{"text_format":"1","workbook":"xlsx","n_sheets":28,"sheets":["Copyright","Terms of Use","Instructions","Dashboard","Business Information","Documentation","Lite","A. Risk Management","B. Security Policy","C. Organizational Security","D. Asset Management","E. Human Resource Security","F. Physical and Environmental","G. Communications and Ops Mgmt","H. Access Control","I. Info Sys AD&M","J. Incident Event & Comm Mgmt","K. BC DR","L. Compliance","M. Mobile","P. Privacy","Q. Software Security","V. Cloud Security","Z. Additional Questions","Glossary","Formula Notes","Full","Drops"],"not_rendered":{"charts":0,"images":18,"macros":1,"external_links":0,"defined_names":78,"comments":2,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Copyright","index":0,"n_rows":12,"n_cols":2,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[null,"Copyright "]
[]
[null,"©Shared Assessments 2014-2015"]
[]
[null,"Documents created under the Shared Assessments Program may be downloaded from the official Shared Assessments Program website at www.sharedassessments.org."]
[]
[null,"While retaining copyrights, the Shared Assessments Program makes specific documents available to members and purchasers for the purpose of conducting self-assessments and third-party security assessments. Licenses for other uses are available from the Shared Assessments. Individuals and organizations should review the terms of use prior to downloading, copying, using or modifying Shared Assessment Program documents."]
[]
[null,"This notice must be included on any copy of the Shared Assessments Program documents, excluding assessors or consultants' reports."]
[]
[null,"The Shared Assessments Program is administered by The Santa Fe Group (www.santa-fe-group.com). Questions about this document and the program should be directed to info@sharedassessments.org. "]

{"sheet":"Terms of Use","index":1,"n_rows":13,"n_cols":2,"rows_kept":13,"cut":false,"hidden":false,"merged":[]}
[]
[null,"Terms of Use"]
[null,"Standardized Information Gathering Questionnaire"]
[null,"The Shared Assessments Program (\"Program\") maintains, promotes and facilitates the use of the  Standardized Information Gathering Questionnaire (\"SIG\") documents."]
[]
[null,"The Shared Assessments Program attaches the following conditions to individuals and organizations downloading, copying and/or using the Program Documents:"]
[]
[null,"·         No modifications may be made to the Program Documents without the express written permission of the Shared Assessments Program and The Santa Fe Group."]
[null,"·         Organizations must notify The Santa Fe Group at sharedassessments@santa-fe-group.com of their reasons for the modifications and make the modifications available to for review and approval as additions and/or modifications to the current version of the documents.  "]
[null,"·         Copyright and all other intellectual property or proprietary rights in any modifications to the Program Documents shall belong exclusively to the Program and The Santa Fe Group."]
[null,"·         Persons downloading the Program Documents who wish to incorporate the AUP and/or SIG into a software product offered for license or sale must first obtain a separate license from the Shared Assessments Program."]
[null,"The Program Documents have been developed as tools for information security, privacy and business continuity compliance. They are based on general information security and privacy laws, regulation, principles, frameworks, audit programs, seal programs and regulatory guidance from various jurisdictions and do not constitute legal advice or an exhaustive list of questions or procedures covering all the information security or privacy laws in the US, or rest of the world, that may apply to a service provider. Each user should consult counsel on a case-by-case basis to ensure compliance with all applicable information security and privacy laws, regulations, policies and standards."]
[null,"THE SHARED ASSESSMENTS PROGRAM DOCUMENTS ARE PROVIDED \"AS IS\" AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ARE DISCLAIMED. IN NO EVENT SHALL THE SANTA FE GROUP, OR THE PROGRAM, ITS SPONSORS OR PROGRAM MEMBERS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THE PROGRAM DOCUMENTS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."]

{"sheet":"Instructions","index":2,"n_rows":43,"n_cols":6,"rows_kept":43,"cut":false,"hidden":false,"merged":[]}
[]
[null,null,null,"Respondent Instructions",null,"Issuer Instructions"]
[null,null,null,"Review the request provided by your client/customer which should provide you with ",null,"We recommend that prior to issuing the SIG you review which sections of the SIG your"]
[null,null,null,"instructions on how to answer the SIG and detail the sections of the SIG you are",null,"vendor should answer based on the type of service(s) they provide. We recommend"]
[null,null,null,"required to complete. In addition your client/customer should provide you with the",null,"that along with the SIG, you notify them of the sections they are required to complete"]
[null,null,null,"scope of services for which to provide answers in the SIG. If you did not receive",null,"and any other information required to accurately complete the SIG (additional"]
[null,null,null,"instructions or scope from your client we recommend you contact them and seek",null,"questions, documents, etc.)."]
[null,null,null,"guidance on how they need the SIG answered and the sections they require you to"]
[null,"The Santa Fe Group",null,"complete. ",null,"Detailed instructions on how to use the SIG are contained in the How To Guide"]
[null,"Standardized Information Gathering (SIG) Questionnaire",null,null,null,"which also includes a Respondent Guide you may want to provide along with the SIG."]
[null,"Version 2015",null,"Primary or parent questions are followed by numbered sub or child questions."]
[null,"Released: January 2015",null,"The SIG has built in automation. Based on your responses, cells will change color",null,"SIG Management Tool (SMT)"]
[null,null,null,"or if Excel macros are enabled child questions may not be displayed. This will reduce",null,"A macros-enabled spreadsheet is provided to Issuers of the SIG to help with"]
[null,"http://www.sharedassessments.org",null,"the number of questions you are required to complete. When you answer No' or 'N/A'",null,"processing service provider responses and managing the transfer of responses"]
[null,"sharedassessments@santa-fe-group.com",null,"to question the cell and all of its related sub-questions will either be hidden and/or",null,"from previous versions of the SIG. If a master SIG is created, the SMT allows for"]
[null,null,null,"the response 'field will change color identifying that question has been answered.",null,"comparisons of all responses in the master SIG to the SIG offered by a service"]
[null,null,null,"The issuer will see only the No or N/A response for the parent and all of it's child",null,"provider. The SMT will also transfer responses and the \"Additional Information\""]
[null,null,null,"questions.",null,"field from previous versions of the SIG. For a full list of functions, please refer"]
[null,null,null,null,null,"to the SMT Functionality tab."]
[null,null,null,"There are two parts to this questionnaire:"]
[null,null,null,"        - SIG Lite",null,"Note: Detailed instructions for the use of the SMT are included in the How To Guide."]
[null,null,null,"        - Detail tabs (A through V)."]
[null,null,null,"The instructions below will help you in the completion of the SIG Lite or full SIG. "]
[null,null,null," ",null,"ATTENTION MAC USERS:"]
[null,null,null,"Full SIG",null,"This document contains functionality (ActiveX) that may not be supported by your system"]
[null,null,null,"1) Complete the \"Business Information\" tab.",null,"This does not prevent your ability to utilize the tool; however, it does limit some of the functionality."]
[null,null,null,"2) Compile the documentation requested on the \"Documentation\" tab.",null,"So in order for you to be able to view and answer the questions in their entirety you must fist"]
[null,null,null,"3) Use the \"Additional Information\" field to provide any pertinent information.",null,"disable the content upon entry of the document. Doing so will allow you the ability to view and answer"]
[null,null,null,"    (An explanation is required for \"N/A\" responses.)",null,"all questions within each tab."]
[null,null,null,"4) Answer the questions in the tab(s) as instructed by the Requestor by selecting"]
[null,null,null,"    Yes, No or N/A from the drop-down menu."]
[]
[null,null,null,"SIG Lite Only"]
[null,null,null,"1) Complete the \"Business Information\" tab."]
[null,null,null,"2) Compile the documentation requested on the \"Documentation\" tab."]
[null,null,null,"3) Answer all of the questions on the \"SIG Lite\" tab by selecting Yes, No or N/A"]
[null,null,null,"from the drop-down menu."]
[null,null,null,"4) Use the \"Additional Information\" field to provide any pertinent information."]
[null,null,null," (An explanation is required for \"N/A\" responses.)"]
[null,null,null,"5) Answer questions on the \"Additional Questions\" tab (tab M) only if additional"]
[null,null,null," questions have been inserted."]
[null,null,null,"6) Note that answers provided in the Lite tab are automatically transferred to the "]
[null,null,null,"corresponding tab in the full SIG avoiding the need to answer those questions again."]

{"sheet":"Dashboard","index":3,"n_rows":34,"n_cols":10,"rows_kept":34,"cut":false,"hidden":false,"merged":[[1,1,1,4],[2,1,6,4]]}
[]
[null,"Dashboard",null,null,null,null,"Tabs","% Comp",null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""}]
[null,"The Dashboard provides you with  a quick and easy reference to determine if the required sections of the SIG have been completed. As questions are answered, either directly or by being pre-filled, the Dashboard will track the completion percentage of each section.",null,null,null,2,"Terms Of Use","N/A"]
[null,null,null,null,null,null,"Business Information",{"$f":"'Business Information'!C2","v":1}]
[null,null,null,null,null,null,"Documentation Request List","N/A"]
[null,null,null,null,null,null,"SIG Lite",{"$f":"Lite!D2","v":1}]
[null,null,null,null,null,null,"A. Risk Management",{"$f":"'A. Risk Management'!D2","v":1}]
[null,null,null,null,null,null,"B. Security Policy",{"$f":"'B. Security Policy'!D2","v":1}]
[null,null,"Response Type",null,null,null,"C. Organizational Security",{"$f":"'C. Organizational Security'!D2","v":1}]
[null,null,"Binary",null,null,null,"D. Asset Management",{"$f":"'D. Asset Management'!D2","v":1}]
[null,null,null,null,null,null,"E. Human Resources Security",{"$f":"'E. Human Resource Security'!D2","v":1}]
[null,null,null,null,null,null,"F. Physical and Environmental",{"$f":"'F. Physical and Environmental'!D2","v":1}]
[null,null,null,null,null,null,"G. Communications and Operations Management",{"$f":"'G. Communications and Ops Mgmt'!D2","v":1}]
[null,null,null,null,null,null,"H. Access Control",{"$f":"'H. Access Control'!D2","v":1}]
[null,null,null,null,null,null,"I. Information Systems Application Development and Maintenance",{"$f":"'I. Info Sys AD&M'!D2","v":1}]
[null,null,null,null,null,null,"J. Incident Event and Communications Management",{"$f":"'J. Incident Event & Comm Mgmt'!D2","v":1}]
[null,null,null,null,null,null,"K. Business Continuity and Disaster Recovery",{"$f":"'K. BC DR'!D2","v":1}]
[null,null,null,null,null,null,"L. Compliance",{"$f":"'L. Compliance'!D2","v":1}]
[null,null,null,null,null,null,"M. Mobile",{"$f":"'M. Mobile'!D2","v":1}]
[null,null,null,null,null,null,"P. Privacy",{"$f":"'P. Privacy'!D2","v":1}]
[null,null,null,null,null,null,"Q. Software Security",{"$f":"'Q. Software Security'!D2","v":1}]
[null,null,null,null,null,null,"V. Cloud Security",{"$f":"'V. Cloud Security'!D2","v":1}]
[null,null,null,null,null,null,"Z. Additional Questions","N/A"]
[null,null,null,null,null,null,"Glossary","N/A"]
[null,null,null,null,null,null,"Formula Notes","N/A"]
[null,null,null,null,null,null,"Full","N/A"]
[null,null,null,null,null,null,"SIG Total",{"$f":"Lite!AH21","v":1}]
[]
[null,null,null,null,null,null,"Response Cell Background Color Coding (All tabs)","Resp"]
[null,null,null,null,null,null,"Response Required (cells with a blue background are editable)"]
[null,null,null,null,null,null,"Yes Response","Yes"]
[null,null,null,null,null,null,"No Response","No"]
[null,null,null,null,null,null,"N/A Response","N/A"]
[null,null,null,null,null,null,"Top of table (no response required)"]

{"sheet":"Business Information","index":4,"n_rows":38,"n_cols":6,"rows_kept":38,"cut":false,"hidden":false,"merged":[]}
[null,"Business Information",null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},"Count","Resp"]
["Serial No",null,{"$f":"IF(E3=0,\"0%\",E3/E2)","v":1},"Percent Complete",{"$f":"COUNTA(E4:E45)","v":32}]
[{"$f":"MAX(A4:A38)","v":4004},"Question/Request",null,"Response",{"$f":"COUNTIF(E4:E45,1)","v":32}]
[2891,"Responder Name",null,"Rusty Faircloth",{"$f":"COUNTA(D4)","v":1},{"$f":"IF(D4=\"Yes\",1,IF(D4=\"No\",2,IF(D4=\"N/A\",3,0)))","v":0}]
[2892,"Responder Job Title",null,"Director of Operations",{"$f":"COUNTA(D5)","v":1},{"$f":"IF(D5=\"Yes\",1,IF(D5=\"No\",2,IF(D5=\"N/A\",3,0)))","v":0}]
[2893,"Responder Contact Information",null,"215-847-5388",{"$f":"COUNTA(D6)","v":1},0]
[3749,"Names and titles/functions of individuals who contributed to this questionnaire",null,"Khushboo Shah (Co-Founder)",{"$f":"COUNTA(D7)","v":1},0]
[2894,"Date of Response",null,"2017-02-01",{"$f":"COUNTA(D8)","v":1},0]
[null,"Company Profile",null,null,null,0]
[2896,"Name of the holding or parent company",null,"None",{"$f":"COUNTA(D10)","v":1},0]
[2897,"Company/business name",null,"Cloudamize",1,0]
[2898,"Publicly or privately held company",null,"Privately held",1,0]
[2899,"If public, what is the name of the Exchange",null,null,{"$f":"IF(D12=\"Privately held\",1,COUNTA(D13))","v":1},0]
[2900,"If public, what is the trading symbol",null,null,{"$f":"IF(D12=\"Privately held\",1,COUNTA(D14))","v":1},0]
[2901,"Type of legal entity and state of incorporation",null,"S Corp",1,0]
[2902,"How long has the company been in business",null,"4 years",1,0]
[2903,"Are there any material claims or judgments against the company",null,"No",1,2]
[2904," If yes, describe the impact it may have on the services in scope of this document",null,null,{"$f":"IF(D17=\"No\",1,COUNTA(D18))","v":1},0]
[4000,"Has your company suffered a data loss or security breach within the last 3 years?",null,"No",1,2]
[4001,"If yes, please describe the loss or breach.",null,null,{"$f":"IF(D19=\"No\",1,COUNTA(D20))","v":1},0]
[4002,"Has any of your Third Party Vendors suffered a data loss or security breach within the last 3 years?",null,"No",1,2]
[4003,"If yes, please describe the loss or breach.",null,null,{"$f":"IF(D21=\"No\",1,COUNTA(D22))","v":1},0]
[null,"Scope\nPlease provide the below responses to establish the scope of the SIG",null,null,null,0]
[2911,"Are the answers in this questionnaire for only one facility or geographic location? If yes, provide description of physical location (address, city, state, country). ",null,"Yes 1735 Market Street Suite 2502 Philadelphia PA 19103",{"$f":"COUNTA(D24)","v":1},0]
[2912,"Backup site physical address",null,"No",{"$f":"COUNTA(D25)","v":1},2]
[2913,"Any additional locations where Scoped Systems and Data is stored",null,"Yes",{"$f":"COUNTA(D26)","v":1},1]
[2914," If yes, provide locations (address, city, state, country).",null,"Production workloads maintained in AWS, Azure and GCP",{"$f":"IF(D26=\"No\",1,COUNTA(D27))","v":1},0]
[2973,"Are the answers to this questionnaire for only one specific type of service? If yes, describe the service.",null,"Yes. Cloudamize is a data and analytics platform to support cloud migrations and cloud infrastructure management",{"$f":"COUNTA(D28)","v":1},0]
[3919,"Is software provided?",null,"Yes",{"$f":"COUNTA(D29)","v":1},1]
[3992,"List the applications provided that are in scope.",null,"Cloudamize Plan",{"$f":"IF($D$29=\"No\",1,COUNTA(D30))","v":1},0]
[3993,"Identify the applications which are covered by the secure software development lifecycle.",null,"All Cloudamize applications are covered by SSDLC",{"$f":"IF($D$29=\"No\",1,COUNTA(D31))","v":1},0]
[3994,"What type of software is being provided, select all that apply?",null,null,null,0]
[3995,"Commercial Off-The-Shelf (COTS)",null,"Yes",{"$f":"IF($D$29=\"No\",1,COUNTA(D33))","v":1},1]
[3996,"Custom Developed",null,"No",1,2]
[3997,"Cloud ",null,"Yes",1,1]
[3998,"Mobile",null,"No",1,2]
[4004,"Open Source Software",null,"No",1,{"$f":"IF(D37=\"Yes\",1,IF(D37=\"No\",2,IF(D37=\"N/A\",3,0)))","v":2}]
[3999,"Other",null,"No",1,2]

{"sheet":"Documentation","index":5,"n_rows":32,"n_cols":4,"rows_kept":32,"cut":false,"hidden":false,"merged":[]}
["Serial No","Documentation*\nUse this section to request any specific documentation you want the Respondent to provide along with the SIG",null,{"$f":"Master","v":0}]
[{"$f":"MAX(A3:A32)","v":4006},"Document Request","Question Reference","Name and/or type of information provided (e.g., document, summary, table of contents)"]
[2922,"* Information Security Policies and Procedures. This should include the following (if not, provide the individual documents as necessary):\na) Hiring policies and practices and employment application\nb) User Account administration policy and procedures for all supported platforms where Scoped Systems and Data are processed and network/LAN access.\nc) Supporting documentation to indicate completion of User Entitlement reviews\nd) Employee Non-disclosure agreement document\ne) Information Security Incident Report policy and procedures, including all contract information\nf) Copy of Visitor Policy and procedures\ng) Security Log Review Policies and Procedures\nh) Copy of third party risk management policies and procedures"]
[2923,"* Copy of internal or external information security audit report"]
[2924,"Information technology and security organization charts (including where Respondent information security resides and the composition of any information security steering committees).\nNote: Actual names of employees are not required"]
[2925,"* Physical Security policy and procedures (building and/or restricted access)"]
[2926,"* Third-party security reviews/assessments/penetration tests "]
[2927,"Legal clauses and confidentiality templates for third parties"]
[2928,"Topics covered in the security training program"]
[2929,"* Security incident handling and reporting process"]
[2930,"Network configuration diagrams for internal and external networks defined in scope. Note: Sanitized versions of the network diagram are acceptable"]
[2931,"* System and network configuration standards"]
[2932,"* System backup policy and procedures"]
[2933,"* Offsite storage policy and procedures"]
[2934,"* Vulnerability and threat management scan policy and procedures"]
[2935,"* Application security policy"]
[2936,"* Change control policy/procedures"]
[2937,"* Problem management policy/procedures"]
[2938,"* Certification of proprietary encryption algorithms"]
[2939,"* Internal vulnerability assessments of systems, applications, and networks"]
[2940,"* Software development and lifecycle (SDLC) process document"]
[2941,"* Business continuity plan (BCP) and / or Disaster recovery plan"]
[2942,"* Most recent BCP/DR test dates and results"]
[2943,"* Most recent SSAE16 audit report"]
[3301,"* Privacy policies (internal, external, web)"]
[4005,"* Executive Summary of certificates held. (e.g. PCI, HIPPA, ISO)"]
[4006,"* Performance Reports against contracted SLAs"]
[]
[]
[]
[]
[null,"*If the Respondent policy prohibits the distribution of any of these documents, please provide the document title, the table of contents, the executive summary, revision history, and evidence of approval."]

{"sheet":"Lite","index":6,"n_rows":143,"n_cols":34,"rows_kept":143,"cut":false,"hidden":false,"merged":[[2,1,2,7]]}
[10,"SIG Lite",null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,null,"Binary",null,null,null,"SL"]
[null,null,null,{"$f":"IF(SUM(AD5:AD20)/SUM(AC5:AC20)=0,\"0%\",SUM(AD5:AD20)/SUM(AC5:AC20))","v":1},"Percent Complete"]
["Detail SN","Questionnaire Instructions: 577 9001\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory. Use the Additional Information Field in column E to provide.",null,null,null,null,null,null,"Q depth","Detail Letter","Q # Calc","Sec Num",null,null,null,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc",null,"Filter","Sec Calc",null,null,"Optional\nScoring","Section","Q per Sec","1 & 2 count","Total Ques","Quest ans","Elements","Max Rows"]
[{"$f":"MAX(A5:A143)","v":3920},"Ques Num"," Question/Request","Response","Additional Information","AUP Reference","ISO Ref Num","ISO Ref Text"]
[null,null,{"$f":"'A. Risk Management'!B1","v":"A. Risk Assessment and Treatment"},null,null,null,null,null,null,1,null,{"$f":"IF(I5=\"\",L4+1,L4)","v":1},null,null,null,{"$f":"IF(ISNA(VLOOKUP(A5,BusInfoArray,6,FALSE)),0,VLOOKUP(A5,BusInfoArray,6,FALSE))","v":0},{"$f":"IF(I5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D5=\"Yes\"),AND($L$1=\"Scaled\",D5>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D5=\"No\"),AND($L$1=\"Scaled\",D5<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":""},{"$f":"IF(I5=\"\",\"\",IF(P5>0,P5,IF(Q5>0,Q5,0)))","v":""},null,{"$f":"IF(I5=\"\",T4,IF(AND(R5>1,OR(T4=\"\",T4=0,T4>=I5)),I5,IF(I5>T4,T4,0)))","v":0},{"$f":"IF(Master=\"Master\",Q5,IF(U4=\"\",R5,IF(OR(AND(T5>0,R5<U4),AND(T5=1,R5<=U4)),U4,R5)))","v":""},null,{"$f":"IF(AND(I5=1,R5=1),2,IF(AND(U4=1,L5=L4),2,IF(AND(W4=2,L5=L4),2,IF(OR(I5=1,I5=\"\"),1,\"\"))))","v":1},null,null,null,null,"A",{"$f":"COUNTIF($J$5:$J$143,AB5)","v":1},{"$f":"SUMPRODUCT(($X$5:$X$143)*($J$5:$J$143=AB5))","v":1},{"$f":"'A. Risk Management'!S2","v":14},{"$f":"'A. Risk Management'!W2","v":14},{"$f":"'A. Risk Management'!I2","v":14},50]
[3198,{"$f":"IF(A6=\"\",\"\",$P$1&\".\"&K6)","v":"SL.1"},"Is there a risk assessment program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the program?","Yes","Cloudamize Security Policy - Cloudamize Risk Assessment Plan","A.1 IT & Infrastructure Risk Governance and Context","5.1                                            6.1.2","Leadership & Commitment,                Information Security Risk Assessment",1,"A",{"$f":"IF(A6=\"\",K5,K5+1)","v":1},{"$f":"IF(I6=\"\",L5+1,L5)","v":1},null,null,null,{"$f":"IF(ISNA(VLOOKUP(A6,BusInfoArray,6,FALSE)),0,VLOOKUP(A6,BusInfoArray,6,FALSE))","v":0},{"$f":"IF(I6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D6=\"Yes\"),AND($L$1=\"Scaled\",D6>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D6=\"No\"),AND($L$1=\"Scaled\",D6<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I6=\"\",\"\",IF(P6>0,P6,IF(Q6>0,Q6,0)))","v":1},null,{"$f":"IF(I6=\"\",T5,IF(AND(R6>1,OR(T5=\"\",T5=0,T5>=I6)),I6,IF(I6>T5,T5,0)))","v":0},{"$f":"IF(Master=\"Master\",Q6,IF(U5=\"\",R6,IF(OR(AND(T6>0,R6<U5),AND(T6=1,R6<=U5)),U5,R6)))","v":1},null,{"$f":"IF(AND(I6=1,R6=1),2,IF(AND(U5=1,L6=L5),2,IF(AND(W5=2,L6=L5),2,IF(OR(I6=1,I6=\"\"),1,\"\"))))","v":2},{"$f":"IF(U6>0,1,0)","v":1},null,null,null,"B",3,3,{"$f":"'B. Security Policy'!S2","v":58},{"$f":"'B. Security Policy'!W2","v":58},{"$f":"'B. Security Policy'!I2","v":58},75]
[null,"",{"$f":"'B. Security Policy'!B1","v":"B. Security Policy"},null,null,null,null,null,null,1,{"$f":"IF(A7=\"\",K6,K6+1)","v":1},{"$f":"IF(I7=\"\",L6+1,L6)","v":2},null,null,null,{"$f":"IF(ISNA(VLOOKUP(A7,BusInfoArray,6,FALSE)),0,VLOOKUP(A7,BusInfoArray,6,FALSE))","v":0},{"$f":"IF(I7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D7=\"Yes\"),AND($L$1=\"Scaled\",D7>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D7=\"No\"),AND($L$1=\"Scaled\",D7<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":""},{"$f":"IF(I7=\"\",\"\",IF(P7>0,P7,IF(Q7>0,Q7,0)))","v":""},null,{"$f":"IF(I7=\"\",T6,IF(AND(R7>1,OR(T6=\"\",T6=0,T6>=I7)),I7,IF(I7>T6,T6,0)))","v":0},{"$f":"IF(Master=\"Master\",Q7,IF(U6=\"\",R7,IF(OR(AND(T7>0,R7<U6),AND(T7=1,R7<=U6)),U6,R7)))","v":""},null,{"$f":"IF(AND(I7=1,R7=1),2,IF(AND(U6=1,L7=L6),2,IF(AND(W6=2,L7=L6),2,IF(OR(I7=1,I7=\"\"),1,\"\"))))","v":1},{"$f":"IF(U7>0,1,0)","v":1},null,null,null,"C",2,2,{"$f":"'C. Organizational Security'!S2","v":56},{"$f":"'C. Organizational Security'!W2","v":56},{"$f":"'C. Organizational Security'!I2","v":56},75]
[3199,"SL.2","Is there an information security policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","B.1 Information Security Policy Content & Maintenance","5.1.1","Policies for information security",1,"B",2,2,null,null,null,0,{"$f":"IF(I8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D8=\"Yes\"),AND($L$1=\"Scaled\",D8>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D8=\"No\"),AND($L$1=\"Scaled\",D8<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1,null,null,null,"D",2,2,{"$f":"'D. Asset Management'!S2","v":32},{"$f":"'D. Asset Management'!W2","v":32},{"$f":"'D. Asset Management'!I2","v":32},50]
[2471,"SL.3","Have the policies been reviewed in the last 12 months?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","B.1 Procedure: d","5.1.2","Review of the policies for information security",1,"B",3,2,null,null,null,0,{"$f":"IF(I9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D9=\"Yes\"),AND($L$1=\"Scaled\",D9>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D9=\"No\"),AND($L$1=\"Scaled\",D9<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1,null,null,null,"E",6,6,{"$f":"'E. Human Resource Security'!S2","v":44},{"$f":"'E. Human Resource Security'!W2","v":44},{"$f":"'E. Human Resource Security'!I2","v":45},75]
[3886,"SL.4","Is there a vendor management program?","No",null,null,null,null,1,"B",4,2,null,null,null,0,{"$f":"IF(I10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D10=\"Yes\"),AND($L$1=\"Scaled\",D10>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D10=\"No\"),AND($L$1=\"Scaled\",D10<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,null,1,2,null,2,1,null,null,null,"F",3,3,{"$f":"'F. Physical and Environmental'!S2","v":119},{"$f":"'F. Physical and Environmental'!W2","v":119},{"$f":"'F. Physical and Environmental'!I2","v":132},150]
[null,"",{"$f":"'C. Organizational Security'!B1","v":"C. Organizational Security"},null,null,null,null,null,null,1,4,3,null,null,null,0,{"$f":"IF(I11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D11=\"Yes\"),AND($L$1=\"Scaled\",D11>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D11=\"No\"),AND($L$1=\"Scaled\",D11<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":""},"",null,1,"",null,1,1,null,null,null,"G",12,12,{"$f":"'G. Communications and Ops Mgmt'!S2","v":265},{"$f":"'G. Communications and Ops Mgmt'!W2","v":265},{"$f":"'G. Communications and Ops Mgmt'!I2","v":289},325]
[58,"SL.5","Is there a respondent information security function responsible for security initiatives?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group","C.3 Security Organization Roles/Responsibilities","6.1.1","Information Security Roles and Responsibilities",1,"C",5,3,null,null,null,0,{"$f":"IF(I12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D12=\"Yes\"),AND($L$1=\"Scaled\",D12>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D12=\"No\"),AND($L$1=\"Scaled\",D12<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1,null,null,null,"H",4,4,{"$f":"'H. Access Control'!S2","v":52},{"$f":"'H. Access Control'!W2","v":52},{"$f":"'H. Access Control'!I2","v":55},75]
[71,"SL.6","Do external parties have access to Scoped Systems and Data or processing facilities?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy",null,15,"Supplier relationships",1,"C",6,3,null,null,null,0,{"$f":"IF(I13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D13=\"Yes\"),AND($L$1=\"Scaled\",D13>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D13=\"No\"),AND($L$1=\"Scaled\",D13<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1,null,null,null,"I",7,7,{"$f":"'I. Info Sys AD&M'!S2","v":95},{"$f":"'I. Info Sys AD&M'!W2","v":95},{"$f":"'I. Info Sys AD&M'!I2","v":95},100]
[null,"",{"$f":"'D. Asset Management'!B1","v":"D. Asset Management"},null,null,null,null,null,null,1,6,4,null,null,null,0,{"$f":"IF(I14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D14=\"Yes\"),AND($L$1=\"Scaled\",D14>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D14=\"No\"),AND($L$1=\"Scaled\",D14<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1,null,null,null,"J",1,1,{"$f":"'J. Incident Event & Comm Mgmt'!S2","v":32},{"$f":"'J. Incident Event & Comm Mgmt'!W2","v":32},{"$f":"'J. Incident Event & Comm Mgmt'!I2","v":41},75]
[3200,"SL.7","Is there an asset management policy or program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy","D. Assessment Management",8.1,"Responsibility For Assets",1,"D",7,4,null,null,null,0,{"$f":"IF(I15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D15=\"Yes\"),AND($L$1=\"Scaled\",D15>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D15=\"No\"),AND($L$1=\"Scaled\",D15<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1,null,null,null,"K",6,6,{"$f":"'K. BC DR'!S2","v":61},{"$f":"'K. BC DR'!W2","v":61},{"$f":"'K. BC DR'!I2","v":61},75]
[2532,"SL.8","Are information assets classified?","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy","D.1.c.6","8.2.1","Classification of Information",1,"D",8,4,null,null,null,0,{"$f":"IF(I16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D16=\"Yes\"),AND($L$1=\"Scaled\",D16>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D16=\"No\"),AND($L$1=\"Scaled\",D16<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1,null,null,null,"L",2,2,{"$f":"'L. Compliance'!S2","v":13},{"$f":"'L. Compliance'!W2","v":13},{"$f":"'L. Compliance'!I2","v":13},25]
[null,"",{"$f":"'E. Human Resource Security'!B1","v":"E. Human Resource Security"},null,null,null,null,null,null,1,8,5,null,null,null,0,{"$f":"IF(I17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D17=\"Yes\"),AND($L$1=\"Scaled\",D17>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D17=\"No\"),AND($L$1=\"Scaled\",D17<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1,null,null,null,"M",1,1,{"$f":"'M. Mobile'!S2","v":105},{"$f":"'M. Mobile'!W2","v":105},{"$f":"'M. Mobile'!I2","v":114},25]
[2536,"SL.9","Are security roles and responsibilities of constituents defined and documented in accordance with the respondent’s information security policy?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group","C.3 Security Organization Roles/Responsibilities","6.1.1","Information security roles and responsibilities",1,"E",9,5,null,null,null,0,{"$f":"IF(I18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D18=\"Yes\"),AND($L$1=\"Scaled\",D18>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D18=\"No\"),AND($L$1=\"Scaled\",D18<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1,null,null,null,"P",22,22,{"$f":"'P. Privacy'!S2","v":50},{"$f":"'P. Privacy'!W2","v":50},{"$f":"'P. Privacy'!I2","v":50},75]
[2538,"SL.10","Is a background screening performed prior to allowing constituent access to Scoped Systems and Data?","No",null,"E.3 Background Investigation Policy Content","7.1.1","Screening",1,"E",10,5,null,null,null,0,{"$f":"IF(I19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D19=\"Yes\"),AND($L$1=\"Scaled\",D19>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D19=\"No\"),AND($L$1=\"Scaled\",D19<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,null,1,2,null,2,1,null,null,null,"Q",2,2,{"$f":"'Q. Software Security'!S2","v":73},{"$f":"'Q. Software Security'!W2","v":73},{"$f":"'Q. Software Security'!I2","v":73}]
[183,"SL.11","Are new hires required to sign any agreements upon hire?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy",null,"7.1.2","Terms and conditions of employment",1,"E",11,5,null,null,null,0,{"$f":"IF(I20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D20=\"Yes\"),AND($L$1=\"Scaled\",D20>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D20=\"No\"),AND($L$1=\"Scaled\",D20<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1,null,null,null,"V",49,49,{"$f":"'V. Cloud Security'!U2","v":323},{"$f":"'V. Cloud Security'!Y2","v":323},{"$f":"'V. Cloud Security'!K2","v":378},450]
[212,"SL.12","Is there a security awareness training program?","Yes","Cloudamize Security Policy - Cloudamize Security Training & Maintenance Policy","E.1 Security Awareness Training Attendance","7.2.2","Information security awareness, education, and training",1,"E",12,5,null,null,null,0,{"$f":"IF(I21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D21=\"Yes\"),AND($L$1=\"Scaled\",D21>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D21=\"No\"),AND($L$1=\"Scaled\",D21<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1,null,null,null,null,null,null,{"$f":"SUM(AE5:AE20)","v":1392},{"$f":"SUM(AF5:AF20)","v":1392},{"$f":"SUM(AG5:AG20)","v":1506},{"$f":"IF(AF21/AE21=0,\"0%\",AF21/AE21)","v":1}]
[293,"SL.13","Is there a disciplinarily process for non-compliance with information security policies?","Yes","Cloudamize Security Policy - Cloudamize Information Secuirty Policy - Non-Compliance",null,"7.2.3","Disciplinary process",1,"E",13,5,null,null,null,0,{"$f":"IF(I22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D22=\"Yes\"),AND($L$1=\"Scaled\",D22>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D22=\"No\"),AND($L$1=\"Scaled\",D22<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[2557,"SL.14","Is there a constituent termination or change of status process?","Yes","Cloudamize Security Policy - Cloudamize Information Secuirty Policy - Non-Compliance","H.2 Revoke System Access",7.3,"Termination responsibilities",1,"E",14,5,null,null,null,0,{"$f":"IF(I23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D23=\"Yes\"),AND($L$1=\"Scaled\",D23>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D23=\"No\"),AND($L$1=\"Scaled\",D23<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[null,"",{"$f":"'F. Physical and Environmental'!B1","v":"F. Physical and Environmental Security"},null,null,null,null,null,null,1,14,6,null,null,null,0,{"$f":"IF(I24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D24=\"Yes\"),AND($L$1=\"Scaled\",D24>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D24=\"No\"),AND($L$1=\"Scaled\",D24<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1]
[2559,"SL.15","Is there a physical security program?","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy",null,"5.1.1","Policies for information security",1,"F",15,6,null,null,null,0,{"$f":"IF(I25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D25=\"Yes\"),AND($L$1=\"Scaled\",D25>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D25=\"No\"),AND($L$1=\"Scaled\",D25<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[2560,"SL.16","Are reasonable physical security and environmental controls present in the building/data center that contains Scoped Systems and Data?","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy / 1735 Market St Building Security Plan","F. Physical and Environmental Security",11.1,"Secure areas",1,"F",16,6,null,null,null,0,{"$f":"IF(I26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D26=\"Yes\"),AND($L$1=\"Scaled\",D26>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D26=\"No\"),AND($L$1=\"Scaled\",D26<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[396,"SL.17","Are visitors permitted in the facility?","Yes","1735 Market St Building Security Plan",null,"11.1.2 ","Physical entry controls",1,"F",17,6,null,null,null,0,{"$f":"IF(I27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D27=\"Yes\"),AND($L$1=\"Scaled\",D27>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D27=\"No\"),AND($L$1=\"Scaled\",D27<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[null,"",{"$f":"'G. Communications and Ops Mgmt'!B1","v":"G. Communications and Operations Management"},null,null,null,null,null,null,1,17,7,null,null,null,0,{"$f":"IF(I28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D28=\"Yes\"),AND($L$1=\"Scaled\",D28>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D28=\"No\"),AND($L$1=\"Scaled\",D28<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1]
[2582,"SL.18","Are Management approved operating procedures utilized?","Yes","Cloudamize Security Policy","G. Communications and Operations Management","12.1.1","Documented Operating Procedure",1,"G",18,7,null,null,null,0,{"$f":"IF(I29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D29=\"Yes\"),AND($L$1=\"Scaled\",D29>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D29=\"No\"),AND($L$1=\"Scaled\",D29<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[816,"SL.19","Is there an operational change management / change control policy or program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group","G.21 Change Control","12.1.2","Change Management",1,"G",19,7,null,null,null,0,{"$f":"IF(I30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D30=\"Yes\"),AND($L$1=\"Scaled\",D30>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D30=\"No\"),AND($L$1=\"Scaled\",D30<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[853,"SL.20","Do third party vendors have access to Scoped Systems and Data? (backup vendors, service providers, equipment support maintenance, software maintenance vendors, data recovery vendors, etc.)?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,15,"Supplier relationships",1,"G",20,7,null,null,null,0,{"$f":"IF(I31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D31=\"Yes\"),AND($L$1=\"Scaled\",D31>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D31=\"No\"),AND($L$1=\"Scaled\",D31<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[895,"SL.21","Is there an anti-virus / malware policy or program (workstations, servers, mobile devices) that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?","Yes","Cloudamize Security Policy - Cloudamize Personnel Acceptable Use Policy","G.7 Virus Protection (Servers), G.8 Virus Protection (Workstations)","12.2.1","Controls Against Malware",1,"G",21,7,null,null,null,0,{"$f":"IF(I32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D32=\"Yes\"),AND($L$1=\"Scaled\",D32>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D32=\"No\"),AND($L$1=\"Scaled\",D32<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[922,"SL.22","Are system backups of Scoped Systems and Data performed?","Yes",null,"G.20 Backup Media Restoration","12.3.1","Information Back-Up",1,"G",22,7,null,null,null,0,{"$f":"IF(I33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D33=\"Yes\"),AND($L$1=\"Scaled\",D33>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D33=\"No\"),AND($L$1=\"Scaled\",D33<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[3688,"SL.23","Are firewalls in use for both internal and external connections?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud","G.2 Network Security – Firewall(s)","13.1.3","Segregation in networks",1,"G",23,7,null,null,null,0,{"$f":"IF(I34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D34=\"Yes\"),AND($L$1=\"Scaled\",D34>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D34=\"No\"),AND($L$1=\"Scaled\",D34<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[3706,"SL.24","Are vulnerability assessments, scans or penetration tests performed on internal or external networks?","Yes","Cloudamize Security Policy - Cloudamize Risk Assessment Plan","L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1","Control of technical vulnerabilities",1,"G",24,7,null,null,null,0,{"$f":"IF(I35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D35=\"Yes\"),AND($L$1=\"Scaled\",D35>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D35=\"No\"),AND($L$1=\"Scaled\",D35<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[975,"SL.25","Are there external network connections (Internet, intranet, extranet, etc.)?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy",null,"13.1.1","Network Controls",1,"G",25,7,null,null,null,0,{"$f":"IF(I36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D36=\"Yes\"),AND($L$1=\"Scaled\",D36>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D36=\"No\"),AND($L$1=\"Scaled\",D36<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[1095,"SL.26","Is wireless networking technology used?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Local Office","G.17 Unapproved Wireless Networks","13.1.1.c","Network Controls",1,"G",26,7,null,null,null,0,{"$f":"IF(I37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D37=\"Yes\"),AND($L$1=\"Scaled\",D37>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D37=\"No\"),AND($L$1=\"Scaled\",D37<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[3295,"SL.27","Is there a removable media policy or program (CDs, DVDs, tapes, disk drives) that has been approved by management, communicated to appropriate constituents, and an owner to maintain and review the policy?","Yes","Cloudamize Security Policy - Cloudamize Removable Media Policy","G.15 Physical Media Tracking","8.3.1","Management Of Removable Media",1,"G",27,7,null,null,null,0,{"$f":"IF(I38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D38=\"Yes\"),AND($L$1=\"Scaled\",D38>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D38=\"No\"),AND($L$1=\"Scaled\",D38<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[1208,"SL.28","Is Scoped Data sent or received electronically or via physical media?","Yes","Cloudamize Security Policy","G.4 Network Management – Encrypted Authentication Credentials","8.3.3","Physical media in transit",1,"G",28,7,null,null,null,0,{"$f":"IF(I39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D39=\"Yes\"),AND($L$1=\"Scaled\",D39>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D39=\"No\"),AND($L$1=\"Scaled\",D39<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[1770,"SL.29","Are Web services provided?","Yes","Cloudamize Security Policy - Cloudamize Privacy Policy (Website Only)",null,"N/A","",1,"G",29,7,null,null,null,0,{"$f":"IF(I40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D40=\"Yes\"),AND($L$1=\"Scaled\",D40>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D40=\"No\"),AND($L$1=\"Scaled\",D40<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[null,"",{"$f":"'H. Access Control'!B1","v":"H. Access Control"},null,null,null,null,null,null,1,29,8,null,null,null,0,{"$f":"IF(I41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D41=\"Yes\"),AND($L$1=\"Scaled\",D41>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D41=\"No\"),AND($L$1=\"Scaled\",D41<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1]
[1998,"SL.30","Are electronic systems used to transmit, process or store Scoped Systems and Data?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy",null,"N/A","",1,"H",30,8,null,null,null,0,{"$f":"IF(I42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D42=\"Yes\"),AND($L$1=\"Scaled\",D42>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D42=\"No\"),AND($L$1=\"Scaled\",D42<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[1911,"SL.31","Are unique user IDs used for access?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy",null,"9.2.1.a","User registration and de-registration",1,"H",31,8,null,null,null,0,{"$f":"IF(I43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D43=\"Yes\"),AND($L$1=\"Scaled\",D43>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D43=\"No\"),AND($L$1=\"Scaled\",D43<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[1948,"SL.32","Are passwords required to access systems transmitting, processing or storing Scoped Systems and Data?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","H.1 Access Controls","9.4.3","Password Management System",1,"H",32,8,null,null,null,0,{"$f":"IF(I44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D44=\"Yes\"),AND($L$1=\"Scaled\",D44>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D44=\"No\"),AND($L$1=\"Scaled\",D44<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[2028,"SL.33","Is remote access permitted?","No","All scoped data is only accessed utilizing Cloudamize issues equipment. No VPN applications are utilized. ",null,6.2,"Mobile devices and teleworking",1,"H",33,8,null,null,null,0,{"$f":"IF(I45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D45=\"Yes\"),AND($L$1=\"Scaled\",D45>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D45=\"No\"),AND($L$1=\"Scaled\",D45<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,null,1,2,null,2,1]
[null,"",{"$f":"'I. Info Sys AD&M'!B1","v":"I. Information Systems Acquisition Development & Maintenance"},null,null,null,null,null,null,1,33,9,null,null,null,0,{"$f":"IF(I46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D46=\"Yes\"),AND($L$1=\"Scaled\",D46>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D46=\"No\"),AND($L$1=\"Scaled\",D46<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":""},"",null,1,"",null,1,1]
[2665,"SL.34","Are business information systems used to transmit, process or store Scoped Systems and Data?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,14.1,"Security requirements of information systems",1,"I",34,9,null,null,null,0,{"$f":"IF(I47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D47=\"Yes\"),AND($L$1=\"Scaled\",D47>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D47=\"No\"),AND($L$1=\"Scaled\",D47<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[2058,"SL.35","Is application development performed?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.2.1","Secure development policy",1,"I",35,9,null,null,null,0,{"$f":"IF(I48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D48=\"Yes\"),AND($L$1=\"Scaled\",D48>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D48=\"No\"),AND($L$1=\"Scaled\",D48<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[2059,"SL.36","Is there a formal Software Development Life Cycle (SDLC) process?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","I.7 Application Security SDLC Phases","14.2.1 ","Secure development policy",1,"I",36,9,null,null,null,0,{"$f":"IF(I49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D49=\"Yes\"),AND($L$1=\"Scaled\",D49>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D49=\"No\"),AND($L$1=\"Scaled\",D49<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[2213,"SL.37","Are systems and applications patched?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","I.4 System Patching","12.6.1 ","Management of technical vulnerabilities",1,"I",37,9,null,null,null,0,{"$f":"IF(I50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D50=\"Yes\"),AND($L$1=\"Scaled\",D50>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D50=\"No\"),AND($L$1=\"Scaled\",D50<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[2230,"SL.38","Is a web site supported, hosted or maintained that has access to Scoped Systems and Data?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"N/A",null,1,"I",38,9,null,null,null,0,{"$f":"IF(I51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D51=\"Yes\"),AND($L$1=\"Scaled\",D51>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D51=\"No\"),AND($L$1=\"Scaled\",D51<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[2225,"SL.39","Are vulnerability tests (internal/external) performed on all applications at least annually?","Yes","Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)","I.1 Application Vulnerability Assessments/Ethical Hacking","18.2.3","Technical compliance review",1,"I",39,9,null,null,null,0,{"$f":"IF(I52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D52=\"Yes\"),AND($L$1=\"Scaled\",D52>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D52=\"No\"),AND($L$1=\"Scaled\",D52<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[1806,"SL.40","Are encryption tools managed and maintained for Scoped Data?","Yes","Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)","G.22 Data Security Policy - Encryption",10.1,"Cytographic controls",1,"I",40,9,null,null,null,0,{"$f":"IF(I53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D53=\"Yes\"),AND($L$1=\"Scaled\",D53>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D53=\"No\"),AND($L$1=\"Scaled\",D53<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[null,"",{"$f":"'J. Incident Event & Comm Mgmt'!B1","v":"J. Incident Event and Communications Management"},null,null,null,null,null,null,1,40,10,null,null,null,0,{"$f":"IF(I54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D54=\"Yes\"),AND($L$1=\"Scaled\",D54>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D54=\"No\"),AND($L$1=\"Scaled\",D54<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1]
[2241,"SL.41","Is there an Incident Management program?","Yes","Cloudamize Security Policy - Cloudamize Incident Management Policy",null,16," Information security incident management",1,"J",41,10,null,null,null,0,{"$f":"IF(I55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D55=\"Yes\"),AND($L$1=\"Scaled\",D55>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D55=\"No\"),AND($L$1=\"Scaled\",D55<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[null,"",{"$f":"'K. BC DR'!B1","v":"K. Business Continuity and Disaster Recovery"},null,null,null,null,null,null,1,41,11,null,null,null,0,{"$f":"IF(I56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D56=\"Yes\"),AND($L$1=\"Scaled\",D56>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D56=\"No\"),AND($L$1=\"Scaled\",D56<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1]
[2281,"SL.42","Is there a documented policy for business continuity and disaster recovery that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan","B.1 Information Security Policy Content",17.100000000000001,"Information security continuity",1,"K",42,11,null,null,null,0,{"$f":"IF(I57=\"\",\"\",IF(D57=\"\",0,IF(D57=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D57=\"Yes\"),AND($L$1=\"Scaled\",D57>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D57=\"No\"),AND($L$1=\"Scaled\",D57<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[2343,"SL.43","Is there an annual schedule of required tests?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.3","Verify, review and evaluate information security continuity",1,"K",43,11,null,null,null,0,{"$f":"IF(I58=\"\",\"\",IF(D58=\"\",0,IF(D58=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D58=\"Yes\"),AND($L$1=\"Scaled\",D58>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D58=\"No\"),AND($L$1=\"Scaled\",D58<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[2779,"SL.44","Are BC/DR tests conducted at least annually?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.3","Verify, review and evaluate information security continuity",1,"K",44,11,null,null,null,0,{"$f":"IF(I59=\"\",\"\",IF(D59=\"\",0,IF(D59=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D59=\"Yes\"),AND($L$1=\"Scaled\",D59>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D59=\"No\"),AND($L$1=\"Scaled\",D59<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[2305,"SL.45","Is there a Pandemic Plan?","No",null,null,"N/A",null,1,"K",45,11,null,null,null,0,{"$f":"IF(I60=\"\",\"\",IF(D60=\"\",0,IF(D60=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D60=\"Yes\"),AND($L$1=\"Scaled\",D60>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D60=\"No\"),AND($L$1=\"Scaled\",D60<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,null,1,2,null,2,1]
[2329,"SL.46","Is a Business Impact Analysis conducted at least annually?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan","K.1 Business Impact Analysis","17.1.1 ","Planning information security continuity",1,"K",46,11,null,null,null,0,{"$f":"IF(I61=\"\",\"\",IF(D61=\"\",0,IF(D61=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D61=\"Yes\"),AND($L$1=\"Scaled\",D61>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D61=\"No\"),AND($L$1=\"Scaled\",D61<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[2365,"SL.47","Is there insurance coverage for business interruptions or general services interruption?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan","K.4 Business Insurance","14.1.1.d","Including Information Security In The Business Continuity Management Process",1,"K",47,11,null,null,null,0,{"$f":"IF(I62=\"\",\"\",IF(D62=\"\",0,IF(D62=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D62=\"Yes\"),AND($L$1=\"Scaled\",D62>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D62=\"No\"),AND($L$1=\"Scaled\",D62<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[null,"",{"$f":"'L. Compliance'!B1","v":"L. Compliance"},null,null,null,null,null,null,1,47,12,null,null,null,0,{"$f":"IF(I63=\"\",\"\",IF(D63=\"\",0,IF(D63=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D63=\"Yes\"),AND($L$1=\"Scaled\",D63>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D63=\"No\"),AND($L$1=\"Scaled\",D63<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1,null,null,null,"M",{"$f":"COUNTIF($J$5:$J$143,AB63)","v":1},{"$f":"SUMPRODUCT(($X$5:$X$143)*($J$5:$J$143=AB63))","v":1},{"$f":"'M. Mobile'!S2","v":105},{"$f":"'M. Mobile'!W2","v":105},{"$f":"'M. Mobile'!I2","v":114},25]
[2826,"SL.48","Is there an internal audit, risk management or compliance department with responsibility for identifying and tracking resolution of outstanding regulatory issues?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"18.1.1 ","Identification of applicable legislation and contractual requirements",1,"L",48,12,null,null,null,0,{"$f":"IF(I64=\"\",\"\",IF(D64=\"\",0,IF(D64=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D64=\"Yes\"),AND($L$1=\"Scaled\",D64>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D64=\"No\"),AND($L$1=\"Scaled\",D64<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[3733,"SL.49","Is there an internal compliance and ethics reporting mechanism and training program for employees to report compliance issues?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"N/A",null,1,"L",49,12,null,null,null,0,{"$f":"IF(I65=\"\",\"\",IF(D65=\"\",0,IF(D65=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D65=\"Yes\"),AND($L$1=\"Scaled\",D65>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D65=\"No\"),AND($L$1=\"Scaled\",D65<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[null,"",{"$f":"'M. Mobile'!B1","v":"M. Mobile"},null,null,null,null,null,null,1,49,13,null,null,null,0,{"$f":"IF(I66=\"\",\"\",IF(D66=\"\",0,IF(D66=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D66=\"Yes\"),AND($L$1=\"Scaled\",D66>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D66=\"No\"),AND($L$1=\"Scaled\",D66<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1]
[3883,"SL.50","Are mobile devices used to access Scoped Systems and Data?","No",null,null,6.2,"Mobile devices and teleworking",1,"M",50,13,null,null,null,0,{"$f":"IF(I67=\"\",\"\",IF(D67=\"\",0,IF(D67=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D67=\"Yes\"),AND($L$1=\"Scaled\",D67>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D67=\"No\"),AND($L$1=\"Scaled\",D67<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,null,1,2,null,1,1]
[null,"",{"$f":"'P. Privacy'!B1","v":"P. Privacy"},null,null,null,null,null,null,1,50,14,null,null,null,0,{"$f":"IF(I68=\"\",\"\",IF(D68=\"\",0,IF(D68=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D68=\"Yes\"),AND($L$1=\"Scaled\",D68>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D68=\"No\"),AND($L$1=\"Scaled\",D68<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":""},"",null,1,"",null,1,1]
[3687,"SL.51","Is Scoped Data transmitted, processed, or stored that can be classified as non-public information (NPI), personally identifiable information (PII), or sensitive customer financial information? If yes, describe and list types of data.","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy. Only NPI, no PII or Finacial Information is collected","P.1 Target Privacy Data Inventory and Flows","8.2.1","Classification of Information",1,"P",51,14,null,null,null,0,{"$f":"IF(I69=\"\",\"\",IF(D69=\"\",0,IF(D69=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D69=\"Yes\"),AND($L$1=\"Scaled\",D69>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D69=\"No\"),AND($L$1=\"Scaled\",D69<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[3694,"SL.52","Is Scoped Data transmitted, processed, or stored that can be classified as protected health information, electronic health records, or personal health records? If yes, identify the classifications.","N/A","Cloudamize Security Policy - Cloudamize Information Security Policy. Only NPI, no PII or Finacial Information is collected","P.1 Target Privacy Data Inventory and Flows","8.2.2","Classification of Information",1,"P",52,14,null,null,null,0,{"$f":"IF(I70=\"\",\"\",IF(D70=\"\",0,IF(D70=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D70=\"Yes\"),AND($L$1=\"Scaled\",D70>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D70=\"No\"),AND($L$1=\"Scaled\",D70<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,null,1,3,null,2,1]
[3704,"SL.53","For Scoped Data, is personal information about individuals transmitted to or received from countries outside the United States? If yes, identify the countries.","N/A","Cloudamize Security Policy - Cloudamize Information Security Policy. Only NPI, no PII or Finacial Information is collected","P.1 Target Privacy Data Inventory and Flows","N/A",null,1,"P",{"$f":"IF(A71=\"\",K70,K70+1)","v":53},{"$f":"IF(I71=\"\",L70+1,L70)","v":14},null,null,null,{"$f":"IF(ISNA(VLOOKUP(A71,BusInfoArray,6,FALSE)),0,VLOOKUP(A71,BusInfoArray,6,FALSE))","v":0},{"$f":"IF(I71=\"\",\"\",IF(D71=\"\",0,IF(D71=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D71=\"Yes\"),AND($L$1=\"Scaled\",D71>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D71=\"No\"),AND($L$1=\"Scaled\",D71<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},{"$f":"IF(I71=\"\",\"\",IF(P71>0,P71,IF(Q71>0,Q71,0)))","v":3},null,{"$f":"IF(I71=\"\",T70,IF(AND(R71>1,OR(T70=\"\",T70=0,T70>=I71)),I71,IF(I71>T70,T70,0)))","v":1},{"$f":"IF(Master=\"Master\",Q71,IF(U70=\"\",R71,IF(OR(AND(T71>0,R71<U70),AND(T71=1,R71<=U70)),U70,R71)))","v":3},null,{"$f":"IF(AND(I71=1,R71=1),2,IF(AND(U70=1,L71=L70),2,IF(AND(W70=2,L71=L70),2,IF(OR(I71=1,I71=\"\"),1,\"\"))))","v":2},{"$f":"IF(U71>0,1,0)","v":1}]
[3872,"SL.54","For Scoped Data is there a dedicated person (or group) responsible for privacy compliance. If yes, describe. If no, explain reason","Yes","Cloudamize Security Policy - Cloudamize Security Working Group","P.3 Privacy Organization and Program Maintenance","16.1.1.b.3 ","Responsibilities and procedures",1,"P",54,14,null,null,null,0,{"$f":"IF(I72=\"\",\"\",IF(D72=\"\",0,IF(D72=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D72=\"Yes\"),AND($L$1=\"Scaled\",D72>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D72=\"No\"),AND($L$1=\"Scaled\",D72<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[3873,"SL.55","For Scoped Data, is there a documented privacy policy or procedures to protect confidential information?","Yes","Cloudamize Security Policy - Cloudamize Privacy Policy","P.2 Privacy Policy and Privacy Notices","15.1.1","Information security policy for supplier relationships",1,"P",55,14,null,null,null,0,{"$f":"IF(I73=\"\",\"\",IF(D73=\"\",0,IF(D73=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D73=\"Yes\"),AND($L$1=\"Scaled\",D73>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D73=\"No\"),AND($L$1=\"Scaled\",D73<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[3225,{"$f":"IF(A74=\"\",\"\",$P$1&\".\"&K74)","v":"SL.56"},"For Scoped Data are there regular privacy risk assessments conducted? If yes, provide frequency and scope. If no, explain reason.","Yes","Cloudamize Security Policy - Cloudamize Privacy Policy Cloudamize Secuirty Working Group. Annually and system wide checks of all Customer Data","P.3 Privacy Organization and Program Maintenance","15.1.3.i ","Information and communication technology supply chain",1,"P",56,14,null,null,null,0,{"$f":"IF(I74=\"\",\"\",IF(D74=\"\",0,IF(D74=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D74=\"Yes\"),AND($L$1=\"Scaled\",D74>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D74=\"No\"),AND($L$1=\"Scaled\",D74<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[3228,"SL.57","Is there formal privacy awareness training for employees, contractors, and third-party users to ensure confidentiality and privacy of Scoped Data?","Yes","Cloudamize Security Policy - Cloudamize Security Personnel Training","P.7 Privacy Awareness","7.2.2 ","Information security awareness, education and training",1,"P",57,14,null,null,null,0,{"$f":"IF(I75=\"\",\"\",IF(D75=\"\",0,IF(D75=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D75=\"Yes\"),AND($L$1=\"Scaled\",D75>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D75=\"No\"),AND($L$1=\"Scaled\",D75<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[3874,"SL.58","Is there a formal process for reporting and responding to privacy complaints or privacy incidents for Scoped Data? If yes, describe. If no, explain reason.","Yes","Cloudamize Security Policy - Cloudamize Privacy Policy","P.8 Privacy Event Notification and Response Management","16.1.1 ","Responsibilties and procedures",1,"P",58,14,null,null,null,0,{"$f":"IF(I76=\"\",\"\",IF(D76=\"\",0,IF(D76=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D76=\"Yes\"),AND($L$1=\"Scaled\",D76>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D76=\"No\"),AND($L$1=\"Scaled\",D76<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[3723,"SL.59","Is there a data classification and retention program for Scoped Data that identifies the data types that require additional management and governance?","Yes","Cloudamize Security Policy - Information Classification  Policy","P.1 Target Privacy Data Inventory and Flows",8.1999999999999993,"Information Classification",1,"P",59,14,null,null,null,0,{"$f":"IF(I77=\"\",\"\",IF(D77=\"\",0,IF(D77=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D77=\"Yes\"),AND($L$1=\"Scaled\",D77>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D77=\"No\"),AND($L$1=\"Scaled\",D77<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[3234,"SL.60","Is there a documented response program to address privacy incidents, unauthorized disclosure, unauthorized access or breach of Scoped Data?","Yes","Cloudamize Security Policy - Cloudamize Security Incident Response Policy","P.8 Privacy Event Notification and Response Management","16.1.1 ","Responsibilties and procedures",1,"P",60,14,null,null,null,0,{"$f":"IF(I78=\"\",\"\",IF(D78=\"\",0,IF(D78=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D78=\"Yes\"),AND($L$1=\"Scaled\",D78>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D78=\"No\"),AND($L$1=\"Scaled\",D78<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[3715,"SL.61","Is Scoped Data disclosed to third parties? If yes, describe","No",null,null,null,null,1,"P",61,14,null,null,null,0,{"$f":"IF(I79=\"\",\"\",IF(D79=\"\",0,IF(D79=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D79=\"Yes\"),AND($L$1=\"Scaled\",D79>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D79=\"No\"),AND($L$1=\"Scaled\",D79<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,null,1,2,null,2,1]
[3269,"SL.62","Is Scoped Data disclosed to third parties outside of the U.S.? If yes, describe.","No",null,null,null,null,1,"P",62,14,null,null,null,0,{"$f":"IF(I80=\"\",\"\",IF(D80=\"\",0,IF(D80=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D80=\"Yes\"),AND($L$1=\"Scaled\",D80>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D80=\"No\"),AND($L$1=\"Scaled\",D80<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,null,1,2,null,2,1]
[3270,"SL.63","Are there contractual controls to ensure that Scoped Data shared with third parties is limited to defined parameters for access, use and disclosure? If yes, describe the controls, If no, explain reason.","Yes","Cloudamize Security Policy -  Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud","P.4 Privacy Third Part Agreements","15.1.2 ","Addressing security within supplier agreements",1,"P",63,14,null,null,null,0,{"$f":"IF(I81=\"\",\"\",IF(D81=\"\",0,IF(D81=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D81=\"Yes\"),AND($L$1=\"Scaled\",D81>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D81=\"No\"),AND($L$1=\"Scaled\",D81<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[3701,"SL.64","Is there a business associate contract in place to address obligations for the privacy and security requirements of the services provided?","Yes","Cloudamize Terms & Conditions can be found at cloudamize.com/terms","P.4 Privacy Third Party Agreements","15.1.2 ","Addressing security within supplier agreements",1,"P",64,14,null,null,null,0,{"$f":"IF(I82=\"\",\"\",IF(D82=\"\",0,IF(D82=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D82=\"Yes\"),AND($L$1=\"Scaled\",D82>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D82=\"No\"),AND($L$1=\"Scaled\",D82<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[3718,"SL.65","Is there a documented privacy program with administrative, technical, and physical safeguards for the protection of Scoped Data?","Yes","Cloudamize Security Policy - Cloudamize Privacy Policy","P.2 Privacy Policy and Privacy Notices","15.1.1","Information security policy for supplier relationships",1,"P",65,14,null,null,null,0,{"$f":"IF(I83=\"\",\"\",IF(D83=\"\",0,IF(D83=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D83=\"Yes\"),AND($L$1=\"Scaled\",D83>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D83=\"No\"),AND($L$1=\"Scaled\",D83<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[3875,"SL.66","Is there a process for ensuring the accuracy of Scoped Data at the direction of the client? If yes, describe. If no, explain reason.","Yes","Customers can request to review the accuracy of Customer Data by contacting Cloudamize and providing the criteria for the data they would like to review.  ","P.6 Management of Client Target Privacy Data","8.2.3","Handling of assets",1,"P",66,14,null,null,null,0,{"$f":"IF(I84=\"\",\"\",IF(D84=\"\",0,IF(D84=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D84=\"Yes\"),AND($L$1=\"Scaled\",D84>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D84=\"No\"),AND($L$1=\"Scaled\",D84<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[3876,"SL.67","Is there a process to ensure that the personal information provided by an individual is limited for the purposes described in the respondent's privacy notice? If yes, describe. If no, explain reason.","Yes","Cloudamize Security Policy - Cloudamize Information Secuirty Policy","P.6 Management of Client Target Privacy Data","8.2.4","Handling of assets",1,"P",67,14,null,null,null,0,{"$f":"IF(I85=\"\",\"\",IF(D85=\"\",0,IF(D85=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D85=\"Yes\"),AND($L$1=\"Scaled\",D85>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D85=\"No\"),AND($L$1=\"Scaled\",D85<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[3877,"SL.68","Are constituents regularly monitored for privacy compliance? If yes, describe. If no, explain reason.","No","Cloudamize Security Policy - Cloudamize Personnel Access Policy / Cloudamize Security Working Group",null,null,null,1,"P",68,14,null,null,null,0,{"$f":"IF(I86=\"\",\"\",IF(D86=\"\",0,IF(D86=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D86=\"Yes\"),AND($L$1=\"Scaled\",D86>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D86=\"No\"),AND($L$1=\"Scaled\",D86<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,null,1,2,null,2,1]
[3724,"SL.69","Are there documented policies, procedures, and controls to limit access based on need to know or minimum necessary for constituents? If yes, describe.","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","P.6 Management of Client Target Privacy Data","9.1.1.b","Access control policy",1,"P",69,14,null,null,null,0,{"$f":"IF(I87=\"\",\"\",IF(D87=\"\",0,IF(D87=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D87=\"Yes\"),AND($L$1=\"Scaled\",D87>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D87=\"No\"),AND($L$1=\"Scaled\",D87<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[3879,"SL.70","Are enforcement mechanisms applied to constituents who violate privacy policies or confidentiality requirements?","Yes","Cloudamize Security Policy - Cloudamize Information Secuirty Policy - Non-Compliance",null,null,null,1,"P",70,14,null,null,null,0,{"$f":"IF(I88=\"\",\"\",IF(D88=\"\",0,IF(D88=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D88=\"Yes\"),AND($L$1=\"Scaled\",D88>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D88=\"No\"),AND($L$1=\"Scaled\",D88<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[3729,"SL.71","Are transactions for covered accounts accessed, modified, or processed, including address changes and discrepancies? If yes, describe.","No",null,null,null,null,1,"P",71,14,null,null,null,0,{"$f":"IF(I89=\"\",\"\",IF(D89=\"\",0,IF(D89=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D89=\"Yes\"),AND($L$1=\"Scaled\",D89>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D89=\"No\"),AND($L$1=\"Scaled\",D89<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,null,1,2,null,2,1]
[3739,"SL.72","Is customer data accessed, transmitted, processed, or stored that can be classified as consumer report information provided by a consumer reporting agency?","No",null,null,null,null,1,"P",72,14,null,null,null,0,{"$f":"IF(I90=\"\",\"\",IF(D90=\"\",0,IF(D90=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D90=\"Yes\"),AND($L$1=\"Scaled\",D90>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D90=\"No\"),AND($L$1=\"Scaled\",D90<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,null,1,2,null,2,1]
[null,"",{"$f":"'Q. Software Security'!B1","v":"Q. Software Application Security"},null,null,null,null,null,null,1,72,15,null,null,null,0,{"$f":"IF(I91=\"\",\"\",IF(D91=\"\",0,IF(D91=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D91=\"Yes\"),AND($L$1=\"Scaled\",D91>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D91=\"No\"),AND($L$1=\"Scaled\",D91<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":""},"",null,1,"",null,1,1]
[3919,"SL.73","Is software provided?  ","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","Q. Software Application Security","N/A",null,1,"Q",73,15,null,null,null,1,{"$f":"IF(I92=\"\",\"\",IF(D92=\"\",0,IF(D92=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D92=\"Yes\"),AND($L$1=\"Scaled\",D92>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D92=\"No\"),AND($L$1=\"Scaled\",D92<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[3920,"SL.74","Is there a secure software development lifecycle policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy? ","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","Q.1 Secure SDLC Policies, Standards and Procedures","14.2.1 ","Secure development policy",2,"Q",74,15,null,null,null,0,{"$f":"IF(I93=\"\",\"\",IF(D93=\"\",0,IF(D93=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D93=\"Yes\"),AND($L$1=\"Scaled\",D93>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D93=\"No\"),AND($L$1=\"Scaled\",D93<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,null,0,1,null,2,1]
[null,"",{"$f":"'V. Cloud Security'!B1","v":"V. Cloud Security"},null,null,null,null,null,null,1,74,16,null,null,null,0,{"$f":"IF(I94=\"\",\"\",IF(D94=\"\",0,IF(D94=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D94=\"Yes\"),AND($L$1=\"Scaled\",D94>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D94=\"No\"),AND($L$1=\"Scaled\",D94<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1]
[3304,"SL.75","Are Cloud Services provided? If yes, what service model and deployment model is provided (select all that apply):","No",null,"V.1 Service and Deployment Models",4.3,"Determining the scope of the information management system",1,"V",75,16,null,null,null,0,{"$f":"IF(I95=\"\",\"\",IF(D95=\"\",0,IF(D95=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D95=\"Yes\"),AND($L$1=\"Scaled\",D95>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D95=\"No\"),AND($L$1=\"Scaled\",D95<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,null,1,2,null,1,1]
[3305,"SL.76","Software as a Service (SaaS)",null,null,"V.1 Service and Deployment Models","N/A",null,2,"V",76,16,null,null,null,0,{"$f":"IF(I96=\"\",\"\",IF(D96=\"\",0,IF(D96=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D96=\"Yes\"),AND($L$1=\"Scaled\",D96>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D96=\"No\"),AND($L$1=\"Scaled\",D96<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3306,"SL.77","Platform as a Service (PaaS)",null,null,"V.1 Service and Deployment Models","N/A",null,2,"V",77,16,null,null,null,0,{"$f":"IF(I97=\"\",\"\",IF(D97=\"\",0,IF(D97=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D97=\"Yes\"),AND($L$1=\"Scaled\",D97>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D97=\"No\"),AND($L$1=\"Scaled\",D97<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3307,"SL.78","Infrastructure as a Service (IaaS)",null,null,"V.1 Service and Deployment Models","N/A",null,2,"V",78,16,null,null,null,0,{"$f":"IF(I98=\"\",\"\",IF(D98=\"\",0,IF(D98=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D98=\"Yes\"),AND($L$1=\"Scaled\",D98>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D98=\"No\"),AND($L$1=\"Scaled\",D98<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3309,"SL.79","Private cloud",null,null,"V.1 Service and Deployment Models","N/A",null,2,"V",79,16,null,null,null,0,{"$f":"IF(I99=\"\",\"\",IF(D99=\"\",0,IF(D99=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D99=\"Yes\"),AND($L$1=\"Scaled\",D99>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D99=\"No\"),AND($L$1=\"Scaled\",D99<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3310,"SL.80","Public cloud",null,null,"V.1 Service and Deployment Models","N/A",null,2,"V",80,16,null,null,null,0,{"$f":"IF(I100=\"\",\"\",IF(D100=\"\",0,IF(D100=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D100=\"Yes\"),AND($L$1=\"Scaled\",D100>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D100=\"No\"),AND($L$1=\"Scaled\",D100<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3311,"SL.81","Community cloud",null,null,"V.1 Service and Deployment Models","N/A",null,2,"V",81,16,null,null,null,0,{"$f":"IF(I101=\"\",\"\",IF(D101=\"\",0,IF(D101=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D101=\"Yes\"),AND($L$1=\"Scaled\",D101>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D101=\"No\"),AND($L$1=\"Scaled\",D101<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3312,"SL.82","Hybrid cloud",null,null,"V.1 Service and Deployment Models","N/A",null,2,"V",82,16,null,null,null,0,{"$f":"IF(I102=\"\",\"\",IF(D102=\"\",0,IF(D102=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D102=\"Yes\"),AND($L$1=\"Scaled\",D102>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D102=\"No\"),AND($L$1=\"Scaled\",D102<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3330,"SL.83","Can clients define the legal jurisdictions where their data can be transmitted, processed or stored?",null,null,"P.1 Target Privacy Data Inventory and Flows","15.1.2","Addressing security within supplier agreements",2,"V",83,16,null,null,null,0,{"$f":"IF(I103=\"\",\"\",IF(D103=\"\",0,IF(D103=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D103=\"Yes\"),AND($L$1=\"Scaled\",D103>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D103=\"No\"),AND($L$1=\"Scaled\",D103<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3339,"SL.84","Is data segmentation and separation capability between clients provided? If yes, describe.",null,null,"V.1 Service and Deployment Models","11.2.6, 9.1.1","Security of equipment and assets off-premises, Access Control Policy",2,"V",84,16,null,null,null,0,{"$f":"IF(I104=\"\",\"\",IF(D104=\"\",0,IF(D104=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D104=\"Yes\"),AND($L$1=\"Scaled\",D104>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D104=\"No\"),AND($L$1=\"Scaled\",D104<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3346,"SL.85","Is Scoped Data encrypted?",null,null,"G.22 Data Security Policy - Encryption",10.1,"Cryptographic Controls",2,"V",85,16,null,null,null,0,{"$f":"IF(I105=\"\",\"\",IF(D105=\"\",0,IF(D105=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D105=\"Yes\"),AND($L$1=\"Scaled\",D105>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D105=\"No\"),AND($L$1=\"Scaled\",D105<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3353,"SL.86","Are clients provided with the ability to generate a unique encryption key?",null,null,"G.22 Data Security Policy - Encryption","10.1.2","Key Management",2,"V",86,16,null,null,null,0,{"$f":"IF(I106=\"\",\"\",IF(D106=\"\",0,IF(D106=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D106=\"Yes\"),AND($L$1=\"Scaled\",D106>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D106=\"No\"),AND($L$1=\"Scaled\",D106<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3354,"SL.87","Are clients provided with the ability to rotate their encryption key on a scheduled basis?",null,null,"G.22 Data Security Policy - Encryption","10.1.2","Key Management",2,"V",87,16,null,null,null,0,{"$f":"IF(I107=\"\",\"\",IF(D107=\"\",0,IF(D107=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D107=\"Yes\"),AND($L$1=\"Scaled\",D107>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D107=\"No\"),AND($L$1=\"Scaled\",D107<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3355,"SL.88","Is standards based federated ID capability available to clients (e.g., SAML, OpenID)?",null,null,"N/A","9.2.4","Management of secret authentication information of users.",2,"V",88,16,null,null,null,0,{"$f":"IF(I108=\"\",\"\",IF(D108=\"\",0,IF(D108=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D108=\"Yes\"),AND($L$1=\"Scaled\",D108>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D108=\"No\"),AND($L$1=\"Scaled\",D108<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3356,"SL.89","Are application self service features or an Internet accessible self-service portal available to clients? If yes, describe.",null,null,"N/A","11.2.6, 9.1.1","Security of equipment and assets off-premises, Access Control Policy",2,"V",89,16,null,null,null,0,{"$f":"IF(I109=\"\",\"\",IF(D109=\"\",0,IF(D109=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D109=\"Yes\"),AND($L$1=\"Scaled\",D109>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D109=\"No\"),AND($L$1=\"Scaled\",D109<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3373,"SL.90","Is there a management approved process to ensure that image snapshots containing Scoped Data are authorized prior to being snapped?",null,null,"N/A","N/A",null,2,"V",90,16,null,null,null,0,{"$f":"IF(I110=\"\",\"\",IF(D110=\"\",0,IF(D110=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D110=\"Yes\"),AND($L$1=\"Scaled\",D110>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D110=\"No\"),AND($L$1=\"Scaled\",D110<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3379,"SL.91","Is there a cloud audit program to address client audit and assessment requirements? If yes, describe.",null,null,"V.3 Cloud Audit Program","N/A",null,2,"V",91,16,null,null,null,0,{"$f":"IF(I111=\"\",\"\",IF(D111=\"\",0,IF(D111=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D111=\"Yes\"),AND($L$1=\"Scaled\",D111>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D111=\"No\"),AND($L$1=\"Scaled\",D111<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3394,"SL.92","Is an agile development methodology in operation?",null,null,"I.2 Secure Systems Development Lifecycle Code Reviews\nQ.5 Secure Code Review",12.5,"Control Of Operational Software",2,"V",92,16,null,null,null,0,{"$f":"IF(I112=\"\",\"\",IF(D112=\"\",0,IF(D112=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D112=\"Yes\"),AND($L$1=\"Scaled\",D112>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D112=\"No\"),AND($L$1=\"Scaled\",D112<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3401,"SL.93","Is there a formal process to ensure clients are notified prior to changes being made which may impact their service? If yes, describe.",null,null,"G.21 Change Control","12.1.2, 14.2.2","Change Management, System change control procedures",2,"V",93,16,null,null,null,0,{"$f":"IF(I113=\"\",\"\",IF(D113=\"\",0,IF(D113=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D113=\"Yes\"),AND($L$1=\"Scaled\",D113>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D113=\"No\"),AND($L$1=\"Scaled\",D113<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3406,"SL.94","Is there a scheduled maintenance window? If yes, what is the frequency?",null,null,"V.4 Security Review of Hypervisor Configuration","12.1.2, 14.2.2","Change Management, System change control procedures",2,"V",94,16,null,null,null,0,{"$f":"IF(I114=\"\",\"\",IF(D114=\"\",0,IF(D114=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D114=\"Yes\"),AND($L$1=\"Scaled\",D114>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D114=\"No\"),AND($L$1=\"Scaled\",D114<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3412,"SL.95","Is there a scheduled maintenance window which results in client downtime, If yes, what is the period of the downtime?",null,null,"V.4 Security Review of Hypervisor Configuration","12.1.2, 14.2.2","Change Management, System change control procedures",2,"V",95,16,null,null,null,0,{"$f":"IF(I115=\"\",\"\",IF(D115=\"\",0,IF(D115=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D115=\"Yes\"),AND($L$1=\"Scaled\",D115>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D115=\"No\"),AND($L$1=\"Scaled\",D115<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3418,"SL.96","Is there an online incident response status portal which outlines planned and unplanned outages? If yes, how long after an unplanned outage is this updated?",null,null,"J.1 Information Security Incident Management\nP.8 Privacy Incident and Response Management","12.1.2, 14.2.2","Change Management, System change control procedures",2,"V",96,16,null,null,null,0,{"$f":"IF(I116=\"\",\"\",IF(D116=\"\",0,IF(D116=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D116=\"Yes\"),AND($L$1=\"Scaled\",D116>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D116=\"No\"),AND($L$1=\"Scaled\",D116<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3426,"SL.97","Is there a 24x7x365 staffed phone number available to clients to report security incidents?",null,null,"J.1 Information Security Incident Management\nP.8 Privacy Incident and Response Management","12.1.2, 14.2.2","Change Management, System change control procedures",2,"V",97,16,null,null,null,0,{"$f":"IF(I117=\"\",\"\",IF(D117=\"\",0,IF(D117=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D117=\"Yes\"),AND($L$1=\"Scaled\",D117>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D117=\"No\"),AND($L$1=\"Scaled\",D117<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3427,"SL.98","Are applications created and released into production? If yes, what is the release frequency?",null,null,"Q.1 Secure SDLC Policies, Standards and Procedures",12.5,"Control Of Operational Software",2,"V",98,16,null,null,null,0,{"$f":"IF(I118=\"\",\"\",IF(D118=\"\",0,IF(D118=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D118=\"Yes\"),AND($L$1=\"Scaled\",D118>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D118=\"No\"),AND($L$1=\"Scaled\",D118<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3436,"SL.99","Is there an automated secure source code review? If yes, what is the frequency?",null,null,"I.2 Secure Systems Development Lifecycle Code Reviews\nQ.5 Secure Code Review",12.5,"Control Of Operational Software",2,"V",99,16,null,null,null,0,{"$f":"IF(I119=\"\",\"\",IF(D119=\"\",0,IF(D119=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D119=\"Yes\"),AND($L$1=\"Scaled\",D119>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D119=\"No\"),AND($L$1=\"Scaled\",D119<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3445,"SL.100","Is source code security reviewed manually? If yes, what is the frequency?",null,null,"I.2 Secure Systems Development Lifecycle Code Reviews\nQ.5 Secure Code Review","12.2.1, 12.5","Control against malware, Control Of Operational Software",2,"V",100,16,null,null,null,0,{"$f":"IF(I120=\"\",\"\",IF(D120=\"\",0,IF(D120=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D120=\"Yes\"),AND($L$1=\"Scaled\",D120>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D120=\"No\"),AND($L$1=\"Scaled\",D120<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3454,"SL.101","Are automated penetration tests performed? If yes, what is the frequency?",null,null,"I.1 Application Vulnerability Assessments/Ethical Hacking",12.6,"Technical vulnerability management",2,"V",101,16,null,null,null,0,{"$f":"IF(I121=\"\",\"\",IF(D121=\"\",0,IF(D121=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D121=\"Yes\"),AND($L$1=\"Scaled\",D121>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D121=\"No\"),AND($L$1=\"Scaled\",D121<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3472,"SL.102","Are clients provided with the ability to specify where their data will be stored? If yes, describe at what level (e.g., data center, country)?",null,null,"P.6 Management of Client Target Privacy Data","8.2.3, 11.1, 15.1.2","Handling of assets,\nSecure areas,\nAddressing secuirty within supplier agreements",2,"V",102,16,null,null,null,0,{"$f":"IF(I122=\"\",\"\",IF(D122=\"\",0,IF(D122=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D122=\"Yes\"),AND($L$1=\"Scaled\",D122>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D122=\"No\"),AND($L$1=\"Scaled\",D122<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3481,"SL.103","Does the ability exist to legally demonstrate sufficient data segmentation, in the event of a client subpoena or a forensics incident, so as not to impact other client's data? If using resource pooling? ",null,null,"V.1 Service and Deployment Models",16.100000000000001,"Management of information security incidents and improvements",2,"V",103,16,null,null,null,0,{"$f":"IF(I123=\"\",\"\",IF(D123=\"\",0,IF(D123=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D123=\"Yes\"),AND($L$1=\"Scaled\",D123>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D123=\"No\"),AND($L$1=\"Scaled\",D123<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3489,"SL.104","Is there a self-service portal or API call available to clients which provides the ability to place a \"Legal hold\" on client data which may be subject to a legal action, without impacting other clients data retention or destruction schedules?",null,null,"P.6 Management of Client Target Privacy Data","8.2.3, 11.1, 15.1.2, 18.1.2","Handling of assets,\nSecure areas,\nAddressing secuirty within supplier agreements, Intellectual property rights",2,"V",104,16,null,null,null,0,{"$f":"IF(I124=\"\",\"\",IF(D124=\"\",0,IF(D124=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D124=\"Yes\"),AND($L$1=\"Scaled\",D124>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D124=\"No\"),AND($L$1=\"Scaled\",D124<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3490,"SL.105","Is a Cloud API available to clients?",null,null,"H.3 Logical Access Authorization","N/A",null,2,"V",105,16,null,null,null,0,{"$f":"IF(I125=\"\",\"\",IF(D125=\"\",0,IF(D125=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D125=\"Yes\"),AND($L$1=\"Scaled\",D125>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D125=\"No\"),AND($L$1=\"Scaled\",D125<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3516,"SL.106","Is there a client management portal which allows distributed business accounts (business units/departments) to be managed under a single central corporate account?",null,null,null,"12.1.2, 14.2.2","Change Management, System change control procedures",2,"V",106,16,null,null,null,0,{"$f":"IF(I126=\"\",\"\",IF(D126=\"\",0,IF(D126=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D126=\"Yes\"),AND($L$1=\"Scaled\",D126>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D126=\"No\"),AND($L$1=\"Scaled\",D126<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3538,"SL.107","Are staff required to use two factor authentication to remotely access the production cloud environment containing Scoped Data?",null,null,"I.6 Application Security Vulnerability Assessments and Remediation","9.3.1, 9.4.2, 9.4.3","Use of secret authentication information, Secure log-on procedures, Password management system",2,"V",107,16,null,null,null,0,{"$f":"IF(I127=\"\",\"\",IF(D127=\"\",0,IF(D127=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D127=\"Yes\"),AND($L$1=\"Scaled\",D127>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D127=\"No\"),AND($L$1=\"Scaled\",D127<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3548,"SL.108","Are staff able to access client Scoped Data in an unencrypted state?",null,null,"H.3 Logical Access Authorization","9.4.1","Information access restriction",2,"V",108,16,null,null,null,0,{"$f":"IF(I128=\"\",\"\",IF(D128=\"\",0,IF(D128=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D128=\"Yes\"),AND($L$1=\"Scaled\",D128>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D128=\"No\"),AND($L$1=\"Scaled\",D128<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3549,"SL.109","Are staff able to access client's encryption key?",null,null,"H.3 Logical Access Authorization","9.4.1","Information access restriction",2,"V",109,16,null,null,null,0,{"$f":"IF(I129=\"\",\"\",IF(D129=\"\",0,IF(D129=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D129=\"Yes\"),AND($L$1=\"Scaled\",D129>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D129=\"No\"),AND($L$1=\"Scaled\",D129<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3554,"SL.110","Is there a process which allows the client to specifically list who from the cloud provider, will have access to their Scoped Systems and Data? If yes, describe.",null,null,"H.3 Logical Access Authorization","9.1.1, 9.4.1","\tAccess Control Policy\nInformation access restriction",2,"V",110,16,null,null,null,0,{"$f":"IF(I130=\"\",\"\",IF(D130=\"\",0,IF(D130=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D130=\"Yes\"),AND($L$1=\"Scaled\",D130>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D130=\"No\"),AND($L$1=\"Scaled\",D130<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3558,"SL.111","Are staff technically prevented from accessing the cloud environment via non-managed private devices? ",null,null,"H.3 Logical Access Authorization","9.1.1, 9.4.1","\tAccess Control Policy\nInformation access restriction",2,"V",111,16,null,null,null,0,{"$f":"IF(I131=\"\",\"\",IF(D131=\"\",0,IF(D131=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D131=\"Yes\"),AND($L$1=\"Scaled\",D131>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D131=\"No\"),AND($L$1=\"Scaled\",D131<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3563,"SL.112","Are there controls to prevent one client attempting to compromise another client in a resource pooled environment? If yes, describe.",null,null,"H.3 Logical Access Authorization","9.1.1, 9.4.1","\tAccess Control Policy\nInformation access restriction",2,"V",112,16,null,null,null,0,{"$f":"IF(I132=\"\",\"\",IF(D132=\"\",0,IF(D132=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D132=\"Yes\"),AND($L$1=\"Scaled\",D132>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D132=\"No\"),AND($L$1=\"Scaled\",D132<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3568,"SL.113","Is a default hardened base virtual image available to clients?",null,null,"I.3 Secure Systems Hardening Standards","N/A",null,2,"V",113,16,null,null,null,0,{"$f":"IF(I133=\"\",\"\",IF(D133=\"\",0,IF(D133=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D133=\"Yes\"),AND($L$1=\"Scaled\",D133>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D133=\"No\"),AND($L$1=\"Scaled\",D133<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3590,"SL.114","Can clients run their own security services within their own cloud environment? If yes, describe.",null,null,"V.3 Cloud Audit Program","8.2.3, 11.1, 15.1.2, 18.1.2","Handling of assets,\nSecure areas,\nAddressing secuirty within supplier agreements, Intellectual property rights",2,"V",114,16,null,null,null,0,{"$f":"IF(I134=\"\",\"\",IF(D134=\"\",0,IF(D134=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D134=\"Yes\"),AND($L$1=\"Scaled\",D134>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D134=\"No\"),AND($L$1=\"Scaled\",D134<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3602,"SL.115","Is there a specific Recovery Time Objective(s) (RTO)? If yes, specify the RTO for the scoped services.",null,null,"N/A",17.100000000000001,"Information security continuity",2,"V",{"$f":"IF(A135=\"\",K134,K134+1)","v":115},{"$f":"IF(I135=\"\",L134+1,L134)","v":16},null,null,null,{"$f":"IF(ISNA(VLOOKUP(A135,BusInfoArray,6,FALSE)),0,VLOOKUP(A135,BusInfoArray,6,FALSE))","v":0},{"$f":"IF(I135=\"\",\"\",IF(D135=\"\",0,IF(D135=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D135=\"Yes\"),AND($L$1=\"Scaled\",D135>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D135=\"No\"),AND($L$1=\"Scaled\",D135<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(I135=\"\",\"\",IF(P135>0,P135,IF(Q135>0,Q135,0)))","v":0},null,{"$f":"IF(I135=\"\",T134,IF(AND(R135>1,OR(T134=\"\",T134=0,T134>=I135)),I135,IF(I135>T134,T134,0)))","v":1},{"$f":"IF(Master=\"Master\",Q135,IF(U134=\"\",R135,IF(OR(AND(T135>0,R135<U134),AND(T135=1,R135<=U134)),U134,R135)))","v":2},null,{"$f":"IF(AND(I135=1,R135=1),2,IF(AND(U134=1,L135=L134),2,IF(AND(W134=2,L135=L134),2,IF(OR(I135=1,I135=\"\"),1,\"\"))))","v":""},{"$f":"IF(U135>0,1,0)","v":1}]
[3623,"SL.116","Are the failover sites for the underlying infrastructure running on different vendor physical systems?",null,null,"N/A",17.100000000000001,"Information security continuity",2,"V",116,16,null,null,null,0,{"$f":"IF(I136=\"\",\"\",IF(D136=\"\",0,IF(D136=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D136=\"Yes\"),AND($L$1=\"Scaled\",D136>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D136=\"No\"),AND($L$1=\"Scaled\",D136<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3624,"SL.117","Is the critical infrastructure running active/active at two or more sites?",null,null,"N/A",17.100000000000001,"Information security continuity",2,"V",117,16,null,null,null,0,{"$f":"IF(I137=\"\",\"\",IF(D137=\"\",0,IF(D137=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D137=\"Yes\"),AND($L$1=\"Scaled\",D137>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D137=\"No\"),AND($L$1=\"Scaled\",D137<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3625,{"$f":"IF(A138=\"\",\"\",$P$1&\".\"&K138)","v":"SL.118"},"Are sites failed over as part of normal operation or as part of a test? If yes, what is the frequency?",null,null,"N/A",17.100000000000001,"Information security continuity",2,"V",118,16,null,null,null,0,{"$f":"IF(I138=\"\",\"\",IF(D138=\"\",0,IF(D138=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D138=\"Yes\"),AND($L$1=\"Scaled\",D138>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D138=\"No\"),AND($L$1=\"Scaled\",D138<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3632,"SL.119","Are all suppliers of critical hardware, network services and facility services involved in annual continuity and recovery tests?",null,null,"N/A",17.100000000000001,"Information security continuity",2,"V",119,16,null,null,null,0,{"$f":"IF(I139=\"\",\"\",IF(D139=\"\",0,IF(D139=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D139=\"Yes\"),AND($L$1=\"Scaled\",D139>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D139=\"No\"),AND($L$1=\"Scaled\",D139<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3634,"SL.120","Are all critical technology service providers described on an architecture diagram that includes physical systems and facilities?",null,null,"N/A",17.100000000000001,"Information security continuity",2,"V",120,16,null,null,null,0,{"$f":"IF(I140=\"\",\"\",IF(D140=\"\",0,IF(D140=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D140=\"Yes\"),AND($L$1=\"Scaled\",D140>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D140=\"No\"),AND($L$1=\"Scaled\",D140<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3638,"SL.121","Is there sufficient redundancy capacity to ensure services are not impacted in multi-tenancy environments during peak usage and above?",null,null,"N/A",17.2,"Redundancies",2,"V",121,16,null,null,null,0,{"$f":"IF(I141=\"\",\"\",IF(D141=\"\",0,IF(D141=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D141=\"Yes\"),AND($L$1=\"Scaled\",D141>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D141=\"No\"),AND($L$1=\"Scaled\",D141<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3639,"SL.122","Do contracts include a penalty or remediation clause for breach of availability and continuity SLAs? ",null,null,"N/A","15.1.2, 15.2.1","Addressing security within supplier agreements, Monitoring and review of supplier services",2,"V",122,16,null,null,null,0,{"$f":"IF(I142=\"\",\"\",IF(D142=\"\",0,IF(D142=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D142=\"Yes\"),AND($L$1=\"Scaled\",D142>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D142=\"No\"),AND($L$1=\"Scaled\",D142<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,null,1,2,null,"",1]
[3649,"SL.123","Is a Hypervisor used to manage systems used to transmit, process or store Scoped Data? If yes, describe the controls used to protect the hypervisor and the managed Guest Operating Systems.","No",null,"V.4 Security Review of Hypervisor Configuration","N/A",null,2,"V",123,16,null,null,null,0,{"$f":"IF(I143=\"\",\"\",IF(D143=\"\",0,IF(D143=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D143=\"Yes\"),AND($L$1=\"Scaled\",D143>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D143=\"No\"),AND($L$1=\"Scaled\",D143<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,null,1,2,null,"",1]

{"sheet":"A. Risk Management","index":7,"n_rows":25,"n_cols":28,"rows_kept":25,"cut":false,"hidden":false,"merged":[[2,1,2,7]]}
[10,"A. Risk Assessment and Treatment",null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,null,"Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"A"},null,null,null,null,null,null,{"$f":"IF(OR(COUNTA(E5:E18)>0,W2>0),1,0)","v":1}]
[null,null,null,{"$f":"IF(W2=0,\"0%\",W2/S2)","v":1},"Percent Complete",null,null,null,{"$f":"COUNTA(I5:I18)","v":14},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(S5:S18,1)","v":14},null,null,null,{"$f":"COUNTIF(W5:W18,1)","v":14}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column E to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, check the Disable Tab Automation checkbox at the top of the page.",null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter"]
[{"$f":"MAX(A5:A18)","v":3286},"Ques Num","Question/Request","Response","Additional Information","AUP Reference","ISO Ref Num","ISO Ref Text"]
[3198,"A.1","Is there a risk assessment program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the program? if yes, does it include:","Yes","Cloudamize Security Policy - Cloudamize Risk Assessment Plan","A.1 IT & Infrastructure Risk Governance and Context","5.1                                            6.1.2","Leadership & Commitment,                Information Security Risk Assessment",1,null,{"$f":"IF(K4=\"\",1,IF(I5=1,K4+1,K4))","v":1},{"$f":"IF(L4=\"\",0,IF(K4<>K5,0,IF($I5=2,L4+1,L4)))","v":0},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($I5=3,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($I5=4,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($I5=5,O4+1,O4)))","v":0},{"$f":"IF(OR(Master=\"Master\",I5=0,J5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,21,FALSE)),0,VLOOKUP(A5,L2_Array,21,FALSE)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D5=\"Yes\"),AND($L$1=\"Scaled\",D5>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D5=\"No\"),AND($L$1=\"Scaled\",D5<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I5=\"\",\"\",IF(P5>0,P5,IF(Q5>0,Q5,0)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(I5=1,S4=\"\"),1,IF(OR(AND(J4=1,(I5-I3<>0)),AND(S4=0,I4=I5),AND(J4=1,I5=I3)),0,1)))","v":1},{"$f":"IF(I5=\"\",T4,IF(AND(R5>1,OR(T4=\"\",T4=0,T4>=I5)),I5,IF(I5>T4,T4,0)))","v":0},{"$f":"IF(Master=\"Master\",Q5,IF(U4=\"\",R5,IF(OR(AND(T5>0,R5<U4),AND(T5=1,R5<=U4)),U4,R5)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(S4=1,T5=1),R5>0,AND(S6=0,V6=1)),1,0))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(T5>0,S5=1),AND(S5=1,V5=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(I5=1,R5=1),2,IF(AND(U4=1,K5=K4),2,IF(AND(AB4=2,K5=K4),2,IF(I5=1,1,\"\"))))","v":2}]
[2409,"A.1.1","A risk assessment, conducted within the last 12 months?","Yes","Cloudamize Security Policy - Cloudamize Risk Assessment Plan","A.2 IT & Infrastructure Risk Assessment Life Cycle",8.1999999999999993," Information security risk assessment",2,null,{"$f":"IF(K5=\"\",1,IF(I6=1,K5+1,K5))","v":1},{"$f":"IF(L5=\"\",0,IF(K5<>K6,0,IF($I6=2,L5+1,L5)))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($I6=3,M5+1,M5)))","v":0},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($I6=4,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($I6=5,O5+1,O5)))","v":0},0,{"$f":"IF(I6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D6=\"Yes\"),AND($L$1=\"Scaled\",D6>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D6=\"No\"),AND($L$1=\"Scaled\",D6<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I6=\"\",\"\",IF(P6>0,P6,IF(Q6>0,Q6,0)))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(I6=1,S5=\"\"),1,IF(OR(AND(J5=1,(I6-I4<>0)),AND(S5=0,I5=I6),AND(J5=1,I6=I4)),0,1)))","v":1},{"$f":"IF(I6=\"\",T5,IF(AND(R6>1,OR(T5=\"\",T5=0,T5>=I6)),I6,IF(I6>T5,T5,0)))","v":0},1,{"$f":"IF(I6=\"\",\"\",IF(OR(AND(S5=1,T6=1),R6>0,AND(S7=0,V7=1)),1,0))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(T6>0,S6=1),AND(S6=1,V6=1)),1,0))","v":1},0,null,null,null,{"$f":"IF(AND(I6=1,R6=1),2,IF(AND(U5=1,K6=K5),2,IF(AND(AB5=2,K6=K5),2,IF(I6=1,1,\"\"))))","v":2}]
[2325,"A.1.2","Risk Governance?","Yes","Cloudamize Security Policy - Cloudamize Risk Assessment Plan","A.1 IT & Infrastructure Risk Governance and Context","N/A",null,2,null,1,2,0,0,0,0,{"$f":"IF(I7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D7=\"Yes\"),AND($L$1=\"Scaled\",D7>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D7=\"No\"),AND($L$1=\"Scaled\",D7<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2326,"A.1.3","Range of assets to include: people, processes, data and technology?","Yes","Cloudamize Security Policy - Cloudamize Risk Assessment Plan","A.1 IT & Infrastructure Risk Governance and Context","N/A",null,2,null,1,3,0,0,0,0,{"$f":"IF(I8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D8=\"Yes\"),AND($L$1=\"Scaled\",D8>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D8=\"No\"),AND($L$1=\"Scaled\",D8<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2420,"A.1.4","Range of threats to include: malicious, natural, accidental, business changes (transaction volume)?","Yes","Cloudamize Security Policy - Cloudamize Risk Assessment Plan","A.1 IT & Infrastructure Risk Governance and Context","6.1.2","Information Security Risk Assessment",2,null,1,4,0,0,0,0,{"$f":"IF(I9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D9=\"Yes\"),AND($L$1=\"Scaled\",D9>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D9=\"No\"),AND($L$1=\"Scaled\",D9<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2425,"A.1.5","Risk scoping?","Yes","Cloudamize Security Policy - Cloudamize Risk Assessment Plan","A.1 IT & Infrastructure Risk Governance and Context","6.1.2","Information Security Risk Assessment",2,null,1,5,0,0,0,0,{"$f":"IF(I10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D10=\"Yes\"),AND($L$1=\"Scaled\",D10>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D10=\"No\"),AND($L$1=\"Scaled\",D10<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2426,"A.1.6","Risk context?","Yes","Cloudamize Security Policy - Cloudamize Risk Assessment Plan","A.1 IT & Infrastructure Risk Governance and Context","6.1.2","Information Security Risk Assessment",2,null,1,6,0,0,0,0,{"$f":"IF(I11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D11=\"Yes\"),AND($L$1=\"Scaled\",D11>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D11=\"No\"),AND($L$1=\"Scaled\",D11<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2427,"A.1.7","Risk training plan?","Yes","Cloudamize Security Policy - Cloudamize Risk Assessment Plan","A.1 IT & Infrastructure Risk Governance and Context","6.1.2","Information Security Risk Assessment",2,null,1,7,0,0,0,0,{"$f":"IF(I12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D12=\"Yes\"),AND($L$1=\"Scaled\",D12>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D12=\"No\"),AND($L$1=\"Scaled\",D12<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2431,"A.1.8","Risk evaluation criteria?","Yes","Cloudamize Security Policy - Cloudamize Risk Assessment Plan","A.1 IT & Infrastructure Risk Governance and Context","6.1.2","Information Security Risk Assessment",2,null,1,8,0,0,0,0,{"$f":"IF(I13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D13=\"Yes\"),AND($L$1=\"Scaled\",D13>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D13=\"No\"),AND($L$1=\"Scaled\",D13<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2429,"A.1.9","Risk scenarios? If yes:","No",null,"A.1 IT & Infrastructure Risk Governance and Context","6.1.2","Information Security Risk Assessment",2,null,1,9,0,0,0,0,{"$f":"IF(I14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D14=\"Yes\"),AND($L$1=\"Scaled\",D14>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D14=\"No\"),AND($L$1=\"Scaled\",D14<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[2430,"A.1.9.1","Have scenarios been created for a variety of events with a range of possible threats that could impact the range of assets?",null,null,"A.1 IT & Infrastructure Risk Governance and Context","6.1.2","Information Security Risk Assessment",3,null,1,9,1,0,0,0,{"$f":"IF(I15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D15=\"Yes\"),AND($L$1=\"Scaled\",D15>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D15=\"No\"),AND($L$1=\"Scaled\",D15<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[2428,"A.1.9.2","Do the scenarios include threat types impacting all assets resulting in business impact?",null,null,"A.1 IT & Infrastructure Risk Governance and Context","6.1.2","Information Security Risk Assessment",3,null,1,9,2,0,0,0,{"$f":"IF(I16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D16=\"Yes\"),AND($L$1=\"Scaled\",D16>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D16=\"No\"),AND($L$1=\"Scaled\",D16<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[3285,"A.1.10","Ownership, action plan, response plan, management update?","Yes","Cloudamize Security Policy - Cloudamize Risk Assessment Plan","A.2 IT & Infrastructure Risk Assessment Life Cycle","6.1.2","Information Security Risk Assessment",2,null,1,10,0,0,0,0,{"$f":"IF(I17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D17=\"Yes\"),AND($L$1=\"Scaled\",D17>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D17=\"No\"),AND($L$1=\"Scaled\",D17<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3286,"A.2","Are controls identified for each risk classified as: preventive, detective, corrective, predictive (technical or administrative controls)?","No",null,"A.2 IT & Infrastructure Risk Assessment Life Cycle","6.1.3","Information Security Risk treatment",1,null,2,0,0,0,0,0,{"$f":"IF(I18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D18=\"Yes\"),AND($L$1=\"Scaled\",D18>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D18=\"No\"),AND($L$1=\"Scaled\",D18<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,1,2,1,1,0,null,null,null,1]
[]
[]
[]
[]
[]
[]
[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,{"$f":"Dashboard!D10","v":0}]

{"sheet":"B. Security Policy","index":8,"n_rows":62,"n_cols":28,"rows_kept":62,"cut":false,"hidden":false,"merged":[[2,1,2,7]]}
[10,"B. Security Policy",null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,null,"Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"B"}]
[null,null,null,{"$f":"IF(W2=0,\"0%\",W2/S2)","v":1},"Percent Complete",null,null,null,{"$f":"COUNTA(I5:I62)","v":58},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(S5:S62,1)","v":58},null,null,null,{"$f":"COUNTIF(W5:W62,1)","v":58}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column E to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, check the Disable Tab Automation checkbox at the top of the page.",null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter"]
[{"$f":"MAX(A5:A62)","v":3896},"Ques Num","Question/Request","Response","Additional Information","AUP Reference","ISO Ref Num","ISO Ref Text"]
[3199,{"$f":"IF(I5=0,\"\",IF(I5=1,P$1&\".\"&K5,IF(I5=2,P$1&\".\"&K5&\".\"&L5,IF(I5=3,P$1&\".\"&K5&\".\"&L5&\".\"&M5,IF(I5=4,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5,IF(I5=5,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5))))))","v":"B.1"},"Is there an information security policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy? If yes, does the policy contain:","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","B.1 Information Security Policy Content & Maintenance","5.1.1","Policies for information security",1,null,{"$f":"IF(K4=\"\",1,IF(I5=1,K4+1,K4))","v":1},{"$f":"IF(L4=\"\",0,IF(K4<>K5,0,IF($I5=2,L4+1,L4)))","v":0},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($I5=3,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($I5=4,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($I5=5,O4+1,O4)))","v":0},{"$f":"IF(OR(Master=\"Master\",I5=0,J5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,21,FALSE)),0,VLOOKUP(A5,L2_Array,21,FALSE)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D5=\"Yes\"),AND($L$1=\"Scaled\",D5>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D5=\"No\"),AND($L$1=\"Scaled\",D5<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I5=\"\",\"\",IF(P5>0,P5,IF(Q5>0,Q5,0)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(I5=1,S4=\"\"),1,IF(OR(AND(J4=1,(I5-I3<>0)),AND(S4=0,I4=I5),AND(J4=1,I5=I3)),0,1)))","v":1},{"$f":"IF(I5=\"\",T4,IF(AND(R5>1,OR(T4=\"\",T4=0,T4>=I5)),I5,IF(I5>T4,T4,0)))","v":0},{"$f":"IF(Master=\"Master\",Q5,IF(U4=\"\",R5,IF(OR(AND(T5>0,R5<U4),AND(T5=1,R5<=U4)),U4,R5)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(S4=1,T5=1),R5>0,AND(S6=0,V6=1)),1,0))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(T5>0,S5=1),AND(S5=1,V5=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(I5=1,R5=1),2,IF(AND(U4=1,K5=K4),2,IF(AND(AB4=2,K5=K4),2,IF(I5=1,1,\"\"))))","v":2}]
[2467,{"$f":"IF(I6=0,\"\",IF(I6=1,P$1&\".\"&K6,IF(I6=2,P$1&\".\"&K6&\".\"&L6,IF(I6=3,P$1&\".\"&K6&\".\"&L6&\".\"&M6,IF(I6=4,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6,IF(I6=5,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6))))))","v":"B.1.1"},"Risk assessment?","Yes","Cloudamize Security Policy - Cloudamize Risk Assessment Plan","A.1 IT & Infrastructure Risk Governance and Context",null,null,2,null,{"$f":"IF(K5=\"\",1,IF(I6=1,K5+1,K5))","v":1},{"$f":"IF(L5=\"\",0,IF(K5<>K6,0,IF($I6=2,L5+1,L5)))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($I6=3,M5+1,M5)))","v":0},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($I6=4,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($I6=5,O5+1,O5)))","v":0},{"$f":"IF(OR(Master=\"Master\",I6=0,J6=1),0,IF(ISNA(VLOOKUP(A6,L2_Array,21,FALSE)),0,VLOOKUP(A6,L2_Array,21,FALSE)))","v":0},{"$f":"IF(I6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D6=\"Yes\"),AND($L$1=\"Scaled\",D6>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D6=\"No\"),AND($L$1=\"Scaled\",D6<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I6=\"\",\"\",IF(P6>0,P6,IF(Q6>0,Q6,0)))","v":1},1,{"$f":"IF(I6=\"\",T5,IF(AND(R6>1,OR(T5=\"\",T5=0,T5>=I6)),I6,IF(I6>T5,T5,0)))","v":0},{"$f":"IF(Master=\"Master\",Q6,IF(U5=\"\",R6,IF(OR(AND(T6>0,R6<U5),AND(T6=1,R6<=U5)),U5,R6)))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(S5=1,T6=1),R6>0,AND(S7=0,V7=1)),1,0))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(T6>0,S6=1),AND(S6=1,V6=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A6,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(I6=1,R6=1),2,IF(AND(U5=1,K6=K5),2,IF(AND(AB5=2,K6=K5),2,IF(I6=1,1,\"\"))))","v":2}]
[45,"B.1.2","Risk management?","Yes","Cloudamize Security Policy - Cloudamize Risk Assessment Plan","A.1 IT & Infrastructure Risk Governance and Context",null,null,2,null,1,2,0,0,0,0,{"$f":"IF(I7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D7=\"Yes\"),AND($L$1=\"Scaled\",D7>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D7=\"No\"),AND($L$1=\"Scaled\",D7<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[47,"B.1.3","Security awareness training/education?","Yes","Cloudamize Security Policy - Cloudamize Risk Assessment Plan","B.1 Procedure: b.3",null,null,2,null,1,3,0,0,0,0,{"$f":"IF(I8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D8=\"Yes\"),AND($L$1=\"Scaled\",D8>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D8=\"No\"),AND($L$1=\"Scaled\",D8<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[24,"B.1.4","Business continuity?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan","B.1 Procedure: b.9",null,null,2,null,1,4,0,0,0,0,{"$f":"IF(I9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D9=\"Yes\"),AND($L$1=\"Scaled\",D9>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D9=\"No\"),AND($L$1=\"Scaled\",D9<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[57,"B.1.5","Consequences for non-compliance with corporate policies?","Yes","Cloudamize Security Policy - Cloudamize Information Secuirty Policy - Non-Compliance",null,null,null,2,null,1,5,0,0,0,0,{"$f":"IF(I10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D10=\"Yes\"),AND($L$1=\"Scaled\",D10>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D10=\"No\"),AND($L$1=\"Scaled\",D10<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2469,"B.1.6","Responsibilities for information security management?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy",null,"5.1.1","Policies for information security",2,null,1,6,0,0,0,0,{"$f":"IF(I11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D11=\"Yes\"),AND($L$1=\"Scaled\",D11>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D11=\"No\"),AND($L$1=\"Scaled\",D11<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[21,"B.1.7","Acceptable use?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","B.1 Procedure: b.3","5.1.1","Policies for information security",2,null,1,7,0,0,0,0,{"$f":"IF(I12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D12=\"Yes\"),AND($L$1=\"Scaled\",D12>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D12=\"No\"),AND($L$1=\"Scaled\",D12<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[22,"B.1.8","Access control?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy",null,"5.1.1","Policies for information security",2,null,1,8,0,0,0,0,{"$f":"IF(I13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D13=\"Yes\"),AND($L$1=\"Scaled\",D13>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D13=\"No\"),AND($L$1=\"Scaled\",D13<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[23,"B.1.9","Application security?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy",null,null,null,2,null,1,9,0,0,0,0,{"$f":"IF(I14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D14=\"Yes\"),AND($L$1=\"Scaled\",D14>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D14=\"No\"),AND($L$1=\"Scaled\",D14<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[25,"B.1.10","Change control?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy",null,null,null,2,null,1,10,0,0,0,0,{"$f":"IF(I15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D15=\"Yes\"),AND($L$1=\"Scaled\",D15>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D15=\"No\"),AND($L$1=\"Scaled\",D15<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[26,"B.1.11","Clean desk?","Yes","Cloudamize Security Policy - Cloudamize Acceptable Use Policy",null,"5.1.1","Policies for information security",2,null,1,11,0,0,0,0,{"$f":"IF(I16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D16=\"Yes\"),AND($L$1=\"Scaled\",D16>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D16=\"No\"),AND($L$1=\"Scaled\",D16<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[27,"B.1.12","Computer and communication systems access and use?","Yes","Cloudamize Security Policy - Cloudamize Acceptable Use Policy",null,"5.1.1","Policies for information security",2,null,1,12,0,0,0,0,{"$f":"IF(I17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D17=\"Yes\"),AND($L$1=\"Scaled\",D17>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D17=\"No\"),AND($L$1=\"Scaled\",D17<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[28,"B.1.13","Data handling?","Yes","Cloudamize Security Policy - Cloudamize Acceptable Use Policy",null,"5.1.1","Policies for information security",2,null,1,13,0,0,0,0,{"$f":"IF(I18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D18=\"Yes\"),AND($L$1=\"Scaled\",D18>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D18=\"No\"),AND($L$1=\"Scaled\",D18<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[29,"B.1.14","Desktop computing?","Yes","Cloudamize Security Policy - Cloudamize Acceptable Use Policy",null,null,null,2,null,1,14,0,0,0,0,{"$f":"IF(I19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D19=\"Yes\"),AND($L$1=\"Scaled\",D19>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D19=\"No\"),AND($L$1=\"Scaled\",D19<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[30,"B.1.15","Disaster recovery?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,null,null,2,null,1,15,0,0,0,0,{"$f":"IF(I20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D20=\"Yes\"),AND($L$1=\"Scaled\",D20>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D20=\"No\"),AND($L$1=\"Scaled\",D20<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[31,"B.1.16","Email?","Yes","Cloudamize Security Policy - Cloudamize Acceptable Use Policy",null,null,null,2,null,1,16,0,0,0,0,{"$f":"IF(I21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D21=\"Yes\"),AND($L$1=\"Scaled\",D21>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D21=\"No\"),AND($L$1=\"Scaled\",D21<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[32,"B.1.17","Constituent accountability?","Yes","Cloudamize Security Policy - Cloudamize Information Secuirty Policy - Non-Compliance","B.1 Procedure: b.3","5.1.1","Policies for information security",2,null,1,17,0,0,0,0,{"$f":"IF(I22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D22=\"Yes\"),AND($L$1=\"Scaled\",D22>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D22=\"No\"),AND($L$1=\"Scaled\",D22<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[33,"B.1.18","Encryption?","Yes","Cloudamize Security Policy - Cloudamize Acceptable Use Policy",null,null,null,2,null,1,18,0,0,0,0,{"$f":"IF(I23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D23=\"Yes\"),AND($L$1=\"Scaled\",D23>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D23=\"No\"),AND($L$1=\"Scaled\",D23<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[34,"B.1.19","Exception process?","Yes","Cloudamize Security Policy - Cloudamize Acceptable Use Policy",null,"5.1.1","Policies for information security",2,null,1,19,0,0,0,0,{"$f":"IF(I24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D24=\"Yes\"),AND($L$1=\"Scaled\",D24>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D24=\"No\"),AND($L$1=\"Scaled\",D24<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[35,"B.1.20","Information classification?","Yes","Cloudamize Security Policy - Cloudamize Informaiton Classification Policy",null,"5.1.1","Policies for information security",2,null,1,20,0,0,0,0,{"$f":"IF(I25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D25=\"Yes\"),AND($L$1=\"Scaled\",D25>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D25=\"No\"),AND($L$1=\"Scaled\",D25<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[36,"B.1.21","Internet/Intranet access and use?","Yes","Cloudamize Security Policy - Cloudamize Acceptable Use Policy",null,null,null,2,null,1,21,0,0,0,0,{"$f":"IF(I26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D26=\"Yes\"),AND($L$1=\"Scaled\",D26>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D26=\"No\"),AND($L$1=\"Scaled\",D26<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[37,"B.1.22","Mobile computing?","Yes","Cloudamize Security Policy - Cloudamize Acceptable Use Policy",null,null,null,2,null,1,22,0,0,0,0,{"$f":"IF(I27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D27=\"Yes\"),AND($L$1=\"Scaled\",D27>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D27=\"No\"),AND($L$1=\"Scaled\",D27<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[38,"B.1.23","Network security?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy",null,null,null,2,null,1,23,0,0,0,0,{"$f":"IF(I28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D28=\"Yes\"),AND($L$1=\"Scaled\",D28>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D28=\"No\"),AND($L$1=\"Scaled\",D28<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[39,"B.1.24","Operating system security?","Yes","Cloudamize Security Policy - Cloudamize Acceptable Use Policy",null,null,null,2,null,1,24,0,0,0,0,{"$f":"IF(I29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D29=\"Yes\"),AND($L$1=\"Scaled\",D29>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D29=\"No\"),AND($L$1=\"Scaled\",D29<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[40,"B.1.25","Personnel security and termination?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","B.1 Procedure: b.3","5.1.1","Policies for information security",2,null,1,25,0,0,0,0,{"$f":"IF(I30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D30=\"Yes\"),AND($L$1=\"Scaled\",D30>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D30=\"No\"),AND($L$1=\"Scaled\",D30<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[41,"B.1.26","Physical access?","Yes","1735 Market Street Building Security Plan","B.1 Procedure: b.4","5.1.1","Policies for information security",2,null,1,26,0,0,0,0,{"$f":"IF(I31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D31=\"Yes\"),AND($L$1=\"Scaled\",D31>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D31=\"No\"),AND($L$1=\"Scaled\",D31<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[42,"B.1.27","Policy maintenance?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group","B.1 Procedure: b.1","5.1.1","Policies for information security",2,null,1,27,0,0,0,0,{"$f":"IF(I32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D32=\"Yes\"),AND($L$1=\"Scaled\",D32>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D32=\"No\"),AND($L$1=\"Scaled\",D32<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[44,"B.1.28","Remote access?","No",null,"B.1 Procedure: b.6",null,null,2,null,1,28,0,0,0,0,{"$f":"IF(I33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D33=\"Yes\"),AND($L$1=\"Scaled\",D33>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D33=\"No\"),AND($L$1=\"Scaled\",D33<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[48,"B.1.29","Security incident and privacy event management?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group / 1735 Market Street Building Security Plan","B.1 Procedure: b.8","5.1.1","Policies for information security",2,null,1,29,0,0,0,0,{"$f":"IF(I34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D34=\"Yes\"),AND($L$1=\"Scaled\",D34>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D34=\"No\"),AND($L$1=\"Scaled\",D34<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[46,"B.1.30","Secure disposal?","Yes","Cloudamize Security Policy - Information Disposal Policy","B.1 Procedure: b.2",null,null,2,null,1,30,0,0,0,0,{"$f":"IF(I35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D35=\"Yes\"),AND($L$1=\"Scaled\",D35>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D35=\"No\"),AND($L$1=\"Scaled\",D35<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3287,"B.1.31","Social media, social networking?","Yes","Cloudamize Security Policy - Cloudamize Acceptable Use Policy","B.1 Procedure: b.3",null,null,2,null,1,31,0,0,0,0,{"$f":"IF(I36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D36=\"Yes\"),AND($L$1=\"Scaled\",D36>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D36=\"No\"),AND($L$1=\"Scaled\",D36<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[50,"B.1.32","Vulnerability management?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group","B.1 Procedure: b.7","5.1.1","Policies for information security",2,null,1,32,0,0,0,0,{"$f":"IF(I37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D37=\"Yes\"),AND($L$1=\"Scaled\",D37>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D37=\"No\"),AND($L$1=\"Scaled\",D37<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2471,"B.1.33","Have the policies been reviewed in the last 12 months? If yes, did the review include:","Yes","MicroStrategy maintains Secure Cloud Security and Availability Policies and related processes that govern the MicroStrategy Secure Cloud engineering and operations activities. These policies and procedures are in place, reviewed, and updated as needed annually. ","B.1 Procedure: d","5.1.2","Review of the policies for information security",2,null,1,33,0,0,0,1,{"$f":"IF(I38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D38=\"Yes\"),AND($L$1=\"Scaled\",D38>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D38=\"No\"),AND($L$1=\"Scaled\",D38<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[2473,"B.1.33.1","Feedback from interested parties?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"5.1.2","Review of the policies for information security",3,null,1,33,1,0,0,0,{"$f":"IF(I39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D39=\"Yes\"),AND($L$1=\"Scaled\",D39>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D39=\"No\"),AND($L$1=\"Scaled\",D39<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2474,"B.1.33.2","Results of independent reviews?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"5.1.2","Review of the policies for information security",3,null,1,33,2,0,0,0,{"$f":"IF(I40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D40=\"Yes\"),AND($L$1=\"Scaled\",D40>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D40=\"No\"),AND($L$1=\"Scaled\",D40<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2478,"B.1.33.3","Policy compliance?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"5.1.2","Review of the policies for information security",3,null,1,33,3,0,0,0,{"$f":"IF(I41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D41=\"Yes\"),AND($L$1=\"Scaled\",D41>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D41=\"No\"),AND($L$1=\"Scaled\",D41<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2479,"B.1.33.4","Changes that could affect the approach to managing information security?","Yes","No needed changes we discovered",null,"5.1.2","Review of the policies for information security",3,null,1,33,4,0,0,0,{"$f":"IF(I42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D42=\"Yes\"),AND($L$1=\"Scaled\",D42>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D42=\"No\"),AND($L$1=\"Scaled\",D42<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2481,"B.1.33.5","Reported information security incidents?","Yes","Cloudamize Security Policy",null,"5.1.2","Review of the policies for information security",3,null,1,33,5,0,0,0,{"$f":"IF(I43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D43=\"Yes\"),AND($L$1=\"Scaled\",D43>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D43=\"No\"),AND($L$1=\"Scaled\",D43<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2482,"B.1.33.6","Recommendations provided by relevant authorities?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"5.1.2","Review of the policies for information security",3,null,1,33,6,0,0,0,{"$f":"IF(I44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D44=\"Yes\"),AND($L$1=\"Scaled\",D44>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D44=\"No\"),AND($L$1=\"Scaled\",D44<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2483,"B.1.33.7","Records management?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"5.1.2","Review of the policies for information security",3,null,1,33,7,0,0,0,{"$f":"IF(I45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D45=\"Yes\"),AND($L$1=\"Scaled\",D45>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D45=\"No\"),AND($L$1=\"Scaled\",D45<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[53,"B.1.34","Is there a process to approve exceptions to the policy? ","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"5.1.2","Review of the policies for information security",2,null,1,34,0,0,0,0,{"$f":"IF(I46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D46=\"Yes\"),AND($L$1=\"Scaled\",D46>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D46=\"No\"),AND($L$1=\"Scaled\",D46<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[54,"B.1.34.1","Does security own the approval process?","Yes",null,null,"N/A",null,3,null,1,34,1,0,0,0,{"$f":"IF(I47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D47=\"Yes\"),AND($L$1=\"Scaled\",D47>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D47=\"No\"),AND($L$1=\"Scaled\",D47<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[19,"B.1.35","Is the information security policy communicated? If yes, is it communicated to:","Yes","Cloudamize Security Policy - Cloudamize Risk Assessment Plan",null,"5.1.1","Policies for information security",2,null,1,35,0,0,0,0,{"$f":"IF(I48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D48=\"Yes\"),AND($L$1=\"Scaled\",D48>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D48=\"No\"),AND($L$1=\"Scaled\",D48<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[223,"B.1.35.1","Full time constituents?","Yes","Cloudamize Security Policy - Cloudamize Risk Assessment Plan",null,"5.1.1","Policies for information security",3,null,1,35,1,0,0,0,{"$f":"IF(I49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D49=\"Yes\"),AND($L$1=\"Scaled\",D49>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D49=\"No\"),AND($L$1=\"Scaled\",D49<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[224,"B.1.35.2","Part time constituents?","Yes","Cloudamize Security Policy - Cloudamize Risk Assessment Plan",null,"5.1.1","Policies for information security",3,null,1,35,2,0,0,0,{"$f":"IF(I50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D50=\"Yes\"),AND($L$1=\"Scaled\",D50>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D50=\"No\"),AND($L$1=\"Scaled\",D50<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[225,"B.1.35.3","Contractors?","Yes","Cloudamize Security Policy - Cloudamize Risk Assessment Plan",null,"5.1.1","Policies for information security",3,null,1,35,3,0,0,0,{"$f":"IF(I51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D51=\"Yes\"),AND($L$1=\"Scaled\",D51>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D51=\"No\"),AND($L$1=\"Scaled\",D51<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3886,"B.2","Is there a vendor management program?","Yes",null,"B.2 Vendor Management Program",null,null,1,null,2,0,0,0,0,2,{"$f":"IF(I52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D52=\"Yes\"),AND($L$1=\"Scaled\",D52>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D52=\"No\"),AND($L$1=\"Scaled\",D52<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},2,1,1,2,1,1,1,null,null,null,1]
[3887,"B.2.1","Does the vendor management program include an individual or group responsible for capturing, maintaining and tracking subcontractor information security issues? If yes, is there:",null,null,null,"N/A",null,2,null,2,1,0,0,0,0,{"$f":"IF(I53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D53=\"Yes\"),AND($L$1=\"Scaled\",D53>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D53=\"No\"),AND($L$1=\"Scaled\",D53<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3888,"B.2.1.1","Risk rating of the issue (e.g., H/M/L, 1-5, etc.)?",null,null,null,null,null,3,null,2,1,1,0,0,0,{"$f":"IF(I54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D54=\"Yes\"),AND($L$1=\"Scaled\",D54>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D54=\"No\"),AND($L$1=\"Scaled\",D54<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3889,"B.2.1.2","Documented corrective action or remediation plan?",null,null,null,"N/A",null,3,null,2,1,2,0,0,0,{"$f":"IF(I55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D55=\"Yes\"),AND($L$1=\"Scaled\",D55>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D55=\"No\"),AND($L$1=\"Scaled\",D55<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3890,"B.2.1.3","Target remediation date?",null,null,null,"N/A",null,3,null,2,1,3,0,0,0,{"$f":"IF(I56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D56=\"Yes\"),AND($L$1=\"Scaled\",D56>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D56=\"No\"),AND($L$1=\"Scaled\",D56<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3891,"B.2.1.4","On-going communication with subcontractor to discuss status of remediation? ",null,null,null,"N/A",null,3,null,2,1,4,0,0,0,{"$f":"IF(I57=\"\",\"\",IF(D57=\"\",0,IF(D57=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D57=\"Yes\"),AND($L$1=\"Scaled\",D57>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D57=\"No\"),AND($L$1=\"Scaled\",D57<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3892,"B.2.1.5","Escalation procedure if the remediation date is not met?",null,null,null,"N/A",null,3,null,2,1,5,0,0,0,{"$f":"IF(I58=\"\",\"\",IF(D58=\"\",0,IF(D58=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D58=\"Yes\"),AND($L$1=\"Scaled\",D58>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D58=\"No\"),AND($L$1=\"Scaled\",D58<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3893,"B.2.1.6","Sign-off when remediation is fully implemented?",null,null,null,"N/A",null,3,null,2,1,6,0,0,0,{"$f":"IF(I59=\"\",\"\",IF(D59=\"\",0,IF(D59=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D59=\"Yes\"),AND($L$1=\"Scaled\",D59>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D59=\"No\"),AND($L$1=\"Scaled\",D59<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3894,"B.2.1.7","Reporting on remediation? If yes, does it include:",null,null,null,"N/A",null,3,null,2,1,7,0,0,0,{"$f":"IF(I60=\"\",\"\",IF(D60=\"\",0,IF(D60=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D60=\"Yes\"),AND($L$1=\"Scaled\",D60>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D60=\"No\"),AND($L$1=\"Scaled\",D60<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3895,"B.2.1.7.1","Identification of stakeholders?",null,null,null,"N/A",null,4,null,2,1,7,1,0,0,{"$f":"IF(I61=\"\",\"\",IF(D61=\"\",0,IF(D61=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D61=\"Yes\"),AND($L$1=\"Scaled\",D61>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D61=\"No\"),AND($L$1=\"Scaled\",D61<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3896,"B.2.1.7.2","Reporting frequency?",null,null,null,"N/A",null,4,null,2,1,7,2,0,0,{"$f":"IF(I62=\"\",\"\",IF(D62=\"\",0,IF(D62=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D62=\"Yes\"),AND($L$1=\"Scaled\",D62>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D62=\"No\"),AND($L$1=\"Scaled\",D62<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]

{"sheet":"C. Organizational Security","index":9,"n_rows":60,"n_cols":28,"rows_kept":60,"cut":false,"hidden":false,"merged":[[2,1,2,7]]}
[10,"C. Organizational Security",null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,null,"Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"C"}]
[null,null,null,{"$f":"IF(W2=0,\"0%\",W2/S2)","v":1},"Percent Complete",null,null,null,{"$f":"COUNTA(I5:I60)","v":56},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(S5:S60,1)","v":56},null,null,null,{"$f":"COUNTIF(W5:W60,1)","v":56}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column E to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, check the Disable Tab Automation checkbox at the top of the page.",null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter"]
[{"$f":"MAX(A5:A60)","v":2889},"Ques Num","Question/Request","Response","Additional Information","AUP Reference","ISO Ref Num","ISO Ref Text"]
[58,{"$f":"IF(I5=0,\"\",IF(I5=1,P$1&\".\"&K5,IF(I5=2,P$1&\".\"&K5&\".\"&L5,IF(I5=3,P$1&\".\"&K5&\".\"&L5&\".\"&M5,IF(I5=4,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5,IF(I5=5,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5))))))","v":"C.1"},"Is there a respondent information security function responsible for security initiatives? If yes, does it include:","Yes","Cloudamize Security Policy - Cloudamize Security Working Group","C.3 Security Organization Roles/Responsibilities","6.1.1","Information Security Roles and Responsibilities",1,null,{"$f":"IF(K4=\"\",1,IF(I5=1,K4+1,K4))","v":1},{"$f":"IF(L4=\"\",0,IF(K4<>K5,0,IF($I5=2,L4+1,L4)))","v":0},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($I5=3,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($I5=4,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($I5=5,O4+1,O4)))","v":0},{"$f":"IF(OR(Master=\"Master\",I5=0,J5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,21,FALSE)),0,VLOOKUP(A5,L2_Array,21,FALSE)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D5=\"Yes\"),AND($L$1=\"Scaled\",D5>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D5=\"No\"),AND($L$1=\"Scaled\",D5<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I5=\"\",\"\",IF(P5>0,P5,IF(Q5>0,Q5,0)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(I5=1,S4=\"\"),1,IF(OR(AND(J4=1,(I5-I3<>0)),AND(S4=0,I4=I5),AND(J4=1,I5=I3)),0,1)))","v":1},{"$f":"IF(I5=\"\",T4,IF(AND(R5>1,OR(T4=\"\",T4=0,T4>=I5)),I5,IF(I5>T4,T4,0)))","v":0},{"$f":"IF(Master=\"Master\",Q5,IF(U4=\"\",R5,IF(OR(AND(T5>0,R5<U4),AND(T5=1,R5<=U4)),U4,R5)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(S4=1,T5=1),R5>0,AND(S6=0,V6=1)),1,0))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(T5>0,S5=1),AND(S5=1,V5=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(I5=1,R5=1),2,IF(AND(U4=1,K5=K4),2,IF(AND(AB4=2,K5=K4),2,IF(I5=1,1,\"\"))))","v":2}]
[61,{"$f":"IF(I6=0,\"\",IF(I6=1,P$1&\".\"&K6,IF(I6=2,P$1&\".\"&K6&\".\"&L6,IF(I6=3,P$1&\".\"&K6&\".\"&L6&\".\"&M6,IF(I6=4,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6,IF(I6=5,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6))))))","v":"C.1.1"},"Creation, review and approve of information security policies?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"5.1.2","Review of the policies for information security",2,null,{"$f":"IF(K5=\"\",1,IF(I6=1,K5+1,K5))","v":1},{"$f":"IF(L5=\"\",0,IF(K5<>K6,0,IF($I6=2,L5+1,L5)))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($I6=3,M5+1,M5)))","v":0},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($I6=4,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($I6=5,O5+1,O5)))","v":0},0,{"$f":"IF(I6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D6=\"Yes\"),AND($L$1=\"Scaled\",D6>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D6=\"No\"),AND($L$1=\"Scaled\",D6<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I6=\"\",\"\",IF(P6>0,P6,IF(Q6>0,Q6,0)))","v":1},1,{"$f":"IF(I6=\"\",T5,IF(AND(R6>1,OR(T5=\"\",T5=0,T5>=I6)),I6,IF(I6>T5,T5,0)))","v":0},1,{"$f":"IF(I6=\"\",\"\",IF(OR(AND(S5=1,T6=1),R6>0,AND(S7=0,V7=1)),1,0))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(T6>0,S6=1),AND(S6=1,V6=1)),1,0))","v":1},0,null,null,null,{"$f":"IF(AND(I6=1,R6=1),2,IF(AND(U5=1,K6=K5),2,IF(AND(AB5=2,K6=K5),2,IF(I6=1,1,\"\"))))","v":2}]
[2488,"C.1.2","Review the effectiveness of information security policy implementation?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"5.1.2","Management commitment to information security",2,null,1,2,0,0,0,0,{"$f":"IF(I7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D7=\"Yes\"),AND($L$1=\"Scaled\",D7>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D7=\"No\"),AND($L$1=\"Scaled\",D7<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2490,"C.1.3","Manage assignment of specific roles and responsibilities for information security?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"6.1.1.c","Management commitment to information security",2,null,1,3,0,0,0,0,{"$f":"IF(I8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D8=\"Yes\"),AND($L$1=\"Scaled\",D8>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D8=\"No\"),AND($L$1=\"Scaled\",D8<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[65,"C.1.4","Develop and maintain an overall strategic security plan?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,6.1,"Internal Organization",2,null,1,4,0,0,0,0,{"$f":"IF(I9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D9=\"Yes\"),AND($L$1=\"Scaled\",D9>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D9=\"No\"),AND($L$1=\"Scaled\",D9<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2494,"C.1.5","Consistent implementation of information security across different parts of the respondent's organization?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"5.1.1","Policies for Information security",2,null,1,5,0,0,0,0,{"$f":"IF(I10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D10=\"Yes\"),AND($L$1=\"Scaled\",D10>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D10=\"No\"),AND($L$1=\"Scaled\",D10<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[63,"C.1.6","Review and monitor information security / privacy incidents or events?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"18.2.1","Independent review of information security",2,null,1,6,0,0,0,0,{"$f":"IF(I11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D11=\"Yes\"),AND($L$1=\"Scaled\",D11>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D11=\"No\"),AND($L$1=\"Scaled\",D11<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[62,"C.1.7","Monitor significant changes in the exposure of information assets?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"6.1.1","Information Security Roles and Responsibilities",2,null,1,7,0,0,0,0,{"$f":"IF(I12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D12=\"Yes\"),AND($L$1=\"Scaled\",D12>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D12=\"No\"),AND($L$1=\"Scaled\",D12<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2500,"C.1.8","Contacts with information security special interest groups, specialist security forums, or professional associations?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"6.1.4","Contact with special interest groups",2,null,1,8,0,0,0,0,{"$f":"IF(I13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D13=\"Yes\"),AND($L$1=\"Scaled\",D13>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D13=\"No\"),AND($L$1=\"Scaled\",D13<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[67,"C.1.9","Identify and document instances of non-compliance with security policies?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"18.2.2","Compliance with security policies and standards",2,null,1,9,0,0,0,0,{"$f":"IF(I14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D14=\"Yes\"),AND($L$1=\"Scaled\",D14>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D14=\"No\"),AND($L$1=\"Scaled\",D14<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2889,"C.1.10","Identify key Information Technology roles?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"6.1.1","Information Security Roles and Responsibilities",2,null,1,10,0,0,0,0,{"$f":"IF(I15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D15=\"Yes\"),AND($L$1=\"Scaled\",D15>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D15=\"No\"),AND($L$1=\"Scaled\",D15<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[71,"C.2","Do external parties have access to Scoped Systems and Data or processing facilities? If yes, is:","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,15,"Supplier relationships",1,null,2,0,0,0,0,1,{"$f":"IF(I16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D16=\"Yes\"),AND($L$1=\"Scaled\",D16>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D16=\"No\"),AND($L$1=\"Scaled\",D16<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[2512,"C.2.1","Access prohibited prior to a risk assessment being conducted?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.1","Information security policy for supplier relationships",2,null,2,1,0,0,0,0,{"$f":"IF(I17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D17=\"Yes\"),AND($L$1=\"Scaled\",D17>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D17=\"No\"),AND($L$1=\"Scaled\",D17<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2514,"C.2.2","A risk assessment performed on third parties?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.1","Information security policy for supplier relationships",2,null,2,2,0,0,0,0,{"$f":"IF(I18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D18=\"Yes\"),AND($L$1=\"Scaled\",D18>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D18=\"No\"),AND($L$1=\"Scaled\",D18<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[101,"C.2.3","A controls assessment performed on third parties?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.1","Information security policy for supplier relationships",2,null,2,3,0,0,0,0,{"$f":"IF(I19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D19=\"Yes\"),AND($L$1=\"Scaled\",D19>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D19=\"No\"),AND($L$1=\"Scaled\",D19<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2516,"C.2.4","Agreements in place when customers access Scoped Systems and Data?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",2,null,2,4,0,0,0,0,{"$f":"IF(I20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D20=\"Yes\"),AND($L$1=\"Scaled\",D20>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D20=\"No\"),AND($L$1=\"Scaled\",D20<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2501,"C.2.5","Does management require the use of confidentiality or non-disclosure agreements for all third parties? If yes, do they contain:","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"7.1.2.a","Terms and conditions of employment",2,null,2,5,0,0,0,0,{"$f":"IF(I21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D21=\"Yes\"),AND($L$1=\"Scaled\",D21>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D21=\"No\"),AND($L$1=\"Scaled\",D21<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2506,"C.2.5.1","Ownership of information, trade secrets and intellectual property?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,5,1,0,0,0,{"$f":"IF(I22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D22=\"Yes\"),AND($L$1=\"Scaled\",D22>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D22=\"No\"),AND($L$1=\"Scaled\",D22<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2507,"C.2.5.2","Permitted use of confidential information, and granting of rights to the signatory to use information?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,5,2,0,0,0,{"$f":"IF(I23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D23=\"Yes\"),AND($L$1=\"Scaled\",D23>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D23=\"No\"),AND($L$1=\"Scaled\",D23<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2509,"C.2.5.3","Process for notification and reporting of unauthorized disclosure or confidential information breaches?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,5,3,0,0,0,{"$f":"IF(I24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D24=\"Yes\"),AND($L$1=\"Scaled\",D24>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D24=\"No\"),AND($L$1=\"Scaled\",D24<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2511,"C.2.5.4","Expected actions to be taken in case of a breach of this agreement?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,5,4,0,0,0,{"$f":"IF(I25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D25=\"Yes\"),AND($L$1=\"Scaled\",D25>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D25=\"No\"),AND($L$1=\"Scaled\",D25<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[72,"C.2.6","Are there contracts with third party service providers who have access to Scoped Systems and Data ? If yes, do they include: ","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud","C.2 Dependent Service Provider Agreements","15.1.2","Addressing security within supplier agreements",2,null,2,6,0,0,0,0,{"$f":"IF(I26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D26=\"Yes\"),AND($L$1=\"Scaled\",D26>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D26=\"No\"),AND($L$1=\"Scaled\",D26<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[74,"C.2.6.1","Non-Disclosure Agreement?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,null,null,3,null,2,6,1,0,0,0,{"$f":"IF(I27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D27=\"Yes\"),AND($L$1=\"Scaled\",D27>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D27=\"No\"),AND($L$1=\"Scaled\",D27<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[73,"C.2.6.2","Confidentiality Agreement?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,null,null,3,null,2,6,2,0,0,0,{"$f":"IF(I28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D28=\"Yes\"),AND($L$1=\"Scaled\",D28>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D28=\"No\"),AND($L$1=\"Scaled\",D28<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[88,"C.2.6.3","Media handling?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,null,null,3,null,2,6,3,0,0,0,{"$f":"IF(I29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D29=\"Yes\"),AND($L$1=\"Scaled\",D29>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D29=\"No\"),AND($L$1=\"Scaled\",D29<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[100,"C.2.6.4","Requirement of an awareness program to communicate security standards and expectations?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,4,0,0,0,{"$f":"IF(I30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D30=\"Yes\"),AND($L$1=\"Scaled\",D30>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D30=\"No\"),AND($L$1=\"Scaled\",D30<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2517,"C.2.6.5","Responsibilities regarding hardware and software installation and maintenance?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,null,null,3,null,2,6,5,0,0,0,{"$f":"IF(I31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D31=\"Yes\"),AND($L$1=\"Scaled\",D31>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D31=\"No\"),AND($L$1=\"Scaled\",D31<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2518,"C.2.6.6","Clear reporting structure and agreed reporting formats?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.2.1","Monitoring and review of supplier services",3,null,2,6,6,0,0,0,{"$f":"IF(I32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D32=\"Yes\"),AND($L$1=\"Scaled\",D32>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D32=\"No\"),AND($L$1=\"Scaled\",D32<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2519,"C.2.6.7","Clear and specified process of change management?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,null,null,3,null,2,6,7,0,0,0,{"$f":"IF(I33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D33=\"Yes\"),AND($L$1=\"Scaled\",D33>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D33=\"No\"),AND($L$1=\"Scaled\",D33<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[80,"C.2.6.8","Notification of change?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,null,null,3,null,2,6,8,0,0,0,{"$f":"IF(I34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D34=\"Yes\"),AND($L$1=\"Scaled\",D34>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D34=\"No\"),AND($L$1=\"Scaled\",D34<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[99,"C.2.6.9","Process to address any identified issues?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,9,0,0,0,{"$f":"IF(I35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D35=\"Yes\"),AND($L$1=\"Scaled\",D35>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D35=\"No\"),AND($L$1=\"Scaled\",D35<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2520,"C.2.6.10","Access control policy?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,10,0,0,0,{"$f":"IF(I36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D36=\"Yes\"),AND($L$1=\"Scaled\",D36>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D36=\"No\"),AND($L$1=\"Scaled\",D36<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[81,"C.2.6.11","Breach notification?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,11,0,0,{"$f":"IF(OR(Master=\"Master\",I37=0,J37=1),0,IF(ISNA(VLOOKUP(A37,L2_Array,21,FALSE)),0,VLOOKUP(A37,L2_Array,21,FALSE)))","v":0},{"$f":"IF(I37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D37=\"Yes\"),AND($L$1=\"Scaled\",D37>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D37=\"No\"),AND($L$1=\"Scaled\",D37<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,{"$f":"IF(Master=\"Master\",Q37,IF(U36=\"\",R37,IF(OR(AND(T37>0,R37<U36),AND(T37=1,R37<=U36)),U36,R37)))","v":1},1,1,{"$f":"IF(ISNA(VLOOKUP(A37,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,2]
[2521,"C.2.6.12","Description of the product or service to be provided?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,12,0,0,0,{"$f":"IF(I38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D38=\"Yes\"),AND($L$1=\"Scaled\",D38>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D38=\"No\"),AND($L$1=\"Scaled\",D38<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2522,"C.2.6.13","Description of the information to be made available along with its security classification?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,13,0,0,0,{"$f":"IF(I39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D39=\"Yes\"),AND($L$1=\"Scaled\",D39>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D39=\"No\"),AND($L$1=\"Scaled\",D39<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[82,"C.2.6.14","SLAs?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,14,0,0,0,{"$f":"IF(I40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D40=\"Yes\"),AND($L$1=\"Scaled\",D40>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D40=\"No\"),AND($L$1=\"Scaled\",D40<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[76,"C.2.6.15","Audit reporting?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,15,0,0,0,{"$f":"IF(I41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D41=\"Yes\"),AND($L$1=\"Scaled\",D41>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D41=\"No\"),AND($L$1=\"Scaled\",D41<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[92,"C.2.6.16","Ongoing monitoring?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.3","Information and Communication technology supply chain",3,null,2,6,16,0,0,0,{"$f":"IF(I42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D42=\"Yes\"),AND($L$1=\"Scaled\",D42>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D42=\"No\"),AND($L$1=\"Scaled\",D42<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[98,"C.2.6.17","A process to regularly monitor to ensure compliance with security standards?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.3","Information and Communication technology supply chain",3,null,2,6,17,0,0,0,{"$f":"IF(I43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D43=\"Yes\"),AND($L$1=\"Scaled\",D43>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D43=\"No\"),AND($L$1=\"Scaled\",D43<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[77,"C.2.6.18","Onsite review?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.3","Information and Communication technology supply chain",3,null,2,6,18,0,0,0,{"$f":"IF(I44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D44=\"Yes\"),AND($L$1=\"Scaled\",D44>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D44=\"No\"),AND($L$1=\"Scaled\",D44<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[78,"C.2.6.19","Right to audit?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,19,0,0,0,{"$f":"IF(I45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D45=\"Yes\"),AND($L$1=\"Scaled\",D45>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D45=\"No\"),AND($L$1=\"Scaled\",D45<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[79,"C.2.6.20","Right to inspect?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,20,0,0,0,{"$f":"IF(I46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D46=\"Yes\"),AND($L$1=\"Scaled\",D46>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D46=\"No\"),AND($L$1=\"Scaled\",D46<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[91,"C.2.6.21","Problem reporting and escalation procedures?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,21,0,0,0,{"$f":"IF(I47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D47=\"Yes\"),AND($L$1=\"Scaled\",D47>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D47=\"No\"),AND($L$1=\"Scaled\",D47<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[96,"C.2.6.22","Business resumption responsibilities?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,null,null,3,null,2,6,22,0,0,0,{"$f":"IF(I48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D48=\"Yes\"),AND($L$1=\"Scaled\",D48>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D48=\"No\"),AND($L$1=\"Scaled\",D48<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[85,"C.2.6.23","Indemnification/liability?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,23,0,0,0,{"$f":"IF(I49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D49=\"Yes\"),AND($L$1=\"Scaled\",D49>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D49=\"No\"),AND($L$1=\"Scaled\",D49<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[87,"C.2.6.24","Privacy requirements?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,24,0,0,0,{"$f":"IF(I50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D50=\"Yes\"),AND($L$1=\"Scaled\",D50>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D50=\"No\"),AND($L$1=\"Scaled\",D50<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[90,"C.2.6.25","Dispute resolution?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,25,0,0,0,{"$f":"IF(I51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D51=\"Yes\"),AND($L$1=\"Scaled\",D51>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D51=\"No\"),AND($L$1=\"Scaled\",D51<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[94,"C.2.6.26","Choice of venue?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,null,null,3,null,2,6,26,0,0,0,{"$f":"IF(I52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D52=\"Yes\"),AND($L$1=\"Scaled\",D52>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D52=\"No\"),AND($L$1=\"Scaled\",D52<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[83,"C.2.6.27","Data ownership?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,27,0,0,0,{"$f":"IF(I53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D53=\"Yes\"),AND($L$1=\"Scaled\",D53>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D53=\"No\"),AND($L$1=\"Scaled\",D53<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[95,"C.2.6.28","Ownership of intellectual property?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,28,0,0,0,{"$f":"IF(I54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D54=\"Yes\"),AND($L$1=\"Scaled\",D54>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D54=\"No\"),AND($L$1=\"Scaled\",D54<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2523,"C.2.6.29","Involvement of the third party with subcontractors?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,29,0,0,0,{"$f":"IF(I55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D55=\"Yes\"),AND($L$1=\"Scaled\",D55>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D55=\"No\"),AND($L$1=\"Scaled\",D55<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2524,"C.2.6.30","Security controls these subcontractors need to implement?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,30,0,0,0,{"$f":"IF(I56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D56=\"Yes\"),AND($L$1=\"Scaled\",D56>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D56=\"No\"),AND($L$1=\"Scaled\",D56<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[86,"C.2.6.31","Termination/exit clause?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,null,null,3,null,2,6,31,0,0,0,{"$f":"IF(I57=\"\",\"\",IF(D57=\"\",0,IF(D57=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D57=\"Yes\"),AND($L$1=\"Scaled\",D57>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D57=\"No\"),AND($L$1=\"Scaled\",D57<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2525,"C.2.6.32","Contingency plan in case either party wishes to terminate the relationship before the end of the agreements?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,null,null,3,null,2,6,32,0,0,0,{"$f":"IF(I58=\"\",\"\",IF(D58=\"\",0,IF(D58=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D58=\"Yes\"),AND($L$1=\"Scaled\",D58>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D58=\"No\"),AND($L$1=\"Scaled\",D58<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2526,"C.2.6.33","Renegotiation of agreements if the security requirements of the respondent change?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,null,null,3,null,2,6,33,0,0,0,{"$f":"IF(I59=\"\",\"\",IF(D59=\"\",0,IF(D59=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D59=\"Yes\"),AND($L$1=\"Scaled\",D59>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D59=\"No\"),AND($L$1=\"Scaled\",D59<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2527,"C.2.6.34","Current documentation of asset lists, licenses, agreements or rights relating to them?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud",null,"15.2.2","Managing changes to supplier services",3,null,2,6,34,0,0,0,{"$f":"IF(I60=\"\",\"\",IF(D60=\"\",0,IF(D60=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D60=\"Yes\"),AND($L$1=\"Scaled\",D60>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D60=\"No\"),AND($L$1=\"Scaled\",D60<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]

{"sheet":"D. Asset Management","index":10,"n_rows":36,"n_cols":28,"rows_kept":36,"cut":false,"hidden":false,"merged":[[2,1,2,7]]}
[10,"D. Asset Management",null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,null,"Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"D"}]
[null,null,null,{"$f":"IF(W2=0,\"0%\",W2/S2)","v":1},"Percent Complete",null,null,null,{"$f":"COUNTA(I5:I36)","v":32},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(S5:S36,1)","v":32},null,null,null,{"$f":"COUNTIF(W5:W36,1)","v":32}]
["Serial N/A","Questionnaire Instructions:\n     - For each question choose either Yes, N/A or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column E to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, check the Disable Tab Automation checkbox at the top of the page.",null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter"]
[{"$f":"MAX(A5:A36)","v":3201},"Ques Num","Question/Request","Response","Additional Information","AUP Reference","ISO Ref Num","ISO Ref Text"]
[3200,{"$f":"IF(I5=0,\"\",IF(I5=1,P$1&\".\"&K5,IF(I5=2,P$1&\".\"&K5&\".\"&L5,IF(I5=3,P$1&\".\"&K5&\".\"&L5&\".\"&M5,IF(I5=4,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5,IF(I5=5,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5))))))","v":"D.1"},"Is there an asset management policy or program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy","D. Assessment Management",8.1,"Responsibility For Assets",1,null,{"$f":"IF(K4=\"\",1,IF(I5=1,K4+1,K4))","v":1},{"$f":"IF(L4=\"\",0,IF(K4<>K5,0,IF($I5=2,L4+1,L4)))","v":0},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($I5=3,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($I5=4,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($I5=5,O4+1,O4)))","v":0},{"$f":"IF(OR(Master=\"Master\",I5=0,J5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,21,FALSE)),0,VLOOKUP(A5,L2_Array,21,FALSE)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D5=\"Yes\"),AND($L$1=\"Scaled\",D5>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D5=\"No\"),AND($L$1=\"Scaled\",D5<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I5=\"\",\"\",IF(P5>0,P5,IF(Q5>0,Q5,0)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(I5=1,S4=\"\"),1,IF(OR(AND(J4=1,(I5-I3<>0)),AND(S4=0,I4=I5),AND(J4=1,I5=I3)),0,1)))","v":1},{"$f":"IF(I5=\"\",T4,IF(AND(R5>1,OR(T4=\"\",T4=0,T4>=I5)),I5,IF(I5>T4,T4,0)))","v":0},{"$f":"IF(Master=\"Master\",Q5,IF(U4=\"\",R5,IF(OR(AND(T5>0,R5<U4),AND(T5=1,R5<=U4)),U4,R5)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(S4=1,T5=1),R5>0,AND(S6=0,V6=1)),1,0))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(T5>0,S5=1),AND(S5=1,V5=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(I5=1,R5=1),2,IF(AND(U4=1,K5=K4),2,IF(AND(AB4=2,K5=K4),2,IF(I5=1,1,\"\"))))","v":2}]
[106,{"$f":"IF(I6=0,\"\",IF(I6=1,P$1&\".\"&K6,IF(I6=2,P$1&\".\"&K6&\".\"&L6,IF(I6=3,P$1&\".\"&K6&\".\"&L6&\".\"&M6,IF(I6=4,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6,IF(I6=5,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6))))))","v":"D.1.1"},"Is there an inventory system for hardware and software assets? If yes, does it include:","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy","D.1 Asset Accounting and Inventory","8.1.1","Inventory Of Assets",2,null,{"$f":"IF(K5=\"\",1,IF(I6=1,K5+1,K5))","v":1},{"$f":"IF(L5=\"\",0,IF(K5<>K6,0,IF($I6=2,L5+1,L5)))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($I6=3,M5+1,M5)))","v":0},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($I6=4,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($I6=5,O5+1,O5)))","v":0},0,{"$f":"IF(I6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D6=\"Yes\"),AND($L$1=\"Scaled\",D6>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D6=\"No\"),AND($L$1=\"Scaled\",D6<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I6=\"\",\"\",IF(P6>0,P6,IF(Q6>0,Q6,0)))","v":1},1,{"$f":"IF(I6=\"\",T5,IF(AND(R6>1,OR(T5=\"\",T5=0,T5>=I6)),I6,IF(I6>T5,T5,0)))","v":0},1,{"$f":"IF(I6=\"\",\"\",IF(OR(AND(S5=1,T6=1),R6>0,AND(S7=0,V7=1)),1,0))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(T6>0,S6=1),AND(S6=1,V6=1)),1,0))","v":1},0,null,null,null,{"$f":"IF(AND(I6=1,R6=1),2,IF(AND(U5=1,K6=K5),2,IF(AND(AB5=2,K6=K5),2,IF(I6=1,1,\"\"))))","v":2}]
[108,"D.1.1.1","Asset control tag?","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy","D.1.c.1","N/A","",3,null,1,1,1,0,0,0,{"$f":"IF(I7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D7=\"Yes\"),AND($L$1=\"Scaled\",D7>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D7=\"No\"),AND($L$1=\"Scaled\",D7<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[113,"D.1.1.2","Operating system?","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy","D.1.c.4","N/A","",3,null,1,1,2,0,0,0,{"$f":"IF(I8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D8=\"Yes\"),AND($L$1=\"Scaled\",D8>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D8=\"No\"),AND($L$1=\"Scaled\",D8<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[114,"D.1.1.3","Physical location?","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy","D.1.c.2","N/A","",3,null,1,1,3,0,0,0,{"$f":"IF(I9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D9=\"Yes\"),AND($L$1=\"Scaled\",D9>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D9=\"No\"),AND($L$1=\"Scaled\",D9<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[115,"D.1.1.4","Serial number?","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy",null,"N/A","",3,null,1,1,4,0,0,0,{"$f":"IF(I10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D10=\"Yes\"),AND($L$1=\"Scaled\",D10>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D10=\"No\"),AND($L$1=\"Scaled\",D10<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[109,"D.1.1.5","Business function supported?","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy",null,"N/A","",3,null,1,1,5,0,0,0,{"$f":"IF(I11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D11=\"Yes\"),AND($L$1=\"Scaled\",D11>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D11=\"No\"),AND($L$1=\"Scaled\",D11<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[110,"D.1.1.6","Environment (dev, test, etc.)?","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy","D.1.c.5","N/A","",3,null,1,1,6,0,0,0,{"$f":"IF(I12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D12=\"Yes\"),AND($L$1=\"Scaled\",D12>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D12=\"No\"),AND($L$1=\"Scaled\",D12<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[112,"D.1.1.7","IP address?","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy",null,"N/A","",3,null,1,1,7,0,0,0,{"$f":"IF(I13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D13=\"Yes\"),AND($L$1=\"Scaled\",D13>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D13=\"No\"),AND($L$1=\"Scaled\",D13<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[119,"D.1.2","Is there a detailed description of software licenses (number of seats, concurrent users, etc.) ?","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy","D.1 Asset Accounting and Inventory","N/A","",2,null,1,2,0,0,0,0,{"$f":"IF(I14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D14=\"Yes\"),AND($L$1=\"Scaled\",D14>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D14=\"No\"),AND($L$1=\"Scaled\",D14<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[120,"D.1.3","Is ownership assigned for information and assets? If yes, is the owner responsible to:","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy",null,"8.1.2","Ownership Of Assets",2,null,1,3,0,0,0,0,{"$f":"IF(I15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D15=\"Yes\"),AND($L$1=\"Scaled\",D15>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D15=\"No\"),AND($L$1=\"Scaled\",D15<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2530,"D.1.3.1","Appropriately classify information and assets?","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy",null,"8.2.1","Classification of Information",3,null,1,3,1,0,0,0,{"$f":"IF(I16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D16=\"Yes\"),AND($L$1=\"Scaled\",D16>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D16=\"No\"),AND($L$1=\"Scaled\",D16<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[121,"D.1.3.2","Review and approve access to those information and assets?","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy",null,"8.1.2","Ownership Of Assets",3,null,1,3,2,0,0,0,{"$f":"IF(I17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D17=\"Yes\"),AND($L$1=\"Scaled\",D17>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D17=\"No\"),AND($L$1=\"Scaled\",D17<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2531,"D.1.3.3","Establish, document and implement rules for the acceptable use of information and assets?","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy",null,"8.1.3","Acceptable Use Of Assets",3,null,1,3,3,0,0,0,{"$f":"IF(I18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D18=\"Yes\"),AND($L$1=\"Scaled\",D18>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D18=\"No\"),AND($L$1=\"Scaled\",D18<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2532,"D.2","Are information and assets classified?","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy","D.1.c.6","8.2.1","Classification of Information",1,null,2,0,0,0,0,1,{"$f":"IF(I19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D19=\"Yes\"),AND($L$1=\"Scaled\",D19>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D19=\"No\"),AND($L$1=\"Scaled\",D19<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[3201,"D.2.1","Is there an information asset classification policy or program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy",null,"8.2.1","Classification of Information",2,null,2,1,0,0,0,0,{"$f":"IF(I20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D20=\"Yes\"),AND($L$1=\"Scaled\",D20>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D20=\"No\"),AND($L$1=\"Scaled\",D20<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2533,"D.2.2","Is there a procedure for handling of information and assets? If yes, does it include:","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","G.15 Physical Media Tracking","8.2.3","Handling of assets",2,null,2,2,0,0,0,0,{"$f":"IF(I21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D21=\"Yes\"),AND($L$1=\"Scaled\",D21>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D21=\"No\"),AND($L$1=\"Scaled\",D21<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[136,"D.2.2.1","Data ownership?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy",null,"8.1.2","Ownership Of Assets",3,null,2,2,1,0,0,0,{"$f":"IF(I22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D22=\"Yes\"),AND($L$1=\"Scaled\",D22>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D22=\"No\"),AND($L$1=\"Scaled\",D22<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[128,"D.2.2.2","Data access controls including authorization?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy",null,"8.2.3","Handling of assets",3,null,2,2,2,0,0,0,{"$f":"IF(I23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D23=\"Yes\"),AND($L$1=\"Scaled\",D23>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D23=\"No\"),AND($L$1=\"Scaled\",D23<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[134,"D.2.2.3","Data labeling?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy",null,"8.2.2","Labeling of information",3,null,2,2,3,0,0,0,{"$f":"IF(I24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D24=\"Yes\"),AND($L$1=\"Scaled\",D24>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D24=\"No\"),AND($L$1=\"Scaled\",D24<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[135,"D.2.2.4","Data on removable media?","Yes","Cloudamize Security Policy - Cloudamize Removable Media Policy",null,"8.3.1","Management Of Removable Media",3,null,2,2,4,0,0,0,{"$f":"IF(I25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D25=\"Yes\"),AND($L$1=\"Scaled\",D25>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D25=\"No\"),AND($L$1=\"Scaled\",D25<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[133,"D.2.2.5","Data in transit?","Yes","Cloudamize Security Policy - Cloudamize Removable Media Policy","G.16 Security of Media in Transit","8.3.3","Physical media transfer",3,null,2,2,5,0,0,0,{"$f":"IF(I26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D26=\"Yes\"),AND($L$1=\"Scaled\",D26>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D26=\"No\"),AND($L$1=\"Scaled\",D26<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[131,"D.2.2.6","Data encryption?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","G.22 Data Security Policy - Encryption","10.1.1","Policy on the use of cryptographic controls",3,null,2,2,6,0,0,0,{"$f":"IF(I27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D27=\"Yes\"),AND($L$1=\"Scaled\",D27>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D27=\"No\"),AND($L$1=\"Scaled\",D27<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[132,"D.2.2.7","Data in storage?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy",null,"11.2.6","Security of equipment and assets off-premise",3,null,2,2,7,0,0,0,{"$f":"IF(I28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D28=\"Yes\"),AND($L$1=\"Scaled\",D28>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D28=\"No\"),AND($L$1=\"Scaled\",D28<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[137,"D.2.2.8","Data reclassification?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy",null,"8.1.2","Ownership Of Assets",3,null,2,2,8,0,0,0,{"$f":"IF(I29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D29=\"Yes\"),AND($L$1=\"Scaled\",D29>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D29=\"No\"),AND($L$1=\"Scaled\",D29<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[138,"D.2.2.9","Data retention?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy",null,null,"",3,null,2,2,9,0,0,0,{"$f":"IF(I30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D30=\"Yes\"),AND($L$1=\"Scaled\",D30>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D30=\"No\"),AND($L$1=\"Scaled\",D30<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[129,"D.2.2.10","Data destruction?","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy","D.2 Asset Destruction","8.1.2","Ownership Of Assets",3,null,2,2,10,0,0,0,{"$f":"IF(I31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D31=\"Yes\"),AND($L$1=\"Scaled\",D31>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D31=\"No\"),AND($L$1=\"Scaled\",D31<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[130,"D.2.2.11","Data disposal?","Yes","Cloudamize Security Policy - Cloudamize Information Disposal Policy","D.2 Asset Destruction","8.3.2","Disposal Of Media",3,null,2,2,11,0,0,0,{"$f":"IF(I32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D32=\"Yes\"),AND($L$1=\"Scaled\",D32>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D32=\"No\"),AND($L$1=\"Scaled\",D32<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2534,"D.2.2.12","Reviewed at least annually?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"8.1.2","Ownership Of Assets",3,null,2,2,12,0,0,0,{"$f":"IF(I33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D33=\"Yes\"),AND($L$1=\"Scaled\",D33>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D33=\"No\"),AND($L$1=\"Scaled\",D33<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2535,"D.2.2.13","Data handling based on classification?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","G.15 Physical Media Tracking","8.2.3","Handling of assets",3,null,2,2,13,0,0,0,{"$f":"IF(I34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D34=\"Yes\"),AND($L$1=\"Scaled\",D34>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D34=\"No\"),AND($L$1=\"Scaled\",D34<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[139,"D.2.2.14","Physical media destruction?","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy","D.2 Asset Destruction","8.3.2","Disposal Of Media",3,null,2,2,14,0,0,0,{"$f":"IF(I35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D35=\"Yes\"),AND($L$1=\"Scaled\",D35>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D35=\"No\"),AND($L$1=\"Scaled\",D35<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[140,"D.2.2.15","Reuse of physical media (tapes, disk drives, etc.)?","Yes","Cloudamize Security Policy - Cloudamize Removable Media Policy",null,"11.2.7","Secure Disposal Or Re-Use Of Equipment",3,null,2,2,15,0,0,0,{"$f":"IF(I36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D36=\"Yes\"),AND($L$1=\"Scaled\",D36>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D36=\"No\"),AND($L$1=\"Scaled\",D36<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]

{"sheet":"E. Human Resource Security","index":11,"n_rows":49,"n_cols":28,"rows_kept":49,"cut":false,"hidden":false,"merged":[[2,1,2,7]]}
[10,"E. Human Resource Security",null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,null,"Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"E"}]
[null,null,null,{"$f":"IF(W2=0,\"0%\",W2/S2)","v":1},"Percent Complete",null,null,null,{"$f":"COUNTA(I5:I49)","v":45},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(S5:S49,1)","v":44},null,null,null,{"$f":"COUNTIF(W5:W49,1)","v":44}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column E to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, check the Disable Tab Automation checkbox at the top of the page.",null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter"]
[{"$f":"MAX(A5:A49)","v":4013},"Ques Num","Question/Request","Response","Additional Information","AUP Reference","ISO Ref Num","ISO Ref Text"]
[2536,{"$f":"IF(I5=0,\"\",IF(I5=1,P$1&\".\"&K5,IF(I5=2,P$1&\".\"&K5&\".\"&L5,IF(I5=3,P$1&\".\"&K5&\".\"&L5&\".\"&M5,IF(I5=4,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5,IF(I5=5,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5))))))","v":"E.1"},"Are security roles and responsibilities of constituents defined and documented in accordance with the respondent’s information security policy?","Yes","Cloudamize Security Policy - Cloudamize Security Work Group","C.3 Security Organization Roles/Responsibilities","6.1.1","Information security roles and responsibilities",1,null,{"$f":"IF(K4=\"\",1,IF(I5=1,K4+1,K4))","v":1},{"$f":"IF(L4=\"\",0,IF(K4<>K5,0,IF($I5=2,L4+1,L4)))","v":0},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($I5=3,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($I5=4,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($I5=5,O4+1,O4)))","v":0},{"$f":"IF(OR(Master=\"Master\",I5=0,J5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,21,FALSE)),0,VLOOKUP(A5,L2_Array,21,FALSE)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D5=\"Yes\"),AND($L$1=\"Scaled\",D5>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D5=\"No\"),AND($L$1=\"Scaled\",D5<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I5=\"\",\"\",IF(P5>0,P5,IF(Q5>0,Q5,0)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(I5=1,S4=\"\"),1,IF(OR(AND(J4=1,(I5-I3<>0)),AND(S4=0,I4=I5),AND(J4=1,I5=I3)),0,1)))","v":1},{"$f":"IF(I5=\"\",T4,IF(AND(R5>1,OR(T4=\"\",T4=0,T4>=I5)),I5,IF(I5>T4,T4,0)))","v":0},{"$f":"IF(Master=\"Master\",Q5,IF(U4=\"\",R5,IF(OR(AND(T5>0,R5<U4),AND(T5=1,R5<=U4)),U4,R5)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(S4=1,T5=1),R5>0,AND(S6=0,V6=1)),1,0))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(T5>0,S5=1),AND(S5=1,V5=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(I5=1,R5=1),2,IF(AND(U4=1,K5=K4),2,IF(AND(AB4=2,K5=K4),2,IF(I5=1,1,\"\"))))","v":2}]
[2538,{"$f":"IF(I6=0,\"\",IF(I6=1,P$1&\".\"&K6,IF(I6=2,P$1&\".\"&K6&\".\"&L6,IF(I6=3,P$1&\".\"&K6&\".\"&L6&\".\"&M6,IF(I6=4,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6,IF(I6=5,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6))))))","v":"E.2"},"Is a background screening performed prior to allowing constituent access to Scoped Systems and Data? If yes, does it include:","No",null,"E.3 Background Investigation Policy Content","7.1.1","Screening",1,null,{"$f":"IF(K5=\"\",1,IF(I6=1,K5+1,K5))","v":2},{"$f":"IF(L5=\"\",0,IF(K5<>K6,0,IF($I6=2,L5+1,L5)))","v":0},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($I6=3,M5+1,M5)))","v":0},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($I6=4,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($I6=5,O5+1,O5)))","v":0},{"$f":"IF(OR(Master=\"Master\",I6=0,J6=1),0,IF(ISNA(VLOOKUP(A6,L2_Array,21,FALSE)),0,VLOOKUP(A6,L2_Array,21,FALSE)))","v":2},{"$f":"IF(I6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D6=\"Yes\"),AND($L$1=\"Scaled\",D6>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D6=\"No\"),AND($L$1=\"Scaled\",D6<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},{"$f":"IF(I6=\"\",\"\",IF(P6>0,P6,IF(Q6>0,Q6,0)))","v":2},{"$f":"IF(I6=\"\",\"\",IF(OR(I6=1,S5=\"\"),1,IF(OR(AND(J5=1,(I6-I4<>0)),AND(S5=0,I5=I6),AND(J5=1,I6=I4)),0,1)))","v":1},{"$f":"IF(I6=\"\",T5,IF(AND(R6>1,OR(T5=\"\",T5=0,T5>=I6)),I6,IF(I6>T5,T5,0)))","v":1},2,{"$f":"IF(I6=\"\",\"\",IF(OR(AND(S5=1,T6=1),R6>0,AND(S7=0,V7=1)),1,0))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(T6>0,S6=1),AND(S6=1,V6=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A6,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(I6=1,R6=1),2,IF(AND(U5=1,K6=K5),2,IF(AND(AB5=2,K6=K5),2,IF(I6=1,1,\"\"))))","v":1}]
[148,"E.2.1","Criminal?",null,null,"E.3.b.7","7.1.1.e ","Screening",2,null,2,1,0,0,0,0,{"$f":"IF(I7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D7=\"Yes\"),AND($L$1=\"Scaled\",D7>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D7=\"No\"),AND($L$1=\"Scaled\",D7<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[155,"E.2.2","Credit?",null,null,"E.3.b.6","7.1.1.e ","Screening",2,null,2,2,0,0,0,0,{"$f":"IF(I8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D8=\"Yes\"),AND($L$1=\"Scaled\",D8>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D8=\"No\"),AND($L$1=\"Scaled\",D8<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[162,"E.2.3","Academic?",null,null,"E.3.b.5","7.1.1.e ","Screening",2,null,2,3,0,0,0,0,{"$f":"IF(I9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D9=\"Yes\"),AND($L$1=\"Scaled\",D9>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D9=\"No\"),AND($L$1=\"Scaled\",D9<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[169,"E.2.4","Reference?",null,null,"E.3.b.8","7.1.1.e ","Screening",2,null,2,4,0,0,0,0,{"$f":"IF(I10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D10=\"Yes\"),AND($L$1=\"Scaled\",D10>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D10=\"No\"),AND($L$1=\"Scaled\",D10<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2539,"E.2.5","Resume or curriculum vitae?",null,null,"E.3.b.4","7.1.1.e ","Screening",2,null,2,5,0,0,0,0,{"$f":"IF(I11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D11=\"Yes\"),AND($L$1=\"Scaled\",D11>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D11=\"No\"),AND($L$1=\"Scaled\",D11<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[176,"E.2.6","Drug Screening?",null,null,null,"NA",null,2,null,2,6,0,0,0,0,{"$f":"IF(I12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D12=\"Yes\"),AND($L$1=\"Scaled\",D12>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D12=\"No\"),AND($L$1=\"Scaled\",D12<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[4007,"E.3","Are periodic background checks conducted? If yes, do they include the following individuals:","No",null,null,null,null,1,null,3,0,0,0,0,0,{"$f":"IF(I13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D13=\"Yes\"),AND($L$1=\"Scaled\",D13>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D13=\"No\"),AND($L$1=\"Scaled\",D13<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,1,2,1,1,0,null,null,null,1]
[4008,"E.3.1","Senior Management?",null,null,null,null,null,2,null,3,1,0,0,0,0,{"$f":"IF(I14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D14=\"Yes\"),AND($L$1=\"Scaled\",D14>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D14=\"No\"),AND($L$1=\"Scaled\",D14<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[4009,"E.3.2","Subcontractors?",null,null,null,null,null,2,null,3,2,0,0,0,0,{"$f":"IF(I15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D15=\"Yes\"),AND($L$1=\"Scaled\",D15>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D15=\"No\"),AND($L$1=\"Scaled\",D15<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[4010,"E.3.3","All other employees?",null,null,null,null,null,2,null,3,3,0,0,0,0,{"$f":"IF(I16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D16=\"Yes\"),AND($L$1=\"Scaled\",D16>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D16=\"No\"),AND($L$1=\"Scaled\",D16<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[183,"E.4","Are new hires required to sign any agreements upon hire? If yes, does it include:","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","E.4 Agreements for Employees","7.1.2","Terms and conditions of employment",1,null,4,0,0,0,0,1,{"$f":"IF(I17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D17=\"Yes\"),AND($L$1=\"Scaled\",D17>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D17=\"No\"),AND($L$1=\"Scaled\",D17<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[184,"E.4.1","Acceptable Use?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","E.4 Agreements for Employees","8.1.3","Acceptable use of assets",2,null,4,1,0,0,0,0,{"$f":"IF(I18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D18=\"Yes\"),AND($L$1=\"Scaled\",D18>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D18=\"No\"),AND($L$1=\"Scaled\",D18<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[191,"E.4.2","Code of Conduct / Ethics?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","E.4 Agreements for Employees","7.1.2","Terms and conditions of employment",2,null,4,2,0,0,0,0,{"$f":"IF(I19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D19=\"Yes\"),AND($L$1=\"Scaled\",D19>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D19=\"No\"),AND($L$1=\"Scaled\",D19<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[198,"E.4.3","Non-Disclosure Agreement?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","E.4 Agreements for Employees","7.1.2","Terms and conditions of employment",2,null,4,3,0,0,0,0,{"$f":"IF(I20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D20=\"Yes\"),AND($L$1=\"Scaled\",D20>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D20=\"No\"),AND($L$1=\"Scaled\",D20<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[205,"E.4.4","Confidentiality Agreement?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","E.4 Agreements for Employees","7.1.2","Terms and conditions of employment",2,null,4,4,0,0,0,0,{"$f":"IF(I21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D21=\"Yes\"),AND($L$1=\"Scaled\",D21>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D21=\"No\"),AND($L$1=\"Scaled\",D21<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2555,"E.4.5","Are constituents required to sign annual acknowledgements? If yes, do they include:","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","E.4 Agreements for Employees","NA",null,2,null,4,5,0,0,0,0,{"$f":"IF(I22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D22=\"Yes\"),AND($L$1=\"Scaled\",D22>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D22=\"No\"),AND($L$1=\"Scaled\",D22<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[265,"E.4.5.1","Acceptable Use?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","E.4 Agreements for Employees","NA",null,3,null,4,5,1,0,0,0,{"$f":"IF(I23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D23=\"Yes\"),AND($L$1=\"Scaled\",D23>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D23=\"No\"),AND($L$1=\"Scaled\",D23<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[272,"E.4.5.2","Code of Conduct / Ethics?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","E.4 Agreements for Employees","NA",null,3,null,4,5,2,0,0,0,{"$f":"IF(I24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D24=\"Yes\"),AND($L$1=\"Scaled\",D24>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D24=\"No\"),AND($L$1=\"Scaled\",D24<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[279,"E.4.5.3","Non-Disclosure Agreement?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","E.4 Agreements for Employees","NA",null,3,null,4,5,3,0,0,0,{"$f":"IF(I25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D25=\"Yes\"),AND($L$1=\"Scaled\",D25>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D25=\"No\"),AND($L$1=\"Scaled\",D25<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[286,"E.4.5.4","Confidentiality Agreement?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","E.4 Agreements for Employees","NA",null,3,null,4,5,4,0,0,0,{"$f":"IF(I26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D26=\"Yes\"),AND($L$1=\"Scaled\",D26>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D26=\"No\"),AND($L$1=\"Scaled\",D26<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[212,"E.5","Is there a security awareness training program? If yes, does it include:","Yes","Cloudamize Security Policy - Cloudamize Security Training & Maintenance Policy","E.1 Security Awareness Training Attendance","7.2.2","Information security awareness, education, and training",1,null,5,0,0,0,0,1,{"$f":"IF(I27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D27=\"Yes\"),AND($L$1=\"Scaled\",D27>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D27=\"No\"),AND($L$1=\"Scaled\",D27<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[214,"E.5.1","Security policies, procedures and processes?","Yes","Cloudamize Security Policy - Cloudamize Security Training & Maintenance Policy","E.1 Security Awareness Training Attendance","7.2.2","Information security awareness, education, and training",2,null,5,1,0,0,0,0,{"$f":"IF(I28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D28=\"Yes\"),AND($L$1=\"Scaled\",D28>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D28=\"No\"),AND($L$1=\"Scaled\",D28<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[215,"E.5.2","Scored test to evaluate successful completion?","No",null,"E.1 Security Awareness Training Attendance","NA",null,2,null,5,2,0,0,0,0,{"$f":"IF(I29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D29=\"Yes\"),AND($L$1=\"Scaled\",D29>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D29=\"No\"),AND($L$1=\"Scaled\",D29<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[3302,"E.5.3","New Hire and annual participation?","Yes","Cloudamize Security Policy - Cloudamize Security Training & Maintenance Policy / Cloudamize Security Policy - Cloudamize Personnel Access Policy","E.1.c","7.2.2","Information security awareness, education, and training",2,null,5,3,0,0,0,0,{"$f":"IF(I30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D30=\"Yes\"),AND($L$1=\"Scaled\",D30>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D30=\"No\"),AND($L$1=\"Scaled\",D30<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[218,"E.5.4","Training commensurate with levels of responsibilities and access?","Yes","Cloudamize Security Policy - Cloudamize Security Training & Maintenance Policy",null,"7.2.2","Information security awareness, education, and training",2,null,5,4,0,0,0,0,{"$f":"IF(I31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D31=\"Yes\"),AND($L$1=\"Scaled\",D31>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D31=\"No\"),AND($L$1=\"Scaled\",D31<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[219,"E.5.5","Additional training for those responsible for information security?","No","All Cloudamize employees and Consitutents are held to the same standard of Information Security. ",null,"7.2.2","Information security awareness, education, and training",2,null,5,5,0,0,0,0,{"$f":"IF(I32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D32=\"Yes\"),AND($L$1=\"Scaled\",D32>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D32=\"No\"),AND($L$1=\"Scaled\",D32<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[220,"E.6","Do information security personnel have professional security certifications?","No","All Cloudamize employees and Consitutents are held to the same standard of Information Security. ",null,"6.1.4","Contact with special interest groups",1,null,6,0,0,0,0,0,{"$f":"IF(I33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D33=\"Yes\"),AND($L$1=\"Scaled\",D33>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D33=\"No\"),AND($L$1=\"Scaled\",D33<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,1,2,1,1,0,null,null,null,1]
[293,"E.7","Is there a disciplinary process for non-compliance with information security policies?","Yes","Cloudamize Security Policy - Cloudamize Information Secuirty Policy - Non-Compliance",null,"7.2.3","Disciplinary process",1,null,7,0,0,0,0,1,{"$f":"IF(I34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D34=\"Yes\"),AND($L$1=\"Scaled\",D34>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D34=\"No\"),AND($L$1=\"Scaled\",D34<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[2557,"E.8","Is there a constituent termination or change of status process?","Yes","Cloudamize Security Policy - Cloudamize Information Secuirty Policy - Non-Compliance","H.2 Revoke System Access",7.3,"Termination responsibilities",1,null,8,0,0,0,0,1,{"$f":"IF(I35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D35=\"Yes\"),AND($L$1=\"Scaled\",D35>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D35=\"No\"),AND($L$1=\"Scaled\",D35<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[294,"E.8.1","Is there a documented termination or change of status policy or process that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?","Yes","Cloudamize Security Policy - Cloudamize Information Secuirty Policy",null,7.3,"Termination responsibilities",2,null,8,1,0,0,0,0,{"$f":"IF(I36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D36=\"Yes\"),AND($L$1=\"Scaled\",D36>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D36=\"No\"),AND($L$1=\"Scaled\",D36<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[299,"E.8.2","Does HR notify security / access administration of constituent termination for access rights removal? If yes, is notification provided:","Yes","Cloudamize Security Policy - Cloudamize Information Secuirty Policy","H.2 Revoke System Access","7.3.1","Termination or change of employment responsibilities",2,null,8,2,0,0,0,0,{"$f":"IF(I37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D37=\"Yes\"),AND($L$1=\"Scaled\",D37>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D37=\"No\"),AND($L$1=\"Scaled\",D37<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[301,"E.8.2.1","On the actual date?","Yes","Cloudamize Security Policy - Cloudamize Information Secuirty Policy",null,"NA",null,3,null,8,2,1,0,0,0,{"$f":"IF(I38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D38=\"Yes\"),AND($L$1=\"Scaled\",D38>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D38=\"No\"),AND($L$1=\"Scaled\",D38<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[302,"E.8.2.2","Two to seven days after termination?","No",null,null,"NA",null,3,null,8,2,2,0,0,0,{"$f":"IF(I39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D39=\"Yes\"),AND($L$1=\"Scaled\",D39>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D39=\"No\"),AND($L$1=\"Scaled\",D39<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,3,2,1,1,0,null,null,null,2]
[303,"E.8.2.3","Greater than seven days after termination?","No",null,null,"NA",null,3,null,8,2,3,0,0,0,{"$f":"IF(I40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D40=\"Yes\"),AND($L$1=\"Scaled\",D40>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D40=\"No\"),AND($L$1=\"Scaled\",D40<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,3,2,1,1,0,null,null,null,2]
[304,"E.8.3","Does HR notify security / access administration of a constituent change of status for access rights removal? If yes, is notification provided:","Yes","Cloudamize Security Policy - Cloudamize Information Secuirty Policy","H.2 Revoke System Access","7.3.1","Termination or change of employment responsibilities",2,null,8,3,0,0,0,0,{"$f":"IF(I41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D41=\"Yes\"),AND($L$1=\"Scaled\",D41>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D41=\"No\"),AND($L$1=\"Scaled\",D41<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[306,"E.8.3.1","On the actual date of the change of status?","Yes","Cloudamize Security Policy - Cloudamize Information Secuirty Policy",null,"NA",null,3,null,8,3,1,0,0,0,{"$f":"IF(I42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D42=\"Yes\"),AND($L$1=\"Scaled\",D42>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D42=\"No\"),AND($L$1=\"Scaled\",D42<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[307,"E.8.3.2","Two to seven days after the change of status?","No",null,null,"NA",null,3,null,8,3,2,0,0,0,{"$f":"IF(I43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D43=\"Yes\"),AND($L$1=\"Scaled\",D43>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D43=\"No\"),AND($L$1=\"Scaled\",D43<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,3,2,1,1,0,null,null,null,2]
[308,"E.8.3.3","Greater than seven days after the change of status?","No",null,null,"NA",null,3,null,8,3,3,0,0,0,{"$f":"IF(I44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D44=\"Yes\"),AND($L$1=\"Scaled\",D44>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D44=\"No\"),AND($L$1=\"Scaled\",D44<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,3,2,1,1,0,null,null,null,2]
[2558,"E.8.4","Are constituents required to return assets (laptop, desktop, PDA, cell phones, access cards, tokens, smart cards, keys, proprietary documentation) upon:",null,null,null,"8.1.4","Return of assets",2,1,8,4,0,0,0,0,{"$f":"IF(I45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D45=\"Yes\"),AND($L$1=\"Scaled\",D45>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D45=\"No\"),AND($L$1=\"Scaled\",D45<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,1,1,0,null,null,null,2]
[310,"E.8.4.1","Termination?","Yes",null,null,"8.1.4","Return of assets",3,null,8,4,1,0,0,0,{"$f":"IF(I46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D46=\"Yes\"),AND($L$1=\"Scaled\",D46>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D46=\"No\"),AND($L$1=\"Scaled\",D46<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,0,0,1,1,0,0,null,null,null,2]
[4011,"E.9","Is there a succession and redundancy planning for key management and support personnel? If yes, does it include:","No",null,null,null,null,1,null,{"$f":"IF(K46=\"\",1,IF(I47=1,K46+1,K46))","v":9},{"$f":"IF(L46=\"\",0,IF(K46<>K47,0,IF($I47=2,L46+1,L46)))","v":0},{"$f":"IF(M46=\"\",0,IF(L46<>L47,0,IF($I47=3,M46+1,M46)))","v":0},{"$f":"IF(N46=\"\",0,IF(M46<>M47,0,IF($I47=4,N46+1,N46)))","v":0},{"$f":"IF(O46=\"\",0,IF(N46<>N47,0,IF($I47=5,O46+1,O46)))","v":0},{"$f":"IF(OR(Master=\"Master\",I47=0,J47=1),0,IF(ISNA(VLOOKUP(A47,L2_Array,21,FALSE)),0,VLOOKUP(A47,L2_Array,21,FALSE)))","v":0},{"$f":"IF(I47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D47=\"Yes\"),AND($L$1=\"Scaled\",D47>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D47=\"No\"),AND($L$1=\"Scaled\",D47<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},{"$f":"IF(I47=\"\",\"\",IF(P47>0,P47,IF(Q47>0,Q47,0)))","v":2},{"$f":"IF(I47=\"\",\"\",IF(OR(I47=1,S46=\"\"),1,IF(OR(AND(J46=1,(I47-I45<>0)),AND(S46=0,I46=I47),AND(J46=1,I47=I45)),0,1)))","v":1},{"$f":"IF(I47=\"\",T46,IF(AND(R47>1,OR(T46=\"\",T46=0,T46>=I47)),I47,IF(I47>T46,T46,0)))","v":1},2,{"$f":"IF(I47=\"\",\"\",IF(OR(AND(S46=1,T47=1),R47>0,AND(S48=0,V48=1)),1,0))","v":1},{"$f":"IF(I47=\"\",\"\",IF(OR(AND(T47>0,S47=1),AND(S47=1,V47=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A47,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,1]
[4012,"E.9.1","Senior Management?",null,null,null,null,null,2,null,{"$f":"IF(K47=\"\",1,IF(I48=1,K47+1,K47))","v":9},{"$f":"IF(L47=\"\",0,IF(K47<>K48,0,IF($I48=2,L47+1,L47)))","v":1},{"$f":"IF(M47=\"\",0,IF(L47<>L48,0,IF($I48=3,M47+1,M47)))","v":0},{"$f":"IF(N47=\"\",0,IF(M47<>M48,0,IF($I48=4,N47+1,N47)))","v":0},{"$f":"IF(O47=\"\",0,IF(N47<>N48,0,IF($I48=5,O47+1,O47)))","v":0},{"$f":"IF(OR(Master=\"Master\",I48=0,J48=1),0,IF(ISNA(VLOOKUP(A48,L2_Array,21,FALSE)),0,VLOOKUP(A48,L2_Array,21,FALSE)))","v":0},{"$f":"IF(I48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D48=\"Yes\"),AND($L$1=\"Scaled\",D48>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D48=\"No\"),AND($L$1=\"Scaled\",D48<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(I48=\"\",\"\",IF(P48>0,P48,IF(Q48>0,Q48,0)))","v":0},{"$f":"IF(I48=\"\",\"\",IF(OR(I48=1,S47=\"\"),1,IF(OR(AND(J47=1,(I48-I46<>0)),AND(S47=0,I47=I48),AND(J47=1,I48=I46)),0,1)))","v":1},{"$f":"IF(I48=\"\",T47,IF(AND(R48>1,OR(T47=\"\",T47=0,T47>=I48)),I48,IF(I48>T47,T47,0)))","v":1},2,{"$f":"IF(I48=\"\",\"\",IF(OR(AND(S47=1,T48=1),R48>0,AND(S49=0,V49=1)),1,0))","v":1},{"$f":"IF(I48=\"\",\"\",IF(OR(AND(T48>0,S48=1),AND(S48=1,V48=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A48,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,""]
[4013,"E.9.2","Key support, operations and devleopment areas?",null,null,null,null,null,2,null,{"$f":"IF(K48=\"\",1,IF(I49=1,K48+1,K48))","v":9},{"$f":"IF(L48=\"\",0,IF(K48<>K49,0,IF($I49=2,L48+1,L48)))","v":2},{"$f":"IF(M48=\"\",0,IF(L48<>L49,0,IF($I49=3,M48+1,M48)))","v":0},{"$f":"IF(N48=\"\",0,IF(M48<>M49,0,IF($I49=4,N48+1,N48)))","v":0},{"$f":"IF(O48=\"\",0,IF(N48<>N49,0,IF($I49=5,O48+1,O48)))","v":0},{"$f":"IF(OR(Master=\"Master\",I49=0,J49=1),0,IF(ISNA(VLOOKUP(A49,L2_Array,21,FALSE)),0,VLOOKUP(A49,L2_Array,21,FALSE)))","v":0},{"$f":"IF(I49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D49=\"Yes\"),AND($L$1=\"Scaled\",D49>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D49=\"No\"),AND($L$1=\"Scaled\",D49<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(I49=\"\",\"\",IF(P49>0,P49,IF(Q49>0,Q49,0)))","v":0},{"$f":"IF(I49=\"\",\"\",IF(OR(I49=1,S48=\"\"),1,IF(OR(AND(J48=1,(I49-I47<>0)),AND(S48=0,I48=I49),AND(J48=1,I49=I47)),0,1)))","v":1},{"$f":"IF(I49=\"\",T48,IF(AND(R49>1,OR(T48=\"\",T48=0,T48>=I49)),I49,IF(I49>T48,T48,0)))","v":1},2,{"$f":"IF(I49=\"\",\"\",IF(OR(AND(S48=1,T49=1),R49>0,AND(S50=0,V50=1)),1,0))","v":1},{"$f":"IF(I49=\"\",\"\",IF(OR(AND(T49>0,S49=1),AND(S49=1,V49=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A49,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,""]

{"sheet":"F. Physical and Environmental","index":12,"n_rows":136,"n_cols":28,"rows_kept":136,"cut":false,"hidden":false,"merged":[[2,1,2,7]]}
[10,"F. Physical and Environmental Security",null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,null,"Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"F"}]
[null,null,null,{"$f":"IF(W2=0,\"0%\",W2/S2)","v":1},"Percent Complete",null,null,null,{"$f":"COUNTA(I5:I136)","v":132},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(S5:S136,1)","v":119},null,null,null,{"$f":"COUNTIF(W5:W136,1)","v":119}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column E to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, check the Disable Tab Automation checkbox at the top of the page.",null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter"]
[{"$f":"MAX(A5:A136)","v":3303},"Ques Num","Question/Request","Response","Additional Information","AUP Reference","ISO Ref Num","ISO Ref Text"]
[2559,{"$f":"IF(I5=0,\"\",IF(I5=1,P$1&\".\"&K5,IF(I5=2,P$1&\".\"&K5&\".\"&L5,IF(I5=3,P$1&\".\"&K5&\".\"&L5&\".\"&M5,IF(I5=4,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5,IF(I5=5,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5))))))","v":"F.1"},"Is there a physical security program?","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy",null,"5.1.1","Policies for information security",1,null,{"$f":"IF(K4=\"\",1,IF(I5=1,K4+1,K4))","v":1},{"$f":"IF(L4=\"\",0,IF(K4<>K5,0,IF($I5=2,L4+1,L4)))","v":0},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($I5=3,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($I5=4,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($I5=5,O4+1,O4)))","v":0},{"$f":"IF(OR(Master=\"Master\",I5=0,J5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,21,FALSE)),0,VLOOKUP(A5,L2_Array,21,FALSE)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D5=\"Yes\"),AND($L$1=\"Scaled\",D5>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D5=\"No\"),AND($L$1=\"Scaled\",D5<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I5=\"\",\"\",IF(P5>0,P5,IF(Q5>0,Q5,0)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(I5=1,S4=\"\"),1,IF(OR(AND(J4=1,(I5-I3<>0)),AND(S4=0,I4=I5),AND(J4=1,I5=I3)),0,1)))","v":1},{"$f":"IF(I5=\"\",T4,IF(AND(R5>1,OR(T4=\"\",T4=0,T4>=I5)),I5,IF(I5>T4,T4,0)))","v":0},{"$f":"IF(Master=\"Master\",Q5,IF(U4=\"\",R5,IF(OR(AND(T5>0,R5<U4),AND(T5=1,R5<=U4)),U4,R5)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(S4=1,T5=1),R5>0,AND(S6=0,V6=1)),1,0))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(T5>0,S5=1),AND(S5=1,V5=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(I5=1,R5=1),2,IF(AND(U4=1,K5=K4),2,IF(AND(AB4=2,K5=K4),2,IF(I5=1,1,\"\"))))","v":2}]
[312,{"$f":"IF(I6=0,\"\",IF(I6=1,P$1&\".\"&K6,IF(I6=2,P$1&\".\"&K6&\".\"&L6,IF(I6=3,P$1&\".\"&K6&\".\"&L6&\".\"&M6,IF(I6=4,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6,IF(I6=5,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6))))))","v":"F.1.1"},"Is there a documented physical security policy approved by management, communicated to constituents and an owner assigned to maintain and review the policy?","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy","B.1 Information Security Policy Content","5.1.1","Policies for information security",2,null,{"$f":"IF(K5=\"\",1,IF(I6=1,K5+1,K5))","v":1},{"$f":"IF(L5=\"\",0,IF(K5<>K6,0,IF($I6=2,L5+1,L5)))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($I6=3,M5+1,M5)))","v":0},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($I6=4,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($I6=5,O5+1,O5)))","v":0},{"$f":"IF(OR(Master=\"Master\",I6=0,J6=1),0,IF(ISNA(VLOOKUP(A6,L2_Array,21,FALSE)),0,VLOOKUP(A6,L2_Array,21,FALSE)))","v":0},{"$f":"IF(I6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D6=\"Yes\"),AND($L$1=\"Scaled\",D6>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D6=\"No\"),AND($L$1=\"Scaled\",D6<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I6=\"\",\"\",IF(P6>0,P6,IF(Q6>0,Q6,0)))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(I6=1,S5=\"\"),1,IF(OR(AND(J5=1,(I6-I4<>0)),AND(S5=0,I5=I6),AND(J5=1,I6=I4)),0,1)))","v":1},{"$f":"IF(I6=\"\",T5,IF(AND(R6>1,OR(T5=\"\",T5=0,T5>=I6)),I6,IF(I6>T5,T5,0)))","v":0},{"$f":"IF(Master=\"Master\",Q6,IF(U5=\"\",R6,IF(OR(AND(T6>0,R6<U5),AND(T6=1,R6<=U5)),U5,R6)))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(S5=1,T6=1),R6>0,AND(S7=0,V7=1)),1,0))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(T6>0,S6=1),AND(S6=1,V6=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A6,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(I6=1,R6=1),2,IF(AND(U5=1,K6=K5),2,IF(AND(AB5=2,K6=K5),2,IF(I6=1,1,\"\"))))","v":2}]
[2560,"F.1.2","Are reasonable physical security and environmental controls present in the building/data center that contains Scoped Systems and Data? If yes, does it include:","Yes","Cloudamize Security Policy - Cloudamize Physical Security Policy / 1735 Market St Building Security Plan","F. Physical and Environmental Security",11.1,"Secure areas",2,null,1,2,0,0,0,1,{"$f":"IF(I7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D7=\"Yes\"),AND($L$1=\"Scaled\",D7>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D7=\"No\"),AND($L$1=\"Scaled\",D7<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[2561,"F.1.2.1","Signage to identify the operations of the facility (data center)?","Yes","1735 Market St Building Security Plan","F.2 Physical Security Controls – Scoped Systems and Data","11.1.3","Securing offices, rooms, and facilities",3,null,1,2,1,0,0,0,{"$f":"IF(I8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D8=\"Yes\"),AND($L$1=\"Scaled\",D8>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D8=\"No\"),AND($L$1=\"Scaled\",D8<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[351,"F.1.2.2","Other tenants using the building?","Yes","1735 Market St Building Security Plan",null,"NA",null,3,null,1,2,2,0,0,0,{"$f":"IF(I9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D9=\"Yes\"),AND($L$1=\"Scaled\",D9>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D9=\"No\"),AND($L$1=\"Scaled\",D9<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[381,"F.1.2.3","Access restricted and logs kept of all access?","Yes","1735 Market St Building Security Plan","F.5 Secure Workspace Access Reporting","11.1.2","Physical entry controls",3,null,1,2,3,0,0,0,{"$f":"IF(I10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D10=\"Yes\"),AND($L$1=\"Scaled\",D10>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D10=\"No\"),AND($L$1=\"Scaled\",D10<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[387,"F.1.2.4","Electronic system (key card, token, fob, biometric reader etc.) to control access?","Yes","1735 Market St Building Security Plan","F.4 Secure Workspace Perimeter","11.1.2","Physical entry controls",3,null,1,2,4,0,0,0,{"$f":"IF(I11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D11=\"Yes\"),AND($L$1=\"Scaled\",D11>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D11=\"No\"),AND($L$1=\"Scaled\",D11<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[391,"F.1.2.5","Cipher locks (electronic or mechanical) to control access within or to the facility? If yes, is there a process to:","No",null,"F.2 Physical Security Controls – Scoped Systems and Data","11.1.2","Physical entry controls",3,null,1,2,5,0,0,0,{"$f":"IF(I12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D12=\"Yes\"),AND($L$1=\"Scaled\",D12>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D12=\"No\"),AND($L$1=\"Scaled\",D12<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,3,2,1,1,0,null,null,null,2]
[392,"F.1.2.5.1","Change the code(s) at least every 90 days?",null,null,null,"NA",null,4,null,1,2,5,1,0,0,{"$f":"IF(I13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D13=\"Yes\"),AND($L$1=\"Scaled\",D13>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D13=\"No\"),AND($L$1=\"Scaled\",D13<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,3,2,0,1,0,null,null,null,2]
[394,"F.1.2.5.2","Change the code(s) when an authorized individual is terminated or transferred to another role?",null,null,null,"9.2.1","User registration and de-registration",4,null,1,2,5,2,0,0,{"$f":"IF(I14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D14=\"Yes\"),AND($L$1=\"Scaled\",D14>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D14=\"No\"),AND($L$1=\"Scaled\",D14<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,3,2,0,1,0,null,null,null,2]
[374,"F.1.2.6","Security guards that provide onsite security services?","Yes","1735 Market St Building Security Plan","F.2 Physical Security Controls – Scoped Systems and Data","11.1.1.c ","Physical security perimeter",3,null,1,2,6,0,0,0,{"$f":"IF(I15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D15=\"Yes\"),AND($L$1=\"Scaled\",D15>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D15=\"No\"),AND($L$1=\"Scaled\",D15<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3288,"F.1.2.7","Perimeter physical barrier (such as fence or walls)?","No",null,"F.2 Physical Security Controls – Scoped Systems and Data","11.1.1.d ","Physical security perimeter",3,null,1,2,7,0,0,0,{"$f":"IF(I16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D16=\"Yes\"),AND($L$1=\"Scaled\",D16>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D16=\"No\"),AND($L$1=\"Scaled\",D16<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,3,2,1,1,0,null,null,null,2]
[371,"F.1.2.8","Entry and exit doors alarmed (forced entry, propped open) and/or monitored by security guards?","Yes","1735 Market St Building Security Plan","F.2 Physical Security Controls – Scoped Systems and Data","11.1.1.e ","Physical security perimeter",3,null,1,2,8,0,0,0,{"$f":"IF(I17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D17=\"Yes\"),AND($L$1=\"Scaled\",D17>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D17=\"No\"),AND($L$1=\"Scaled\",D17<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[395,"F.1.2.9","A mechanism to prevent tailgating / piggybacking?","Yes","1735 Market St Building Security Plan","F.2 Physical Security Controls – Scoped Systems and Data","11.1.1.c ","Physical entry controls",3,null,1,2,9,0,0,0,{"$f":"IF(I18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D18=\"Yes\"),AND($L$1=\"Scaled\",D18>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D18=\"No\"),AND($L$1=\"Scaled\",D18<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[360,"F.1.2.10","External lighting?","Yes","1735 Market St Building Security Plan","F.2 Physical Security Controls – Scoped Systems and Data",null,null,3,null,1,2,10,0,0,0,{"$f":"IF(I19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D19=\"Yes\"),AND($L$1=\"Scaled\",D19>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D19=\"No\"),AND($L$1=\"Scaled\",D19<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[364,"F.1.2.11","Lighting on all doors?","Yes","1735 Market St Building Security Plan",null,null,null,3,null,1,2,11,0,0,0,{"$f":"IF(I20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D20=\"Yes\"),AND($L$1=\"Scaled\",D20>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D20=\"No\"),AND($L$1=\"Scaled\",D20<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[365,"F.1.2.12","Exterior doors with external hinge pins?","Yes","1735 Market St Building Security Plan",null,"11.1.1.b ","Physical security perimeter",3,null,1,2,12,0,0,0,{"$f":"IF(I21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D21=\"Yes\"),AND($L$1=\"Scaled\",D21>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D21=\"No\"),AND($L$1=\"Scaled\",D21<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[358,"F.1.2.13","Windows with contact or break alarms on all windows?","Yes","1735 Market St Building Security Plan",null,"11.1.1.b ","Physical security perimeter",3,null,1,2,13,0,0,0,{"$f":"IF(I22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D22=\"Yes\"),AND($L$1=\"Scaled\",D22>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D22=\"No\"),AND($L$1=\"Scaled\",D22<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[366,"F.1.2.14","CCTV with video stored at least 90 days?","Yes","1735 Market St Building Security Plan","F.2 Physical Security Controls – Scoped Systems and Data","NA",null,3,null,1,2,14,0,0,0,{"$f":"IF(I23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D23=\"Yes\"),AND($L$1=\"Scaled\",D23>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D23=\"No\"),AND($L$1=\"Scaled\",D23<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[566,"F.1.2.15","Fluid or water sensor?","No","1735 Market St Building Security Plan","F.2 Physical Security Controls – Scoped Systems and Data","11.1.4","Protecting against external and environmental threats",3,null,1,2,15,0,0,0,{"$f":"IF(I24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D24=\"Yes\"),AND($L$1=\"Scaled\",D24>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D24=\"No\"),AND($L$1=\"Scaled\",D24<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,3,2,1,1,0,null,null,null,2]
[3297,"F.1.2.16","Air conditioning and humidity controls?","Yes","1735 Market St Building Security Plan","F.2 Physical Security Controls – Scoped Systems and Data","11.1.4","Protecting against external and environmental threats",3,null,1,2,16,0,0,0,{"$f":"IF(I25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D25=\"Yes\"),AND($L$1=\"Scaled\",D25>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D25=\"No\"),AND($L$1=\"Scaled\",D25<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3298,"F.1.2.17","Heat detection?","No","1735 Market St Building Security Plan",null,"11.1.4","Protecting against external and environmental threats",3,null,1,2,17,0,0,0,{"$f":"IF(I26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D26=\"Yes\"),AND($L$1=\"Scaled\",D26>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D26=\"No\"),AND($L$1=\"Scaled\",D26<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,3,2,1,1,0,null,null,null,2]
[569,"F.1.2.18","Smoke detection?","Yes","1735 Market St Building Security Plan",null,"11.1.4","Protecting against external and environmental threats",3,null,1,2,18,0,0,0,{"$f":"IF(I27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D27=\"Yes\"),AND($L$1=\"Scaled\",D27>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D27=\"No\"),AND($L$1=\"Scaled\",D27<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3303,"F.1.2.19","Fire suppression?","Yes","1735 Market St Building Security Plan","F.1 Environmental Controls – Computing Hardware","11.1.4","Protecting against external and environmental threats",3,null,1,2,19,0,0,0,{"$f":"IF(I28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D28=\"Yes\"),AND($L$1=\"Scaled\",D28>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D28=\"No\"),AND($L$1=\"Scaled\",D28<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3289,"F.1.2.20","Multiple power feeds?","Yes","1735 Market St Building Security Plan",null,"11.2.2","Supporting utilities",3,null,1,2,20,0,0,0,{"$f":"IF(I29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D29=\"Yes\"),AND($L$1=\"Scaled\",D29>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D29=\"No\"),AND($L$1=\"Scaled\",D29<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3290,"F.1.2.21","Multiple communication feeds?","Yes","1735 Market St Building Security Plan",null,"11.2.2","Supporting utilities",3,null,1,2,21,0,0,0,{"$f":"IF(I30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D30=\"Yes\"),AND($L$1=\"Scaled\",D30>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D30=\"No\"),AND($L$1=\"Scaled\",D30<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[382,"F.1.2.22","Physical access control procedures? If yes, is there:","Yes","1735 Market St Building Security Plan",null,"11.1.1.a ","Physical security perimeter",3,null,1,2,22,0,0,0,{"$f":"IF(I31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D31=\"Yes\"),AND($L$1=\"Scaled\",D31>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D31=\"No\"),AND($L$1=\"Scaled\",D31<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[383,"F.1.2.22.1","Segregation of duties for issuing and approving access to the facility (keys, badge, etc.)?","Yes","1735 Market St Building Security Plan",null,"9.1.1.f ","Access control policy",4,null,1,2,22,1,0,0,{"$f":"IF(I32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D32=\"Yes\"),AND($L$1=\"Scaled\",D32>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D32=\"No\"),AND($L$1=\"Scaled\",D32<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[384,"F.1.2.22.2","Access reviews at least every six months?","Yes","1735 Market St Building Security Plan",null,"9.1.1.h                                       9.2.5","Access control policy,         Review of user access rights",4,null,1,2,22,2,0,0,{"$f":"IF(I33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D33=\"Yes\"),AND($L$1=\"Scaled\",D33>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D33=\"No\"),AND($L$1=\"Scaled\",D33<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[389,"F.1.2.22.3","Collection of access equipment (badges, keys, change pin numbers, etc.) when a constituent is terminated or changes status and no longer require access?","Yes","1735 Market St Building Security Plan","H.6 Revoke Physical Access","9.1.1.i ","Access control policy",4,null,1,2,22,3,0,0,{"$f":"IF(I34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D34=\"Yes\"),AND($L$1=\"Scaled\",D34>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D34=\"No\"),AND($L$1=\"Scaled\",D34<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[390,"F.1.2.22.4","A process to report lost or stolen access cards / keys?","Yes","1735 Market St Building Security Plan",null,"11.1.2.d ","Physical entry controls",4,null,1,2,22,4,0,0,{"$f":"IF(I35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D35=\"Yes\"),AND($L$1=\"Scaled\",D35>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D35=\"No\"),AND($L$1=\"Scaled\",D35<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[396,"F.1.3","Are visitors permitted in the facility? If yes, are they required to:","Yes","1735 Market St Building Security Plan",null,"11.1.2 ","Physical entry controls",2,null,1,3,0,0,0,1,{"$f":"IF(I36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D36=\"Yes\"),AND($L$1=\"Scaled\",D36>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D36=\"No\"),AND($L$1=\"Scaled\",D36<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[397,"F.1.3.1","Sign in and out?","Yes","1735 Market St Building Security Plan",null,"11.1.2.a ","Physical entry controls",3,null,1,3,1,0,0,0,{"$f":"IF(I37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D37=\"Yes\"),AND($L$1=\"Scaled\",D37>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D37=\"No\"),AND($L$1=\"Scaled\",D37<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[398,"F.1.3.2","Provide a government issued ID?","Yes","1735 Market St Building Security Plan",null,"11.1.2.a ","Physical entry controls",3,null,1,3,2,0,0,0,{"$f":"IF(I38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D38=\"Yes\"),AND($L$1=\"Scaled\",D38>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D38=\"No\"),AND($L$1=\"Scaled\",D38<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[399,"F.1.3.3","Be escorted through secure areas?","Yes","1735 Market St Building Security Plan",null,null,null,3,null,1,3,3,0,0,0,{"$f":"IF(I39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D39=\"Yes\"),AND($L$1=\"Scaled\",D39>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D39=\"No\"),AND($L$1=\"Scaled\",D39<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2944,"F.1.3.4","Wear badge distinguishing them from employees?","Yes","1735 Market St Building Security Plan",null,"11.1.2.a ","Physical entry controls",3,null,1,3,4,0,0,0,{"$f":"IF(I40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D40=\"Yes\"),AND($L$1=\"Scaled\",D40>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D40=\"No\"),AND($L$1=\"Scaled\",D40<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[400,"F.1.3.5","Are visitor logs maintained for at least 90 days?","Yes","1735 Market St Building Security Plan","F.2 Physical Security Controls – Scoped Systems and Data","NA",null,3,null,1,3,5,0,0,0,{"$f":"IF(I41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D41=\"Yes\"),AND($L$1=\"Scaled\",D41>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D41=\"No\"),AND($L$1=\"Scaled\",D41<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[492,"F.1.4","Is there a loading dock at the facility? If yes, is there:","Yes","1735 Market St Building Security Plan",null,"11.1.6","Delivery and loading areas",2,null,1,4,0,0,0,0,{"$f":"IF(I42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D42=\"Yes\"),AND($L$1=\"Scaled\",D42>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D42=\"No\"),AND($L$1=\"Scaled\",D42<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[493,"F.1.4.1","Any other tenants using the loading dock?","Yes","1735 Market St Building Security Plan",null,"NA",null,3,null,1,4,1,0,0,0,{"$f":"IF(I43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D43=\"Yes\"),AND($L$1=\"Scaled\",D43>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D43=\"No\"),AND($L$1=\"Scaled\",D43<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[495,"F.1.4.2","A security guards at each point of entry?","Yes","1735 Market St Building Security Plan","F.2 Physical Security Controls – Scoped Systems and Data","NA",null,3,null,1,4,2,0,0,0,{"$f":"IF(I44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D44=\"Yes\"),AND($L$1=\"Scaled\",D44>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D44=\"No\"),AND($L$1=\"Scaled\",D44<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[513,"F.1.4.3","Smoke detector?","Yes","1735 Market St Building Security Plan","F.1 Environmental Controls – Computing Hardware","11.1.4","Protecting against external and environmental threats",3,null,1,4,3,0,0,0,{"$f":"IF(I45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D45=\"Yes\"),AND($L$1=\"Scaled\",D45>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D45=\"No\"),AND($L$1=\"Scaled\",D45<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[514,"F.1.4.4","Fire alarm?","Yes","1735 Market St Building Security Plan",null,"11.1.4","Protecting against external and environmental threats",3,null,1,4,4,0,0,0,{"$f":"IF(I46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D46=\"Yes\"),AND($L$1=\"Scaled\",D46>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D46=\"No\"),AND($L$1=\"Scaled\",D46<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[516,"F.1.4.5","Fire suppression?","Yes","1735 Market St Building Security Plan","F.1 Environmental Controls – Computing Hardware","11.1.4","Protecting against external and environmental threats",3,null,1,4,5,0,0,0,{"$f":"IF(I47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D47=\"Yes\"),AND($L$1=\"Scaled\",D47>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D47=\"No\"),AND($L$1=\"Scaled\",D47<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[508,"F.1.4.6","CCTV and the video stored for at least 90 days?","Yes","1735 Market St Building Security Plan","F.2 Physical Security Controls – Scoped Systems and Data","NA",null,3,null,1,4,6,0,0,0,{"$f":"IF(I48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D48=\"Yes\"),AND($L$1=\"Scaled\",D48>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D48=\"No\"),AND($L$1=\"Scaled\",D48<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3203,"F.1.4.7","Restricted access and logs kept of all access?","Yes","1735 Market St Building Security Plan",null,"11.1.2.c ","Physical entry controls",3,null,1,4,7,0,0,0,{"$f":"IF(I49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D49=\"Yes\"),AND($L$1=\"Scaled\",D49>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D49=\"No\"),AND($L$1=\"Scaled\",D49<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[541,"F.1.5","Is there a battery/UPS room? If yes, does it contain:","No",null,"F.1 Environmental Controls – Computing Hardware","11.2.2 ","Supporting utilities",2,null,1,5,0,0,0,0,{"$f":"IF(I50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D50=\"Yes\"),AND($L$1=\"Scaled\",D50>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D50=\"No\"),AND($L$1=\"Scaled\",D50<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[543,"F.1.5.1","Hydrogen sensors?",null,null,"F.1 Environmental Controls – Computing Hardware","11.1.4","Protecting against external and environmental threats",3,null,1,5,1,0,0,0,{"$f":"IF(I51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D51=\"Yes\"),AND($L$1=\"Scaled\",D51>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D51=\"No\"),AND($L$1=\"Scaled\",D51<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[570,"F.1.5.2","Monitored fire alarm?",null,null,"F.1 Environmental Controls – Computing Hardware","11.1.4","Protecting against external and environmental threats",3,null,1,5,2,0,0,0,{"$f":"IF(I52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D52=\"Yes\"),AND($L$1=\"Scaled\",D52>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D52=\"No\"),AND($L$1=\"Scaled\",D52<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[3204,"F.1.5.3","Fire suppression system?",null,null,"F.1 Environmental Controls – Computing Hardware","11.1.4","Protecting against external and environmental threats",3,null,1,5,3,0,0,0,{"$f":"IF(I53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D53=\"Yes\"),AND($L$1=\"Scaled\",D53>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D53=\"No\"),AND($L$1=\"Scaled\",D53<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[560,"F.1.5.4","CCTV and the video stored for at least 90 days?",null,null,"F.2 Physical Security Controls – Scoped Systems and Data","NA",null,3,null,1,5,4,0,0,0,{"$f":"IF(I54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D54=\"Yes\"),AND($L$1=\"Scaled\",D54>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D54=\"No\"),AND($L$1=\"Scaled\",D54<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[546,"F.1.5.5","Restricted access and logs kept of all access?",null,null,"F.1 Environmental Controls – Computing Hardware","11.1.2.c","Physical entry controls",3,null,1,5,5,0,0,0,{"$f":"IF(I55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D55=\"Yes\"),AND($L$1=\"Scaled\",D55>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D55=\"No\"),AND($L$1=\"Scaled\",D55<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[454,"F.1.5.6","Does UPS support N+1?",null,null,"F.1 Environmental Controls – Computing Hardware","11.2.2 ","Supporting utilities",3,null,1,5,6,0,0,0,{"$f":"IF(I56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D56=\"Yes\"),AND($L$1=\"Scaled\",D56>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D56=\"No\"),AND($L$1=\"Scaled\",D56<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[621,"F.1.6","Is there a generator or generator area? If yes, is there:","No",null,"F.1 Environmental Controls – Computing Hardware","11.2.2 ","Supporting utilities",2,null,1,6,0,0,0,0,{"$f":"IF(I57=\"\",\"\",IF(D57=\"\",0,IF(D57=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D57=\"Yes\"),AND($L$1=\"Scaled\",D57>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D57=\"No\"),AND($L$1=\"Scaled\",D57<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[627,"F.1.6.1","A fuel supply readily available to ensure uninterrupted service?",null,null,"F.1 Environmental Controls – Computing Hardware","11.2.2 ","Supporting utilities",3,null,1,6,1,0,0,0,{"$f":"IF(I58=\"\",\"\",IF(D58=\"\",0,IF(D58=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D58=\"Yes\"),AND($L$1=\"Scaled\",D58>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D58=\"No\"),AND($L$1=\"Scaled\",D58<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[628,"F.1.6.2","Adequate capacity to supply power for at least 48 hours?",null,null,"F.1 Environmental Controls – Computing Hardware","11.2.2 ","Supporting utilities",3,null,1,6,2,0,0,0,{"$f":"IF(I59=\"\",\"\",IF(D59=\"\",0,IF(D59=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D59=\"Yes\"),AND($L$1=\"Scaled\",D59>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D59=\"No\"),AND($L$1=\"Scaled\",D59<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[629,"F.1.6.3","Restricted access and logs kept of all access?",null,null,"F.1 Environmental Controls – Computing Hardware","11.1.2.c","Physical Entry Controls",3,null,1,6,3,0,0,0,{"$f":"IF(I60=\"\",\"\",IF(D60=\"\",0,IF(D60=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D60=\"Yes\"),AND($L$1=\"Scaled\",D60>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D60=\"No\"),AND($L$1=\"Scaled\",D60<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[640,"F.1.6.4","CCTV and the video stored for at least 90 days?",null,null,"F.2 Physical Security Controls – Scoped Systems and Data","NA",null,3,null,1,6,4,0,0,0,{"$f":"IF(I61=\"\",\"\",IF(D61=\"\",0,IF(D61=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D61=\"Yes\"),AND($L$1=\"Scaled\",D61>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D61=\"No\"),AND($L$1=\"Scaled\",D61<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[656,"F.1.7","Is there a mailroom that handles Scoped Data? If yes, is access:","No",null,null,"12.1.1","Documented operating procedures",2,null,1,7,0,0,0,0,{"$f":"IF(I62=\"\",\"\",IF(D62=\"\",0,IF(D62=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D62=\"Yes\"),AND($L$1=\"Scaled\",D62>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D62=\"No\"),AND($L$1=\"Scaled\",D62<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[660,"F.1.7.1","Restricted access and logs kept of all access?",null,null,null,"11.1.2.c","Physical entry controls",3,null,1,7,1,0,0,0,{"$f":"IF(I63=\"\",\"\",IF(D63=\"\",0,IF(D63=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D63=\"Yes\"),AND($L$1=\"Scaled\",D63>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D63=\"No\"),AND($L$1=\"Scaled\",D63<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[3291,"F.1.7.2","CCTV and the video stored for at least 90 days?",null,null,"F.2 Physical Security Controls – Scoped Systems and Data","NA",null,3,null,1,7,2,0,0,0,{"$f":"IF(I64=\"\",\"\",IF(D64=\"\",0,IF(D64=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D64=\"Yes\"),AND($L$1=\"Scaled\",D64>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D64=\"No\"),AND($L$1=\"Scaled\",D64<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[685,"F.1.8","Is there a media library to store Scoped Data? If yes, is access:","No",null,null,"12.1.1","Documented operating procedures",2,null,1,8,0,0,0,0,{"$f":"IF(I65=\"\",\"\",IF(D65=\"\",0,IF(D65=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D65=\"Yes\"),AND($L$1=\"Scaled\",D65>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D65=\"No\"),AND($L$1=\"Scaled\",D65<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[694,"F.1.8.1","Restricted and logs kept of all access?",null,null,null,"11.1.2.c","Physical entry controls",3,null,1,8,1,0,0,0,{"$f":"IF(I66=\"\",\"\",IF(D66=\"\",0,IF(D66=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D66=\"Yes\"),AND($L$1=\"Scaled\",D66>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D66=\"No\"),AND($L$1=\"Scaled\",D66<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[3292,"F.1.8.2","CCTV and the video stored for at least 90 days?",null,null,"F.2 Physical Security Controls – Scoped Systems and Data","NA",null,3,null,1,8,2,0,0,0,{"$f":"IF(I67=\"\",\"\",IF(D67=\"\",0,IF(D67=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D67=\"Yes\"),AND($L$1=\"Scaled\",D67>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D67=\"No\"),AND($L$1=\"Scaled\",D67<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[778,"F.1.9","Is there a separate room for telecom equipment? If yes, is access:","Yes","1735 Market St Building Security Plan",null,"12.1.1","Documented operating procedures",2,null,1,9,0,0,0,0,{"$f":"IF(I68=\"\",\"\",IF(D68=\"\",0,IF(D68=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D68=\"Yes\"),AND($L$1=\"Scaled\",D68>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D68=\"No\"),AND($L$1=\"Scaled\",D68<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[781,"F.1.9.1","Monitored with CCTV and the video stored for 90 days?","Yes","1735 Market St Building Security Plan","F.2 Physical Security Controls – Scoped Systems and Data","NA",null,3,null,1,9,1,0,0,0,{"$f":"IF(I69=\"\",\"\",IF(D69=\"\",0,IF(D69=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D69=\"Yes\"),AND($L$1=\"Scaled\",D69>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D69=\"No\"),AND($L$1=\"Scaled\",D69<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[786,{"$f":"IF(I70=0,\"\",IF(I70=1,P$1&\".\"&K70,IF(I70=2,P$1&\".\"&K70&\".\"&L70,IF(I70=3,P$1&\".\"&K70&\".\"&L70&\".\"&M70,IF(I70=4,P$1&\".\"&K70&\".\"&L70&\".\"&M70&\".\"&N70,IF(I70=5,P$1&\".\"&K70&\".\"&L70&\".\"&M70&\".\"&N70&\".\"&O70))))))","v":"F.1.9.2"},"Restricted and logs kept of all access?","Yes","1735 Market St Building Security Plan",null,"11.1.2.c","Physical entry controls",3,null,{"$f":"IF(K69=\"\",1,IF(I70=1,K69+1,K69))","v":1},{"$f":"IF(L69=\"\",0,IF(K69<>K70,0,IF($I70=2,L69+1,L69)))","v":9},{"$f":"IF(M69=\"\",0,IF(L69<>L70,0,IF($I70=3,M69+1,M69)))","v":2},{"$f":"IF(N69=\"\",0,IF(M69<>M70,0,IF($I70=4,N69+1,N69)))","v":0},{"$f":"IF(O69=\"\",0,IF(N69<>N70,0,IF($I70=5,O69+1,O69)))","v":0},{"$f":"IF(OR(Master=\"Master\",I70=0,J70=1),0,IF(ISNA(VLOOKUP(A70,L2_Array,21,FALSE)),0,VLOOKUP(A70,L2_Array,21,FALSE)))","v":0},{"$f":"IF(I70=\"\",\"\",IF(D70=\"\",0,IF(D70=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D70=\"Yes\"),AND($L$1=\"Scaled\",D70>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D70=\"No\"),AND($L$1=\"Scaled\",D70<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I70=\"\",\"\",IF(P70>0,P70,IF(Q70>0,Q70,0)))","v":1},{"$f":"IF(I70=\"\",\"\",IF(OR(I70=1,S69=\"\"),1,IF(OR(AND(J69=1,(I70-I68<>0)),AND(S69=0,I69=I70),AND(J69=1,I70=I68)),0,1)))","v":1},{"$f":"IF(I70=\"\",T69,IF(AND(R70>1,OR(T69=\"\",T69=0,T69>=I70)),I70,IF(I70>T69,T69,0)))","v":0},{"$f":"IF(Master=\"Master\",Q70,IF(U69=\"\",R70,IF(OR(AND(T70>0,R70<U69),AND(T70=1,R70<=U69)),U69,R70)))","v":1},{"$f":"IF(I70=\"\",\"\",IF(OR(AND(S69=1,T70=1),R70>0,AND(S71=0,V71=1)),1,0))","v":1},{"$f":"IF(I70=\"\",\"\",IF(OR(AND(T70>0,S70=1),AND(S70=1,V70=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A70,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(I70=1,R70=1),2,IF(AND(U69=1,K70=K69),2,IF(AND(AB69=2,K70=K69),2,IF(I70=1,1,\"\"))))","v":2}]
[401,"F.2","Do the Scoped Systems and Data reside in a data center? If yes, is there:","Yes","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.1 Environmental Controls – Computing Hardware","11.2.1.b","Equipment siting and protection",1,null,2,0,0,0,0,0,{"$f":"IF(I71=\"\",\"\",IF(D71=\"\",0,IF(D71=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D71=\"Yes\"),AND($L$1=\"Scaled\",D71>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D71=\"No\"),AND($L$1=\"Scaled\",D71<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[435,"F.2.1","Fluid or water sensor?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.1 Environmental Controls – Computing Hardware",null,null,2,null,2,1,0,0,0,0,{"$f":"IF(I72=\"\",\"\",IF(D72=\"\",0,IF(D72=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D72=\"Yes\"),AND($L$1=\"Scaled\",D72>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D72=\"No\"),AND($L$1=\"Scaled\",D72<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[434,"F.2.2","Air conditioning?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.1 Environmental Controls – Computing Hardware","11.2.1.e","Equipment siting and protection",2,null,2,2,0,0,0,0,{"$f":"IF(I73=\"\",\"\",IF(D73=\"\",0,IF(D73=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D73=\"Yes\"),AND($L$1=\"Scaled\",D73>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D73=\"No\"),AND($L$1=\"Scaled\",D73<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[436,"F.2.3","Heat detection?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.1 Environmental Controls – Computing Hardware","11.2.1.e","Equipment siting and protection",2,null,2,3,0,0,0,0,{"$f":"IF(I74=\"\",\"\",IF(D74=\"\",0,IF(D74=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D74=\"Yes\"),AND($L$1=\"Scaled\",D74>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D74=\"No\"),AND($L$1=\"Scaled\",D74<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[439,"F.2.4","Smoke detection?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.1 Environmental Controls – Computing Hardware","11.2.1.e","Equipment siting and protection",2,null,2,4,0,0,0,0,{"$f":"IF(I75=\"\",\"\",IF(D75=\"\",0,IF(D75=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D75=\"Yes\"),AND($L$1=\"Scaled\",D75>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D75=\"No\"),AND($L$1=\"Scaled\",D75<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[441,"F.2.5","Vibration alarm / sensor?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.1 Environmental Controls – Computing Hardware","11.2.1.e","Equipment siting and protection",2,null,2,5,0,0,0,0,{"$f":"IF(I76=\"\",\"\",IF(D76=\"\",0,IF(D76=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D76=\"Yes\"),AND($L$1=\"Scaled\",D76>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D76=\"No\"),AND($L$1=\"Scaled\",D76<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[442,"F.2.6","Monitored fire alarm?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.1 Environmental Controls – Computing Hardware","11.2.1.e","Equipment siting and protection",2,null,2,6,0,0,0,0,{"$f":"IF(I77=\"\",\"\",IF(D77=\"\",0,IF(D77=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D77=\"Yes\"),AND($L$1=\"Scaled\",D77>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D77=\"No\"),AND($L$1=\"Scaled\",D77<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[443,"F.2.7","Fire suppression (e.g., dry, chemical, wet pipe)?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.1 Environmental Controls – Computing Hardware","11.2.1.e","Equipment siting and protection",2,null,2,7,0,0,0,0,{"$f":"IF(I78=\"\",\"\",IF(D78=\"\",0,IF(D78=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D78=\"Yes\"),AND($L$1=\"Scaled\",D78>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D78=\"No\"),AND($L$1=\"Scaled\",D78<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[447,"F.2.8","Multiple power feeds?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.1 Environmental Controls – Computing Hardware","11.2.2","Supporting utilities",2,null,2,8,0,0,0,0,{"$f":"IF(I79=\"\",\"\",IF(D79=\"\",0,IF(D79=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D79=\"Yes\"),AND($L$1=\"Scaled\",D79>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D79=\"No\"),AND($L$1=\"Scaled\",D79<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[448,"F.2.9","Multiple communication feeds?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.1 Environmental Controls – Computing Hardware","11.2.2","Supporting utilities",2,null,2,9,0,0,0,0,{"$f":"IF(I80=\"\",\"\",IF(D80=\"\",0,IF(D80=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D80=\"Yes\"),AND($L$1=\"Scaled\",D80>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D80=\"No\"),AND($L$1=\"Scaled\",D80<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[455,"F.2.10","Are there generator(s)?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.1 Environmental Controls – Computing Hardware","11.2.2","Supporting utilities",2,null,2,10,0,0,0,0,{"$f":"IF(I81=\"\",\"\",IF(D81=\"\",0,IF(D81=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D81=\"Yes\"),AND($L$1=\"Scaled\",D81>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D81=\"No\"),AND($L$1=\"Scaled\",D81<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[403,"F.2.11","Is access to the data center restricted and logs kept of all access?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.1.2.c","Physical entry controls",2,null,2,11,0,0,0,0,{"$f":"IF(I82=\"\",\"\",IF(D82=\"\",0,IF(D82=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D82=\"Yes\"),AND($L$1=\"Scaled\",D82>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D82=\"No\"),AND($L$1=\"Scaled\",D82<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[411,"F.2.11.1","Badge readers at points of entry?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.1.2","Physical entry controls",3,null,2,11,1,0,0,0,{"$f":"IF(I83=\"\",\"\",IF(D83=\"\",0,IF(D83=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D83=\"Yes\"),AND($L$1=\"Scaled\",D83>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D83=\"No\"),AND($L$1=\"Scaled\",D83<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[413,"F.2.11.2","Locked doors requiring a key or PIN at points of entry?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.1.2","Physical entry controls",3,null,2,11,2,0,0,0,{"$f":"IF(I84=\"\",\"\",IF(D84=\"\",0,IF(D84=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D84=\"Yes\"),AND($L$1=\"Scaled\",D84>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D84=\"No\"),AND($L$1=\"Scaled\",D84<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[404,"F.2.11.3","Access request procedures?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","H.7 Physical Access Authorization","9.1.1.g","Access control policy",3,null,2,11,3,0,0,0,{"$f":"IF(I85=\"\",\"\",IF(D85=\"\",0,IF(D85=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D85=\"Yes\"),AND($L$1=\"Scaled\",D85>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D85=\"No\"),AND($L$1=\"Scaled\",D85<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[406,"F.2.11.3.1","Segregation of duties for issuing and approving access?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","H.7 Physical Access Authorization","9.1.1.f","Access control policy",4,null,2,11,3,1,0,0,{"$f":"IF(I86=\"\",\"\",IF(D86=\"\",0,IF(D86=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D86=\"Yes\"),AND($L$1=\"Scaled\",D86>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D86=\"No\"),AND($L$1=\"Scaled\",D86<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[407,"F.2.11.3.2","Access reviews conducted at least every six months?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","9.1.1.h                                       9.2.5","Access control policy,         Review of user access rights",4,null,2,11,3,2,0,0,{"$f":"IF(I87=\"\",\"\",IF(D87=\"\",0,IF(D87=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D87=\"Yes\"),AND($L$1=\"Scaled\",D87>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D87=\"No\"),AND($L$1=\"Scaled\",D87<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[420,"F.2.11.4","Is there a mechanism to thwart tailgating / piggybacking into the data center?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","NA",null,3,null,2,11,4,0,0,0,{"$f":"IF(I88=\"\",\"\",IF(D88=\"\",0,IF(D88=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D88=\"Yes\"),AND($L$1=\"Scaled\",D88>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D88=\"No\"),AND($L$1=\"Scaled\",D88<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[414,"F.2.12","Are there security guards at points of entry?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.1.1.c","Physical security perimeter",2,null,2,12,0,0,0,0,{"$f":"IF(I89=\"\",\"\",IF(D89=\"\",0,IF(D89=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D89=\"Yes\"),AND($L$1=\"Scaled\",D89>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D89=\"No\"),AND($L$1=\"Scaled\",D89<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[415,"F.2.12.1","Do the security guards monitor security systems and alarms?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.1.1.c","Physical security perimeter",3,null,2,12,1,0,0,0,{"$f":"IF(I90=\"\",\"\",IF(D90=\"\",0,IF(D90=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D90=\"Yes\"),AND($L$1=\"Scaled\",D90>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D90=\"No\"),AND($L$1=\"Scaled\",D90<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[417,"F.2.13","Are visitors permitted in the data center?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.1.2","Physical entry controls",2,null,2,13,0,0,0,0,{"$f":"IF(I91=\"\",\"\",IF(D91=\"\",0,IF(D91=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D91=\"Yes\"),AND($L$1=\"Scaled\",D91>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D91=\"No\"),AND($L$1=\"Scaled\",D91<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[418,"F.2.13.1","Are they required to sign in and out of the data center?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.1.2.a","Physical entry controls",3,null,2,13,1,0,0,0,{"$f":"IF(I92=\"\",\"\",IF(D92=\"\",0,IF(D92=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D92=\"Yes\"),AND($L$1=\"Scaled\",D92>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D92=\"No\"),AND($L$1=\"Scaled\",D92<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[419,"F.2.13.2","Are they escorted within the data center?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.1.2.a","Physical entry controls",3,null,2,13,2,0,0,0,{"$f":"IF(I93=\"\",\"\",IF(D93=\"\",0,IF(D93=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D93=\"Yes\"),AND($L$1=\"Scaled\",D93>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D93=\"No\"),AND($L$1=\"Scaled\",D93<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[421,"F.2.14","Are all entry and exit points to the data center alarmed?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.1.1.f","Physical security perimeter",2,null,2,14,0,0,0,0,{"$f":"IF(I94=\"\",\"\",IF(D94=\"\",0,IF(D94=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D94=\"Yes\"),AND($L$1=\"Scaled\",D94>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D94=\"No\"),AND($L$1=\"Scaled\",D94<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[422,"F.2.14.1","Are there alarm motion sensors monitoring the data center?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.1.1.f","Physical security perimeter",3,null,2,14,1,0,0,0,{"$f":"IF(I95=\"\",\"\",IF(D95=\"\",0,IF(D95=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D95=\"Yes\"),AND($L$1=\"Scaled\",D95>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D95=\"No\"),AND($L$1=\"Scaled\",D95<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[2578,"F.2.15","Is access to the Data center monitored with CCTV and the video stored for at least 90 days?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","NA",null,2,null,2,15,0,0,0,0,{"$f":"IF(I96=\"\",\"\",IF(D96=\"\",0,IF(D96=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D96=\"Yes\"),AND($L$1=\"Scaled\",D96>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D96=\"No\"),AND($L$1=\"Scaled\",D96<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[430,"F.2.16","Walls extending from true floor to true ceiling?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.1.1.b","Physical security perimeter",2,null,2,16,0,0,0,0,{"$f":"IF(I97=\"\",\"\",IF(D97=\"\",0,IF(D97=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D97=\"Yes\"),AND($L$1=\"Scaled\",D97>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D97=\"No\"),AND($L$1=\"Scaled\",D97<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[432,"F.2.17","Windows or glass walls along the perimeter?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.1.1.b","Physical security perimeter",2,null,2,17,0,0,0,0,{"$f":"IF(I98=\"\",\"\",IF(D98=\"\",0,IF(D98=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D98=\"Yes\"),AND($L$1=\"Scaled\",D98>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D98=\"No\"),AND($L$1=\"Scaled\",D98<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[457,"F.2.18","Do the Scoped Systems and Data reside in a caged environment within a data center? If yes, is there a:","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","NA",null,2,null,2,18,0,0,0,0,{"$f":"IF(I99=\"\",\"\",IF(D99=\"\",0,IF(D99=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D99=\"Yes\"),AND($L$1=\"Scaled\",D99>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D99=\"No\"),AND($L$1=\"Scaled\",D99<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[461,"F.2.18.1","Lock requiring a key or PIN used at points of entry?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.1.2","Physical entry controls",3,null,2,18,1,0,0,0,{"$f":"IF(I100=\"\",\"\",IF(D100=\"\",0,IF(D100=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D100=\"Yes\"),AND($L$1=\"Scaled\",D100>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D100=\"No\"),AND($L$1=\"Scaled\",D100<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[462,"F.2.18.2","Process for requesting access?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","9.1.1.g","Access control policy",3,null,2,18,2,0,0,0,{"$f":"IF(I101=\"\",\"\",IF(D101=\"\",0,IF(D101=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D101=\"Yes\"),AND($L$1=\"Scaled\",D101>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D101=\"No\"),AND($L$1=\"Scaled\",D101<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[463,"F.2.18.2.1","Segregation of duties for granting and storage of access devices (badges, keys, etc.)?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","9.1.1.f","Access control policy",4,null,2,18,2,1,0,0,{"$f":"IF(I102=\"\",\"\",IF(D102=\"\",0,IF(D102=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D102=\"Yes\"),AND($L$1=\"Scaled\",D102>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D102=\"No\"),AND($L$1=\"Scaled\",D102<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[465,"F.2.18.3","List maintained of personnel with cards / keys to the caged environment?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.1.1.c","Physical security perimeter",3,null,2,18,3,0,0,0,{"$f":"IF(I103=\"\",\"\",IF(D103=\"\",0,IF(D103=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D103=\"Yes\"),AND($L$1=\"Scaled\",D103>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D103=\"No\"),AND($L$1=\"Scaled\",D103<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[466,"F.2.18.4","Process to report lost access cards / keys?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.1.2.d","Physical entry controls",3,null,2,18,4,0,0,0,{"$f":"IF(I104=\"\",\"\",IF(D104=\"\",0,IF(D104=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D104=\"Yes\"),AND($L$1=\"Scaled\",D104>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D104=\"No\"),AND($L$1=\"Scaled\",D104<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[467,"F.2.18.5","Process to review access to the cage at least every six months?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","9.1.1.h                                       9.2.5","Access control policy,         Review of user access rights",3,null,2,18,5,0,0,0,{"$f":"IF(I105=\"\",\"\",IF(D105=\"\",0,IF(D105=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D105=\"Yes\"),AND($L$1=\"Scaled\",D105>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D105=\"No\"),AND($L$1=\"Scaled\",D105<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[469,"F.2.18.6","Process to collect access equipment (badges, keys, change pin numbers, etc.) when a constituent is terminated or changes status and no longer requires access?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","H.6 Revoke Physical Access","9.1.1.i","Access control policy",3,null,2,18,6,0,0,0,{"$f":"IF(I106=\"\",\"\",IF(D106=\"\",0,IF(D106=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D106=\"Yes\"),AND($L$1=\"Scaled\",D106>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D106=\"No\"),AND($L$1=\"Scaled\",D106<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[471,"F.2.18.7","Are visitors permitted in the caged environment? If yes, are they:","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.1.2","Physical entry controls",3,null,2,18,7,0,0,0,{"$f":"IF(I107=\"\",\"\",IF(D107=\"\",0,IF(D107=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D107=\"Yes\"),AND($L$1=\"Scaled\",D107>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D107=\"No\"),AND($L$1=\"Scaled\",D107<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[472,"F.2.18.7.1","Required to sign in and out?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.1.2.a","Physical entry controls",4,null,2,18,7,1,0,0,{"$f":"IF(I108=\"\",\"\",IF(D108=\"\",0,IF(D108=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D108=\"Yes\"),AND($L$1=\"Scaled\",D108>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D108=\"No\"),AND($L$1=\"Scaled\",D108<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[473,"F.2.18.7.2","Escorted?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.1.2.a Physical entry controls","Physical entry controls",4,null,2,18,7,2,0,0,{"$f":"IF(I109=\"\",\"\",IF(D109=\"\",0,IF(D109=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D109=\"Yes\"),AND($L$1=\"Scaled\",D109>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D109=\"No\"),AND($L$1=\"Scaled\",D109<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[474,"F.2.18.8","Monitored with CCTV and the video stored for at least 90 days?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","NA",null,3,null,2,18,8,0,0,0,{"$f":"IF(I110=\"\",\"\",IF(D110=\"\",0,IF(D110=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D110=\"Yes\"),AND($L$1=\"Scaled\",D110>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D110=\"No\"),AND($L$1=\"Scaled\",D110<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[477,"F.2.19","Do the Scoped Systems and Data reside in a locked cabinet? If yes, is there:","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","NA",null,2,null,2,19,0,0,0,0,{"$f":"IF(I111=\"\",\"\",IF(D111=\"\",0,IF(D111=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D111=\"Yes\"),AND($L$1=\"Scaled\",D111>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D111=\"No\"),AND($L$1=\"Scaled\",D111<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[478,"F.2.19.1","Shared cabinets?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","NA",null,3,null,2,19,1,0,0,0,{"$f":"IF(I112=\"\",\"\",IF(D112=\"\",0,IF(D112=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D112=\"Yes\"),AND($L$1=\"Scaled\",D112>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D112=\"No\"),AND($L$1=\"Scaled\",D112<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[479,"F.2.19.2","Restricted access and logs kept of all access?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.1.2.c","Physical entry controls",3,null,2,19,2,0,0,0,{"$f":"IF(I113=\"\",\"\",IF(D113=\"\",0,IF(D113=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D113=\"Yes\"),AND($L$1=\"Scaled\",D113>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D113=\"No\"),AND($L$1=\"Scaled\",D113<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[480,"F.2.19.3","Access request procedures?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","9.1.1.g","Access control policy",3,null,2,19,3,0,0,0,{"$f":"IF(I114=\"\",\"\",IF(D114=\"\",0,IF(D114=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D114=\"Yes\"),AND($L$1=\"Scaled\",D114>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D114=\"No\"),AND($L$1=\"Scaled\",D114<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[481,"F.2.19.4","Segregation of duties for issuing, approving access and storing devices (badges, keys, etc.)?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","9.1.1.f","Access control policy",3,null,2,19,4,0,0,0,{"$f":"IF(I115=\"\",\"\",IF(D115=\"\",0,IF(D115=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D115=\"Yes\"),AND($L$1=\"Scaled\",D115>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D115=\"No\"),AND($L$1=\"Scaled\",D115<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[483,"F.2.19.5","A list of personnel with cards / keys to the cabinet?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.1.1.c","Physical security perimeter",3,null,2,19,5,0,0,0,{"$f":"IF(I116=\"\",\"\",IF(D116=\"\",0,IF(D116=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D116=\"Yes\"),AND($L$1=\"Scaled\",D116>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D116=\"No\"),AND($L$1=\"Scaled\",D116<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[484,"F.2.19.6","A process to report lost access cards / keys?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.1.2.d","Physical entry controls",3,null,2,19,6,0,0,0,{"$f":"IF(I117=\"\",\"\",IF(D117=\"\",0,IF(D117=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D117=\"Yes\"),AND($L$1=\"Scaled\",D117>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D117=\"No\"),AND($L$1=\"Scaled\",D117<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[485,"F.2.19.7","Collection access equipment (badges, keys, change pin numbers, etc.) when a constituent is terminated or changes status and no longer requires access?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","H.6 Revoke Physical Access","9.1.1.i","Access control policy",3,null,2,19,7,0,0,0,{"$f":"IF(I118=\"\",\"\",IF(D118=\"\",0,IF(D118=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D118=\"Yes\"),AND($L$1=\"Scaled\",D118>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D118=\"No\"),AND($L$1=\"Scaled\",D118<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[487,"F.2.19.8","Cabinets monitored with CCTV and the video stored for at least 90 days?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","NA",null,3,null,2,19,8,0,0,0,{"$f":"IF(I119=\"\",\"\",IF(D119=\"\",0,IF(D119=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D119=\"Yes\"),AND($L$1=\"Scaled\",D119>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D119=\"No\"),AND($L$1=\"Scaled\",D119<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[490,"F.2.20","Is there a policy on using locking screensavers on unattended system displays or locks on consoles within the data center?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.2.8                                       11.2.9","Unattended user equipment, Clear desk and clear screen policy",2,null,2,20,0,0,0,0,{"$f":"IF(I120=\"\",\"\",IF(D120=\"\",0,IF(D120=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D120=\"Yes\"),AND($L$1=\"Scaled\",D120>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D120=\"No\"),AND($L$1=\"Scaled\",D120<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[491,"F.2.21","Is there a procedure for equipment removal from the data center?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.2.6","Security of equipment and assets off-premises",2,null,2,21,0,0,0,0,{"$f":"IF(I121=\"\",\"\",IF(D121=\"\",0,IF(D121=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D121=\"Yes\"),AND($L$1=\"Scaled\",D121>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D121=\"No\"),AND($L$1=\"Scaled\",D121<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[526,"F.2.22","Is there a preventive maintenance or current maintenance contracts for:",null,null,"F.2 Physical Security Controls – Scoped Systems and Data","11.2.4","Equipment maintenance",2,1,2,22,0,0,0,0,{"$f":"IF(I122=\"\",\"\",IF(D122=\"\",0,IF(D122=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D122=\"Yes\"),AND($L$1=\"Scaled\",D122>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D122=\"No\"),AND($L$1=\"Scaled\",D122<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,1,1,0,null,null,null,2]
[527,"F.2.22.1","UPS system?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.2.4","Equipment maintenance",3,null,2,22,1,0,0,0,{"$f":"IF(I123=\"\",\"\",IF(D123=\"\",0,IF(D123=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D123=\"Yes\"),AND($L$1=\"Scaled\",D123>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D123=\"No\"),AND($L$1=\"Scaled\",D123<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,0,3,3,1,0,0,null,null,null,2]
[528,"F.2.22.2","Security system?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.2.4","Equipment maintenance",3,null,2,22,2,0,0,0,{"$f":"IF(I124=\"\",\"\",IF(D124=\"\",0,IF(D124=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D124=\"Yes\"),AND($L$1=\"Scaled\",D124>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D124=\"No\"),AND($L$1=\"Scaled\",D124<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,0,3,3,1,0,0,null,null,null,2]
[529,"F.2.22.3","Generator?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.2.4","Equipment maintenance",3,null,2,22,3,0,0,0,{"$f":"IF(I125=\"\",\"\",IF(D125=\"\",0,IF(D125=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D125=\"Yes\"),AND($L$1=\"Scaled\",D125>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D125=\"No\"),AND($L$1=\"Scaled\",D125<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,0,3,3,1,0,0,null,null,null,2]
[530,"F.2.22.4","Batteries?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.2.4","Equipment maintenance",3,null,2,22,4,0,0,0,{"$f":"IF(I126=\"\",\"\",IF(D126=\"\",0,IF(D126=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D126=\"Yes\"),AND($L$1=\"Scaled\",D126>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D126=\"No\"),AND($L$1=\"Scaled\",D126<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,0,3,3,1,0,0,null,null,null,2]
[531,"F.2.22.5","Monitored fire alarm?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.2.4","Equipment maintenance",3,null,2,22,5,0,0,0,{"$f":"IF(I127=\"\",\"\",IF(D127=\"\",0,IF(D127=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D127=\"Yes\"),AND($L$1=\"Scaled\",D127>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D127=\"No\"),AND($L$1=\"Scaled\",D127<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,0,3,3,1,0,0,null,null,null,2]
[532,"F.2.22.6","Fire suppression systems?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.2.4","Equipment maintenance",3,null,2,22,6,0,0,0,{"$f":"IF(I128=\"\",\"\",IF(D128=\"\",0,IF(D128=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D128=\"Yes\"),AND($L$1=\"Scaled\",D128>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D128=\"No\"),AND($L$1=\"Scaled\",D128<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,0,3,3,1,0,0,null,null,null,2]
[533,"F.2.22.7","HVAC?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","11.2.4","Equipment maintenance",3,null,2,22,7,0,0,0,{"$f":"IF(I129=\"\",\"\",IF(D129=\"\",0,IF(D129=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D129=\"Yes\"),AND($L$1=\"Scaled\",D129>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D129=\"No\"),AND($L$1=\"Scaled\",D129<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,0,3,3,1,0,0,null,null,null,2]
[534,"F.2.23","Are the following tested:",null,null,"F.2 Physical Security Controls – Scoped Systems and Data","NA",null,2,1,2,23,0,0,0,0,{"$f":"IF(I130=\"\",\"\",IF(D130=\"\",0,IF(D130=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D130=\"Yes\"),AND($L$1=\"Scaled\",D130>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D130=\"No\"),AND($L$1=\"Scaled\",D130<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,1,1,0,null,null,null,2]
[535,"F.2.23.1","UPS system - annually?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","NA",null,3,null,2,23,1,0,0,0,{"$f":"IF(I131=\"\",\"\",IF(D131=\"\",0,IF(D131=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D131=\"Yes\"),AND($L$1=\"Scaled\",D131>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D131=\"No\"),AND($L$1=\"Scaled\",D131<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,0,3,3,1,0,0,null,null,null,2]
[536,"F.2.23.2","Security alarm system - annually?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","NA",null,3,null,2,23,2,0,0,0,{"$f":"IF(I132=\"\",\"\",IF(D132=\"\",0,IF(D132=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D132=\"Yes\"),AND($L$1=\"Scaled\",D132>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D132=\"No\"),AND($L$1=\"Scaled\",D132<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,0,3,3,1,0,0,null,null,null,2]
[537,"F.2.23.3","Fire alarms - annually?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","NA",null,3,null,2,23,3,0,0,0,{"$f":"IF(I133=\"\",\"\",IF(D133=\"\",0,IF(D133=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D133=\"Yes\"),AND($L$1=\"Scaled\",D133>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D133=\"No\"),AND($L$1=\"Scaled\",D133<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,0,3,3,1,0,0,null,null,null,2]
[538,{"$f":"IF(I134=0,\"\",IF(I134=1,P$1&\".\"&K134,IF(I134=2,P$1&\".\"&K134&\".\"&L134,IF(I134=3,P$1&\".\"&K134&\".\"&L134&\".\"&M134,IF(I134=4,P$1&\".\"&K134&\".\"&L134&\".\"&M134&\".\"&N134,IF(I134=5,P$1&\".\"&K134&\".\"&L134&\".\"&M134&\".\"&N134&\".\"&O134))))))","v":"F.2.23.4"},"Fire suppression system - annually?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","NA",null,3,null,{"$f":"IF(K133=\"\",1,IF(I134=1,K133+1,K133))","v":2},{"$f":"IF(L133=\"\",0,IF(K133<>K134,0,IF($I134=2,L133+1,L133)))","v":23},{"$f":"IF(M133=\"\",0,IF(L133<>L134,0,IF($I134=3,M133+1,M133)))","v":4},{"$f":"IF(N133=\"\",0,IF(M133<>M134,0,IF($I134=4,N133+1,N133)))","v":0},{"$f":"IF(O133=\"\",0,IF(N133<>N134,0,IF($I134=5,O133+1,O133)))","v":0},{"$f":"IF(OR(Master=\"Master\",I134=0,J134=1),0,IF(ISNA(VLOOKUP(A134,L2_Array,21,FALSE)),0,VLOOKUP(A134,L2_Array,21,FALSE)))","v":0},{"$f":"IF(I134=\"\",\"\",IF(D134=\"\",0,IF(D134=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D134=\"Yes\"),AND($L$1=\"Scaled\",D134>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D134=\"No\"),AND($L$1=\"Scaled\",D134<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},{"$f":"IF(I134=\"\",\"\",IF(P134>0,P134,IF(Q134>0,Q134,0)))","v":3},{"$f":"IF(I134=\"\",\"\",IF(OR(I134=1,S133=\"\"),1,IF(OR(AND(J133=1,(I134-I132<>0)),AND(S133=0,I133=I134),AND(J133=1,I134=I132)),0,1)))","v":0},{"$f":"IF(I134=\"\",T133,IF(AND(R134>1,OR(T133=\"\",T133=0,T133>=I134)),I134,IF(I134>T133,T133,0)))","v":3},{"$f":"IF(Master=\"Master\",Q134,IF(U133=\"\",R134,IF(OR(AND(T134>0,R134<U133),AND(T134=1,R134<=U133)),U133,R134)))","v":3},{"$f":"IF(I134=\"\",\"\",IF(OR(AND(S133=1,T134=1),R134>0,AND(S135=0,V135=1)),1,0))","v":1},{"$f":"IF(I134=\"\",\"\",IF(OR(AND(T134>0,S134=1),AND(S134=1,V134=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A134,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(I134=1,R134=1),2,IF(AND(U133=1,K134=K133),2,IF(AND(AB133=2,K134=K133),2,IF(I134=1,1,\"\"))))","v":2}]
[539,{"$f":"IF(I135=0,\"\",IF(I135=1,P$1&\".\"&K135,IF(I135=2,P$1&\".\"&K135&\".\"&L135,IF(I135=3,P$1&\".\"&K135&\".\"&L135&\".\"&M135,IF(I135=4,P$1&\".\"&K135&\".\"&L135&\".\"&M135&\".\"&N135,IF(I135=5,P$1&\".\"&K135&\".\"&L135&\".\"&M135&\".\"&N135&\".\"&O135))))))","v":"F.2.23.5"},"Generators - monthly?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","NA",null,3,null,{"$f":"IF(K134=\"\",1,IF(I135=1,K134+1,K134))","v":2},{"$f":"IF(L134=\"\",0,IF(K134<>K135,0,IF($I135=2,L134+1,L134)))","v":23},{"$f":"IF(M134=\"\",0,IF(L134<>L135,0,IF($I135=3,M134+1,M134)))","v":5},{"$f":"IF(N134=\"\",0,IF(M134<>M135,0,IF($I135=4,N134+1,N134)))","v":0},{"$f":"IF(O134=\"\",0,IF(N134<>N135,0,IF($I135=5,O134+1,O134)))","v":0},{"$f":"IF(OR(Master=\"Master\",I135=0,J135=1),0,IF(ISNA(VLOOKUP(A135,L2_Array,21,FALSE)),0,VLOOKUP(A135,L2_Array,21,FALSE)))","v":0},{"$f":"IF(I135=\"\",\"\",IF(D135=\"\",0,IF(D135=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D135=\"Yes\"),AND($L$1=\"Scaled\",D135>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D135=\"No\"),AND($L$1=\"Scaled\",D135<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},{"$f":"IF(I135=\"\",\"\",IF(P135>0,P135,IF(Q135>0,Q135,0)))","v":3},{"$f":"IF(I135=\"\",\"\",IF(OR(I135=1,S134=\"\"),1,IF(OR(AND(J134=1,(I135-I133<>0)),AND(S134=0,I134=I135),AND(J134=1,I135=I133)),0,1)))","v":0},{"$f":"IF(I135=\"\",T134,IF(AND(R135>1,OR(T134=\"\",T134=0,T134>=I135)),I135,IF(I135>T134,T134,0)))","v":3},{"$f":"IF(Master=\"Master\",Q135,IF(U134=\"\",R135,IF(OR(AND(T135>0,R135<U134),AND(T135=1,R135<=U134)),U134,R135)))","v":3},{"$f":"IF(I135=\"\",\"\",IF(OR(AND(S134=1,T135=1),R135>0,AND(S136=0,V136=1)),1,0))","v":1},{"$f":"IF(I135=\"\",\"\",IF(OR(AND(T135>0,S135=1),AND(S135=1,V135=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A135,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(I135=1,R135=1),2,IF(AND(U134=1,K135=K134),2,IF(AND(AB134=2,K135=K134),2,IF(I135=1,1,\"\"))))","v":2}]
[540,{"$f":"IF(I136=0,\"\",IF(I136=1,P$1&\".\"&K136,IF(I136=2,P$1&\".\"&K136&\".\"&L136,IF(I136=3,P$1&\".\"&K136&\".\"&L136&\".\"&M136,IF(I136=4,P$1&\".\"&K136&\".\"&L136&\".\"&M136&\".\"&N136,IF(I136=5,P$1&\".\"&K136&\".\"&L136&\".\"&M136&\".\"&N136&\".\"&O136))))))","v":"F.2.23.6"},"Generators full load tested - monthly?","N/A","Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. ","F.2 Physical Security Controls – Scoped Systems and Data","NA",null,3,null,{"$f":"IF(K135=\"\",1,IF(I136=1,K135+1,K135))","v":2},{"$f":"IF(L135=\"\",0,IF(K135<>K136,0,IF($I136=2,L135+1,L135)))","v":23},{"$f":"IF(M135=\"\",0,IF(L135<>L136,0,IF($I136=3,M135+1,M135)))","v":6},{"$f":"IF(N135=\"\",0,IF(M135<>M136,0,IF($I136=4,N135+1,N135)))","v":0},{"$f":"IF(O135=\"\",0,IF(N135<>N136,0,IF($I136=5,O135+1,O135)))","v":0},{"$f":"IF(OR(Master=\"Master\",I136=0,J136=1),0,IF(ISNA(VLOOKUP(A136,L2_Array,21,FALSE)),0,VLOOKUP(A136,L2_Array,21,FALSE)))","v":0},{"$f":"IF(I136=\"\",\"\",IF(D136=\"\",0,IF(D136=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D136=\"Yes\"),AND($L$1=\"Scaled\",D136>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D136=\"No\"),AND($L$1=\"Scaled\",D136<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},{"$f":"IF(I136=\"\",\"\",IF(P136>0,P136,IF(Q136>0,Q136,0)))","v":3},{"$f":"IF(I136=\"\",\"\",IF(OR(I136=1,S135=\"\"),1,IF(OR(AND(J135=1,(I136-I134<>0)),AND(S135=0,I135=I136),AND(J135=1,I136=I134)),0,1)))","v":0},{"$f":"IF(I136=\"\",T135,IF(AND(R136>1,OR(T135=\"\",T135=0,T135>=I136)),I136,IF(I136>T135,T135,0)))","v":3},{"$f":"IF(Master=\"Master\",Q136,IF(U135=\"\",R136,IF(OR(AND(T136>0,R136<U135),AND(T136=1,R136<=U135)),U135,R136)))","v":3},{"$f":"IF(I136=\"\",\"\",IF(OR(AND(S135=1,T136=1),R136>0,AND(S137=0,V137=1)),1,0))","v":1},{"$f":"IF(I136=\"\",\"\",IF(OR(AND(T136>0,S136=1),AND(S136=1,V136=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A136,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(I136=1,R136=1),2,IF(AND(U135=1,K136=K135),2,IF(AND(AB135=2,K136=K135),2,IF(I136=1,1,\"\"))))","v":2}]

{"sheet":"G. Communications and Ops Mgmt","index":13,"n_rows":293,"n_cols":28,"rows_kept":293,"cut":false,"hidden":false,"merged":[[2,1,2,7]]}
[10,"G. Communications and Operations Management",null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,null,"Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"G"}]
[null,null,null,{"$f":"IF(W2=0,\"0%\",W2/S2)","v":1},"Percent Complete",null,null,null,{"$f":"COUNTA(I5:I293)","v":289},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(S5:S293,1)","v":265},null,null,null,{"$f":"COUNTIF(W5:W293,1)","v":265}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column E to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, check the Disable Tab Automation checkbox at the top of the page.",null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter"]
[{"$f":"MAX(A5:A293)","v":3917},"Ques Num","Question/Request","Response","Additional Information","AUP Reference","ISO Ref Num","ISO Ref Text"]
[2582,{"$f":"IF(I5=0,\"\",IF(I5=1,P$1&\".\"&K5,IF(I5=2,P$1&\".\"&K5&\".\"&L5,IF(I5=3,P$1&\".\"&K5&\".\"&L5&\".\"&M5,IF(I5=4,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5,IF(I5=5,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5))))))","v":"G.1"},"Are management approved operating procedures utilized? If yes, are they:","Yes","Cloudamize Security Policy","G. Communications and Operations Management","12.1.1","Documented Operating Procedure",1,null,{"$f":"IF(K4=\"\",1,IF(I5=1,K4+1,K4))","v":1},{"$f":"IF(L4=\"\",0,IF(K4<>K5,0,IF($I5=2,L4+1,L4)))","v":0},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($I5=3,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($I5=4,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($I5=5,O4+1,O4)))","v":0},{"$f":"IF(OR(Master=\"Master\",I5=0,J5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,21,FALSE)),0,VLOOKUP(A5,L2_Array,21,FALSE)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D5=\"Yes\"),AND($L$1=\"Scaled\",D5>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D5=\"No\"),AND($L$1=\"Scaled\",D5<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I5=\"\",\"\",IF(P5>0,P5,IF(Q5>0,Q5,0)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(I5=1,S4=\"\"),1,IF(OR(AND(J4=1,(I5-I3<>0)),AND(S4=0,I4=I5),AND(J4=1,I5=I3)),0,1)))","v":1},{"$f":"IF(I5=\"\",T4,IF(AND(R5>1,OR(T4=\"\",T4=0,T4>=I5)),I5,IF(I5>T4,T4,0)))","v":0},{"$f":"IF(Master=\"Master\",Q5,IF(U4=\"\",R5,IF(OR(AND(T5>0,R5<U4),AND(T5=1,R5<=U4)),U4,R5)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(S4=1,T5=1),R5>0,AND(S6=0,V6=1)),1,0))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(T5>0,S5=1),AND(S5=1,V5=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(I5=1,R5=1),2,IF(AND(U4=1,K5=K4),2,IF(AND(AB4=2,K5=K4),2,IF(I5=1,1,\"\"))))","v":2}]
[2583,{"$f":"IF(I6=0,\"\",IF(I6=1,P$1&\".\"&K6,IF(I6=2,P$1&\".\"&K6&\".\"&L6,IF(I6=3,P$1&\".\"&K6&\".\"&L6&\".\"&M6,IF(I6=4,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6,IF(I6=5,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6))))))","v":"G.1.1"},"Documented, maintained, and made available to all users?","Yes","Cloudamize Security Policy","G. Communications and Operations Management","12.1.1","Documented Operating Procedure",2,null,{"$f":"IF(K5=\"\",1,IF(I6=1,K5+1,K5))","v":1},{"$f":"IF(L5=\"\",0,IF(K5<>K6,0,IF($I6=2,L5+1,L5)))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($I6=3,M5+1,M5)))","v":0},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($I6=4,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($I6=5,O5+1,O5)))","v":0},0,{"$f":"IF(I6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D6=\"Yes\"),AND($L$1=\"Scaled\",D6>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D6=\"No\"),AND($L$1=\"Scaled\",D6<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I6=\"\",\"\",IF(P6>0,P6,IF(Q6>0,Q6,0)))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(I6=1,S5=\"\"),1,IF(OR(AND(J5=1,(I6-I4<>0)),AND(S5=0,I5=I6),AND(J5=1,I6=I4)),0,1)))","v":1},{"$f":"IF(I6=\"\",T5,IF(AND(R6>1,OR(T5=\"\",T5=0,T5>=I6)),I6,IF(I6>T5,T5,0)))","v":0},1,{"$f":"IF(I6=\"\",\"\",IF(OR(AND(S5=1,T6=1),R6>0,AND(S7=0,V7=1)),1,0))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(T6>0,S6=1),AND(S6=1,V6=1)),1,0))","v":1},0,null,null,null,{"$f":"IF(AND(I6=1,R6=1),2,IF(AND(U5=1,K6=K5),2,IF(AND(AB5=2,K6=K5),2,IF(I6=1,1,\"\"))))","v":2}]
[816,"G.2","Is there an operational change management / change control policy or program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy? If yes, does it include:","Yes","Cloudamize Security Policy -Change Management","G.21 Change Control","12.1.2","Change Management",1,null,2,0,0,0,0,1,{"$f":"IF(I7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D7=\"Yes\"),AND($L$1=\"Scaled\",D7>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D7=\"No\"),AND($L$1=\"Scaled\",D7<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[828,"G.2.1","Documentation of changes?","Yes","Cloudamize Security Policy -Change Management","G.21 Change Control","12.1.2.a","Change Management",2,null,2,1,0,0,0,0,{"$f":"IF(I8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D8=\"Yes\"),AND($L$1=\"Scaled\",D8>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D8=\"No\"),AND($L$1=\"Scaled\",D8<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[823,"G.2.2","Request, review and approval of proposed changes?","Yes","Cloudamize Security Policy -Change Management","G.21 Change Control","12.1.2.d","Change Management",2,null,2,2,0,0,0,0,{"$f":"IF(I9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D9=\"Yes\"),AND($L$1=\"Scaled\",D9>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D9=\"No\"),AND($L$1=\"Scaled\",D9<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[829,"G.2.3","Pre-implementation testing?","Yes","Cloudamize Security Policy -Change Management","G.21 Change Control","12.1.2.b","Change Management",2,null,2,3,0,0,0,0,{"$f":"IF(I10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D10=\"Yes\"),AND($L$1=\"Scaled\",D10>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D10=\"No\"),AND($L$1=\"Scaled\",D10<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[830,"G.2.4","Post-implementation testing?","Yes","Cloudamize Security Policy -Change Management","G.21 Change Control","12.1.2.b","Change Management",2,null,2,4,0,0,0,0,{"$f":"IF(I11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D11=\"Yes\"),AND($L$1=\"Scaled\",D11>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D11=\"No\"),AND($L$1=\"Scaled\",D11<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[824,"G.2.5","Review for potential security impact?","Yes","Cloudamize Security Policy -Change Management","G.21 Change Control","12.1.2.c","Change Management",2,null,2,5,0,0,0,0,{"$f":"IF(I12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D12=\"Yes\"),AND($L$1=\"Scaled\",D12>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D12=\"No\"),AND($L$1=\"Scaled\",D12<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[826,"G.2.6","Review for potential operational impact?","Yes","Cloudamize Security Policy -Change Management","G.21 Change Control","12.1.2.c","Change Management",2,null,2,6,0,0,0,0,{"$f":"IF(I13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D13=\"Yes\"),AND($L$1=\"Scaled\",D13>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D13=\"No\"),AND($L$1=\"Scaled\",D13<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2593,"G.2.7","Communication of changes to all relevant constituents?","Yes","Cloudamize Security Policy -Change Management","G.21 Change Control","12.1.2.f","Change Management",2,null,2,7,0,0,0,0,{"$f":"IF(I14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D14=\"Yes\"),AND($L$1=\"Scaled\",D14>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D14=\"No\"),AND($L$1=\"Scaled\",D14<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[831,"G.2.8","Rollback procedures?","Yes","Cloudamize Security Policy -Change Management","G.21 Change Control","12.1.2.g","Change Management",2,null,2,8,0,0,0,0,{"$f":"IF(I15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D15=\"Yes\"),AND($L$1=\"Scaled\",D15>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D15=\"No\"),AND($L$1=\"Scaled\",D15<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[841,"G.2.9","Maintenance of change control logs?","Yes","Cloudamize Security Policy -Change Management","G.21 Change Control","14.2.2.j","System change control procedures",2,null,2,9,0,0,0,0,{"$f":"IF(I16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D16=\"Yes\"),AND($L$1=\"Scaled\",D16>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D16=\"No\"),AND($L$1=\"Scaled\",D16<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[837,"G.2.10","Code reviewed by information security prior to the implementation of internally developed applications and / or application updates?","Yes","Cloudamize Security Policy -Change Management","G.21 Change Control","14.2.2.e","System change control procedures",2,null,2,10,0,0,0,0,{"$f":"IF(I17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D17=\"Yes\"),AND($L$1=\"Scaled\",D17>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D17=\"No\"),AND($L$1=\"Scaled\",D17<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[839,"G.2.11","Is Information security's approval required prior to implementation changes?","Yes","Cloudamize Security Policy -Change Management","G.21 Change Control","14.2.2.f","System change control procedures",2,null,2,11,0,0,0,0,{"$f":"IF(I18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D18=\"Yes\"),AND($L$1=\"Scaled\",D18>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D18=\"No\"),AND($L$1=\"Scaled\",D18<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[832,"G.2.12","Are the following changes to the production environment subject to the change control process:",null,null,"G.21 Change Control","12.1.2                                      14.2.2","Change Management      System change control procedures",2,1,2,12,0,0,0,0,{"$f":"IF(I19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D19=\"Yes\"),AND($L$1=\"Scaled\",D19>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D19=\"No\"),AND($L$1=\"Scaled\",D19<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,1,1,0,null,null,null,2]
[833,"G.2.12.1","Network?","Yes","Cloudamize Security Policy -Change Management","G.21 Change Control","14.2.2","System change control procedures",3,null,2,12,1,0,0,0,{"$f":"IF(I20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D20=\"Yes\"),AND($L$1=\"Scaled\",D20>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D20=\"No\"),AND($L$1=\"Scaled\",D20<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,0,0,1,1,0,0,null,null,null,2]
[834,"G.2.12.2","Systems?","Yes","Cloudamize Security Policy -Change Management","G.21 Change Control","14.2.2","System change control procedures",3,null,2,12,2,0,0,0,{"$f":"IF(I21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D21=\"Yes\"),AND($L$1=\"Scaled\",D21>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D21=\"No\"),AND($L$1=\"Scaled\",D21<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,0,0,1,1,0,0,null,null,null,2]
[835,"G.2.12.3","Application updates?","Yes","Cloudamize Security Policy -Change Management","G.21 Change Control","14.2.2","System change control procedures",3,null,2,12,3,0,0,0,{"$f":"IF(I22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D22=\"Yes\"),AND($L$1=\"Scaled\",D22>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D22=\"No\"),AND($L$1=\"Scaled\",D22<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,0,0,1,1,0,0,null,null,null,2]
[836,"G.2.12.4","Code changes?","Yes","Cloudamize Security Policy -Change Management","G.21 Change Control","14.2.2","System change control procedures",3,null,2,12,4,0,0,0,{"$f":"IF(I23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D23=\"Yes\"),AND($L$1=\"Scaled\",D23>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D23=\"No\"),AND($L$1=\"Scaled\",D23<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,0,0,1,1,0,0,null,null,null,2]
[838,"G.2.13","Is there a segregation of duties between those requesting, approving and implementing a change?","Yes","Cloudamize Security Policy -Change Management","G.21 Change Control","6.1.2","Segregation Of Duties",2,null,2,13,0,0,0,0,{"$f":"IF(I24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D24=\"Yes\"),AND($L$1=\"Scaled\",D24>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D24=\"No\"),AND($L$1=\"Scaled\",D24<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[853,"G.3","Do Subcontractors have access to Scoped Systems and Data? (backup vendors, service providers, equipment support maintenance, software maintenance vendors, data recovery vendors, etc.)? If yes, is there:","Yes","Cloudamize Security Policy - Cloudamize Network Security",null,15,"Supplier relationships",1,null,3,0,0,0,0,1,{"$f":"IF(I25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D25=\"Yes\"),AND($L$1=\"Scaled\",D25>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D25=\"No\"),AND($L$1=\"Scaled\",D25<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[3897,"G.3.1","Is there a documented subcontractor management process in place for the selection and oversight of third party vendors? If yes, does it include:","No","Cloudamize Security Policy - Cloudamize Network Security","M.1 Subcontractor Selection and Management Process","15.1.1","Information security policy for supplier relationships",2,null,3,1,0,0,0,0,{"$f":"IF(I26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D26=\"Yes\"),AND($L$1=\"Scaled\",D26>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D26=\"No\"),AND($L$1=\"Scaled\",D26<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[3898,"G.3.1.1","Approval by management?",null,null,"M.1 Subcontractor Selection and Management Process","5.1.1","Policies on information security",3,null,3,1,1,0,0,0,{"$f":"IF(I27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D27=\"Yes\"),AND($L$1=\"Scaled\",D27>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D27=\"No\"),AND($L$1=\"Scaled\",D27<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[3899,"G.3.1.2","Annual review?",null,null,"M.1 Subcontractor Selection and Management Process","5.1.2","Review of the policies for information security",3,null,3,1,2,0,0,0,{"$f":"IF(I28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D28=\"Yes\"),AND($L$1=\"Scaled\",D28>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D28=\"No\"),AND($L$1=\"Scaled\",D28<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[3900,"G.3.1.3","Review of the subcontractor's vendor management policy and procedures?",null,null,"M.3 Documenting Information Security Assessments for Subcontractors","15.2.1.g","Monitoring and review of supplier services",3,null,3,1,3,0,0,0,{"$f":"IF(I29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D29=\"Yes\"),AND($L$1=\"Scaled\",D29>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D29=\"No\"),AND($L$1=\"Scaled\",D29<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[3901,"G.3.2","Is there a process to identify and log subcontractor information security, privacy and/or data breach issues?","No","Cloudamize Security Policy - Cloudamize Network Security","M.3 Documenting Information Security Assessments for Subcontractors","15.2.1.e","Monitoring and review of supplier services",2,null,3,2,0,0,0,0,{"$f":"IF(I30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D30=\"Yes\"),AND($L$1=\"Scaled\",D30>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D30=\"No\"),AND($L$1=\"Scaled\",D30<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[3902,"G.3.3","Do subcontractor's, as part of their vendor risk management program include the following:",null,null,null,"NA",null,2,1,3,3,0,0,0,0,{"$f":"IF(I31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D31=\"Yes\"),AND($L$1=\"Scaled\",D31>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D31=\"No\"),AND($L$1=\"Scaled\",D31<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,1,1,0,null,null,null,2]
[3903,"G.3.3.1","Comprehensive financial analysis?","No",null,"M.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,1,0,0,0,{"$f":"IF(I32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D32=\"Yes\"),AND($L$1=\"Scaled\",D32>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D32=\"No\"),AND($L$1=\"Scaled\",D32<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,0,3,2,1,0,0,null,null,null,2]
[3904,"G.3.3.2","Vendor reputational review?","No",null,"M.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,2,0,0,0,{"$f":"IF(I33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D33=\"Yes\"),AND($L$1=\"Scaled\",D33>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D33=\"No\"),AND($L$1=\"Scaled\",D33<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,0,3,2,1,0,0,null,null,null,2]
[3905,"G.3.3.3","Compliance checks (e.g., Office of Foreign Assets Controls (OFAC), etc.)?","No",null,"M.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,3,0,0,0,{"$f":"IF(I34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D34=\"Yes\"),AND($L$1=\"Scaled\",D34>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D34=\"No\"),AND($L$1=\"Scaled\",D34<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,0,3,2,1,0,0,null,null,null,2]
[3906,"G.3.3.4","Defined risk assessment and classification method for vendors?","No",null,"M.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,4,0,0,0,{"$f":"IF(I35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D35=\"Yes\"),AND($L$1=\"Scaled\",D35>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D35=\"No\"),AND($L$1=\"Scaled\",D35<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,0,3,2,1,0,0,null,null,null,2]
[3907,"G.3.3.5","Management of subcontractor risk, compliance and performance?","No",null,"M.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,5,0,0,0,{"$f":"IF(I36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D36=\"Yes\"),AND($L$1=\"Scaled\",D36>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D36=\"No\"),AND($L$1=\"Scaled\",D36<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,0,3,2,1,0,0,null,null,null,2]
[3908,"G.3.3.6","Ability and right to audit controls? ","No",null,"M.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,6,0,0,0,{"$f":"IF(I37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D37=\"Yes\"),AND($L$1=\"Scaled\",D37>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D37=\"No\"),AND($L$1=\"Scaled\",D37<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,0,3,2,1,0,0,null,null,null,2]
[3909,"G.3.3.7","Notification of new or change in subcontractors?","No",null,"M.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,7,0,0,0,{"$f":"IF(I38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D38=\"Yes\"),AND($L$1=\"Scaled\",D38>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D38=\"No\"),AND($L$1=\"Scaled\",D38<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,0,3,2,1,0,0,null,null,null,2]
[3910,"G.3.3.8","Defined procedures for subcontractor management?","No",null,"M.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,8,0,0,0,{"$f":"IF(I39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D39=\"Yes\"),AND($L$1=\"Scaled\",D39>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D39=\"No\"),AND($L$1=\"Scaled\",D39<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,0,3,2,1,0,0,null,null,null,2]
[3911,"G.3.3.9","Oversight and Governance of program adherence?","No",null,"M.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,9,0,0,0,{"$f":"IF(I40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D40=\"Yes\"),AND($L$1=\"Scaled\",D40>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D40=\"No\"),AND($L$1=\"Scaled\",D40<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,0,3,2,1,0,0,null,null,null,2]
[873,"G.3.3.10","Security review prior to engaging their services (logical, physical, other controls)?","No",null,"M.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,10,0,0,0,{"$f":"IF(I41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D41=\"Yes\"),AND($L$1=\"Scaled\",D41>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D41=\"No\"),AND($L$1=\"Scaled\",D41<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,0,3,2,1,0,0,null,null,null,2]
[874,"G.3.3.11","Security review at least annually?","No",null,"M.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,11,0,0,0,{"$f":"IF(I42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D42=\"Yes\"),AND($L$1=\"Scaled\",D42>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D42=\"No\"),AND($L$1=\"Scaled\",D42<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,0,3,2,1,0,0,null,null,null,2]
[875,"G.3.3.12","Risk assessments or review?","No",null,"M.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,12,0,0,0,{"$f":"IF(I43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D43=\"Yes\"),AND($L$1=\"Scaled\",D43>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D43=\"No\"),AND($L$1=\"Scaled\",D43<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,0,3,2,1,0,0,null,null,null,2]
[878,"G.3.3.13","Confidentiality and/or Non Disclosure Agreement requirements?","No",null,"M.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,13,0,0,0,{"$f":"IF(I44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D44=\"Yes\"),AND($L$1=\"Scaled\",D44>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D44=\"No\"),AND($L$1=\"Scaled\",D44<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,0,3,2,1,0,0,null,null,null,2]
[879,"G.3.3.14","Notification of changes affecting services rendered?","No",null,"M.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,14,0,0,0,{"$f":"IF(I45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D45=\"Yes\"),AND($L$1=\"Scaled\",D45>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D45=\"No\"),AND($L$1=\"Scaled\",D45<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,0,3,2,1,0,0,null,null,null,2]
[895,"G.4","Is there an anti-virus / malware policy or program (workstations, servers, mobile devices) that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?","Yes","Cloudamize Security Policy - Cloudamize Personnel Acceptable Use Policy","G.7 Virus Protection (Servers), G.8 Virus Protection (Workstations)","12.2.1","Controls Against Malware",1,null,4,0,0,0,0,1,{"$f":"IF(I46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D46=\"Yes\"),AND($L$1=\"Scaled\",D46>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D46=\"No\"),AND($L$1=\"Scaled\",D46<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[912,"G.4.1","What is the interval between the availability of a new signature update and its deployment:",null,null,"G.1 Network Security – IDS/IPS Signature Updates","12.6.1","Management of technical vulnerabilities",2,1,4,1,0,0,0,0,{"$f":"IF(I47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D47=\"Yes\"),AND($L$1=\"Scaled\",D47>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D47=\"No\"),AND($L$1=\"Scaled\",D47<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,1,1,0,null,null,null,2]
[913,"G.4.1.1","Hourly?","Yes","Cloudamize Security Policy - Cloudamize Personnel Acceptable Use Policy","G.1 Network Security – IDS/IPS Signature Updates","NA","",3,null,4,1,1,0,0,0,{"$f":"IF(I48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D48=\"Yes\"),AND($L$1=\"Scaled\",D48>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D48=\"No\"),AND($L$1=\"Scaled\",D48<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,0,0,1,1,0,0,null,null,null,2]
[914,"G.4.1.2","Daily?","Yes","Cloudamize Security Policy - Cloudamize Personnel Acceptable Use Policy","G.1 Network Security – IDS/IPS Signature Updates","NA","",3,null,4,1,2,0,0,0,{"$f":"IF(I49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D49=\"Yes\"),AND($L$1=\"Scaled\",D49>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D49=\"No\"),AND($L$1=\"Scaled\",D49<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,0,0,1,1,0,0,null,null,null,2]
[915,"G.4.1.3","Weekly?","Yes","Cloudamize Security Policy - Cloudamize Personnel Acceptable Use Policy","G.1 Network Security – IDS/IPS Signature Updates","NA","",3,null,4,1,3,0,0,0,{"$f":"IF(I50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D50=\"Yes\"),AND($L$1=\"Scaled\",D50>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D50=\"No\"),AND($L$1=\"Scaled\",D50<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,0,0,1,1,0,0,null,null,null,2]
[916,"G.4.1.4","Monthly?","Yes","Cloudamize Security Policy - Cloudamize Personnel Acceptable Use Policy","G.1 Network Security – IDS/IPS Signature Updates","NA","",3,null,4,1,4,0,0,0,{"$f":"IF(I51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D51=\"Yes\"),AND($L$1=\"Scaled\",D51>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D51=\"No\"),AND($L$1=\"Scaled\",D51<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,0,0,1,1,0,0,null,null,null,2]
[922,"G.5","Are system backups of Scoped Systems and Data performed?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","G.20 Backup Media Restoration","12.3.1","Information Back-Up",1,null,5,0,0,0,0,1,{"$f":"IF(I52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D52=\"Yes\"),AND($L$1=\"Scaled\",D52>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D52=\"No\"),AND($L$1=\"Scaled\",D52<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[923,"G.5.1","Is there a policy or process for the backup of production data? If yes, does it include a requirement to:","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","G.20 Backup Media Restoration","12.3.1","Information Back-Up",2,null,5,1,0,0,0,0,{"$f":"IF(I53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D53=\"Yes\"),AND($L$1=\"Scaled\",D53>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D53=\"No\"),AND($L$1=\"Scaled\",D53<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2601,"G.5.1.1","Store backups to avoid any damage from a disaster at the main site?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","G.20 Backup Media Restoration","12.3.1.c","Information Back-Up",3,null,5,1,1,0,0,0,{"$f":"IF(I54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D54=\"Yes\"),AND($L$1=\"Scaled\",D54>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D54=\"No\"),AND($L$1=\"Scaled\",D54<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2602,"G.5.1.2","Test backup media and restoration procedures at least annually?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","G.20 Backup Media Restoration","12.3.1.e","Information Back-Up",3,null,5,1,2,0,0,0,{"$f":"IF(I55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D55=\"Yes\"),AND($L$1=\"Scaled\",D55>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D55=\"No\"),AND($L$1=\"Scaled\",D55<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[951,"G.5.2","Is backup media stored offsite? If yes, is there:","No",null,"G.20 Backup Media Restoration","12.3.1.c","Information Back-Up",2,null,5,2,0,0,0,0,{"$f":"IF(I56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D56=\"Yes\"),AND($L$1=\"Scaled\",D56>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D56=\"No\"),AND($L$1=\"Scaled\",D56<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[953,"G.5.2.1","Secure transport?",null,null,"G.20 Backup Media Restoration","8.3.3","Physical media transfer",3,null,5,2,1,0,0,0,{"$f":"IF(I57=\"\",\"\",IF(D57=\"\",0,IF(D57=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D57=\"Yes\"),AND($L$1=\"Scaled\",D57>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D57=\"No\"),AND($L$1=\"Scaled\",D57<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[954,"G.5.2.2","Tracking shipments?",null,null,"G.20 Backup Media Restoration","8.3.3.e","Exchange Agreements",3,null,5,2,2,0,0,0,{"$f":"IF(I58=\"\",\"\",IF(D58=\"\",0,IF(D58=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D58=\"Yes\"),AND($L$1=\"Scaled\",D58>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D58=\"No\"),AND($L$1=\"Scaled\",D58<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[955,"G.5.2.3","Verification of receipt?",null,null,"G.20 Backup Media Restoration","8.3.3.e","Exchange Agreements",3,null,5,2,3,0,0,0,{"$f":"IF(I59=\"\",\"\",IF(D59=\"\",0,IF(D59=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D59=\"Yes\"),AND($L$1=\"Scaled\",D59>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D59=\"No\"),AND($L$1=\"Scaled\",D59<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[3688,"G.6","Are firewalls in use for both internal and external connections?","Yes","Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan","G.2 Network Security – Firewall(s)","13.1.3","Segregation in networks",1,null,6,0,0,0,0,1,{"$f":"IF(I60=\"\",\"\",IF(D60=\"\",0,IF(D60=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D60=\"Yes\"),AND($L$1=\"Scaled\",D60>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D60=\"No\"),AND($L$1=\"Scaled\",D60<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[976,"G.6.1","Is every connection to an external network terminated at a firewall?","No",null,"G.2 Network Security – Firewall(s)","13.1.3","Segregation In Networks",2,null,6,1,0,0,0,0,{"$f":"IF(I61=\"\",\"\",IF(D61=\"\",0,IF(D61=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D61=\"Yes\"),AND($L$1=\"Scaled\",D61>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D61=\"No\"),AND($L$1=\"Scaled\",D61<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[3689,"G.6.2","Are firewalls used to segment internal networks?","No",null,"G.2 Network Security – Firewall(s)","13.1.3","Segregation In Networks",2,null,6,2,0,0,0,0,{"$f":"IF(I62=\"\",\"\",IF(D62=\"\",0,IF(D62=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D62=\"Yes\"),AND($L$1=\"Scaled\",D62>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D62=\"No\"),AND($L$1=\"Scaled\",D62<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[3693,"G.6.3","Do the firewalls have any rules that permit 'any' network, sub network, host, protocol or port on any of the firewalls (internal or external)?","No",null,"G.2 Network Security – Firewall(s)","9.1.1.f","Access control policy",2,null,6,3,0,0,0,0,{"$f":"IF(I63=\"\",\"\",IF(D63=\"\",0,IF(D63=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D63=\"Yes\"),AND($L$1=\"Scaled\",D63>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D63=\"No\"),AND($L$1=\"Scaled\",D63<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[3705,"G.6.4","Are all firewall rules reviewed and updated at least quarterly to identify and remove any networks, sub networks, hosts, protocols or ports no longer in use?","Yes","Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan","G.2 Network Security – Firewall(s)","18.2.2","Compliance with security policies and standards",2,null,6,4,0,0,0,0,{"$f":"IF(I64=\"\",\"\",IF(D64=\"\",0,IF(D64=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D64=\"Yes\"),AND($L$1=\"Scaled\",D64>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D64=\"No\"),AND($L$1=\"Scaled\",D64<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3706,"G.7","Are vulnerability assessments, scans or penetration tests on internal or external networks performed at least annually? If yes, are they:","Yes","Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan","L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1","Control of technical vulnerabilities",1,null,7,0,0,0,0,1,{"$f":"IF(I65=\"\",\"\",IF(D65=\"\",0,IF(D65=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D65=\"Yes\"),AND($L$1=\"Scaled\",D65>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D65=\"No\"),AND($L$1=\"Scaled\",D65<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[3710,"G.7.1","Performed by trained and experienced personnel?","Yes","Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan","L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","18.2.3","Technical compliance review",2,null,7,1,0,0,0,0,{"$f":"IF(I66=\"\",\"\",IF(D66=\"\",0,IF(D66=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D66=\"Yes\"),AND($L$1=\"Scaled\",D66>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D66=\"No\"),AND($L$1=\"Scaled\",D66<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3912,"G.7.2","For Internal Networks:",null,null,null,null,null,2,1,7,2,0,0,0,0,{"$f":"IF(I67=\"\",\"\",IF(D67=\"\",0,IF(D67=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D67=\"Yes\"),AND($L$1=\"Scaled\",D67>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D67=\"No\"),AND($L$1=\"Scaled\",D67<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,1,1,0,null,null,null,2]
[3711,"G.7.2.1","Are vulnerability assessments or scans performed? If yes, are issues:","Yes","Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan","L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1","Control of technical vulnerabilities",3,null,7,2,1,0,0,0,{"$f":"IF(I68=\"\",\"\",IF(D68=\"\",0,IF(D68=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D68=\"Yes\"),AND($L$1=\"Scaled\",D68>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D68=\"No\"),AND($L$1=\"Scaled\",D68<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,0,0,1,1,0,0,null,null,null,2]
[3913,"G.7.2.1.1","Risk ranked for importance to the system and the vulnerability identified?","Yes","Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan","L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1.d","Control of technical vulnerabilities",4,null,7,2,1,1,0,{"$f":"IF(OR(Master=\"Master\",I69=0,J69=1),0,IF(ISNA(VLOOKUP(A69,L2_Array,21,FALSE)),0,VLOOKUP(A69,L2_Array,21,FALSE)))","v":0},{"$f":"IF(I69=\"\",\"\",IF(D69=\"\",0,IF(D69=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D69=\"Yes\"),AND($L$1=\"Scaled\",D69>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D69=\"No\"),AND($L$1=\"Scaled\",D69<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,{"$f":"IF(Master=\"Master\",Q69,IF(U68=\"\",R69,IF(OR(AND(T69>0,R69<U68),AND(T69=1,R69<=U68)),U68,R69)))","v":1},1,1,{"$f":"IF(ISNA(VLOOKUP(A69,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,2]
[3716,{"$f":"IF(I70=0,\"\",IF(I70=1,P$1&\".\"&K70,IF(I70=2,P$1&\".\"&K70&\".\"&L70,IF(I70=3,P$1&\".\"&K70&\".\"&L70&\".\"&M70,IF(I70=4,P$1&\".\"&K70&\".\"&L70&\".\"&M70&\".\"&N70,IF(I70=5,P$1&\".\"&K70&\".\"&L70&\".\"&M70&\".\"&N70&\".\"&O70))))))","v":"G.7.2.1.2"},"Documented and tracked to remediation?","Yes","Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan","L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1.h","Control of technical vulnerabilities",4,null,{"$f":"IF(K69=\"\",1,IF(I70=1,K69+1,K69))","v":7},{"$f":"IF(L69=\"\",0,IF(K69<>K70,0,IF($I70=2,L69+1,L69)))","v":2},{"$f":"IF(M69=\"\",0,IF(L69<>L70,0,IF($I70=3,M69+1,M69)))","v":1},{"$f":"IF(N69=\"\",0,IF(M69<>M70,0,IF($I70=4,N69+1,N69)))","v":2},{"$f":"IF(O69=\"\",0,IF(N69<>N70,0,IF($I70=5,O69+1,O69)))","v":0},0,{"$f":"IF(I70=\"\",\"\",IF(D70=\"\",0,IF(D70=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D70=\"Yes\"),AND($L$1=\"Scaled\",D70>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D70=\"No\"),AND($L$1=\"Scaled\",D70<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I70=\"\",\"\",IF(P70>0,P70,IF(Q70>0,Q70,0)))","v":1},{"$f":"IF(I70=\"\",\"\",IF(OR(I70=1,S69=\"\"),1,IF(OR(AND(J69=1,(I70-I68<>0)),AND(S69=0,I69=I70),AND(J69=1,I70=I68)),0,1)))","v":1},{"$f":"IF(I70=\"\",T69,IF(AND(R70>1,OR(T69=\"\",T69=0,T69>=I70)),I70,IF(I70>T69,T69,0)))","v":0},1,{"$f":"IF(I70=\"\",\"\",IF(OR(AND(S69=1,T70=1),R70>0,AND(S71=0,V71=1)),1,0))","v":1},{"$f":"IF(I70=\"\",\"\",IF(OR(AND(T70>0,S70=1),AND(S70=1,V70=1)),1,0))","v":1},0,null,null,null,{"$f":"IF(AND(I70=1,R70=1),2,IF(AND(U69=1,K70=K69),2,IF(AND(AB69=2,K70=K69),2,IF(I70=1,1,\"\"))))","v":2}]
[3721,"G.7.2.2","Are penetration tests performed? If yes, are issues:","Yes","Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan","L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1","Control of technical vulnerabilities",3,null,7,2,2,0,0,0,{"$f":"IF(I71=\"\",\"\",IF(D71=\"\",0,IF(D71=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D71=\"Yes\"),AND($L$1=\"Scaled\",D71>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D71=\"No\"),AND($L$1=\"Scaled\",D71<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3914,"G.7.2.2.1","Risk ranked for importance to the system and the vulnerability identified?","Yes","Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan","L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1.d","Control of technical vulnerabilities",4,null,7,2,2,1,0,0,{"$f":"IF(I72=\"\",\"\",IF(D72=\"\",0,IF(D72=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D72=\"Yes\"),AND($L$1=\"Scaled\",D72>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D72=\"No\"),AND($L$1=\"Scaled\",D72<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3725,"G.7.2.2.2","Documented and tracked to remediation?","Yes","Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan","L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1.h","Control of technical vulnerabilities",4,null,7,2,2,2,0,0,{"$f":"IF(I73=\"\",\"\",IF(D73=\"\",0,IF(D73=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D73=\"Yes\"),AND($L$1=\"Scaled\",D73>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D73=\"No\"),AND($L$1=\"Scaled\",D73<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3915,"G.7.3","For External Networks:",null,null,null,null,null,2,1,7,3,0,0,0,0,{"$f":"IF(I74=\"\",\"\",IF(D74=\"\",0,IF(D74=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D74=\"Yes\"),AND($L$1=\"Scaled\",D74>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D74=\"No\"),AND($L$1=\"Scaled\",D74<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,1,1,0,null,null,null,2]
[3717,"G.7.3.1","Are vulnerability assessments or scans performed? If yes, are issues:","Yes","Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan","L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1","Control of technical vulnerabilities",3,null,7,3,1,0,0,0,{"$f":"IF(I75=\"\",\"\",IF(D75=\"\",0,IF(D75=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D75=\"Yes\"),AND($L$1=\"Scaled\",D75>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D75=\"No\"),AND($L$1=\"Scaled\",D75<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,0,0,1,1,0,0,null,null,null,2]
[3916,"G.7.3.1.1","Risk ranked for importance to the system and the vulnerability identified?","Yes","Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan","L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1.d","Control of technical vulnerabilities",4,null,7,3,1,1,0,0,{"$f":"IF(I76=\"\",\"\",IF(D76=\"\",0,IF(D76=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D76=\"Yes\"),AND($L$1=\"Scaled\",D76>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D76=\"No\"),AND($L$1=\"Scaled\",D76<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3720,"G.7.3.1.2","Documented and tracked to remediation?","Yes","Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan","L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1.h","Control of technical vulnerabilities",4,null,7,3,1,2,0,0,{"$f":"IF(I77=\"\",\"\",IF(D77=\"\",0,IF(D77=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D77=\"Yes\"),AND($L$1=\"Scaled\",D77>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D77=\"No\"),AND($L$1=\"Scaled\",D77<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3726,"G.7.3.2","Are penetration tests performed on external networks? If yes, are issues:","Yes","Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan","L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1","Control of technical vulnerabilities",3,null,7,3,2,0,0,0,{"$f":"IF(I78=\"\",\"\",IF(D78=\"\",0,IF(D78=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D78=\"Yes\"),AND($L$1=\"Scaled\",D78>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D78=\"No\"),AND($L$1=\"Scaled\",D78<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3917,"G.7.3.2.1","Risk ranked for importance to the system and the vulnerability identified?","Yes","Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan","L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1.d","Control of technical vulnerabilities",4,null,7,3,2,1,0,0,{"$f":"IF(I79=\"\",\"\",IF(D79=\"\",0,IF(D79=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D79=\"Yes\"),AND($L$1=\"Scaled\",D79>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D79=\"No\"),AND($L$1=\"Scaled\",D79<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3728,"G.7.3.2.2","Documented and tracked to remediation?","Yes","Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan","L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1.h","Control of technical vulnerabilities",4,null,7,3,2,2,0,0,{"$f":"IF(I80=\"\",\"\",IF(D80=\"\",0,IF(D80=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D80=\"Yes\"),AND($L$1=\"Scaled\",D80>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D80=\"No\"),AND($L$1=\"Scaled\",D80<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[975,"G.8","Are there external network connections (Internet, extranet, etc.)? If yes, is there:","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy",null,"13.1.1","Network Controls",1,null,8,0,0,0,0,1,{"$f":"IF(I81=\"\",\"\",IF(D81=\"\",0,IF(D81=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D81=\"Yes\"),AND($L$1=\"Scaled\",D81>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D81=\"No\"),AND($L$1=\"Scaled\",D81<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[998,"G.8.1","Security and hardening standards for network devices (baseline configuration, patching, passwords, access control)?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards",null,"13.1.1.c","Network Controls",2,null,8,1,0,0,0,0,{"$f":"IF(I82=\"\",\"\",IF(D82=\"\",0,IF(D82=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D82=\"Yes\"),AND($L$1=\"Scaled\",D82>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D82=\"No\"),AND($L$1=\"Scaled\",D82<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1008,"G.8.1.1","Regular review and/or monitoring of network devices for continued compliance to security requirements?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards",null,"13.1.1.d                                  18.2.3","Network controls,                   Technical compliance review",3,null,8,1,1,0,0,0,{"$f":"IF(I83=\"\",\"\",IF(D83=\"\",0,IF(D83=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D83=\"Yes\"),AND($L$1=\"Scaled\",D83>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D83=\"No\"),AND($L$1=\"Scaled\",D83<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[977,"G.8.2","Are network devices configured to prevent communications from unapproved networks?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards","G.2 Network Security – Firewall(s)","13.1.3","Segregation In Networks",2,null,8,2,0,0,0,0,{"$f":"IF(I84=\"\",\"\",IF(D84=\"\",0,IF(D84=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D84=\"Yes\"),AND($L$1=\"Scaled\",D84>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D84=\"No\"),AND($L$1=\"Scaled\",D84<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[979,"G.8.3","Do network devices deny all access by default?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards",null,"9.1.1","Access Control Policy",2,null,8,3,0,0,0,0,{"$f":"IF(I85=\"\",\"\",IF(D85=\"\",0,IF(D85=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D85=\"Yes\"),AND($L$1=\"Scaled\",D85>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D85=\"No\"),AND($L$1=\"Scaled\",D85<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[980,"G.8.4","A process to request, approve, log, and review access to networks across network devices?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards",null,"9.1.1.h","Policy On Use Of Network Services",2,null,8,4,0,0,0,0,{"$f":"IF(I86=\"\",\"\",IF(D86=\"\",0,IF(D86=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D86=\"Yes\"),AND($L$1=\"Scaled\",D86>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D86=\"No\"),AND($L$1=\"Scaled\",D86<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[981,"G.8.5","Network traffic logged to support forensics? If yes, do logs contain:","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards","G.6 Network Logging","13.1.1.d","Network Controls",2,null,8,5,0,0,0,0,{"$f":"IF(I87=\"\",\"\",IF(D87=\"\",0,IF(D87=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D87=\"Yes\"),AND($L$1=\"Scaled\",D87>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D87=\"No\"),AND($L$1=\"Scaled\",D87<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3865,"G.8.5.1","Failed login attempts?","No",null,"G.6 Network Logging","13.1.1.d","Network Controls",3,null,8,5,1,0,0,0,{"$f":"IF(I88=\"\",\"\",IF(D88=\"\",0,IF(D88=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D88=\"Yes\"),AND($L$1=\"Scaled\",D88>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D88=\"No\"),AND($L$1=\"Scaled\",D88<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,3,2,1,1,0,null,null,null,2]
[3866,"G.8.5.2","Disabling of audit logs?","No",null,"G.6 Network Logging","13.1.1.d","Network Controls",3,null,8,5,2,0,0,0,{"$f":"IF(I89=\"\",\"\",IF(D89=\"\",0,IF(D89=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D89=\"Yes\"),AND($L$1=\"Scaled\",D89>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D89=\"No\"),AND($L$1=\"Scaled\",D89<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,3,2,1,1,0,null,null,null,2]
[3869,"G.8.5.3","Changes?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards","G.6 Network Logging","13.1.1.d","Network Controls",3,null,8,5,3,0,0,0,{"$f":"IF(I90=\"\",\"\",IF(D90=\"\",0,IF(D90=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D90=\"Yes\"),AND($L$1=\"Scaled\",D90>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D90=\"No\"),AND($L$1=\"Scaled\",D90<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3870,"G.8.5.4","Timestamps?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards","G.6 Network Logging","13.1.1.d","Network Controls",3,null,8,5,4,0,0,0,{"$f":"IF(I91=\"\",\"\",IF(D91=\"\",0,IF(D91=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D91=\"Yes\"),AND($L$1=\"Scaled\",D91>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D91=\"No\"),AND($L$1=\"Scaled\",D91<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3871,"G.8.5.5","IP info","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards","G.6 Network Logging","13.1.1.d","Network Controls",3,null,8,5,5,0,0,0,{"$f":"IF(I92=\"\",\"\",IF(D92=\"\",0,IF(D92=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D92=\"Yes\"),AND($L$1=\"Scaled\",D92>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D92=\"No\"),AND($L$1=\"Scaled\",D92<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3294,"G.8.5.6","In the event of a network device audit log failure, does the network device generate an alert and prevent further connections?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy",null,"12.4.1","Event logging",3,null,8,5,6,0,0,0,{"$f":"IF(I93=\"\",\"\",IF(D93=\"\",0,IF(D93=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D93=\"Yes\"),AND($L$1=\"Scaled\",D93>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D93=\"No\"),AND($L$1=\"Scaled\",D93<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1093,"G.8.5.7","Is the overwriting of audit logs disabled?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy",null,"12.4.2.b","Protection Of Log Information",3,null,8,5,7,0,0,0,{"$f":"IF(I94=\"\",\"\",IF(D94=\"\",0,IF(D94=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D94=\"Yes\"),AND($L$1=\"Scaled\",D94>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D94=\"No\"),AND($L$1=\"Scaled\",D94<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[993,"G.8.5.8","Are the logs from network devices aggregated to a central server?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy",null,"12.4.2","Protection Of Log Information",3,null,8,5,8,0,0,0,{"$f":"IF(I95=\"\",\"\",IF(D95=\"\",0,IF(D95=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D95=\"Yes\"),AND($L$1=\"Scaled\",D95>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D95=\"No\"),AND($L$1=\"Scaled\",D95<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[994,"G.8.6","Are security patches reviewed and applied to network devices?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy",null,"12.6.1.g","Management of technical vulnerabilities",2,null,8,6,0,0,0,0,{"$f":"IF(I96=\"\",\"\",IF(D96=\"\",0,IF(D96=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D96=\"Yes\"),AND($L$1=\"Scaled\",D96>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D96=\"No\"),AND($L$1=\"Scaled\",D96<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[995,"G.8.7","Is there an approval process prior to installing a network device?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy",null,"12.1.2.d","Change Management",2,null,8,7,0,0,0,0,{"$f":"IF(I97=\"\",\"\",IF(D97=\"\",0,IF(D97=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D97=\"Yes\"),AND($L$1=\"Scaled\",D97>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D97=\"No\"),AND($L$1=\"Scaled\",D97<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[997,"G.8.8","Is there an approval process for the ports allowed through the network devices?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","G.19 Network Security – Authorized Network Traffic","13.1.2.c","Security Of Network Services",2,null,8,8,0,0,0,0,{"$f":"IF(I98=\"\",\"\",IF(D98=\"\",0,IF(D98=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D98=\"Yes\"),AND($L$1=\"Scaled\",D98>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D98=\"No\"),AND($L$1=\"Scaled\",D98<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1010,"G.8.9","Are critical network segments isolated?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","G.2 Network Security – Firewall(s)","13.1.3","Segregation In Networks",2,null,8,9,0,0,0,0,{"$f":"IF(I99=\"\",\"\",IF(D99=\"\",0,IF(D99=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D99=\"Yes\"),AND($L$1=\"Scaled\",D99>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D99=\"No\"),AND($L$1=\"Scaled\",D99<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1011,"G.8.10","Is there a process to prevent unauthorized devices from physically connecting to the internal network?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy",null,"13.1.2","Security Of Network Services",2,null,8,10,0,0,0,0,{"$f":"IF(I100=\"\",\"\",IF(D100=\"\",0,IF(D100=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D100=\"Yes\"),AND($L$1=\"Scaled\",D100>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D100=\"No\"),AND($L$1=\"Scaled\",D100<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1014,"G.8.11","Are internal systems required to pass through a content filtering proxy prior to accessing the Internet?","No",null,null,"13.1.2","Security Of Network Services",2,null,8,11,0,0,0,0,{"$f":"IF(I101=\"\",\"\",IF(D101=\"\",0,IF(D101=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D101=\"Yes\"),AND($L$1=\"Scaled\",D101>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D101=\"No\"),AND($L$1=\"Scaled\",D101<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[1015,"G.8.12","Is there an approval process to allow extranet connections?","No",null,null,"9.1.2.b","Access to networks and network services",2,null,8,12,0,0,0,0,{"$f":"IF(I102=\"\",\"\",IF(D102=\"\",0,IF(D102=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D102=\"Yes\"),AND($L$1=\"Scaled\",D102>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D102=\"No\"),AND($L$1=\"Scaled\",D102<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[1016,"G.8.13","Are insecure protocols (telnet) used to access network devices?","No","Cloudamize Security Policy - Cloudamize Network Security Policy","G.4 Network Management – Encrypted Authentication Credentials","9.1.2.d","Access to networks and network services",2,null,8,13,0,0,0,0,{"$f":"IF(I103=\"\",\"\",IF(D103=\"\",0,IF(D103=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D103=\"Yes\"),AND($L$1=\"Scaled\",D103>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D103=\"No\"),AND($L$1=\"Scaled\",D103<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[2612,"G.8.14","Is access to diagnostic or maintenance ports on network devices restricted?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","G.5 Externally Facing Open Administrative Ports","9.1.2.a","Access to networks and network services",2,null,8,14,0,0,0,0,{"$f":"IF(I104=\"\",\"\",IF(D104=\"\",0,IF(D104=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D104=\"Yes\"),AND($L$1=\"Scaled\",D104>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D104=\"No\"),AND($L$1=\"Scaled\",D104<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1065,"G.8.15","Is there a separate network segment or endpoints for remote access?","N/A",null,null,"13.1.3","Segregation in networks",2,null,8,15,0,0,0,0,{"$f":"IF(I105=\"\",\"\",IF(D105=\"\",0,IF(D105=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D105=\"Yes\"),AND($L$1=\"Scaled\",D105>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D105=\"No\"),AND($L$1=\"Scaled\",D105<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[2947,"G.8.16","Are firewall rules and network access control lists regularly reviewed?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy",null,"18.2.3","Technical Compliance review",2,null,8,16,0,0,0,0,{"$f":"IF(I106=\"\",\"\",IF(D106=\"\",0,IF(D106=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D106=\"Yes\"),AND($L$1=\"Scaled\",D106>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D106=\"No\"),AND($L$1=\"Scaled\",D106<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2614,"G.8.17","Is there a DMZ environment within the network that transmits, processes or stores Scoped Systems and Data? If yes, is it:","No",null,null,"NA","",2,null,8,17,0,0,0,0,{"$f":"IF(I107=\"\",\"\",IF(D107=\"\",0,IF(D107=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D107=\"Yes\"),AND($L$1=\"Scaled\",D107>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D107=\"No\"),AND($L$1=\"Scaled\",D107<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[1049,"G.8.17.1","Limited to only those servers that require access from the Internet?",null,null,null,"13.1.3","Segregation In Networks",3,null,8,17,1,0,0,0,{"$f":"IF(I108=\"\",\"\",IF(D108=\"\",0,IF(D108=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D108=\"Yes\"),AND($L$1=\"Scaled\",D108>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D108=\"No\"),AND($L$1=\"Scaled\",D108<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[1056,"G.8.17.2","Separated with DMZ segments for devices that initiate outbound traffic to the Internet?",null,null,null,"13.1.3","Segregation In Networks",3,null,8,17,2,0,0,0,{"$f":"IF(I109=\"\",\"\",IF(D109=\"\",0,IF(D109=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D109=\"Yes\"),AND($L$1=\"Scaled\",D109>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D109=\"No\"),AND($L$1=\"Scaled\",D109<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[1068,"G.8.18","Is Intrusion Detection/Prevention System employed in all network zones? If yes, does it include:","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","G.3 Network Security – IDS/IPS Attributes","13.1.2","Security Of Network Services",2,null,8,18,0,0,0,0,{"$f":"IF(I110=\"\",\"\",IF(D110=\"\",0,IF(D110=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D110=\"Yes\"),AND($L$1=\"Scaled\",D110>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D110=\"No\"),AND($L$1=\"Scaled\",D110<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1075,"G.8.18.1","Configuration to generate alerts when incidents and values exceed predetermined thresholds?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy",null,"12.4.1","Event logging",3,null,8,18,1,0,0,0,{"$f":"IF(I111=\"\",\"\",IF(D111=\"\",0,IF(D111=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D111=\"Yes\"),AND($L$1=\"Scaled\",D111>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D111=\"No\"),AND($L$1=\"Scaled\",D111<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1076,"G.8.18.2","Regularly updated signatures based on new threats?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","G.3 Network Security – IDS/IPS Signature Updates","13.6.1","Management of technical vulnerabilities",3,null,8,18,2,0,0,0,{"$f":"IF(I112=\"\",\"\",IF(D112=\"\",0,IF(D112=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D112=\"Yes\"),AND($L$1=\"Scaled\",D112>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D112=\"No\"),AND($L$1=\"Scaled\",D112<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1077,"G.8.18.3","System monitoring 24x7x365?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy",null,"13.1.1.d","Network Controls",3,null,8,18,3,0,0,0,{"$f":"IF(I113=\"\",\"\",IF(D113=\"\",0,IF(D113=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D113=\"Yes\"),AND($L$1=\"Scaled\",D113>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D113=\"No\"),AND($L$1=\"Scaled\",D113<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1080,"G.8.18.4","Event feeds into the Incident Management process?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy",null,"12.2.1.i","Controls against malware",3,null,8,18,4,0,0,0,{"$f":"IF(I114=\"\",\"\",IF(D114=\"\",0,IF(D114=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D114=\"Yes\"),AND($L$1=\"Scaled\",D114>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D114=\"No\"),AND($L$1=\"Scaled\",D114<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1121,"G.8.19","Is approval required prior to connecting any outbound or inbound modem lines, cable modem lines, DSL phone lines or wireless access points to a desktop or other access point directly connected to the company-managed network?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy",null,"9.1.2.b","Access to networks and network services",2,null,8,19,0,0,0,0,{"$f":"IF(I115=\"\",\"\",IF(D115=\"\",0,IF(D115=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D115=\"Yes\"),AND($L$1=\"Scaled\",D115>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D115=\"No\"),AND($L$1=\"Scaled\",D115<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1095,"G.9","Is wireless networking technology used? Is yes, is there:","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Local Office","G.17 Unapproved Wireless Networks","13.1.1.c","Network Controls",1,null,9,0,0,0,0,1,{"$f":"IF(I116=\"\",\"\",IF(D116=\"\",0,IF(D116=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D116=\"Yes\"),AND($L$1=\"Scaled\",D116>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D116=\"No\"),AND($L$1=\"Scaled\",D116<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[1096,"G.9.1","Approved and fully implemented wireless networking policy?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Local Office","G.17 Unapproved Wireless Networks","13.1.1.a","Network Controls",2,null,9,1,0,0,0,0,{"$f":"IF(I117=\"\",\"\",IF(D117=\"\",0,IF(D117=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D117=\"Yes\"),AND($L$1=\"Scaled\",D117>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D117=\"No\"),AND($L$1=\"Scaled\",D117<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1107,"G.9.2","Two active network connections allowed at the same time (split-tunneling)?","No",null,"G.17 Unapproved Wireless Networks","NA","",2,null,9,2,0,0,0,0,{"$f":"IF(I118=\"\",\"\",IF(D118=\"\",0,IF(D118=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D118=\"Yes\"),AND($L$1=\"Scaled\",D118>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D118=\"No\"),AND($L$1=\"Scaled\",D118<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[1108,"G.9.3","Wireless connections authenticated using multi-factor authentication?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Local Office","G.17 Unapproved Wireless Networks","13.1.3","Segregation In Networks",2,null,9,3,0,0,0,0,{"$f":"IF(I119=\"\",\"\",IF(D119=\"\",0,IF(D119=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D119=\"Yes\"),AND($L$1=\"Scaled\",D119>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D119=\"No\"),AND($L$1=\"Scaled\",D119<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1111,"G.9.4","Encrypted using strong encryption (WPA2 or higher)?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Local Office","G.18 Wireless Networks Encryption ","13.1.3","Segregation In Networks",2,null,9,4,0,0,0,0,{"$f":"IF(I120=\"\",\"\",IF(D120=\"\",0,IF(D120=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D120=\"Yes\"),AND($L$1=\"Scaled\",D120>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D120=\"No\"),AND($L$1=\"Scaled\",D120<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1117,"G.9.5","Wireless access points SNMP community strings changed?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Local Office",null,"NA",null,2,null,9,5,0,0,0,0,{"$f":"IF(I121=\"\",\"\",IF(D121=\"\",0,IF(D121=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D121=\"Yes\"),AND($L$1=\"Scaled\",D121>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D121=\"No\"),AND($L$1=\"Scaled\",D121<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1118,"G.9.6","Quarterly scans for rogue wireless access points?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Local Office",null,"NA","",2,null,9,6,0,0,0,0,{"$f":"IF(I122=\"\",\"\",IF(D122=\"\",0,IF(D122=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D122=\"Yes\"),AND($L$1=\"Scaled\",D122>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D122=\"No\"),AND($L$1=\"Scaled\",D122<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3295,"G.10","Is there a removable media policy or program (CDs, DVDs, tapes, disk drives) that has been approved by management, communicated to appropriate constituents, and an owner to maintain and review the policy? If yes, is:","Yes","Cloudamize Security Policy - Cloudamize Removable Media Policy","G.15 Physical Media Tracking","8.3.1","Management Of Removable Media",1,null,10,0,0,0,0,1,{"$f":"IF(I123=\"\",\"\",IF(D123=\"\",0,IF(D123=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D123=\"Yes\"),AND($L$1=\"Scaled\",D123>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D123=\"No\"),AND($L$1=\"Scaled\",D123<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[1872,"G.10.1","Data encrypted while stored?","Yes","Cloudamize Security Policy - Cloudamize Removable Media Policy","G. 22 Data Security Policy - Encryption","10.1.1.c","Policy On The Use Of Cryptographic Controls",2,null,10,1,0,0,0,0,{"$f":"IF(I124=\"\",\"\",IF(D124=\"\",0,IF(D124=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D124=\"Yes\"),AND($L$1=\"Scaled\",D124>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D124=\"No\"),AND($L$1=\"Scaled\",D124<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1137,"G.10.2","Sensitive data encrypted?","Yes","Cloudamize Security Policy - Cloudamize Removable Media Policy","G. 22 Data Security Policy - Encryption","8.3.1.d                                    10.1.1.Section2a ","Management of removable media,                                         Policy On The Use Of Cryptographic Controls",2,null,10,2,0,0,0,0,{"$f":"IF(I125=\"\",\"\",IF(D125=\"\",0,IF(D125=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D125=\"Yes\"),AND($L$1=\"Scaled\",D125>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D125=\"No\"),AND($L$1=\"Scaled\",D125<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1138,"G.10.3","Is all media containing Scoped Systems and Data disposed of securely to prevent recovery? If yes, is it:","Yes","Cloudamize Security Policy - Cloudamize Removable Media Policy","D.2 Asset Destruction","8.3.2","Disposal Of Media",2,null,10,3,0,0,0,0,{"$f":"IF(I126=\"\",\"\",IF(D126=\"\",0,IF(D126=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D126=\"Yes\"),AND($L$1=\"Scaled\",D126>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D126=\"No\"),AND($L$1=\"Scaled\",D126<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1153,"G.10.3.1","Logged to maintain an audit trail?","Yes","Cloudamize Security Policy - Cloudamize Removable Media Policy","D.2 Asset Destruction","8.3.2.e","Disposal Of Media",3,null,10,3,1,0,0,0,{"$f":"IF(I127=\"\",\"\",IF(D127=\"\",0,IF(D127=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D127=\"Yes\"),AND($L$1=\"Scaled\",D127>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D127=\"No\"),AND($L$1=\"Scaled\",D127<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2624,"G.10.3.2","Made unrecoverable (wiped or overwritten) prior to asset reuse?","Yes","Cloudamize Security Policy - Cloudamize Removable Media Policy",null,"8.3.1.a                                     11.2.7 ","Disposal of media,                   Secure disposal or re-use of equipment",3,null,10,3,2,0,0,0,{"$f":"IF(I128=\"\",\"\",IF(D128=\"\",0,IF(D128=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D128=\"Yes\"),AND($L$1=\"Scaled\",D128>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D128=\"No\"),AND($L$1=\"Scaled\",D128<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2950,"G.10.3.3","Inventoried at least quarterly?","Yes","Cloudamize Security Policy - Cloudamize Removable Media Policy","D.1 Asset Accounting and Inventory","8.1.1 Inventory of assets",null,3,null,10,3,3,0,0,0,{"$f":"IF(I129=\"\",\"\",IF(D129=\"\",0,IF(D129=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D129=\"Yes\"),AND($L$1=\"Scaled\",D129>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D129=\"No\"),AND($L$1=\"Scaled\",D129<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1208,"G.11","Is Scoped Data sent or received electronically or via physical media? If yes, is there:","Yes","Cloudamize Security Policy","G.4 Network Management – Encrypted Authentication Credentials","8.3.3","Physical media in transit",1,null,11,0,0,0,0,1,{"$f":"IF(I130=\"\",\"\",IF(D130=\"\",0,IF(D130=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D130=\"Yes\"),AND($L$1=\"Scaled\",D130>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D130=\"No\"),AND($L$1=\"Scaled\",D130<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[1871,"G.11.1","Encryption in transit while outside the network?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","G.4 Network Management – Encrypted Authentication Credentials","13.2.1.f","Information transfer policies and procedures",2,null,11,1,0,0,0,0,{"$f":"IF(I131=\"\",\"\",IF(D131=\"\",0,IF(D131=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D131=\"Yes\"),AND($L$1=\"Scaled\",D131>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D131=\"No\"),AND($L$1=\"Scaled\",D131<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1193,"G.11.2","Encryption in transit within the network?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","G.4 Network Management – Encrypted Authentication Credentials","13.2.1.f","Information transfer policies and procedures",2,null,11,2,0,0,0,0,{"$f":"IF(I132=\"\",\"\",IF(D132=\"\",0,IF(D132=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D132=\"Yes\"),AND($L$1=\"Scaled\",D132>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D132=\"No\"),AND($L$1=\"Scaled\",D132<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2629,"G.11.3","Protection against malicious code?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy",null,"13.2.1.b","Information transfer policies and procedures",2,null,11,3,0,0,0,{"$f":"IF(OR(Master=\"Master\",I133=0,J133=1),0,IF(ISNA(VLOOKUP(A133,L2_Array,21,FALSE)),0,VLOOKUP(A133,L2_Array,21,FALSE)))","v":0},{"$f":"IF(I133=\"\",\"\",IF(D133=\"\",0,IF(D133=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D133=\"Yes\"),AND($L$1=\"Scaled\",D133>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D133=\"No\"),AND($L$1=\"Scaled\",D133<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,{"$f":"IF(Master=\"Master\",Q133,IF(U132=\"\",R133,IF(OR(AND(T133>0,R133<U132),AND(T133=1,R133<=U132)),U132,R133)))","v":1},1,1,{"$f":"IF(ISNA(VLOOKUP(A133,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,2]
[1177,{"$f":"IF(I134=0,\"\",IF(I134=1,P$1&\".\"&K134,IF(I134=2,P$1&\".\"&K134&\".\"&L134,IF(I134=3,P$1&\".\"&K134&\".\"&L134&\".\"&M134,IF(I134=4,P$1&\".\"&K134&\".\"&L134&\".\"&M134&\".\"&N134,IF(I134=5,P$1&\".\"&K134&\".\"&L134&\".\"&M134&\".\"&N134&\".\"&O134))))))","v":"G.11.4"},"Confidentiality / integrity of data following any transmissions?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","G.16 Security of Media in Transit","13.2.4","Confidentiality or non-disclosure agreements",2,null,{"$f":"IF(K133=\"\",1,IF(I134=1,K133+1,K133))","v":11},{"$f":"IF(L133=\"\",0,IF(K133<>K134,0,IF($I134=2,L133+1,L133)))","v":4},{"$f":"IF(M133=\"\",0,IF(L133<>L134,0,IF($I134=3,M133+1,M133)))","v":0},{"$f":"IF(N133=\"\",0,IF(M133<>M134,0,IF($I134=4,N133+1,N133)))","v":0},{"$f":"IF(O133=\"\",0,IF(N133<>N134,0,IF($I134=5,O133+1,O133)))","v":0},0,{"$f":"IF(I134=\"\",\"\",IF(D134=\"\",0,IF(D134=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D134=\"Yes\"),AND($L$1=\"Scaled\",D134>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D134=\"No\"),AND($L$1=\"Scaled\",D134<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I134=\"\",\"\",IF(P134>0,P134,IF(Q134>0,Q134,0)))","v":1},{"$f":"IF(I134=\"\",\"\",IF(OR(I134=1,S133=\"\"),1,IF(OR(AND(J133=1,(I134-I132<>0)),AND(S133=0,I133=I134),AND(J133=1,I134=I132)),0,1)))","v":1},{"$f":"IF(I134=\"\",T133,IF(AND(R134>1,OR(T133=\"\",T133=0,T133>=I134)),I134,IF(I134>T133,T133,0)))","v":0},1,{"$f":"IF(I134=\"\",\"\",IF(OR(AND(S133=1,T134=1),R134>0,AND(S135=0,V135=1)),1,0))","v":1},{"$f":"IF(I134=\"\",\"\",IF(OR(AND(T134>0,S134=1),AND(S134=1,V134=1)),1,0))","v":1},0,null,null,null,{"$f":"IF(AND(I134=1,R134=1),2,IF(AND(U133=1,K134=K133),2,IF(AND(AB133=2,K134=K133),2,IF(I134=1,1,\"\"))))","v":2}]
[1186,"G.11.5","Review and approval process for transmissions?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","G.16 Security of Media in Transit","13.2.1","Information transfer policies and procedures",2,null,11,5,0,0,0,0,{"$f":"IF(I135=\"\",\"\",IF(D135=\"\",0,IF(D135=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D135=\"Yes\"),AND($L$1=\"Scaled\",D135>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D135=\"No\"),AND($L$1=\"Scaled\",D135<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2634,"G.11.6","Transport containers to protect against physical damage?","N/A",null,"G.16 Security of Media in Transit","8.3.3.d","Physical media in transit",2,null,11,6,0,0,0,0,{"$f":"IF(I136=\"\",\"\",IF(D136=\"\",0,IF(D136=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D136=\"Yes\"),AND($L$1=\"Scaled\",D136>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D136=\"No\"),AND($L$1=\"Scaled\",D136<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[2635,"G.11.7","Locked or tamper evident transport containers?","N/A",null,"G.16 Security of Media in Transit","8.3.3.d","Physical media in transit",2,null,11,7,0,0,0,0,{"$f":"IF(I137=\"\",\"\",IF(D137=\"\",0,IF(D137=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D137=\"Yes\"),AND($L$1=\"Scaled\",D137>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D137=\"No\"),AND($L$1=\"Scaled\",D137<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[1209,"G.11.8","Physical media tracking?","N/A",null,"G.15 Physical Media Tracking","8.3.3.e","Physical media in transit",2,null,11,8,0,0,0,0,{"$f":"IF(I138=\"\",\"\",IF(D138=\"\",0,IF(D138=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D138=\"Yes\"),AND($L$1=\"Scaled\",D138>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D138=\"No\"),AND($L$1=\"Scaled\",D138<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,2,3,1,1,0,null,null,null,2]
[1243,"G.11.9","Protection when transmitted through email?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","G. 22 Data Security Policy - Encryption","13.2.3","Electronic messaging",2,null,11,9,0,0,0,0,{"$f":"IF(I139=\"\",\"\",IF(D139=\"\",0,IF(D139=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D139=\"Yes\"),AND($L$1=\"Scaled\",D139>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D139=\"No\"),AND($L$1=\"Scaled\",D139<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1245,"G.11.10","Encryption when sent through email?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","G. 22 Data Security Policy - Encryption","13.2.1.f","Information transfer policies and procedures",2,null,11,10,0,0,0,0,{"$f":"IF(I140=\"\",\"\",IF(D140=\"\",0,IF(D140=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D140=\"Yes\"),AND($L$1=\"Scaled\",D140>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D140=\"No\"),AND($L$1=\"Scaled\",D140<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1247,"G.11.11","Content filtering scans performed on incoming/outgoing email to enforce email policy?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","G. 22 Data Security Policy - Encryption","12.2.1.d","Controls against malware",2,null,11,11,0,0,0,0,{"$f":"IF(I141=\"\",\"\",IF(D141=\"\",0,IF(D141=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D141=\"Yes\"),AND($L$1=\"Scaled\",D141>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D141=\"No\"),AND($L$1=\"Scaled\",D141<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1272,"G.12","Do systems and network devices utilize a common time synchronization service?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy",null,"12.4.4","Clock Synchronization",1,null,12,0,0,0,0,0,{"$f":"IF(I142=\"\",\"\",IF(D142=\"\",0,IF(D142=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D142=\"Yes\"),AND($L$1=\"Scaled\",D142>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D142=\"No\"),AND($L$1=\"Scaled\",D142<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1281,"G.13","Are UNIX or Linux operating systems used for transmitting, processing or storing Scoped Data? If yes, is there:","No",null,null,"NA","",1,null,13,0,0,0,0,0,{"$f":"IF(I143=\"\",\"\",IF(D143=\"\",0,IF(D143=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D143=\"Yes\"),AND($L$1=\"Scaled\",D143>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D143=\"No\"),AND($L$1=\"Scaled\",D143<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,1,2,1,1,0,null,null,null,1]
[1282,"G.13.1"," UNIX hardening standards?",null,null,"I.3 Secure System Hardening Standards","13.1.1.e","Network Controls",2,null,13,1,0,0,0,0,{"$f":"IF(I144=\"\",\"\",IF(D144=\"\",0,IF(D144=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D144=\"Yes\"),AND($L$1=\"Scaled\",D144>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D144=\"No\"),AND($L$1=\"Scaled\",D144<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1304,"G.13.1.1","Periodic monitoring for continued compliance to build standards and security requirements?",null,null,null,"18.2.3","Technical compliance review",3,null,13,1,1,0,0,0,{"$f":"IF(I145=\"\",\"\",IF(D145=\"\",0,IF(D145=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D145=\"Yes\"),AND($L$1=\"Scaled\",D145>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D145=\"No\"),AND($L$1=\"Scaled\",D145<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1292,"G.13.2","Are users required to ‘su’ or ‘sudo’ into root?",null,null,null,"9.2.1","User registration and de-registration",2,null,13,2,0,0,0,0,{"$f":"IF(I146=\"\",\"\",IF(D146=\"\",0,IF(D146=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D146=\"Yes\"),AND($L$1=\"Scaled\",D146>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D146=\"No\"),AND($L$1=\"Scaled\",D146<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1294,"G.13.3","Does remote SU/root access require multi-factor authentication?",null,null,null,"9.1.2","Access to networks and network services",2,null,13,3,0,0,0,0,{"$f":"IF(I147=\"\",\"\",IF(D147=\"\",0,IF(D147=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D147=\"Yes\"),AND($L$1=\"Scaled\",D147>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D147=\"No\"),AND($L$1=\"Scaled\",D147<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1301,"G.13.4","Are remote access tools that do not require authentication (e.g., rhost, shost) allowed?",null,null,null,"9.1.2","Access to networks and network services",2,null,13,4,0,0,0,0,{"$f":"IF(I148=\"\",\"\",IF(D148=\"\",0,IF(D148=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D148=\"Yes\"),AND($L$1=\"Scaled\",D148>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D148=\"No\"),AND($L$1=\"Scaled\",D148<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1302,"G.13.5","Is access to modify startup and shutdown scripts restricted to root-level users?",null,null,null,"9.4.4.d","Use of privileged utility programs",2,null,13,5,0,0,0,0,{"$f":"IF(I149=\"\",\"\",IF(D149=\"\",0,IF(D149=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D149=\"Yes\"),AND($L$1=\"Scaled\",D149>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D149=\"No\"),AND($L$1=\"Scaled\",D149<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1303,"G.13.6","Are all unnecessary/unused services turned off?",null,null,null,"9.4.4.h","Use of privileged utility programs",2,null,13,6,0,0,0,0,{"$f":"IF(I150=\"\",\"\",IF(D150=\"\",0,IF(D150=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D150=\"Yes\"),AND($L$1=\"Scaled\",D150>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D150=\"No\"),AND($L$1=\"Scaled\",D150<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1314,"G.13.7","Are logs regularly reviewed using a specific methodology to uncover potential incidents?",null,null,null,"9.4.4.f","Use of privileged utility programs",2,null,13,7,0,0,0,0,{"$f":"IF(I151=\"\",\"\",IF(D151=\"\",0,IF(D151=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D151=\"Yes\"),AND($L$1=\"Scaled\",D151>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D151=\"No\"),AND($L$1=\"Scaled\",D151<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1316,"G.13.8","Do operating system event logs contain sufficient detail to support incident investigation including failed login attempts?",null,null,"G.9 Administrative Activity Logging, G.10 Log-on Activity Logging","12.4.1","Event logging",2,null,13,8,0,0,0,0,{"$f":"IF(I152=\"\",\"\",IF(D152=\"\",0,IF(D152=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D152=\"Yes\"),AND($L$1=\"Scaled\",D152>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D152=\"No\"),AND($L$1=\"Scaled\",D152<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1307,"G.13.9","Are operating system logs retained for a minimum of one year?",null,null,"G.11 Log Retention ","12.4.2 ","Protection Of Log Information",2,null,13,9,0,0,0,0,{"$f":"IF(I153=\"\",\"\",IF(D153=\"\",0,IF(D153=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D153=\"Yes\"),AND($L$1=\"Scaled\",D153>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D153=\"No\"),AND($L$1=\"Scaled\",D153<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1329,"G.13.10","In the event of an operating system audit log failure, does the system generate an alert?",null,null,"G.11 Log Retention ","12.4.2 ","Protection Of Log Information",2,null,13,10,0,0,0,0,{"$f":"IF(I154=\"\",\"\",IF(D154=\"\",0,IF(D154=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D154=\"Yes\"),AND($L$1=\"Scaled\",D154>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D154=\"No\"),AND($L$1=\"Scaled\",D154<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1333,"G.13.11","Are audit logs stored on alternate systems?",null,null,"G.11 Log Retention ","12.4.2 ","Protection Of Log Information",2,null,13,11,0,0,0,0,{"$f":"IF(I155=\"\",\"\",IF(D155=\"\",0,IF(D155=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D155=\"Yes\"),AND($L$1=\"Scaled\",D155>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D155=\"No\"),AND($L$1=\"Scaled\",D155<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1334,"G.13.12","Are audit logs protected against modification, deletion, and/or inappropriate access?",null,null,"G.11 Log Retention ","12.4.2 ","Protection Of Log Information",2,null,13,12,0,0,0,0,{"$f":"IF(I156=\"\",\"\",IF(D156=\"\",0,IF(D156=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D156=\"Yes\"),AND($L$1=\"Scaled\",D156>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D156=\"No\"),AND($L$1=\"Scaled\",D156<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1342,"G.13.13","Minimum password length at least eight characters?",null,null,"H.1 Password Controls","9.3.1.d","Use of secret authentication information",2,null,13,13,0,0,0,0,{"$f":"IF(I157=\"\",\"\",IF(D157=\"\",0,IF(D157=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D157=\"Yes\"),AND($L$1=\"Scaled\",D157>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D157=\"No\"),AND($L$1=\"Scaled\",D157<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1348,"G.13.14","Complex passwords required?",null,null,"H.1 Password Controls","9.3.1.d                                     9.4.3.c","Use of secret authentication information,                 Password management system",2,null,13,14,0,0,0,0,{"$f":"IF(I158=\"\",\"\",IF(D158=\"\",0,IF(D158=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D158=\"Yes\"),AND($L$1=\"Scaled\",D158>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D158=\"No\"),AND($L$1=\"Scaled\",D158<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1353,"G.13.15","Minimum password expiration at least 90 days?",null,null,"H.1 Password Controls","9.4.3.e","Password Management System",2,null,13,15,0,0,0,0,{"$f":"IF(I159=\"\",\"\",IF(D159=\"\",0,IF(D159=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D159=\"Yes\"),AND($L$1=\"Scaled\",D159>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D159=\"No\"),AND($L$1=\"Scaled\",D159<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1358,"G.13.16","Password history at least 12 before reuse?",null,null,"H.1 Password Controls","9.4.3.f","Password Management System",2,null,13,16,0,0,0,0,{"$f":"IF(I160=\"\",\"\",IF(D160=\"\",0,IF(D160=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D160=\"Yes\"),AND($L$1=\"Scaled\",D160>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D160=\"No\"),AND($L$1=\"Scaled\",D160<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2636,"G.13.17","Initial password required to be changed at first logon?",null,null,"H.1 Password Controls","9.4.3.d","Password Management System",2,null,13,17,0,0,0,0,{"$f":"IF(I161=\"\",\"\",IF(D161=\"\",0,IF(D161=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D161=\"Yes\"),AND($L$1=\"Scaled\",D161>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D161=\"No\"),AND($L$1=\"Scaled\",D161<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1378,"G.13.18","Passwords encrypted in transit?",null,null,"H.1 Password Controls","9.4.3.i","Password Management System",2,null,13,18,0,0,0,0,{"$f":"IF(I162=\"\",\"\",IF(D162=\"\",0,IF(D162=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D162=\"Yes\"),AND($L$1=\"Scaled\",D162>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D162=\"No\"),AND($L$1=\"Scaled\",D162<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1379,"G.13.19","Passwords encrypted or hashed in storage?",null,null,"H.1 Password Controls","9.4.3.i","Password Management System",2,null,13,19,0,0,0,0,{"$f":"IF(I163=\"\",\"\",IF(D163=\"\",0,IF(D163=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D163=\"Yes\"),AND($L$1=\"Scaled\",D163>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D163=\"No\"),AND($L$1=\"Scaled\",D163<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1380,"G.13.20","Passwords displayed when entered into a system?",null,null,"H.1 Password Controls","9.4.3.g","Password Management System",2,null,13,20,0,0,0,0,{"$f":"IF(I164=\"\",\"\",IF(D164=\"\",0,IF(D164=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D164=\"Yes\"),AND($L$1=\"Scaled\",D164>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D164=\"No\"),AND($L$1=\"Scaled\",D164<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1287,"G.13.21","User accounts associated to a unique individual?",null,null,"H.1 Password Controls","9.4.3.a","Password Management System",2,null,13,21,0,0,0,0,{"$f":"IF(I165=\"\",\"\",IF(D165=\"\",0,IF(D165=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D165=\"Yes\"),AND($L$1=\"Scaled\",D165>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D165=\"No\"),AND($L$1=\"Scaled\",D165<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1362,"G.13.22","Does the system lock an account when three to five invalid login attempts are made?",null,null,"H.1 Password Controls","9.4.2","Secure Log-On Procedures",2,null,13,22,0,0,0,0,{"$f":"IF(I166=\"\",\"\",IF(D166=\"\",0,IF(D166=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D166=\"Yes\"),AND($L$1=\"Scaled\",D166>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D166=\"No\"),AND($L$1=\"Scaled\",D166<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1382,"G.14","Are Windows systems used to transmit, process or store Scoped Data? If yes, are there:","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy",null,"NA","",1,null,14,0,0,0,0,0,{"$f":"IF(I167=\"\",\"\",IF(D167=\"\",0,IF(D167=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D167=\"Yes\"),AND($L$1=\"Scaled\",D167>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D167=\"No\"),AND($L$1=\"Scaled\",D167<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1383,"G.14.1","Windows hardening standards?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards","I.3 Secure System Hardening Standards","13.1.1.e","Network Controls",2,null,14,1,0,0,0,0,{"$f":"IF(I168=\"\",\"\",IF(D168=\"\",0,IF(D168=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D168=\"Yes\"),AND($L$1=\"Scaled\",D168>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D168=\"No\"),AND($L$1=\"Scaled\",D168<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1441,"G.14.1.1","Standard builds/security compliance checks?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy.",null,"18.2.3","Technical Compliance review",3,null,14,1,1,0,0,0,{"$f":"IF(I169=\"\",\"\",IF(D169=\"\",0,IF(D169=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D169=\"Yes\"),AND($L$1=\"Scaled\",D169>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D169=\"No\"),AND($L$1=\"Scaled\",D169<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1439,"G.14.2","Current patches?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","I.4 System Patching","12.6.1.d","Control of technical vulnerabilities",2,null,14,2,0,0,0,0,{"$f":"IF(I170=\"\",\"\",IF(D170=\"\",0,IF(D170=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D170=\"Yes\"),AND($L$1=\"Scaled\",D170>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D170=\"No\"),AND($L$1=\"Scaled\",D170<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1395,"G.14.3","Unnecessary/unused services turned off?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards",null,"9.4.4.h","Use of privileged utility programs",2,null,14,3,0,0,0,0,{"$f":"IF(I171=\"\",\"\",IF(D171=\"\",0,IF(D171=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D171=\"Yes\"),AND($L$1=\"Scaled\",D171>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D171=\"No\"),AND($L$1=\"Scaled\",D171<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1451,"G.14.4","Regular log reviews using a specific methodology to uncover potential incidents?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy / Cloudamize Security Working Group",null,"9.4.4.f","Use of privileged utility programs",2,null,14,4,0,0,0,0,{"$f":"IF(I172=\"\",\"\",IF(D172=\"\",0,IF(D172=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D172=\"Yes\"),AND($L$1=\"Scaled\",D172>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D172=\"No\"),AND($L$1=\"Scaled\",D172<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1453,"G.14.5","Sufficient information in the logs to evaluate incidents?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","G.9 Administrative Activity Logging, G.10 Log-on Activity Logging","12.4.1","Event logging",2,null,14,5,0,0,0,0,{"$f":"IF(I173=\"\",\"\",IF(D173=\"\",0,IF(D173=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D173=\"Yes\"),AND($L$1=\"Scaled\",D173>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D173=\"No\"),AND($L$1=\"Scaled\",D173<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1444,"G.14.6","Logs retained for a minimum of one year?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","G.11 Log Retention ","12.4.2","Protection Of Log Information",2,null,14,6,0,0,0,0,{"$f":"IF(I174=\"\",\"\",IF(D174=\"\",0,IF(D174=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D174=\"Yes\"),AND($L$1=\"Scaled\",D174>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D174=\"No\"),AND($L$1=\"Scaled\",D174<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1464,"G.14.7","System generated alerts in the event of an audit log failure?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","G.11 Log Retention ","12.4.2","Protection Of Log Information",2,null,14,7,0,0,0,0,{"$f":"IF(I175=\"\",\"\",IF(D175=\"\",0,IF(D175=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D175=\"Yes\"),AND($L$1=\"Scaled\",D175>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D175=\"No\"),AND($L$1=\"Scaled\",D175<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1468,"G.14.8","Audit logs stored on alternate systems?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","G.11 Log Retention ","12.4.2","Protection Of Log Information",2,null,14,8,0,0,0,0,{"$f":"IF(I176=\"\",\"\",IF(D176=\"\",0,IF(D176=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D176=\"Yes\"),AND($L$1=\"Scaled\",D176>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D176=\"No\"),AND($L$1=\"Scaled\",D176<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1469,"G.14.9","Audit logs protected against modification, deletion, and/or inappropriate access?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","G.11 Log Retention ","12.4.2","Protection Of Log Information",2,null,14,9,0,0,0,0,{"$f":"IF(I177=\"\",\"\",IF(D177=\"\",0,IF(D177=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D177=\"Yes\"),AND($L$1=\"Scaled\",D177>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D177=\"No\"),AND($L$1=\"Scaled\",D177<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1396,"G.14.10","Minimum password length at least eight characters?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","H.1 Password Controls","9.3.1.d","Use of secret authentication information",2,null,14,10,0,0,0,0,{"$f":"IF(I178=\"\",\"\",IF(D178=\"\",0,IF(D178=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D178=\"Yes\"),AND($L$1=\"Scaled\",D178>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D178=\"No\"),AND($L$1=\"Scaled\",D178<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1402,"G.14.11","Complex passwords required?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","H.1 Password Controls","9.3.1.d                                     9.4.3.c","Use of secret authentication information,                 Password management system",2,null,14,11,0,0,0,0,{"$f":"IF(I179=\"\",\"\",IF(D179=\"\",0,IF(D179=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D179=\"Yes\"),AND($L$1=\"Scaled\",D179>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D179=\"No\"),AND($L$1=\"Scaled\",D179<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1407,"G.14.12","Minimum password expiration at least every 90 days?","No",null,"H.1 Password Controls","9.4.3.e","Password Management System",2,null,14,12,0,0,0,0,{"$f":"IF(I180=\"\",\"\",IF(D180=\"\",0,IF(D180=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D180=\"Yes\"),AND($L$1=\"Scaled\",D180>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D180=\"No\"),AND($L$1=\"Scaled\",D180<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[1412,"G.14.13","Password history of 12 before reuse?","No",null,"H.1 Password Controls","9.4.3.f","Password Management System",2,null,14,13,0,0,0,0,{"$f":"IF(I181=\"\",\"\",IF(D181=\"\",0,IF(D181=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D181=\"Yes\"),AND($L$1=\"Scaled\",D181>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D181=\"No\"),AND($L$1=\"Scaled\",D181<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[2637,"G.14.14","Initial password required to be changed at first logon?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","H.1 Password Controls","9.4.3.d","Password Management System",2,null,14,14,0,0,0,0,{"$f":"IF(I182=\"\",\"\",IF(D182=\"\",0,IF(D182=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D182=\"Yes\"),AND($L$1=\"Scaled\",D182>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D182=\"No\"),AND($L$1=\"Scaled\",D182<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1431,"G.14.15","Can a PIN or secret question be a stand-alone method of authentication?","No",null,"H.1 Password Controls","9.4.2","Secure Log-On Procedures",2,null,14,15,0,0,0,0,{"$f":"IF(I183=\"\",\"\",IF(D183=\"\",0,IF(D183=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D183=\"Yes\"),AND($L$1=\"Scaled\",D183>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D183=\"No\"),AND($L$1=\"Scaled\",D183<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[1432,"G.14.16","Passwords encrypted in transit?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","H.1 Password Controls","9.4.3.i","Password Management System",2,null,14,16,0,0,0,0,{"$f":"IF(I184=\"\",\"\",IF(D184=\"\",0,IF(D184=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D184=\"Yes\"),AND($L$1=\"Scaled\",D184>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D184=\"No\"),AND($L$1=\"Scaled\",D184<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1433,"G.14.17","Passwords encrypted or hashed in storage?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","H.1 Password Controls","9.4.3.i","Password Management System",2,null,14,17,0,0,0,0,{"$f":"IF(I185=\"\",\"\",IF(D185=\"\",0,IF(D185=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D185=\"Yes\"),AND($L$1=\"Scaled\",D185>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D185=\"No\"),AND($L$1=\"Scaled\",D185<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1434,"G.14.18","Passwords displayed when entered into a system?","No",null,"H.1 Password Controls","9.4.3.g","Password Management System",2,null,14,18,0,0,0,0,{"$f":"IF(I186=\"\",\"\",IF(D186=\"\",0,IF(D186=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D186=\"Yes\"),AND($L$1=\"Scaled\",D186>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D186=\"No\"),AND($L$1=\"Scaled\",D186<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[2638,"G.14.19","User accounts associated to a unique individual?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","H.1 Password Controls","9.4.3.a","Password Management System",2,null,14,19,0,0,0,0,{"$f":"IF(I187=\"\",\"\",IF(D187=\"\",0,IF(D187=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D187=\"Yes\"),AND($L$1=\"Scaled\",D187>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D187=\"No\"),AND($L$1=\"Scaled\",D187<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1416,"G.14.20","Does the system lock an account when three to five invalid login attempts are made?","No",null,"H.1 Password Controls","9.4.2","Secure Log-On Procedures",2,null,14,20,0,0,0,0,{"$f":"IF(I188=\"\",\"\",IF(D188=\"\",0,IF(D188=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D188=\"Yes\"),AND($L$1=\"Scaled\",D188>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D188=\"No\"),AND($L$1=\"Scaled\",D188<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[1478,"G.15","Is a mainframe used to transmit, process or store Scoped Systems and Data? If yes, are:","No",null,null,"NA","",1,null,15,0,0,0,0,0,{"$f":"IF(I189=\"\",\"\",IF(D189=\"\",0,IF(D189=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D189=\"Yes\"),AND($L$1=\"Scaled\",D189>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D189=\"No\"),AND($L$1=\"Scaled\",D189<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,1,2,1,1,0,null,null,null,1]
[1503,"G.15.1","Mainframe security controls documented?",null,null,null,"13.1.1.a","Network controls",2,null,15,1,0,0,0,0,{"$f":"IF(I190=\"\",\"\",IF(D190=\"\",0,IF(D190=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D190=\"Yes\"),AND($L$1=\"Scaled\",D190>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D190=\"No\"),AND($L$1=\"Scaled\",D190<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1504,"G.15.1.1","Reviews performed to validate compliance with documented standards?",null,null,null,"18.2.3","Technical compliance review",3,null,15,1,1,0,0,0,{"$f":"IF(I191=\"\",\"\",IF(D191=\"\",0,IF(D191=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D191=\"Yes\"),AND($L$1=\"Scaled\",D191>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D191=\"No\"),AND($L$1=\"Scaled\",D191<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1489,"G.15.2","Transmission encrypted?",null,null,null,"13.2.1.f","Information transfer policies and procedures",2,null,15,2,0,0,0,0,{"$f":"IF(I192=\"\",\"\",IF(D192=\"\",0,IF(D192=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D192=\"Yes\"),AND($L$1=\"Scaled\",D192>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D192=\"No\"),AND($L$1=\"Scaled\",D192<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1492,"G.15.3","Authentication required for access to any transaction or database system?",null,null,null,"9.4.2","Secure Log-On Procedures",2,null,15,3,0,0,0,0,{"$f":"IF(I193=\"\",\"\",IF(D193=\"\",0,IF(D193=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D193=\"Yes\"),AND($L$1=\"Scaled\",D193>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D193=\"No\"),AND($L$1=\"Scaled\",D193<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1496,"G.15.4","Job scheduling systems secured to control the submission of production jobs?",null,null,null,"9.4.4","Use of privileged utility programs",2,null,15,4,0,0,0,0,{"$f":"IF(I194=\"\",\"\",IF(D194=\"\",0,IF(D194=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D194=\"Yes\"),AND($L$1=\"Scaled\",D194>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D194=\"No\"),AND($L$1=\"Scaled\",D194<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1497,"G.15.5","Storage management personnel (tape operators) given privileged access to mainframe systems?",null,null,null,"9.4.4","Use of privileged utility programs",2,null,15,5,0,0,0,0,{"$f":"IF(I195=\"\",\"\",IF(D195=\"\",0,IF(D195=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D195=\"Yes\"),AND($L$1=\"Scaled\",D195>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D195=\"No\"),AND($L$1=\"Scaled\",D195<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1502,"G.15.6","ESM (RACF) and inherent security configuration settings configured to support the access control standards and requirements?",null,null,null,"13.1.1.f","Network Controls",2,null,15,6,0,0,0,0,{"$f":"IF(I196=\"\",\"\",IF(D196=\"\",0,IF(D196=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D196=\"Yes\"),AND($L$1=\"Scaled\",D196>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D196=\"No\"),AND($L$1=\"Scaled\",D196<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1513,"G.15.7","Regular review of logs using a specific methodology to uncover potential incidents?",null,null,null,"12.4.1","Event logging",2,null,15,7,0,0,0,{"$f":"IF(OR(Master=\"Master\",I197=0,J197=1),0,IF(ISNA(VLOOKUP(A197,L2_Array,21,FALSE)),0,VLOOKUP(A197,L2_Array,21,FALSE)))","v":0},{"$f":"IF(I197=\"\",\"\",IF(D197=\"\",0,IF(D197=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D197=\"Yes\"),AND($L$1=\"Scaled\",D197>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D197=\"No\"),AND($L$1=\"Scaled\",D197<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,{"$f":"IF(Master=\"Master\",Q197,IF(U196=\"\",R197,IF(OR(AND(T197>0,R197<U196),AND(T197=1,R197<=U196)),U196,R197)))","v":2},1,1,{"$f":"IF(ISNA(VLOOKUP(A197,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,""]
[1515,{"$f":"IF(I198=0,\"\",IF(I198=1,P$1&\".\"&K198,IF(I198=2,P$1&\".\"&K198&\".\"&L198,IF(I198=3,P$1&\".\"&K198&\".\"&L198&\".\"&M198,IF(I198=4,P$1&\".\"&K198&\".\"&L198&\".\"&M198&\".\"&N198,IF(I198=5,P$1&\".\"&K198&\".\"&L198&\".\"&M198&\".\"&N198&\".\"&O198))))))","v":"G.15.8"},"System generated alerts in the event of an audit log failure?",null,null,"G.9 Administrative Activity Logging, G.10 Log-on Activity Logging","12.4.2","Protection Of Log Information",2,null,{"$f":"IF(K197=\"\",1,IF(I198=1,K197+1,K197))","v":15},{"$f":"IF(L197=\"\",0,IF(K197<>K198,0,IF($I198=2,L197+1,L197)))","v":8},{"$f":"IF(M197=\"\",0,IF(L197<>L198,0,IF($I198=3,M197+1,M197)))","v":0},{"$f":"IF(N197=\"\",0,IF(M197<>M198,0,IF($I198=4,N197+1,N197)))","v":0},{"$f":"IF(O197=\"\",0,IF(N197<>N198,0,IF($I198=5,O197+1,O197)))","v":0},0,{"$f":"IF(I198=\"\",\"\",IF(D198=\"\",0,IF(D198=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D198=\"Yes\"),AND($L$1=\"Scaled\",D198>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D198=\"No\"),AND($L$1=\"Scaled\",D198<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(I198=\"\",\"\",IF(P198>0,P198,IF(Q198>0,Q198,0)))","v":0},{"$f":"IF(I198=\"\",\"\",IF(OR(I198=1,S197=\"\"),1,IF(OR(AND(J197=1,(I198-I196<>0)),AND(S197=0,I197=I198),AND(J197=1,I198=I196)),0,1)))","v":1},{"$f":"IF(I198=\"\",T197,IF(AND(R198>1,OR(T197=\"\",T197=0,T197>=I198)),I198,IF(I198>T197,T197,0)))","v":1},2,{"$f":"IF(I198=\"\",\"\",IF(OR(AND(S197=1,T198=1),R198>0,AND(S199=0,V199=1)),1,0))","v":1},{"$f":"IF(I198=\"\",\"\",IF(OR(AND(T198>0,S198=1),AND(S198=1,V198=1)),1,0))","v":1},0,null,null,null,{"$f":"IF(AND(I198=1,R198=1),2,IF(AND(U197=1,K198=K197),2,IF(AND(AB197=2,K198=K197),2,IF(I198=1,1,\"\"))))","v":""}]
[1506,"G.15.9","Logs retained for a minimum of one year?",null,null,"G.11 Log Retention ","NA",null,2,null,15,9,0,0,0,0,{"$f":"IF(I199=\"\",\"\",IF(D199=\"\",0,IF(D199=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D199=\"Yes\"),AND($L$1=\"Scaled\",D199>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D199=\"No\"),AND($L$1=\"Scaled\",D199<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1531,"G.15.10","Audit logs adequately protected against modification, deletion, and/or inappropriate access?",null,null,"G.9 Administrative Activity Logging, G.10 Log-on Activity Logging","12.4.2","Protection Of Log Information",2,null,15,10,0,0,0,0,{"$f":"IF(I200=\"\",\"\",IF(D200=\"\",0,IF(D200=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D200=\"Yes\"),AND($L$1=\"Scaled\",D200>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D200=\"No\"),AND($L$1=\"Scaled\",D200<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1539,"G.15.11","Minimum password length at least eight characters?",null,null,"H.1 Password Controls","9.3.1.d","Use of secret authentication information",2,null,15,11,0,0,0,0,{"$f":"IF(I201=\"\",\"\",IF(D201=\"\",0,IF(D201=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D201=\"Yes\"),AND($L$1=\"Scaled\",D201>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D201=\"No\"),AND($L$1=\"Scaled\",D201<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1545,"G.15.12","Complex passwords required?",null,null,"H.1 Password Controls","9.3.1.d                                     9.4.3.c","Use of secret authentication information,                 Password management system",2,null,15,12,0,0,0,0,{"$f":"IF(I202=\"\",\"\",IF(D202=\"\",0,IF(D202=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D202=\"Yes\"),AND($L$1=\"Scaled\",D202>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D202=\"No\"),AND($L$1=\"Scaled\",D202<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1550,"G.15.13","Minimum password expiration at least 90 days?",null,null,"H.1 Password Controls","9.4.3.e","Password Management System",2,null,15,13,0,0,0,0,{"$f":"IF(I203=\"\",\"\",IF(D203=\"\",0,IF(D203=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D203=\"Yes\"),AND($L$1=\"Scaled\",D203>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D203=\"No\"),AND($L$1=\"Scaled\",D203<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1555,"G.15.14","Password history of 12 before reuse?",null,null,"H.1 Password Controls","9.4.3.f","Password Management System",2,null,15,14,0,0,0,0,{"$f":"IF(I204=\"\",\"\",IF(D204=\"\",0,IF(D204=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D204=\"Yes\"),AND($L$1=\"Scaled\",D204>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D204=\"No\"),AND($L$1=\"Scaled\",D204<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1570,"G.15.15","Password minimum age?",null,null,"H.1 Password Controls","9.4.3.e","Password Management System",2,null,15,15,0,0,0,0,{"$f":"IF(I205=\"\",\"\",IF(D205=\"\",0,IF(D205=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D205=\"Yes\"),AND($L$1=\"Scaled\",D205>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D205=\"No\"),AND($L$1=\"Scaled\",D205<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2639,"G.15.16","Initial password required to be changed at first logon?",null,null,"H.1 Password Controls","9.4.3.d","Password Management System",2,null,15,16,0,0,0,0,{"$f":"IF(I206=\"\",\"\",IF(D206=\"\",0,IF(D206=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D206=\"Yes\"),AND($L$1=\"Scaled\",D206>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D206=\"No\"),AND($L$1=\"Scaled\",D206<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1574,"G.15.17","Can a PIN or secret question be a stand alone method of authentication?",null,null,null,"9.4.2 ","Secure Log-On Procedures",2,null,15,17,0,0,0,0,{"$f":"IF(I207=\"\",\"\",IF(D207=\"\",0,IF(D207=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D207=\"Yes\"),AND($L$1=\"Scaled\",D207>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D207=\"No\"),AND($L$1=\"Scaled\",D207<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1575,"G.15.18","Passwords encrypted in transit?",null,null,"H.1 Password Controls","9.4.3.i","Password Management System",2,null,15,18,0,0,0,0,{"$f":"IF(I208=\"\",\"\",IF(D208=\"\",0,IF(D208=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D208=\"Yes\"),AND($L$1=\"Scaled\",D208>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D208=\"No\"),AND($L$1=\"Scaled\",D208<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1576,"G.15.19","Passwords encrypted or hashed in storage?",null,null,"H.1 Password Controls","9.4.3.i","Password Management System",2,null,15,19,0,0,0,0,{"$f":"IF(I209=\"\",\"\",IF(D209=\"\",0,IF(D209=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D209=\"Yes\"),AND($L$1=\"Scaled\",D209>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D209=\"No\"),AND($L$1=\"Scaled\",D209<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1577,"G.15.20","Passwords displayed when entered into a system?",null,null,"H.1 Password Controls","9.4.3.g","Password Management System",2,null,15,20,0,0,0,0,{"$f":"IF(I210=\"\",\"\",IF(D210=\"\",0,IF(D210=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D210=\"Yes\"),AND($L$1=\"Scaled\",D210>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D210=\"No\"),AND($L$1=\"Scaled\",D210<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2640,"G.15.21","User accounts associated to a unique individual?",null,null,"H.1 Password Controls","9.4.3.a","Password Management System",2,null,15,21,0,0,0,0,{"$f":"IF(I211=\"\",\"\",IF(D211=\"\",0,IF(D211=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D211=\"Yes\"),AND($L$1=\"Scaled\",D211>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D211=\"No\"),AND($L$1=\"Scaled\",D211<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1559,"G.15.22","Does the system lock an account when three to five invalid login attempts are made?",null,null,"H.1 Password Controls","9.4.2","Secure Log-On Procedures",2,null,15,22,0,0,0,0,{"$f":"IF(I212=\"\",\"\",IF(D212=\"\",0,IF(D212=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D212=\"Yes\"),AND($L$1=\"Scaled\",D212>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D212=\"No\"),AND($L$1=\"Scaled\",D212<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1564,"G.15.23","Administrator intervention required to unlock an account?",null,null,"H.1 Password Controls","9.4.2","Secure Log-On Procedures",2,null,15,23,0,0,0,0,{"$f":"IF(I213=\"\",\"\",IF(D213=\"\",0,IF(D213=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D213=\"Yes\"),AND($L$1=\"Scaled\",D213>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D213=\"No\"),AND($L$1=\"Scaled\",D213<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1579,"G.16","Is an AS400 used to transmit, process or store Scoped Systems and Data? If yes, are:","No",null,null,"NA","",1,null,16,0,0,0,0,0,{"$f":"IF(I214=\"\",\"\",IF(D214=\"\",0,IF(D214=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D214=\"Yes\"),AND($L$1=\"Scaled\",D214>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D214=\"No\"),AND($L$1=\"Scaled\",D214<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,1,2,1,1,0,null,null,null,1]
[2641,"G.16.1","Security controls documented?",null,null,null,"13.1.1.a","Network Controls",2,null,16,1,0,0,0,0,{"$f":"IF(I215=\"\",\"\",IF(D215=\"\",0,IF(D215=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D215=\"Yes\"),AND($L$1=\"Scaled\",D215>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D215=\"No\"),AND($L$1=\"Scaled\",D215<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1598,"G.16.1.1","Systems periodically monitored to ensure continued compliance with the documented standards?",null,null,null,"18.2.3","Technical Compliance review",3,null,16,1,1,0,0,0,{"$f":"IF(I216=\"\",\"\",IF(D216=\"\",0,IF(D216=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D216=\"Yes\"),AND($L$1=\"Scaled\",D216>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D216=\"No\"),AND($L$1=\"Scaled\",D216<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1580,"G.16.2","Group profile assignments based on constituent role?",null,null,null,"9.1.1.k","Access Control Policy",2,null,16,2,0,0,0,0,{"$f":"IF(I217=\"\",\"\",IF(D217=\"\",0,IF(D217=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D217=\"Yes\"),AND($L$1=\"Scaled\",D217>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D217=\"No\"),AND($L$1=\"Scaled\",D217<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1581,"G.16.3","Group profile assignments approved?",null,null,null,"9.1.1.g","Access Control Policy",2,null,16,3,0,0,0,0,{"$f":"IF(I218=\"\",\"\",IF(D218=\"\",0,IF(D218=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D218=\"Yes\"),AND($L$1=\"Scaled\",D218>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D218=\"No\"),AND($L$1=\"Scaled\",D218<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1582,"G.16.4","User profiles created with the principle of least privilege?",null,null,null,"9.1.1.b","Access Control Policy",2,null,16,4,0,0,0,0,{"$f":"IF(I219=\"\",\"\",IF(D219=\"\",0,IF(D219=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D219=\"Yes\"),AND($L$1=\"Scaled\",D219>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D219=\"No\"),AND($L$1=\"Scaled\",D219<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1607,"G.16.5","Logs regularly reviewed using a specific methodology to uncover potential incidents?",null,null,"G.9 Administrative Activity Logging, G.10 Log-on Activity Logging","12.4.1","Event logging",2,null,16,5,0,0,0,0,{"$f":"IF(I220=\"\",\"\",IF(D220=\"\",0,IF(D220=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D220=\"Yes\"),AND($L$1=\"Scaled\",D220>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D220=\"No\"),AND($L$1=\"Scaled\",D220<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1609,"G.16.6","Sufficient information in the logs to evaluate incidents?",null,null,"G.9 Administrative Activity Logging, G.10 Log-on Activity Logging","12.4.1","Event logging",2,null,16,6,0,0,0,0,{"$f":"IF(I221=\"\",\"\",IF(D221=\"\",0,IF(D221=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D221=\"Yes\"),AND($L$1=\"Scaled\",D221>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D221=\"No\"),AND($L$1=\"Scaled\",D221<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1600,"G.16.7","Logs retained for a minimum of one year?",null,null,"G.11 Log Retention ","12.4.2","Protection Of Log Information",2,null,16,7,0,0,0,0,{"$f":"IF(I222=\"\",\"\",IF(D222=\"\",0,IF(D222=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D222=\"Yes\"),AND($L$1=\"Scaled\",D222>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D222=\"No\"),AND($L$1=\"Scaled\",D222<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1620,"G.16.8","System generated alerts in the event of an audit log failure?",null,null,"G.9 Administrative Activity Logging, G.10 Log-on Activity Logging","12.4.1","Event logging",2,null,16,8,0,0,0,0,{"$f":"IF(I223=\"\",\"\",IF(D223=\"\",0,IF(D223=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D223=\"Yes\"),AND($L$1=\"Scaled\",D223>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D223=\"No\"),AND($L$1=\"Scaled\",D223<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1625,"G.16.9","Audit logs protected against modification, deletion, and/or inappropriate access?",null,null,"G.9 Administrative Activity Logging, G.10 Log-on Activity Logging","12.4.2","Protection Of Log Information",2,null,16,9,0,0,0,0,{"$f":"IF(I224=\"\",\"\",IF(D224=\"\",0,IF(D224=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D224=\"Yes\"),AND($L$1=\"Scaled\",D224>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D224=\"No\"),AND($L$1=\"Scaled\",D224<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1633,"G.16.10","Minimum password length at least eight characters:",null,null,"H.1 Password Controls","9.3.1.d","Use of secret authentication information",2,null,16,10,0,0,0,0,{"$f":"IF(I225=\"\",\"\",IF(D225=\"\",0,IF(D225=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D225=\"Yes\"),AND($L$1=\"Scaled\",D225>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D225=\"No\"),AND($L$1=\"Scaled\",D225<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1639,"G.16.11","Complex passwords required?",null,null,"H.1 Password Controls","9.3.1.d                                     9.4.3.c","Use of secret authentication information,                 Password management system",2,null,16,11,0,0,0,0,{"$f":"IF(I226=\"\",\"\",IF(D226=\"\",0,IF(D226=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D226=\"Yes\"),AND($L$1=\"Scaled\",D226>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D226=\"No\"),AND($L$1=\"Scaled\",D226<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1644,"G.16.12","Minimum password expiration at least 90 days?",null,null,"H.1 Password Controls","9.4.3.e","Password Management System",2,null,16,12,0,0,0,0,{"$f":"IF(I227=\"\",\"\",IF(D227=\"\",0,IF(D227=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D227=\"Yes\"),AND($L$1=\"Scaled\",D227>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D227=\"No\"),AND($L$1=\"Scaled\",D227<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1649,"G.16.13","Password history of 12 before reuse?",null,null,"H.1 Password Controls","9.4.3.f","Password Management System",2,null,16,13,0,0,0,0,{"$f":"IF(I228=\"\",\"\",IF(D228=\"\",0,IF(D228=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D228=\"Yes\"),AND($L$1=\"Scaled\",D228>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D228=\"No\"),AND($L$1=\"Scaled\",D228<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2642,"G.16.14","Initial password required to be changed at first logon?",null,null,"H.1 Password Controls","9.4.3.d","Password Management System",2,null,16,14,0,0,0,0,{"$f":"IF(I229=\"\",\"\",IF(D229=\"\",0,IF(D229=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D229=\"Yes\"),AND($L$1=\"Scaled\",D229>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D229=\"No\"),AND($L$1=\"Scaled\",D229<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1668,"G.16.15","Can a PIN or secret question be a stand alone method of authentication?",null,null,"H.1 Password Controls","9.4.2","Secure Log-On Procedures",2,null,16,15,0,0,0,0,{"$f":"IF(I230=\"\",\"\",IF(D230=\"\",0,IF(D230=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D230=\"Yes\"),AND($L$1=\"Scaled\",D230>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D230=\"No\"),AND($L$1=\"Scaled\",D230<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1669,"G.16.16","Passwords encrypted in transit?",null,null,"H.1 Password Controls","9.4.3.i","Password Management System",2,null,16,16,0,0,0,0,{"$f":"IF(I231=\"\",\"\",IF(D231=\"\",0,IF(D231=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D231=\"Yes\"),AND($L$1=\"Scaled\",D231>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D231=\"No\"),AND($L$1=\"Scaled\",D231<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1670,"G.16.17","Passwords encrypted or hashed in storage?",null,null,"H.1 Password Controls","9.4.3.i","Password Management System",2,null,16,17,0,0,0,0,{"$f":"IF(I232=\"\",\"\",IF(D232=\"\",0,IF(D232=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D232=\"Yes\"),AND($L$1=\"Scaled\",D232>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D232=\"No\"),AND($L$1=\"Scaled\",D232<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1671,"G.16.18","Passwords displayed when entered into a system?",null,null,"H.1 Password Controls","9.4.3.g","Password Management System",2,null,16,18,0,0,0,0,{"$f":"IF(I233=\"\",\"\",IF(D233=\"\",0,IF(D233=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D233=\"Yes\"),AND($L$1=\"Scaled\",D233>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D233=\"No\"),AND($L$1=\"Scaled\",D233<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2643,"G.16.19","User accounts associated to a unique individual?",null,null,"H.1 Password Controls","9.4.3.a","Password Management System",2,null,16,19,0,0,0,0,{"$f":"IF(I234=\"\",\"\",IF(D234=\"\",0,IF(D234=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D234=\"Yes\"),AND($L$1=\"Scaled\",D234>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D234=\"No\"),AND($L$1=\"Scaled\",D234<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1653,"G.16.20","Does the system lock an account when three to five invalid login attempts are made?",null,null,"H.1 Password Controls","9.4.2","Secure Log-On Procedures",2,null,16,20,0,0,0,0,{"$f":"IF(I235=\"\",\"\",IF(D235=\"\",0,IF(D235=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D235=\"Yes\"),AND($L$1=\"Scaled\",D235>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D235=\"No\"),AND($L$1=\"Scaled\",D235<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2644,"G.16.21","Users required to log off when the session is finished?",null,null,null,"11.2.8.a","Unattended User Equipment",2,null,16,21,0,0,0,0,{"$f":"IF(I236=\"\",\"\",IF(D236=\"\",0,IF(D236=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D236=\"Yes\"),AND($L$1=\"Scaled\",D236>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D236=\"No\"),AND($L$1=\"Scaled\",D236<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1672,"G.17","Is an Open VMS (VAX or Alpha) system used to transmit, process or store Scoped Systems and Data? If yes, are:","No",null,null,"NA","",1,null,17,0,0,0,0,0,{"$f":"IF(I237=\"\",\"\",IF(D237=\"\",0,IF(D237=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D237=\"Yes\"),AND($L$1=\"Scaled\",D237>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D237=\"No\"),AND($L$1=\"Scaled\",D237<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,1,2,1,1,0,null,null,null,1]
[1679,"G.17.1","Administrative privilege restricted to those responsible for VMS administration?",null,null,null,"9.4.4.c","Use of privileged utility programs",2,null,17,1,0,0,0,0,{"$f":"IF(I238=\"\",\"\",IF(D238=\"\",0,IF(D238=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D238=\"Yes\"),AND($L$1=\"Scaled\",D238>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D238=\"No\"),AND($L$1=\"Scaled\",D238<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1705,"G.17.2","Logs regularly reviewed using a specific methodology to uncover potential incidents?",null,null,null,"12.4.1","Event logging",2,null,17,2,0,0,0,0,{"$f":"IF(I239=\"\",\"\",IF(D239=\"\",0,IF(D239=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D239=\"Yes\"),AND($L$1=\"Scaled\",D239>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D239=\"No\"),AND($L$1=\"Scaled\",D239<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1707,"G.17.3","Sufficient information to investigate incidents including (failed login attempts)?",null,null,"G.9 Administrative Activity Logging, G.10 Log-on Activity Logging","12.4.1","Event logging",2,null,17,3,0,0,0,0,{"$f":"IF(I240=\"\",\"\",IF(D240=\"\",0,IF(D240=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D240=\"Yes\"),AND($L$1=\"Scaled\",D240>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D240=\"No\"),AND($L$1=\"Scaled\",D240<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1698,"G.17.4","Logs retained for a minimum of one year?",null,null,"G.11 Log Retention ","12.4.2","Protection Of Log Information",2,null,17,4,0,0,0,0,{"$f":"IF(I241=\"\",\"\",IF(D241=\"\",0,IF(D241=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D241=\"Yes\"),AND($L$1=\"Scaled\",D241>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D241=\"No\"),AND($L$1=\"Scaled\",D241<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1718,"G.17.5","System generated alerts in the event of an audit log failure?",null,null,"G.9 Administrative Activity Logging, G.10 Log-on Activity Logging","12.4.1","Event logging",2,null,17,5,0,0,0,0,{"$f":"IF(I242=\"\",\"\",IF(D242=\"\",0,IF(D242=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D242=\"Yes\"),AND($L$1=\"Scaled\",D242>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D242=\"No\"),AND($L$1=\"Scaled\",D242<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1723,"G.17.6","Are audit logs protected against modification, deletion, and/or inappropriate access?",null,null,"G.9 Administrative Activity Logging, G.10 Log-on Activity Logging","12.4.2","Protection Of Log Information",2,null,17,6,0,0,0,0,{"$f":"IF(I243=\"\",\"\",IF(D243=\"\",0,IF(D243=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D243=\"Yes\"),AND($L$1=\"Scaled\",D243>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D243=\"No\"),AND($L$1=\"Scaled\",D243<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1731,"G.17.7","Minimum password length at least eight characters?",null,null,"H.1 Password Controls","9.3.1.d","Use of secret authentication information",2,null,17,7,0,0,0,0,{"$f":"IF(I244=\"\",\"\",IF(D244=\"\",0,IF(D244=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D244=\"Yes\"),AND($L$1=\"Scaled\",D244>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D244=\"No\"),AND($L$1=\"Scaled\",D244<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1737,"G.17.8","Complex passwords required?",null,null,"H.1 Password Controls","9.3.1.d                                     9.4.3.c","Use of secret authentication information,                 Password management system",2,null,17,8,0,0,0,0,{"$f":"IF(I245=\"\",\"\",IF(D245=\"\",0,IF(D245=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D245=\"Yes\"),AND($L$1=\"Scaled\",D245>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D245=\"No\"),AND($L$1=\"Scaled\",D245<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1742,"G.17.9","Minimum password expiration at least every 90 days?",null,null,"H.1 Password Controls","9.4.3.e","Password Management System",2,null,17,9,0,0,0,0,{"$f":"IF(I246=\"\",\"\",IF(D246=\"\",0,IF(D246=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D246=\"Yes\"),AND($L$1=\"Scaled\",D246>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D246=\"No\"),AND($L$1=\"Scaled\",D246<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1747,"G.17.10","Password history of 12 before reuse?",null,null,"H.1 Password Controls","9.4.3.f","Password Management System",2,null,17,10,0,0,0,0,{"$f":"IF(I247=\"\",\"\",IF(D247=\"\",0,IF(D247=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D247=\"Yes\"),AND($L$1=\"Scaled\",D247>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D247=\"No\"),AND($L$1=\"Scaled\",D247<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2646,"G.17.11","Initial password required to be changed at first logon?",null,null,"H.1 Password Controls","9.4.3.d","Password Management System",2,null,17,11,0,0,0,0,{"$f":"IF(I248=\"\",\"\",IF(D248=\"\",0,IF(D248=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D248=\"Yes\"),AND($L$1=\"Scaled\",D248>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D248=\"No\"),AND($L$1=\"Scaled\",D248<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1766,"G.17.12","Can a PIN or secret question be a stand alone method of authentication?",null,null,null,"9.4.2","Secure Log-On Procedures",2,null,17,12,0,0,0,0,{"$f":"IF(I249=\"\",\"\",IF(D249=\"\",0,IF(D249=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D249=\"Yes\"),AND($L$1=\"Scaled\",D249>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D249=\"No\"),AND($L$1=\"Scaled\",D249<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1767,"G.17.13","Passwords encrypted in transit?",null,null,"H.1 Password Controls","9.4.3.i","Password Management System",2,null,17,13,0,0,0,0,{"$f":"IF(I250=\"\",\"\",IF(D250=\"\",0,IF(D250=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D250=\"Yes\"),AND($L$1=\"Scaled\",D250>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D250=\"No\"),AND($L$1=\"Scaled\",D250<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1768,"G.17.14","Passwords encrypted or hashed in storage?",null,null,"H.1 Password Controls","9.4.3.i","Password Management System",2,null,17,14,0,0,0,0,{"$f":"IF(I251=\"\",\"\",IF(D251=\"\",0,IF(D251=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D251=\"Yes\"),AND($L$1=\"Scaled\",D251>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D251=\"No\"),AND($L$1=\"Scaled\",D251<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1769,"G.17.15","Passwords displayed when entered into a system?",null,null,"H.1 Password Controls","9.4.3.g","Password Management System",2,null,17,15,0,0,0,0,{"$f":"IF(I252=\"\",\"\",IF(D252=\"\",0,IF(D252=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D252=\"Yes\"),AND($L$1=\"Scaled\",D252>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D252=\"No\"),AND($L$1=\"Scaled\",D252<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2647,"G.17.16","User accounts associated to a unique individual?",null,null,"H.1 Password Controls","9.4.3.a","Password Management System",2,null,17,16,0,0,0,0,{"$f":"IF(I253=\"\",\"\",IF(D253=\"\",0,IF(D253=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D253=\"Yes\"),AND($L$1=\"Scaled\",D253>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D253=\"No\"),AND($L$1=\"Scaled\",D253<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1751,"G.17.17","Does the system lock an account when three to five invalid login attempts are made?",null,null,"H.1 Password Controls","9.4.2","Secure Log-On Procedures",2,null,17,17,0,0,0,0,{"$f":"IF(I254=\"\",\"\",IF(D254=\"\",0,IF(D254=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D254=\"Yes\"),AND($L$1=\"Scaled\",D254>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D254=\"No\"),AND($L$1=\"Scaled\",D254<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1770,"G.18","Are Web services provided? If yes, are:","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy",null,"NA","",1,null,18,0,0,0,0,1,{"$f":"IF(I255=\"\",\"\",IF(D255=\"\",0,IF(D255=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D255=\"Yes\"),AND($L$1=\"Scaled\",D255>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D255=\"No\"),AND($L$1=\"Scaled\",D255<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[2649,"G.18.1","Electronic commerce web sites or applications used to transmit, process or store Scoped Systems and Data?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","G.13 Website – Client Encryption","14.1.2","Securing application services on public networks",2,null,18,1,0,0,0,0,{"$f":"IF(I256=\"\",\"\",IF(D256=\"\",0,IF(D256=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D256=\"Yes\"),AND($L$1=\"Scaled\",D256>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D256=\"No\"),AND($L$1=\"Scaled\",D256<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2650,"G.18.1.1","Cryptographic controls used for the electronic commerce application (SSL)?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","G.13 Website – Client Encryption","14.1.2","Securing application services on public networks",3,null,18,1,1,0,0,0,{"$f":"IF(I257=\"\",\"\",IF(D257=\"\",0,IF(D257=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D257=\"Yes\"),AND($L$1=\"Scaled\",D257>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D257=\"No\"),AND($L$1=\"Scaled\",D257<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2651,"G.18.1.2","Users required to authenticate to the application?","Yes","Cloudamize Security Policy - Cloudamize Network Security Policy","G.13 Website – Client Encryption","14.1.3","Protecting application services transactions",3,null,18,1,2,0,0,0,{"$f":"IF(I258=\"\",\"\",IF(D258=\"\",0,IF(D258=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D258=\"Yes\"),AND($L$1=\"Scaled\",D258>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D258=\"No\"),AND($L$1=\"Scaled\",D258<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2652,"G.18.1.3","Transaction details stored in the DMZ?","No",null,null,"14.1.3.e","Protecting application services transactions",3,null,18,1,3,0,0,0,{"$f":"IF(I259=\"\",\"\",IF(D259=\"\",0,IF(D259=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D259=\"Yes\"),AND($L$1=\"Scaled\",D259>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D259=\"No\"),AND($L$1=\"Scaled\",D259<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,3,2,1,1,0,null,null,null,2]
[1771,"G.18.2","Is Windows IIS for these Web services used? If yes, is:","No","Cloudamize Security Policy - Cloudamize Network Security Policy",null,"NA","",2,null,18,2,0,0,0,0,{"$f":"IF(I260=\"\",\"\",IF(D260=\"\",0,IF(D260=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D260=\"Yes\"),AND($L$1=\"Scaled\",D260>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D260=\"No\"),AND($L$1=\"Scaled\",D260<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[1772,"G.18.2.1","Anonymous access to FTP disabled?",null,"Cloudamize Security Policy - Cloudamize Network Security Policy",null,"13.2.2","Agreements on information transfer",3,null,18,2,1,0,0,{"$f":"IF(OR(Master=\"Master\",I261=0,J261=1),0,IF(ISNA(VLOOKUP(A261,L2_Array,21,FALSE)),0,VLOOKUP(A261,L2_Array,21,FALSE)))","v":0},{"$f":"IF(I261=\"\",\"\",IF(D261=\"\",0,IF(D261=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D261=\"Yes\"),AND($L$1=\"Scaled\",D261>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D261=\"No\"),AND($L$1=\"Scaled\",D261<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,{"$f":"IF(Master=\"Master\",Q261,IF(U260=\"\",R261,IF(OR(AND(T261>0,R261<U260),AND(T261=1,R261<=U260)),U260,R261)))","v":2},0,1,{"$f":"IF(ISNA(VLOOKUP(A261,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,2]
[1773,{"$f":"IF(I262=0,\"\",IF(I262=1,P$1&\".\"&K262,IF(I262=2,P$1&\".\"&K262&\".\"&L262,IF(I262=3,P$1&\".\"&K262&\".\"&L262&\".\"&M262,IF(I262=4,P$1&\".\"&K262&\".\"&L262&\".\"&M262&\".\"&N262,IF(I262=5,P$1&\".\"&K262&\".\"&L262&\".\"&M262&\".\"&N262&\".\"&O262))))))","v":"G.18.2.2"},"Membership to the IIS Administrators group restricted to those with web administration roles and responsibilities?",null,"Cloudamize Security Policy - Cloudamize Network Security Policy",null,"9.2.3.b","management of privileged access rights",3,null,{"$f":"IF(K261=\"\",1,IF(I262=1,K261+1,K261))","v":18},{"$f":"IF(L261=\"\",0,IF(K261<>K262,0,IF($I262=2,L261+1,L261)))","v":2},{"$f":"IF(M261=\"\",0,IF(L261<>L262,0,IF($I262=3,M261+1,M261)))","v":2},{"$f":"IF(N261=\"\",0,IF(M261<>M262,0,IF($I262=4,N261+1,N261)))","v":0},{"$f":"IF(O261=\"\",0,IF(N261<>N262,0,IF($I262=5,O261+1,O261)))","v":0},0,{"$f":"IF(I262=\"\",\"\",IF(D262=\"\",0,IF(D262=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D262=\"Yes\"),AND($L$1=\"Scaled\",D262>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D262=\"No\"),AND($L$1=\"Scaled\",D262<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(I262=\"\",\"\",IF(P262>0,P262,IF(Q262>0,Q262,0)))","v":0},{"$f":"IF(I262=\"\",\"\",IF(OR(I262=1,S261=\"\"),1,IF(OR(AND(J261=1,(I262-I260<>0)),AND(S261=0,I261=I262),AND(J261=1,I262=I260)),0,1)))","v":1},{"$f":"IF(I262=\"\",T261,IF(AND(R262>1,OR(T261=\"\",T261=0,T261>=I262)),I262,IF(I262>T261,T261,0)))","v":2},2,{"$f":"IF(I262=\"\",\"\",IF(OR(AND(S261=1,T262=1),R262>0,AND(S263=0,V263=1)),1,0))","v":0},{"$f":"IF(I262=\"\",\"\",IF(OR(AND(T262>0,S262=1),AND(S262=1,V262=1)),1,0))","v":1},0,null,null,null,{"$f":"IF(AND(I262=1,R262=1),2,IF(AND(U261=1,K262=K261),2,IF(AND(AB261=2,K262=K261),2,IF(I262=1,1,\"\"))))","v":2}]
[1774,"G.18.2.3","Dedicated virtual directory structure used for each website?",null,"Cloudamize Security Policy - Cloudamize Network Security Policy",null,"13.1.3","Segregation In Networks",3,null,18,2,3,0,0,0,{"$f":"IF(I263=\"\",\"\",IF(D263=\"\",0,IF(D263=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D263=\"Yes\"),AND($L$1=\"Scaled\",D263>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D263=\"No\"),AND($L$1=\"Scaled\",D263<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[1776,"G.18.2.4","Unused services turned off on IIS servers?",null,"Cloudamize Security Policy - Cloudamize Network Security Policy",null,"9.4.4.h","Use of privileged utility programs",3,null,18,2,4,0,0,0,{"$f":"IF(I264=\"\",\"\",IF(D264=\"\",0,IF(D264=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D264=\"Yes\"),AND($L$1=\"Scaled\",D264>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D264=\"No\"),AND($L$1=\"Scaled\",D264<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[1777,"G.18.2.5","Services running on standard ports?",null,"Cloudamize Security Policy - Cloudamize Network Security Policy",null,"NA","",3,null,18,2,5,0,0,0,{"$f":"IF(I265=\"\",\"\",IF(D265=\"\",0,IF(D265=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D265=\"Yes\"),AND($L$1=\"Scaled\",D265>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D265=\"No\"),AND($L$1=\"Scaled\",D265<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[1778,"G.18.2.6","Logging configured to support incident investigation?",null,"Cloudamize Security Policy - Cloudamize Network Security Policy",null,12.4,"Logging and monitoring",3,null,18,2,6,0,0,0,{"$f":"IF(I266=\"\",\"\",IF(D266=\"\",0,IF(D266=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D266=\"Yes\"),AND($L$1=\"Scaled\",D266>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D266=\"No\"),AND($L$1=\"Scaled\",D266<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[1779,"G.18.2.7","Sample applications and scripts removed?",null,"Cloudamize Security Policy - Cloudamize Network Security Policy",null,"9.4.4.h","Use of privileged utility programs",3,null,18,2,7,0,0,0,{"$f":"IF(I267=\"\",\"\",IF(D267=\"\",0,IF(D267=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D267=\"Yes\"),AND($L$1=\"Scaled\",D267>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D267=\"No\"),AND($L$1=\"Scaled\",D267<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[1780,"G.18.2.8","Least privilege used when setting IIS content permissions?",null,"Cloudamize Security Policy - Cloudamize Network Security Policy",null,"9.1.1","Access Control Policy",3,null,18,2,8,0,0,0,{"$f":"IF(I268=\"\",\"\",IF(D268=\"\",0,IF(D268=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D268=\"Yes\"),AND($L$1=\"Scaled\",D268>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D268=\"No\"),AND($L$1=\"Scaled\",D268<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[1781,"G.18.2.9","Content folder on the same drive as the operating system?",null,"Cloudamize Security Policy - Cloudamize Network Security Policy",null,"NA","",3,null,18,2,9,0,0,0,{"$f":"IF(I269=\"\",\"\",IF(D269=\"\",0,IF(D269=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D269=\"Yes\"),AND($L$1=\"Scaled\",D269>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D269=\"No\"),AND($L$1=\"Scaled\",D269<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,2,2,0,1,0,null,null,null,2]
[1782,"G.18.3","Is Apache used for these Web services? If yes, is:","Yes",null,null,"NA","",2,null,18,3,0,0,0,0,{"$f":"IF(I270=\"\",\"\",IF(D270=\"\",0,IF(D270=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D270=\"Yes\"),AND($L$1=\"Scaled\",D270>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D270=\"No\"),AND($L$1=\"Scaled\",D270<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1783,"G.18.3.1","Logging configured to support incident investigation?","Yes",null,null,12.4,"Logging and monitoring",3,null,18,3,1,0,0,0,{"$f":"IF(I271=\"\",\"\",IF(D271=\"\",0,IF(D271=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D271=\"Yes\"),AND($L$1=\"Scaled\",D271>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D271=\"No\"),AND($L$1=\"Scaled\",D271<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1784,"G.18.3.2","Anonymous access to FTP disabled?","Yes",null,null,"13.2.2","Agreements on information transfer",3,null,18,3,2,0,0,0,{"$f":"IF(I272=\"\",\"\",IF(D272=\"\",0,IF(D272=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D272=\"Yes\"),AND($L$1=\"Scaled\",D272>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D272=\"No\"),AND($L$1=\"Scaled\",D272<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1785,"G.18.3.3","Membership to the Apache group restricted to those with web administration roles and responsibilities?","Yes",null,null,"9.2.3.b","management of privileged access rights",3,null,18,3,3,0,0,0,{"$f":"IF(I273=\"\",\"\",IF(D273=\"\",0,IF(D273=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D273=\"Yes\"),AND($L$1=\"Scaled\",D273>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D273=\"No\"),AND($L$1=\"Scaled\",D273<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1786,"G.18.3.4","Dedicated virtual directory structure used for each website?","Yes",null,null,"13.1.3","Segregation In Networks",3,null,18,3,4,0,0,0,{"$f":"IF(I274=\"\",\"\",IF(D274=\"\",0,IF(D274=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D274=\"Yes\"),AND($L$1=\"Scaled\",D274>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D274=\"No\"),AND($L$1=\"Scaled\",D274<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1787,"G.18.3.5","Configuration options restricted to authorized users?","Yes",null,null,"9.1.1","Access Control Policy",3,null,18,3,5,0,0,0,{"$f":"IF(I275=\"\",\"\",IF(D275=\"\",0,IF(D275=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D275=\"Yes\"),AND($L$1=\"Scaled\",D275>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D275=\"No\"),AND($L$1=\"Scaled\",D275<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1788,"G.18.3.6","Services run on standard ports?","Yes",null,null,"NA","",3,null,18,3,6,0,0,0,{"$f":"IF(I276=\"\",\"\",IF(D276=\"\",0,IF(D276=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D276=\"Yes\"),AND($L$1=\"Scaled\",D276>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D276=\"No\"),AND($L$1=\"Scaled\",D276<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1789,"G.18.3.7","Sample applications and scripts removed?","Yes",null,null,"9.4.4.h","Use of privileged utility programs",3,null,18,3,7,0,0,0,{"$f":"IF(I277=\"\",\"\",IF(D277=\"\",0,IF(D277=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D277=\"Yes\"),AND($L$1=\"Scaled\",D277>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D277=\"No\"),AND($L$1=\"Scaled\",D277<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1790,"G.18.3.8","Least privilege used when setting permissions?","Yes",null,"H.3 Logical Access Authorization","9.1.1","Access Control Policy",3,null,18,3,8,0,0,0,{"$f":"IF(I278=\"\",\"\",IF(D278=\"\",0,IF(D278=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D278=\"Yes\"),AND($L$1=\"Scaled\",D278>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D278=\"No\"),AND($L$1=\"Scaled\",D278<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1791,"G.19","Are desktop computers used to transmit, process or store Scoped Systems and Data. If yes, is:","No",null,null,"NA","",1,null,19,0,0,0,0,0,{"$f":"IF(I279=\"\",\"\",IF(D279=\"\",0,IF(D279=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D279=\"Yes\"),AND($L$1=\"Scaled\",D279>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D279=\"No\"),AND($L$1=\"Scaled\",D279<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,1,2,1,1,0,null,null,null,1]
[842,"G.19.1","Segregation of duties for granting access and approving access?",null,null,null,"9.1.1.f","Access Control Policy",2,null,19,1,0,0,0,0,{"$f":"IF(I280=\"\",\"\",IF(D280=\"\",0,IF(D280=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D280=\"Yes\"),AND($L$1=\"Scaled\",D280>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D280=\"No\"),AND($L$1=\"Scaled\",D280<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[845,"G.19.2","Segregation of duties for approving and implementing access requests?",null,null,null,"6.1.2 ","Segregation Of Duties",2,null,19,2,0,0,0,0,{"$f":"IF(I281=\"\",\"\",IF(D281=\"\",0,IF(D281=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D281=\"Yes\"),AND($L$1=\"Scaled\",D281>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D281=\"No\"),AND($L$1=\"Scaled\",D281<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2954,"G.19.3","User able to use removable media (floppy disk, recordable CD, USB drive) without detection?",null,null,null,"8.3.1.b","Management of removable media",2,null,19,3,0,0,0,0,{"$f":"IF(I282=\"\",\"\",IF(D282=\"\",0,IF(D282=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D282=\"Yes\"),AND($L$1=\"Scaled\",D282>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D282=\"No\"),AND($L$1=\"Scaled\",D282<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[843,"G.19.4","User of a system also responsible for reviewing its security audit logs?",null,null,null,"6.1.2 ","Segregation Of Duties",2,null,19,4,0,0,0,0,{"$f":"IF(I283=\"\",\"\",IF(D283=\"\",0,IF(D283=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D283=\"Yes\"),AND($L$1=\"Scaled\",D283>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D283=\"No\"),AND($L$1=\"Scaled\",D283<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[844,"G.19.5","Segregation of duties to prevent the user of a system from modifying or deleting its security audit logs?",null,null,null,"6.1.2 ","Segregation Of Duties",2,null,19,5,0,0,0,0,{"$f":"IF(I284=\"\",\"\",IF(D284=\"\",0,IF(D284=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D284=\"Yes\"),AND($L$1=\"Scaled\",D284>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D284=\"No\"),AND($L$1=\"Scaled\",D284<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1792,"G.19.6","Standard operating environment required?",null,null,null,"13.1.1.e","Network Controls",2,null,19,6,0,0,0,0,{"$f":"IF(I285=\"\",\"\",IF(D285=\"\",0,IF(D285=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D285=\"Yes\"),AND($L$1=\"Scaled\",D285>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D285=\"No\"),AND($L$1=\"Scaled\",D285<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1013,"G.19.7","Content filtering proxy used prior to accessing the Internet?",null,null,null,"NA","Network Routing Control",2,null,19,7,0,0,0,0,{"$f":"IF(I286=\"\",\"\",IF(D286=\"\",0,IF(D286=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D286=\"Yes\"),AND($L$1=\"Scaled\",D286>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D286=\"No\"),AND($L$1=\"Scaled\",D286<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1793,"G.19.8","Security approval required prior to implementing non-standard operating equipment?",null,null,null,"13.1.1","Network Controls",2,null,19,8,0,0,0,0,{"$f":"IF(I287=\"\",\"\",IF(D287=\"\",0,IF(D287=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D287=\"Yes\"),AND($L$1=\"Scaled\",D287>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D287=\"No\"),AND($L$1=\"Scaled\",D287<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1794,"G.19.9","Security approval required prior to implementing freeware or shareware applications?",null,null,null,"13.1.1","Network Controls",2,null,19,9,0,0,0,0,{"$f":"IF(I288=\"\",\"\",IF(D288=\"\",0,IF(D288=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D288=\"Yes\"),AND($L$1=\"Scaled\",D288>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D288=\"No\"),AND($L$1=\"Scaled\",D288<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1797,"G.19.10","Non-company managed PCs used to connect to the company network?",null,null,null,"NA","",2,null,19,10,0,0,0,0,{"$f":"IF(I289=\"\",\"\",IF(D289=\"\",0,IF(D289=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D289=\"Yes\"),AND($L$1=\"Scaled\",D289>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D289=\"No\"),AND($L$1=\"Scaled\",D289<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1798,"G.19.11","Installation of software on company-owned equipment (workstations, mobile devices) restricted to administrators?",null,null,null,"13.1.1","Network Controls",2,null,19,11,0,0,0,0,{"$f":"IF(I290=\"\",\"\",IF(D290=\"\",0,IF(D290=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D290=\"Yes\"),AND($L$1=\"Scaled\",D290>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D290=\"No\"),AND($L$1=\"Scaled\",D290<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2653,"G.19.12","Users permitted to execute mobile code?",null,null,null,"12.2.1","Controls against malware",2,null,19,12,0,0,0,0,{"$f":"IF(I291=\"\",\"\",IF(D291=\"\",0,IF(D291=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D291=\"Yes\"),AND($L$1=\"Scaled\",D291>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D291=\"No\"),AND($L$1=\"Scaled\",D291<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1803,"G.19.13","Mobile devices used?",null,null,null,"6.2.1","Mobile device policy",2,null,19,13,0,0,0,0,{"$f":"IF(I292=\"\",\"\",IF(D292=\"\",0,IF(D292=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D292=\"Yes\"),AND($L$1=\"Scaled\",D292>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D292=\"No\"),AND($L$1=\"Scaled\",D292<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[1805,"G.19.14","Encryption used to secure mobile computing devices?",null,null,null,"6.2.1.g","Mobile device policy",2,null,19,14,0,0,0,0,{"$f":"IF(I293=\"\",\"\",IF(D293=\"\",0,IF(D293=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D293=\"Yes\"),AND($L$1=\"Scaled\",D293>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D293=\"No\"),AND($L$1=\"Scaled\",D293<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]

{"sheet":"H. Access Control","index":14,"n_rows":59,"n_cols":28,"rows_kept":59,"cut":false,"hidden":false,"merged":[[2,1,2,7]]}
[10,"H. Access Control",null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,null,"Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"H"}]
[null,null,null,{"$f":"IF(W2=0,\"0%\",W2/S2)","v":1},"Percent Complete",null,null,null,{"$f":"COUNTA(I5:I59)","v":55},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(S5:S59,1)","v":52},null,null,null,{"$f":"COUNTIF(W5:W59,1)","v":52}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column E to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, check the Disable Tab Automation checkbox at the top of the page.",null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter"]
[{"$f":"MAX(A5:A59)","v":3218},"Ques Num","Question/Request","Response","Additional Information","AUP Reference","ISO Ref Num","ISO Ref Text"]
[1998,{"$f":"IF(I5=0,\"\",IF(I5=1,P$1&\".\"&K5,IF(I5=2,P$1&\".\"&K5&\".\"&L5,IF(I5=3,P$1&\".\"&K5&\".\"&L5&\".\"&M5,IF(I5=4,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5,IF(I5=5,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5))))))","v":"H.1"},"Are electronic systems used to transmit, process or store Scoped Systems and Data?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy",null,"NA","",1,null,{"$f":"IF(K4=\"\",1,IF(I5=1,K4+1,K4))","v":1},{"$f":"IF(L4=\"\",0,IF(K4<>K5,0,IF($I5=2,L4+1,L4)))","v":0},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($I5=3,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($I5=4,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($I5=5,O4+1,O4)))","v":0},{"$f":"IF(OR(Master=\"Master\",I5=0,J5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,21,FALSE)),0,VLOOKUP(A5,L2_Array,21,FALSE)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D5=\"Yes\"),AND($L$1=\"Scaled\",D5>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D5=\"No\"),AND($L$1=\"Scaled\",D5<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I5=\"\",\"\",IF(P5>0,P5,IF(Q5>0,Q5,0)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(I5=1,S4=\"\"),1,IF(OR(AND(J4=1,(I5-I3<>0)),AND(S4=0,I4=I5),AND(J4=1,I5=I3)),0,1)))","v":1},{"$f":"IF(I5=\"\",T4,IF(AND(R5>1,OR(T4=\"\",T4=0,T4>=I5)),I5,IF(I5>T4,T4,0)))","v":0},{"$f":"IF(Master=\"Master\",Q5,IF(U4=\"\",R5,IF(OR(AND(T5>0,R5<U4),AND(T5=1,R5<=U4)),U4,R5)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(S4=1,T5=1),R5>0,AND(S6=0,V6=1)),1,0))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(T5>0,S5=1),AND(S5=1,V5=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(I5=1,R5=1),2,IF(AND(U4=1,K5=K4),2,IF(AND(AB4=2,K5=K4),2,IF(I5=1,1,\"\"))))","v":2}]
[1903,{"$f":"IF(I6=0,\"\",IF(I6=1,P$1&\".\"&K6,IF(I6=2,P$1&\".\"&K6&\".\"&L6,IF(I6=3,P$1&\".\"&K6&\".\"&L6&\".\"&M6,IF(I6=4,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6,IF(I6=5,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6))))))","v":"H.1.1"},"Is there an access control policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","B.1 Information Security Policy Content","9.1.1","Access control policy",2,null,{"$f":"IF(K5=\"\",1,IF(I6=1,K5+1,K5))","v":1},{"$f":"IF(L5=\"\",0,IF(K5<>K6,0,IF($I6=2,L5+1,L5)))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($I6=3,M5+1,M5)))","v":0},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($I6=4,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($I6=5,O5+1,O5)))","v":0},{"$f":"IF(OR(Master=\"Master\",I6=0,J6=1),0,IF(ISNA(VLOOKUP(A6,L2_Array,21,FALSE)),0,VLOOKUP(A6,L2_Array,21,FALSE)))","v":0},{"$f":"IF(I6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D6=\"Yes\"),AND($L$1=\"Scaled\",D6>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D6=\"No\"),AND($L$1=\"Scaled\",D6<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I6=\"\",\"\",IF(P6>0,P6,IF(Q6>0,Q6,0)))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(I6=1,S5=\"\"),1,IF(OR(AND(J5=1,(I6-I4<>0)),AND(S5=0,I5=I6),AND(J5=1,I6=I4)),0,1)))","v":1},{"$f":"IF(I6=\"\",T5,IF(AND(R6>1,OR(T5=\"\",T5=0,T5>=I6)),I6,IF(I6>T5,T5,0)))","v":0},1,{"$f":"IF(I6=\"\",\"\",IF(OR(AND(S5=1,T6=1),R6>0,AND(S7=0,V7=1)),1,0))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(T6>0,S6=1),AND(S6=1,V6=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A6,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(I6=1,R6=1),2,IF(AND(U5=1,K6=K5),2,IF(AND(AB5=2,K6=K5),2,IF(I6=1,1,\"\"))))","v":2}]
[1908,"H.1.2","Does access control on applications, operating systems, databases, and network devices ensure users have least privilege?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy",null,"9.1.1.b","Access control policy",2,null,1,2,0,0,0,0,{"$f":"IF(I7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D7=\"Yes\"),AND($L$1=\"Scaled\",D7>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D7=\"No\"),AND($L$1=\"Scaled\",D7<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1911,"H.2","Are unique user IDs used for access?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy",null,"9.2.1.a","User registration and de-registration",1,null,2,0,0,0,0,1,{"$f":"IF(I8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D8=\"Yes\"),AND($L$1=\"Scaled\",D8>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D8=\"No\"),AND($L$1=\"Scaled\",D8<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[1913,"H.2.1","Can a user ID contain personal information (SSN, access level, admin of the user)?","No",null,null,"9.4.3.c","Password Management System",2,null,2,1,0,0,0,0,{"$f":"IF(I9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D9=\"Yes\"),AND($L$1=\"Scaled\",D9>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D9=\"No\"),AND($L$1=\"Scaled\",D9<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[3205,"H.2.2","Is an inactive user ID deleted or disabled within 90 days?","No",null,"H.4 Inactive Accounts","9.2.6","Removal or adjustment of access rights",2,null,2,2,0,0,0,0,{"$f":"IF(I10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D10=\"Yes\"),AND($L$1=\"Scaled\",D10>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D10=\"No\"),AND($L$1=\"Scaled\",D10<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[1915,"H.2.3","Can a user ID be shared?","No",null,null,"9.3.1.e","Use of secret authentication information",2,null,2,3,0,0,0,0,{"$f":"IF(I11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D11=\"Yes\"),AND($L$1=\"Scaled\",D11>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D11=\"No\"),AND($L$1=\"Scaled\",D11<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[1916,"H.2.4","Is there a process to grant and approve access to systems transmitting, processing or storing Scoped Systems and Data?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy",null,"9.1.2.b","Access to networks and network services",2,null,2,4,0,0,0,0,{"$f":"IF(I12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D12=\"Yes\"),AND($L$1=\"Scaled\",D12>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D12=\"No\"),AND($L$1=\"Scaled\",D12<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3206,"H.2.4.1","Does access to electronic systems include a formal request and management approval?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","H.3 Logical Access Authorization","9.1.2.b","Access to networks and network services",3,null,2,4,1,0,0,0,{"$f":"IF(I13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D13=\"Yes\"),AND($L$1=\"Scaled\",D13>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D13=\"No\"),AND($L$1=\"Scaled\",D13<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1922,"H.2.4.2","Are approved requests for granting access logged, archived and maintained?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy",null,"9.2.5.e","Review of user access rights",3,null,2,4,2,0,0,0,{"$f":"IF(I14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D14=\"Yes\"),AND($L$1=\"Scaled\",D14>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D14=\"No\"),AND($L$1=\"Scaled\",D14<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1939,"H.2.5","Is system access limited by:",null,null,null,"9.4.1","Information access restriction",2,1,2,5,0,0,0,0,{"$f":"IF(I15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D15=\"Yes\"),AND($L$1=\"Scaled\",D15>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D15=\"No\"),AND($L$1=\"Scaled\",D15<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,1,1,0,null,null,null,2]
[1940,"H.2.5.1","Time of day?","No",null,null,"NA",null,3,null,2,5,1,0,0,0,{"$f":"IF(I16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D16=\"Yes\"),AND($L$1=\"Scaled\",D16>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D16=\"No\"),AND($L$1=\"Scaled\",D16<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,0,3,2,1,0,0,null,null,null,2]
[1943,"H.2.5.2","Physical location?","No",null,null,"NA","",3,null,2,5,2,0,0,0,{"$f":"IF(I17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D17=\"Yes\"),AND($L$1=\"Scaled\",D17>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D17=\"No\"),AND($L$1=\"Scaled\",D17<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,0,3,2,1,0,0,null,null,null,2]
[1945,"H.2.5.3","Network subnet?","No",null,null,"NA","",3,null,2,5,3,0,0,0,{"$f":"IF(I18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D18=\"Yes\"),AND($L$1=\"Scaled\",D18>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D18=\"No\"),AND($L$1=\"Scaled\",D18<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,0,3,2,1,0,0,null,null,null,2]
[3207,"H.2.6","Are user access rights reviewed at least quarterly?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy",null,"9.2.5.a","Review Of User Access Rights",2,null,2,6,0,0,0,0,{"$f":"IF(I19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D19=\"Yes\"),AND($L$1=\"Scaled\",D19>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D19=\"No\"),AND($L$1=\"Scaled\",D19<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2654,"H.2.7","Are access rights reviewed when a constituent changes roles?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy",null,"9.2.5.b","Review Of User Access Rights",2,null,2,7,0,0,0,0,{"$f":"IF(I20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D20=\"Yes\"),AND($L$1=\"Scaled\",D20>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D20=\"No\"),AND($L$1=\"Scaled\",D20<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2655,"H.2.8","Are reviews of privileged systems conducted to ensure unauthorized privileges have not been obtained?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy",null,"9.2.5.d","Review Of User Access Rights",2,null,2,8,0,0,0,0,{"$f":"IF(I21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D21=\"Yes\"),AND($L$1=\"Scaled\",D21>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D21=\"No\"),AND($L$1=\"Scaled\",D21<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3208,"H.2.9","Are privileged user access rights reviewed at least quarterly?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy",null,"9.2.5.c","Review Of User Access Rights",2,null,2,9,0,0,0,0,{"$f":"IF(I22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D22=\"Yes\"),AND($L$1=\"Scaled\",D22>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D22=\"No\"),AND($L$1=\"Scaled\",D22<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2656,"H.2.10","Are changes to privileged user access rights logged?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy",null,"9.2.5.e","Review Of User Access Rights",2,null,2,10,0,0,0,0,{"$f":"IF(I23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D23=\"Yes\"),AND($L$1=\"Scaled\",D23>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D23=\"No\"),AND($L$1=\"Scaled\",D23<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3209,"H.2.11","Are there logon banners for all electronic systems access?","No",null,"L.1 Presence of Log-on Banners","9.4.2.b","Secure Log-On Procedures",2,null,2,11,0,0,0,0,{"$f":"IF(I24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D24=\"Yes\"),AND($L$1=\"Scaled\",D24>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D24=\"No\"),AND($L$1=\"Scaled\",D24<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[2006,"H.2.12","Upon logon failure, does the error message describe the cause of the failure to the user (Invalid password, invalid user ID, etc.)?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy",null,"9.4.2.d","Secure Log-On Procedures",2,null,2,12,0,0,0,0,{"$f":"IF(I25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D25=\"Yes\"),AND($L$1=\"Scaled\",D25>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D25=\"No\"),AND($L$1=\"Scaled\",D25<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2007,"H.2.13","Upon successful logon, does a message indicate the last time of successful logon?","No",null,null,"9.4.2.h","Secure Log-On Procedures",2,null,2,13,0,0,0,0,{"$f":"IF(I26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D26=\"Yes\"),AND($L$1=\"Scaled\",D26>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D26=\"No\"),AND($L$1=\"Scaled\",D26<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[1910,"H.2.14","Is multi-factor authentication deployed for “high-risk” environments?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy",null,"9.1.2.e","Access to networks and network services",2,null,2,14,0,0,0,0,{"$f":"IF(I27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D27=\"Yes\"),AND($L$1=\"Scaled\",D27>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D27=\"No\"),AND($L$1=\"Scaled\",D27<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1912,"H.2.15","Do all users have a unique user ID when accessing applications?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy",null,"9.2.1.a","User registration and de-registration",2,null,2,15,0,0,0,0,{"$f":"IF(I28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D28=\"Yes\"),AND($L$1=\"Scaled\",D28>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D28=\"No\"),AND($L$1=\"Scaled\",D28<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2657,"H.2.16","Is the use of system utilities restricted to authorized users only?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy",null,"9.4.4","Use of privileged utility programs",2,null,2,16,0,0,0,0,{"$f":"IF(I29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D29=\"Yes\"),AND($L$1=\"Scaled\",D29>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D29=\"No\"),AND($L$1=\"Scaled\",D29<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3210,"H.2.17","Do inactive workstation lock within 15 minutes?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","H.5 Controls for Unattended Systems","9.4.2.k","Secure Log-On Procedures",2,null,2,17,0,0,0,0,{"$f":"IF(I30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D30=\"Yes\"),AND($L$1=\"Scaled\",D30>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D30=\"No\"),AND($L$1=\"Scaled\",D30<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3211,"H.2.18","Do inactive sessions timeout within 15 minutes?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","H.5 Controls for Unattended Systems","9.4.2.k","Secure Log-On Procedures",2,null,2,18,0,0,0,0,{"$f":"IF(I31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D31=\"Yes\"),AND($L$1=\"Scaled\",D31>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D31=\"No\"),AND($L$1=\"Scaled\",D31<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1948,"H.3","Are passwords required to access systems transmitting, processing or storing Scoped Systems and Data?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","H.1 Access Controls","9.4.3","Password Management System",1,null,3,0,0,0,0,1,{"$f":"IF(I32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D32=\"Yes\"),AND($L$1=\"Scaled\",D32>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D32=\"No\"),AND($L$1=\"Scaled\",D32<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[1949,"H.3.1","Is there a password policy for systems that transmit, process or store Scoped Systems and Data that has been approved by management and communicated to appropriate constituents? If yes, does it include:","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","B.1 Information Security Policy Content","9.4.3","Password Management System",2,null,3,1,0,0,0,0,{"$f":"IF(I33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D33=\"Yes\"),AND($L$1=\"Scaled\",D33>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D33=\"No\"),AND($L$1=\"Scaled\",D33<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2661,"H.3.1.1","Keep passwords confidential?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","B.1 Information Security Policy Content","9.3.1.a","User responsibilities",3,null,3,1,1,0,0,0,{"$f":"IF(I34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D34=\"Yes\"),AND($L$1=\"Scaled\",D34>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D34=\"No\"),AND($L$1=\"Scaled\",D34<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2662,"H.3.1.2","Not keep a record of passwords (paper, software file or handheld device)?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","B.1 Information Security Policy Content","9.3.1.b","User responsibilities",3,null,3,1,2,0,0,0,{"$f":"IF(I35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D35=\"Yes\"),AND($L$1=\"Scaled\",D35>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D35=\"No\"),AND($L$1=\"Scaled\",D35<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1977,"H.3.1.3","Change passwords when there is an indication of possible system or password compromise?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","B.1 Information Security Policy Content","9.3.1.c","User responsibilities",3,null,3,1,3,0,0,0,{"$f":"IF(I36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D36=\"Yes\"),AND($L$1=\"Scaled\",D36>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D36=\"No\"),AND($L$1=\"Scaled\",D36<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1978,"H.3.1.4","Change passwords at regular intervals?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","B.1 Information Security Policy Content","9.4.3.e","Password Management System",3,null,3,1,4,0,0,0,{"$f":"IF(I37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D37=\"Yes\"),AND($L$1=\"Scaled\",D37>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D37=\"No\"),AND($L$1=\"Scaled\",D37<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,{"$f":"IF(Master=\"Master\",Q37,IF(U36=\"\",R37,IF(OR(AND(T37>0,R37<U36),AND(T37=1,R37<=U36)),U36,R37)))","v":1},1,1,0,null,null,null,2]
[2663,"H.3.1.5","Change temporary passwords at first logon?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","B.1 Information Security Policy Content","9.4.3.d","Password Management System",3,null,3,1,5,0,0,0,{"$f":"IF(I38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D38=\"Yes\"),AND($L$1=\"Scaled\",D38>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D38=\"No\"),AND($L$1=\"Scaled\",D38<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1979,"H.3.1.6","Not include passwords in automated logon processes? (stored in a macro or function key)?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","B.1 Information Security Policy Content","9.3.1.f","User responsibilities",3,null,3,1,6,0,0,0,{"$f":"IF(I39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D39=\"Yes\"),AND($L$1=\"Scaled\",D39>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D39=\"No\"),AND($L$1=\"Scaled\",D39<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1981,"H.3.1.7","Terminate or secure active sessions when finished?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","B.1 Information Security Policy Content","11.2.8.a","Unattended User Equipment",3,null,3,1,7,0,0,0,{"$f":"IF(I40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D40=\"Yes\"),AND($L$1=\"Scaled\",D40>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D40=\"No\"),AND($L$1=\"Scaled\",D40<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2664,"H.3.1.8","Logoff terminals, PC or servers when the session is finished?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","B.1 Information Security Policy Content","11.2.8.b","Unattended User Equipment",3,null,3,1,8,0,0,0,{"$f":"IF(I41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D41=\"Yes\"),AND($L$1=\"Scaled\",D41>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D41=\"No\"),AND($L$1=\"Scaled\",D41<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1980,"H.3.1.9","Lock (using key lock or equivalent control) when systems are unattended?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","B.1 Information Security Policy Content","11.2.8.c","Unattended User Equipment",3,null,3,1,9,0,0,0,{"$f":"IF(I42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D42=\"Yes\"),AND($L$1=\"Scaled\",D42>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D42=\"No\"),AND($L$1=\"Scaled\",D42<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1974,"H.3.1.10","Prohibit users from sharing passwords?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","B.1 Information Security Policy Content","9.3.1.g","User responsibilities",3,null,3,1,10,0,0,0,{"$f":"IF(I43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D43=\"Yes\"),AND($L$1=\"Scaled\",D43>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D43=\"No\"),AND($L$1=\"Scaled\",D43<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1975,"H.3.2","Are strong passwords required on systems transmitting, processing storing Scoped Systems and Data?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","B.1 Information Security Policy Content","9.3.1.d,                                    9.4.3.c","Use of secret authentication information,                                    Password management system",2,null,3,2,0,0,0,0,{"$f":"IF(I44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D44=\"Yes\"),AND($L$1=\"Scaled\",D44>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D44=\"No\"),AND($L$1=\"Scaled\",D44<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2008,"H.3.3","Are password files and application system data stored in different file systems?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","B.1 Information Security Policy Content","9.4.3.h","Password Management System",2,null,3,3,0,0,0,0,{"$f":"IF(I45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D45=\"Yes\"),AND($L$1=\"Scaled\",D45>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D45=\"No\"),AND($L$1=\"Scaled\",D45<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3212,"H.3.4","Are user ID and passwords communicated/distributed via separate media (e-mail and phone)?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy","B.1 Information Security Policy Content","9.2.4.d ","Management of secret authentication information for users",2,null,3,4,0,0,0,0,{"$f":"IF(I46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D46=\"Yes\"),AND($L$1=\"Scaled\",D46>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D46=\"No\"),AND($L$1=\"Scaled\",D46<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1964,"H.3.5","Are new constituents issued random initial single use passwords?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","B.1 Information Security Policy Content","9.4.3.b","Password Management System",2,null,3,5,0,0,0,0,{"$f":"IF(I47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D47=\"Yes\"),AND($L$1=\"Scaled\",D47>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D47=\"No\"),AND($L$1=\"Scaled\",D47<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3213,"H.3.6","Do temporary passwords expire within 10 days?","No","Invalid after the first login","B.1 Information Security Policy Content","NA",null,2,null,3,6,0,0,0,0,{"$f":"IF(I48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D48=\"Yes\"),AND($L$1=\"Scaled\",D48>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D48=\"No\"),AND($L$1=\"Scaled\",D48<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[3214,"H.3.7","Is a user’s identity verified prior to resetting a password?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","B.1 Information Security Policy Content","9.2.4.c","Management of secret authentication information for users",2,null,3,7,0,0,0,0,{"$f":"IF(I49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D49=\"Yes\"),AND($L$1=\"Scaled\",D49>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D49=\"No\"),AND($L$1=\"Scaled\",D49<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2659,"H.3.8","Are vendor default passwords removed, disabled or changed prior to placing the device or system into production?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","B.1 Information Security Policy Content","9.2.4.g","Management of secret authentication information for users",2,null,3,8,0,0,0,0,{"$f":"IF(I50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D50=\"Yes\"),AND($L$1=\"Scaled\",D50>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D50=\"No\"),AND($L$1=\"Scaled\",D50<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2971,"H.3.9","Is password reset authority restricted to authorized persons and/or an automated password reset tool?","Yes","Cloudamize Security Policy - Cloudamize Personnel Access Policy","B.1 Information Security Policy Content","9.3.1.f","User responsibilities",2,null,3,9,0,0,0,0,{"$f":"IF(I51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D51=\"Yes\"),AND($L$1=\"Scaled\",D51>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D51=\"No\"),AND($L$1=\"Scaled\",D51<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2028,"H.4","Is remote access permitted?","No","Cloudamize Security Policy - Cloudamize Information Security Policy",null,6.2,"Mobile devices and teleworking",1,null,4,0,0,0,0,2,{"$f":"IF(I52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D52=\"Yes\"),AND($L$1=\"Scaled\",D52>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D52=\"No\"),AND($L$1=\"Scaled\",D52<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,1,2,1,1,1,null,null,null,1]
[3215,"H.4.1","Is there a remote access policy for systems transmitting, processing and storing Scoped Systems and Data that has been approved by management and communicated to appropriate constituents?",null,null,null,"6.2.1                                        6.2.2","Mobile device policy,                  Teleworking",2,null,4,1,0,0,0,0,{"$f":"IF(I53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D53=\"Yes\"),AND($L$1=\"Scaled\",D53>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D53=\"No\"),AND($L$1=\"Scaled\",D53<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2972,"H.4.2","Is split tunneling or bridged internet connections allowed by policy and/or technical control?",null,null,null,"NA","",2,null,4,2,0,0,0,0,{"$f":"IF(I54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D54=\"Yes\"),AND($L$1=\"Scaled\",D54>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D54=\"No\"),AND($L$1=\"Scaled\",D54<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3216,"H.4.3","Is only company owned equipment permitted to connect remotely?",null,"Cloudamize Security Policy - Cloudamize Personnel Access Policy",null,"6.2.1                                        6.2.2 ","Mobile device policy,                  Teleworking",2,null,4,3,0,0,0,0,{"$f":"IF(I55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D55=\"Yes\"),AND($L$1=\"Scaled\",D55>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D55=\"No\"),AND($L$1=\"Scaled\",D55<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3217,"H.4.4","Is remote desktop technology (Citrix) used to access the network remotely?",null,null,null,"6.2.2.d","Teleworking",2,null,4,4,0,0,0,0,{"$f":"IF(I56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D56=\"Yes\"),AND($L$1=\"Scaled\",D56>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D56=\"No\"),AND($L$1=\"Scaled\",D56<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3218,"H.4.5","Are remote users prevented from copying data to remote devices?",null,null,null,"6.2.2.d","Teleworking",2,null,4,5,0,0,0,0,{"$f":"IF(I57=\"\",\"\",IF(D57=\"\",0,IF(D57=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D57=\"Yes\"),AND($L$1=\"Scaled\",D57>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D57=\"No\"),AND($L$1=\"Scaled\",D57<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2964,"H.4.6","Are encrypted communications required for all remote connections?",null,"Cloudamize Security Policy - Cloudamize Personnel Access Policy",null,"10.1.1.c","Policy on the use of cryptographic controls",2,null,4,6,0,0,0,0,{"$f":"IF(I58=\"\",\"\",IF(D58=\"\",0,IF(D58=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D58=\"Yes\"),AND($L$1=\"Scaled\",D58>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D58=\"No\"),AND($L$1=\"Scaled\",D58<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2048,"H.4.7","Is multi-factor authentication required for remote access?",null,"Cloudamize Security Policy - Cloudamize Personnel Access Policy","H.8 Two-Factor Authentication for Remote Access","9.1.2.d","Access to networks and network services",2,null,4,7,0,0,0,0,{"$f":"IF(I59=\"\",\"\",IF(D59=\"\",0,IF(D59=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D59=\"Yes\"),AND($L$1=\"Scaled\",D59>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D59=\"No\"),AND($L$1=\"Scaled\",D59<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]

{"sheet":"I. Info Sys AD&M","index":15,"n_rows":99,"n_cols":28,"rows_kept":99,"cut":false,"hidden":false,"merged":[[2,1,2,7]]}
[10,"I. Information Systems Acquisition Development & Maintenance",null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,null,"Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"I"}]
[null,null,null,{"$f":"IF(W2=0,\"0%\",W2/S2)","v":1},"Percent Complete",null,null,null,{"$f":"COUNTA(I5:I99)","v":95},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(S5:S99,1)","v":95},null,null,null,{"$f":"COUNTIF(W5:W99,1)","v":95}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column E to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, check the Disable Tab Automation checkbox at the top of the page.",null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter"]
[{"$f":"MAX(A5:A99)","v":3219},"Ques Num","Question/Request","Response","Additional Information","AUP Reference","ISO Ref Num","ISO Ref Text"]
[2665,{"$f":"IF(I5=0,\"\",IF(I5=1,P$1&\".\"&K5,IF(I5=2,P$1&\".\"&K5&\".\"&L5,IF(I5=3,P$1&\".\"&K5&\".\"&L5&\".\"&M5,IF(I5=4,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5,IF(I5=5,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5))))))","v":"I.1"},"Are business information systems used to transmit, process or store Scoped Systems and Data? If yes, are:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,14.1,"Security requirements of information systems",1,null,{"$f":"IF(K4=\"\",1,IF(I5=1,K4+1,K4))","v":1},{"$f":"IF(L4=\"\",0,IF(K4<>K5,0,IF($I5=2,L4+1,L4)))","v":0},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($I5=3,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($I5=4,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($I5=5,O4+1,O4)))","v":0},{"$f":"IF(OR(Master=\"Master\",I5=0,J5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,21,FALSE)),0,VLOOKUP(A5,L2_Array,21,FALSE)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D5=\"Yes\"),AND($L$1=\"Scaled\",D5>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D5=\"No\"),AND($L$1=\"Scaled\",D5<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I5=\"\",\"\",IF(P5>0,P5,IF(Q5>0,Q5,0)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(I5=1,S4=\"\"),1,IF(OR(AND(J4=1,(I5-I3<>0)),AND(S4=0,I4=I5),AND(J4=1,I5=I3)),0,1)))","v":1},{"$f":"IF(I5=\"\",T4,IF(AND(R5>1,OR(T4=\"\",T4=0,T4>=I5)),I5,IF(I5>T4,T4,0)))","v":0},{"$f":"IF(Master=\"Master\",Q5,IF(U4=\"\",R5,IF(OR(AND(T5>0,R5<U4),AND(T5=1,R5<=U4)),U4,R5)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(S4=1,T5=1),R5>0,AND(S6=0,V6=1)),1,0))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(T5>0,S5=1),AND(S5=1,V5=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(I5=1,R5=1),2,IF(AND(U4=1,K5=K4),2,IF(AND(AB4=2,K5=K4),2,IF(I5=1,1,\"\"))))","v":2}]
[2666,{"$f":"IF(I6=0,\"\",IF(I6=1,P$1&\".\"&K6,IF(I6=2,P$1&\".\"&K6&\".\"&L6,IF(I6=3,P$1&\".\"&K6&\".\"&L6&\".\"&M6,IF(I6=4,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6,IF(I6=5,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6))))))","v":"I.1.1"},"Security requirements documented?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","I.5 Application Security Program Governance, procedure b.1","14.1.1 ","Information security requirements analysis and specification",2,null,{"$f":"IF(K5=\"\",1,IF(I6=1,K5+1,K5))","v":1},{"$f":"IF(L5=\"\",0,IF(K5<>K6,0,IF($I6=2,L5+1,L5)))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($I6=3,M5+1,M5)))","v":0},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($I6=4,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($I6=5,O5+1,O5)))","v":0},0,{"$f":"IF(I6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D6=\"Yes\"),AND($L$1=\"Scaled\",D6>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D6=\"No\"),AND($L$1=\"Scaled\",D6<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I6=\"\",\"\",IF(P6>0,P6,IF(Q6>0,Q6,0)))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(I6=1,S5=\"\"),1,IF(OR(AND(J5=1,(I6-I4<>0)),AND(S5=0,I5=I6),AND(J5=1,I6=I4)),0,1)))","v":1},{"$f":"IF(I6=\"\",T5,IF(AND(R6>1,OR(T5=\"\",T5=0,T5>=I6)),I6,IF(I6>T5,T5,0)))","v":0},1,{"$f":"IF(I6=\"\",\"\",IF(OR(AND(S5=1,T6=1),R6>0,AND(S7=0,V7=1)),1,0))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(T6>0,S6=1),AND(S6=1,V6=1)),1,0))","v":1},0,null,null,null,{"$f":"IF(AND(I6=1,R6=1),2,IF(AND(U5=1,K6=K5),2,IF(AND(AB5=2,K6=K5),2,IF(I6=1,1,\"\"))))","v":2}]
[1795,"I.1.2","Information security reviews conducted and approved for the use or installation of open source software (Linux, Apache, etc.)?","Yes",null,null,"14.1.1 ","Information security requirements analysis and specification",2,null,1,2,0,0,0,0,{"$f":"IF(I7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D7=\"Yes\"),AND($L$1=\"Scaled\",D7>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D7=\"No\"),AND($L$1=\"Scaled\",D7<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2058,"I.2","Is application development performed? If yes, does it provide:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.2.1","Secure development policy",1,null,2,0,0,0,0,1,{"$f":"IF(I8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D8=\"Yes\"),AND($L$1=\"Scaled\",D8>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D8=\"No\"),AND($L$1=\"Scaled\",D8<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[2198,"I.2.1","Independent security evaluation or certification?","No",null,null,"NA",null,2,null,2,1,0,0,0,0,{"$f":"IF(I9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D9=\"Yes\"),AND($L$1=\"Scaled\",D9>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D9=\"No\"),AND($L$1=\"Scaled\",D9<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[2111,"I.2.2","Formal application methodology (OWASP)?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","I.2 Secure Systems Development Life Cycle (SDLC) code reviews","14.2.1 ","Secure development policy",2,null,2,2,0,0,0,0,{"$f":"IF(I10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D10=\"Yes\"),AND($L$1=\"Scaled\",D10>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D10=\"No\"),AND($L$1=\"Scaled\",D10<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2125,"I.2.3","An authenticated and maintained state for every data transaction?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.1.3.b.1","Protecting application serivices transactions",2,null,2,3,0,0,0,0,{"$f":"IF(I11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D11=\"Yes\"),AND($L$1=\"Scaled\",D11>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D11=\"No\"),AND($L$1=\"Scaled\",D11<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2126,"I.2.4","A means for secure session management?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.1.3.d","Protecting application serivices transactions",2,null,2,4,0,0,0,0,{"$f":"IF(I12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D12=\"Yes\"),AND($L$1=\"Scaled\",D12>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D12=\"No\"),AND($L$1=\"Scaled\",D12<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2129,"I.2.5","Comprehensive secure error handling?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.2.5 ","Secure system engineering principles",2,null,2,5,0,0,0,0,{"$f":"IF(I13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D13=\"Yes\"),AND($L$1=\"Scaled\",D13>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D13=\"No\"),AND($L$1=\"Scaled\",D13<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1269,"I.2.6","Audit log failures and generate an alert?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"12.4.1","Event logging",2,null,2,6,0,0,0,0,{"$f":"IF(I14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D14=\"Yes\"),AND($L$1=\"Scaled\",D14>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D14=\"No\"),AND($L$1=\"Scaled\",D14<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2182,"I.2.7","Development, test, and staging environment separate from the production environment? If so how are they separated:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"12.1.4","Separation of development, testing and operational environments",2,null,2,7,0,0,0,0,{"$f":"IF(I15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D15=\"Yes\"),AND($L$1=\"Scaled\",D15>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D15=\"No\"),AND($L$1=\"Scaled\",D15<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[849,"I.2.7.1","Logically?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"12.1.4","Separation of development, testing and operational environments",3,null,2,7,1,0,0,0,{"$f":"IF(I16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D16=\"Yes\"),AND($L$1=\"Scaled\",D16>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D16=\"No\"),AND($L$1=\"Scaled\",D16<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[850,"I.2.7.2","Physically?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"12.1.4","Separation of development, testing and operational environments",3,null,2,7,2,0,0,0,{"$f":"IF(I17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D17=\"Yes\"),AND($L$1=\"Scaled\",D17>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D17=\"No\"),AND($L$1=\"Scaled\",D17<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[852,"I.2.7.3","No segregation?","No",null,null,"12.1.4","Separation of development, testing and operational environments",3,null,2,7,3,0,0,0,{"$f":"IF(I18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D18=\"Yes\"),AND($L$1=\"Scaled\",D18>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D18=\"No\"),AND($L$1=\"Scaled\",D18<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,3,2,1,1,0,null,null,null,2]
[2059,"I.2.8","Is there a formal Software Development Life Cycle (SDLC) process? If yes, does it include:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","I.7 Application Security SDLC Phases","14.2.1 ","Secure development policy",2,null,2,8,0,0,0,1,{"$f":"IF(I19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D19=\"Yes\"),AND($L$1=\"Scaled\",D19>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D19=\"No\"),AND($L$1=\"Scaled\",D19<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[2098,"I.2.8.1","Peer code review, integration testing, and acceptance testing?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.2.2 ","System change control procedures",3,null,2,8,1,0,0,0,{"$f":"IF(I20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D20=\"Yes\"),AND($L$1=\"Scaled\",D20>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D20=\"No\"),AND($L$1=\"Scaled\",D20<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[847,"I.2.8.2","Separate source code repositories for production and non-production?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"9.4.5 ","Access control to program source code",3,null,2,8,2,0,0,0,{"$f":"IF(I21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D21=\"Yes\"),AND($L$1=\"Scaled\",D21>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D21=\"No\"),AND($L$1=\"Scaled\",D21<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2668,"I.2.9","Do IT support personnel have access to program source libraries?","No","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"9.4.5.c","Access control to program source code",2,null,2,9,0,0,0,0,{"$f":"IF(I22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D22=\"Yes\"),AND($L$1=\"Scaled\",D22>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D22=\"No\"),AND($L$1=\"Scaled\",D22<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[2669,"I.2.10","Is all access to program source libraries logged?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"9.4.5.f","Access control to program source code",2,null,2,10,0,0,0,0,{"$f":"IF(I23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D23=\"Yes\"),AND($L$1=\"Scaled\",D23>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D23=\"No\"),AND($L$1=\"Scaled\",D23<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2670,"I.2.11","Are change control procedures required for all changes to the production environment?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","G.21 Change Control","9.4.5.g","Access control to program source code",2,null,2,11,0,0,0,0,{"$f":"IF(I24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D24=\"Yes\"),AND($L$1=\"Scaled\",D24>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D24=\"No\"),AND($L$1=\"Scaled\",D24<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2144,"I.2.12","Do applications provide granular and comprehensive logging?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"12.4.1","Event logging",2,null,2,12,0,0,0,0,{"$f":"IF(I25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D25=\"Yes\"),AND($L$1=\"Scaled\",D25>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D25=\"No\"),AND($L$1=\"Scaled\",D25<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2070,"I.2.13","Are application sessions set to time out within 15 minutes or less?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","H.5 Controls for Unattended Systems","9.4.2.k","Secure log-on procedures",2,null,2,13,0,0,0,0,{"$f":"IF(I26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D26=\"Yes\"),AND($L$1=\"Scaled\",D26>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D26=\"No\"),AND($L$1=\"Scaled\",D26<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2153,"I.2.14","Is application development third party / outsourced developers onshore?","No","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.2.7 ","Outsourced development",2,null,2,14,0,0,0,0,{"$f":"IF(I27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D27=\"Yes\"),AND($L$1=\"Scaled\",D27>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D27=\"No\"),AND($L$1=\"Scaled\",D27<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[2154,"I.2.15","Is application development third party / outsourced developers offshore?","No","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.2.7 ","Outsourced development",2,null,2,15,0,0,0,0,{"$f":"IF(I28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D28=\"Yes\"),AND($L$1=\"Scaled\",D28>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D28=\"No\"),AND($L$1=\"Scaled\",D28<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[2155,"I.2.16","Are there access controls to protect source code and test data?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"9.4.5 ","Access control to program source code",2,null,2,16,0,0,0,0,{"$f":"IF(I29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D29=\"Yes\"),AND($L$1=\"Scaled\",D29>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D29=\"No\"),AND($L$1=\"Scaled\",D29<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2160,"I.2.17","Does the version management system provide segregation of code, data and environments?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"9.4.5 ","Access control to program source code",2,null,2,17,0,0,0,0,{"$f":"IF(I30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D30=\"Yes\"),AND($L$1=\"Scaled\",D30>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D30=\"No\"),AND($L$1=\"Scaled\",D30<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2164,"I.2.18","Do changes to applications or application code go through a risk assessment including application testing?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.2.2                                       14.2.4.a","System change control procedures,                                Restrictions on changes to software packages",2,null,2,18,0,0,0,0,{"$f":"IF(I31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D31=\"Yes\"),AND($L$1=\"Scaled\",D31>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D31=\"No\"),AND($L$1=\"Scaled\",D31<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2169,"I.2.19","Is Scoped Systems and Data ever used in the test, development, or QA environments? If yes, is:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.3.1 ","Protection of test data",2,null,2,19,0,0,0,0,{"$f":"IF(I32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D32=\"Yes\"),AND($L$1=\"Scaled\",D32>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D32=\"No\"),AND($L$1=\"Scaled\",D32<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2672,"I.2.19.1","Authorization required when production data is copied to the test environment?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","I.7 Application Security SDLC Phases","14.3.1.b","Protection of test data",3,null,2,19,1,0,0,0,{"$f":"IF(I33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D33=\"Yes\"),AND($L$1=\"Scaled\",D33>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D33=\"No\"),AND($L$1=\"Scaled\",D33<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2171,"I.2.19.2","Test data destroyed following the testing phase?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.3.1.c","Protection of test data",3,null,2,19,2,0,0,0,{"$f":"IF(I34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D34=\"Yes\"),AND($L$1=\"Scaled\",D34>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D34=\"No\"),AND($L$1=\"Scaled\",D34<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2170,"I.2.19.3","Test data masked or obfuscated during the testing phase?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.3.1","Protection of test data",3,null,2,19,3,0,0,0,{"$f":"IF(I35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D35=\"Yes\"),AND($L$1=\"Scaled\",D35>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D35=\"No\"),AND($L$1=\"Scaled\",D35<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2673,"I.2.19.4","Copying to the test environment logged?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.3.1.d","Protection of test data",3,null,2,19,4,0,0,0,{"$f":"IF(I36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D36=\"Yes\"),AND($L$1=\"Scaled\",D36>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D36=\"No\"),AND($L$1=\"Scaled\",D36<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2019,"I.2.20","Are developers permitted to:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.2.1","Secure development policy",2,null,2,20,0,0,0,{"$f":"IF(OR(Master=\"Master\",I37=0,J37=1),0,IF(ISNA(VLOOKUP(A37,L2_Array,21,FALSE)),0,VLOOKUP(A37,L2_Array,21,FALSE)))","v":0},{"$f":"IF(I37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D37=\"Yes\"),AND($L$1=\"Scaled\",D37>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D37=\"No\"),AND($L$1=\"Scaled\",D37<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,{"$f":"IF(Master=\"Master\",Q37,IF(U36=\"\",R37,IF(OR(AND(T37>0,R37<U36),AND(T37=1,R37<=U36)),U36,R37)))","v":1},1,1,{"$f":"IF(ISNA(VLOOKUP(A37,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,2]
[2020,"I.2.20.1","Access production environments, including read only access?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.2.1.b","Secure development policy",3,null,2,20,1,0,0,0,{"$f":"IF(I38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D38=\"Yes\"),AND($L$1=\"Scaled\",D38>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D38=\"No\"),AND($L$1=\"Scaled\",D38<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1909,"I.2.20.2","Access systems and applications based on established profiles that define responsibilities or job functions?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"9.1.1","Access Control Policy",3,null,2,20,2,0,0,0,{"$f":"IF(I39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D39=\"Yes\"),AND($L$1=\"Scaled\",D39>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D39=\"No\"),AND($L$1=\"Scaled\",D39<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2027,"I.2.20.3","Request or obtain access outside an established role (emergency access)?","No","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"9.2.3.b","Management of privileged access rights",3,null,2,20,3,0,0,0,{"$f":"IF(I40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D40=\"Yes\"),AND($L$1=\"Scaled\",D40>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D40=\"No\"),AND($L$1=\"Scaled\",D40<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,3,2,1,1,0,null,null,null,2]
[2970,"I.2.21","Are system, vendor, or service accounts disallowed for normal operations and monitored for usage?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"NA",null,2,null,2,21,0,0,0,0,{"$f":"IF(I41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D41=\"Yes\"),AND($L$1=\"Scaled\",D41>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D41=\"No\"),AND($L$1=\"Scaled\",D41<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2674,"I.2.22","Are access control procedures the same for both the test and production environment?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","H.5 Controls for Unattended Systems","14.3.1.a","Protection of test data",2,null,2,22,0,0,0,0,{"$f":"IF(I42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D42=\"Yes\"),AND($L$1=\"Scaled\",D42>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D42=\"No\"),AND($L$1=\"Scaled\",D42<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2172,"I.2.23","Prior to implementation, do applications go through a risk assessment and approval by security?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","I.7 Application Security SDLC Phases, I.8 Security Review of Internal and External Applications","14.2.2                                       14.2.4.a","System change control procedures,                                Restrictions on changes to software packages",2,null,2,23,0,0,0,0,{"$f":"IF(I43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D43=\"Yes\"),AND($L$1=\"Scaled\",D43>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D43=\"No\"),AND($L$1=\"Scaled\",D43<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2177,"I.2.24","Is Internet facing software and infrastructure tested prior to implementation? If yes, does the testing include:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","I.6 Application Security Vulnerability Assessment and Remediation","14.1.1","Information security requirements analysis and specification",2,null,2,24,0,0,0,0,{"$f":"IF(I44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D44=\"Yes\"),AND($L$1=\"Scaled\",D44>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D44=\"No\"),AND($L$1=\"Scaled\",D44<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2179,"I.2.24.1","Issue tracking and resolution?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.1.1","Information security requirements analysis and specification",3,null,2,24,1,0,0,0,{"$f":"IF(I45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D45=\"Yes\"),AND($L$1=\"Scaled\",D45>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D45=\"No\"),AND($L$1=\"Scaled\",D45<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2180,"I.2.24.2","Metrics on software defects and release incidents?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.1.1","Information security requirements analysis and specification",3,null,2,24,2,0,0,0,{"$f":"IF(I46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D46=\"Yes\"),AND($L$1=\"Scaled\",D46>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D46=\"No\"),AND($L$1=\"Scaled\",D46<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2204,"I.2.25","Is there a documented change management / change control process? If yes, does it include:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","G.21 Change Control","14.2.2 ","System change control procedures",2,null,2,25,0,0,0,0,{"$f":"IF(I47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D47=\"Yes\"),AND($L$1=\"Scaled\",D47>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D47=\"No\"),AND($L$1=\"Scaled\",D47<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2206,"I.2.25.1","Testing prior to deployment?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","I.7 Application Security SDLC Phases","12.5.1.c ","Installation of software on operational systems",3,null,2,25,1,0,0,0,{"$f":"IF(I48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D48=\"Yes\"),AND($L$1=\"Scaled\",D48>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D48=\"No\"),AND($L$1=\"Scaled\",D48<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2207,"I.2.25.2","Management approval prior to deployment?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","I.8 Security Review of Internal and External Applications","12.5.1.a                                    14.2.2.f ","Installation of software on operational systems                              System change control procedures",3,null,2,25,2,0,0,0,{"$f":"IF(I49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D49=\"Yes\"),AND($L$1=\"Scaled\",D49>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D49=\"No\"),AND($L$1=\"Scaled\",D49<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2208,"I.2.25.3","Establishment of restart points?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"12.5.1.e","Control Of Operational Software",3,null,2,25,3,0,0,0,{"$f":"IF(I50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D50=\"Yes\"),AND($L$1=\"Scaled\",D50>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D50=\"No\"),AND($L$1=\"Scaled\",D50<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2209,"I.2.25.4","Management approval for changes?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.2.2.f","System change control procedures",3,null,2,25,4,0,0,0,{"$f":"IF(I51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D51=\"Yes\"),AND($L$1=\"Scaled\",D51>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D51=\"No\"),AND($L$1=\"Scaled\",D51<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2675,"I.2.25.5","Requirements for the transfer of software from development to production?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"12.1.4.a ","Separation of development, testing and operational environments",3,null,2,25,5,0,0,0,{"$f":"IF(I52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D52=\"Yes\"),AND($L$1=\"Scaled\",D52>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D52=\"No\"),AND($L$1=\"Scaled\",D52<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2210,"I.2.25.6","Review of code changes by information security?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","I.2 Secure Systems Development Life Cycle (SDLC) code reviews","12.5.1.c ","Installation of software on operational systems",3,null,2,25,6,0,0,0,{"$f":"IF(I53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D53=\"Yes\"),AND($L$1=\"Scaled\",D53>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D53=\"No\"),AND($L$1=\"Scaled\",D53<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2676,"I.2.25.7","Stakeholder communication and/or approvals?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","G.21 Change Control","14.2.2.f","System change control procedures",3,null,2,25,7,0,0,0,{"$f":"IF(I54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D54=\"Yes\"),AND($L$1=\"Scaled\",D54>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D54=\"No\"),AND($L$1=\"Scaled\",D54<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2677,"I.2.25.8","A list of individuals authorized to approve changes?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","G.21 Change Control","14.2.2.a","System change control procedures",3,null,2,25,8,0,0,0,{"$f":"IF(I55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D55=\"Yes\"),AND($L$1=\"Scaled\",D55>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D55=\"No\"),AND($L$1=\"Scaled\",D55<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2678,"I.2.25.9","An impact assessment to review all affected systems and applications?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.2.2.e","System change control procedures",3,null,2,25,9,0,0,0,{"$f":"IF(I56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D56=\"Yes\"),AND($L$1=\"Scaled\",D56>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D56=\"No\"),AND($L$1=\"Scaled\",D56<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2679,"I.2.25.10","Documentation for all system changes?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","G.21 Change Control","14.2.2.h","System change control procedures",3,null,2,25,10,0,0,0,{"$f":"IF(I57=\"\",\"\",IF(D57=\"\",0,IF(D57=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D57=\"Yes\"),AND($L$1=\"Scaled\",D57>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D57=\"No\"),AND($L$1=\"Scaled\",D57<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2680,"I.2.25.11","Version control for all software?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.2.2.i","System change control procedures",3,null,2,25,11,0,0,0,{"$f":"IF(I58=\"\",\"\",IF(D58=\"\",0,IF(D58=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D58=\"Yes\"),AND($L$1=\"Scaled\",D58>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D58=\"No\"),AND($L$1=\"Scaled\",D58<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2681,"I.2.25.12","Logging of all change requests?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","G.21 Change Control","14.2.2.j","System change control procedures",3,null,2,25,12,0,0,0,{"$f":"IF(I59=\"\",\"\",IF(D59=\"\",0,IF(D59=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D59=\"Yes\"),AND($L$1=\"Scaled\",D59>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D59=\"No\"),AND($L$1=\"Scaled\",D59<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2682,"I.2.25.13","Changes only take place during specified and agreed upon times (green zone)?","No",null,"G.21 Change Control","14.2.2.l","System change control procedures",3,null,2,25,13,0,0,0,{"$f":"IF(I60=\"\",\"\",IF(D60=\"\",0,IF(D60=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D60=\"Yes\"),AND($L$1=\"Scaled\",D60>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D60=\"No\"),AND($L$1=\"Scaled\",D60<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,3,2,1,1,0,null,null,null,2]
[2212,"I.2.25.14","Modifications and changes to software are strictly controlled?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","G.21 Change Control","14.2.2.e","System change control procedures",3,null,2,25,14,0,0,0,{"$f":"IF(I61=\"\",\"\",IF(D61=\"\",0,IF(D61=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D61=\"Yes\"),AND($L$1=\"Scaled\",D61>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D61=\"No\"),AND($L$1=\"Scaled\",D61<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2683,"I.2.26","Are audit logs maintained and reviewed for all program library updates?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"12.5.1.f ","Installation of software on operational systems",2,null,2,26,0,0,0,0,{"$f":"IF(I62=\"\",\"\",IF(D62=\"\",0,IF(D62=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D62=\"Yes\"),AND($L$1=\"Scaled\",D62>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D62=\"No\"),AND($L$1=\"Scaled\",D62<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2684,"I.2.27","Are compilers, editors or other development tools present in the production environment?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"12.1.4.e","Separation of development, testing and operational environments",2,null,2,27,0,0,0,0,{"$f":"IF(I63=\"\",\"\",IF(D63=\"\",0,IF(D63=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D63=\"Yes\"),AND($L$1=\"Scaled\",D63>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D63=\"No\"),AND($L$1=\"Scaled\",D63<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2872,"I.3","Are criteria for accepting new information systems, upgrades, and new versions established? If yes, do they include:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"12.1.3                                      14.2.9","Capacity management, System acceptance",1,null,3,0,0,0,0,0,{"$f":"IF(I64=\"\",\"\",IF(D64=\"\",0,IF(D64=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D64=\"Yes\"),AND($L$1=\"Scaled\",D64>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D64=\"No\"),AND($L$1=\"Scaled\",D64<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2874,"I.3.1","Performance and computer capacity requirements?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"12.1.3","Capacity management",2,null,3,1,0,0,0,0,{"$f":"IF(I65=\"\",\"\",IF(D65=\"\",0,IF(D65=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D65=\"Yes\"),AND($L$1=\"Scaled\",D65>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D65=\"No\"),AND($L$1=\"Scaled\",D65<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2875,"I.3.2","Error recovery and restart procedures?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"12.1.1.h","Documented operating procedures",2,null,3,2,0,0,0,0,{"$f":"IF(I66=\"\",\"\",IF(D66=\"\",0,IF(D66=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D66=\"Yes\"),AND($L$1=\"Scaled\",D66>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D66=\"No\"),AND($L$1=\"Scaled\",D66<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2876,"I.3.3","Preparation and testing of operating procedures?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.2.2","System change control procedures",2,null,3,3,0,0,0,0,{"$f":"IF(I67=\"\",\"\",IF(D67=\"\",0,IF(D67=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D67=\"Yes\"),AND($L$1=\"Scaled\",D67>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D67=\"No\"),AND($L$1=\"Scaled\",D67<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2877,"I.3.4","Agreed set of security controls?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.2.9","System acceptance testing",2,null,3,4,0,0,0,0,{"$f":"IF(I68=\"\",\"\",IF(D68=\"\",0,IF(D68=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D68=\"Yes\"),AND($L$1=\"Scaled\",D68>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D68=\"No\"),AND($L$1=\"Scaled\",D68<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2878,"I.3.5","Effective manual procedures?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,null,null,2,null,3,5,0,0,0,{"$f":"IF(OR(Master=\"Master\",I69=0,J69=1),0,IF(ISNA(VLOOKUP(A69,L2_Array,21,FALSE)),0,VLOOKUP(A69,L2_Array,21,FALSE)))","v":0},{"$f":"IF(I69=\"\",\"\",IF(D69=\"\",0,IF(D69=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D69=\"Yes\"),AND($L$1=\"Scaled\",D69>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D69=\"No\"),AND($L$1=\"Scaled\",D69<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,{"$f":"IF(Master=\"Master\",Q69,IF(U68=\"\",R69,IF(OR(AND(T69>0,R69<U68),AND(T69=1,R69<=U68)),U68,R69)))","v":1},1,1,{"$f":"IF(ISNA(VLOOKUP(A69,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,2]
[2879,{"$f":"IF(I70=0,\"\",IF(I70=1,P$1&\".\"&K70,IF(I70=2,P$1&\".\"&K70&\".\"&L70,IF(I70=3,P$1&\".\"&K70&\".\"&L70&\".\"&M70,IF(I70=4,P$1&\".\"&K70&\".\"&L70&\".\"&M70&\".\"&N70,IF(I70=5,P$1&\".\"&K70&\".\"&L70&\".\"&M70&\".\"&N70&\".\"&O70))))))","v":"I.3.6"},"Business continuity arrangements?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.2.3.c","Technical review of applications after operating platform changes",2,null,{"$f":"IF(K69=\"\",1,IF(I70=1,K69+1,K69))","v":3},{"$f":"IF(L69=\"\",0,IF(K69<>K70,0,IF($I70=2,L69+1,L69)))","v":6},{"$f":"IF(M69=\"\",0,IF(L69<>L70,0,IF($I70=3,M69+1,M69)))","v":0},{"$f":"IF(N69=\"\",0,IF(M69<>M70,0,IF($I70=4,N69+1,N69)))","v":0},{"$f":"IF(O69=\"\",0,IF(N69<>N70,0,IF($I70=5,O69+1,O69)))","v":0},0,{"$f":"IF(I70=\"\",\"\",IF(D70=\"\",0,IF(D70=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D70=\"Yes\"),AND($L$1=\"Scaled\",D70>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D70=\"No\"),AND($L$1=\"Scaled\",D70<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I70=\"\",\"\",IF(P70>0,P70,IF(Q70>0,Q70,0)))","v":1},{"$f":"IF(I70=\"\",\"\",IF(OR(I70=1,S69=\"\"),1,IF(OR(AND(J69=1,(I70-I68<>0)),AND(S69=0,I69=I70),AND(J69=1,I70=I68)),0,1)))","v":1},{"$f":"IF(I70=\"\",T69,IF(AND(R70>1,OR(T69=\"\",T69=0,T69>=I70)),I70,IF(I70>T69,T69,0)))","v":0},1,{"$f":"IF(I70=\"\",\"\",IF(OR(AND(S69=1,T70=1),R70>0,AND(S71=0,V71=1)),1,0))","v":1},{"$f":"IF(I70=\"\",\"\",IF(OR(AND(T70>0,S70=1),AND(S70=1,V70=1)),1,0))","v":1},0,null,null,null,{"$f":"IF(AND(I70=1,R70=1),2,IF(AND(U69=1,K70=K69),2,IF(AND(AB69=2,K70=K69),2,IF(I70=1,1,\"\"))))","v":2}]
[2880,"I.3.7","Evidence that new system will not adversely affect existing systems, particularly at peak processing times, such as month end?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.2.3.a","Technical review of applications after operating platform changes",2,null,3,7,0,0,0,0,{"$f":"IF(I71=\"\",\"\",IF(D71=\"\",0,IF(D71=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D71=\"Yes\"),AND($L$1=\"Scaled\",D71>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D71=\"No\"),AND($L$1=\"Scaled\",D71<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2881,"I.3.8","Evidence of the effect on the overall security of the respondent?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.2.2.c","System change control procedures",2,null,3,8,0,0,0,0,{"$f":"IF(I72=\"\",\"\",IF(D72=\"\",0,IF(D72=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D72=\"Yes\"),AND($L$1=\"Scaled\",D72>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D72=\"No\"),AND($L$1=\"Scaled\",D72<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2595,"I.4","Are system resources reviewed to ensure adequate capacity is maintained?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"12.1.3","Capacity Management",1,null,4,0,0,0,0,0,{"$f":"IF(I73=\"\",\"\",IF(D73=\"\",0,IF(D73=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D73=\"Yes\"),AND($L$1=\"Scaled\",D73>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D73=\"No\"),AND($L$1=\"Scaled\",D73<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2213,"I.5","Are systems and applications patched? If yes, does it include:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","I.4 System Patching","12.6.1 ","Management of technical vulnerabilities",1,null,5,0,0,0,0,1,{"$f":"IF(I74=\"\",\"\",IF(D74=\"\",0,IF(D74=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D74=\"Yes\"),AND($L$1=\"Scaled\",D74>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D74=\"No\"),AND($L$1=\"Scaled\",D74<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[2215,"I.5.1","Testing of patches, service packs, and hot fixes prior to installation?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","I.4 System Patching","12.6.1.g","Management of technical vulnerabilities",2,null,5,1,0,0,0,0,{"$f":"IF(I75=\"\",\"\",IF(D75=\"\",0,IF(D75=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D75=\"Yes\"),AND($L$1=\"Scaled\",D75>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D75=\"No\"),AND($L$1=\"Scaled\",D75<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2217,"I.5.2","Evaluation and prioritize vulnerabilities?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","I.6 Application Security Vulnerability Assessment and Remediation","12.6.1.f","Management of technical vulnerabilities",2,null,5,2,0,0,0,0,{"$f":"IF(I76=\"\",\"\",IF(D76=\"\",0,IF(D76=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D76=\"Yes\"),AND($L$1=\"Scaled\",D76>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D76=\"No\"),AND($L$1=\"Scaled\",D76<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2686,"I.5.3","Logging?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"12.6.1.h","Management of technical vulnerabilities",2,null,5,3,0,0,0,0,{"$f":"IF(I77=\"\",\"\",IF(D77=\"\",0,IF(D77=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D77=\"Yes\"),AND($L$1=\"Scaled\",D77>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D77=\"No\"),AND($L$1=\"Scaled\",D77<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2687,"I.5.4","Priority patching of high-risk systems first?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","I.4 System Patching","12.6.1.j","Management of technical vulnerabilities",2,null,5,4,0,0,0,0,{"$f":"IF(I78=\"\",\"\",IF(D78=\"\",0,IF(D78=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D78=\"Yes\"),AND($L$1=\"Scaled\",D78>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D78=\"No\"),AND($L$1=\"Scaled\",D78<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2216,"I.5.5","Are third party alert services used to keep up to date with the latest vulnerabilities?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"12.6.1.b","Management of technical vulnerabilities",2,null,5,5,0,0,0,0,{"$f":"IF(I79=\"\",\"\",IF(D79=\"\",0,IF(D79=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D79=\"Yes\"),AND($L$1=\"Scaled\",D79>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D79=\"No\"),AND($L$1=\"Scaled\",D79<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2230,"I.6","Is a web site supported, hosted or maintained that has access to Scoped Systems and Data? If yes, is there:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"NA",null,1,null,6,0,0,0,0,1,{"$f":"IF(I80=\"\",\"\",IF(D80=\"\",0,IF(D80=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D80=\"Yes\"),AND($L$1=\"Scaled\",D80>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D80=\"No\"),AND($L$1=\"Scaled\",D80<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[2231,"I.6.1","Regular penetration tests executed against web-based applications?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy","I.1 Application Vulnerability Assessments/Ethical Hacking","18.2.3 ","Technical compliance review",2,null,6,1,0,0,0,0,{"$f":"IF(I81=\"\",\"\",IF(D81=\"\",0,IF(D81=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D81=\"Yes\"),AND($L$1=\"Scaled\",D81>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D81=\"No\"),AND($L$1=\"Scaled\",D81<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2076,"I.6.2","Physical separation of server components (web, application, database)?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"13.1.3 ","Segragation in networks",2,null,6,2,0,0,0,0,{"$f":"IF(I82=\"\",\"\",IF(D82=\"\",0,IF(D82=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D82=\"Yes\"),AND($L$1=\"Scaled\",D82>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D82=\"No\"),AND($L$1=\"Scaled\",D82<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2081,"I.6.3","Web applications configured to follow best practices or security guidelines (OWASP)?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"13.1.1","Network Controls",2,null,6,3,0,0,0,0,{"$f":"IF(I83=\"\",\"\",IF(D83=\"\",0,IF(D83=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D83=\"Yes\"),AND($L$1=\"Scaled\",D83>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D83=\"No\"),AND($L$1=\"Scaled\",D83<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2109,"I.6.4","Data input into applications validated for accuracy?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.2.1","Securing application services on public networks",2,null,6,4,0,0,0,0,{"$f":"IF(I84=\"\",\"\",IF(D84=\"\",0,IF(D84=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D84=\"Yes\"),AND($L$1=\"Scaled\",D84>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D84=\"No\"),AND($L$1=\"Scaled\",D84<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2110,"I.6.5","Validation checks include cross site scripting and SQL injections?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy",null,"14.2.1","Securing application services on public networks",2,null,6,5,0,0,0,0,{"$f":"IF(I85=\"\",\"\",IF(D85=\"\",0,IF(D85=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D85=\"Yes\"),AND($L$1=\"Scaled\",D85>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D85=\"No\"),AND($L$1=\"Scaled\",D85<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2225,"I.7","Are vulnerability tests (internal/external) performed on all applications at least annually? If yes, are there:","Yes","Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)","I.1 Application Vulnerability Assessments/Ethical Hacking","18.2.3","Technical compliance review",1,null,7,0,0,0,0,1,{"$f":"IF(I86=\"\",\"\",IF(D86=\"\",0,IF(D86=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D86=\"Yes\"),AND($L$1=\"Scaled\",D86>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D86=\"No\"),AND($L$1=\"Scaled\",D86<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[2220,"I.7.1","Results tracked, remediated and reported to management?","Yes","Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)",null,"18.2.2","Compliance With Security Policies And Standards",2,null,7,1,0,0,0,0,{"$f":"IF(I87=\"\",\"\",IF(D87=\"\",0,IF(D87=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D87=\"Yes\"),AND($L$1=\"Scaled\",D87>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D87=\"No\"),AND($L$1=\"Scaled\",D87<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2233,"I.7.2","Processes to manage threat and vulnerability assessment tools and the data they collect?","Yes","Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)","I.5 Application Security Program Governance","12.6.1","Management of technical vulnerabilities",2,null,7,2,0,0,0,0,{"$f":"IF(I88=\"\",\"\",IF(D88=\"\",0,IF(D88=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D88=\"Yes\"),AND($L$1=\"Scaled\",D88>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D88=\"No\"),AND($L$1=\"Scaled\",D88<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1806,"I.8","Are encryption tools managed and maintained for Scoped Data? If yes, is there:","Yes","Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)","G.22 Data Security Policy - Encryption",10.1,"Cytographic controls",1,null,8,0,0,0,0,1,{"$f":"IF(I89=\"\",\"\",IF(D89=\"\",0,IF(D89=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D89=\"Yes\"),AND($L$1=\"Scaled\",D89>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D89=\"No\"),AND($L$1=\"Scaled\",D89<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[1807,"I.8.1","An encryption policy?","Yes","Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)","G.22 Data Security Policy - Encryption","10.1.1","Policy On The Use Of Cryptographic Controls",2,null,8,1,0,0,0,0,{"$f":"IF(I90=\"\",\"\",IF(D90=\"\",0,IF(D90=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D90=\"Yes\"),AND($L$1=\"Scaled\",D90>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D90=\"No\"),AND($L$1=\"Scaled\",D90<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1813,"I.8.2","Encryption in storage / at rest?","Yes","Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)","G.22 Data Security Policy - Encryption","10.1.1 Section 2.a","Policy On The Use Of Cryptographic Controls",2,null,8,2,0,0,0,0,{"$f":"IF(I91=\"\",\"\",IF(D91=\"\",0,IF(D91=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D91=\"Yes\"),AND($L$1=\"Scaled\",D91>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D91=\"No\"),AND($L$1=\"Scaled\",D91<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3219,"I.8.3","Clear text data ever visible by anyone, including system administrators?","No","Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)",null,"NA",null,2,null,8,3,0,0,0,0,{"$f":"IF(I92=\"\",\"\",IF(D92=\"\",0,IF(D92=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D92=\"Yes\"),AND($L$1=\"Scaled\",D92>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D92=\"No\"),AND($L$1=\"Scaled\",D92<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[1814,"I.8.4","Centralized key management system?","Yes","Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)","G.22 Data Security Policy - Encryption","10.1.2","Key Management",2,null,8,4,0,0,0,0,{"$f":"IF(I93=\"\",\"\",IF(D93=\"\",0,IF(D93=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D93=\"Yes\"),AND($L$1=\"Scaled\",D93>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D93=\"No\"),AND($L$1=\"Scaled\",D93<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1815,"I.8.5","Encryption keys encrypted at rest and when transmitted?","Yes","Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)","G.22 Data Security Policy - Encryption","10.1.2","Key Management",2,null,8,5,0,0,0,0,{"$f":"IF(I94=\"\",\"\",IF(D94=\"\",0,IF(D94=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D94=\"Yes\"),AND($L$1=\"Scaled\",D94>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D94=\"No\"),AND($L$1=\"Scaled\",D94<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1902,"I.8.6","Segregation of duties between key management duties and normal operational duties?","Yes","Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)",null,"6.1.2","Segregation Of Duties",2,null,8,6,0,0,0,0,{"$f":"IF(I95=\"\",\"\",IF(D95=\"\",0,IF(D95=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D95=\"Yes\"),AND($L$1=\"Scaled\",D95>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D95=\"No\"),AND($L$1=\"Scaled\",D95<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1865,"I.8.7","Key/certificate sharing between production and non-production?","No",null,null,"12.1.4.g","Separation Of Development, Test, And Operational Facilities",2,null,8,7,0,0,0,0,{"$f":"IF(I96=\"\",\"\",IF(D96=\"\",0,IF(D96=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D96=\"Yes\"),AND($L$1=\"Scaled\",D96>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D96=\"No\"),AND($L$1=\"Scaled\",D96<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[1866,"I.8.8","Default certificates provided by vendors replaced with proprietary certificates?","Yes","Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)",null,"10.1.2.e","Key Management",2,null,8,8,0,0,0,0,{"$f":"IF(I97=\"\",\"\",IF(D97=\"\",0,IF(D97=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D97=\"Yes\"),AND($L$1=\"Scaled\",D97>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D97=\"No\"),AND($L$1=\"Scaled\",D97<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1859,"I.8.9","Segregation of access to both parts of an asymmetric key?","Yes","Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)",null,"10.1.2.d","Key Management",2,null,8,9,0,0,0,0,{"$f":"IF(I98=\"\",\"\",IF(D98=\"\",0,IF(D98=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D98=\"Yes\"),AND($L$1=\"Scaled\",D98>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D98=\"No\"),AND($L$1=\"Scaled\",D98<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[1860,"I.8.10","Asymmetric encryption key length a minimum of 2048 bit?","Yes","Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)",null,"NA",null,2,null,8,10,0,0,0,0,{"$f":"IF(I99=\"\",\"\",IF(D99=\"\",0,IF(D99=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D99=\"Yes\"),AND($L$1=\"Scaled\",D99>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D99=\"No\"),AND($L$1=\"Scaled\",D99<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]

{"sheet":"J. Incident Event & Comm Mgmt","index":16,"n_rows":45,"n_cols":28,"rows_kept":45,"cut":false,"hidden":false,"merged":[[2,1,2,7]]}
[10,"J. Incident Event and Communications Management",null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,null,"Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"J"}]
[null,null,null,{"$f":"IF(W2=0,\"0%\",W2/S2)","v":1},"Percent Complete",null,null,null,{"$f":"COUNTA(I5:I45)","v":41},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(S5:S45,1)","v":32},null,null,null,{"$f":"COUNTIF(W5:W45,1)","v":32}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column E to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, check the Disable Tab Automation checkbox at the top of the page.",null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter"]
[{"$f":"MAX(A5:A45)","v":3046},"Ques Num","Question/Request","Response","Additional Information","AUP Reference","ISO Ref Num","ISO Ref Text"]
[2241,{"$f":"IF(I5=0,\"\",IF(I5=1,P$1&\".\"&K5,IF(I5=2,P$1&\".\"&K5&\".\"&L5,IF(I5=3,P$1&\".\"&K5&\".\"&L5&\".\"&M5,IF(I5=4,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5,IF(I5=5,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5))))))","v":"J.1"},"Is there an Incident Management program?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,16," Information security incident management",1,null,{"$f":"IF(K4=\"\",1,IF(I5=1,K4+1,K4))","v":1},{"$f":"IF(L4=\"\",0,IF(K4<>K5,0,IF($I5=2,L4+1,L4)))","v":0},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($I5=3,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($I5=4,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($I5=5,O4+1,O4)))","v":0},{"$f":"IF(OR(Master=\"Master\",I5=0,J5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,21,FALSE)),0,VLOOKUP(A5,L2_Array,21,FALSE)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D5=\"Yes\"),AND($L$1=\"Scaled\",D5>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D5=\"No\"),AND($L$1=\"Scaled\",D5<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I5=\"\",\"\",IF(P5>0,P5,IF(Q5>0,Q5,0)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(I5=1,S4=\"\"),1,IF(OR(AND(J4=1,(I5-I3<>0)),AND(S4=0,I4=I5),AND(J4=1,I5=I3)),0,1)))","v":1},{"$f":"IF(I5=\"\",T4,IF(AND(R5>1,OR(T4=\"\",T4=0,T4>=I5)),I5,IF(I5>T4,T4,0)))","v":0},{"$f":"IF(Master=\"Master\",Q5,IF(U4=\"\",R5,IF(OR(AND(T5>0,R5<U4),AND(T5=1,R5<=U4)),U4,R5)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(S4=1,T5=1),R5>0,AND(S6=0,V6=1)),1,0))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(T5>0,S5=1),AND(S5=1,V5=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(I5=1,R5=1),2,IF(AND(U4=1,K5=K4),2,IF(AND(AB4=2,K5=K4),2,IF(I5=1,1,\"\"))))","v":2}]
[2698,{"$f":"IF(I6=0,\"\",IF(I6=1,P$1&\".\"&K6,IF(I6=2,P$1&\".\"&K6&\".\"&L6,IF(I6=3,P$1&\".\"&K6&\".\"&L6&\".\"&M6,IF(I6=4,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6,IF(I6=5,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6))))))","v":"J.1.1"},"Is there a documented policy for incident management that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?","Yes","Cloudamize Security Policy - Incident Management Procedure","J.1 Information Security Incident Management Policy \n and Procedures Content","16.1.1 ","Responsibilities and procedures",2,null,{"$f":"IF(K5=\"\",1,IF(I6=1,K5+1,K5))","v":1},{"$f":"IF(L5=\"\",0,IF(K5<>K6,0,IF($I6=2,L5+1,L5)))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($I6=3,M5+1,M5)))","v":0},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($I6=4,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($I6=5,O5+1,O5)))","v":0},0,{"$f":"IF(I6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D6=\"Yes\"),AND($L$1=\"Scaled\",D6>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D6=\"No\"),AND($L$1=\"Scaled\",D6<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I6=\"\",\"\",IF(P6>0,P6,IF(Q6>0,Q6,0)))","v":1},1,{"$f":"IF(I6=\"\",T5,IF(AND(R6>1,OR(T5=\"\",T5=0,T5>=I6)),I6,IF(I6>T5,T5,0)))","v":0},{"$f":"IF(Master=\"Master\",Q6,IF(U5=\"\",R6,IF(OR(AND(T6>0,R6<U5),AND(T6=1,R6<=U5)),U5,R6)))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(S5=1,T6=1),R6>0,AND(S7=0,V7=1)),1,0))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(T6>0,S6=1),AND(S6=1,V6=1)),1,0))","v":1},0,null,null,null,{"$f":"IF(AND(I6=1,R6=1),2,IF(AND(U5=1,K6=K5),2,IF(AND(AB5=2,K6=K5),2,IF(I6=1,1,\"\"))))","v":2}]
[2246,"J.1.2","Is there a formal Incident Response Plan. If yes, does it include:","Yes","Cloudamize Security Policy - Cloudamize Security Incident Response Policy","J.1 procedure b.5","16.1.1.a.1","Responsibilities and procedures",2,null,1,2,0,0,0,0,{"$f":"IF(I7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D7=\"Yes\"),AND($L$1=\"Scaled\",D7>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D7=\"No\"),AND($L$1=\"Scaled\",D7<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2274,"J.1.2.1","Reporting procedure for an information security event?","Yes","Cloudamize Security Policy - Incident Management Procedure","J.1 procedure b.5.g","16.1.1.a.2","Responsibilities and procedures",3,null,1,2,1,0,0,0,{"$f":"IF(I8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D8=\"Yes\"),AND($L$1=\"Scaled\",D8>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D8=\"No\"),AND($L$1=\"Scaled\",D8<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2699,"J.1.2.2","Escalation procedure?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.1.a.6","Responsibilities and procedures",3,null,1,2,2,0,0,0,{"$f":"IF(I9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D9=\"Yes\"),AND($L$1=\"Scaled\",D9>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D9=\"No\"),AND($L$1=\"Scaled\",D9<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2276,"J.1.2.3","An Incident / Event Response team with defined roles and response related qualifications available 24x7x365?","Yes","Cloudamize Security Policy - Incident Management Procedure","J.1 procedure b.2","16.1.5 ","Response to information security incidents",3,null,1,2,3,0,0,0,{"$f":"IF(I10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D10=\"Yes\"),AND($L$1=\"Scaled\",D10>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D10=\"No\"),AND($L$1=\"Scaled\",D10<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2280,"J.1.2.4","Procedures to collect and maintain a chain of custody for evidence during incident investigation?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.7","Collection Of Evidence",3,null,1,2,4,0,0,0,{"$f":"IF(I11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D11=\"Yes\"),AND($L$1=\"Scaled\",D11>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D11=\"No\"),AND($L$1=\"Scaled\",D11<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2702,"J.1.2.5","Feedback process to ensure those reporting information security events are notified of the results after the issue has been dealt with and closed?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.1.c.4","Responsibilities and procedures",3,null,1,2,5,0,0,0,{"$f":"IF(I12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D12=\"Yes\"),AND($L$1=\"Scaled\",D12>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D12=\"No\"),AND($L$1=\"Scaled\",D12<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2703,"J.1.2.6","Event reporting mechanism to support the reporting action, and to list all necessary actions in case of an information security event?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.1.a.2","Responsibilities and procedures",3,null,1,2,6,0,0,0,{"$f":"IF(I13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D13=\"Yes\"),AND($L$1=\"Scaled\",D13>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D13=\"No\"),AND($L$1=\"Scaled\",D13<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2704,"J.1.2.7","Actions to be taken in the event of an information security event?","Yes","Cloudamize Security Policy - Incident Management Procedure","J.1 procedure b.5","16.1.1.c.1","Responsibilities and procedures",3,null,1,2,7,0,0,0,{"$f":"IF(I14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D14=\"Yes\"),AND($L$1=\"Scaled\",D14>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D14=\"No\"),AND($L$1=\"Scaled\",D14<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2705,"J.1.2.8","Formal disciplinary process for dealing with those who commit a security breach?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.1.c.3","Responsibilities and procedures",3,null,1,2,8,0,0,0,{"$f":"IF(I15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D15=\"Yes\"),AND($L$1=\"Scaled\",D15>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D15=\"No\"),AND($L$1=\"Scaled\",D15<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2273,"J.1.2.9","Process for assessing and executing client and third party notification requirements (legal, regulatory, and contractual)?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.1.b.3","Responsibilities and procedures",3,null,1,2,9,0,0,0,{"$f":"IF(I16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D16=\"Yes\"),AND($L$1=\"Scaled\",D16>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D16=\"No\"),AND($L$1=\"Scaled\",D16<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2275,"J.1.2.10","Postmortem to include root cause analysis and remediation plan, provided to leadership?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.5 ","Response to information security incidents",3,null,1,2,10,0,0,0,{"$f":"IF(I17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D17=\"Yes\"),AND($L$1=\"Scaled\",D17>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D17=\"No\"),AND($L$1=\"Scaled\",D17<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2249,"J.1.2.11","Is there an identification of incident process? If yes, does it include:","Yes","Cloudamize Security Policy - Incident Management Procedure","J.1 procedure b.5.a","16.1.1.a.5","Responsibilities and procedures",3,null,1,2,11,0,0,0,{"$f":"IF(I18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D18=\"Yes\"),AND($L$1=\"Scaled\",D18>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D18=\"No\"),AND($L$1=\"Scaled\",D18<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2266,"J.1.2.11.1","Unauthorized physical access?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.2.e","Reporting information security events",4,null,1,2,11,1,0,0,{"$f":"IF(I19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D19=\"Yes\"),AND($L$1=\"Scaled\",D19>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D19=\"No\"),AND($L$1=\"Scaled\",D19<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2259,"J.1.2.11.2","Information system failure or loss of service?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.2.g","Reporting information security events",4,null,1,2,11,2,0,0,{"$f":"IF(I20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D20=\"Yes\"),AND($L$1=\"Scaled\",D20>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D20=\"No\"),AND($L$1=\"Scaled\",D20<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2264,"J.1.2.11.3","Malware activity (anti-virus, worms, Trojans)?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.2.h","Reporting information security events",4,null,1,2,11,3,0,0,{"$f":"IF(I21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D21=\"Yes\"),AND($L$1=\"Scaled\",D21>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D21=\"No\"),AND($L$1=\"Scaled\",D21<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2260,"J.1.2.11.4","Denial of service?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.2.f","Reporting information security events",4,null,1,2,11,4,0,0,{"$f":"IF(I22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D22=\"Yes\"),AND($L$1=\"Scaled\",D22>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D22=\"No\"),AND($L$1=\"Scaled\",D22<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2707,"J.1.2.11.5","Errors resulting from incomplete or inaccurate business data?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.2.b","Reporting information security events",4,null,1,2,11,5,0,0,{"$f":"IF(I23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D23=\"Yes\"),AND($L$1=\"Scaled\",D23>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D23=\"No\"),AND($L$1=\"Scaled\",D23<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2262,"J.1.2.11.6","Breach or loss of confidentiality?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.2.b","Reporting information security events",4,null,1,2,11,6,0,0,{"$f":"IF(I24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D24=\"Yes\"),AND($L$1=\"Scaled\",D24>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D24=\"No\"),AND($L$1=\"Scaled\",D24<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2261,"J.1.2.11.7","System exploit?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.2.f","Reporting information security events",4,null,1,2,11,7,0,0,{"$f":"IF(I25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D25=\"Yes\"),AND($L$1=\"Scaled\",D25>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D25=\"No\"),AND($L$1=\"Scaled\",D25<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2267,"J.1.2.11.8","Unauthorized logical access or use of system resources?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.2.h","Reporting information security events",4,null,1,2,11,8,0,0,{"$f":"IF(I26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D26=\"Yes\"),AND($L$1=\"Scaled\",D26>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D26=\"No\"),AND($L$1=\"Scaled\",D26<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2251,"J.1.2.11.9","Containment?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"NA",null,4,null,1,2,11,9,0,0,{"$f":"IF(I27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D27=\"Yes\"),AND($L$1=\"Scaled\",D27>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D27=\"No\"),AND($L$1=\"Scaled\",D27<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2256,"J.1.2.11.10","Remediation?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.5.f ","Response to information security incidents",4,null,1,2,11,10,0,0,{"$f":"IF(I28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D28=\"Yes\"),AND($L$1=\"Scaled\",D28>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D28=\"No\"),AND($L$1=\"Scaled\",D28<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2250,"J.1.2.11.11","Notification of stakeholders?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.1.a.6","Responsibilities and procedures",4,null,1,2,11,11,0,0,{"$f":"IF(I29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D29=\"Yes\"),AND($L$1=\"Scaled\",D29>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D29=\"No\"),AND($L$1=\"Scaled\",D29<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2253,"J.1.2.11.12","Tracking?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.1.a.2","Responsibilities and procedures",4,null,1,2,11,12,0,0,{"$f":"IF(I30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D30=\"Yes\"),AND($L$1=\"Scaled\",D30>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D30=\"No\"),AND($L$1=\"Scaled\",D30<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2254,"J.1.2.11.13","Repair?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.5.g","Response to information security incidents",4,null,1,2,11,13,0,0,{"$f":"IF(I31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D31=\"Yes\"),AND($L$1=\"Scaled\",D31>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D31=\"No\"),AND($L$1=\"Scaled\",D31<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2255,"J.1.2.11.14","Recovery?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.1.a.6","Responsibilities and procedures",4,null,1,2,11,14,0,0,{"$f":"IF(I32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D32=\"Yes\"),AND($L$1=\"Scaled\",D32>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D32=\"No\"),AND($L$1=\"Scaled\",D32<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2257,"J.1.2.11.15","Feedback and lessons learned?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.6 ","Learning from information security incidents",4,null,1,2,11,15,0,0,{"$f":"IF(I33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D33=\"Yes\"),AND($L$1=\"Scaled\",D33>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D33=\"No\"),AND($L$1=\"Scaled\",D33<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3046,"J.1.2.11.16","Unique, specific, applicable data breach notification requirements, including timing of notification (HIPAA/HITECH, state breach laws, client contracts)?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.1.a.6","Responsibilities and procedures",4,null,1,2,11,16,0,0,{"$f":"IF(I34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D34=\"Yes\"),AND($L$1=\"Scaled\",D34>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D34=\"No\"),AND($L$1=\"Scaled\",D34<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2708,"J.1.2.11.17","Annual testing of the procedures?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"16.1.6 ","Learning from information security incidents",4,null,1,2,11,17,0,0,{"$f":"IF(I35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D35=\"Yes\"),AND($L$1=\"Scaled\",D35>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D35=\"No\"),AND($L$1=\"Scaled\",D35<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2709,"J.1.3","Are the following considered Information Security events:",null,null,null,"16.1.2","Reporting information security events",2,1,1,3,0,0,0,0,{"$f":"IF(I36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D36=\"Yes\"),AND($L$1=\"Scaled\",D36>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D36=\"No\"),AND($L$1=\"Scaled\",D36<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,1,1,0,null,null,null,2]
[2710,"J.1.3.1","Loss of service (equipment or facility)?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.2.f","Reporting information security events",3,null,1,3,1,0,0,0,{"$f":"IF(I37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D37=\"Yes\"),AND($L$1=\"Scaled\",D37>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D37=\"No\"),AND($L$1=\"Scaled\",D37<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,0,0,1,1,0,0,null,null,null,2]
[2711,"J.1.3.2","System malfunction or overload?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"16.1.2.g","Reporting information security events",3,null,1,3,2,0,0,0,{"$f":"IF(I38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D38=\"Yes\"),AND($L$1=\"Scaled\",D38>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D38=\"No\"),AND($L$1=\"Scaled\",D38<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,0,0,1,1,0,0,null,null,null,2]
[2712,"J.1.3.3","Human error?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"16.1.2.c","Reporting information security events",3,null,1,3,3,0,0,0,{"$f":"IF(I39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D39=\"Yes\"),AND($L$1=\"Scaled\",D39>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D39=\"No\"),AND($L$1=\"Scaled\",D39<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,0,0,1,1,0,0,null,null,null,2]
[2713,"J.1.3.4","Non-compliance with policy or guidelines?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"16.1.2.d","Reporting information security events",3,null,1,3,4,0,0,0,{"$f":"IF(I40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D40=\"Yes\"),AND($L$1=\"Scaled\",D40>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D40=\"No\"),AND($L$1=\"Scaled\",D40<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,0,0,1,1,0,0,null,null,null,2]
[2714,"J.1.3.5","Breach of physical security arrangement?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"16.1.2.e","Reporting information security events",3,null,1,3,5,0,0,0,{"$f":"IF(I41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D41=\"Yes\"),AND($L$1=\"Scaled\",D41>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D41=\"No\"),AND($L$1=\"Scaled\",D41<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,0,0,1,1,0,0,null,null,null,2]
[2715,"J.1.3.6","Uncontrolled system change?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"16.1.2.f","Reporting information security events",3,null,1,3,6,0,0,0,{"$f":"IF(I42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D42=\"Yes\"),AND($L$1=\"Scaled\",D42>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D42=\"No\"),AND($L$1=\"Scaled\",D42<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,0,0,1,1,0,0,null,null,null,2]
[2716,"J.1.3.7","Malfunction of software or hardware?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"16.1.2.g","Reporting information security events",3,null,1,3,7,0,0,0,{"$f":"IF(I43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D43=\"Yes\"),AND($L$1=\"Scaled\",D43>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D43=\"No\"),AND($L$1=\"Scaled\",D43<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,0,0,1,1,0,0,null,null,null,2]
[2272,"J.1.3.8","Access violation?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"16.1.2.h","Reporting information security events",3,null,1,3,8,0,0,0,{"$f":"IF(I44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D44=\"Yes\"),AND($L$1=\"Scaled\",D44>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D44=\"No\"),AND($L$1=\"Scaled\",D44<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,0,0,1,1,0,0,null,null,null,2]
[2265,"J.1.3.9","Physical asset loss or theft?","Yes","Cloudamize Security Policy - Incident Management Procedure",null,"16.1.2.a","Reporting information security events",3,null,1,3,9,0,0,0,{"$f":"IF(I45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D45=\"Yes\"),AND($L$1=\"Scaled\",D45>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D45=\"No\"),AND($L$1=\"Scaled\",D45<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,0,0,1,1,0,0,null,null,null,2]

{"sheet":"K. BC DR","index":17,"n_rows":65,"n_cols":28,"rows_kept":65,"cut":false,"hidden":false,"merged":[[2,1,2,7]]}
[10,"K. Business Continuity and Disaster Recovery",null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,null,"Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"K"}]
[null,null,null,{"$f":"IF(W2=0,\"0%\",W2/S2)","v":1},"Percent Complete",null,null,null,{"$f":"COUNTA(I5:I65)","v":61},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(S5:S65,1)","v":61},null,null,null,{"$f":"COUNTIF(W5:W65,1)","v":61}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column E to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, check the Disable Tab Automation checkbox at the top of the page.",null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter"]
[{"$f":"MAX(A5:A65)","v":2779},"Ques Num","Question/Request","Response","Additional Information","AUP Reference","ISO Ref Num","ISO Ref Text"]
[2281,{"$f":"IF(I5=0,\"\",IF(I5=1,P$1&\".\"&K5,IF(I5=2,P$1&\".\"&K5&\".\"&L5,IF(I5=3,P$1&\".\"&K5&\".\"&L5&\".\"&M5,IF(I5=4,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5,IF(I5=5,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5))))))","v":"K.1"},"Is there a documented policy for business continuity and disaster recovery that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan","B.1 Information Security Policy Content",17.100000000000001,"Information security continuity",1,null,{"$f":"IF(K4=\"\",1,IF(I5=1,K4+1,K4))","v":1},{"$f":"IF(L4=\"\",0,IF(K4<>K5,0,IF($I5=2,L4+1,L4)))","v":0},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($I5=3,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($I5=4,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($I5=5,O4+1,O4)))","v":0},{"$f":"IF(OR(Master=\"Master\",I5=0,J5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,21,FALSE)),0,VLOOKUP(A5,L2_Array,21,FALSE)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D5=\"Yes\"),AND($L$1=\"Scaled\",D5>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D5=\"No\"),AND($L$1=\"Scaled\",D5<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I5=\"\",\"\",IF(P5>0,P5,IF(Q5>0,Q5,0)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(I5=1,S4=\"\"),1,IF(OR(AND(J4=1,(I5-I3<>0)),AND(S4=0,I4=I5),AND(J4=1,I5=I3)),0,1)))","v":1},{"$f":"IF(I5=\"\",T4,IF(AND(R5>1,OR(T4=\"\",T4=0,T4>=I5)),I5,IF(I5>T4,T4,0)))","v":0},{"$f":"IF(Master=\"Master\",Q5,IF(U4=\"\",R5,IF(OR(AND(T5>0,R5<U4),AND(T5=1,R5<=U4)),U4,R5)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(S4=1,T5=1),R5>0,AND(S6=0,V6=1)),1,0))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(T5>0,S5=1),AND(S5=1,V5=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(I5=1,R5=1),2,IF(AND(U4=1,K5=K4),2,IF(AND(AB4=2,K5=K4),2,IF(I5=1,1,\"\"))))","v":2}]
[2287,{"$f":"IF(I6=0,\"\",IF(I6=1,P$1&\".\"&K6,IF(I6=2,P$1&\".\"&K6&\".\"&L6,IF(I6=3,P$1&\".\"&K6&\".\"&L6&\".\"&M6,IF(I6=4,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6,IF(I6=5,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6))))))","v":"K.1.1"},"Has a third party evaluated the BC/DR Program within the past 12 months?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"NA",null,2,null,{"$f":"IF(K5=\"\",1,IF(I6=1,K5+1,K5))","v":1},{"$f":"IF(L5=\"\",0,IF(K5<>K6,0,IF($I6=2,L5+1,L5)))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($I6=3,M5+1,M5)))","v":0},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($I6=4,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($I6=5,O5+1,O5)))","v":0},{"$f":"IF(OR(Master=\"Master\",I6=0,J6=1),0,IF(ISNA(VLOOKUP(A6,L2_Array,21,FALSE)),0,VLOOKUP(A6,L2_Array,21,FALSE)))","v":0},{"$f":"IF(I6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D6=\"Yes\"),AND($L$1=\"Scaled\",D6>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D6=\"No\"),AND($L$1=\"Scaled\",D6<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I6=\"\",\"\",IF(P6>0,P6,IF(Q6>0,Q6,0)))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(I6=1,S5=\"\"),1,IF(OR(AND(J5=1,(I6-I4<>0)),AND(S5=0,I5=I6),AND(J5=1,I6=I4)),0,1)))","v":1},{"$f":"IF(I6=\"\",T5,IF(AND(R6>1,OR(T5=\"\",T5=0,T5>=I6)),I6,IF(I6>T5,T5,0)))","v":0},{"$f":"IF(Master=\"Master\",Q6,IF(U5=\"\",R6,IF(OR(AND(T6>0,R6<U5),AND(T6=1,R6<=U5)),U5,R6)))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(S5=1,T6=1),R6>0,AND(S7=0,V7=1)),1,0))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(T6>0,S6=1),AND(S6=1,V6=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A6,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(I6=1,R6=1),2,IF(AND(U5=1,K6=K5),2,IF(AND(AB5=2,K6=K5),2,IF(I6=1,1,\"\"))))","v":2}]
[2719,"K.1.2","Is there a BC/DR Program that has been approved by management, communicated to appropriate constituents and an owner or group to maintain and review the plan? If yes ,does it include:","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.2","Implementing information security continuity",2,null,1,2,0,0,0,0,{"$f":"IF(I7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D7=\"Yes\"),AND($L$1=\"Scaled\",D7>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D7=\"No\"),AND($L$1=\"Scaled\",D7<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2341,"K.1.2.1","Annual management review of the BC program for adequacy of resources (people, technology, facilities, and funding)?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan","K.3 Business Continuity Governance","17.1.3 ","Verify, review and evaluate information security continuity",3,null,1,2,1,0,0,0,{"$f":"IF(I8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D8=\"Yes\"),AND($L$1=\"Scaled\",D8>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D8=\"No\"),AND($L$1=\"Scaled\",D8<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2342,"K.1.2.2","Virtual or physical command center where management can meet, organize, and conduct emergency operations in a secure setting?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"NA","",3,null,1,2,2,0,0,0,{"$f":"IF(I9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D9=\"Yes\"),AND($L$1=\"Scaled\",D9>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D9=\"No\"),AND($L$1=\"Scaled\",D9<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2765,"K.1.2.3","The product or service in scope have an assured business continuity capability?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan","K.4 Business Process Level Readiness","17.1.2 ","Implementing information security continuity",3,null,1,2,3,0,0,0,{"$f":"IF(I10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D10=\"Yes\"),AND($L$1=\"Scaled\",D10>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D10=\"No\"),AND($L$1=\"Scaled\",D10<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2289,"K.1.2.4","Conditions for activating the plan, and the associated roles and responsibilities?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan","K.3 Business Continuity Governance","17.1.2.b","Implementing information security continuity",3,null,1,2,4,0,0,0,{"$f":"IF(I11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D11=\"Yes\"),AND($L$1=\"Scaled\",D11>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D11=\"No\"),AND($L$1=\"Scaled\",D11<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2292,"K.1.2.5","Maintenance schedule to revise and test the plan?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.3","Verify, review and evaluate information security continuity",3,null,1,2,5,0,0,0,{"$f":"IF(I12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D12=\"Yes\"),AND($L$1=\"Scaled\",D12>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D12=\"No\"),AND($L$1=\"Scaled\",D12<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2293,"K.1.2.6","Awareness and education activities?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"7.2.2 .d ","Information security awareness, education and training",3,null,1,2,6,0,0,0,{"$f":"IF(I13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D13=\"Yes\"),AND($L$1=\"Scaled\",D13>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D13=\"No\"),AND($L$1=\"Scaled\",D13<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2294,"K.1.2.7","Roles and responsibilities for those who invoke and execute the plan?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan","K.3 Business Continuity Governance","17.1.2.b","Implementing information security continuity",3,null,1,2,7,0,0,0,{"$f":"IF(I14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D14=\"Yes\"),AND($L$1=\"Scaled\",D14>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D14=\"No\"),AND($L$1=\"Scaled\",D14<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2298,"K.1.2.8","Change management to ensure changes are replicated to contingency environments?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"12.1.2","Change Management",3,null,1,2,8,0,0,0,{"$f":"IF(I15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D15=\"Yes\"),AND($L$1=\"Scaled\",D15>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D15=\"No\"),AND($L$1=\"Scaled\",D15<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2299,"K.1.2.9","Identification of applications, equipment, facilities, personnel, supplies and vital records necessary for recovery?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan","K.5 Business Continuity Threat Assessments","17.1.2.c","Implementing information security continuity",3,null,1,2,9,0,0,0,{"$f":"IF(I16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D16=\"Yes\"),AND($L$1=\"Scaled\",D16>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D16=\"No\"),AND($L$1=\"Scaled\",D16<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2300,"K.1.2.10","Updates from the inventory of IT and telecom assets?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.2.c","Implementing information security continuity",3,null,1,2,10,0,0,0,{"$f":"IF(I17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D17=\"Yes\"),AND($L$1=\"Scaled\",D17>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D17=\"No\"),AND($L$1=\"Scaled\",D17<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2303,"K.1.2.11","Alternate and diverse means of communications in the event standard communication channels are unavailable?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.2.Section 2.c","Implementing information security continuity",3,null,1,2,11,0,0,0,{"$f":"IF(I18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D18=\"Yes\"),AND($L$1=\"Scaled\",D18>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D18=\"No\"),AND($L$1=\"Scaled\",D18<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2725,"K.1.2.12","Interaction with the media during an event?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"NA","",3,null,1,2,12,0,0,0,{"$f":"IF(I19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D19=\"Yes\"),AND($L$1=\"Scaled\",D19>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D19=\"No\"),AND($L$1=\"Scaled\",D19<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2726,"K.1.2.13","Resumption procedures to return to normal business operations?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.2","Implementing information security continuity",3,null,1,2,13,0,0,0,{"$f":"IF(I20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D20=\"Yes\"),AND($L$1=\"Scaled\",D20>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D20=\"No\"),AND($L$1=\"Scaled\",D20<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2728,"K.1.2.14","Notification and escalation to clients?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.2.c","Implementing information security continuity",3,null,1,2,14,0,0,0,{"$f":"IF(I21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D21=\"Yes\"),AND($L$1=\"Scaled\",D21>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D21=\"No\"),AND($L$1=\"Scaled\",D21<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2729,"K.1.2.15","Dependencies upon critical service providers. If yes, does it include:","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan","K.5 Business Continuity Threat Assessments","17.1.2.c","Implementing information security continuity",3,null,1,2,15,0,0,0,{"$f":"IF(I22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D22=\"Yes\"),AND($L$1=\"Scaled\",D22>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D22=\"No\"),AND($L$1=\"Scaled\",D22<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2308,"K.1.2.15.1","Contact information for key personnel, which is updated at least annually?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.2.c","Implementing information security continuity",4,null,1,2,15,1,0,0,{"$f":"IF(I23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D23=\"Yes\"),AND($L$1=\"Scaled\",D23>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D23=\"No\"),AND($L$1=\"Scaled\",D23<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2295,"K.1.2.15.2","Notification and escalation?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.2.c","Implementing information security continuity",4,null,1,2,15,2,0,0,{"$f":"IF(I24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D24=\"Yes\"),AND($L$1=\"Scaled\",D24>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D24=\"No\"),AND($L$1=\"Scaled\",D24<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2730,"K.1.2.15.3","Communication in the event of a disruption at their facility?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.2.c","Implementing information security continuity",4,null,1,2,15,3,0,0,{"$f":"IF(I25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D25=\"Yes\"),AND($L$1=\"Scaled\",D25>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D25=\"No\"),AND($L$1=\"Scaled\",D25<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2296,"K.1.2.15.4","Capabilities adequate to support the plan through contract requirements, SSAE16 reviews or both?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"NA",null,4,null,1,2,15,4,0,0,{"$f":"IF(I26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D26=\"Yes\"),AND($L$1=\"Scaled\",D26>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D26=\"No\"),AND($L$1=\"Scaled\",D26<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2731,"K.1.2.15.5","Notification when their BCP is modified?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.3","Verify, review and evaluate information security continuity",4,null,1,2,15,5,0,0,{"$f":"IF(I27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D27=\"Yes\"),AND($L$1=\"Scaled\",D27>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D27=\"No\"),AND($L$1=\"Scaled\",D27<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2286,"K.1.2.16","Annual review which includes: critical functions, known and emerging threats, organizational structure and personnel changes?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.3","Verify, review and evaluate information security continuity",3,null,1,2,16,0,0,0,{"$f":"IF(I28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D28=\"Yes\"),AND($L$1=\"Scaled\",D28>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D28=\"No\"),AND($L$1=\"Scaled\",D28<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2343,"K.1.3","Is there an annual schedule of required tests? If yes, does it include:","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.3","Verify, review and evaluate information security continuity",2,null,1,3,0,0,0,1,{"$f":"IF(I29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D29=\"Yes\"),AND($L$1=\"Scaled\",D29>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D29=\"No\"),AND($L$1=\"Scaled\",D29<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[2346,"K.1.3.1","Test objectives for a technology outage, loss of facility or personnel, identification of parties involved, and the evaluation of testing results?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan","K.6 Business Continuity Process Testing procedure 4. Test Scenarios","17.1.3","Verify, review and evaluate information security continuity",3,null,1,3,1,0,0,0,{"$f":"IF(I30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D30=\"Yes\"),AND($L$1=\"Scaled\",D30>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D30=\"No\"),AND($L$1=\"Scaled\",D30<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2779,"K.1.4","Is a BC/DR test conducted at least annually?  If yes, does it include:","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.3","Verify, review and evaluate information security continuity",2,null,1,4,0,0,0,1,{"$f":"IF(I31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D31=\"Yes\"),AND($L$1=\"Scaled\",D31>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D31=\"No\"),AND($L$1=\"Scaled\",D31<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[2351,"K.1.4.1","Evacuation drills?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan","K.6 Business Continuity Process Testing procedure 5. Test Types","NA","",3,null,1,4,1,0,0,0,{"$f":"IF(I32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D32=\"Yes\"),AND($L$1=\"Scaled\",D32>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D32=\"No\"),AND($L$1=\"Scaled\",D32<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2352,"K.1.4.2","Notification tests?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"NA","",3,null,1,4,2,0,0,0,{"$f":"IF(I33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D33=\"Yes\"),AND($L$1=\"Scaled\",D33>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D33=\"No\"),AND($L$1=\"Scaled\",D33<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2353,"K.1.4.3","Tabletop exercises?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan","K.6 Business Continuity Process Testing procedure 5. Test Types","17.1.3","Verify, review and evaluate information security continuity",3,null,1,4,3,0,0,0,{"$f":"IF(I34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D34=\"Yes\"),AND($L$1=\"Scaled\",D34>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D34=\"No\"),AND($L$1=\"Scaled\",D34<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2354,"K.1.4.4","Application recovery tests?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.3","Verify, review and evaluate information security continuity",3,null,1,4,4,0,0,0,{"$f":"IF(I35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D35=\"Yes\"),AND($L$1=\"Scaled\",D35>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D35=\"No\"),AND($L$1=\"Scaled\",D35<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2355,"K.1.4.5","Remote access tests?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.3","Verify, review and evaluate information security continuity",3,null,1,4,5,0,0,0,{"$f":"IF(I36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D36=\"Yes\"),AND($L$1=\"Scaled\",D36>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D36=\"No\"),AND($L$1=\"Scaled\",D36<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2357,"K.1.4.6","Full scale exercises?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan","K.6 Business Continuity Process Testing procedure 5. Test Types","17.1.3","Verify, review and evaluate information security continuity",3,null,1,4,6,0,0,0,{"$f":"IF(I37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D37=\"Yes\"),AND($L$1=\"Scaled\",D37>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D37=\"No\"),AND($L$1=\"Scaled\",D37<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2762,"K.1.4.7","Business relocation test?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.3","Verify, review and evaluate information security continuity",3,null,1,4,7,0,0,0,{"$f":"IF(I38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D38=\"Yes\"),AND($L$1=\"Scaled\",D38>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D38=\"No\"),AND($L$1=\"Scaled\",D38<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2723,"K.1.4.8","Business disruptions?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan","K.6 Business Continuity Process Testing procedure 5. Test Types","17.1.3","Verify, review and evaluate information security continuity",3,null,1,4,8,0,0,0,{"$f":"IF(I39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D39=\"Yes\"),AND($L$1=\"Scaled\",D39>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D39=\"No\"),AND($L$1=\"Scaled\",D39<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2763,"K.1.4.9","Data center failover test?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.3","Verify, review and evaluate information security continuity",3,null,1,4,9,0,0,0,{"$f":"IF(I40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D40=\"Yes\"),AND($L$1=\"Scaled\",D40>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D40=\"No\"),AND($L$1=\"Scaled\",D40<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2764,"K.1.4.10","Critical service providers included in testing?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.3","Verify, review and evaluate information security continuity",3,null,1,4,10,0,0,0,{"$f":"IF(I41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D41=\"Yes\"),AND($L$1=\"Scaled\",D41>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D41=\"No\"),AND($L$1=\"Scaled\",D41<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2356,"K.1.4.11","Recovery site tests?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.3","Verify, review and evaluate information security continuity",3,null,1,4,11,0,0,0,{"$f":"IF(I42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D42=\"Yes\"),AND($L$1=\"Scaled\",D42>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D42=\"No\"),AND($L$1=\"Scaled\",D42<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2348,"K.1.4.12","Assessment of the Ability to retrieve vital records?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"17.1.3","Verify, review and evaluate information security continuity",3,null,1,4,12,0,0,0,{"$f":"IF(I43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D43=\"Yes\"),AND($L$1=\"Scaled\",D43>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D43=\"No\"),AND($L$1=\"Scaled\",D43<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2305,"K.2","Is there a Pandemic Plan? If yes, does it include:","No",null,null,"NA",null,1,null,2,0,0,0,0,2,{"$f":"IF(I44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D44=\"Yes\"),AND($L$1=\"Scaled\",D44>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D44=\"No\"),AND($L$1=\"Scaled\",D44<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,1,2,1,1,1,null,null,null,1]
[2751,"K.2.1","Trigger points for activating the plan?",null,null,null,"NA",null,2,null,2,1,0,0,0,0,{"$f":"IF(I45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D45=\"Yes\"),AND($L$1=\"Scaled\",D45>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D45=\"No\"),AND($L$1=\"Scaled\",D45<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2752,"K.2.2","Travel and visitor restrictions?",null,null,null,"NA",null,2,null,2,2,0,0,0,0,{"$f":"IF(I46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D46=\"Yes\"),AND($L$1=\"Scaled\",D46>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D46=\"No\"),AND($L$1=\"Scaled\",D46<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2753,"K.2.3","Cleaning and disinfecting protocols?",null,null,null,"NA",null,2,null,2,3,0,0,0,0,{"$f":"IF(I47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D47=\"Yes\"),AND($L$1=\"Scaled\",D47>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D47=\"No\"),AND($L$1=\"Scaled\",D47<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2754,"K.2.4","Pandemic-specific HR policies and procedures?",null,null,null,"NA",null,2,null,2,4,0,0,0,0,{"$f":"IF(I48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D48=\"Yes\"),AND($L$1=\"Scaled\",D48>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D48=\"No\"),AND($L$1=\"Scaled\",D48<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2755,"K.2.5","Specific \"Social Distancing\" criteria / techniques (work from home)?",null,null,null,"NA",null,2,null,2,5,0,0,0,0,{"$f":"IF(I49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D49=\"Yes\"),AND($L$1=\"Scaled\",D49>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D49=\"No\"),AND($L$1=\"Scaled\",D49<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2756,"K.2.6","Personal protective equipment for constituents (face masks)?",null,null,null,"NA",null,2,null,2,6,0,0,0,0,{"$f":"IF(I50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D50=\"Yes\"),AND($L$1=\"Scaled\",D50>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D50=\"No\"),AND($L$1=\"Scaled\",D50<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2757,"K.2.7","Special food handling in cafeterias?",null,null,null,"NA",null,2,null,2,7,0,0,0,0,{"$f":"IF(I51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D51=\"Yes\"),AND($L$1=\"Scaled\",D51>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D51=\"No\"),AND($L$1=\"Scaled\",D51<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2759,"K.2.8","Seasonal flu vaccinations for constituents?",null,null,null,"NA",null,2,null,2,8,0,0,0,0,{"$f":"IF(I52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D52=\"Yes\"),AND($L$1=\"Scaled\",D52>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D52=\"No\"),AND($L$1=\"Scaled\",D52<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2743,"K.2.9","Annual review?",null,null,null,"NA",null,2,null,2,9,0,0,0,0,{"$f":"IF(I53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D53=\"Yes\"),AND($L$1=\"Scaled\",D53>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D53=\"No\"),AND($L$1=\"Scaled\",D53<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2747,"K.2.10","Periodic testing of the plan?",null,null,null,"NA",null,2,null,2,10,0,0,0,0,{"$f":"IF(I54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D54=\"Yes\"),AND($L$1=\"Scaled\",D54>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D54=\"No\"),AND($L$1=\"Scaled\",D54<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2748,"K.2.11","Verification of critical service provider pandemic plans?",null,null,null,"NA",null,2,null,2,11,0,0,0,0,{"$f":"IF(I55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D55=\"Yes\"),AND($L$1=\"Scaled\",D55>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D55=\"No\"),AND($L$1=\"Scaled\",D55<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2749,"K.2.12","Business Impact Analysis?",null,null,null,"17.1.1 ","Planning information security continuity",2,null,2,12,0,0,0,0,{"$f":"IF(I56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D56=\"Yes\"),AND($L$1=\"Scaled\",D56>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D56=\"No\"),AND($L$1=\"Scaled\",D56<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[2329,"K.3","Is a Business Impact Analysis conducted at least annually? If yes, does it include:","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan","K.1 Business Impact Analysis","17.1.1 ","Planning information security continuity",1,null,3,0,0,0,0,1,{"$f":"IF(I57=\"\",\"\",IF(D57=\"\",0,IF(D57=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D57=\"Yes\"),AND($L$1=\"Scaled\",D57>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D57=\"No\"),AND($L$1=\"Scaled\",D57<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[2334,"K.3.1","Business Process Criticality (high, medium, low or numerical rating) that distinguishes the relative importance of each process?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan","K.1 Business Impact Analysis","17.1.1 ","Planning information security continuity",2,null,3,1,0,0,0,0,{"$f":"IF(I58=\"\",\"\",IF(D58=\"\",0,IF(D58=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D58=\"Yes\"),AND($L$1=\"Scaled\",D58>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D58=\"No\"),AND($L$1=\"Scaled\",D58<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2335,"K.3.2","Recovery Time Objective?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"NA","",2,null,3,2,0,0,0,0,{"$f":"IF(I59=\"\",\"\",IF(D59=\"\",0,IF(D59=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D59=\"Yes\"),AND($L$1=\"Scaled\",D59>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D59=\"No\"),AND($L$1=\"Scaled\",D59<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2337,"K.3.3","Recovery Point Objective?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"NA","",2,null,3,3,0,0,0,0,{"$f":"IF(I60=\"\",\"\",IF(D60=\"\",0,IF(D60=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D60=\"Yes\"),AND($L$1=\"Scaled\",D60>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D60=\"No\"),AND($L$1=\"Scaled\",D60<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2338,"K.3.4","Maximum allowable downtime?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan","K.1 Business Impact Analysis","NA","",2,null,3,4,0,0,0,0,{"$f":"IF(I61=\"\",\"\",IF(D61=\"\",0,IF(D61=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D61=\"Yes\"),AND($L$1=\"Scaled\",D61>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D61=\"No\"),AND($L$1=\"Scaled\",D61<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2760,"K.3.5","Impact to clients?","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan",null,"NA","",2,null,3,5,0,0,0,0,{"$f":"IF(I62=\"\",\"\",IF(D62=\"\",0,IF(D62=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D62=\"Yes\"),AND($L$1=\"Scaled\",D62>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D62=\"No\"),AND($L$1=\"Scaled\",D62<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2365,"K.4","Is there insurance coverage for business interruptions or general services interruption? If yes, are there:","Yes","Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan","K.4 Business Insurance","NA",null,1,null,4,0,0,0,0,1,{"$f":"IF(I63=\"\",\"\",IF(D63=\"\",0,IF(D63=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D63=\"Yes\"),AND($L$1=\"Scaled\",D63>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D63=\"No\"),AND($L$1=\"Scaled\",D63<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[2366,"K.4.1","Limitations based on the cause of the interruption?","No",null,"K.4 Business Insurance","NA",null,2,null,4,1,0,0,0,0,{"$f":"IF(I64=\"\",\"\",IF(D64=\"\",0,IF(D64=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D64=\"Yes\"),AND($L$1=\"Scaled\",D64>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D64=\"No\"),AND($L$1=\"Scaled\",D64<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[2367,"K.4.2","Insurance coverage for products and services provided to clients?","No",null,"K.4 Business Insurance","NA",null,2,null,4,2,0,0,0,0,{"$f":"IF(I65=\"\",\"\",IF(D65=\"\",0,IF(D65=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D65=\"Yes\"),AND($L$1=\"Scaled\",D65>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D65=\"No\"),AND($L$1=\"Scaled\",D65<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]

{"sheet":"L. Compliance","index":18,"n_rows":17,"n_cols":28,"rows_kept":17,"cut":false,"hidden":false,"merged":[[2,1,2,7]]}
[10,"L. Compliance",null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,null,"Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"L"}]
[null,null,null,{"$f":"IF(W2=0,\"0%\",W2/S2)","v":1},"Percent Complete",null,null,null,{"$f":"COUNTA(I5:I17)","v":13},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(S5:S17,1)","v":13},null,null,null,{"$f":"COUNTIF(W5:W17,1)","v":13}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column E to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, check the Disable Tab Automation checkbox at the top of the page.",null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter"]
[{"$f":"MAX(A5:A17)","v":3733},"Ques Num","Question/Request","Response","Additional Information","AUP Reference","ISO Ref Num","ISO Ref Text"]
[2826,{"$f":"IF(I5=0,\"\",IF(I5=1,P$1&\".\"&K5,IF(I5=2,P$1&\".\"&K5&\".\"&L5,IF(I5=3,P$1&\".\"&K5&\".\"&L5&\".\"&M5,IF(I5=4,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5,IF(I5=5,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5))))))","v":"L.1"},"Is there an internal audit, risk management or compliance department with responsibility for identifying and tracking resolution of outstanding regulatory issues?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"18.1.1 ","Identification of applicable legislation and contractual requirements",1,null,{"$f":"IF(K4=\"\",1,IF(I5=1,K4+1,K4))","v":1},{"$f":"IF(L4=\"\",0,IF(K4<>K5,0,IF($G5=2,L4+1,L4)))","v":0},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($G5=3,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($G5=4,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($G5=5,O4+1,O4)))","v":0},{"$f":"IF(OR(Master=\"Master\",I5=0,J5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,21,FALSE)),0,VLOOKUP(A5,L2_Array,21,FALSE)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D5=\"Yes\"),AND($L$1=\"Scaled\",D5>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D5=\"No\"),AND($L$1=\"Scaled\",D5<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I5=\"\",\"\",IF(P5>0,P5,IF(Q5>0,Q5,0)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(I5=1,S4=\"\"),1,IF(OR(AND(J4=1,(I5-I3<>0)),AND(S4=0,I4=I5),AND(J4=1,I5=I3)),0,1)))","v":1},{"$f":"IF(I5=\"\",T4,IF(AND(R5>1,OR(T4=\"\",T4=0,T4>=I5)),I5,IF(I5>T4,T4,0)))","v":0},{"$f":"IF(Master=\"Master\",Q5,IF(U4=\"\",R5,IF(OR(AND(T5>0,R5<U4),AND(T5=1,R5<=U4)),U4,R5)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(S4=1,T5=1),R5>0,AND(S6=0,V6=1)),1,0))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(T5>0,S5=1),AND(S5=1,V5=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(I5=1,R5=1),2,IF(AND(U4=1,K5=K4),2,IF(AND(AB4=2,K5=K4),2,IF(I5=1,1,\"\"))))","v":2}]
[2376,{"$f":"IF(I6=0,\"\",IF(I6=1,P$1&\".\"&K6,IF(I6=2,P$1&\".\"&K6&\".\"&L6,IF(I6=3,P$1&\".\"&K6&\".\"&L6&\".\"&M6,IF(I6=4,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6,IF(I6=5,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6))))))","v":"L.2"},"Are audits performed to ensure compliance with any legal, regulatory or industry requirements?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"NA","",1,null,{"$f":"IF(K5=\"\",1,IF(I6=1,K5+1,K5))","v":2},{"$f":"IF(L5=\"\",0,IF(K5<>K6,0,IF($G6=2,L5+1,L5)))","v":0},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($G6=3,M5+1,M5)))","v":0},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($G6=4,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($G6=5,O5+1,O5)))","v":0},0,{"$f":"IF(I6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D6=\"Yes\"),AND($L$1=\"Scaled\",D6>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D6=\"No\"),AND($L$1=\"Scaled\",D6<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I6=\"\",\"\",IF(P6>0,P6,IF(Q6>0,Q6,0)))","v":1},1,{"$f":"IF(I6=\"\",T5,IF(AND(R6>1,OR(T5=\"\",T5=0,T5>=I6)),I6,IF(I6>T5,T5,0)))","v":0},1,{"$f":"IF(I6=\"\",\"\",IF(OR(AND(S5=1,T6=1),R6>0,AND(S7=0,V7=1)),1,0))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(T6>0,S6=1),AND(S6=1,V6=1)),1,0))","v":1},0,null,null,null,{"$f":"IF(AND(I6=1,R6=1),2,IF(AND(U5=1,K6=K5),2,IF(AND(AB5=2,K6=K5),2,IF(I6=1,1,\"\"))))","v":2}]
[2829,"L.3","Is there a process used to manage the controls on a life cycle basis?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"NA",null,1,null,3,0,0,0,0,0,{"$f":"IF(I7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D7=\"Yes\"),AND($L$1=\"Scaled\",D7>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D7=\"No\"),AND($L$1=\"Scaled\",D7<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2830,"L.4","Are there procedures to ensure compliance with legislative, regulatory, and contractual requirements on the use of material where intellectual property rights may be applied and on the use of proprietary software products?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"18.1.2","Intellectual property rights",1,null,4,0,0,0,0,0,{"$f":"IF(I8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D8=\"Yes\"),AND($L$1=\"Scaled\",D8>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D8=\"No\"),AND($L$1=\"Scaled\",D8<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2837,"L.5","Is there a records retention policy covering paper and electronic records, including email, in support of applicable regulations, standards and contractual requirements?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"18.1.3 ","Protection of records",1,null,5,0,0,0,0,0,{"$f":"IF(I9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D9=\"Yes\"),AND($L$1=\"Scaled\",D9>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D9=\"No\"),AND($L$1=\"Scaled\",D9<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2849,"L.6","Are encryption tools managed and maintained?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"18.1.3 ","Protection of records",1,null,6,0,0,0,0,0,{"$f":"IF(I10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D10=\"Yes\"),AND($L$1=\"Scaled\",D10>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D10=\"No\"),AND($L$1=\"Scaled\",D10<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2857,"L.7","Does management regularly review the compliance of information processing within their area of responsibility with the appropriate security policies, standards, and any other security requirements?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group",null,"18.2.2 ","Compliance with the security policies and standards",1,null,7,0,0,0,0,0,{"$f":"IF(I11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D11=\"Yes\"),AND($L$1=\"Scaled\",D11>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D11=\"No\"),AND($L$1=\"Scaled\",D11<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2390,"L.8","Has a review of security policies, standards, procedures, and/or guidelines been performed within the last 12 months?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group","B.1 Information Security Policy Content and Maintenance","18.2.2 ","Compliance with the security policies and standards",1,null,8,0,0,0,0,0,{"$f":"IF(I12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D12=\"Yes\"),AND($L$1=\"Scaled\",D12>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D12=\"No\"),AND($L$1=\"Scaled\",D12<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2868,"L.9","Are information systems regularly checked for compliance with security implementation standards?","Yes","Cloudamize Security Policy - Cloudamize Security Working Group","L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","18.2.3 ","Technical compliance review",1,null,9,0,0,0,0,0,{"$f":"IF(I13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D13=\"Yes\"),AND($L$1=\"Scaled\",D13>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D13=\"No\"),AND($L$1=\"Scaled\",D13<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2404,"L.10","Has a network penetration test been conducted within the last 12 months?","Yes","Cloudamize Security Policy - Cloudamize Network Security","L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","18.2.3 ","Technical compliance review",1,null,10,0,0,0,0,0,{"$f":"IF(I14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D14=\"Yes\"),AND($L$1=\"Scaled\",D14>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D14=\"No\"),AND($L$1=\"Scaled\",D14<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2869,"L.11","Does the respondent have an independent audit function?","Yes","Curently pursuing a SOC 2 audit reivew",null,"18.2.1","Independent review of information security",1,null,11,0,0,0,0,0,{"$f":"IF(I15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D15=\"Yes\"),AND($L$1=\"Scaled\",D15>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D15=\"No\"),AND($L$1=\"Scaled\",D15<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[2871,"L.12","Are any information systems audit tools (e.g., software or data files) accessible to any users in any unprotected area?","Yes","Cloudamize Security Policy - Cloudamize Security Work Group",null,"NA",null,1,null,12,0,0,0,0,0,{"$f":"IF(I16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D16=\"Yes\"),AND($L$1=\"Scaled\",D16>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D16=\"No\"),AND($L$1=\"Scaled\",D16<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3733,"L.13","Is there an internal compliance and ethics reporting mechanism and training program for constituents to report compliance issues?","Yes","Cloudamize Security Policy - Cloudamize Security Work Group",null,"NA",null,1,null,13,0,0,0,0,1,{"$f":"IF(I17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D17=\"Yes\"),AND($L$1=\"Scaled\",D17>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D17=\"No\"),AND($L$1=\"Scaled\",D17<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]

{"sheet":"M. Mobile","index":19,"n_rows":118,"n_cols":28,"rows_kept":118,"cut":false,"hidden":false,"merged":[[2,1,2,7]]}
[10,"M. Mobile",null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,null,"Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"M"}]
[null,null,null,{"$f":"IF(W2=0,\"0%\",W2/S2)","v":1},"Percent Complete",null,null,null,{"$f":"COUNTA(I5:I118)","v":114},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(S5:S118,1)","v":105},null,null,null,{"$f":"COUNTIF(W5:W118,1)","v":105}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column E to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, check the Disable Tab Automation checkbox at the top of the page.",null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter"]
[{"$f":"MAX(A5:A118)","v":3918},"Ques Num","Question/Request","Response","Additional Information","AUP Reference","ISO Ref Num","ISO Ref Text",null,null,0]
[3883,{"$f":"IF(I5=0,\"\",IF(I5=1,P$1&\".\"&K5,IF(I5=2,P$1&\".\"&K5&\".\"&L5,IF(I5=3,P$1&\".\"&K5&\".\"&L5&\".\"&M5,IF(I5=4,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5,IF(I5=5,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5))))))","v":"M.1"},"Are mobile devices able to access Scoped Systems and Data","No",null,null,6.2,"Mobile devices and teleworking",1,null,{"$f":"IF(K4=\"\",1,IF(I5=1,K4+1,K4))","v":1},{"$f":"IF(L4=\"\",0,IF(K4<>K5,0,IF($I5=2,L4+1,L4)))","v":0},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($I5=3,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($I5=4,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($I5=5,O4+1,O4)))","v":0},{"$f":"IF(OR(Master=\"Master\",I5=0,J5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,21,FALSE)),0,VLOOKUP(A5,L2_Array,21,FALSE)))","v":2},{"$f":"IF(I5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D5=\"Yes\"),AND($L$1=\"Scaled\",D5>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D5=\"No\"),AND($L$1=\"Scaled\",D5<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},{"$f":"IF(I5=\"\",\"\",IF(P5>0,P5,IF(Q5>0,Q5,0)))","v":2},{"$f":"IF(OR(I5=\"\",I5=0),\"\",IF(OR(I5=1,S4=\"\"),1,IF(OR(AND(J4=1,(I5-I3<>0)),AND(S4=0,I4=I5),AND(J4=1,I5=I3)),0,1)))","v":1},{"$f":"IF(I5=\"\",T4,IF(AND(R5>1,OR(T4=\"\",T4=0,T4>=I5)),I5,IF(I5>T4,T4,0)))","v":1},{"$f":"IF(Master=\"Master\",Q5,IF(U4=\"\",R5,IF(OR(AND(T5>0,R5<U4),AND(T5=1,R5<=U4)),U4,R5)))","v":2},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(S4=1,T5=1),R5>0,AND(S6=0,V6=1)),1,0))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(T5>0,S5=1),AND(S5=1,V5=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(I5=1,R5=1),2,IF(AND(U4=1,K5=K4),2,IF(AND(AB4=2,K5=K4),2,IF(I5=1,1,\"\"))))","v":1}]
[3881,{"$f":"IF(I6=0,\"\",IF(I6=1,P$1&\".\"&K6,IF(I6=2,P$1&\".\"&K6&\".\"&L6,IF(I6=3,P$1&\".\"&K6&\".\"&L6&\".\"&M6,IF(I6=4,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6,IF(I6=5,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6))))))","v":"M.1.1"},"Is there a policy for mobile device use that has been approved by management? If yes, does it contain:",null,null,null,"6.2.1","Mobile device policy",2,null,{"$f":"IF(K5=\"\",1,IF(I6=1,K5+1,K5))","v":1},{"$f":"IF(L5=\"\",0,IF(K5<>K6,0,IF($I6=2,L5+1,L5)))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($I6=3,M5+1,M5)))","v":0},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($I6=4,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($I6=5,O5+1,O5)))","v":0},{"$f":"IF(OR(Master=\"Master\",I6=0,J6=1),0,IF(ISNA(VLOOKUP(A6,L2_Array,21,FALSE)),0,VLOOKUP(A6,L2_Array,21,FALSE)))","v":0},{"$f":"IF(I6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D6=\"Yes\"),AND($L$1=\"Scaled\",D6>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D6=\"No\"),AND($L$1=\"Scaled\",D6<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(I6=\"\",\"\",IF(P6>0,P6,IF(Q6>0,Q6,0)))","v":0},1,{"$f":"IF(I6=\"\",T5,IF(AND(R6>1,OR(T5=\"\",T5=0,T5>=I6)),I6,IF(I6>T5,T5,0)))","v":1},{"$f":"IF(Master=\"Master\",Q6,IF(U5=\"\",R6,IF(OR(AND(T6>0,R6<U5),AND(T6=1,R6<=U5)),U5,R6)))","v":2},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(S5=1,T6=1),R6>0,AND(S7=0,V7=1)),1,0))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(T6>0,S6=1),AND(S6=1,V6=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A6,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(I6=1,R6=1),2,IF(AND(U5=1,K6=K5),2,IF(AND(AB5=2,K6=K5),2,IF(I6=1,1,\"\"))))","v":""}]
[3882,"M.1.1.1","Security awareness training/education?",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,1,0,0,0,{"$f":"IF(I7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D7=\"Yes\"),AND($L$1=\"Scaled\",D7>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D7=\"No\"),AND($L$1=\"Scaled\",D7<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3738,"M.1.1.2","Acceptable use?",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,2,0,0,0,{"$f":"IF(I8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D8=\"Yes\"),AND($L$1=\"Scaled\",D8>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D8=\"No\"),AND($L$1=\"Scaled\",D8<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3884,"M.1.1.3","Operating system security?",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,3,0,0,0,{"$f":"IF(I9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D9=\"Yes\"),AND($L$1=\"Scaled\",D9>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D9=\"No\"),AND($L$1=\"Scaled\",D9<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3740,"M.1.1.4","User responsibilities?",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,4,0,0,0,{"$f":"IF(I10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D10=\"Yes\"),AND($L$1=\"Scaled\",D10>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D10=\"No\"),AND($L$1=\"Scaled\",D10<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3741,"M.1.1.5","Access control?",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,5,0,0,0,{"$f":"IF(I11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D11=\"Yes\"),AND($L$1=\"Scaled\",D11>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D11=\"No\"),AND($L$1=\"Scaled\",D11<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3742,"M.1.1.6","Data handling?",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,6,0,0,0,{"$f":"IF(I12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D12=\"Yes\"),AND($L$1=\"Scaled\",D12>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D12=\"No\"),AND($L$1=\"Scaled\",D12<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3743,"M.1.1.7","Individual responsibility for co-mingling personal and Scoped Data on the mobile device?",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,7,0,0,0,{"$f":"IF(I13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D13=\"Yes\"),AND($L$1=\"Scaled\",D13>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D13=\"No\"),AND($L$1=\"Scaled\",D13<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3744,"M.1.1.8","Constituent accountability?",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,8,0,0,0,{"$f":"IF(I14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D14=\"Yes\"),AND($L$1=\"Scaled\",D14>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D14=\"No\"),AND($L$1=\"Scaled\",D14<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3745,"M.1.1.9","Secure disposal of device at end of life?",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,9,0,0,0,{"$f":"IF(I15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D15=\"Yes\"),AND($L$1=\"Scaled\",D15>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D15=\"No\"),AND($L$1=\"Scaled\",D15<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3746,"M.1.1.10","Vulnerability management?",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,10,0,0,0,{"$f":"IF(I16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D16=\"Yes\"),AND($L$1=\"Scaled\",D16>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D16=\"No\"),AND($L$1=\"Scaled\",D16<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3747,"M.1.1.11","Responsibility for ensuring mobile device operating system is updated?",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,11,0,0,0,{"$f":"IF(I17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D17=\"Yes\"),AND($L$1=\"Scaled\",D17>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D17=\"No\"),AND($L$1=\"Scaled\",D17<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3748,"M.1.1.12","Responsibility for ensuring mobile device applications are updated?",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,12,0,0,0,{"$f":"IF(I18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D18=\"Yes\"),AND($L$1=\"Scaled\",D18>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D18=\"No\"),AND($L$1=\"Scaled\",D18<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3749,"M.1.1.13","Reporting information security incidents in the event of loss or theft?",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,13,0,0,0,{"$f":"IF(I19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D19=\"Yes\"),AND($L$1=\"Scaled\",D19>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D19=\"No\"),AND($L$1=\"Scaled\",D19<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3750,"M.1.1.14","Prohibit sharing mobile device with other users, including family and friends?",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,14,0,0,0,{"$f":"IF(I20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D20=\"Yes\"),AND($L$1=\"Scaled\",D20>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D20=\"No\"),AND($L$1=\"Scaled\",D20<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3751,"M.1.1.15","Ownership of data on the device?",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,15,0,0,0,{"$f":"IF(I21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D21=\"Yes\"),AND($L$1=\"Scaled\",D21>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D21=\"No\"),AND($L$1=\"Scaled\",D21<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3752,"M.1.1.16","Legal ownership and rights of the mobile device and contents?",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,16,0,0,0,{"$f":"IF(I22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D22=\"Yes\"),AND($L$1=\"Scaled\",D22>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D22=\"No\"),AND($L$1=\"Scaled\",D22<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3753,"M.1.1.17","Specific actions that may be taken in the event of a lost/stolen or compromised mobile device (e.g., remote disable, remote wipe, confiscation)?",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,17,0,0,0,{"$f":"IF(I23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D23=\"Yes\"),AND($L$1=\"Scaled\",D23>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D23=\"No\"),AND($L$1=\"Scaled\",D23<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3754,"M.1.1.18","Data sanitization of Scoped Data, settings and accounts on the mobile device at end of life?",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,18,0,0,0,{"$f":"IF(I24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D24=\"Yes\"),AND($L$1=\"Scaled\",D24>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D24=\"No\"),AND($L$1=\"Scaled\",D24<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3755,"M.1.1.19","Creation and use of mobile hotspots on the respondent's premise (BYON - Bring Your Own Network)",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,19,0,0,0,{"$f":"IF(I25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D25=\"Yes\"),AND($L$1=\"Scaled\",D25>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D25=\"No\"),AND($L$1=\"Scaled\",D25<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3756,"M.1.1.20","Consequences for non-compliance with mobile device policy?",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,20,0,0,0,{"$f":"IF(I26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D26=\"Yes\"),AND($L$1=\"Scaled\",D26>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D26=\"No\"),AND($L$1=\"Scaled\",D26<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3757,"M.1.1.21","User authentication on the device?",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,21,0,0,0,{"$f":"IF(I27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D27=\"Yes\"),AND($L$1=\"Scaled\",D27>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D27=\"No\"),AND($L$1=\"Scaled\",D27<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3758,"M.1.1.22","Device encryption?",null,null,null,"6.2.1","Mobile device policy",3,null,1,1,22,0,0,0,{"$f":"IF(I28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D28=\"Yes\"),AND($L$1=\"Scaled\",D28>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D28=\"No\"),AND($L$1=\"Scaled\",D28<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3759,"M.1.2","Are mobile devices permitted to connect to the environment? If Yes, what type of connection is permitted:",null,null,null,"6.2.1","Mobile device policy",2,null,1,2,0,0,0,0,{"$f":"IF(I29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D29=\"Yes\"),AND($L$1=\"Scaled\",D29>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D29=\"No\"),AND($L$1=\"Scaled\",D29<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3810,"M.1.2.1","Respondent e-mail - remote access?",null,null,null,"6.2.1","Mobile device policy",3,null,1,2,1,0,0,0,{"$f":"IF(I30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D30=\"Yes\"),AND($L$1=\"Scaled\",D30>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D30=\"No\"),AND($L$1=\"Scaled\",D30<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3811,"M.1.2.2","VPN - remote access?",null,null,null,"6.2.1","Mobile device policy",3,null,1,2,2,0,0,0,{"$f":"IF(I31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D31=\"Yes\"),AND($L$1=\"Scaled\",D31>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D31=\"No\"),AND($L$1=\"Scaled\",D31<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3812,"M.1.2.3","Guest access networks - wireless (local connection)?",null,null,null,"6.2.1","Mobile device policy",3,null,1,2,3,0,0,0,{"$f":"IF(I32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D32=\"Yes\"),AND($L$1=\"Scaled\",D32>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D32=\"No\"),AND($L$1=\"Scaled\",D32<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3813,"M.1.2.4","Corporate networks - wireless (local connection)?",null,null,null,"6.2.1","Mobile device policy",3,null,1,2,4,0,0,0,{"$f":"IF(I33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D33=\"Yes\"),AND($L$1=\"Scaled\",D33>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D33=\"No\"),AND($L$1=\"Scaled\",D33<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3814,"M.1.2.5","Test and development networks - wireless (local connection)?",null,null,null,"6.2.1","Mobile device policy",3,null,1,2,5,0,0,0,{"$f":"IF(I34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D34=\"Yes\"),AND($L$1=\"Scaled\",D34>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D34=\"No\"),AND($L$1=\"Scaled\",D34<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3815,"M.1.2.6","Production networks - wireless (local connection)?",null,null,null,"6.2.1","Mobile device policy",3,null,1,2,6,0,0,0,{"$f":"IF(I35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D35=\"Yes\"),AND($L$1=\"Scaled\",D35>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D35=\"No\"),AND($L$1=\"Scaled\",D35<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3816,"M.1.2.7","Any network containing Scoped Data - wireless (local connection)?",null,null,null,"6.2.1","Mobile device policy",3,null,1,2,7,0,0,0,{"$f":"IF(I36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D36=\"Yes\"),AND($L$1=\"Scaled\",D36>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D36=\"No\"),AND($L$1=\"Scaled\",D36<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3762,"M.1.3","Are all mobile devices evaluated as part of the IT Risk Management program?",null,null,null,"NA",null,2,null,1,3,0,0,0,0,{"$f":"IF(I37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D37=\"Yes\"),AND($L$1=\"Scaled\",D37>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D37=\"No\"),AND($L$1=\"Scaled\",D37<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3763,"M.1.4","Are any of the following mobile device ownership models supported:",null,null,null,"6.2.1","Mobile device policy",2,1,1,4,0,0,0,0,{"$f":"IF(I38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D38=\"Yes\"),AND($L$1=\"Scaled\",D38>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D38=\"No\"),AND($L$1=\"Scaled\",D38<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3764,"M.1.4.1","Respondent owned and managed mobile devices?",null,null,null,"6.2.1","Mobile device policy",3,null,1,4,1,0,0,0,{"$f":"IF(I39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D39=\"Yes\"),AND($L$1=\"Scaled\",D39>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D39=\"No\"),AND($L$1=\"Scaled\",D39<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,1,0,0,null,null,null,""]
[3765,"M.1.4.2","Constituent owned (BYOD) and respondent un-managed mobile devices?",null,null,null,"6.2.1","Mobile device policy",3,null,1,4,2,0,0,0,{"$f":"IF(I40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D40=\"Yes\"),AND($L$1=\"Scaled\",D40>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D40=\"No\"),AND($L$1=\"Scaled\",D40<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,null,null,null,""]
[3766,"M.1.4.3","Constituent owned (BYOD) and respondent managed mobile devices?",null,null,null,"6.2.1","Mobile device policy",3,null,1,4,3,0,0,0,{"$f":"IF(I41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D41=\"Yes\"),AND($L$1=\"Scaled\",D41>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D41=\"No\"),AND($L$1=\"Scaled\",D41<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,null,null,null,""]
[3767,"M.1.5","Are constituents who are authorized to access Scoped Systems and Data required to attend mandatory mobile device Security Awareness Training? If yes, what is the frequency:",null,null,null,"6.2.1","Mobile device policy",2,null,1,5,0,0,0,0,{"$f":"IF(I42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D42=\"Yes\"),AND($L$1=\"Scaled\",D42>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D42=\"No\"),AND($L$1=\"Scaled\",D42<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,0,1,0,null,null,null,""]
[3768,"M.1.5.1","Prior to connecting the mobile device to respondent resources?",null,null,null,"NA",null,3,null,1,5,1,0,0,0,{"$f":"IF(I43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D43=\"Yes\"),AND($L$1=\"Scaled\",D43>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D43=\"No\"),AND($L$1=\"Scaled\",D43<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3769,"M.1.5.2","Annually?",null,null,null,"NA",null,3,null,1,5,2,0,0,0,{"$f":"IF(I44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D44=\"Yes\"),AND($L$1=\"Scaled\",D44>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D44=\"No\"),AND($L$1=\"Scaled\",D44<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3770,"M.1.6","Is Mobile Device Management (MDM) functionality supported? If yes, is it:",null,null,null,"NA",null,2,null,1,6,0,0,0,0,{"$f":"IF(I45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D45=\"Yes\"),AND($L$1=\"Scaled\",D45>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D45=\"No\"),AND($L$1=\"Scaled\",D45<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3771,"M.1.6.1","Part of existing native software (e.g., Exchange ActiveSync)? If yes, describe.",null,null,null,"NA",null,3,null,1,6,1,0,0,0,{"$f":"IF(I46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D46=\"Yes\"),AND($L$1=\"Scaled\",D46>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D46=\"No\"),AND($L$1=\"Scaled\",D46<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3772,"M.1.6.2","Dedicated mobile device Management (MDM) software? If yes, describe.",null,null,null,"NA",null,3,null,1,6,2,0,0,0,{"$f":"IF(I47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D47=\"Yes\"),AND($L$1=\"Scaled\",D47>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D47=\"No\"),AND($L$1=\"Scaled\",D47<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3773,"M.1.7","Prior to device on-boarding are constituents required to sign a legal agreement which details the obligations and rights related to mobile devices? If yes, does it include:",null,null,null,"6.2.1.Section 2.b","Mobile device policy",2,null,1,7,0,0,0,0,{"$f":"IF(I48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D48=\"Yes\"),AND($L$1=\"Scaled\",D48>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D48=\"No\"),AND($L$1=\"Scaled\",D48<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3774,"M.1.7.1","Owner of data on the mobile device?",null,null,null,"6.2.1.Section 2.b","Mobile device policy",3,null,1,7,1,0,0,0,{"$f":"IF(I49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D49=\"Yes\"),AND($L$1=\"Scaled\",D49>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D49=\"No\"),AND($L$1=\"Scaled\",D49<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3775,"M.1.7.2","User's responsibility in ensuring the security of the mobile device?",null,null,null,"6.2.1","Mobile device policy",3,null,1,7,2,0,0,0,{"$f":"IF(I50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D50=\"Yes\"),AND($L$1=\"Scaled\",D50>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D50=\"No\"),AND($L$1=\"Scaled\",D50<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3776,"M.1.7.3","Security requirements for Scoped Systems and Data will override user's personal use?",null,null,null,"6.2.1","Mobile device policy",3,null,1,7,3,0,0,0,{"$f":"IF(I51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D51=\"Yes\"),AND($L$1=\"Scaled\",D51>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D51=\"No\"),AND($L$1=\"Scaled\",D51<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3777,"M.1.7.4","Support roles and responsibilities",null,null,null,"NA",null,3,null,1,7,4,0,0,0,{"$f":"IF(I52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D52=\"Yes\"),AND($L$1=\"Scaled\",D52>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D52=\"No\"),AND($L$1=\"Scaled\",D52<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3778,"M.1.8","In the event of a data compromise investigation, is it possible to:",null,null,null,"NA",null,2,1,1,8,0,0,0,0,{"$f":"IF(I53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D53=\"Yes\"),AND($L$1=\"Scaled\",D53>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D53=\"No\"),AND($L$1=\"Scaled\",D53<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3779,"M.1.8.1","Remotely wipe the mobile device?",null,null,null,"NA",null,3,null,1,8,1,0,0,0,{"$f":"IF(I54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D54=\"Yes\"),AND($L$1=\"Scaled\",D54>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D54=\"No\"),AND($L$1=\"Scaled\",D54<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,1,0,0,null,null,null,""]
[3780,"M.1.8.2","Remotely access Scoped Data on the mobile?",null,null,null,"NA",null,3,null,1,8,2,0,0,0,{"$f":"IF(I55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D55=\"Yes\"),AND($L$1=\"Scaled\",D55>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D55=\"No\"),AND($L$1=\"Scaled\",D55<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,null,null,null,""]
[3781,"M.1.8.3","Physically access Scoped Data on the mobile device?",null,null,null,"NA",null,3,null,1,8,3,0,0,0,{"$f":"IF(I56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D56=\"Yes\"),AND($L$1=\"Scaled\",D56>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D56=\"No\"),AND($L$1=\"Scaled\",D56<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,null,null,null,""]
[3782,"M.1.8.4","Perform a forensic analysis on the mobile device?",null,null,null,"NA",null,3,null,1,8,4,0,0,0,{"$f":"IF(I57=\"\",\"\",IF(D57=\"\",0,IF(D57=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D57=\"Yes\"),AND($L$1=\"Scaled\",D57>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D57=\"No\"),AND($L$1=\"Scaled\",D57<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,null,null,null,""]
[3783,"M.1.9","Is there an approved process to support the mobile device lifecycle? If yes, does it include:",null,null,null,"6.2.1.a","Mobile device policy",2,null,1,9,0,0,0,0,{"$f":"IF(I58=\"\",\"\",IF(D58=\"\",0,IF(D58=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D58=\"Yes\"),AND($L$1=\"Scaled\",D58>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D58=\"No\"),AND($L$1=\"Scaled\",D58<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,0,1,0,null,null,null,""]
[3784,"M.1.9.1","On-boarding mobile devices?",null,null,null,"6.2.1.a","Mobile device policy",3,null,1,9,1,0,0,0,{"$f":"IF(I59=\"\",\"\",IF(D59=\"\",0,IF(D59=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D59=\"Yes\"),AND($L$1=\"Scaled\",D59>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D59=\"No\"),AND($L$1=\"Scaled\",D59<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3785,"M.1.9.2","Off-boarding mobile devices?",null,null,null,"6.2.1.a","Mobile device policy",3,null,1,9,2,0,0,0,{"$f":"IF(I60=\"\",\"\",IF(D60=\"\",0,IF(D60=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D60=\"Yes\"),AND($L$1=\"Scaled\",D60>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D60=\"No\"),AND($L$1=\"Scaled\",D60<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3786,"M.1.9.3","Asset Tracking against the mobile devices each constituent is permitted to connect with?",null,null,null,"NA",null,3,null,1,9,3,0,0,0,{"$f":"IF(I61=\"\",\"\",IF(D61=\"\",0,IF(D61=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D61=\"Yes\"),AND($L$1=\"Scaled\",D61>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D61=\"No\"),AND($L$1=\"Scaled\",D61<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3787,"M.1.10","Is there an approved process for IT to off-board mobile devices when a constituent terminates, or requests to on-board a new mobile device? If yes, does it:",null,null,null,"NA",null,2,null,1,10,0,0,0,0,{"$f":"IF(I62=\"\",\"\",IF(D62=\"\",0,IF(D62=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D62=\"Yes\"),AND($L$1=\"Scaled\",D62>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D62=\"No\"),AND($L$1=\"Scaled\",D62<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3788,"M.1.10.1","Identify if the constituent has any legacy devices accessing Scoped Systems and Data?",null,null,null,"NA",null,3,null,1,10,1,0,0,0,{"$f":"IF(I63=\"\",\"\",IF(D63=\"\",0,IF(D63=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D63=\"Yes\"),AND($L$1=\"Scaled\",D63>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D63=\"No\"),AND($L$1=\"Scaled\",D63<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3789,"M.1.10.2","Confirm that Scoped Data, respondent settings and accounts have been removed from the legacy mobile device?",null,null,null,"NA",null,3,null,1,10,2,0,0,0,{"$f":"IF(I64=\"\",\"\",IF(D64=\"\",0,IF(D64=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D64=\"Yes\"),AND($L$1=\"Scaled\",D64>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D64=\"No\"),AND($L$1=\"Scaled\",D64<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3790,"M.1.11","Are constituents permitted to simultaneously connect more than two mobile devices to respondent resources?",null,null,null,"NA",null,2,null,1,11,0,0,0,0,{"$f":"IF(I65=\"\",\"\",IF(D65=\"\",0,IF(D65=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D65=\"Yes\"),AND($L$1=\"Scaled\",D65>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D65=\"No\"),AND($L$1=\"Scaled\",D65<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3797,"M.1.12","Are secure disposal service provided?",null,null,null,"6.2.1.i","Mobile device policy",2,null,1,12,0,0,0,0,{"$f":"IF(I66=\"\",\"\",IF(D66=\"\",0,IF(D66=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D66=\"Yes\"),AND($L$1=\"Scaled\",D66>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D66=\"No\"),AND($L$1=\"Scaled\",D66<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3798,"M.1.13","Are management discovery and control capabilities implemented? If yes, do they include:",null,null,null,"NA",null,2,null,1,13,0,0,0,0,{"$f":"IF(I67=\"\",\"\",IF(D67=\"\",0,IF(D67=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D67=\"Yes\"),AND($L$1=\"Scaled\",D67>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D67=\"No\"),AND($L$1=\"Scaled\",D67<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3799,"M.1.13.1","Software distribution controls?",null,null,null,"NA",null,3,null,1,13,1,0,0,0,{"$f":"IF(I68=\"\",\"\",IF(D68=\"\",0,IF(D68=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D68=\"Yes\"),AND($L$1=\"Scaled\",D68>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D68=\"No\"),AND($L$1=\"Scaled\",D68<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3800,"M.1.13.2","Password strength?",null,null,null,"NA",null,3,null,1,13,2,0,0,0,{"$f":"IF(I69=\"\",\"\",IF(D69=\"\",0,IF(D69=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D69=\"Yes\"),AND($L$1=\"Scaled\",D69>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D69=\"No\"),AND($L$1=\"Scaled\",D69<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3801,{"$f":"IF(I70=0,\"\",IF(I70=1,P$1&\".\"&K70,IF(I70=2,P$1&\".\"&K70&\".\"&L70,IF(I70=3,P$1&\".\"&K70&\".\"&L70&\".\"&M70,IF(I70=4,P$1&\".\"&K70&\".\"&L70&\".\"&M70&\".\"&N70,IF(I70=5,P$1&\".\"&K70&\".\"&L70&\".\"&M70&\".\"&N70&\".\"&O70))))))","v":"M.1.13.3"},"Remote wipe?",null,null,null,"NA",null,3,null,{"$f":"IF(K69=\"\",1,IF(I70=1,K69+1,K69))","v":1},{"$f":"IF(L69=\"\",0,IF(K69<>K70,0,IF($I70=2,L69+1,L69)))","v":13},{"$f":"IF(M69=\"\",0,IF(L69<>L70,0,IF($I70=3,M69+1,M69)))","v":3},{"$f":"IF(N69=\"\",0,IF(M69<>M70,0,IF($I70=4,N69+1,N69)))","v":0},{"$f":"IF(O69=\"\",0,IF(N69<>N70,0,IF($I70=5,O69+1,O69)))","v":0},{"$f":"IF(OR(Master=\"Master\",I70=0,J70=1),0,IF(ISNA(VLOOKUP(A70,L2_Array,21,FALSE)),0,VLOOKUP(A70,L2_Array,21,FALSE)))","v":0},{"$f":"IF(I70=\"\",\"\",IF(D70=\"\",0,IF(D70=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D70=\"Yes\"),AND($L$1=\"Scaled\",D70>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D70=\"No\"),AND($L$1=\"Scaled\",D70<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(I70=\"\",\"\",IF(P70>0,P70,IF(Q70>0,Q70,0)))","v":0},{"$f":"IF(OR(I70=\"\",I70=0),\"\",IF(OR(I70=1,S69=\"\"),1,IF(OR(AND(J69=1,(I70-I68<>0)),AND(S69=0,I69=I70),AND(J69=1,I70=I68)),0,1)))","v":1},{"$f":"IF(I70=\"\",T69,IF(AND(R70>1,OR(T69=\"\",T69=0,T69>=I70)),I70,IF(I70>T69,T69,0)))","v":1},{"$f":"IF(Master=\"Master\",Q70,IF(U69=\"\",R70,IF(OR(AND(T70>0,R70<U69),AND(T70=1,R70<=U69)),U69,R70)))","v":2},{"$f":"IF(I70=\"\",\"\",IF(OR(AND(S69=1,T70=1),R70>0,AND(S71=0,V71=1)),1,0))","v":1},{"$f":"IF(I70=\"\",\"\",IF(OR(AND(T70>0,S70=1),AND(S70=1,V70=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A70,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(I70=1,R70=1),2,IF(AND(U69=1,K70=K69),2,IF(AND(AB69=2,K70=K69),2,IF(I70=1,1,\"\"))))","v":""}]
[3802,"M.1.13.4","Remote lock?",null,null,null,"NA",null,3,null,1,13,4,0,0,0,{"$f":"IF(I71=\"\",\"\",IF(D71=\"\",0,IF(D71=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D71=\"Yes\"),AND($L$1=\"Scaled\",D71>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D71=\"No\"),AND($L$1=\"Scaled\",D71<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3803,"M.1.13.5","Detect jailbreak device?",null,null,null,"NA",null,3,null,1,13,5,0,0,0,{"$f":"IF(I72=\"\",\"\",IF(D72=\"\",0,IF(D72=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D72=\"Yes\"),AND($L$1=\"Scaled\",D72>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D72=\"No\"),AND($L$1=\"Scaled\",D72<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3804,"M.1.13.6","Application Inventory?",null,null,null,"NA",null,3,null,1,13,6,0,0,0,{"$f":"IF(I73=\"\",\"\",IF(D73=\"\",0,IF(D73=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D73=\"Yes\"),AND($L$1=\"Scaled\",D73>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D73=\"No\"),AND($L$1=\"Scaled\",D73<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3805,"M.1.13.7","Encryption verification?",null,null,null,"6.2.1.g","Mobile device policy",3,null,1,13,7,0,0,0,{"$f":"IF(I74=\"\",\"\",IF(D74=\"\",0,IF(D74=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D74=\"Yes\"),AND($L$1=\"Scaled\",D74>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D74=\"No\"),AND($L$1=\"Scaled\",D74<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3806,"M.1.13.8","Verification mobile device operating system?",null,null,null,"NA",null,3,null,1,13,8,0,0,0,{"$f":"IF(I75=\"\",\"\",IF(D75=\"\",0,IF(D75=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D75=\"Yes\"),AND($L$1=\"Scaled\",D75>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D75=\"No\"),AND($L$1=\"Scaled\",D75<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3807,"M.1.13.9","Verification mobile device applications?",null,null,null,"NA",null,3,null,1,13,9,0,0,0,{"$f":"IF(I76=\"\",\"\",IF(D76=\"\",0,IF(D76=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D76=\"Yes\"),AND($L$1=\"Scaled\",D76>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D76=\"No\"),AND($L$1=\"Scaled\",D76<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3808,"M.1.13.10","Detect and unlock applications?",null,null,null,"NA",null,3,null,1,13,10,0,0,0,{"$f":"IF(I77=\"\",\"\",IF(D77=\"\",0,IF(D77=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D77=\"Yes\"),AND($L$1=\"Scaled\",D77>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D77=\"No\"),AND($L$1=\"Scaled\",D77<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3817,"M.1.14","Is interaction permitted to Scoped Data and Systems? If yes, what is permitted:",null,null,null,"6.2.1","Mobile device policy",2,null,1,14,0,0,0,0,{"$f":"IF(I78=\"\",\"\",IF(D78=\"\",0,IF(D78=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D78=\"Yes\"),AND($L$1=\"Scaled\",D78>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D78=\"No\"),AND($L$1=\"Scaled\",D78<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3818,"M.1.14.1","View Scoped Data directly from the mobile device?",null,null,null,"6.2.1","Mobile device policy",3,null,1,14,1,0,0,0,{"$f":"IF(I79=\"\",\"\",IF(D79=\"\",0,IF(D79=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D79=\"Yes\"),AND($L$1=\"Scaled\",D79>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D79=\"No\"),AND($L$1=\"Scaled\",D79<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3819,"M.1.14.2","Access to Scoped Data limited via a clean room? ",null,null,null,"6.2.1","Mobile device policy",3,null,1,14,2,0,0,0,{"$f":"IF(I80=\"\",\"\",IF(D80=\"\",0,IF(D80=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D80=\"Yes\"),AND($L$1=\"Scaled\",D80>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D80=\"No\"),AND($L$1=\"Scaled\",D80<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3820,"M.1.14.3","Store Scoped Data locally on the mobile device, only when still logged into the application?",null,null,null,"6.2.1","Mobile device policy",3,null,1,14,3,0,0,0,{"$f":"IF(I81=\"\",\"\",IF(D81=\"\",0,IF(D81=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D81=\"Yes\"),AND($L$1=\"Scaled\",D81>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D81=\"No\"),AND($L$1=\"Scaled\",D81<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3821,"M.1.14.4","Store Scoped Data locally on the mobile device, when logged out of the application?",null,null,null,"6.2.1","Mobile device policy",3,null,1,14,4,0,0,0,{"$f":"IF(I82=\"\",\"\",IF(D82=\"\",0,IF(D82=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D82=\"Yes\"),AND($L$1=\"Scaled\",D82>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D82=\"No\"),AND($L$1=\"Scaled\",D82<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3822,"M.1.15","Is mobile device management part of the audit program? ",null,null,null,"NA",null,2,null,1,15,0,0,0,0,{"$f":"IF(I83=\"\",\"\",IF(D83=\"\",0,IF(D83=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D83=\"Yes\"),AND($L$1=\"Scaled\",D83>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D83=\"No\"),AND($L$1=\"Scaled\",D83<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3823,"M.1.16","Are there approved operating system versions permitted to connect to the respondent's environment? If yes, describe.",null,null,null,"6.2.1","Mobile device policy",2,null,1,16,0,0,0,0,{"$f":"IF(I84=\"\",\"\",IF(D84=\"\",0,IF(D84=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D84=\"Yes\"),AND($L$1=\"Scaled\",D84>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D84=\"No\"),AND($L$1=\"Scaled\",D84<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3824,"M.1.16.1","Are operating system versions that are deemed end of life permitted to connect to Scoped Systems and Data?",null,null,null,"6.2.1","Mobile device policy",3,null,1,16,1,0,0,0,{"$f":"IF(I85=\"\",\"\",IF(D85=\"\",0,IF(D85=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D85=\"Yes\"),AND($L$1=\"Scaled\",D85>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D85=\"No\"),AND($L$1=\"Scaled\",D85<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3825,"M.1.17","Are constituents permitted to create and activate mobile hotspots Bring Your Own Network (BYON) ?",null,null,null,"6.2.1","Mobile device policy",2,null,1,17,0,0,0,0,{"$f":"IF(I86=\"\",\"\",IF(D86=\"\",0,IF(D86=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D86=\"Yes\"),AND($L$1=\"Scaled\",D86>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D86=\"No\"),AND($L$1=\"Scaled\",D86<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3826,"M.1.18","Are mobile applications that access Scoped Systems and Data developed?",null,null,null,"NA",null,2,null,1,18,0,0,0,0,{"$f":"IF(I87=\"\",\"\",IF(D87=\"\",0,IF(D87=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D87=\"Yes\"),AND($L$1=\"Scaled\",D87>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D87=\"No\"),AND($L$1=\"Scaled\",D87<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3918,"M.1.18.1","Are the applications released:",null,null,null,"NA",null,3,1,1,18,1,0,0,0,{"$f":"IF(I88=\"\",\"\",IF(D88=\"\",0,IF(D88=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D88=\"Yes\"),AND($L$1=\"Scaled\",D88>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D88=\"No\"),AND($L$1=\"Scaled\",D88<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3827,"M.1.18.1.1","In an application store - customer only?",null,null,null,"NA",null,4,null,1,18,1,1,0,0,{"$f":"IF(I89=\"\",\"\",IF(D89=\"\",0,IF(D89=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D89=\"Yes\"),AND($L$1=\"Scaled\",D89>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D89=\"No\"),AND($L$1=\"Scaled\",D89<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,1,0,0,null,null,null,""]
[3828,"M.1.18.1.2","In an application store - public?",null,null,null,"NA",null,4,null,1,18,1,2,0,0,{"$f":"IF(I90=\"\",\"\",IF(D90=\"\",0,IF(D90=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D90=\"Yes\"),AND($L$1=\"Scaled\",D90>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D90=\"No\"),AND($L$1=\"Scaled\",D90<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,null,null,null,""]
[3829,"M.1.18.2","Are any actions performed by the application to Scoped Systems or Data? If yes, what are they:",null,null,null,"NA",null,3,null,1,18,2,0,0,0,{"$f":"IF(I91=\"\",\"\",IF(D91=\"\",0,IF(D91=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D91=\"Yes\"),AND($L$1=\"Scaled\",D91>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D91=\"No\"),AND($L$1=\"Scaled\",D91<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,0,1,0,null,null,null,""]
[3830,"M.1.18.2.1","Access?",null,null,null,"NA",null,4,null,1,18,2,1,0,0,{"$f":"IF(I92=\"\",\"\",IF(D92=\"\",0,IF(D92=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D92=\"Yes\"),AND($L$1=\"Scaled\",D92>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D92=\"No\"),AND($L$1=\"Scaled\",D92<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3831,"M.1.18.2.2","Process?",null,null,null,"NA",null,4,null,1,18,2,2,0,0,{"$f":"IF(I93=\"\",\"\",IF(D93=\"\",0,IF(D93=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D93=\"Yes\"),AND($L$1=\"Scaled\",D93>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D93=\"No\"),AND($L$1=\"Scaled\",D93<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3832,"M.1.18.2.3","Transmit?",null,null,null,"NA",null,4,null,1,18,2,3,0,0,{"$f":"IF(I94=\"\",\"\",IF(D94=\"\",0,IF(D94=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D94=\"Yes\"),AND($L$1=\"Scaled\",D94>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D94=\"No\"),AND($L$1=\"Scaled\",D94<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3833,"M.1.18.2.4","Store locally?",null,null,null,"NA",null,4,null,1,18,2,4,0,0,{"$f":"IF(I95=\"\",\"\",IF(D95=\"\",0,IF(D95=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D95=\"Yes\"),AND($L$1=\"Scaled\",D95>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D95=\"No\"),AND($L$1=\"Scaled\",D95<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3834,"M.1.18.3","Is there a mobile software development lifecycle (SDLC) process? If yes, does it include:",null,null,null,"NA",null,3,null,1,18,3,0,0,0,{"$f":"IF(I96=\"\",\"\",IF(D96=\"\",0,IF(D96=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D96=\"Yes\"),AND($L$1=\"Scaled\",D96>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D96=\"No\"),AND($L$1=\"Scaled\",D96<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3835,"M.1.18.3.1","Application security review?",null,null,null,"NA",null,4,null,1,18,3,1,0,0,{"$f":"IF(I97=\"\",\"\",IF(D97=\"\",0,IF(D97=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D97=\"Yes\"),AND($L$1=\"Scaled\",D97>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D97=\"No\"),AND($L$1=\"Scaled\",D97<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3836,"M.1.18.3.2","Static Code Analysis (SCA)?",null,null,null,"NA",null,4,null,1,18,3,2,0,0,{"$f":"IF(I98=\"\",\"\",IF(D98=\"\",0,IF(D98=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D98=\"Yes\"),AND($L$1=\"Scaled\",D98>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D98=\"No\"),AND($L$1=\"Scaled\",D98<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3837,"M.1.18.3.3","Penetration test?",null,null,null,"NA",null,4,null,1,18,3,3,0,0,{"$f":"IF(I99=\"\",\"\",IF(D99=\"\",0,IF(D99=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D99=\"Yes\"),AND($L$1=\"Scaled\",D99>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D99=\"No\"),AND($L$1=\"Scaled\",D99<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3838,"M.1.18.3.4","Signing by a trusted certificate?",null,null,null,"NA",null,4,null,1,18,3,4,0,0,{"$f":"IF(I100=\"\",\"\",IF(D100=\"\",0,IF(D100=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D100=\"Yes\"),AND($L$1=\"Scaled\",D100>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D100=\"No\"),AND($L$1=\"Scaled\",D100<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3839,"M.1.18.4","Are mobile applications developed for constituent use? If yes, which functions are permitted?",null,null,null,"6.2.1.f","Mobile device policy",3,null,1,18,4,0,0,0,{"$f":"IF(I101=\"\",\"\",IF(D101=\"\",0,IF(D101=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D101=\"Yes\"),AND($L$1=\"Scaled\",D101>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D101=\"No\"),AND($L$1=\"Scaled\",D101<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3840,"M.1.18.4.1","Access email?",null,null,null,"6.2.1.f","Mobile device policy",4,null,1,18,4,1,0,0,{"$f":"IF(I102=\"\",\"\",IF(D102=\"\",0,IF(D102=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D102=\"Yes\"),AND($L$1=\"Scaled\",D102>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D102=\"No\"),AND($L$1=\"Scaled\",D102<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3841,"M.1.18.4.2","Access contacts?",null,null,null,"6.2.1.f","Mobile device policy",4,null,1,18,4,2,0,0,{"$f":"IF(I103=\"\",\"\",IF(D103=\"\",0,IF(D103=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D103=\"Yes\"),AND($L$1=\"Scaled\",D103>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D103=\"No\"),AND($L$1=\"Scaled\",D103<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3842,"M.1.18.4.3","Access calendar?",null,null,null,"6.2.1.f","Mobile device policy",4,null,1,18,4,3,0,0,{"$f":"IF(I104=\"\",\"\",IF(D104=\"\",0,IF(D104=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D104=\"Yes\"),AND($L$1=\"Scaled\",D104>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D104=\"No\"),AND($L$1=\"Scaled\",D104<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3843,"M.1.18.4.4","Access user created content (e.g., photos and videos)?",null,null,null,"6.2.1.f","Mobile device policy",4,null,1,18,4,4,0,0,{"$f":"IF(I105=\"\",\"\",IF(D105=\"\",0,IF(D105=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D105=\"Yes\"),AND($L$1=\"Scaled\",D105>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D105=\"No\"),AND($L$1=\"Scaled\",D105<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3844,"M.1.18.4.5","Access geographic location?",null,null,null,"6.2.1.f","Mobile device policy",4,null,1,18,4,5,0,0,{"$f":"IF(I106=\"\",\"\",IF(D106=\"\",0,IF(D106=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D106=\"Yes\"),AND($L$1=\"Scaled\",D106>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D106=\"No\"),AND($L$1=\"Scaled\",D106<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3845,"M.1.18.4.6","Enable/disable camera?",null,null,null,"6.2.1.f","Mobile device policy",4,null,1,18,4,6,0,0,{"$f":"IF(I107=\"\",\"\",IF(D107=\"\",0,IF(D107=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D107=\"Yes\"),AND($L$1=\"Scaled\",D107>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D107=\"No\"),AND($L$1=\"Scaled\",D107<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3846,"M.1.18.4.7","Enable/disable microphone?",null,null,null,"6.2.1.f","Mobile device policy",4,null,1,18,4,7,0,0,{"$f":"IF(I108=\"\",\"\",IF(D108=\"\",0,IF(D108=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D108=\"Yes\"),AND($L$1=\"Scaled\",D108>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D108=\"No\"),AND($L$1=\"Scaled\",D108<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3847,"M.1.18.4.8","Connect to an external site \"beacon signal\" when the application is not activated by the user?",null,null,null,"6.2.1.k","Mobile device policy",4,null,1,18,4,8,0,0,{"$f":"IF(I109=\"\",\"\",IF(D109=\"\",0,IF(D109=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D109=\"Yes\"),AND($L$1=\"Scaled\",D109>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D109=\"No\"),AND($L$1=\"Scaled\",D109<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3848,"M.1.18.5","Does data remain stored on the device after the application disconnects? If yes, what type of data:",null,null,null,"6.2.1","Mobile device policy",3,null,1,18,5,0,0,0,{"$f":"IF(I110=\"\",\"\",IF(D110=\"\",0,IF(D110=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D110=\"Yes\"),AND($L$1=\"Scaled\",D110>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D110=\"No\"),AND($L$1=\"Scaled\",D110<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3849,"M.1.18.5.1","IP or web address?",null,null,null,"NA",null,4,null,1,18,5,1,0,0,{"$f":"IF(I111=\"\",\"\",IF(D111=\"\",0,IF(D111=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D111=\"Yes\"),AND($L$1=\"Scaled\",D111>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D111=\"No\"),AND($L$1=\"Scaled\",D111<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3850,"M.1.18.5.2","User name?",null,null,null,"NA",null,4,null,1,18,5,2,0,0,{"$f":"IF(I112=\"\",\"\",IF(D112=\"\",0,IF(D112=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D112=\"Yes\"),AND($L$1=\"Scaled\",D112>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D112=\"No\"),AND($L$1=\"Scaled\",D112<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3851,"M.1.18.5.3","Password?",null,null,null,"NA",null,4,null,1,18,5,3,0,0,{"$f":"IF(I113=\"\",\"\",IF(D113=\"\",0,IF(D113=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D113=\"Yes\"),AND($L$1=\"Scaled\",D113>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D113=\"No\"),AND($L$1=\"Scaled\",D113<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3852,"M.1.18.5.4","Session authentication cookie?",null,null,null,"NA",null,4,null,1,18,5,4,0,0,{"$f":"IF(I114=\"\",\"\",IF(D114=\"\",0,IF(D114=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D114=\"Yes\"),AND($L$1=\"Scaled\",D114>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D114=\"No\"),AND($L$1=\"Scaled\",D114<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3853,"M.1.18.5.5","Geographic location data?",null,null,null,"NA",null,4,null,1,18,5,5,0,0,{"$f":"IF(I115=\"\",\"\",IF(D115=\"\",0,IF(D115=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D115=\"Yes\"),AND($L$1=\"Scaled\",D115>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D115=\"No\"),AND($L$1=\"Scaled\",D115<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3854,"M.1.18.5.6","Scoped Data?",null,null,null,"NA",null,4,null,1,18,5,6,0,0,{"$f":"IF(I116=\"\",\"\",IF(D116=\"\",0,IF(D116=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D116=\"Yes\"),AND($L$1=\"Scaled\",D116>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D116=\"No\"),AND($L$1=\"Scaled\",D116<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3855,"M.1.18.6","Are mobile payments enabled? ",null,null,null,"NA",null,3,null,1,18,6,0,0,0,{"$f":"IF(I117=\"\",\"\",IF(D117=\"\",0,IF(D117=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D117=\"Yes\"),AND($L$1=\"Scaled\",D117>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D117=\"No\"),AND($L$1=\"Scaled\",D117<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3856,"M.1.18.6.1","Is Scoped Data stored in unencrypted form locally?",null,null,null,"6.2.1.g","Mobile device policy",4,null,1,18,6,1,0,0,{"$f":"IF(I118=\"\",\"\",IF(D118=\"\",0,IF(D118=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D118=\"Yes\"),AND($L$1=\"Scaled\",D118>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D118=\"No\"),AND($L$1=\"Scaled\",D118<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]

{"sheet":"P. Privacy","index":20,"n_rows":54,"n_cols":28,"rows_kept":54,"cut":false,"hidden":false,"merged":[[2,1,2,7]]}
[10,"P. Privacy",null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,null,"Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"P"}]
[null,null,null,{"$f":"IF(W2=0,\"0%\",W2/S2)","v":1},"Percent Complete",null,null,null,{"$f":"COUNTA(I5:I54)","v":50},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(S5:S54,1)","v":50},null,null,null,{"$f":"COUNTIF(W5:W54,1)","v":50}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column E to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, check the Disable Tab Automation checkbox at the top of the page.",null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter"]
[{"$f":"MAX(A5:A54)","v":3864},"Ques Num","Question/Request","Response","Additional Information","AUP Reference","ISO Ref Num","ISO Ref Text",null,null,0]
[3687,{"$f":"IF(I5=0,\"\",IF(I5=1,P$1&\".\"&K5,IF(I5=2,P$1&\".\"&K5&\".\"&L5,IF(I5=3,P$1&\".\"&K5&\".\"&L5&\".\"&M5,IF(I5=4,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5,IF(I5=5,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5))))))","v":"P.1"},"Is Scoped Data transmitted, processed, or stored that can be classified as non-public information (NPI), personally identifiable information (PII), or sensitive customer financial information? If yes, describe and list types of data.","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy. Only NPI, no PII or Finacial Information",null,"8.2.1","Classification of Information",1,null,{"$f":"IF(K4=\"\",1,IF(I5=1,K4+1,K4))","v":1},{"$f":"IF(L4=\"\",0,IF(K4<>K5,0,IF($I5=2,L4+1,L4)))","v":0},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($I5=3,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($I5=4,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($I5=5,O4+1,O4)))","v":0},{"$f":"IF(OR(Master=\"Master\",I5=0,J5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,21,FALSE)),0,VLOOKUP(A5,L2_Array,21,FALSE)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D5=\"Yes\"),AND($L$1=\"Scaled\",D5>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D5=\"No\"),AND($L$1=\"Scaled\",D5<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I5=\"\",\"\",IF(P5>0,P5,IF(Q5>0,Q5,0)))","v":1},{"$f":"IF(OR(I5=\"\",I5=0),\"\",IF(OR(I5=1,S4=\"\"),1,IF(OR(AND(J4=1,(I5-I3<>0)),AND(S4=0,I4=I5),AND(J4=1,I5=I3)),0,1)))","v":1},{"$f":"IF(I5=\"\",T4,IF(AND(R5>1,OR(T4=\"\",T4=0,T4>=I5)),I5,IF(I5>T4,T4,0)))","v":0},{"$f":"IF(Master=\"Master\",Q5,IF(U4=\"\",R5,IF(OR(AND(T5>0,R5<U4),AND(T5=1,R5<=U4)),U4,R5)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(S4=1,T5=1),R5>0,AND(S6=0,V6=1)),1,0))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(T5>0,S5=1),AND(S5=1,V5=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(I5=1,R5=1),2,IF(AND(U4=1,K5=K4),2,IF(AND(AB4=2,K5=K4),2,IF(I5=1,1,\"\"))))","v":2}]
[3221,{"$f":"IF(I6=0,\"\",IF(I6=1,P$1&\".\"&K6,IF(I6=2,P$1&\".\"&K6&\".\"&L6,IF(I6=3,P$1&\".\"&K6&\".\"&L6&\".\"&M6,IF(I6=4,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6,IF(I6=5,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6))))))","v":"P.1.1"},"Is there a documented data protection program with administrative, technical, and physical safeguards for the protection of Scoped Data?","Yes","Cloudamize Security Policy - Cloudamize Information Security Policy. ","P.6 Management of Client Target Privacy Data",null,null,2,null,{"$f":"IF(K5=\"\",1,IF(I6=1,K5+1,K5))","v":1},{"$f":"IF(L5=\"\",0,IF(K5<>K6,0,IF($I6=2,L5+1,L5)))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($I6=3,M5+1,M5)))","v":0},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($I6=4,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($I6=5,O5+1,O5)))","v":0},0,{"$f":"IF(I6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D6=\"Yes\"),AND($L$1=\"Scaled\",D6>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D6=\"No\"),AND($L$1=\"Scaled\",D6<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I6=\"\",\"\",IF(P6>0,P6,IF(Q6>0,Q6,0)))","v":1},1,{"$f":"IF(I6=\"\",T5,IF(AND(R6>1,OR(T5=\"\",T5=0,T5>=I6)),I6,IF(I6>T5,T5,0)))","v":0},{"$f":"IF(Master=\"Master\",Q6,IF(U5=\"\",R6,IF(OR(AND(T6>0,R6<U5),AND(T6=1,R6<=U5)),U5,R6)))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(S5=1,T6=1),R6>0,AND(S7=0,V7=1)),1,0))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(T6>0,S6=1),AND(S6=1,V6=1)),1,0))","v":1},0,null,null,null,{"$f":"IF(AND(I6=1,R6=1),2,IF(AND(U5=1,K6=K5),2,IF(AND(AB5=2,K6=K5),2,IF(I6=1,1,\"\"))))","v":2}]
[3234,"P.1.2","Is a response program maintained that includes policies and procedures to address privacy incidents, unauthorized disclosure, unauthorized access or breach of Scoped Data?","Yes","Cloudamize Security Policy - Cloudamize Privacy Policy","P.8 Privacy Event Notification and Response Management",16.100000000000001,"Management of information security incidents and improvements",2,null,1,2,0,0,0,1,{"$f":"IF(I7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D7=\"Yes\"),AND($L$1=\"Scaled\",D7>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D7=\"No\"),AND($L$1=\"Scaled\",D7<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[3690,"P.1.3","Do agreements with third parties who have access to Scoped Data, address confidentiality, audit, security, and privacy, including but not limited to incident response, ongoing monitoring, data sharing and secure disposal of Scoped Data?","Yes","Cloudamize Security Policy - Cloudamize Privacy Policy","P.4 Privacy Third Party Agreements","15.1.2 ","Addressing security within supplier agreements",2,null,1,3,0,0,0,0,{"$f":"IF(I8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D8=\"Yes\"),AND($L$1=\"Scaled\",D8>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D8=\"No\"),AND($L$1=\"Scaled\",D8<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3691,"P.1.4","Are processes maintained to ensure the proper disposal of Scoped Data? If yes, describe.","Yes","Cloudamize Security Policy - Cloudamize Privacy Policy",null,"8.3.2 ","Disposal of media",2,null,1,4,0,0,0,0,{"$f":"IF(I9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D9=\"Yes\"),AND($L$1=\"Scaled\",D9>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D9=\"No\"),AND($L$1=\"Scaled\",D9<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3692,"P.1.5","Is there a process to limit or prevent the sharing of Scoped Data with affiliates unless authorized?","Yes","Cloudamize Security Policy - Cloudamize Privacy Policy","P.6 Management of Client Target Privacy Data","8.2.3 ","Handling of assets",2,null,1,5,0,0,0,0,{"$f":"IF(I10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D10=\"Yes\"),AND($L$1=\"Scaled\",D10>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D10=\"No\"),AND($L$1=\"Scaled\",D10<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3284,"P.1.6","Is there a process to provide notification as required by regulatory authorities or law enforcement, to address incidents of unauthorized access or breach of Scoped Data?","Yes","Cloudamize Security Policy - Cloudamize Privacy Policy","P.8 Privacy Event Notification and Response Management","16.1.2 ","Reporting information security events",2,null,1,6,0,0,0,0,{"$f":"IF(I11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D11=\"Yes\"),AND($L$1=\"Scaled\",D11>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D11=\"No\"),AND($L$1=\"Scaled\",D11<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3857,"P.1.7","For services provided on behalf of client that include direct interaction with client's customers are processes in place to log and report privacy complaints?","Yes","Cloudamize Security Policy - Cloudamize Privacy Policy","P.4 Privacy Third Party Agreements","NA",null,2,null,1,7,0,0,0,0,{"$f":"IF(I12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D12=\"Yes\"),AND($L$1=\"Scaled\",D12>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D12=\"No\"),AND($L$1=\"Scaled\",D12<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3694,"P.2","Is Scoped Data transmitted, processed, or stored that can be classified as Protected Health Information (PHI), electronic health records, or personal health records of a covered entity? If yes, identify the classifications.","No",null,null,"8.2.1","Classification of Information",1,null,2,0,0,0,0,3,{"$f":"IF(I13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D13=\"Yes\"),AND($L$1=\"Scaled\",D13>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D13=\"No\"),AND($L$1=\"Scaled\",D13<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},3,1,1,3,1,1,1,null,null,null,1]
[3858,"P.2.1"," Is PHI accessed, transmitted, processed or stored?",null,null,null,"NA",null,2,null,2,1,0,0,0,0,{"$f":"IF(I14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D14=\"Yes\"),AND($L$1=\"Scaled\",D14>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D14=\"No\"),AND($L$1=\"Scaled\",D14<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3696,"P.2.2","Are there documented policies and procedures to detect and report unauthorized acquisition, use, or disclosure of PHI? If yes, describe.",null,null,"P.8 Privacy Event Notification and Response Management","16.1.2 ","Reporting information security events",2,null,2,2,0,0,0,0,{"$f":"IF(I15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D15=\"Yes\"),AND($L$1=\"Scaled\",D15>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D15=\"No\"),AND($L$1=\"Scaled\",D15<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3697,"P.2.3","Are there contractual provisions, and control mechanisms to ensure that privacy and security obligations of the respondent extend to the respondents suppliers, vendors, or subcontractors?",null,null,"P.4 Privacy Third Party Agreements","15.1.2 ","Addressing security within supplier agreements",2,null,2,3,0,0,0,0,{"$f":"IF(I16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D16=\"Yes\"),AND($L$1=\"Scaled\",D16>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D16=\"No\"),AND($L$1=\"Scaled\",D16<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3698,"P.2.4","Are there documented procedures for availability of access to PHI data or designated record set maintained by the respondent?",null,null,"P.6 Management of Client Target Privacy Data","8.2.3 ","Handling of assets",2,null,2,4,0,0,0,0,{"$f":"IF(I17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D17=\"Yes\"),AND($L$1=\"Scaled\",D17>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D17=\"No\"),AND($L$1=\"Scaled\",D17<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3699,"P.2.5","Are there documented procedures to enable the ability to reasonably amend PHI maintained by the respondent upon request?",null,null,"P.4 Privacy Third Party Agreements","NA",null,2,null,2,5,0,0,0,0,{"$f":"IF(I18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D18=\"Yes\"),AND($L$1=\"Scaled\",D18>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D18=\"No\"),AND($L$1=\"Scaled\",D18<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3700,"P.2.6","Are there logs or records of disclosures of PHI that can be provided upon request?",null,null,"P.1 Target Privacy Data Inventory and Flows","8.2.3.b","Handling of assets",2,null,2,6,0,0,0,0,{"$f":"IF(I19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D19=\"Yes\"),AND($L$1=\"Scaled\",D19>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D19=\"No\"),AND($L$1=\"Scaled\",D19<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3701,"P.2.7","Is a business associate contract in place to address obligations for the privacy and security requirements for the services provided?","Yes",null,"P.4 Privacy Third Party Agreements","15.1.2 ","Addressing security within supplier agreements",2,null,2,7,0,0,0,1,{"$f":"IF(I20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D20=\"Yes\"),AND($L$1=\"Scaled\",D20>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D20=\"No\"),AND($L$1=\"Scaled\",D20<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,1,3,1,1,1,null,null,null,""]
[3702,"P.2.8","Are there training logs for employees with access to client PHI to meet the privacy and security obligations required by HIPAA? If yes, describe.",null,null,"P.7 Privacy Awareness","7.2.2 ","Information security awareness, education and training",2,null,2,8,0,0,0,0,{"$f":"IF(I21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D21=\"Yes\"),AND($L$1=\"Scaled\",D21>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D21=\"No\"),AND($L$1=\"Scaled\",D21<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3703,"P.2.9","Is there a documented process to provide notification as required by regulatory authorities or law enforcement, to address incidents of unauthorized access or breach of protected health information?",null,null,"P.8 Privacy Event Notification and Response Management","16.1.1.b.3 ","Responsibilities and procedures",2,null,2,9,0,0,0,0,{"$f":"IF(I22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D22=\"Yes\"),AND($L$1=\"Scaled\",D22>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D22=\"No\"),AND($L$1=\"Scaled\",D22<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3704,"P.3","For Scoped Data, is personal information about individuals transmitted to or received from countries outside the United States? If yes, list the countries.","No",null,null,"NA",null,1,null,3,0,0,0,0,3,{"$f":"IF(I23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D23=\"Yes\"),AND($L$1=\"Scaled\",D23>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D23=\"No\"),AND($L$1=\"Scaled\",D23<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},3,1,1,3,1,1,1,null,null,null,1]
[3859,"P.3.1","Is information directly collected and used about individuals?",null,null,null,"NA",null,2,null,3,1,0,0,0,0,{"$f":"IF(I24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D24=\"Yes\"),AND($L$1=\"Scaled\",D24>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D24=\"No\"),AND($L$1=\"Scaled\",D24<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3239,"P.3.2","Are notices provided when information is directly collected from an individual? If yes, describe.",null,null,"P.2 Privacy Policy and Privacy Notices","NA",null,2,null,3,2,0,0,0,0,{"$f":"IF(I25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D25=\"Yes\"),AND($L$1=\"Scaled\",D25>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D25=\"No\"),AND($L$1=\"Scaled\",D25<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3707,"P.3.3","Are there documented operating procedures regarding limiting personal data collection and use?",null,null,null,"8.2.3 ","Handling of assets",2,null,3,3,0,0,0,0,{"$f":"IF(I26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D26=\"Yes\"),AND($L$1=\"Scaled\",D26>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D26=\"No\"),AND($L$1=\"Scaled\",D26<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3708,"P.3.4","Are there operating procedures for onward transfer of customer information? If yes, describe.",null,null,null,"13.2.1","Information transfer policies and procedures",2,null,3,4,0,0,0,0,{"$f":"IF(I27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D27=\"Yes\"),AND($L$1=\"Scaled\",D27>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D27=\"No\"),AND($L$1=\"Scaled\",D27<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3709,"P.3.5","Is Safe Harbor status maintained with the Department of Commerce with respect to the data protection applicable to the European Union?",null,null,"P.5 Legal Authorizations","NA",null,2,null,3,5,0,0,0,0,{"$f":"IF(I28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D28=\"Yes\"),AND($L$1=\"Scaled\",D28>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D28=\"No\"),AND($L$1=\"Scaled\",D28<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3254,"P.3.6","If customer data is directly collected from individuals, does the customer have the ability to opt out? ",null,null,null,"NA",null,2,null,3,6,0,0,0,0,{"$f":"IF(I29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D29=\"Yes\"),AND($L$1=\"Scaled\",D29>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D29=\"No\"),AND($L$1=\"Scaled\",D29<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3263,"P.3.7","If customer data of individuals is retained, are there processes and procedures to enable individuals to access, correct, amend, or delete inaccurate information?",null,null,null,"8.2.3 ","Handling of assets",2,null,3,7,0,0,0,0,{"$f":"IF(I30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D30=\"Yes\"),AND($L$1=\"Scaled\",D30>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D30=\"No\"),AND($L$1=\"Scaled\",D30<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3228,"P.3.8","Is there privacy awareness training provided to constituents regarding their obligation to data protection.","Yes","Security Awareness and Training Program and associated procedures ensure all MicroStrategy staff that manage the Secure Cloud complete annual security awareness training on relevant risk management and IT security threats, countermeasures, and trends. The entire MicroStrategy Secure Cloud team attends mandatory training on all key Secure Cloud policies, procedures, and operational controls. All MicroStrategy staff who manages the Secure Cloud is also required to complete privileged user training and acceptable use acknowledgement. ","P.7 Privacy Awareness","7.2.2 ","Information security awareness, education and training",2,null,3,8,0,0,0,1,{"$f":"IF(I31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D31=\"Yes\"),AND($L$1=\"Scaled\",D31>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D31=\"No\"),AND($L$1=\"Scaled\",D31<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,1,3,1,1,1,null,null,null,""]
[3713,"P.3.9","Are there documented procedures for cross border data flows of customer data to the US from other countries. If yes, list the countries:",null,null,"P.2 Privacy Policy and Privacy Notices","NA",null,2,null,3,9,0,0,0,0,{"$f":"IF(I32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D32=\"Yes\"),AND($L$1=\"Scaled\",D32>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D32=\"No\"),AND($L$1=\"Scaled\",D32<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3714,"P.3.10","Is there a documented response program with policies and procedures to address privacy incidents, unauthorized disclosure, unauthorized access or breach of Scoped Data?",null,null,"P.8 Privacy Event Notification and Response Management","16.1.1 ","Responsibilties and procedures",2,null,3,10,0,0,0,0,{"$f":"IF(I33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D33=\"Yes\"),AND($L$1=\"Scaled\",D33>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D33=\"No\"),AND($L$1=\"Scaled\",D33<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3715,"P.4","Is personal information disclosed to or retained by third parties? If yes, describe.","No",null,null,15,"Supplier Relationships",1,null,4,0,0,0,0,2,{"$f":"IF(I34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D34=\"Yes\"),AND($L$1=\"Scaled\",D34>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D34=\"No\"),AND($L$1=\"Scaled\",D34<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,1,3,1,1,1,null,null,null,1]
[3270,"P.4.1","Are there contractual controls to ensure that personal information shared with third parties is limited to defined parameters for access, use and disclosure? If yes, describe. If no, explain reason.","Yes","MicroStrategy does not share customer data stored on the MicroStrategy Secure Cloud with external third-parties, unless requested by the customer or required by law.","P.4 Privacy Third Part Agreements","15.1.2 ","Addressing security within supplier agreements",2,null,4,1,0,0,0,1,{"$f":"IF(I35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D35=\"Yes\"),AND($L$1=\"Scaled\",D35>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D35=\"No\"),AND($L$1=\"Scaled\",D35<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,1,3,1,1,1,null,null,null,""]
[3269,"P.4.2","Is personal information accessed, disclosed, processed, transmitted or retained with third parties outside the US? If yes, describe and list the countries.","No",null,null,15,"Supplier Relationships",2,null,4,2,0,0,0,2,{"$f":"IF(I36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D36=\"Yes\"),AND($L$1=\"Scaled\",D36>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D36=\"No\"),AND($L$1=\"Scaled\",D36<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,1,3,1,1,1,null,null,null,""]
[3718,"P.5","Is there a documented privacy policy or procedures for the protection of information transmitted, processed, or maintained on behalf of the client?","Yes","Cloudamize Security Policy - Cloudamize Privacy Policy","P.2 Privacy Policy and Privacy Notices","15.1.1","Information security policy for supplier relationships",1,null,5,0,0,0,0,{"$f":"IF(OR(Master=\"Master\",I37=0,J37=1),0,IF(ISNA(VLOOKUP(A37,L2_Array,21,FALSE)),0,VLOOKUP(A37,L2_Array,21,FALSE)))","v":1},{"$f":"IF(I37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D37=\"Yes\"),AND($L$1=\"Scaled\",D37>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D37=\"No\"),AND($L$1=\"Scaled\",D37<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,{"$f":"IF(ISNA(VLOOKUP(A37,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,2]
[3224,"P.5.1","Are privacy policies and procedures reviewed and revised at least annually? ","Yes","Cloudamize Security Policy - Cloudamize Privacy Policy","P.3 Privacy Organization and Program Maintenance","15.1.1.e","Information security policy for supplier relationships",2,null,5,1,0,0,0,0,{"$f":"IF(I38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D38=\"Yes\"),AND($L$1=\"Scaled\",D38>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D38=\"No\"),AND($L$1=\"Scaled\",D38<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3225,"P.6","Are there regular privacy risk assessments conducted? If yes, provide frequency and scope. If no, explain reason.","Yes","Cloudamize Security Policy - Cloudamize Privacy Policy","P.3 Privacy Organization and Program Maintenance","15.1.3.i ","Information and communication technology supply chain",1,null,6,0,0,0,0,1,{"$f":"IF(I39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D39=\"Yes\"),AND($L$1=\"Scaled\",D39>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D39=\"No\"),AND($L$1=\"Scaled\",D39<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[3226,"P.6.1","Are identified privacy risks and associated mitigation plans formally documented and reviewed by management?","Yes","Cloudamize Security Policy - Cloudamize Privacy Policy","P.3 Privacy Organization and Program Maintenance","15.1.1.l","Information security policy for supplier relationships",2,null,6,1,0,0,0,0,{"$f":"IF(I40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D40=\"Yes\"),AND($L$1=\"Scaled\",D40>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D40=\"No\"),AND($L$1=\"Scaled\",D40<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3227,"P.6.2","Are reasonable resources (in time and money) allocated to mitigating identified privacy risks?","Yes","Cloudamize Security Policy - Cloudamize Privacy Policy",null,"NA",null,2,null,6,2,0,0,0,0,{"$f":"IF(I41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D41=\"Yes\"),AND($L$1=\"Scaled\",D41>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D41=\"No\"),AND($L$1=\"Scaled\",D41<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3723,"P.7","Is there a data classification retention program that identifies the data types that require additional management and governance?","Yes",null,"P.1 Target Privacy Data Inventory and Flows",8.1999999999999993,"Information Classification",1,null,7,0,0,0,0,1,{"$f":"IF(I42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D42=\"Yes\"),AND($L$1=\"Scaled\",D42>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D42=\"No\"),AND($L$1=\"Scaled\",D42<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[3724,"P.7.1","Are there documented policies, procedures, and controls to limit access based on need to know or minimum necessary for constituents? If yes, describe.","Yes","Cloudamize Security Policy - Cloudamize Personnel Policy","P.6 Management of Client Target Privacy Data","9.1.1.b","Access control policy",2,null,7,1,0,0,0,1,{"$f":"IF(I43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D43=\"Yes\"),AND($L$1=\"Scaled\",D43>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D43=\"No\"),AND($L$1=\"Scaled\",D43<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,1,null,null,null,2]
[3235,"P.8","Is personal information collected directly from individuals? If yes, describe.","No",null,"P.6 Management of Client Target Privacy Data","NA",null,1,null,8,0,0,0,0,0,{"$f":"IF(I44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D44=\"Yes\"),AND($L$1=\"Scaled\",D44>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D44=\"No\"),AND($L$1=\"Scaled\",D44<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,1,2,1,1,0,null,null,null,1]
[3236,"P.9","Are controls in place to ensure that the collection of personal information is limited?","N/A","Cloudamize does not collect personal informaiton","P.6 Management of Client Target Privacy Data","8.2.3","Handling of assets",1,null,9,0,0,0,0,0,{"$f":"IF(I45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D45=\"Yes\"),AND($L$1=\"Scaled\",D45>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D45=\"No\"),AND($L$1=\"Scaled\",D45<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,1,3,1,1,0,null,null,null,1]
[3237,"P.10","Are controls in place to ensure that the collection and usage of personal information is limited and in compliance with applicable law?","N/A","Cloudamize does not collect personal informaiton","P.6 Management of Client Target Privacy Data","8.2.3","Handling of assets",1,null,10,0,0,0,0,0,{"$f":"IF(I46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D46=\"Yes\"),AND($L$1=\"Scaled\",D46>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D46=\"No\"),AND($L$1=\"Scaled\",D46<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":3},3,1,1,3,1,1,0,null,null,null,1]
[3860,"P.10.1","Are there enforcement mechanisms in place to address complaints, disputes, and recourse for violations of privacy compliance?",null,null,"P.6 Management of Client Target Privacy Data","NA",null,2,null,10,1,0,0,0,0,{"$f":"IF(I47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D47=\"Yes\"),AND($L$1=\"Scaled\",D47>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D47=\"No\"),AND($L$1=\"Scaled\",D47<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3729,"P.11"," Are transactions for covered accounts accessed, modified, or processed, including address changes and discrepancies? If yes, describe.","No",null,null,"NA",null,1,null,11,0,0,0,0,2,{"$f":"IF(I48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D48=\"Yes\"),AND($L$1=\"Scaled\",D48>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D48=\"No\"),AND($L$1=\"Scaled\",D48<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,1,3,1,1,1,null,null,null,1]
[3730,"P.11.1","Is there a documented identify theft prevention program approved by management in place to detect, prevent, and mitigate identify theft?",null,null,null,"NA",null,2,null,11,1,0,0,0,0,{"$f":"IF(I49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D49=\"Yes\"),AND($L$1=\"Scaled\",D49>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D49=\"No\"),AND($L$1=\"Scaled\",D49<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3731,"P.11.2","Are there documented policies and procedures for identifying and responding to relevant red flags on covered accounts, including address changes and discrepancies?",null,null,null,"NA",null,2,null,11,2,0,0,0,0,{"$f":"IF(I50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D50=\"Yes\"),AND($L$1=\"Scaled\",D50>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D50=\"No\"),AND($L$1=\"Scaled\",D50<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3861,"P.11.3","Is customer data transmitted, processed, or stored that can be classified as consumer report information provided by a consumer reporting agency?",null,null,null,8.1999999999999993,"Information Classification",2,null,11,3,0,0,0,0,{"$f":"IF(I51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D51=\"Yes\"),AND($L$1=\"Scaled\",D51>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D51=\"No\"),AND($L$1=\"Scaled\",D51<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3862,"P.12","Is there a compliance risk management system that addresses the quality and accuracy of reported consumer data?","No","Cloudamize does not collect or store reported consumer data",null,"NA",null,1,null,12,0,0,0,0,0,{"$f":"IF(I52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D52=\"Yes\"),AND($L$1=\"Scaled\",D52>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D52=\"No\"),AND($L$1=\"Scaled\",D52<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,1,3,1,1,0,null,null,null,1]
[3863,"P.12.1","Is there a compliance risk management system that addresses the quality of assembling and maintaining the data?",null,null,null,"NA",null,2,null,12,1,0,0,0,0,{"$f":"IF(I53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D53=\"Yes\"),AND($L$1=\"Scaled\",D53>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D53=\"No\"),AND($L$1=\"Scaled\",D53<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]
[3864,"P.12.2","Is there a mechanism in place for resolving consumer disputes?",null,null,null,"NA",null,2,null,12,2,0,0,0,0,{"$f":"IF(I54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D54=\"Yes\"),AND($L$1=\"Scaled\",D54>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D54=\"No\"),AND($L$1=\"Scaled\",D54<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,3,1,1,0,null,null,null,""]

{"sheet":"Q. Software Security","index":21,"n_rows":77,"n_cols":28,"rows_kept":77,"cut":false,"hidden":false,"merged":[[2,1,2,7]]}
[10,"Q. Software Application Security",null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,null,"Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"Q"}]
[null,null,null,{"$f":"IF(W2=0,\"0%\",W2/S2)","v":1},"Percent Complete",null,null,null,{"$f":"COUNTA(I5:I77)","v":73},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(S5:S77,1)","v":73},null,null,null,{"$f":"COUNTIF(W5:W77,1)","v":73}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column E to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, check the Disable Tab Automation checkbox at the top of the page.",null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter"]
[{"$f":"MAX(A5:A77)","v":3991},"Ques Num","Question/Request","Response","Additional Information","AUP Reference","ISO Ref Num","ISO Ref Text",null,null,0]
[3919,{"$f":"IF(I5=0,\"\",IF(I5=1,P$1&\".\"&K5,IF(I5=2,P$1&\".\"&K5&\".\"&L5,IF(I5=3,P$1&\".\"&K5&\".\"&L5&\".\"&M5,IF(I5=4,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5,IF(I5=5,P$1&\".\"&K5&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5))))))","v":"Q.1"},"Is Software provided? ","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q. Software Application Security",null,null,1,null,{"$f":"IF(K4=\"\",1,IF(I5=1,K4+1,K4))","v":1},{"$f":"IF(L4=\"\",0,IF(K4<>K5,0,IF($I5=2,L4+1,L4)))","v":0},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($I5=3,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($I5=4,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($I5=5,O4+1,O4)))","v":0},{"$f":"IF(OR(Master=\"Master\",I5=0,J5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,21,FALSE)),0,VLOOKUP(A5,L2_Array,21,FALSE)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D5=\"Yes\"),AND($L$1=\"Scaled\",D5>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D5=\"No\"),AND($L$1=\"Scaled\",D5<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I5=\"\",\"\",IF(P5>0,P5,IF(Q5>0,Q5,0)))","v":1},{"$f":"IF(OR(I5=\"\",I5=0),\"\",IF(OR(I5=1,S4=\"\"),1,IF(OR(AND(J4=1,(I5-I3<>0)),AND(S4=0,I4=I5),AND(J4=1,I5=I3)),0,1)))","v":1},{"$f":"IF(I5=\"\",T4,IF(AND(R5>1,OR(T4=\"\",T4=0,T4>=I5)),I5,IF(I5>T4,T4,0)))","v":0},{"$f":"IF(Master=\"Master\",Q5,IF(U4=\"\",R5,IF(OR(AND(T5>0,R5<U4),AND(T5=1,R5<=U4)),U4,R5)))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(S4=1,T5=1),R5>0,AND(S6=0,V6=1)),1,0))","v":1},{"$f":"IF(I5=\"\",\"\",IF(OR(AND(T5>0,S5=1),AND(S5=1,V5=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(I5=1,R5=1),2,IF(AND(U4=1,K5=K4),2,IF(AND(AB4=2,K5=K4),2,IF(I5=1,1,\"\"))))","v":2}]
[3920,{"$f":"IF(I6=0,\"\",IF(I6=1,P$1&\".\"&K6,IF(I6=2,P$1&\".\"&K6&\".\"&L6,IF(I6=3,P$1&\".\"&K6&\".\"&L6&\".\"&M6,IF(I6=4,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6,IF(I6=5,P$1&\".\"&K6&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6))))))","v":"Q.1.1"},"Is there a secure software development lifecycle policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy? ","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.1 Secure SDLC Policies, Standards and Procedures","14.2.1 ","Secure development policy",2,null,{"$f":"IF(K5=\"\",1,IF(I6=1,K5+1,K5))","v":1},{"$f":"IF(L5=\"\",0,IF(K5<>K6,0,IF($I6=2,L5+1,L5)))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($I6=3,M5+1,M5)))","v":0},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($I6=4,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($I6=5,O5+1,O5)))","v":0},{"$f":"IF(OR(Master=\"Master\",I6=0,J6=1),0,IF(ISNA(VLOOKUP(A6,L2_Array,21,FALSE)),0,VLOOKUP(A6,L2_Array,21,FALSE)))","v":1},{"$f":"IF(I6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D6=\"Yes\"),AND($L$1=\"Scaled\",D6>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D6=\"No\"),AND($L$1=\"Scaled\",D6<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I6=\"\",\"\",IF(P6>0,P6,IF(Q6>0,Q6,0)))","v":1},1,{"$f":"IF(I6=\"\",T5,IF(AND(R6>1,OR(T5=\"\",T5=0,T5>=I6)),I6,IF(I6>T5,T5,0)))","v":0},{"$f":"IF(Master=\"Master\",Q6,IF(U5=\"\",R6,IF(OR(AND(T6>0,R6<U5),AND(T6=1,R6<=U5)),U5,R6)))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(S5=1,T6=1),R6>0,AND(S7=0,V7=1)),1,0))","v":1},{"$f":"IF(I6=\"\",\"\",IF(OR(AND(T6>0,S6=1),AND(S6=1,V6=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A6,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(I6=1,R6=1),2,IF(AND(U5=1,K6=K5),2,IF(AND(AB5=2,K6=K5),2,IF(I6=1,1,\"\"))))","v":2}]
[3921,"Q.1.1.1","Has the policy been reviewed in the last 12 months? If yes, did it include:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.1 Secure SDLC Policies, Standards and Procedures","5.1.2","Review of policies for information security",3,null,1,1,1,0,0,0,{"$f":"IF(I7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D7=\"Yes\"),AND($L$1=\"Scaled\",D7>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D7=\"No\"),AND($L$1=\"Scaled\",D7<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3922,"Q.1.1.1.1","Feedback from interested parties?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.1 Secure SDLC Policies, Standards and Procedures","5.1.2","Review of policies for information security",4,null,1,1,1,1,0,0,{"$f":"IF(I8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D8=\"Yes\"),AND($L$1=\"Scaled\",D8>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D8=\"No\"),AND($L$1=\"Scaled\",D8<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3923,"Q.1.1.1.2","Results of independent reviews?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.1 Secure SDLC Policies, Standards and Procedures","5.1.2","Review of policies for information security",4,null,1,1,1,2,0,0,{"$f":"IF(I9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D9=\"Yes\"),AND($L$1=\"Scaled\",D9>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D9=\"No\"),AND($L$1=\"Scaled\",D9<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3924,"Q.1.1.1.3","Policy compliance?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.1 Secure SDLC Policies, Standards and Procedures","5.1.2","Review of policies for information security",4,null,1,1,1,3,0,0,{"$f":"IF(I10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D10=\"Yes\"),AND($L$1=\"Scaled\",D10>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D10=\"No\"),AND($L$1=\"Scaled\",D10<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3925,"Q.1.1.1.4","Changes that could affect the approach to managing information security?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.1 Secure SDLC Policies, Standards and Procedures","5.1.2","Review of policies for information security",4,null,1,1,1,4,0,0,{"$f":"IF(I11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D11=\"Yes\"),AND($L$1=\"Scaled\",D11>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D11=\"No\"),AND($L$1=\"Scaled\",D11<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3926,"Q.1.1.1.5","Reported information security incidents?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.1 Secure SDLC Policies, Standards and Procedures","5.1.2","Review of policies for information security",4,null,1,1,1,5,0,0,{"$f":"IF(I12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D12=\"Yes\"),AND($L$1=\"Scaled\",D12>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D12=\"No\"),AND($L$1=\"Scaled\",D12<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3927,"Q.1.1.1.6","Recommendations provided by relevant authorities?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.1 Secure SDLC Policies, Standards and Procedures","5.1.2","Review of policies for information security",4,null,1,1,1,6,0,0,{"$f":"IF(I13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D13=\"Yes\"),AND($L$1=\"Scaled\",D13>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D13=\"No\"),AND($L$1=\"Scaled\",D13<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3928,"Q.1.1.1.7","Records management?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.1 Secure SDLC Policies, Standards and Procedures","5.1.2","Review of policies for information security",4,null,1,1,1,7,0,0,{"$f":"IF(I14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D14=\"Yes\"),AND($L$1=\"Scaled\",D14>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D14=\"No\"),AND($L$1=\"Scaled\",D14<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3929,"Q.1.1.2","Is there a process to approve exceptions to the policy? ","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy",null,"5.1.2","Review of policies for information security",3,null,1,1,2,0,0,0,{"$f":"IF(I15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D15=\"Yes\"),AND($L$1=\"Scaled\",D15>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D15=\"No\"),AND($L$1=\"Scaled\",D15<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3930,"Q.1.1.2.1","Does security own the approval process?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.1 Secure SDLC Policies, Standards and Procedures","5.1.2","Review of policies for information security",4,null,1,1,2,1,0,0,{"$f":"IF(I16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D16=\"Yes\"),AND($L$1=\"Scaled\",D16>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D16=\"No\"),AND($L$1=\"Scaled\",D16<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3931,"Q.1.1.3","Is the SDLC policy communicated? If yes, to:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy",null,"NA",null,3,null,1,1,3,0,0,0,{"$f":"IF(I17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D17=\"Yes\"),AND($L$1=\"Scaled\",D17>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D17=\"No\"),AND($L$1=\"Scaled\",D17<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3932,"Q.1.1.3.1","Full time constituents?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy",null,"NA",null,4,null,1,1,3,1,0,0,{"$f":"IF(I18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D18=\"Yes\"),AND($L$1=\"Scaled\",D18>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D18=\"No\"),AND($L$1=\"Scaled\",D18<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3933,"Q.1.1.3.2","Part time constituents?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy",null,"NA",null,4,null,1,1,3,2,0,0,{"$f":"IF(I19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D19=\"Yes\"),AND($L$1=\"Scaled\",D19>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D19=\"No\"),AND($L$1=\"Scaled\",D19<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3934,"Q.1.1.3.3","Contractors?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy",null,"NA",null,4,null,1,1,3,3,0,0,{"$f":"IF(I20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D20=\"Yes\"),AND($L$1=\"Scaled\",D20>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D20=\"No\"),AND($L$1=\"Scaled\",D20<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3935,"Q.1.1.3.4","Temporary workers?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy",null,"NA",null,4,null,1,1,3,4,0,0,{"$f":"IF(I21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D21=\"Yes\"),AND($L$1=\"Scaled\",D21>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D21=\"No\"),AND($L$1=\"Scaled\",D21<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3936,"Q.1.2","Is a secure code review performed? If yes, what is the frequency:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.1 Secure SDLC Policies, Standards and Procedures","14.2.1 ","Secure development policy",2,null,1,2,0,0,0,0,{"$f":"IF(I22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D22=\"Yes\"),AND($L$1=\"Scaled\",D22>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D22=\"No\"),AND($L$1=\"Scaled\",D22<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3937,"Q.1.2.1","As developed?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy",null,"NA",null,3,null,1,2,1,0,0,0,{"$f":"IF(I23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D23=\"Yes\"),AND($L$1=\"Scaled\",D23>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D23=\"No\"),AND($L$1=\"Scaled\",D23<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3938,"Q.1.2.2","Monthly?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy",null,"NA",null,3,null,1,2,2,0,0,0,{"$f":"IF(I24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D24=\"Yes\"),AND($L$1=\"Scaled\",D24>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D24=\"No\"),AND($L$1=\"Scaled\",D24<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3939,"Q.1.2.3","Quarterly?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy",null,"NA",null,3,null,1,2,3,0,0,0,{"$f":"IF(I25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D25=\"Yes\"),AND($L$1=\"Scaled\",D25>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D25=\"No\"),AND($L$1=\"Scaled\",D25<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3940,"Q.1.2.4","Annually?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy",null,"NA",null,3,null,1,2,4,0,0,0,{"$f":"IF(I26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D26=\"Yes\"),AND($L$1=\"Scaled\",D26>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D26=\"No\"),AND($L$1=\"Scaled\",D26<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3941,"Q.1.2.5","Other?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy",null,"NA",null,3,null,1,2,5,0,0,0,{"$f":"IF(I27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D27=\"Yes\"),AND($L$1=\"Scaled\",D27>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D27=\"No\"),AND($L$1=\"Scaled\",D27<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3942,"Q.1.2.6","Does the secure code review include a third party review?","No",null,null,"NA",null,3,null,1,2,6,0,0,0,{"$f":"IF(I28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D28=\"Yes\"),AND($L$1=\"Scaled\",D28>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D28=\"No\"),AND($L$1=\"Scaled\",D28<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,3,2,1,1,0,null,null,null,2]
[3943,"Q.1.3","Are applications given ratings that reflect the types of data accessed (e.g., high, medium low)?","No",null,"Q. 3 Risk Classification","14.1.1 ","Information security requirements analysis and specification",2,null,1,3,0,0,0,0,{"$f":"IF(I29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D29=\"Yes\"),AND($L$1=\"Scaled\",D29>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D29=\"No\"),AND($L$1=\"Scaled\",D29<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[3944,"Q.1.4","Are the risks from internal and external sources clearly understood based on risk exposure?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q. 3 Risk Classification","14.1.1 ","Information security requirements analysis and specification",2,null,1,4,0,0,0,0,{"$f":"IF(I30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D30=\"Yes\"),AND($L$1=\"Scaled\",D30>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D30=\"No\"),AND($L$1=\"Scaled\",D30<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3945,"Q.1.5","Is there a Software Security Group responsible for application security?","Yes","Cloudamize Security Policy - Cloudamize Security Work Group",null,"14.2.8","Software testing",2,null,1,5,0,0,0,0,{"$f":"IF(I31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D31=\"Yes\"),AND($L$1=\"Scaled\",D31>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D31=\"No\"),AND($L$1=\"Scaled\",D31<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3946,"Q.1.6","Is a security architecture risk analysis performed when new platforms are designed? If yes, does it include:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.4 Secure Architectual Design Standards","14.1.1 ","Information security requirements analysis and specification",2,null,1,6,0,0,0,0,{"$f":"IF(I32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D32=\"Yes\"),AND($L$1=\"Scaled\",D32>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D32=\"No\"),AND($L$1=\"Scaled\",D32<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3947,"Q.1.6.1","Security feature review i.e., authentication, access controls, use of cryptography, etc.?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.4 Secure Architectual Design Standards","14.1.1 ","Information security requirements analysis and specification",3,null,1,6,1,0,0,0,{"$f":"IF(I33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D33=\"Yes\"),AND($L$1=\"Scaled\",D33>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D33=\"No\"),AND($L$1=\"Scaled\",D33<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3948,"Q.1.6.2","Security architecture design review for high risk applications?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.4 Secure Architectual Design Standards","14.1.1 ","Information security requirements analysis and specification",3,null,1,6,2,0,0,0,{"$f":"IF(I34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D34=\"Yes\"),AND($L$1=\"Scaled\",D34>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D34=\"No\"),AND($L$1=\"Scaled\",D34<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3949,"Q.1.6.3","Threat modeling into the business requirements/design process of the SDLC?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.4 Secure Architectual Design Standards","14.2.9","System acceptance testing",3,null,1,6,3,0,0,0,{"$f":"IF(I35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D35=\"Yes\"),AND($L$1=\"Scaled\",D35>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D35=\"No\"),AND($L$1=\"Scaled\",D35<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3950,"Q.1.6.4","Review when major changes are introduced into applications?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy",null,"14.2.2","System change control procedures",3,null,1,6,4,0,0,0,{"$f":"IF(I36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D36=\"Yes\"),AND($L$1=\"Scaled\",D36>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D36=\"No\"),AND($L$1=\"Scaled\",D36<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3951,"Q.1.7","Is there a secure application development life cycle process? If yes, does it include:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.1 Secure SDLC Policies, Standards and Procedures","14.2.1","Secure development policy",2,null,1,7,0,0,0,0,{"$f":"IF(I37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D37=\"Yes\"),AND($L$1=\"Scaled\",D37>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D37=\"No\"),AND($L$1=\"Scaled\",D37<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3952,"Q.1.7.1","Common vulnerabilities/bugs that need to be eliminated?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy",null,"14.2.1","Secure development policy",3,null,1,7,1,0,0,0,{"$f":"IF(I38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D38=\"Yes\"),AND($L$1=\"Scaled\",D38>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D38=\"No\"),AND($L$1=\"Scaled\",D38<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3953,"Q.1.7.2","Secure code reviews against the entire code base in the development phase?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.5 Secure Code Review",14.2,"Security in develoment and support processes",3,null,1,7,2,0,0,0,{"$f":"IF(I39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D39=\"Yes\"),AND($L$1=\"Scaled\",D39>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D39=\"No\"),AND($L$1=\"Scaled\",D39<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3954,"Q.1.7.3","Review by qualified individual?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.5 Secure Code Review","14.2.1.g","Secure development policy",3,null,1,7,3,0,0,0,{"$f":"IF(I40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D40=\"Yes\"),AND($L$1=\"Scaled\",D40>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D40=\"No\"),AND($L$1=\"Scaled\",D40<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3955,"Q.1.7.4","Use of automated code review tools?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.5 Secure Code Review","14.2.9","System acceptance testing",3,null,1,7,4,0,0,0,{"$f":"IF(I41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D41=\"Yes\"),AND($L$1=\"Scaled\",D41>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D41=\"No\"),AND($L$1=\"Scaled\",D41<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3956,"Q.1.7.5","Remediation of findings?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.5 Secure Code Review","14.2.9","System acceptance testing",3,null,1,7,5,0,0,0,{"$f":"IF(I42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D42=\"Yes\"),AND($L$1=\"Scaled\",D42>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D42=\"No\"),AND($L$1=\"Scaled\",D42<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3957,"Q.1.7.6","Formal software security training for developers?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy",null,"7.2.2"," Information security awareness, education and training",3,null,1,7,6,0,0,0,{"$f":"IF(I43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D43=\"Yes\"),AND($L$1=\"Scaled\",D43>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D43=\"No\"),AND($L$1=\"Scaled\",D43<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3958,"Q.1.7.7","Security experts that work with developers for every application?","No",null,null,"14.2.5 ","Secure system engineering principles",3,null,1,7,7,0,0,0,{"$f":"IF(I44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D44=\"Yes\"),AND($L$1=\"Scaled\",D44>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D44=\"No\"),AND($L$1=\"Scaled\",D44<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,3,2,1,1,0,null,null,null,2]
[3959,"Q.1.7.8","Outsourcing development? If yes, describe:","No",null,null,"14.2.7","Outsourced development",3,null,1,7,8,0,0,0,{"$f":"IF(I45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D45=\"Yes\"),AND($L$1=\"Scaled\",D45>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D45=\"No\"),AND($L$1=\"Scaled\",D45<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,3,2,1,1,0,null,null,null,2]
[3960,"Q.1.7.9","All developers subject to the SDLC?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy",null,"14.2.7.b","Outsourced development",3,null,1,7,9,0,0,0,{"$f":"IF(I46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D46=\"Yes\"),AND($L$1=\"Scaled\",D46>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D46=\"No\"),AND($L$1=\"Scaled\",D46<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3961,"Q.1.7.10","Identification of security defects documented and communicated with development to prevent reoccurrence?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.5 Secure Code Review","14.2.7.c","Outsourced development",3,null,1,7,10,0,0,0,{"$f":"IF(I47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D47=\"Yes\"),AND($L$1=\"Scaled\",D47>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D47=\"No\"),AND($L$1=\"Scaled\",D47<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3962,"Q.1.8","Is there a QA_UAT process? If yes does it include:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.7 QA_UAT Process","NA",null,2,null,1,8,0,0,0,0,{"$f":"IF(I48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D48=\"Yes\"),AND($L$1=\"Scaled\",D48>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D48=\"No\"),AND($L$1=\"Scaled\",D48<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3963,"Q.1.8.1","Edge/boundary value condition testing? ","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.7 QA_UAT Process","NA",null,3,null,1,8,1,0,0,0,{"$f":"IF(I49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D49=\"Yes\"),AND($L$1=\"Scaled\",D49>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D49=\"No\"),AND($L$1=\"Scaled\",D49<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3964,"Q.1.8.2","Testing procedures to determine whether security features are effective? If yes, are they:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.7 QA_UAT Process","14.2.8","System security testing",3,null,1,8,2,0,0,0,{"$f":"IF(I50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D50=\"Yes\"),AND($L$1=\"Scaled\",D50>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D50=\"No\"),AND($L$1=\"Scaled\",D50<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3965,"Q.1.8.2.1","Derived by obtaining a list of security features by the architecture group?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.7 QA_UAT Process","14.2.5","Secure system engineering principles",4,null,1,8,2,1,0,0,{"$f":"IF(I51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D51=\"Yes\"),AND($L$1=\"Scaled\",D51>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D51=\"No\"),AND($L$1=\"Scaled\",D51<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3966,"Q.1.8.3","Dynamic scanning against web based applications while in the Q/A phase? If no, is there a:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.7 QA_UAT Process","14.2.9","System acceptance testing",3,null,1,8,3,0,0,0,{"$f":"IF(I52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D52=\"Yes\"),AND($L$1=\"Scaled\",D52>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D52=\"No\"),AND($L$1=\"Scaled\",D52<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3967,"Q.1.8.3.1","Form of black box testing or scripts specific to abuse cases that are used? ","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.7 QA_UAT Process","NA",null,4,null,1,8,3,1,0,0,{"$f":"IF(I53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D53=\"Yes\"),AND($L$1=\"Scaled\",D53>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D53=\"No\"),AND($L$1=\"Scaled\",D53<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3968,"Q.1.8.4","Remediation of security vulnerabilities identified?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.7 QA_UAT Process","14.2.9","System acceptance testing",3,null,1,8,4,0,0,0,{"$f":"IF(I54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D54=\"Yes\"),AND($L$1=\"Scaled\",D54>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D54=\"No\"),AND($L$1=\"Scaled\",D54<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3969,"Q.1.8.5","Fuzz testing (e.g., small #'s, large #'s, negative values, binary sequences, command line inputs, random values, etc.}?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.7 QA_UAT Process","NA",null,3,null,1,8,5,0,0,0,{"$f":"IF(I55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D55=\"Yes\"),AND($L$1=\"Scaled\",D55>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D55=\"No\"),AND($L$1=\"Scaled\",D55<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3970,"Q.1.9","Is each release subject to a full secure code review?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.5 Secure Code Review","14.2.1","Secure development policy",2,null,1,9,0,0,0,0,{"$f":"IF(I56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D56=\"Yes\"),AND($L$1=\"Scaled\",D56>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D56=\"No\"),AND($L$1=\"Scaled\",D56<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3971,"Q.1.10","Are penetration tests performed? If yes, are they:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy",null,"14.2.9","System acceptance testing",2,null,1,10,0,0,0,0,{"$f":"IF(I57=\"\",\"\",IF(D57=\"\",0,IF(D57=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D57=\"Yes\"),AND($L$1=\"Scaled\",D57>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D57=\"No\"),AND($L$1=\"Scaled\",D57<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3972,"Q.1.10.1","Performed by a 3rd party?","No",null,null,"14.2.9","System acceptance testing",3,null,1,10,1,0,0,0,{"$f":"IF(I58=\"\",\"\",IF(D58=\"\",0,IF(D58=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D58=\"Yes\"),AND($L$1=\"Scaled\",D58>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D58=\"No\"),AND($L$1=\"Scaled\",D58<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,3,2,1,1,0,null,null,null,2]
[3973,"Q.1.10.2","Internal Penetration Testers? If yes, are they:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.7 QA_UAT Process","14.2.9","System acceptance testing",3,null,1,10,2,0,0,0,{"$f":"IF(I59=\"\",\"\",IF(D59=\"\",0,IF(D59=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D59=\"Yes\"),AND($L$1=\"Scaled\",D59>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D59=\"No\"),AND($L$1=\"Scaled\",D59<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3974,"Q.1.10.2.1"," Part of the development group?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.7 QA_UAT Process","14.2.9","System acceptance testing",4,null,1,10,2,1,0,0,{"$f":"IF(I60=\"\",\"\",IF(D60=\"\",0,IF(D60=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D60=\"Yes\"),AND($L$1=\"Scaled\",D60>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D60=\"No\"),AND($L$1=\"Scaled\",D60<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3975,"Q.1.10.3","Consistently use the same approach (e.g., tools, methods, time spent, etc.)?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.7 QA_UAT Process","14.2.9","System acceptance testing",3,null,1,10,3,0,0,0,{"$f":"IF(I61=\"\",\"\",IF(D61=\"\",0,IF(D61=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D61=\"Yes\"),AND($L$1=\"Scaled\",D61>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D61=\"No\"),AND($L$1=\"Scaled\",D61<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3976,"Q.1.10.4","Performed on a set frequently? If yes, describe","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.7 QA_UAT Process","NA",null,3,null,1,10,4,0,0,0,{"$f":"IF(I62=\"\",\"\",IF(D62=\"\",0,IF(D62=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D62=\"Yes\"),AND($L$1=\"Scaled\",D62>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D62=\"No\"),AND($L$1=\"Scaled\",D62<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3977,"Q.1.10.5","Issues remediated?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.7 QA_UAT Process","14.2.9","System acceptance testing",3,null,1,10,5,0,0,0,{"$f":"IF(I63=\"\",\"\",IF(D63=\"\",0,IF(D63=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D63=\"Yes\"),AND($L$1=\"Scaled\",D63>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D63=\"No\"),AND($L$1=\"Scaled\",D63<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3978,"Q.1.10.6","Conducted on the complete production version, not just the components","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.7 QA_UAT Process","14.2.9","System acceptance testing",3,null,1,10,6,0,0,0,{"$f":"IF(I64=\"\",\"\",IF(D64=\"\",0,IF(D64=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D64=\"Yes\"),AND($L$1=\"Scaled\",D64>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D64=\"No\"),AND($L$1=\"Scaled\",D64<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3979,"Q.1.10.7","Any un-remediated Penetration Test issues in the application under review?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.7 QA_UAT Process","NA",null,3,null,1,10,7,0,0,0,{"$f":"IF(I65=\"\",\"\",IF(D65=\"\",0,IF(D65=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D65=\"Yes\"),AND($L$1=\"Scaled\",D65>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D65=\"No\"),AND($L$1=\"Scaled\",D65<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3980,"Q.1.10.8","Authenticated when a Penetration Test is performed?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.7 QA_UAT Process","NA",null,3,null,1,10,8,0,0,0,{"$f":"IF(I66=\"\",\"\",IF(D66=\"\",0,IF(D66=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D66=\"Yes\"),AND($L$1=\"Scaled\",D66>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D66=\"No\"),AND($L$1=\"Scaled\",D66<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3981,"Q.1.10.9","Performed in the production environment?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.7 QA_UAT Process","14.2.9","System acceptance testing",3,null,1,10,9,0,0,0,{"$f":"IF(I67=\"\",\"\",IF(D67=\"\",0,IF(D67=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D67=\"Yes\"),AND($L$1=\"Scaled\",D67>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D67=\"No\"),AND($L$1=\"Scaled\",D67<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3982,"Q.1.11","Are discovered vulnerabilities communicated to developers? If yes, explain","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.7 QA_UAT Process","14.2.6","Secure development environment",2,null,1,11,0,0,0,0,{"$f":"IF(I68=\"\",\"\",IF(D68=\"\",0,IF(D68=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D68=\"Yes\"),AND($L$1=\"Scaled\",D68>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D68=\"No\"),AND($L$1=\"Scaled\",D68<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3983,"Q.1.12","Does the Software Security Group interface with the Incident Response group or function? If yes, are:","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy",null,"12.6.1.k","Management of Technical vulnerabilities",2,null,1,12,0,0,0,0,{"$f":"IF(I69=\"\",\"\",IF(D69=\"\",0,IF(D69=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D69=\"Yes\"),AND($L$1=\"Scaled\",D69>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D69=\"No\"),AND($L$1=\"Scaled\",D69<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3984,{"$f":"IF(I70=0,\"\",IF(I70=1,P$1&\".\"&K70,IF(I70=2,P$1&\".\"&K70&\".\"&L70,IF(I70=3,P$1&\".\"&K70&\".\"&L70&\".\"&M70,IF(I70=4,P$1&\".\"&K70&\".\"&L70&\".\"&M70&\".\"&N70,IF(I70=5,P$1&\".\"&K70&\".\"&L70&\".\"&M70&\".\"&N70&\".\"&O70))))))","v":"Q.1.12.1"},"Vulnerabilities identified by the Incident Response group provided to the Software Security Group?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy",null,"12.6.1.k","Management of Technical vulnerabilities",3,null,{"$f":"IF(K69=\"\",1,IF(I70=1,K69+1,K69))","v":1},{"$f":"IF(L69=\"\",0,IF(K69<>K70,0,IF($I70=2,L69+1,L69)))","v":12},{"$f":"IF(M69=\"\",0,IF(L69<>L70,0,IF($I70=3,M69+1,M69)))","v":1},{"$f":"IF(N69=\"\",0,IF(M69<>M70,0,IF($I70=4,N69+1,N69)))","v":0},{"$f":"IF(O69=\"\",0,IF(N69<>N70,0,IF($I70=5,O69+1,O69)))","v":0},{"$f":"IF(OR(Master=\"Master\",I70=0,J70=1),0,IF(ISNA(VLOOKUP(A70,L2_Array,21,FALSE)),0,VLOOKUP(A70,L2_Array,21,FALSE)))","v":0},{"$f":"IF(I70=\"\",\"\",IF(D70=\"\",0,IF(D70=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D70=\"Yes\"),AND($L$1=\"Scaled\",D70>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D70=\"No\"),AND($L$1=\"Scaled\",D70<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},{"$f":"IF(I70=\"\",\"\",IF(P70>0,P70,IF(Q70>0,Q70,0)))","v":1},{"$f":"IF(OR(I70=\"\",I70=0),\"\",IF(OR(I70=1,S69=\"\"),1,IF(OR(AND(J69=1,(I70-I68<>0)),AND(S69=0,I69=I70),AND(J69=1,I70=I68)),0,1)))","v":1},{"$f":"IF(I70=\"\",T69,IF(AND(R70>1,OR(T69=\"\",T69=0,T69>=I70)),I70,IF(I70>T69,T69,0)))","v":0},{"$f":"IF(Master=\"Master\",Q70,IF(U69=\"\",R70,IF(OR(AND(T70>0,R70<U69),AND(T70=1,R70<=U69)),U69,R70)))","v":1},{"$f":"IF(I70=\"\",\"\",IF(OR(AND(S69=1,T70=1),R70>0,AND(S71=0,V71=1)),1,0))","v":1},{"$f":"IF(I70=\"\",\"\",IF(OR(AND(T70>0,S70=1),AND(S70=1,V70=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A70,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(I70=1,R70=1),2,IF(AND(U69=1,K70=K69),2,IF(AND(AB69=2,K70=K69),2,IF(I70=1,1,\"\"))))","v":2}]
[3985,"Q.1.13","Does the incident response process include steps to identify root/cause and prevent reoccurrence?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy",null,"16.1.1.a.2","Responsibilities and procedures",2,null,1,13,0,0,0,0,{"$f":"IF(I71=\"\",\"\",IF(D71=\"\",0,IF(D71=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D71=\"Yes\"),AND($L$1=\"Scaled\",D71>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D71=\"No\"),AND($L$1=\"Scaled\",D71<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3986,"Q.1.14","Are hosted production applications monitored for vulnerabilities?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy",null,14.1,"Security requirements of information systems",2,null,1,14,0,0,0,0,{"$f":"IF(I72=\"\",\"\",IF(D72=\"\",0,IF(D72=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D72=\"Yes\"),AND($L$1=\"Scaled\",D72>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D72=\"No\"),AND($L$1=\"Scaled\",D72<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3987,"Q.1.15","Are third party code reviews performed prior to release into production?","No",null,null,"NA",null,2,null,1,15,0,0,0,0,{"$f":"IF(I73=\"\",\"\",IF(D73=\"\",0,IF(D73=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D73=\"Yes\"),AND($L$1=\"Scaled\",D73>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D73=\"No\"),AND($L$1=\"Scaled\",D73<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[3988,"Q.1.16","Is there a Change or Configuration Management policy or program? If yes, does it include:","No",null,"Q.1 Secure SDLC Policies, Standards and Procedures","12.1.2","Change management",2,null,1,16,0,0,0,0,{"$f":"IF(I74=\"\",\"\",IF(D74=\"\",0,IF(D74=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D74=\"Yes\"),AND($L$1=\"Scaled\",D74>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D74=\"No\"),AND($L$1=\"Scaled\",D74<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[3989,"Q.1.16.1","Vulnerability Management to ensure code has been properly analyzed?","No",null,"Q.7 QA_UAT Process","12.1.2.c","Change management",3,null,1,16,1,0,0,0,{"$f":"IF(I75=\"\",\"\",IF(D75=\"\",0,IF(D75=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D75=\"Yes\"),AND($L$1=\"Scaled\",D75>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D75=\"No\"),AND($L$1=\"Scaled\",D75<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,2,2,1,1,0,null,null,null,2]
[3990,"Q.1.17","Are applications analyzed on a regular basis to determine their vulnerability against recent attacks?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.7 QA_UAT Process","12.2.1","Controls against malware",2,null,1,17,0,0,0,0,{"$f":"IF(I76=\"\",\"\",IF(D76=\"\",0,IF(D76=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D76=\"Yes\"),AND($L$1=\"Scaled\",D76>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D76=\"No\"),AND($L$1=\"Scaled\",D76<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]
[3991,"Q.1.18","Are any vulnerabilities identified in production fed through the same mechanisms used to track and remediate results from Penetration Tests?","Yes","Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy","Q.7 QA_UAT Process","12.2.1","Controls against malware",2,null,1,18,0,0,0,0,{"$f":"IF(I77=\"\",\"\",IF(D77=\"\",0,IF(D77=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D77=\"Yes\"),AND($L$1=\"Scaled\",D77>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D77=\"No\"),AND($L$1=\"Scaled\",D77<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},1,1,0,1,1,1,0,null,null,null,2]

{"sheet":"V. Cloud Security","index":22,"n_rows":382,"n_cols":30,"rows_kept":382,"cut":false,"hidden":false,"merged":[[2,1,2,7]]}
[10,"V. Cloud Security",null,null,null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,"Binary",null,null,null,null,null,{"$f":"LEFT(B1,1)","v":"V"}]
[null,null,null,{"$f":"IF(Y2=0,\"0%\",Y2/U2)","v":1},"Percent Complete",null,null,null,null,null,{"$f":"COUNTA(K5:K382)","v":378},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(U5:U382,1)","v":323},null,null,null,{"$f":"COUNTIF(Y5:Y382,1)","v":323}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column E to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, check the Disable Tab Automation checkbox at the top of the page.",null,null,null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk","Evaluating Cloud Risk for the Enterprise: A Shared Assessments Guide",null,"Optional\nScoring","Filter"]
[{"$f":"MAX(A5:A382)","v":3734},"Ques Num","Question/Request","Response","Additional Information","Service Model","Deployment Model","AUP Reference","ISO Ref Num","ISO Ref Text",null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,"White Paper Description"]
[3304,{"$f":"IF(K5=0,\"\",IF(K5=1,R$1&\".\"&M5,IF(K5=2,R$1&\".\"&M5&\".\"&N5,IF(K5=3,R$1&\".\"&M5&\".\"&N5&\".\"&O5,IF(K5=4,R$1&\".\"&M5&\".\"&N5&\".\"&O5&\".\"&P5,IF(K5=5,R$1&\".\"&M5&\".\"&N5&\".\"&O5&\".\"&P5&\".\"&Q5))))))","v":"V.1"},"Are Cloud Services provided? If yes, what service model is provided (select all that apply):","No",null,null,null,"V.1 Service and Deployment Models",4.3,"Determining the scope of the information management system",1,null,{"$f":"IF(M4=\"\",1,IF(K5=1,M4+1,M4))","v":1},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($K5=2,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($K5=3,O4+1,O4)))","v":0},{"$f":"IF(P4=\"\",0,IF(O4<>O5,0,IF($K5=4,P4+1,P4)))","v":0},{"$f":"IF(Q4=\"\",0,IF(P4<>P5,0,IF($K5=5,Q4+1,Q4)))","v":0},{"$f":"IF(OR(Master=\"Master\",K5=0,L5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,21,FALSE)),0,VLOOKUP(A5,L2_Array,21,FALSE)))","v":2},{"$f":"IF(K5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D5=\"Yes\"),AND($L$1=\"Scaled\",D5>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D5=\"No\"),AND($L$1=\"Scaled\",D5<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},{"$f":"IF(K5=\"\",\"\",IF(R5>0,R5,IF(S5>0,S5,0)))","v":2},{"$f":"IF(OR(K5=\"\",K5=0),\"\",IF(OR(K5=1,U4=\"\"),1,IF(OR(AND(L4=1,(K5-K3<>0)),AND(U4=0,K4=K5),AND(L4=1,K5=K3)),0,1)))","v":1},{"$f":"IF(K5=\"\",V4,IF(AND(T5>1,OR(V4=\"\",V4=0,V4>=K5)),K5,IF(K5>V4,V4,0)))","v":1},{"$f":"IF(Master=\"Master\",S5,IF(W4=\"\",T5,IF(OR(AND(V5>0,T5<W4),AND(V5=1,T5<=W4)),W4,T5)))","v":2},{"$f":"IF(K5=\"\",\"\",IF(OR(AND(U4=1,V5=1),T5>0,AND(U6=0,X6=1)),1,0))","v":1},{"$f":"IF(K5=\"\",\"\",IF(OR(AND(V5>0,U5=1),AND(U5=1,X5=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},"WP.1.A.1, WP.1.A.2",null,null,{"$f":"IF(AND(K5=1,T5=1),2,IF(AND(W4=1,M5=M4),2,IF(AND(AD4=2,M5=M4),2,IF(K5=1,1,\"\"))))","v":1}]
[3305,{"$f":"IF(K6=0,\"\",IF(K6=1,R$1&\".\"&M6,IF(K6=2,R$1&\".\"&M6&\".\"&N6,IF(K6=3,R$1&\".\"&M6&\".\"&N6&\".\"&O6,IF(K6=4,R$1&\".\"&M6&\".\"&N6&\".\"&O6&\".\"&P6,IF(K6=5,R$1&\".\"&M6&\".\"&N6&\".\"&O6&\".\"&P6&\".\"&Q6))))))","v":"V.1.1"},"Software as a Service (SaaS)?","No",null,null,null,"V.1 Service and Deployment Models","NA",null,2,null,{"$f":"IF(M5=\"\",1,IF(K6=1,M5+1,M5))","v":1},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($K6=2,N5+1,N5)))","v":1},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($K6=3,O5+1,O5)))","v":0},{"$f":"IF(P5=\"\",0,IF(O5<>O6,0,IF($K6=4,P5+1,P5)))","v":0},{"$f":"IF(Q5=\"\",0,IF(P5<>P6,0,IF($K6=5,Q5+1,Q5)))","v":0},{"$f":"IF(OR(Master=\"Master\",K6=0,L6=1),0,IF(ISNA(VLOOKUP(A6,L2_Array,21,FALSE)),0,VLOOKUP(A6,L2_Array,21,FALSE)))","v":2},{"$f":"IF(K6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D6=\"Yes\"),AND($L$1=\"Scaled\",D6>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D6=\"No\"),AND($L$1=\"Scaled\",D6<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},{"$f":"IF(K6=\"\",\"\",IF(R6>0,R6,IF(S6>0,S6,0)))","v":2},{"$f":"IF(OR(K6=\"\",K6=0),\"\",IF(OR(K6=1,U5=\"\"),1,IF(OR(AND(L5=1,(K6-K4<>0)),AND(U5=0,K5=K6),AND(L5=1,K6=K4)),0,1)))","v":1},{"$f":"IF(K6=\"\",V5,IF(AND(T6>1,OR(V5=\"\",V5=0,V5>=K6)),K6,IF(K6>V5,V5,0)))","v":1},{"$f":"IF(Master=\"Master\",S6,IF(W5=\"\",T6,IF(OR(AND(V6>0,T6<W5),AND(V6=1,T6<=W5)),W5,T6)))","v":2},{"$f":"IF(K6=\"\",\"\",IF(OR(AND(U5=1,V6=1),T6>0,AND(U7=0,X7=1)),1,0))","v":1},{"$f":"IF(K6=\"\",\"\",IF(OR(AND(V6>0,U6=1),AND(U6=1,X6=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A6,L2_Array,1,FALSE)),0,1)","v":1},"WP.1.A.1, WP.1.A.2",null,null,{"$f":"IF(AND(K6=1,T6=1),2,IF(AND(W5=1,M6=M5),2,IF(AND(AD5=2,M6=M5),2,IF(K6=1,1,\"\"))))","v":""}]
[3306,"V.1.2","Platform as a Service (PaaS)?","Yes",null,null,null,"V.1 Service and Deployment Models","NA",null,2,null,1,2,0,0,0,2,{"$f":"IF(K7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D7=\"Yes\"),AND($L$1=\"Scaled\",D7>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D7=\"No\"),AND($L$1=\"Scaled\",D7<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":1},2,1,1,2,1,1,1,"WP.1.A.1, WP.1.A.2",null,null,""]
[3307,"V.1.3","Infrastructure as a Service (IaaS)?",null,null,null,null,"V.1 Service and Deployment Models","NA",null,2,null,1,3,0,0,0,2,{"$f":"IF(K8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D8=\"Yes\"),AND($L$1=\"Scaled\",D8>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D8=\"No\"),AND($L$1=\"Scaled\",D8<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.A.1, WP.1.A.2",null,null,""]
[3308,"V.1.4","What deployment models are provided (select all that apply):",null,null,null,null,"V.1 Service and Deployment Models",4.3,"Determining the scope of the information management system",2,1,1,4,0,0,0,0,{"$f":"IF(K9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D9=\"Yes\"),AND($L$1=\"Scaled\",D9>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D9=\"No\"),AND($L$1=\"Scaled\",D9<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.E.1",null,null,""]
[3309,"V.1.4.1","Private cloud?",null,null,null,null,"V.1 Service and Deployment Models","NA",null,3,null,1,4,1,0,0,2,{"$f":"IF(K10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D10=\"Yes\"),AND($L$1=\"Scaled\",D10>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D10=\"No\"),AND($L$1=\"Scaled\",D10<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,0,1,2,1,0,1,"WP.1.E.1",null,null,""]
[3310,"V.1.4.2","Public cloud?",null,null,null,null,"V.1 Service and Deployment Models","NA",null,3,null,1,4,2,0,0,2,{"$f":"IF(K11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D11=\"Yes\"),AND($L$1=\"Scaled\",D11>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D11=\"No\"),AND($L$1=\"Scaled\",D11<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,0,1,2,1,0,1,"WP.1.E.1",null,null,""]
[3311,"V.1.4.3","Community cloud?",null,null,null,null,"V.1 Service and Deployment Models","NA",null,3,null,1,4,3,0,0,2,{"$f":"IF(K12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D12=\"Yes\"),AND($L$1=\"Scaled\",D12>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D12=\"No\"),AND($L$1=\"Scaled\",D12<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,0,1,2,1,0,1,"WP.1.E.1",null,null,""]
[3312,"V.1.4.4","Hybrid cloud?",null,null,null,null,"V.1 Service and Deployment Models","NA",null,3,null,1,4,4,0,0,2,{"$f":"IF(K13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D13=\"Yes\"),AND($L$1=\"Scaled\",D13>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D13=\"No\"),AND($L$1=\"Scaled\",D13<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,0,1,2,1,0,1,"WP.1.E.1",null,null,""]
[3313,"V.1.5","Where is the cloud infrastructure hosted:",null,null,null,null,null,4.3,"Determining the scope of the information management system",2,1,1,5,0,0,0,0,{"$f":"IF(K14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D14=\"Yes\"),AND($L$1=\"Scaled\",D14>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D14=\"No\"),AND($L$1=\"Scaled\",D14<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.E.1",null,null,""]
[3314,"V.1.5.1","Data center: single tenancy?",null,null,null,null,null,"NA",null,3,null,1,5,1,0,0,0,{"$f":"IF(K15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D15=\"Yes\"),AND($L$1=\"Scaled\",D15>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D15=\"No\"),AND($L$1=\"Scaled\",D15<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,1,0,0,"WP.1.E.1",null,null,""]
[3315,"V.1.5.2","Co-location: dedicated server?",null,null,null,null,null,"NA",null,3,null,1,5,2,0,0,0,{"$f":"IF(K16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D16=\"Yes\"),AND($L$1=\"Scaled\",D16>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D16=\"No\"),AND($L$1=\"Scaled\",D16<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.1",null,null,""]
[3686,"V.1.5.3","Co-location: shared server?",null,null,null,null,null,"NA",null,3,null,1,5,3,0,0,0,{"$f":"IF(K17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D17=\"Yes\"),AND($L$1=\"Scaled\",D17>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D17=\"No\"),AND($L$1=\"Scaled\",D17<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.1",null,null,""]
[3316,"V.1.5.4","Co-location: dedicated cabinet?",null,null,null,null,null,"NA",null,3,null,1,5,4,0,0,0,{"$f":"IF(K18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D18=\"Yes\"),AND($L$1=\"Scaled\",D18>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D18=\"No\"),AND($L$1=\"Scaled\",D18<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.1",null,null,""]
[3317,"V.1.5.5","Co-location: shared cabinet?",null,null,null,null,null,"NA",null,3,null,1,5,5,0,0,0,{"$f":"IF(K19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D19=\"Yes\"),AND($L$1=\"Scaled\",D19>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D19=\"No\"),AND($L$1=\"Scaled\",D19<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.1",null,null,""]
[3318,"V.1.5.6","Co-location: dedicated cage?",null,null,null,null,null,"NA",null,3,null,1,5,6,0,0,0,{"$f":"IF(K20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D20=\"Yes\"),AND($L$1=\"Scaled\",D20>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D20=\"No\"),AND($L$1=\"Scaled\",D20<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.1",null,null,""]
[3319,"V.1.5.7","Co-location: shared cage?",null,null,null,null,null,"NA",null,3,null,1,5,7,0,0,0,{"$f":"IF(K21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D21=\"Yes\"),AND($L$1=\"Scaled\",D21>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D21=\"No\"),AND($L$1=\"Scaled\",D21<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.1",null,null,""]
[3320,"V.1.5.8","Cloud provider: (e.g., AWS)?",null,null,null,null,null,"NA",null,3,null,1,5,8,0,0,0,{"$f":"IF(K22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D22=\"Yes\"),AND($L$1=\"Scaled\",D22>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D22=\"No\"),AND($L$1=\"Scaled\",D22<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.1",null,null,""]
[3321,"V.1.6","What legal jurisdiction does data reside (select all that apply):",null,null,null,null,"P.1 Privacy Target Data Inventory and Flows","18.1.1 ","Identification of applicable legislation and contractual requirements",2,1,1,6,0,0,0,0,{"$f":"IF(K23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D23=\"Yes\"),AND($L$1=\"Scaled\",D23>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D23=\"No\"),AND($L$1=\"Scaled\",D23<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3322,"V.1.6.1","USA?",null,null,null,null,"P.1 Privacy Target Data Inventory and Flows","NA",null,3,null,1,6,1,0,0,0,{"$f":"IF(K24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D24=\"Yes\"),AND($L$1=\"Scaled\",D24>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D24=\"No\"),AND($L$1=\"Scaled\",D24<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,1,0,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3323,"V.1.6.2","Canada?",null,null,null,null,"P.1 Privacy Target Data Inventory and Flows","NA",null,3,null,1,6,2,0,0,0,{"$f":"IF(K25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D25=\"Yes\"),AND($L$1=\"Scaled\",D25>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D25=\"No\"),AND($L$1=\"Scaled\",D25<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3324,"V.1.6.3","Asia?",null,null,null,null,"P.1 Privacy Target Data Inventory and Flows","NA",null,3,null,1,6,3,0,0,0,{"$f":"IF(K26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D26=\"Yes\"),AND($L$1=\"Scaled\",D26>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D26=\"No\"),AND($L$1=\"Scaled\",D26<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3325,"V.1.6.4","South America?",null,null,null,null,"P.1 Privacy Target Data Inventory and Flows","NA",null,3,null,1,6,4,0,0,0,{"$f":"IF(K27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D27=\"Yes\"),AND($L$1=\"Scaled\",D27>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D27=\"No\"),AND($L$1=\"Scaled\",D27<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3326,"V.1.6.5","Australia?",null,null,null,null,"P.1 Privacy Target Data Inventory and Flows","NA",null,3,null,1,6,5,0,0,0,{"$f":"IF(K28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D28=\"Yes\"),AND($L$1=\"Scaled\",D28>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D28=\"No\"),AND($L$1=\"Scaled\",D28<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3327,"V.1.6.6","Asia-Pacific?",null,null,null,null,"P.1 Privacy Target Data Inventory and Flows","NA",null,3,null,1,6,6,0,0,0,{"$f":"IF(K29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D29=\"Yes\"),AND($L$1=\"Scaled\",D29>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D29=\"No\"),AND($L$1=\"Scaled\",D29<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3328,"V.1.6.7","Africa?",null,null,null,null,"P.1 Privacy Target Data Inventory and Flows","NA",null,3,null,1,6,7,0,0,0,{"$f":"IF(K30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D30=\"Yes\"),AND($L$1=\"Scaled\",D30>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D30=\"No\"),AND($L$1=\"Scaled\",D30<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3684,"V.1.6.8","Europe (EU)?",null,null,null,null,"P.1 Privacy Target Data Inventory and Flows","NA",null,3,null,1,6,8,0,0,0,{"$f":"IF(K31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D31=\"Yes\"),AND($L$1=\"Scaled\",D31>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D31=\"No\"),AND($L$1=\"Scaled\",D31<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3685,"V.1.6.9","Europe (non-EU)?",null,null,null,null,"P.1 Privacy Target Data Inventory and Flows","NA",null,3,null,1,6,9,0,0,0,{"$f":"IF(K32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D32=\"Yes\"),AND($L$1=\"Scaled\",D32>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D32=\"No\"),AND($L$1=\"Scaled\",D32<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3329,"V.1.6.10","Other (please specify)?",null,null,null,null,"P.1 Privacy Target Data Inventory and Flows","NA",null,3,null,1,6,10,0,0,0,{"$f":"IF(K33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D33=\"Yes\"),AND($L$1=\"Scaled\",D33>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D33=\"No\"),AND($L$1=\"Scaled\",D33<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3330,"V.1.7","Can clients define the legal jurisdictions of their data? If yes, can they define where the data is:",null,null,null,null,"P.1 Privacy Target Data Inventory and Flows","18.1.1 ","Identification of applicable legislation and contractual requirements",2,null,1,7,0,0,0,2,{"$f":"IF(K34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D34=\"Yes\"),AND($L$1=\"Scaled\",D34>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D34=\"No\"),AND($L$1=\"Scaled\",D34<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.G.3",null,null,""]
[3331,"V.1.7.1","Stored?",null,null,null,null,"P.1 Privacy Target Data Inventory and Flows","NA",null,3,null,1,7,1,0,0,0,{"$f":"IF(K35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D35=\"Yes\"),AND($L$1=\"Scaled\",D35>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D35=\"No\"),AND($L$1=\"Scaled\",D35<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.G.3",null,null,""]
[3332,"V.1.7.2","Processed?",null,null,null,null,"P.1 Privacy Target Data Inventory and Flows","NA",null,3,null,1,7,2,0,0,0,{"$f":"IF(K36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D36=\"Yes\"),AND($L$1=\"Scaled\",D36>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D36=\"No\"),AND($L$1=\"Scaled\",D36<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.G.3",null,null,""]
[3333,"V.1.7.3","Transmitted?",null,null,null,null,"P.1 Privacy Target Data Inventory and Flows","NA",null,3,null,1,7,3,0,0,0,{"$f":"IF(K37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D37=\"Yes\"),AND($L$1=\"Scaled\",D37>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D37=\"No\"),AND($L$1=\"Scaled\",D37<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.G.3",null,null,""]
[3334,"V.1.7.4","Accessed?",null,null,null,null,"P.1 Privacy Target Data Inventory and Flows","NA",null,3,null,1,7,4,0,0,0,{"$f":"IF(K38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D38=\"Yes\"),AND($L$1=\"Scaled\",D38>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D38=\"No\"),AND($L$1=\"Scaled\",D38<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.G.3",null,null,""]
[3335,"V.1.8","Are application instances part of the services provided?",null,null,null,null,"P.1 Privacy Target Data Inventory and Flows","9.4.1 ","Information access restriction",2,null,1,8,0,0,0,0,{"$f":"IF(K39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D39=\"Yes\"),AND($L$1=\"Scaled\",D39>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D39=\"No\"),AND($L$1=\"Scaled\",D39<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.G.3",null,null,""]
[3336,"V.1.8.1","Are these instances shared with other clients?",null,null,null,null,"P.1 Privacy Target Data Inventory and Flows","NA",null,3,null,1,8,1,0,0,0,{"$f":"IF(K40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D40=\"Yes\"),AND($L$1=\"Scaled\",D40>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D40=\"No\"),AND($L$1=\"Scaled\",D40<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.A.2, WP.1.A.8",null,null,""]
[3337,"V.1.9","Are database instances part of the services provided?",null,null,null,null,"P.1 Privacy Target Data Inventory and Flows","9.4.1","Information access restriction",2,null,1,9,0,0,0,0,{"$f":"IF(K41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D41=\"Yes\"),AND($L$1=\"Scaled\",D41>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D41=\"No\"),AND($L$1=\"Scaled\",D41<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.G.3",null,null,""]
[3338,"V.1.9.1","Are these instances shared with other clients?",null,null,null,null,"P.1 Privacy Target Data Inventory and Flows","NA",null,3,null,1,9,1,0,0,0,{"$f":"IF(K42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D42=\"Yes\"),AND($L$1=\"Scaled\",D42>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D42=\"No\"),AND($L$1=\"Scaled\",D42<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.A.2, WP.1.A.8",null,null,""]
[3339,"V.1.10","Is data segmentation and separation capability between clients provided? If yes, is it:",null,null,null,null,"V.1 Service and Deployment Models","9.4.1 ","Information access restriction",2,null,1,10,0,0,0,2,{"$f":"IF(K43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D43=\"Yes\"),AND($L$1=\"Scaled\",D43>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D43=\"No\"),AND($L$1=\"Scaled\",D43<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.A.1",null,null,""]
[3340,"V.1.10.1","Physical segmentation (private cloud)?",null,null,null,null,null,"9.4.1 ","Information access restriction",3,null,1,10,1,0,0,0,{"$f":"IF(K44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D44=\"Yes\"),AND($L$1=\"Scaled\",D44>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D44=\"No\"),AND($L$1=\"Scaled\",D44<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1",null,null,""]
[3341,"V.1.10.2","Network segmentation?",null,null,null,null,null,"9.4.1 ","Information access restriction",3,null,1,10,2,0,0,0,{"$f":"IF(K45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D45=\"Yes\"),AND($L$1=\"Scaled\",D45>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D45=\"No\"),AND($L$1=\"Scaled\",D45<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1",null,null,""]
[3342,"V.1.10.3","System segmentation (unique system instances (e.g., virtualization)?",null,null,null,null,null,"9.4.1 ","Information access restriction",3,null,1,10,3,0,0,0,{"$f":"IF(K46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D46=\"Yes\"),AND($L$1=\"Scaled\",D46>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D46=\"No\"),AND($L$1=\"Scaled\",D46<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.D.1, WP.1.D.3",null,null,""]
[3343,"V.1.10.4","Application segmentation (unique application instances)?",null,null,null,null,null,"9.4.1 ","Information access restriction",3,null,1,10,4,0,0,0,{"$f":"IF(K47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D47=\"Yes\"),AND($L$1=\"Scaled\",D47>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D47=\"No\"),AND($L$1=\"Scaled\",D47<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1",null,null,""]
[3344,"V.1.10.5","Application segmentation (e.g., application ID, metadata tagging)?",null,null,null,null,null,"9.4.1 ","Information access restriction",3,null,1,10,5,0,0,0,{"$f":"IF(K48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D48=\"Yes\"),AND($L$1=\"Scaled\",D48>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D48=\"No\"),AND($L$1=\"Scaled\",D48<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1",null,null,""]
[3345,"V.1.10.6","Other (please specify)?",null,null,null,null,null,"9.4.1 ","Information access restriction",3,null,1,10,6,0,0,0,{"$f":"IF(K49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D49=\"Yes\"),AND($L$1=\"Scaled\",D49>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D49=\"No\"),AND($L$1=\"Scaled\",D49<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3346,"V.1.11","Is Scoped Data encrypted? If yes, when:",null,null,null,null,"G.22 Data Security Policy – Encryption ","10.1.1                                                     13.1.2                                                14.1.3                                                                 18.1.3","Policy On The Use Of Cryptographic Controls,\nSecurity Of Network Services,\nProtecting application services transactions,\nProtection Of records",2,null,1,11,0,0,0,2,{"$f":"IF(K50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D50=\"Yes\"),AND($L$1=\"Scaled\",D50>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D50=\"No\"),AND($L$1=\"Scaled\",D50<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.A.7, WP.1.G.9",null,null,""]
[3347,"V.1.11.1","External: Network?",null,null,null,null,"G.22 Data Security Policy – Encryption, G.13 Website – Client Encryption","NA",null,3,null,1,11,1,0,0,0,{"$f":"IF(K51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D51=\"Yes\"),AND($L$1=\"Scaled\",D51>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D51=\"No\"),AND($L$1=\"Scaled\",D51<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3348,"V.1.11.2","Internal: Network?",null,null,null,null,"G.22 Data Security Policy – Encryption, G.13 Website – Client Encryption","NA",null,3,null,1,11,2,0,0,0,{"$f":"IF(K52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D52=\"Yes\"),AND($L$1=\"Scaled\",D52>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D52=\"No\"),AND($L$1=\"Scaled\",D52<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3349,"V.1.11.3","Internal: Storage?",null,null,null,null,"G.22 Data Security Policy – Encryption ","NA",null,3,null,1,11,3,0,0,0,{"$f":"IF(K53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D53=\"Yes\"),AND($L$1=\"Scaled\",D53>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D53=\"No\"),AND($L$1=\"Scaled\",D53<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3350,"V.1.11.4","Vendors: Transit to third party vendors?",null,null,null,null,"G.22 Data Security Policy – Encryption ","NA",null,3,null,1,11,4,0,0,0,{"$f":"IF(K54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D54=\"Yes\"),AND($L$1=\"Scaled\",D54>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D54=\"No\"),AND($L$1=\"Scaled\",D54<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3351,"V.1.11.5","Vendors: Stored by third party vendors?",null,null,null,null,"Gap but added under G.22 Data Security Policy – Encryption ","NA",null,3,null,1,11,5,0,0,0,{"$f":"IF(K55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D55=\"Yes\"),AND($L$1=\"Scaled\",D55>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D55=\"No\"),AND($L$1=\"Scaled\",D55<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3352,"V.1.11.6","Other (please specify)?",null,null,null,null,null,"NA",null,3,null,1,11,6,0,0,0,{"$f":"IF(K56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D56=\"Yes\"),AND($L$1=\"Scaled\",D56>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D56=\"No\"),AND($L$1=\"Scaled\",D56<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3353,"V.1.12","Are clients provided with the ability to generate a unique encryption key?",null,null,null,null,"G.22 Data Security Policy - Encryption","10.1.2","Key Management",2,null,1,12,0,0,0,2,{"$f":"IF(K57=\"\",\"\",IF(D57=\"\",0,IF(D57=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D57=\"Yes\"),AND($L$1=\"Scaled\",D57>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D57=\"No\"),AND($L$1=\"Scaled\",D57<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.A.6",null,null,""]
[3354,"V.1.13","Are clients provided with the ability to rotate their encryption key on a scheduled basis?",null,null,null,null,"G.22 Data Security Policy - Encryption","10.1.2","Key Management",2,null,1,13,0,0,0,2,{"$f":"IF(K58=\"\",\"\",IF(D58=\"\",0,IF(D58=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D58=\"Yes\"),AND($L$1=\"Scaled\",D58>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D58=\"No\"),AND($L$1=\"Scaled\",D58<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.A.6, WP.1.A.7",null,null,""]
[3355,"V.1.14","Is standards based federated ID capability available to clients (e.g., SAML, OpenID)?",null,null,null,null,null,"9.2.1","User registration and de-registration",2,null,1,14,0,0,0,2,{"$f":"IF(K59=\"\",\"\",IF(D59=\"\",0,IF(D59=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D59=\"Yes\"),AND($L$1=\"Scaled\",D59>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D59=\"No\"),AND($L$1=\"Scaled\",D59<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.H.2, WP.1.H.4",null,null,""]
[3356,"V.1.15","Are application self service features or an Internet accessible self-service portal available to clients? If yes, are the following functions available:",null,null,null,null,null,"9.4.1","Information access restriction",2,null,1,15,0,0,0,2,{"$f":"IF(K60=\"\",\"\",IF(D60=\"\",0,IF(D60=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D60=\"Yes\"),AND($L$1=\"Scaled\",D60>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D60=\"No\"),AND($L$1=\"Scaled\",D60<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,null,null,null,""]
[3357,"V.1.15.1","Provision users?",null,null,null,null,null,"9.2.2 ","User access provisioning",3,null,1,15,1,0,0,0,{"$f":"IF(K61=\"\",\"\",IF(D61=\"\",0,IF(D61=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D61=\"Yes\"),AND($L$1=\"Scaled\",D61>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D61=\"No\"),AND($L$1=\"Scaled\",D61<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.H.1, WP.1.H.3, WP.1.H.5, WP.1.H.7",null,null,""]
[3358,"V.1.15.2","Audit user entitlements?",null,null,null,null,null,"9.2.5","Review Of User Access Rights",3,null,1,15,2,0,0,0,{"$f":"IF(K62=\"\",\"\",IF(D62=\"\",0,IF(D62=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D62=\"Yes\"),AND($L$1=\"Scaled\",D62>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D62=\"No\"),AND($L$1=\"Scaled\",D62<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.H.9",null,null,""]
[3359,"V.1.15.3","View uptime?",null,null,null,null,null,"12.4.1                                                     15.2.1","Event Logging,\nMonitoring And Review Of Supplier Services",3,null,1,15,3,0,0,0,{"$f":"IF(K63=\"\",\"\",IF(D63=\"\",0,IF(D63=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D63=\"Yes\"),AND($L$1=\"Scaled\",D63>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D63=\"No\"),AND($L$1=\"Scaled\",D63<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.7, WP.1.K.8, WP.1.K.9, WP.1.K.10",null,null,""]
[3360,"V.1.15.4","View real-time service interruptions?",null,null,null,null,null,"12.4.1                                                     15.2.1","Event Logging,\nMonitoring And Review Of Supplier Services",3,null,1,15,4,0,0,0,{"$f":"IF(K64=\"\",\"\",IF(D64=\"\",0,IF(D64=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D64=\"Yes\"),AND($L$1=\"Scaled\",D64>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D64=\"No\"),AND($L$1=\"Scaled\",D64<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.H.9, WP.1.H.10",null,null,""]
[3361,"V.1.15.5","View maintenance window information?",null,null,null,null,null,"12.4.1                                                     15.2.1","Event Logging,\nMonitoring And Review Of Supplier Services",3,null,1,15,5,0,0,0,{"$f":"IF(K65=\"\",\"\",IF(D65=\"\",0,IF(D65=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D65=\"Yes\"),AND($L$1=\"Scaled\",D65>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D65=\"No\"),AND($L$1=\"Scaled\",D65<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.H.10",null,null,""]
[3362,"V.1.15.6","View access logs?",null,null,null,null,null,"12.4.1                                                     15.2.1","Event Logging,\nMonitoring And Review Of Supplier Services",3,null,1,15,6,0,0,0,{"$f":"IF(K66=\"\",\"\",IF(D66=\"\",0,IF(D66=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D66=\"Yes\"),AND($L$1=\"Scaled\",D66>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D66=\"No\"),AND($L$1=\"Scaled\",D66<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.H.9, WP.1.H.10",null,null,""]
[3363,"V.1.15.7","Create or modify a new cloud instance?",null,null,null,null,null,"9.2.3.b ","Management of privileged access rights",3,null,1,15,7,0,0,0,{"$f":"IF(K67=\"\",\"\",IF(D67=\"\",0,IF(D67=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D67=\"Yes\"),AND($L$1=\"Scaled\",D67>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D67=\"No\"),AND($L$1=\"Scaled\",D67<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3364,"V.1.15.8","View system health and status?",null,null,null,null,null,"9.2.3","Management of privileged access rights",3,null,1,15,8,0,0,0,{"$f":"IF(K68=\"\",\"\",IF(D68=\"\",0,IF(D68=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D68=\"Yes\"),AND($L$1=\"Scaled\",D68>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D68=\"No\"),AND($L$1=\"Scaled\",D68<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.H.9, WP.1.H.10",null,null,""]
[3365,"V.1.15.9","Create IP access lists?",null,null,null,null,null,"9.2.3","Management of privileged access rights",3,null,1,15,9,0,0,0,{"$f":"IF(K69=\"\",\"\",IF(D69=\"\",0,IF(D69=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D69=\"Yes\"),AND($L$1=\"Scaled\",D69>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D69=\"No\"),AND($L$1=\"Scaled\",D69<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3366,{"$f":"IF(K70=0,\"\",IF(K70=1,R$1&\".\"&M70,IF(K70=2,R$1&\".\"&M70&\".\"&N70,IF(K70=3,R$1&\".\"&M70&\".\"&N70&\".\"&O70,IF(K70=4,R$1&\".\"&M70&\".\"&N70&\".\"&O70&\".\"&P70,IF(K70=5,R$1&\".\"&M70&\".\"&N70&\".\"&O70&\".\"&P70&\".\"&Q70))))))","v":"V.1.15.10"},"View security events and alerts?",null,null,null,null,null,"9.2.3","Management of privileged access rights",3,null,{"$f":"IF(M69=\"\",1,IF(K70=1,M69+1,M69))","v":1},{"$f":"IF(N69=\"\",0,IF(M69<>M70,0,IF($K70=2,N69+1,N69)))","v":15},{"$f":"IF(O69=\"\",0,IF(N69<>N70,0,IF($K70=3,O69+1,O69)))","v":10},{"$f":"IF(P69=\"\",0,IF(O69<>O70,0,IF($K70=4,P69+1,P69)))","v":0},{"$f":"IF(Q69=\"\",0,IF(P69<>P70,0,IF($K70=5,Q69+1,Q69)))","v":0},{"$f":"IF(OR(Master=\"Master\",K70=0,L70=1),0,IF(ISNA(VLOOKUP(A70,L2_Array,21,FALSE)),0,VLOOKUP(A70,L2_Array,21,FALSE)))","v":0},{"$f":"IF(K70=\"\",\"\",IF(D70=\"\",0,IF(D70=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D70=\"Yes\"),AND($L$1=\"Scaled\",D70>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D70=\"No\"),AND($L$1=\"Scaled\",D70<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(K70=\"\",\"\",IF(R70>0,R70,IF(S70>0,S70,0)))","v":0},{"$f":"IF(OR(K70=\"\",K70=0),\"\",IF(OR(K70=1,U69=\"\"),1,IF(OR(AND(L69=1,(K70-K68<>0)),AND(U69=0,K69=K70),AND(L69=1,K70=K68)),0,1)))","v":1},{"$f":"IF(K70=\"\",V69,IF(AND(T70>1,OR(V69=\"\",V69=0,V69>=K70)),K70,IF(K70>V69,V69,0)))","v":1},{"$f":"IF(Master=\"Master\",S70,IF(W69=\"\",T70,IF(OR(AND(V70>0,T70<W69),AND(V70=1,T70<=W69)),W69,T70)))","v":2},{"$f":"IF(K70=\"\",\"\",IF(OR(AND(U69=1,V70=1),T70>0,AND(U71=0,X71=1)),1,0))","v":1},{"$f":"IF(K70=\"\",\"\",IF(OR(AND(V70>0,U70=1),AND(U70=1,X70=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A70,L2_Array,1,FALSE)),0,1)","v":0},"WP.1.H.9, WP.1.H.10",null,null,{"$f":"IF(AND(K70=1,T70=1),2,IF(AND(W69=1,M70=M69),2,IF(AND(AD69=2,M70=M69),2,IF(K70=1,1,\"\"))))","v":""}]
[3367,"V.1.15.11","Remote administrative access to the systems?",null,null,null,null,null,"9.2.3","Management of privileged access rights",3,null,1,15,11,0,0,0,{"$f":"IF(K71=\"\",\"\",IF(D71=\"\",0,IF(D71=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D71=\"Yes\"),AND($L$1=\"Scaled\",D71>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D71=\"No\"),AND($L$1=\"Scaled\",D71<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3368,"V.1.15.12","View raw system and application logs?",null,null,null,null,null,"9.2.3","Management of privileged access rights",3,null,1,15,12,0,0,0,{"$f":"IF(K72=\"\",\"\",IF(D72=\"\",0,IF(D72=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D72=\"Yes\"),AND($L$1=\"Scaled\",D72>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D72=\"No\"),AND($L$1=\"Scaled\",D72<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.H.9, WP.1.H.10",null,null,""]
[3369,"V.1.15.13","Specify data retention periods?",null,null,null,null,null,"9.2.3","Management of privileged access rights",3,null,1,15,13,0,0,0,{"$f":"IF(K73=\"\",\"\",IF(D73=\"\",0,IF(D73=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D73=\"Yes\"),AND($L$1=\"Scaled\",D73>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D73=\"No\"),AND($L$1=\"Scaled\",D73<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.2, WP.1.K.4",null,null,""]
[3370,"V.1.15.14","Delete data on request?",null,null,null,null,null,"9.2.3","Management of privileged access rights",3,null,1,15,14,0,0,0,{"$f":"IF(K74=\"\",\"\",IF(D74=\"\",0,IF(D74=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D74=\"Yes\"),AND($L$1=\"Scaled\",D74>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D74=\"No\"),AND($L$1=\"Scaled\",D74<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.2, WP.1.K.3",null,null,""]
[3371,"V.1.15.15","Data extraction tool or process to allow retrieval of data?",null,null,null,null,null,"9.2.3","Management of privileged access rights",3,null,1,15,15,0,0,0,{"$f":"IF(K75=\"\",\"\",IF(D75=\"\",0,IF(D75=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D75=\"Yes\"),AND($L$1=\"Scaled\",D75>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D75=\"No\"),AND($L$1=\"Scaled\",D75<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.5",null,null,""]
[3372,"V.1.15.16","Create image snapshots?",null,null,null,null,null,"9.2.3","Management of privileged access rights",3,null,1,15,16,0,0,0,{"$f":"IF(K76=\"\",\"\",IF(D76=\"\",0,IF(D76=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D76=\"Yes\"),AND($L$1=\"Scaled\",D76>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D76=\"No\"),AND($L$1=\"Scaled\",D76<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.D.1, WP.1.D.2",null,null,""]
[3373,"V.1.16","Is there a management approved process to ensure that image snapshots containing Scoped Data are authorized prior to being snapped?",null,null,null,null,null,"9.2.3","Management of privileged access rights",2,null,1,16,0,0,0,2,{"$f":"IF(K77=\"\",\"\",IF(D77=\"\",0,IF(D77=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D77=\"Yes\"),AND($L$1=\"Scaled\",D77>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D77=\"No\"),AND($L$1=\"Scaled\",D77<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.D.2",null,null,""]
[3374,"V.1.16.1","Are image snapshots containing Scoped Data stored in an environment where the security controls protecting them are commensurate with the production environment?",null,null,null,null,null,"9.2.3","Management of privileged access rights",3,null,1,16,1,0,0,0,{"$f":"IF(K78=\"\",\"\",IF(D78=\"\",0,IF(D78=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D78=\"Yes\"),AND($L$1=\"Scaled\",D78>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D78=\"No\"),AND($L$1=\"Scaled\",D78<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.D.2",null,null,""]
[3375,"V.1.17","Are clients provided the ability to:",null,null,null,null,null,"NA",null,2,1,1,17,0,0,0,0,{"$f":"IF(K79=\"\",\"\",IF(D79=\"\",0,IF(D79=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D79=\"Yes\"),AND($L$1=\"Scaled\",D79>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D79=\"No\"),AND($L$1=\"Scaled\",D79<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.10",null,null,""]
[3376,"V.1.17.1","Execute a vulnerability scan of the external environment?",null,null,null,null,"I.1 Application Vulnerability Assessments/Ethical Hacking","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,17,1,0,0,0,{"$f":"IF(K80=\"\",\"\",IF(D80=\"\",0,IF(D80=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D80=\"Yes\"),AND($L$1=\"Scaled\",D80>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D80=\"No\"),AND($L$1=\"Scaled\",D80<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,1,0,0,null,null,null,""]
[3377,"V.1.17.2","Execute a penetration test of the external environment?",null,null,null,null,"I.1 Application Vulnerability Assessments/Ethical Hacking","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,17,2,0,0,0,{"$f":"IF(K81=\"\",\"\",IF(D81=\"\",0,IF(D81=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D81=\"Yes\"),AND($L$1=\"Scaled\",D81>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D81=\"No\"),AND($L$1=\"Scaled\",D81<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.A.10, WP.1.I.7.d",null,null,""]
[3378,"V.1.17.3","Execute a secure code review?",null,null,null,null,"I.2 Secure Systems Development Life Cycle Code Reviews","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,17,3,0,0,0,{"$f":"IF(K82=\"\",\"\",IF(D82=\"\",0,IF(D82=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D82=\"Yes\"),AND($L$1=\"Scaled\",D82>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D82=\"No\"),AND($L$1=\"Scaled\",D82<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,null,null,null,""]
[3379,"V.1.18","Is there a cloud audit program to address client audit and assessment requirements? If yes, does this program permit:",null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",2,null,1,18,0,0,0,2,{"$f":"IF(K83=\"\",\"\",IF(D83=\"\",0,IF(D83=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D83=\"Yes\"),AND($L$1=\"Scaled\",D83>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D83=\"No\"),AND($L$1=\"Scaled\",D83<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,null,null,null,""]
[3380,"V.1.18.1","Onsite assessments by clients?",null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,18,1,0,0,0,{"$f":"IF(K84=\"\",\"\",IF(D84=\"\",0,IF(D84=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D84=\"Yes\"),AND($L$1=\"Scaled\",D84>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D84=\"No\"),AND($L$1=\"Scaled\",D84<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.F.5",null,null,""]
[3381,"V.1.18.2","Program documentation describing audit capabilities, roles and responsibilities?",null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,18,2,0,0,0,{"$f":"IF(K85=\"\",\"\",IF(D85=\"\",0,IF(D85=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D85=\"Yes\"),AND($L$1=\"Scaled\",D85>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D85=\"No\"),AND($L$1=\"Scaled\",D85<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.F.4, WP.1.F.5 ",null,null,""]
[3382,"V.1.18.3","Scheduled internal audits?",null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,18,3,0,0,0,{"$f":"IF(K86=\"\",\"\",IF(D86=\"\",0,IF(D86=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D86=\"Yes\"),AND($L$1=\"Scaled\",D86>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D86=\"No\"),AND($L$1=\"Scaled\",D86<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.J.6",null,null,""]
[3383,"V.1.18.4","Controls verification and validation performed by independent, third party information security professionals?",null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,18,4,0,0,0,{"$f":"IF(K87=\"\",\"\",IF(D87=\"\",0,IF(D87=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D87=\"Yes\"),AND($L$1=\"Scaled\",D87>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D87=\"No\"),AND($L$1=\"Scaled\",D87<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.F.4, WP.1.F.5 ",null,null,""]
[3384,"V.1.19","Is there a full time internal security team assigned to protecting the cloud infrastructure?",null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",2,null,1,19,0,0,0,0,{"$f":"IF(K88=\"\",\"\",IF(D88=\"\",0,IF(D88=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D88=\"Yes\"),AND($L$1=\"Scaled\",D88>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D88=\"No\"),AND($L$1=\"Scaled\",D88<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3385,"V.1.20","Are the following artifacts available during a client audit:",null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",2,1,1,20,0,0,0,0,{"$f":"IF(K89=\"\",\"\",IF(D89=\"\",0,IF(D89=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D89=\"Yes\"),AND($L$1=\"Scaled\",D89>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D89=\"No\"),AND($L$1=\"Scaled\",D89<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.E.1",null,null,""]
[3386,"V.1.20.1","Cloud topology and architecture diagrams?",null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,20,1,0,0,0,{"$f":"IF(K90=\"\",\"\",IF(D90=\"\",0,IF(D90=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D90=\"Yes\"),AND($L$1=\"Scaled\",D90>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D90=\"No\"),AND($L$1=\"Scaled\",D90<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,1,0,0,"WP.1.A.1, WP.1.E.1",null,null,""]
[3387,"V.1.20.2","Connectivity diagrams?",null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,20,2,0,0,0,{"$f":"IF(K91=\"\",\"\",IF(D91=\"\",0,IF(D91=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D91=\"Yes\"),AND($L$1=\"Scaled\",D91>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D91=\"No\"),AND($L$1=\"Scaled\",D91<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.A.1, WP.1.E.1",null,null,""]
[3388,"V.1.20.3","List of ports that are open externally?",null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,20,3,0,0,0,{"$f":"IF(K92=\"\",\"\",IF(D92=\"\",0,IF(D92=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D92=\"Yes\"),AND($L$1=\"Scaled\",D92>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D92=\"No\"),AND($L$1=\"Scaled\",D92<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.A.1, WP.1.E.1, WP.1.H.6, WP.1.I.2",null,null,""]
[3389,"V.1.20.4","Component and system configuration standards?",null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,20,4,0,0,0,{"$f":"IF(K93=\"\",\"\",IF(D93=\"\",0,IF(D93=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D93=\"Yes\"),AND($L$1=\"Scaled\",D93>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D93=\"No\"),AND($L$1=\"Scaled\",D93<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.I.4",null,null,""]
[3390,"V.1.20.5","Standard operating procedures?",null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,20,5,0,0,0,{"$f":"IF(K94=\"\",\"\",IF(D94=\"\",0,IF(D94=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D94=\"Yes\"),AND($L$1=\"Scaled\",D94>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D94=\"No\"),AND($L$1=\"Scaled\",D94<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.K.6",null,null,""]
[3391,"V.1.21","Who is responsible for user entitlement audits:",null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",2,1,1,21,0,0,0,0,{"$f":"IF(K95=\"\",\"\",IF(D95=\"\",0,IF(D95=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D95=\"Yes\"),AND($L$1=\"Scaled\",D95>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D95=\"No\"),AND($L$1=\"Scaled\",D95<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.H.9, WP.1.F.4, WP.1.F.5",null,null,""]
[3392,"V.1.21.1","Cloud provider?",null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,21,1,0,0,0,{"$f":"IF(K96=\"\",\"\",IF(D96=\"\",0,IF(D96=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D96=\"Yes\"),AND($L$1=\"Scaled\",D96>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D96=\"No\"),AND($L$1=\"Scaled\",D96<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,1,0,0,"WP.1.H.9, WP.1.F.4, WP.1.F.5",null,null,""]
[3393,"V.1.21.2","Client?",null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,21,2,0,0,0,{"$f":"IF(K97=\"\",\"\",IF(D97=\"\",0,IF(D97=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D97=\"Yes\"),AND($L$1=\"Scaled\",D97>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D97=\"No\"),AND($L$1=\"Scaled\",D97<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.H.9, WP.1.F.4, WP.1.F.5",null,null,""]
[3394,"V.1.22","Is there a formal development methodology in operation? If yes, does this include:",null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","12.5.1","Control Of Operational Software",2,null,1,22,0,0,0,2,{"$f":"IF(K98=\"\",\"\",IF(D98=\"\",0,IF(D98=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D98=\"Yes\"),AND($L$1=\"Scaled\",D98>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D98=\"No\"),AND($L$1=\"Scaled\",D98<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3",null,null,""]
[3395,"V.1.22.1","Waterfall",null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","NA",null,3,null,1,22,1,0,0,0,{"$f":"IF(K99=\"\",\"\",IF(D99=\"\",0,IF(D99=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D99=\"Yes\"),AND($L$1=\"Scaled\",D99>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D99=\"No\"),AND($L$1=\"Scaled\",D99<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3",null,null,""]
[3396,"V.1.22.2","Agile? If yes, what groups:",null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","NA",null,3,null,1,22,2,0,0,0,{"$f":"IF(K100=\"\",\"\",IF(D100=\"\",0,IF(D100=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D100=\"Yes\"),AND($L$1=\"Scaled\",D100>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D100=\"No\"),AND($L$1=\"Scaled\",D100<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3",null,null,""]
[3397,"V.1.22.2.1","Development?",null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","NA",null,4,null,1,22,2,1,0,0,{"$f":"IF(K101=\"\",\"\",IF(D101=\"\",0,IF(D101=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D101=\"Yes\"),AND($L$1=\"Scaled\",D101>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D101=\"No\"),AND($L$1=\"Scaled\",D101<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3",null,null,""]
[3398,"V.1.22.2.2","QA?",null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","NA",null,4,null,1,22,2,2,0,0,{"$f":"IF(K102=\"\",\"\",IF(D102=\"\",0,IF(D102=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D102=\"Yes\"),AND($L$1=\"Scaled\",D102>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D102=\"No\"),AND($L$1=\"Scaled\",D102<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3",null,null,""]
[3399,"V.1.22.2.3","Security?",null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","NA",null,4,null,1,22,2,3,0,0,{"$f":"IF(K103=\"\",\"\",IF(D103=\"\",0,IF(D103=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D103=\"Yes\"),AND($L$1=\"Scaled\",D103>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D103=\"No\"),AND($L$1=\"Scaled\",D103<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3",null,null,""]
[3400,"V.1.22.3","Other?",null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","NA",null,3,null,1,22,3,0,0,0,{"$f":"IF(K104=\"\",\"\",IF(D104=\"\",0,IF(D104=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D104=\"Yes\"),AND($L$1=\"Scaled\",D104>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D104=\"No\"),AND($L$1=\"Scaled\",D104<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3401,"V.1.23","Is there a formal process to ensure clients are notified prior to changes being made which may impact their service? If yes, what is the communication method:",null,null,null,null,"G.21 Change Control","12.1.2","Change management",2,null,1,23,0,0,0,2,{"$f":"IF(K105=\"\",\"\",IF(D105=\"\",0,IF(D105=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D105=\"Yes\"),AND($L$1=\"Scaled\",D105>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D105=\"No\"),AND($L$1=\"Scaled\",D105<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.F.6, WP.1.E.3",null,null,""]
[3402,"V.1.23.1","Post to website or portal?",null,null,null,null,"G.21 Change Control","NA",null,3,null,1,23,1,0,0,0,{"$f":"IF(K106=\"\",\"\",IF(D106=\"\",0,IF(D106=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D106=\"Yes\"),AND($L$1=\"Scaled\",D106>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D106=\"No\"),AND($L$1=\"Scaled\",D106<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.F.6, WP.1.E.3, WP.1.H.10",null,null,""]
[3403,"V.1.23.2","Email?",null,null,null,null,"G.21 Change Control","NA",null,3,null,1,23,2,0,0,0,{"$f":"IF(K107=\"\",\"\",IF(D107=\"\",0,IF(D107=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D107=\"Yes\"),AND($L$1=\"Scaled\",D107>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D107=\"No\"),AND($L$1=\"Scaled\",D107<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.F.6, WP.1.E.3",null,null,""]
[3404,"V.1.23.3","Verbal?",null,null,null,null,"G.21 Change Control","NA",null,3,null,1,23,3,0,0,0,{"$f":"IF(K108=\"\",\"\",IF(D108=\"\",0,IF(D108=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D108=\"Yes\"),AND($L$1=\"Scaled\",D108>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D108=\"No\"),AND($L$1=\"Scaled\",D108<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.F.6, WP.1.E.3",null,null,""]
[3405,"V.1.23.4","Other?",null,null,null,null,"G.21 Change Control","NA",null,3,null,1,23,4,0,0,0,{"$f":"IF(K109=\"\",\"\",IF(D109=\"\",0,IF(D109=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D109=\"Yes\"),AND($L$1=\"Scaled\",D109>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D109=\"No\"),AND($L$1=\"Scaled\",D109<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.F.6, WP.1.E.3",null,null,""]
[3406,"V.1.24","Is there a scheduled maintenance window? If yes, what is the frequency:",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.6.1 ","Management of technical vulnerabilities",2,null,1,24,0,0,0,2,{"$f":"IF(K110=\"\",\"\",IF(D110=\"\",0,IF(D110=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D110=\"Yes\"),AND($L$1=\"Scaled\",D110>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D110=\"No\"),AND($L$1=\"Scaled\",D110<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3407,"V.1.24.1","Daily?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","NA",null,3,null,1,24,1,0,0,0,{"$f":"IF(K111=\"\",\"\",IF(D111=\"\",0,IF(D111=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D111=\"Yes\"),AND($L$1=\"Scaled\",D111>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D111=\"No\"),AND($L$1=\"Scaled\",D111<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3408,"V.1.24.2","Weekly?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","NA",null,3,null,1,24,2,0,0,0,{"$f":"IF(K112=\"\",\"\",IF(D112=\"\",0,IF(D112=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D112=\"Yes\"),AND($L$1=\"Scaled\",D112>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D112=\"No\"),AND($L$1=\"Scaled\",D112<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3409,"V.1.24.3","Biweekly?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","NA",null,3,null,1,24,3,0,0,0,{"$f":"IF(K113=\"\",\"\",IF(D113=\"\",0,IF(D113=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D113=\"Yes\"),AND($L$1=\"Scaled\",D113>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D113=\"No\"),AND($L$1=\"Scaled\",D113<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3410,"V.1.24.4","Monthly?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","NA",null,3,null,1,24,4,0,0,0,{"$f":"IF(K114=\"\",\"\",IF(D114=\"\",0,IF(D114=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D114=\"Yes\"),AND($L$1=\"Scaled\",D114>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D114=\"No\"),AND($L$1=\"Scaled\",D114<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3411,"V.1.24.5","Other?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","NA",null,3,null,1,24,5,0,0,0,{"$f":"IF(K115=\"\",\"\",IF(D115=\"\",0,IF(D115=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D115=\"Yes\"),AND($L$1=\"Scaled\",D115>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D115=\"No\"),AND($L$1=\"Scaled\",D115<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3412,"V.1.25","Is there a scheduled maintenance window which results in client downtime? If yes, what is the downtime:",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","14.2.2.l","System change control procedures",2,null,1,25,0,0,0,2,{"$f":"IF(K116=\"\",\"\",IF(D116=\"\",0,IF(D116=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D116=\"Yes\"),AND($L$1=\"Scaled\",D116>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D116=\"No\"),AND($L$1=\"Scaled\",D116<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3413,"V.1.25.1","< 30 min?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","NA",null,3,null,1,25,1,0,0,0,{"$f":"IF(K117=\"\",\"\",IF(D117=\"\",0,IF(D117=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D117=\"Yes\"),AND($L$1=\"Scaled\",D117>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D117=\"No\"),AND($L$1=\"Scaled\",D117<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3414,"V.1.25.2",">30 min < 60 min?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","NA",null,3,null,1,25,2,0,0,0,{"$f":"IF(K118=\"\",\"\",IF(D118=\"\",0,IF(D118=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D118=\"Yes\"),AND($L$1=\"Scaled\",D118>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D118=\"No\"),AND($L$1=\"Scaled\",D118<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3415,"V.1.25.3",">60 min < 120 min?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","NA",null,3,null,1,25,3,0,0,0,{"$f":"IF(K119=\"\",\"\",IF(D119=\"\",0,IF(D119=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D119=\"Yes\"),AND($L$1=\"Scaled\",D119>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D119=\"No\"),AND($L$1=\"Scaled\",D119<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3416,"V.1.25.4",">120 min < 180 min?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","NA",null,3,null,1,25,4,0,0,0,{"$f":"IF(K120=\"\",\"\",IF(D120=\"\",0,IF(D120=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D120=\"Yes\"),AND($L$1=\"Scaled\",D120>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D120=\"No\"),AND($L$1=\"Scaled\",D120<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3417,"V.1.25.5","Other?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","NA",null,3,null,1,25,5,0,0,0,{"$f":"IF(K121=\"\",\"\",IF(D121=\"\",0,IF(D121=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D121=\"Yes\"),AND($L$1=\"Scaled\",D121>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D121=\"No\"),AND($L$1=\"Scaled\",D121<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3418,"V.1.26","Is there an online incident response status portal, which outlines planned and unplanned outages? If yes, how long after an unplanned outage is this updated:",null,null,null,null,"J. Information Security Incident Management, P.8 Privacy Incident and Response Management","14.2.2","System change control procedures",2,null,1,26,0,0,0,2,{"$f":"IF(K122=\"\",\"\",IF(D122=\"\",0,IF(D122=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D122=\"Yes\"),AND($L$1=\"Scaled\",D122>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D122=\"No\"),AND($L$1=\"Scaled\",D122<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.F.6, WP.1.E.3",null,null,""]
[3419,"V.1.26.1","Real-time?",null,null,null,null,null,"NA",null,3,null,1,26,1,0,0,0,{"$f":"IF(K123=\"\",\"\",IF(D123=\"\",0,IF(D123=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D123=\"Yes\"),AND($L$1=\"Scaled\",D123>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D123=\"No\"),AND($L$1=\"Scaled\",D123<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.F.6, WP.1.E.3",null,null,""]
[3420,"V.1.26.2","< 30 min?",null,null,null,null,null,"NA",null,3,null,1,26,2,0,0,0,{"$f":"IF(K124=\"\",\"\",IF(D124=\"\",0,IF(D124=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D124=\"Yes\"),AND($L$1=\"Scaled\",D124>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D124=\"No\"),AND($L$1=\"Scaled\",D124<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.F.6, WP.1.E.3",null,null,""]
[3421,"V.1.26.3",">30 min < 60 min?",null,null,null,null,null,"NA",null,3,null,1,26,3,0,0,0,{"$f":"IF(K125=\"\",\"\",IF(D125=\"\",0,IF(D125=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D125=\"Yes\"),AND($L$1=\"Scaled\",D125>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D125=\"No\"),AND($L$1=\"Scaled\",D125<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.F.6, WP.1.E.3",null,null,""]
[3422,"V.1.26.4",">60 min < 120 min?",null,null,null,null,null,"NA",null,3,null,1,26,4,0,0,0,{"$f":"IF(K126=\"\",\"\",IF(D126=\"\",0,IF(D126=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D126=\"Yes\"),AND($L$1=\"Scaled\",D126>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D126=\"No\"),AND($L$1=\"Scaled\",D126<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.F.6, WP.1.E.3",null,null,""]
[3423,"V.1.26.5",">120 min < 180 min?",null,null,null,null,null,"NA",null,3,null,1,26,5,0,0,0,{"$f":"IF(K127=\"\",\"\",IF(D127=\"\",0,IF(D127=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D127=\"Yes\"),AND($L$1=\"Scaled\",D127>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D127=\"No\"),AND($L$1=\"Scaled\",D127<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.F.6, WP.1.E.3",null,null,""]
[3424,"V.1.26.6","Other?",null,null,null,null,null,"NA",null,3,null,1,26,6,0,0,0,{"$f":"IF(K128=\"\",\"\",IF(D128=\"\",0,IF(D128=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D128=\"Yes\"),AND($L$1=\"Scaled\",D128>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D128=\"No\"),AND($L$1=\"Scaled\",D128<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.F.6, WP.1.E.3",null,null,""]
[3425,"V.1.27","Is there the option for clients to opt-in or opt-out of specific features in releases?",null,null,null,null,null,"14.2.2","System change control procedures",2,null,1,27,0,0,0,0,{"$f":"IF(K129=\"\",\"\",IF(D129=\"\",0,IF(D129=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D129=\"Yes\"),AND($L$1=\"Scaled\",D129>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D129=\"No\"),AND($L$1=\"Scaled\",D129<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3426,"V.1.28","Is there a 24x7x365 staffed phone number available to clients to report security incidents?",null,null,null,null,"J. Information Security Incident Management, P.8 Privacy Incident and Response Management","15.1.1.h ","Information security policy for supplier relationships",2,null,1,28,0,0,0,2,{"$f":"IF(K130=\"\",\"\",IF(D130=\"\",0,IF(D130=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D130=\"Yes\"),AND($L$1=\"Scaled\",D130>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D130=\"No\"),AND($L$1=\"Scaled\",D130<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.E.3, WP.1.G.10",null,null,""]
[3427,"V.1.29","Are applications created and released into production? If yes, what is the release frequency:",null,null,null,null,"Q.1 Secure SDLC Policies, Standards and Procedures","12.5.1","Control Of Operational Software",2,null,1,29,0,0,0,2,{"$f":"IF(K131=\"\",\"\",IF(D131=\"\",0,IF(D131=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D131=\"Yes\"),AND($L$1=\"Scaled\",D131>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D131=\"No\"),AND($L$1=\"Scaled\",D131<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7",null,null,""]
[3428,"V.1.29.1","Ad hoc?",null,null,null,null,null,"NA",null,3,null,1,29,1,0,0,0,{"$f":"IF(K132=\"\",\"\",IF(D132=\"\",0,IF(D132=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D132=\"Yes\"),AND($L$1=\"Scaled\",D132>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D132=\"No\"),AND($L$1=\"Scaled\",D132<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3429,"V.1.29.2","Daily?",null,null,null,null,null,"NA",null,3,null,1,29,2,0,0,0,{"$f":"IF(K133=\"\",\"\",IF(D133=\"\",0,IF(D133=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D133=\"Yes\"),AND($L$1=\"Scaled\",D133>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D133=\"No\"),AND($L$1=\"Scaled\",D133<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3430,{"$f":"IF(K134=0,\"\",IF(K134=1,R$1&\".\"&M134,IF(K134=2,R$1&\".\"&M134&\".\"&N134,IF(K134=3,R$1&\".\"&M134&\".\"&N134&\".\"&O134,IF(K134=4,R$1&\".\"&M134&\".\"&N134&\".\"&O134&\".\"&P134,IF(K134=5,R$1&\".\"&M134&\".\"&N134&\".\"&O134&\".\"&P134&\".\"&Q134))))))","v":"V.1.29.3"},"Weekly?",null,null,null,null,null,"NA",null,3,null,{"$f":"IF(M133=\"\",1,IF(K134=1,M133+1,M133))","v":1},{"$f":"IF(N133=\"\",0,IF(M133<>M134,0,IF($K134=2,N133+1,N133)))","v":29},{"$f":"IF(O133=\"\",0,IF(N133<>N134,0,IF($K134=3,O133+1,O133)))","v":3},{"$f":"IF(P133=\"\",0,IF(O133<>O134,0,IF($K134=4,P133+1,P133)))","v":0},{"$f":"IF(Q133=\"\",0,IF(P133<>P134,0,IF($K134=5,Q133+1,Q133)))","v":0},{"$f":"IF(OR(Master=\"Master\",K134=0,L134=1),0,IF(ISNA(VLOOKUP(A134,L2_Array,21,FALSE)),0,VLOOKUP(A134,L2_Array,21,FALSE)))","v":0},{"$f":"IF(K134=\"\",\"\",IF(D134=\"\",0,IF(D134=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D134=\"Yes\"),AND($L$1=\"Scaled\",D134>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D134=\"No\"),AND($L$1=\"Scaled\",D134<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(K134=\"\",\"\",IF(R134>0,R134,IF(S134>0,S134,0)))","v":0},{"$f":"IF(OR(K134=\"\",K134=0),\"\",IF(OR(K134=1,U133=\"\"),1,IF(OR(AND(L133=1,(K134-K132<>0)),AND(U133=0,K133=K134),AND(L133=1,K134=K132)),0,1)))","v":1},{"$f":"IF(K134=\"\",V133,IF(AND(T134>1,OR(V133=\"\",V133=0,V133>=K134)),K134,IF(K134>V133,V133,0)))","v":1},{"$f":"IF(Master=\"Master\",S134,IF(W133=\"\",T134,IF(OR(AND(V134>0,T134<W133),AND(V134=1,T134<=W133)),W133,T134)))","v":2},{"$f":"IF(K134=\"\",\"\",IF(OR(AND(U133=1,V134=1),T134>0,AND(U135=0,X135=1)),1,0))","v":1},{"$f":"IF(K134=\"\",\"\",IF(OR(AND(V134>0,U134=1),AND(U134=1,X134=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A134,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(K134=1,T134=1),2,IF(AND(W133=1,M134=M133),2,IF(AND(AD133=2,M134=M133),2,IF(K134=1,1,\"\"))))","v":""}]
[3431,"V.1.29.4","Biweekly?",null,null,null,null,null,"NA",null,3,null,1,29,4,0,0,0,{"$f":"IF(K135=\"\",\"\",IF(D135=\"\",0,IF(D135=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D135=\"Yes\"),AND($L$1=\"Scaled\",D135>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D135=\"No\"),AND($L$1=\"Scaled\",D135<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3432,"V.1.29.5","Monthly?",null,null,null,null,null,"NA",null,3,null,1,29,5,0,0,0,{"$f":"IF(K136=\"\",\"\",IF(D136=\"\",0,IF(D136=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D136=\"Yes\"),AND($L$1=\"Scaled\",D136>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D136=\"No\"),AND($L$1=\"Scaled\",D136<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3433,"V.1.29.6","> 3 months?",null,null,null,null,null,"NA",null,3,null,1,29,6,0,0,0,{"$f":"IF(K137=\"\",\"\",IF(D137=\"\",0,IF(D137=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D137=\"Yes\"),AND($L$1=\"Scaled\",D137>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D137=\"No\"),AND($L$1=\"Scaled\",D137<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3434,"V.1.29.7","> 6 months?",null,null,null,null,null,"NA",null,3,null,1,29,7,0,0,0,{"$f":"IF(K138=\"\",\"\",IF(D138=\"\",0,IF(D138=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D138=\"Yes\"),AND($L$1=\"Scaled\",D138>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D138=\"No\"),AND($L$1=\"Scaled\",D138<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3435,"V.1.29.8","Other?",null,null,null,null,null,"NA",null,3,null,1,29,8,0,0,0,{"$f":"IF(K139=\"\",\"\",IF(D139=\"\",0,IF(D139=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D139=\"Yes\"),AND($L$1=\"Scaled\",D139>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D139=\"No\"),AND($L$1=\"Scaled\",D139<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3436,"V.1.30","Is there an automated secure source code review? If yes, what is the frequency:",null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","12.5.1","Control Of Operational Software",2,null,1,30,0,0,0,2,{"$f":"IF(K140=\"\",\"\",IF(D140=\"\",0,IF(D140=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D140=\"Yes\"),AND($L$1=\"Scaled\",D140>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D140=\"No\"),AND($L$1=\"Scaled\",D140<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7",null,null,""]
[3437,"V.1.30.1","Ad hoc?",null,null,null,null,null,"NA",null,3,null,1,30,1,0,0,0,{"$f":"IF(K141=\"\",\"\",IF(D141=\"\",0,IF(D141=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D141=\"Yes\"),AND($L$1=\"Scaled\",D141>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D141=\"No\"),AND($L$1=\"Scaled\",D141<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3438,"V.1.30.2","Daily?",null,null,null,null,null,"NA",null,3,null,1,30,2,0,0,0,{"$f":"IF(K142=\"\",\"\",IF(D142=\"\",0,IF(D142=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D142=\"Yes\"),AND($L$1=\"Scaled\",D142>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D142=\"No\"),AND($L$1=\"Scaled\",D142<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3439,"V.1.30.3","Weekly?",null,null,null,null,null,"NA",null,3,null,1,30,3,0,0,0,{"$f":"IF(K143=\"\",\"\",IF(D143=\"\",0,IF(D143=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D143=\"Yes\"),AND($L$1=\"Scaled\",D143>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D143=\"No\"),AND($L$1=\"Scaled\",D143<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3440,"V.1.30.4","Biweekly?",null,null,null,null,null,"NA",null,3,null,1,30,4,0,0,0,{"$f":"IF(K144=\"\",\"\",IF(D144=\"\",0,IF(D144=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D144=\"Yes\"),AND($L$1=\"Scaled\",D144>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D144=\"No\"),AND($L$1=\"Scaled\",D144<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3441,"V.1.30.5","Monthly?",null,null,null,null,null,"NA",null,3,null,1,30,5,0,0,0,{"$f":"IF(K145=\"\",\"\",IF(D145=\"\",0,IF(D145=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D145=\"Yes\"),AND($L$1=\"Scaled\",D145>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D145=\"No\"),AND($L$1=\"Scaled\",D145<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3442,"V.1.30.6","> 3 months?",null,null,null,null,null,"NA",null,3,null,1,30,6,0,0,0,{"$f":"IF(K146=\"\",\"\",IF(D146=\"\",0,IF(D146=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D146=\"Yes\"),AND($L$1=\"Scaled\",D146>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D146=\"No\"),AND($L$1=\"Scaled\",D146<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3443,"V.1.30.7","> 6 months?",null,null,null,null,null,"NA",null,3,null,1,30,7,0,0,0,{"$f":"IF(K147=\"\",\"\",IF(D147=\"\",0,IF(D147=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D147=\"Yes\"),AND($L$1=\"Scaled\",D147>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D147=\"No\"),AND($L$1=\"Scaled\",D147<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3444,"V.1.30.8","Other?",null,null,null,null,null,"NA",null,3,null,1,30,8,0,0,0,{"$f":"IF(K148=\"\",\"\",IF(D148=\"\",0,IF(D148=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D148=\"Yes\"),AND($L$1=\"Scaled\",D148>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D148=\"No\"),AND($L$1=\"Scaled\",D148<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3445,"V.1.31","Is source code security reviewed manually? If yes, what is the frequency:",null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","12.2.1                                                      12.5.1","Controls against malware,\nControl of Operational Software",2,null,1,31,0,0,0,2,{"$f":"IF(K149=\"\",\"\",IF(D149=\"\",0,IF(D149=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D149=\"Yes\"),AND($L$1=\"Scaled\",D149>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D149=\"No\"),AND($L$1=\"Scaled\",D149<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7",null,null,""]
[3446,"V.1.31.1","Ad hoc?",null,null,null,null,null,"NA",null,3,null,1,31,1,0,0,0,{"$f":"IF(K150=\"\",\"\",IF(D150=\"\",0,IF(D150=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D150=\"Yes\"),AND($L$1=\"Scaled\",D150>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D150=\"No\"),AND($L$1=\"Scaled\",D150<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3447,"V.1.31.2","Daily?",null,null,null,null,null,"NA",null,3,null,1,31,2,0,0,0,{"$f":"IF(K151=\"\",\"\",IF(D151=\"\",0,IF(D151=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D151=\"Yes\"),AND($L$1=\"Scaled\",D151>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D151=\"No\"),AND($L$1=\"Scaled\",D151<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3448,"V.1.31.3","Weekly?",null,null,null,null,null,"NA",null,3,null,1,31,3,0,0,0,{"$f":"IF(K152=\"\",\"\",IF(D152=\"\",0,IF(D152=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D152=\"Yes\"),AND($L$1=\"Scaled\",D152>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D152=\"No\"),AND($L$1=\"Scaled\",D152<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3449,"V.1.31.4","Biweekly?",null,null,null,null,null,"NA",null,3,null,1,31,4,0,0,0,{"$f":"IF(K153=\"\",\"\",IF(D153=\"\",0,IF(D153=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D153=\"Yes\"),AND($L$1=\"Scaled\",D153>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D153=\"No\"),AND($L$1=\"Scaled\",D153<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3450,"V.1.31.5","Monthly?",null,null,null,null,null,"NA",null,3,null,1,31,5,0,0,0,{"$f":"IF(K154=\"\",\"\",IF(D154=\"\",0,IF(D154=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D154=\"Yes\"),AND($L$1=\"Scaled\",D154>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D154=\"No\"),AND($L$1=\"Scaled\",D154<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3451,"V.1.31.6","> 3 months?",null,null,null,null,null,"NA",null,3,null,1,31,6,0,0,0,{"$f":"IF(K155=\"\",\"\",IF(D155=\"\",0,IF(D155=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D155=\"Yes\"),AND($L$1=\"Scaled\",D155>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D155=\"No\"),AND($L$1=\"Scaled\",D155<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3452,"V.1.31.7","> 6 months?",null,null,null,null,null,"NA",null,3,null,1,31,7,0,0,0,{"$f":"IF(K156=\"\",\"\",IF(D156=\"\",0,IF(D156=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D156=\"Yes\"),AND($L$1=\"Scaled\",D156>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D156=\"No\"),AND($L$1=\"Scaled\",D156<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3453,"V.1.31.8","Other?",null,null,null,null,null,"NA",null,3,null,1,31,8,0,0,0,{"$f":"IF(K157=\"\",\"\",IF(D157=\"\",0,IF(D157=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D157=\"Yes\"),AND($L$1=\"Scaled\",D157>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D157=\"No\"),AND($L$1=\"Scaled\",D157<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3454,"V.1.32","Are automated penetration tests performed? If yes, what is the frequency:",null,null,null,null,"I.1 Application Vulnerability Assessments/Ethical Hacking","12.2.1                                                      12.5.1                                              12.6.1","Controls against malware,\nControl of Operational Software                                    Management of technical vulnerabilities",2,null,1,32,0,0,0,2,{"$f":"IF(K158=\"\",\"\",IF(D158=\"\",0,IF(D158=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D158=\"Yes\"),AND($L$1=\"Scaled\",D158>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D158=\"No\"),AND($L$1=\"Scaled\",D158<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7, WP.1.A.10",null,null,""]
[3455,"V.1.32.1","Ad hoc?",null,null,null,null,null,"NA",null,3,null,1,32,1,0,0,0,{"$f":"IF(K159=\"\",\"\",IF(D159=\"\",0,IF(D159=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D159=\"Yes\"),AND($L$1=\"Scaled\",D159>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D159=\"No\"),AND($L$1=\"Scaled\",D159<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3456,"V.1.32.2","Daily?",null,null,null,null,null,"NA",null,3,null,1,32,2,0,0,0,{"$f":"IF(K160=\"\",\"\",IF(D160=\"\",0,IF(D160=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D160=\"Yes\"),AND($L$1=\"Scaled\",D160>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D160=\"No\"),AND($L$1=\"Scaled\",D160<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3457,"V.1.32.3","Weekly?",null,null,null,null,null,"NA",null,3,null,1,32,3,0,0,0,{"$f":"IF(K161=\"\",\"\",IF(D161=\"\",0,IF(D161=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D161=\"Yes\"),AND($L$1=\"Scaled\",D161>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D161=\"No\"),AND($L$1=\"Scaled\",D161<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3458,"V.1.32.4","Biweekly?",null,null,null,null,null,"NA",null,3,null,1,32,4,0,0,0,{"$f":"IF(K162=\"\",\"\",IF(D162=\"\",0,IF(D162=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D162=\"Yes\"),AND($L$1=\"Scaled\",D162>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D162=\"No\"),AND($L$1=\"Scaled\",D162<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3459,"V.1.32.5","Monthly?",null,null,null,null,null,"NA",null,3,null,1,32,5,0,0,0,{"$f":"IF(K163=\"\",\"\",IF(D163=\"\",0,IF(D163=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D163=\"Yes\"),AND($L$1=\"Scaled\",D163>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D163=\"No\"),AND($L$1=\"Scaled\",D163<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3460,"V.1.32.6","> 3 months?",null,null,null,null,null,"NA",null,3,null,1,32,6,0,0,0,{"$f":"IF(K164=\"\",\"\",IF(D164=\"\",0,IF(D164=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D164=\"Yes\"),AND($L$1=\"Scaled\",D164>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D164=\"No\"),AND($L$1=\"Scaled\",D164<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3461,"V.1.32.7","> 6 months?",null,null,null,null,null,"NA",null,3,null,1,32,7,0,0,0,{"$f":"IF(K165=\"\",\"\",IF(D165=\"\",0,IF(D165=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D165=\"Yes\"),AND($L$1=\"Scaled\",D165>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D165=\"No\"),AND($L$1=\"Scaled\",D165<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3462,"V.1.32.8","Other?",null,null,null,null,null,"NA",null,3,null,1,32,8,0,0,0,{"$f":"IF(K166=\"\",\"\",IF(D166=\"\",0,IF(D166=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D166=\"Yes\"),AND($L$1=\"Scaled\",D166>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D166=\"No\"),AND($L$1=\"Scaled\",D166<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3463,"V.1.33","Are manual penetration tests performed? If yes, what is the frequency:",null,null,null,null,"I.1 Application Vulnerability Assessments/Ethical Hacking","12.2.1                                                      12.5.1                                              12.6.1","Controls against malware,\nControl of Operational Software                                    Management of technical vulnerabilities",2,null,1,33,0,0,0,0,{"$f":"IF(K167=\"\",\"\",IF(D167=\"\",0,IF(D167=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D167=\"Yes\"),AND($L$1=\"Scaled\",D167>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D167=\"No\"),AND($L$1=\"Scaled\",D167<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7, WP.1.A.10",null,null,""]
[3464,"V.1.33.1","Ad hoc?",null,null,null,null,null,"NA",null,3,null,1,33,1,0,0,0,{"$f":"IF(K168=\"\",\"\",IF(D168=\"\",0,IF(D168=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D168=\"Yes\"),AND($L$1=\"Scaled\",D168>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D168=\"No\"),AND($L$1=\"Scaled\",D168<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3465,"V.1.33.2","Daily?",null,null,null,null,null,"NA",null,3,null,1,33,2,0,0,0,{"$f":"IF(K169=\"\",\"\",IF(D169=\"\",0,IF(D169=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D169=\"Yes\"),AND($L$1=\"Scaled\",D169>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D169=\"No\"),AND($L$1=\"Scaled\",D169<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3466,"V.1.33.3","Weekly?",null,null,null,null,null,"NA",null,3,null,1,33,3,0,0,0,{"$f":"IF(K170=\"\",\"\",IF(D170=\"\",0,IF(D170=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D170=\"Yes\"),AND($L$1=\"Scaled\",D170>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D170=\"No\"),AND($L$1=\"Scaled\",D170<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3467,"V.1.33.4","Biweekly?",null,null,null,null,null,"NA",null,3,null,1,33,4,0,0,0,{"$f":"IF(K171=\"\",\"\",IF(D171=\"\",0,IF(D171=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D171=\"Yes\"),AND($L$1=\"Scaled\",D171>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D171=\"No\"),AND($L$1=\"Scaled\",D171<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3468,"V.1.33.5","Monthly?",null,null,null,null,null,"NA",null,3,null,1,33,5,0,0,0,{"$f":"IF(K172=\"\",\"\",IF(D172=\"\",0,IF(D172=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D172=\"Yes\"),AND($L$1=\"Scaled\",D172>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D172=\"No\"),AND($L$1=\"Scaled\",D172<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3469,"V.1.33.6","> 3 months?",null,null,null,null,null,"NA",null,3,null,1,33,6,0,0,0,{"$f":"IF(K173=\"\",\"\",IF(D173=\"\",0,IF(D173=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D173=\"Yes\"),AND($L$1=\"Scaled\",D173>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D173=\"No\"),AND($L$1=\"Scaled\",D173<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3470,"V.1.33.7","> 6 months?",null,null,null,null,null,"NA",null,3,null,1,33,7,0,0,0,{"$f":"IF(K174=\"\",\"\",IF(D174=\"\",0,IF(D174=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D174=\"Yes\"),AND($L$1=\"Scaled\",D174>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D174=\"No\"),AND($L$1=\"Scaled\",D174<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3471,"V.1.33.8","Other?",null,null,null,null,null,"NA",null,3,null,1,33,8,0,0,0,{"$f":"IF(K175=\"\",\"\",IF(D175=\"\",0,IF(D175=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D175=\"Yes\"),AND($L$1=\"Scaled\",D175>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D175=\"No\"),AND($L$1=\"Scaled\",D175<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3472,"V.1.34","Are clients provided with the ability to specify where their data will be stored? If yes, what level:",null,null,null,null,"P.6 Management of Client Target Privacy Data","8.1.1                                                        15.1.1                                                         18.1.1","Inventory Of Assets,                   Information security policy for supplier relationships,\nIdentification Of Applicable Legislation",2,null,1,34,0,0,0,2,{"$f":"IF(K176=\"\",\"\",IF(D176=\"\",0,IF(D176=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D176=\"Yes\"),AND($L$1=\"Scaled\",D176>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D176=\"No\"),AND($L$1=\"Scaled\",D176<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.E.4, WP.1.G.2, WP.1.G.3",null,null,""]
[3473,"V.1.34.1","Data classification zone: based on security classification level (e.g., production networks, PCI networks)",null,null,null,null,"P.6 Management of Client Target Privacy Data","NA",null,3,null,1,34,1,0,0,0,{"$f":"IF(K177=\"\",\"\",IF(D177=\"\",0,IF(D177=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D177=\"Yes\"),AND($L$1=\"Scaled\",D177>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D177=\"No\"),AND($L$1=\"Scaled\",D177<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.E.4, WP.1.G.2, WP.1.G.3",null,null,""]
[3474,"V.1.34.2","Data center?",null,null,null,null,"P.6 Management of Client Target Privacy Data","NA",null,3,null,1,34,2,0,0,0,{"$f":"IF(K178=\"\",\"\",IF(D178=\"\",0,IF(D178=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D178=\"Yes\"),AND($L$1=\"Scaled\",D178>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D178=\"No\"),AND($L$1=\"Scaled\",D178<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.E.4, WP.1.G.2, WP.1.G.3",null,null,""]
[3475,"V.1.34.3","Country?",null,null,null,null,"P.6 Management of Client Target Privacy Data","NA",null,3,null,1,34,3,0,0,0,{"$f":"IF(K179=\"\",\"\",IF(D179=\"\",0,IF(D179=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D179=\"Yes\"),AND($L$1=\"Scaled\",D179>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D179=\"No\"),AND($L$1=\"Scaled\",D179<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.E.4, WP.1.G.2, WP.1.G.3",null,null,""]
[3476,"V.1.34.4","Location based on legal jurisdiction?",null,null,null,null,"P.6 Management of Client Target Privacy Data","NA",null,3,null,1,34,4,0,0,0,{"$f":"IF(K180=\"\",\"\",IF(D180=\"\",0,IF(D180=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D180=\"Yes\"),AND($L$1=\"Scaled\",D180>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D180=\"No\"),AND($L$1=\"Scaled\",D180<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.E.4, WP.1.G.2, WP.1.G.3",null,null,""]
[3477,"V.1.35","Are there legal data ownership agreements with clients? If yes, do they include:",null,null,null,null,"P.6 Management of Client Target Privacy Data","18.1.2                                                      18.2.3","Intellectual Property Rights,\nProtection Of  Records",2,null,1,35,0,0,0,0,{"$f":"IF(K181=\"\",\"\",IF(D181=\"\",0,IF(D181=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D181=\"Yes\"),AND($L$1=\"Scaled\",D181>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D181=\"No\"),AND($L$1=\"Scaled\",D181<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.G.1",null,null,""]
[3478,"V.1.35.1","Who owns the data?",null,null,null,null,"P.6 Management of Client Target Privacy Data","18.1.2                                                      18.2.3","Intellectual Property Rights,\nProtection Of  Records",3,null,1,35,1,0,0,0,{"$f":"IF(K182=\"\",\"\",IF(D182=\"\",0,IF(D182=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D182=\"Yes\"),AND($L$1=\"Scaled\",D182>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D182=\"No\"),AND($L$1=\"Scaled\",D182<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.G.1",null,null,""]
[3479,"V.1.35.2","What rights (if any) the cloud provider has to the client's complete data?",null,null,null,null,"P.6 Management of Client Target Privacy Data","18.1.2                                                      18.2.3","Intellectual Property Rights,\nProtection Of  Records",3,null,1,35,2,0,0,0,{"$f":"IF(K183=\"\",\"\",IF(D183=\"\",0,IF(D183=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D183=\"Yes\"),AND($L$1=\"Scaled\",D183>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D183=\"No\"),AND($L$1=\"Scaled\",D183<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.G.1",null,null,""]
[3480,"V.1.35.3","What rights (if any) the cloud provider has to the client's aggregate/sanitized data?",null,null,null,null,"P.6 Management of Client Target Privacy Data","18.1.2                                                      18.2.3","Intellectual Property Rights,\nProtection Of  Records",3,null,1,35,3,0,0,0,{"$f":"IF(K184=\"\",\"\",IF(D184=\"\",0,IF(D184=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D184=\"Yes\"),AND($L$1=\"Scaled\",D184>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D184=\"No\"),AND($L$1=\"Scaled\",D184<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.G.1",null,null,""]
[3481,"V.1.36","Does the ability exist to legally demonstrate sufficient data segmentation, in the event of a client subpoena or a forensics incident, so as not to impact other clients data if using resource pooling? If yes, is there a:",null,null,null,null,"V.1 Service and Deployment Models","16.1.1                                                     16.1.7","Responsibilities And Procedures,\nCollection Of Evidence.",2,null,1,36,0,0,0,2,{"$f":"IF(K185=\"\",\"\",IF(D185=\"\",0,IF(D185=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D185=\"Yes\"),AND($L$1=\"Scaled\",D185>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D185=\"No\"),AND($L$1=\"Scaled\",D185<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.L.2, WP.1.G.5",null,null,""]
[3482,"V.1.36.1","Legal strategy document that can be shared with the client?",null,null,null,null,null,"NA",null,3,null,1,36,1,0,0,0,{"$f":"IF(K186=\"\",\"\",IF(D186=\"\",0,IF(D186=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D186=\"Yes\"),AND($L$1=\"Scaled\",D186>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D186=\"No\"),AND($L$1=\"Scaled\",D186<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.L.2, WP.1.G.5",null,null,""]
[3483,"V.1.36.2","Legal counsel (in-house or external) approval?",null,null,null,null,null,"NA",null,3,null,1,36,2,0,0,0,{"$f":"IF(K187=\"\",\"\",IF(D187=\"\",0,IF(D187=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D187=\"Yes\"),AND($L$1=\"Scaled\",D187>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D187=\"No\"),AND($L$1=\"Scaled\",D187<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.L.2, WP.1.G.5",null,null,""]
[3484,"V.1.37","Is there a data retention/destruction schedule? If yes, is it:",null,null,null,null,null,8.3000000000000007,"Media Handling",2,null,1,37,0,0,0,0,{"$f":"IF(K188=\"\",\"\",IF(D188=\"\",0,IF(D188=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D188=\"Yes\"),AND($L$1=\"Scaled\",D188>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D188=\"No\"),AND($L$1=\"Scaled\",D188<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3485,"V.1.37.1","Online: disk?",null,null,null,null,null,"NA",null,3,null,1,37,1,0,0,0,{"$f":"IF(K189=\"\",\"\",IF(D189=\"\",0,IF(D189=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D189=\"Yes\"),AND($L$1=\"Scaled\",D189>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D189=\"No\"),AND($L$1=\"Scaled\",D189<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.2, WP.1.K.3, WP.1.K.5",null,null,""]
[3486,"V.1.37.2","Offline: media: (e.g., DLT, DVD)?",null,null,null,null,null,"NA",null,3,null,1,37,2,0,0,0,{"$f":"IF(K190=\"\",\"\",IF(D190=\"\",0,IF(D190=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D190=\"Yes\"),AND($L$1=\"Scaled\",D190>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D190=\"No\"),AND($L$1=\"Scaled\",D190<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.2, WP.1.K.3, WP.1.K.5",null,null,""]
[3487,"V.1.37.3","Online: data managed by third party vendors?",null,null,null,null,null,"NA",null,3,null,1,37,3,0,0,0,{"$f":"IF(K191=\"\",\"\",IF(D191=\"\",0,IF(D191=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D191=\"Yes\"),AND($L$1=\"Scaled\",D191>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D191=\"No\"),AND($L$1=\"Scaled\",D191<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.2, WP.1.K.3, WP.1.K.5",null,null,""]
[3488,"V.1.37.4","Offline: data managed by third party vendors?",null,null,null,null,null,"NA",null,3,null,1,37,4,0,0,0,{"$f":"IF(K192=\"\",\"\",IF(D192=\"\",0,IF(D192=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D192=\"Yes\"),AND($L$1=\"Scaled\",D192>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D192=\"No\"),AND($L$1=\"Scaled\",D192<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.2, WP.1.K.3, WP.1.K.5",null,null,""]
[3489,"V.1.38","Is there a self-service portal or API call available to clients which provides the ability to place a \"Legal hold\" on client data which may be subject to a legal action, without impacting other clients data retention or destruction schedules?",null,null,null,null,"P.6 Management of Client Target Privacy Data","16.1.1                                                      16.1.7                                                          18.1.2                                             18.1.3","Responsibilities And Procedures,\nCollection Of Evidence,\nIntellectual Property Rights,\nProtection Of records",2,null,1,38,0,0,0,2,{"$f":"IF(K193=\"\",\"\",IF(D193=\"\",0,IF(D193=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D193=\"Yes\"),AND($L$1=\"Scaled\",D193>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D193=\"No\"),AND($L$1=\"Scaled\",D193<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.K.4",null,null,""]
[3490,"V.1.39","Is a Cloud API available to clients?",null,null,null,null,"H.3 Logical Access Authorization","NA",null,2,null,1,39,0,0,0,2,{"$f":"IF(K194=\"\",\"\",IF(D194=\"\",0,IF(D194=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D194=\"Yes\"),AND($L$1=\"Scaled\",D194>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D194=\"No\"),AND($L$1=\"Scaled\",D194<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,null,null,null,""]
[3491,"V.1.39.1","Is there a formal security program established to include API security reviews? If yes, does this include:",null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","12.5.1","Control Of Operational Software",3,null,1,39,1,0,0,0,{"$f":"IF(K195=\"\",\"\",IF(D195=\"\",0,IF(D195=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D195=\"Yes\"),AND($L$1=\"Scaled\",D195>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D195=\"No\"),AND($L$1=\"Scaled\",D195<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3492,"V.1.39.1.1","API security evaluated at the requirements phase?",null,null,null,null,null,"12.5.1","Control Of Operational Software",4,null,1,39,1,1,0,0,{"$f":"IF(K196=\"\",\"\",IF(D196=\"\",0,IF(D196=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D196=\"Yes\"),AND($L$1=\"Scaled\",D196>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D196=\"No\"),AND($L$1=\"Scaled\",D196<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3493,"V.1.39.1.2","Security review of API design?",null,null,null,null,null,"12.5.1","Control Of Operational Software",4,null,1,39,1,2,0,0,{"$f":"IF(K197=\"\",\"\",IF(D197=\"\",0,IF(D197=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D197=\"Yes\"),AND($L$1=\"Scaled\",D197>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D197=\"No\"),AND($L$1=\"Scaled\",D197<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3494,{"$f":"IF(K198=0,\"\",IF(K198=1,R$1&\".\"&M198,IF(K198=2,R$1&\".\"&M198&\".\"&N198,IF(K198=3,R$1&\".\"&M198&\".\"&N198&\".\"&O198,IF(K198=4,R$1&\".\"&M198&\".\"&N198&\".\"&O198&\".\"&P198,IF(K198=5,R$1&\".\"&M198&\".\"&N198&\".\"&O198&\".\"&P198&\".\"&Q198))))))","v":"V.1.39.1.3"},"API permission model review?",null,null,null,null,null,"12.5.1","Control Of Operational Software",4,null,{"$f":"IF(M197=\"\",1,IF(K198=1,M197+1,M197))","v":1},{"$f":"IF(N197=\"\",0,IF(M197<>M198,0,IF($K198=2,N197+1,N197)))","v":39},{"$f":"IF(O197=\"\",0,IF(N197<>N198,0,IF($K198=3,O197+1,O197)))","v":1},{"$f":"IF(P197=\"\",0,IF(O197<>O198,0,IF($K198=4,P197+1,P197)))","v":3},{"$f":"IF(Q197=\"\",0,IF(P197<>P198,0,IF($K198=5,Q197+1,Q197)))","v":0},{"$f":"IF(OR(Master=\"Master\",K198=0,L198=1),0,IF(ISNA(VLOOKUP(A198,L2_Array,21,FALSE)),0,VLOOKUP(A198,L2_Array,21,FALSE)))","v":0},{"$f":"IF(K198=\"\",\"\",IF(D198=\"\",0,IF(D198=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D198=\"Yes\"),AND($L$1=\"Scaled\",D198>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D198=\"No\"),AND($L$1=\"Scaled\",D198<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(K198=\"\",\"\",IF(R198>0,R198,IF(S198>0,S198,0)))","v":0},{"$f":"IF(OR(K198=\"\",K198=0),\"\",IF(OR(K198=1,U197=\"\"),1,IF(OR(AND(L197=1,(K198-K196<>0)),AND(U197=0,K197=K198),AND(L197=1,K198=K196)),0,1)))","v":1},{"$f":"IF(K198=\"\",V197,IF(AND(T198>1,OR(V197=\"\",V197=0,V197>=K198)),K198,IF(K198>V197,V197,0)))","v":1},{"$f":"IF(Master=\"Master\",S198,IF(W197=\"\",T198,IF(OR(AND(V198>0,T198<W197),AND(V198=1,T198<=W197)),W197,T198)))","v":2},{"$f":"IF(K198=\"\",\"\",IF(OR(AND(U197=1,V198=1),T198>0,AND(U199=0,X199=1)),1,0))","v":1},{"$f":"IF(K198=\"\",\"\",IF(OR(AND(V198>0,U198=1),AND(U198=1,X198=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A198,L2_Array,1,FALSE)),0,1)","v":0},"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,{"$f":"IF(AND(K198=1,T198=1),2,IF(AND(W197=1,M198=M197),2,IF(AND(AD197=2,M198=M197),2,IF(K198=1,1,\"\"))))","v":""}]
[3495,"V.1.39.2","Is the API code security tested against OWASP top 10 security issues? If yes, does this include:",null,null,null,null,null,"12.6.1","Management of technical vulnerabilities",3,null,1,39,2,0,0,0,{"$f":"IF(K199=\"\",\"\",IF(D199=\"\",0,IF(D199=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D199=\"Yes\"),AND($L$1=\"Scaled\",D199>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D199=\"No\"),AND($L$1=\"Scaled\",D199<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3496,"V.1.39.2.1","Data scoping?",null,null,null,null,null,"NA",null,4,null,1,39,2,1,0,0,{"$f":"IF(K200=\"\",\"\",IF(D200=\"\",0,IF(D200=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D200=\"Yes\"),AND($L$1=\"Scaled\",D200>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D200=\"No\"),AND($L$1=\"Scaled\",D200<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3497,"V.1.39.2.2","XSS?",null,null,null,null,null,"NA",null,4,null,1,39,2,2,0,0,{"$f":"IF(K201=\"\",\"\",IF(D201=\"\",0,IF(D201=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D201=\"Yes\"),AND($L$1=\"Scaled\",D201>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D201=\"No\"),AND($L$1=\"Scaled\",D201<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3498,"V.1.39.2.3","SQL injection?",null,null,null,null,null,"NA",null,4,null,1,39,2,3,0,0,{"$f":"IF(K202=\"\",\"\",IF(D202=\"\",0,IF(D202=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D202=\"Yes\"),AND($L$1=\"Scaled\",D202>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D202=\"No\"),AND($L$1=\"Scaled\",D202<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3499,"V.1.39.2.4","Session abuse?",null,null,null,null,null,"NA",null,4,null,1,39,2,4,0,0,{"$f":"IF(K203=\"\",\"\",IF(D203=\"\",0,IF(D203=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D203=\"Yes\"),AND($L$1=\"Scaled\",D203>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D203=\"No\"),AND($L$1=\"Scaled\",D203<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3500,"V.1.39.2.5","Replay attack?",null,null,null,null,null,"NA",null,4,null,1,39,2,5,0,0,{"$f":"IF(K204=\"\",\"\",IF(D204=\"\",0,IF(D204=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D204=\"Yes\"),AND($L$1=\"Scaled\",D204>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D204=\"No\"),AND($L$1=\"Scaled\",D204<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3501,"V.1.39.2.6","DoS?",null,null,null,null,null,"NA",null,4,null,1,39,2,6,0,0,{"$f":"IF(K205=\"\",\"\",IF(D205=\"\",0,IF(D205=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D205=\"Yes\"),AND($L$1=\"Scaled\",D205>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D205=\"No\"),AND($L$1=\"Scaled\",D205<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3502,"V.1.39.2.7","Data Leakage",null,null,null,null,null,"NA",null,4,null,1,39,2,7,0,0,{"$f":"IF(K206=\"\",\"\",IF(D206=\"\",0,IF(D206=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D206=\"Yes\"),AND($L$1=\"Scaled\",D206>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D206=\"No\"),AND($L$1=\"Scaled\",D206<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3503,"V.1.39.3","Is there the self-service ability to control access to APIs? If yes, does it include:",null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","9.1.2 ","Access to networks and network services",3,null,1,39,3,0,0,0,{"$f":"IF(K207=\"\",\"\",IF(D207=\"\",0,IF(D207=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D207=\"Yes\"),AND($L$1=\"Scaled\",D207>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D207=\"No\"),AND($L$1=\"Scaled\",D207<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.H.10, WP.1.A.1",null,null,""]
[3504,"V.1.39.3.1","Network: Network access control (e.g., firewall ACL)?",null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","9.1.2 ","Access to networks and network services",4,null,1,39,3,1,0,0,{"$f":"IF(K208=\"\",\"\",IF(D208=\"\",0,IF(D208=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D208=\"Yes\"),AND($L$1=\"Scaled\",D208>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D208=\"No\"),AND($L$1=\"Scaled\",D208<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.A.2, WP.1.A.3",null,null,""]
[3505,"V.1.39.3.2","Network: VPN?",null,null,null,null,null,"9.1.2 ","Access to networks and network services",4,null,1,39,3,2,0,0,{"$f":"IF(K209=\"\",\"\",IF(D209=\"\",0,IF(D209=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D209=\"Yes\"),AND($L$1=\"Scaled\",D209>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D209=\"No\"),AND($L$1=\"Scaled\",D209<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.A.2, WP.1.A.3",null,null,""]
[3506,"V.1.39.3.3","Application: Application access control (e.g., application ACL)?",null,null,null,null,"I.5 Application Security Program Governance","9.4.1","Information access restriction",4,null,1,39,3,3,0,0,{"$f":"IF(K210=\"\",\"\",IF(D210=\"\",0,IF(D210=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D210=\"Yes\"),AND($L$1=\"Scaled\",D210>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D210=\"No\"),AND($L$1=\"Scaled\",D210<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.2, WP.1.A.1, WP.1.A.2, WP.1.A.3",null,null,""]
[3507,"V.1.39.3.4","Credential: username/password?",null,null,null,null,null,"9.4.2","Secure log-on procedures",4,null,1,39,3,4,0,0,{"$f":"IF(K211=\"\",\"\",IF(D211=\"\",0,IF(D211=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D211=\"Yes\"),AND($L$1=\"Scaled\",D211>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D211=\"No\"),AND($L$1=\"Scaled\",D211<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.2, WP.1.A.1, WP.1.A.2, WP.1.A.3",null,null,""]
[3508,"V.1.39.3.5","Credential: client side certificate?",null,null,null,null,null,"9.4.1","Information access restriction",4,null,1,39,3,5,0,0,{"$f":"IF(K212=\"\",\"\",IF(D212=\"\",0,IF(D212=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D212=\"Yes\"),AND($L$1=\"Scaled\",D212>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D212=\"No\"),AND($L$1=\"Scaled\",D212<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.2, WP.1.A.1, WP.1.A.2, WP.1.A.3",null,null,""]
[3509,"V.1.39.3.6","Credential: multi factor authentication?",null,null,null,null,null,"9.4.2","Secure log-on procedures",4,null,1,39,3,6,0,0,{"$f":"IF(K213=\"\",\"\",IF(D213=\"\",0,IF(D213=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D213=\"Yes\"),AND($L$1=\"Scaled\",D213>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D213=\"No\"),AND($L$1=\"Scaled\",D213<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.2, WP.1.A.1, WP.1.A.2, WP.1.A.3",null,null,""]
[3510,"V.1.39.4","Is there a self-service kill switch available to clients to disable an API in the event of a security incident (e.g., DoS)?",null,null,null,null,null,"9.4.1","Information access restriction",3,null,1,39,4,0,0,0,{"$f":"IF(K214=\"\",\"\",IF(D214=\"\",0,IF(D214=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D214=\"Yes\"),AND($L$1=\"Scaled\",D214>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D214=\"No\"),AND($L$1=\"Scaled\",D214<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.4, WP.1.I.7",null,null,""]
[3511,"V.1.39.5","Does the API have the ability to alert, block or lock based on rate limit?",null,null,null,null,null,"9.4.2","Secure log-on procedures",3,null,1,39,5,0,0,0,{"$f":"IF(K215=\"\",\"\",IF(D215=\"\",0,IF(D215=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D215=\"Yes\"),AND($L$1=\"Scaled\",D215>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D215=\"No\"),AND($L$1=\"Scaled\",D215<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.4, WP.1.I.7",null,null,""]
[3512,"V.1.39.6","Is Scoped Data encrypted in the API response? ",null,null,null,null,null,"10.1.1                                                     13.1.2","Policy On The Use Of Cryptographic Controls  Security of network services",3,null,1,39,6,0,0,0,{"$f":"IF(K216=\"\",\"\",IF(D216=\"\",0,IF(D216=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D216=\"Yes\"),AND($L$1=\"Scaled\",D216>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D216=\"No\"),AND($L$1=\"Scaled\",D216<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.5, WP.1.A.6, WP.1.G.9, WP.1.I.4, WP.1.I.7",null,null,""]
[3513,"V.1.39.7","Is Scoped Data encrypted in the API request?",null,null,null,null,null,"10.1.1                                                     13.1.2","Policy On The Use Of Cryptographic Controls  Security of network services",3,null,1,39,7,0,0,0,{"$f":"IF(K217=\"\",\"\",IF(D217=\"\",0,IF(D217=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D217=\"Yes\"),AND($L$1=\"Scaled\",D217>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D217=\"No\"),AND($L$1=\"Scaled\",D217<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.5, WP.1.A.6, WP.1.G.9, WP.1.I.4, WP.1.I.7",null,null,""]
[3514,"V.1.39.8","Is there an option for the API request calls to be digitally signed?",null,null,null,null,null,"10.1.1                                                     13.1.2","Policy On The Use Of Cryptographic Controls  Security of network services",3,null,1,39,8,0,0,0,{"$f":"IF(K218=\"\",\"\",IF(D218=\"\",0,IF(D218=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D218=\"Yes\"),AND($L$1=\"Scaled\",D218>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D218=\"No\"),AND($L$1=\"Scaled\",D218<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.4, WP.1.I.7",null,null,""]
[3515,"V.1.39.9","Is there an option for the API response calls to be digitally signed?",null,null,null,null,null,"10.1.1                                                     13.1.2","Policy On The Use Of Cryptographic Controls  Security of network services",3,null,1,39,9,0,0,0,{"$f":"IF(K219=\"\",\"\",IF(D219=\"\",0,IF(D219=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D219=\"Yes\"),AND($L$1=\"Scaled\",D219>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D219=\"No\"),AND($L$1=\"Scaled\",D219<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.4, WP.1.I.7",null,null,""]
[3516,"V.1.40","Is there a client management portal which allows distributed business accounts (business units/departments) to be managed under a single central corporate account?",null,null,null,null,null,"15.2.1","Monitoring and review of supplier services",2,null,1,40,0,0,0,2,{"$f":"IF(K220=\"\",\"\",IF(D220=\"\",0,IF(D220=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D220=\"Yes\"),AND($L$1=\"Scaled\",D220>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D220=\"No\"),AND($L$1=\"Scaled\",D220<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.J.1, WP.1.J.7, WP.1.A.3, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.H.6, WP.1.H.10",null,null,""]
[3517,"V.1.41","Are background checks performed? If yes, are they for:",null,null,null,null,"E.3 Background Investigation Policy Content","7.1.1                                                        7.2.1","Screening                         Management responsibilities",2,null,1,41,0,0,0,0,{"$f":"IF(K221=\"\",\"\",IF(D221=\"\",0,IF(D221=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D221=\"Yes\"),AND($L$1=\"Scaled\",D221>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D221=\"No\"),AND($L$1=\"Scaled\",D221<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3518,"V.1.41.1","Cloud provider staff?",null,null,null,null,null,"7.1.1                                                        7.2.1","Screening                         Management responsibilities",3,null,1,41,1,0,0,0,{"$f":"IF(K222=\"\",\"\",IF(D222=\"\",0,IF(D222=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D222=\"Yes\"),AND($L$1=\"Scaled\",D222>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D222=\"No\"),AND($L$1=\"Scaled\",D222<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3519,"V.1.41.2","Cloud provider contractors?",null,null,null,null,null,"7.1.1                                                        7.2.1","Screening                         Management responsibilities",3,null,1,41,2,0,0,0,{"$f":"IF(K223=\"\",\"\",IF(D223=\"\",0,IF(D223=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D223=\"Yes\"),AND($L$1=\"Scaled\",D223>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D223=\"No\"),AND($L$1=\"Scaled\",D223<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3520,"V.1.41.3","Cloud provider subcontractor?",null,null,null,null,null,"7.1.1                                                        7.2.1","Screening                         Management responsibilities",3,null,1,41,3,0,0,0,{"$f":"IF(K224=\"\",\"\",IF(D224=\"\",0,IF(D224=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D224=\"Yes\"),AND($L$1=\"Scaled\",D224>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D224=\"No\"),AND($L$1=\"Scaled\",D224<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3521,"V.1.41.4","What is the default frequency of the background checks:",null,null,null,null,null,"7.1.1                                                        7.2.1","Screening                         Management responsibilities",3,1,1,41,4,0,0,0,{"$f":"IF(K225=\"\",\"\",IF(D225=\"\",0,IF(D225=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D225=\"Yes\"),AND($L$1=\"Scaled\",D225>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D225=\"No\"),AND($L$1=\"Scaled\",D225<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3522,"V.1.41.4.1","At time of hire?",null,null,null,null,null,"NA",null,4,null,1,41,4,1,0,0,{"$f":"IF(K226=\"\",\"\",IF(D226=\"\",0,IF(D226=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D226=\"Yes\"),AND($L$1=\"Scaled\",D226>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D226=\"No\"),AND($L$1=\"Scaled\",D226<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,1,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3523,"V.1.41.4.2","Quarterly?",null,null,null,null,null,"NA",null,4,null,1,41,4,2,0,0,{"$f":"IF(K227=\"\",\"\",IF(D227=\"\",0,IF(D227=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D227=\"Yes\"),AND($L$1=\"Scaled\",D227>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D227=\"No\"),AND($L$1=\"Scaled\",D227<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3524,"V.1.41.4.3","Semiannually?",null,null,null,null,null,"NA",null,4,null,1,41,4,3,0,0,{"$f":"IF(K228=\"\",\"\",IF(D228=\"\",0,IF(D228=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D228=\"Yes\"),AND($L$1=\"Scaled\",D228>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D228=\"No\"),AND($L$1=\"Scaled\",D228<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3525,"V.1.41.4.4","Annually?",null,null,null,null,null,"NA",null,4,null,1,41,4,4,0,0,{"$f":"IF(K229=\"\",\"\",IF(D229=\"\",0,IF(D229=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D229=\"Yes\"),AND($L$1=\"Scaled\",D229>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D229=\"No\"),AND($L$1=\"Scaled\",D229<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3526,"V.1.41.4.5","Other?",null,null,null,null,null,"NA",null,4,null,1,41,4,5,0,0,{"$f":"IF(K230=\"\",\"\",IF(D230=\"\",0,IF(D230=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D230=\"Yes\"),AND($L$1=\"Scaled\",D230>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D230=\"No\"),AND($L$1=\"Scaled\",D230<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3532,"V.1.41.5","Who performs background checks on direct contractors",null,null,null,null,null,"7.1.1                                                        7.2.1","Screening                         Management responsibilities",3,1,1,41,5,0,0,0,{"$f":"IF(K231=\"\",\"\",IF(D231=\"\",0,IF(D231=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D231=\"Yes\"),AND($L$1=\"Scaled\",D231>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D231=\"No\"),AND($L$1=\"Scaled\",D231<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3533,"V.1.41.5.1","Direct contracting firm?",null,null,null,null,null,"NA",null,4,null,1,41,5,1,0,0,{"$f":"IF(K232=\"\",\"\",IF(D232=\"\",0,IF(D232=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D232=\"Yes\"),AND($L$1=\"Scaled\",D232>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D232=\"No\"),AND($L$1=\"Scaled\",D232<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,1,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3534,"V.1.41.5.2","Subcontracting firm?",null,null,null,null,null,"NA",null,4,null,1,41,5,2,0,0,{"$f":"IF(K233=\"\",\"\",IF(D233=\"\",0,IF(D233=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D233=\"Yes\"),AND($L$1=\"Scaled\",D233>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D233=\"No\"),AND($L$1=\"Scaled\",D233<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,null,null,null,""]
[3535,"V.1.41.5.3","Cloud provider?",null,null,null,null,null,"NA",null,4,null,1,41,5,3,0,0,{"$f":"IF(K234=\"\",\"\",IF(D234=\"\",0,IF(D234=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D234=\"Yes\"),AND($L$1=\"Scaled\",D234>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D234=\"No\"),AND($L$1=\"Scaled\",D234<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3536,"V.1.41.5.4","Client?",null,null,null,null,null,"NA",null,4,null,1,41,5,4,0,0,{"$f":"IF(K235=\"\",\"\",IF(D235=\"\",0,IF(D235=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D235=\"Yes\"),AND($L$1=\"Scaled\",D235>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D235=\"No\"),AND($L$1=\"Scaled\",D235<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3537,"V.1.41.5.5","Other?",null,null,null,null,null,"NA",null,4,null,1,41,5,5,0,0,{"$f":"IF(K236=\"\",\"\",IF(D236=\"\",0,IF(D236=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D236=\"Yes\"),AND($L$1=\"Scaled\",D236>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D236=\"No\"),AND($L$1=\"Scaled\",D236<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3538,"V.1.42","Is two factor authentication required to access the production cloud environment containing Scoped Data?  If yes, does it include:",null,null,null,null,"I.6 Application Security Vulnerability Assessment and Remediation","9.3.1","Use of secret authentication information",2,null,1,42,0,0,0,2,{"$f":"IF(K237=\"\",\"\",IF(D237=\"\",0,IF(D237=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D237=\"Yes\"),AND($L$1=\"Scaled\",D237>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D237=\"No\"),AND($L$1=\"Scaled\",D237<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.H.6, WP.1.I.4, WP.1.I.7",null,null,""]
[3539,"V.1.42.1","Admin access (shell or UI): Internally from within cloud provider network?",null,null,null,null,null,"9.4.1","Information access restriction",3,null,1,42,1,0,0,0,{"$f":"IF(K238=\"\",\"\",IF(D238=\"\",0,IF(D238=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D238=\"Yes\"),AND($L$1=\"Scaled\",D238>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D238=\"No\"),AND($L$1=\"Scaled\",D238<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.H.6, WP.1.I.4, WP.1.I.7",null,null,""]
[3540,"V.1.42.2","Non-admin access (shell or UI): Internally from within cloud provider network?",null,null,null,null,null,"9.4.1","Information access restriction",3,null,1,42,2,0,0,0,{"$f":"IF(K239=\"\",\"\",IF(D239=\"\",0,IF(D239=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D239=\"Yes\"),AND($L$1=\"Scaled\",D239>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D239=\"No\"),AND($L$1=\"Scaled\",D239<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.H.6, WP.1.I.4, WP.1.I.7",null,null,""]
[3541,"V.1.42.3","Admin access (shell or UI): remote access?",null,null,null,null,null,"9.4.1","Information access restriction",3,null,1,42,3,0,0,0,{"$f":"IF(K240=\"\",\"\",IF(D240=\"\",0,IF(D240=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D240=\"Yes\"),AND($L$1=\"Scaled\",D240>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D240=\"No\"),AND($L$1=\"Scaled\",D240<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.H.6, WP.1.I.4, WP.1.I.7",null,null,""]
[3542,"V.1.42.4","Non-admin access (shell or UI): remote access?",null,null,null,null,null,"9.4.1","Information access restriction",3,null,1,42,4,0,0,0,{"$f":"IF(K241=\"\",\"\",IF(D241=\"\",0,IF(D241=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D241=\"Yes\"),AND($L$1=\"Scaled\",D241>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D241=\"No\"),AND($L$1=\"Scaled\",D241<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.H.6, WP.1.I.4, WP.1.I.7",null,null,""]
[3543,"V.1.43","Are staff able to access client Scoped Data? If not, which of the following controls are used to prevent this:",null,null,null,null,"H.3 Logical Access Authorization","9.2.3\n9.4.1","Management of privileged access rights                                Information access restriction",2,null,1,43,0,0,0,0,{"$f":"IF(K242=\"\",\"\",IF(D242=\"\",0,IF(D242=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D242=\"Yes\"),AND($L$1=\"Scaled\",D242>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D242=\"No\"),AND($L$1=\"Scaled\",D242<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3544,"V.1.43.1","Preventative controls (e.g., technical)?",null,null,null,null,null,"9.2.3\n9.4.2","Management of privileged access rights                                Information access restriction",3,null,1,43,1,0,0,0,{"$f":"IF(K243=\"\",\"\",IF(D243=\"\",0,IF(D243=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D243=\"Yes\"),AND($L$1=\"Scaled\",D243>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D243=\"No\"),AND($L$1=\"Scaled\",D243<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3545,"V.1.43.2","Detective controls?",null,null,null,null,null,"9.2.3\n9.4.3","Management of privileged access rights                                Information access restriction",3,null,1,43,2,0,0,0,{"$f":"IF(K244=\"\",\"\",IF(D244=\"\",0,IF(D244=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D244=\"Yes\"),AND($L$1=\"Scaled\",D244>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D244=\"No\"),AND($L$1=\"Scaled\",D244<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3546,"V.1.43.3","Corrective controls?",null,null,null,null,null,"9.2.3\n9.4.4","Management of privileged access rights                                Information access restriction",3,null,1,43,3,0,0,0,{"$f":"IF(K245=\"\",\"\",IF(D245=\"\",0,IF(D245=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D245=\"Yes\"),AND($L$1=\"Scaled\",D245>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D245=\"No\"),AND($L$1=\"Scaled\",D245<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3547,"V.1.43.4","Policy controls?",null,null,null,null,null,"9.2.3\n9.4.5","Management of privileged access rights                                Information access restriction",3,null,1,43,4,0,0,0,{"$f":"IF(K246=\"\",\"\",IF(D246=\"\",0,IF(D246=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D246=\"Yes\"),AND($L$1=\"Scaled\",D246>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D246=\"No\"),AND($L$1=\"Scaled\",D246<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3548,"V.1.44","Are staff able to access client Scoped Data in an unencrypted state?",null,null,null,null,"H.3 Logical Access Authorization","9.2.3\n9.4.6","Management of privileged access rights                                Information access restriction",2,null,1,44,0,0,0,2,{"$f":"IF(K247=\"\",\"\",IF(D247=\"\",0,IF(D247=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D247=\"Yes\"),AND($L$1=\"Scaled\",D247>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D247=\"No\"),AND($L$1=\"Scaled\",D247<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3549,"V.1.45","Are staff able to access client's encryption key? If not, which of the following controls are used to prevent this:",null,null,null,null,"H.3 Logical Access Authorization","9.2.3\n9.4.7","Management of privileged access rights                                Information access restriction",2,null,1,45,0,0,0,2,{"$f":"IF(K248=\"\",\"\",IF(D248=\"\",0,IF(D248=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D248=\"Yes\"),AND($L$1=\"Scaled\",D248>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D248=\"No\"),AND($L$1=\"Scaled\",D248<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3550,"V.1.45.1","Preventative controls (e.g., technical)?",null,null,null,null,null,"NA",null,3,null,1,45,1,0,0,0,{"$f":"IF(K249=\"\",\"\",IF(D249=\"\",0,IF(D249=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D249=\"Yes\"),AND($L$1=\"Scaled\",D249>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D249=\"No\"),AND($L$1=\"Scaled\",D249<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3551,"V.1.45.2","Detective controls?",null,null,null,null,null,"NA",null,3,null,1,45,2,0,0,0,{"$f":"IF(K250=\"\",\"\",IF(D250=\"\",0,IF(D250=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D250=\"Yes\"),AND($L$1=\"Scaled\",D250>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D250=\"No\"),AND($L$1=\"Scaled\",D250<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3552,"V.1.45.3","Corrective controls?",null,null,null,null,null,"NA",null,3,null,1,45,3,0,0,0,{"$f":"IF(K251=\"\",\"\",IF(D251=\"\",0,IF(D251=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D251=\"Yes\"),AND($L$1=\"Scaled\",D251>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D251=\"No\"),AND($L$1=\"Scaled\",D251<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3553,"V.1.45.4","Policy controls?",null,null,null,null,null,"NA",null,3,null,1,45,4,0,0,0,{"$f":"IF(K252=\"\",\"\",IF(D252=\"\",0,IF(D252=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D252=\"Yes\"),AND($L$1=\"Scaled\",D252>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D252=\"No\"),AND($L$1=\"Scaled\",D252<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3554,"V.1.46","Is there a process which allows the client to specifically list who from the cloud provider will have access to their Scoped Systems and Data? If yes, does this include:",null,null,null,null,"H.3 Logical Access Authorization","9.1.1                                                        9.2.3","\tAccess Control Policy\nManagement of privileged access rights",2,null,1,46,0,0,0,2,{"$f":"IF(K253=\"\",\"\",IF(D253=\"\",0,IF(D253=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D253=\"Yes\"),AND($L$1=\"Scaled\",D253>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D253=\"No\"),AND($L$1=\"Scaled\",D253<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3555,"V.1.46.1","Role based access groups?",null,null,null,null,null,"NA",null,3,null,1,46,1,0,0,0,{"$f":"IF(K254=\"\",\"\",IF(D254=\"\",0,IF(D254=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D254=\"Yes\"),AND($L$1=\"Scaled\",D254>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D254=\"No\"),AND($L$1=\"Scaled\",D254<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3556,"V.1.46.2","Written approval from client?",null,null,null,null,null,"NA",null,3,null,1,46,2,0,0,0,{"$f":"IF(K255=\"\",\"\",IF(D255=\"\",0,IF(D255=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D255=\"Yes\"),AND($L$1=\"Scaled\",D255>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D255=\"No\"),AND($L$1=\"Scaled\",D255<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3557,"V.1.46.3","Other?",null,null,null,null,null,"NA",null,3,null,1,46,3,0,0,0,{"$f":"IF(K256=\"\",\"\",IF(D256=\"\",0,IF(D256=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D256=\"Yes\"),AND($L$1=\"Scaled\",D256>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D256=\"No\"),AND($L$1=\"Scaled\",D256<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3558,"V.1.47","Are staff technically prevented from accessing the cloud environment via non-managed private devices? If yes, is it from:",null,null,null,null,"H.3 Logical Access Authorization","9.1.1                                                        9.1.2                                                                               9.2.1                                                  9.2.3 ","Access control policy,                            Access to networks and network services,                          User registration and de-registration,                           Management of privileged access rights",2,null,1,47,0,0,0,2,{"$f":"IF(K257=\"\",\"\",IF(D257=\"\",0,IF(D257=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D257=\"Yes\"),AND($L$1=\"Scaled\",D257>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D257=\"No\"),AND($L$1=\"Scaled\",D257<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.E.2, WP.1.H.6",null,null,""]
[3559,"V.1.47.1","Admin access (shell or UI): Internally from within cloud provider network?",null,null,null,null,null,"NA",null,3,null,1,47,1,0,0,0,{"$f":"IF(K258=\"\",\"\",IF(D258=\"\",0,IF(D258=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D258=\"Yes\"),AND($L$1=\"Scaled\",D258>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D258=\"No\"),AND($L$1=\"Scaled\",D258<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.E.2, WP.1.H.6",null,null,""]
[3560,"V.1.47.2","Non-Admin access (shell or UI): Internally from within cloud provider network?",null,null,null,null,null,"NA",null,3,null,1,47,2,0,0,0,{"$f":"IF(K259=\"\",\"\",IF(D259=\"\",0,IF(D259=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D259=\"Yes\"),AND($L$1=\"Scaled\",D259>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D259=\"No\"),AND($L$1=\"Scaled\",D259<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.E.2, WP.1.H.6",null,null,""]
[3561,"V.1.47.3","Admin access (shell or UI): Remote access?",null,null,null,null,null,"NA",null,3,null,1,47,3,0,0,0,{"$f":"IF(K260=\"\",\"\",IF(D260=\"\",0,IF(D260=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D260=\"Yes\"),AND($L$1=\"Scaled\",D260>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D260=\"No\"),AND($L$1=\"Scaled\",D260<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.E.2, WP.1.H.6",null,null,""]
[3562,"V.1.47.4","Non-admin access (shell or UI): remote access?",null,null,null,null,null,"NA",null,3,null,1,47,4,0,0,0,{"$f":"IF(K261=\"\",\"\",IF(D261=\"\",0,IF(D261=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D261=\"Yes\"),AND($L$1=\"Scaled\",D261>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D261=\"No\"),AND($L$1=\"Scaled\",D261<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.E.2, WP.1.H.6",null,null,""]
[3563,{"$f":"IF(K262=0,\"\",IF(K262=1,R$1&\".\"&M262,IF(K262=2,R$1&\".\"&M262&\".\"&N262,IF(K262=3,R$1&\".\"&M262&\".\"&N262&\".\"&O262,IF(K262=4,R$1&\".\"&M262&\".\"&N262&\".\"&O262&\".\"&P262,IF(K262=5,R$1&\".\"&M262&\".\"&N262&\".\"&O262&\".\"&P262&\".\"&Q262))))))","v":"V.1.48"},"Are there controls to prevent one client attempting to compromise another client in a resource pooled environment? If yes, does that include:",null,null,null,null,"H.3 Logical Access Authorization","12.4.1                                                      15.2.1","Event Logging,\nMonitoring and review of supplier services",2,null,{"$f":"IF(M261=\"\",1,IF(K262=1,M261+1,M261))","v":1},{"$f":"IF(N261=\"\",0,IF(M261<>M262,0,IF($K262=2,N261+1,N261)))","v":48},{"$f":"IF(O261=\"\",0,IF(N261<>N262,0,IF($K262=3,O261+1,O261)))","v":0},{"$f":"IF(P261=\"\",0,IF(O261<>O262,0,IF($K262=4,P261+1,P261)))","v":0},{"$f":"IF(Q261=\"\",0,IF(P261<>P262,0,IF($K262=5,Q261+1,Q261)))","v":0},{"$f":"IF(OR(Master=\"Master\",K262=0,L262=1),0,IF(ISNA(VLOOKUP(A262,L2_Array,21,FALSE)),0,VLOOKUP(A262,L2_Array,21,FALSE)))","v":2},{"$f":"IF(K262=\"\",\"\",IF(D262=\"\",0,IF(D262=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D262=\"Yes\"),AND($L$1=\"Scaled\",D262>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D262=\"No\"),AND($L$1=\"Scaled\",D262<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(K262=\"\",\"\",IF(R262>0,R262,IF(S262>0,S262,0)))","v":2},{"$f":"IF(OR(K262=\"\",K262=0),\"\",IF(OR(K262=1,U261=\"\"),1,IF(OR(AND(L261=1,(K262-K260<>0)),AND(U261=0,K261=K262),AND(L261=1,K262=K260)),0,1)))","v":1},{"$f":"IF(K262=\"\",V261,IF(AND(T262>1,OR(V261=\"\",V261=0,V261>=K262)),K262,IF(K262>V261,V261,0)))","v":1},{"$f":"IF(Master=\"Master\",S262,IF(W261=\"\",T262,IF(OR(AND(V262>0,T262<W261),AND(V262=1,T262<=W261)),W261,T262)))","v":2},{"$f":"IF(K262=\"\",\"\",IF(OR(AND(U261=1,V262=1),T262>0,AND(U263=0,X263=1)),1,0))","v":1},{"$f":"IF(K262=\"\",\"\",IF(OR(AND(V262>0,U262=1),AND(U262=1,X262=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A262,L2_Array,1,FALSE)),0,1)","v":1},"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2",null,null,{"$f":"IF(AND(K262=1,T262=1),2,IF(AND(W261=1,M262=M261),2,IF(AND(AD261=2,M262=M261),2,IF(K262=1,1,\"\"))))","v":""}]
[3564,"V.1.48.1","Inbound/Outbound firewall?",null,null,null,null,null,"12.4.1                                                      15.2.1","Event Logging,\nMonitoring and review of supplier services",3,null,1,48,1,0,0,0,{"$f":"IF(K263=\"\",\"\",IF(D263=\"\",0,IF(D263=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D263=\"Yes\"),AND($L$1=\"Scaled\",D263>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D263=\"No\"),AND($L$1=\"Scaled\",D263<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2",null,null,""]
[3565,"V.1.48.2","IPS?",null,null,null,null,null,"12.4.1                                                      15.2.1","Event Logging,\nMonitoring and review of supplier services",3,null,1,48,2,0,0,0,{"$f":"IF(K264=\"\",\"\",IF(D264=\"\",0,IF(D264=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D264=\"Yes\"),AND($L$1=\"Scaled\",D264>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D264=\"No\"),AND($L$1=\"Scaled\",D264<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2",null,null,""]
[3566,"V.1.48.3","Real-time alerting?",null,null,null,null,null,"12.4.1                                                      15.2.1","Event Logging,\nMonitoring and review of supplier services",3,null,1,48,3,0,0,0,{"$f":"IF(K265=\"\",\"\",IF(D265=\"\",0,IF(D265=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D265=\"Yes\"),AND($L$1=\"Scaled\",D265>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D265=\"No\"),AND($L$1=\"Scaled\",D265<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2",null,null,""]
[3567,"V.1.48.4","Real-time monitoring by cloud provider?",null,null,null,null,null,"12.4.1                                                      15.2.1","Event Logging,\nMonitoring and review of supplier services",3,null,1,48,4,0,0,0,{"$f":"IF(K266=\"\",\"\",IF(D266=\"\",0,IF(D266=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D266=\"Yes\"),AND($L$1=\"Scaled\",D266>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D266=\"No\"),AND($L$1=\"Scaled\",D266<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2",null,null,""]
[3568,"V.1.49","Is a default hardened base virtual image available to clients? If yes, does it include:",null,null,null,null,"I.3 Secure System Hardening Standards","NA",null,2,null,1,49,0,0,0,2,{"$f":"IF(K267=\"\",\"\",IF(D267=\"\",0,IF(D267=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D267=\"Yes\"),AND($L$1=\"Scaled\",D267>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D267=\"No\"),AND($L$1=\"Scaled\",D267<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3569,"V.1.49.1","Cloud providers default hardened Image?",null,null,null,null,null,"NA",null,3,null,1,49,1,0,0,0,{"$f":"IF(K268=\"\",\"\",IF(D268=\"\",0,IF(D268=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D268=\"Yes\"),AND($L$1=\"Scaled\",D268>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D268=\"No\"),AND($L$1=\"Scaled\",D268<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3570,"V.1.49.2","Client supplied default hardening Image?",null,null,null,null,null,"NA",null,3,null,1,49,2,0,0,0,{"$f":"IF(K269=\"\",\"\",IF(D269=\"\",0,IF(D269=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D269=\"Yes\"),AND($L$1=\"Scaled\",D269>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D269=\"No\"),AND($L$1=\"Scaled\",D269<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3571,"V.1.49.3","Center for Internet Security (CIS) hardening standard?",null,null,null,null,null,"NA",null,3,null,1,49,3,0,0,0,{"$f":"IF(K270=\"\",\"\",IF(D270=\"\",0,IF(D270=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D270=\"Yes\"),AND($L$1=\"Scaled\",D270>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D270=\"No\"),AND($L$1=\"Scaled\",D270<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3572,"V.1.49.4","National Institute of Standards and Technology (NIST) hardening standard?",null,null,null,null,null,"NA",null,3,null,1,49,4,0,0,0,{"$f":"IF(K271=\"\",\"\",IF(D271=\"\",0,IF(D271=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D271=\"Yes\"),AND($L$1=\"Scaled\",D271>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D271=\"No\"),AND($L$1=\"Scaled\",D271<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3573,"V.1.49.5","SANS hardening standard?",null,null,null,null,null,"NA",null,3,null,1,49,5,0,0,0,{"$f":"IF(K272=\"\",\"\",IF(D272=\"\",0,IF(D272=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D272=\"Yes\"),AND($L$1=\"Scaled\",D272>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D272=\"No\"),AND($L$1=\"Scaled\",D272<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3574,"V.1.49.6","Vendor hardening standard?",null,null,null,null,null,"NA",null,3,null,1,49,6,0,0,0,{"$f":"IF(K273=\"\",\"\",IF(D273=\"\",0,IF(D273=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D273=\"Yes\"),AND($L$1=\"Scaled\",D273>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D273=\"No\"),AND($L$1=\"Scaled\",D273<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3575,"V.1.49.7","Other?",null,null,null,null,null,"NA",null,3,null,1,49,7,0,0,0,{"$f":"IF(K274=\"\",\"\",IF(D274=\"\",0,IF(D274=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D274=\"Yes\"),AND($L$1=\"Scaled\",D274>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D274=\"No\"),AND($L$1=\"Scaled\",D274<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3576,"V.1.50","Are systems and applications patched? If yes, how:",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.6.1 ","Management of technical vulnerabilities",2,null,1,50,0,0,0,0,{"$f":"IF(K275=\"\",\"\",IF(D275=\"\",0,IF(D275=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D275=\"Yes\"),AND($L$1=\"Scaled\",D275>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D275=\"No\"),AND($L$1=\"Scaled\",D275<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3577,"V.1.50.1","Cloud provider: deploy to the live server?",null,null,null,null,null,"NA",null,3,null,1,50,1,0,0,0,{"$f":"IF(K276=\"\",\"\",IF(D276=\"\",0,IF(D276=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D276=\"Yes\"),AND($L$1=\"Scaled\",D276>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D276=\"No\"),AND($L$1=\"Scaled\",D276<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.C.2, WP.1.C.3, WP.1.C.4, WP.1.F.4, WP.1.I.4, WP.1.I.6, WP.1.J.5",null,null,""]
[3578,"V.1.50.2","Client: deploy to the live server?",null,null,null,null,null,"NA",null,3,null,1,50,2,0,0,0,{"$f":"IF(K277=\"\",\"\",IF(D277=\"\",0,IF(D277=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D277=\"Yes\"),AND($L$1=\"Scaled\",D277>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D277=\"No\"),AND($L$1=\"Scaled\",D277<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.C.2, WP.1.C.3, WP.1.C.4, WP.1.F.4, WP.1.I.4, WP.1.I.6, WP.1.J.5",null,null,""]
[3579,"V.1.50.3","Cloud provider: deploy to the base image?",null,null,null,null,null,"NA",null,3,null,1,50,3,0,0,0,{"$f":"IF(K278=\"\",\"\",IF(D278=\"\",0,IF(D278=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D278=\"Yes\"),AND($L$1=\"Scaled\",D278>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D278=\"No\"),AND($L$1=\"Scaled\",D278<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.C.2, WP.1.C.3, WP.1.C.4, WP.1.F.4, WP.1.I.4, WP.1.I.6, WP.1.J.5",null,null,""]
[3580,"V.1.50.4","Client: deploy to the base image?",null,null,null,null,null,"NA",null,3,null,1,50,4,0,0,0,{"$f":"IF(K279=\"\",\"\",IF(D279=\"\",0,IF(D279=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D279=\"Yes\"),AND($L$1=\"Scaled\",D279>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D279=\"No\"),AND($L$1=\"Scaled\",D279<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.C.2, WP.1.C.3, WP.1.C.4, WP.1.F.4, WP.1.I.4, WP.1.I.6, WP.1.J.5",null,null,""]
[3581,"V.1.50.5","Other?",null,null,null,null,null,"NA",null,3,null,1,50,5,0,0,0,{"$f":"IF(K280=\"\",\"\",IF(D280=\"\",0,IF(D280=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D280=\"Yes\"),AND($L$1=\"Scaled\",D280>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D280=\"No\"),AND($L$1=\"Scaled\",D280<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.C.2, WP.1.C.3, WP.1.C.4, WP.1.F.4, WP.1.I.4, WP.1.I.6, WP.1.J.5",null,null,""]
[3582,"V.1.51","Which of the following are responsible for the base image and patching:",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.6.1 ","Management of technical vulnerabilities",2,1,1,51,0,0,0,0,{"$f":"IF(K281=\"\",\"\",IF(D281=\"\",0,IF(D281=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D281=\"Yes\"),AND($L$1=\"Scaled\",D281>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D281=\"No\"),AND($L$1=\"Scaled\",D281<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3583,"V.1.51.1","Cloud provider: initial base image hardening and patching?",null,null,null,null,null,"NA",null,3,null,1,51,1,0,0,0,{"$f":"IF(K282=\"\",\"\",IF(D282=\"\",0,IF(D282=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D282=\"Yes\"),AND($L$1=\"Scaled\",D282>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D282=\"No\"),AND($L$1=\"Scaled\",D282<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,1,0,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3584,"V.1.51.2","Client: Initial base image hardening and patching?",null,null,null,null,null,"NA",null,3,null,1,51,2,0,0,0,{"$f":"IF(K283=\"\",\"\",IF(D283=\"\",0,IF(D283=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D283=\"Yes\"),AND($L$1=\"Scaled\",D283>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D283=\"No\"),AND($L$1=\"Scaled\",D283<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3585,"V.1.51.3","Cloud provider: ongoing hardening and patching?",null,null,null,null,null,"NA",null,3,null,1,51,3,0,0,0,{"$f":"IF(K284=\"\",\"\",IF(D284=\"\",0,IF(D284=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D284=\"Yes\"),AND($L$1=\"Scaled\",D284>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D284=\"No\"),AND($L$1=\"Scaled\",D284<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3586,"V.1.51.4","Client: ongoing hardening and patching?",null,null,null,null,null,"NA",null,3,null,1,51,4,0,0,0,{"$f":"IF(K285=\"\",\"\",IF(D285=\"\",0,IF(D285=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D285=\"Yes\"),AND($L$1=\"Scaled\",D285>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D285=\"No\"),AND($L$1=\"Scaled\",D285<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3587,"V.1.52","Can image versions be electronically signed to insure integrity? If yes, who would perform:",null,null,null,null,null,"14.2.2                                                     14.2.4","System change control procedures,                                Restrictions on changes to software packages",2,null,1,52,0,0,0,0,{"$f":"IF(K286=\"\",\"\",IF(D286=\"\",0,IF(D286=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D286=\"Yes\"),AND($L$1=\"Scaled\",D286>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D286=\"No\"),AND($L$1=\"Scaled\",D286<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,0,1,0,"WP.1.D.1, WP.1.D.2, WP.1.D.3, WP.1.J.4, WP.1.J.5, WP.1.F4",null,null,""]
[3588,"V.1.52.1","Cloud provider?",null,null,null,null,null,"NA",null,3,null,1,52,1,0,0,0,{"$f":"IF(K287=\"\",\"\",IF(D287=\"\",0,IF(D287=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D287=\"Yes\"),AND($L$1=\"Scaled\",D287>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D287=\"No\"),AND($L$1=\"Scaled\",D287<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.D.1, WP.1.D.2, WP.1.D.3, WP.1.J.4, WP.1.J.5, WP.1.F4",null,null,""]
[3589,"V.1.52.2","Client?",null,null,null,null,null,"NA",null,3,null,1,52,2,0,0,0,{"$f":"IF(K288=\"\",\"\",IF(D288=\"\",0,IF(D288=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D288=\"Yes\"),AND($L$1=\"Scaled\",D288>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D288=\"No\"),AND($L$1=\"Scaled\",D288<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.D.1, WP.1.D.2, WP.1.D.3, WP.1.J.4, WP.1.J.5, WP.1.F4",null,null,""]
[3590,"V.1.53","Can clients run their own security services within their own cloud environment? If yes, can it include:",null,null,null,null,"V.3 Cloud Audit Program","12.4.1                                                     12.4.3                                                 12.5                                                12.6.1 ","Event logging,                           Administrator and operator logs,                                     Control of operational software,                   Management of technical vulnerabilities",2,null,1,53,0,0,0,2,{"$f":"IF(K289=\"\",\"\",IF(D289=\"\",0,IF(D289=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D289=\"Yes\"),AND($L$1=\"Scaled\",D289>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D289=\"No\"),AND($L$1=\"Scaled\",D289<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6",null,null,""]
[3591,"V.1.53.1","Firewall?",null,null,null,null,null,"NA",null,3,null,1,53,1,0,0,0,{"$f":"IF(K290=\"\",\"\",IF(D290=\"\",0,IF(D290=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D290=\"Yes\"),AND($L$1=\"Scaled\",D290>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D290=\"No\"),AND($L$1=\"Scaled\",D290<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6",null,null,""]
[3592,"V.1.53.2","IDS/IPS?",null,null,null,null,null,"NA",null,3,null,1,53,2,0,0,0,{"$f":"IF(K291=\"\",\"\",IF(D291=\"\",0,IF(D291=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D291=\"Yes\"),AND($L$1=\"Scaled\",D291>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D291=\"No\"),AND($L$1=\"Scaled\",D291<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6",null,null,""]
[3593,"V.1.53.3","Data integrity monitoring (host based Integrity)?",null,null,null,null,null,"NA",null,3,null,1,53,3,0,0,0,{"$f":"IF(K292=\"\",\"\",IF(D292=\"\",0,IF(D292=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D292=\"Yes\"),AND($L$1=\"Scaled\",D292>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D292=\"No\"),AND($L$1=\"Scaled\",D292<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6",null,null,""]
[3594,"V.1.53.4","Anti virus?",null,null,null,null,null,"NA",null,3,null,1,53,4,0,0,0,{"$f":"IF(K293=\"\",\"\",IF(D293=\"\",0,IF(D293=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D293=\"Yes\"),AND($L$1=\"Scaled\",D293>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D293=\"No\"),AND($L$1=\"Scaled\",D293<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6",null,null,""]
[3595,"V.1.53.5","Other (please specify)?",null,null,null,null,null,"NA",null,3,null,1,53,5,0,0,0,{"$f":"IF(K294=\"\",\"\",IF(D294=\"\",0,IF(D294=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D294=\"Yes\"),AND($L$1=\"Scaled\",D294>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D294=\"No\"),AND($L$1=\"Scaled\",D294<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6",null,null,""]
[3596,"V.1.54","Is 24x7x365 security monitoring performed? If yes, does it include:",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.4.1                                                     12.4.3                                                 12.5                                                12.6.1 ","Event logging,                           Administrator and operator logs,                                     Control of operational software,                   Management of technical vulnerabilities",2,null,1,54,0,0,0,0,{"$f":"IF(K295=\"\",\"\",IF(D295=\"\",0,IF(D295=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D295=\"Yes\"),AND($L$1=\"Scaled\",D295>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D295=\"No\"),AND($L$1=\"Scaled\",D295<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.2",null,null,""]
[3597,"V.1.54.1","Inbound: Internet to cloud platform (client)?",null,null,null,null,null,"NA",null,3,null,1,54,1,0,0,0,{"$f":"IF(K296=\"\",\"\",IF(D296=\"\",0,IF(D296=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D296=\"Yes\"),AND($L$1=\"Scaled\",D296>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D296=\"No\"),AND($L$1=\"Scaled\",D296<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.2",null,null,""]
[3598,"V.1.54.2","Outbound: Cloud platform (client) to internet?",null,null,null,null,null,"NA",null,3,null,1,54,2,0,0,0,{"$f":"IF(K297=\"\",\"\",IF(D297=\"\",0,IF(D297=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D297=\"Yes\"),AND($L$1=\"Scaled\",D297>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D297=\"No\"),AND($L$1=\"Scaled\",D297<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.2",null,null,""]
[3599,"V.1.54.3","Internal: Cloud staff environment to cloud platform (client)?",null,null,null,null,null,"NA",null,3,null,1,54,3,0,0,0,{"$f":"IF(K298=\"\",\"\",IF(D298=\"\",0,IF(D298=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D298=\"Yes\"),AND($L$1=\"Scaled\",D298>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D298=\"No\"),AND($L$1=\"Scaled\",D298<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.2",null,null,""]
[3600,"V.1.54.4","Internal: Cloud platform (client) to cloud staff environment?",null,null,null,null,null,"NA",null,3,null,1,54,4,0,0,0,{"$f":"IF(K299=\"\",\"\",IF(D299=\"\",0,IF(D299=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D299=\"Yes\"),AND($L$1=\"Scaled\",D299>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D299=\"No\"),AND($L$1=\"Scaled\",D299<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.2",null,null,""]
[3601,"V.1.54.5","Internal: Cloud platform (client) to cloud platform (client)?",null,null,null,null,null,"NA",null,3,null,1,54,5,0,0,0,{"$f":"IF(K300=\"\",\"\",IF(D300=\"\",0,IF(D300=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D300=\"Yes\"),AND($L$1=\"Scaled\",D300>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D300=\"No\"),AND($L$1=\"Scaled\",D300<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.2",null,null,""]
[3602,"V.1.55","Is there a specific Recovery Time Objective (RTO)? If yes, specify.",null,null,null,null,null,"17.1.2","Implementing information security continuity",2,null,1,55,0,0,0,2,{"$f":"IF(K301=\"\",\"\",IF(D301=\"\",0,IF(D301=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D301=\"Yes\"),AND($L$1=\"Scaled\",D301>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D301=\"No\"),AND($L$1=\"Scaled\",D301<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.K.10",null,null,""]
[3603,"V.1.56","Is there a specific Recovery Point Objective (RPO)? If yes, specify.",null,null,null,null,null,"17.1.2","Implementing information security continuity",2,null,1,56,0,0,0,0,{"$f":"IF(K302=\"\",\"\",IF(D302=\"\",0,IF(D302=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D302=\"Yes\"),AND($L$1=\"Scaled\",D302>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D302=\"No\"),AND($L$1=\"Scaled\",D302<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.11",null,null,""]
[3604,"V.1.57","Are any critical vendors necessary to provide the scoped services to clients?",null,null,null,null,"V.2 Nested Service Provider Relationships","17.1.2                                                     17.2.1","Implementing information security continuity,             Availability of information processing facilities",2,null,1,57,0,0,0,0,{"$f":"IF(K303=\"\",\"\",IF(D303=\"\",0,IF(D303=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D303=\"Yes\"),AND($L$1=\"Scaled\",D303>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D303=\"No\"),AND($L$1=\"Scaled\",D303<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3605,"V.1.57.1","Is a critical vendor dependency chart made available to clients?",null,null,null,null,"V.2 Nested Service Provider Relationships","17.1.2                                                     17.2.1","Implementing information security continuity,             Availability of information processing facilities",3,null,1,57,1,0,0,0,{"$f":"IF(K304=\"\",\"\",IF(D304=\"\",0,IF(D304=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D304=\"Yes\"),AND($L$1=\"Scaled\",D304>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D304=\"No\"),AND($L$1=\"Scaled\",D304<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.7",null,null,""]
[3606,"V.1.57.2","Are each of the vendors identified in the vendor dependency chart subjected to at least an annual disaster recovery test for service provided? If yes, is the test:",null,null,null,null,"V.2 Nested Service Provider Relationships","17.1.2                                                     17.2.1","Implementing information security continuity,             Availability of information processing facilities",3,null,1,57,2,0,0,0,{"$f":"IF(K305=\"\",\"\",IF(D305=\"\",0,IF(D305=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D305=\"Yes\"),AND($L$1=\"Scaled\",D305>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D305=\"No\"),AND($L$1=\"Scaled\",D305<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.11",null,null,""]
[3607,"V.1.57.2.1","Table top?",null,null,null,null,null,"NA",null,4,null,1,57,2,1,0,0,{"$f":"IF(K306=\"\",\"\",IF(D306=\"\",0,IF(D306=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D306=\"Yes\"),AND($L$1=\"Scaled\",D306>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D306=\"No\"),AND($L$1=\"Scaled\",D306<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.11",null,null,""]
[3608,"V.1.57.2.2","Simulated test?",null,null,null,null,null,"NA",null,4,null,1,57,2,2,0,0,{"$f":"IF(K307=\"\",\"\",IF(D307=\"\",0,IF(D307=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D307=\"Yes\"),AND($L$1=\"Scaled\",D307>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D307=\"No\"),AND($L$1=\"Scaled\",D307<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.11",null,null,""]
[3609,"V.1.57.2.3","Functional test?",null,null,null,null,null,"NA",null,4,null,1,57,2,3,0,0,{"$f":"IF(K308=\"\",\"\",IF(D308=\"\",0,IF(D308=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D308=\"Yes\"),AND($L$1=\"Scaled\",D308>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D308=\"No\"),AND($L$1=\"Scaled\",D308<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.11",null,null,""]
[3610,"V.1.57.2.4","Full scale failover?",null,null,null,null,null,"NA",null,4,null,1,57,2,4,0,0,{"$f":"IF(K309=\"\",\"\",IF(D309=\"\",0,IF(D309=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D309=\"Yes\"),AND($L$1=\"Scaled\",D309>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D309=\"No\"),AND($L$1=\"Scaled\",D309<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.11",null,null,""]
[3611,"V.1.58","How many different critical vendors is the live cloud platform running on at any given time:",null,null,null,null,"V.2 Nested Service Provider Relationships","17.1.3","Verify, review and evaluate information security continuity",2,1,1,58,0,0,0,0,{"$f":"IF(K310=\"\",\"\",IF(D310=\"\",0,IF(D310=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D310=\"Yes\"),AND($L$1=\"Scaled\",D310>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D310=\"No\"),AND($L$1=\"Scaled\",D310<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.11",null,null,""]
[3612,"V.1.58.1","1?",null,null,null,null,null,"NA",null,3,null,1,58,1,0,0,0,{"$f":"IF(K311=\"\",\"\",IF(D311=\"\",0,IF(D311=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D311=\"Yes\"),AND($L$1=\"Scaled\",D311>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D311=\"No\"),AND($L$1=\"Scaled\",D311<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,1,0,0,"WP.1.K.11",null,null,""]
[3613,"V.1.58.2",">1 <2?",null,null,null,null,null,"NA",null,3,null,1,58,2,0,0,0,{"$f":"IF(K312=\"\",\"\",IF(D312=\"\",0,IF(D312=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D312=\"Yes\"),AND($L$1=\"Scaled\",D312>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D312=\"No\"),AND($L$1=\"Scaled\",D312<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.K.11",null,null,""]
[3614,"V.1.58.3","> 2?",null,null,null,null,null,"NA",null,3,null,1,58,3,0,0,0,{"$f":"IF(K313=\"\",\"\",IF(D313=\"\",0,IF(D313=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D313=\"Yes\"),AND($L$1=\"Scaled\",D313>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D313=\"No\"),AND($L$1=\"Scaled\",D313<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.K.11",null,null,""]
[3615,"V.1.59","How many separate data center(s) is the live cloud platform running in at any one time:",null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,1,1,59,0,0,0,0,{"$f":"IF(K314=\"\",\"\",IF(D314=\"\",0,IF(D314=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D314=\"Yes\"),AND($L$1=\"Scaled\",D314>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D314=\"No\"),AND($L$1=\"Scaled\",D314<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.11",null,null,""]
[3616,"V.1.59.1","1?",null,null,null,null,null,"NA",null,3,null,1,59,1,0,0,0,{"$f":"IF(K315=\"\",\"\",IF(D315=\"\",0,IF(D315=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D315=\"Yes\"),AND($L$1=\"Scaled\",D315>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D315=\"No\"),AND($L$1=\"Scaled\",D315<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,1,0,0,"WP.1.K.11",null,null,""]
[3617,"V.1.59.2",">1 <2?",null,null,null,null,null,"NA",null,3,null,1,59,2,0,0,0,{"$f":"IF(K316=\"\",\"\",IF(D316=\"\",0,IF(D316=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D316=\"Yes\"),AND($L$1=\"Scaled\",D316>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D316=\"No\"),AND($L$1=\"Scaled\",D316<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.K.11",null,null,""]
[3618,"V.1.59.3","> 2?",null,null,null,null,null,"NA",null,3,null,1,59,3,0,0,0,{"$f":"IF(K317=\"\",\"\",IF(D317=\"\",0,IF(D317=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D317=\"Yes\"),AND($L$1=\"Scaled\",D317>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D317=\"No\"),AND($L$1=\"Scaled\",D317<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.K.11",null,null,""]
[3619,"V.1.60","Which availability mode is the critical cloud infrastructure running:",null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,1,1,60,0,0,0,0,{"$f":"IF(K318=\"\",\"\",IF(D318=\"\",0,IF(D318=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D318=\"Yes\"),AND($L$1=\"Scaled\",D318>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D318=\"No\"),AND($L$1=\"Scaled\",D318<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.7",null,null,""]
[3620,"V.1.60.1","Cold standby?",null,null,null,null,null,"NA",null,3,null,1,60,1,0,0,0,{"$f":"IF(K319=\"\",\"\",IF(D319=\"\",0,IF(D319=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D319=\"Yes\"),AND($L$1=\"Scaled\",D319>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D319=\"No\"),AND($L$1=\"Scaled\",D319<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,1,0,0,"WP.1.K.7",null,null,""]
[3621,"V.1.60.2","Warm standby?",null,null,null,null,null,"NA",null,3,null,1,60,2,0,0,0,{"$f":"IF(K320=\"\",\"\",IF(D320=\"\",0,IF(D320=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D320=\"Yes\"),AND($L$1=\"Scaled\",D320>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D320=\"No\"),AND($L$1=\"Scaled\",D320<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.K.7",null,null,""]
[3622,"V.1.60.3","Active, Active?",null,null,null,null,null,"NA",null,3,null,1,60,3,0,0,0,{"$f":"IF(K321=\"\",\"\",IF(D321=\"\",0,IF(D321=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D321=\"Yes\"),AND($L$1=\"Scaled\",D321>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D321=\"No\"),AND($L$1=\"Scaled\",D321<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,0,1,2,0,0,0,"WP.1.K.7",null,null,""]
[3623,"V.1.61","Are the failover sites for the underlying infrastructure running on the same vendor physical systems?",null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,null,1,61,0,0,0,2,{"$f":"IF(K322=\"\",\"\",IF(D322=\"\",0,IF(D322=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D322=\"Yes\"),AND($L$1=\"Scaled\",D322>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D322=\"No\"),AND($L$1=\"Scaled\",D322<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.K.12",null,null,""]
[3734,"V.1.62","Are the failover sites for the underlying infrastructure running on different vendor physical systems?",null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,null,1,62,0,0,0,0,{"$f":"IF(K323=\"\",\"\",IF(D323=\"\",0,IF(D323=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D323=\"Yes\"),AND($L$1=\"Scaled\",D323>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D323=\"No\"),AND($L$1=\"Scaled\",D323<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.12",null,null,""]
[3624,"V.1.63","Is the critical infrastructure running active/active at two or more sites?",null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,null,1,63,0,0,0,2,{"$f":"IF(K324=\"\",\"\",IF(D324=\"\",0,IF(D324=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D324=\"Yes\"),AND($L$1=\"Scaled\",D324>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D324=\"No\"),AND($L$1=\"Scaled\",D324<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.K.12",null,null,""]
[3625,"V.1.64","Are sites failed over as part of normal operation or as part of a test? If yes, what is the frequency:",null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,null,1,64,0,0,0,2,{"$f":"IF(K325=\"\",\"\",IF(D325=\"\",0,IF(D325=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D325=\"Yes\"),AND($L$1=\"Scaled\",D325>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D325=\"No\"),AND($L$1=\"Scaled\",D325<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.K.11",null,null,""]
[3626,{"$f":"IF(K326=0,\"\",IF(K326=1,R$1&\".\"&M326,IF(K326=2,R$1&\".\"&M326&\".\"&N326,IF(K326=3,R$1&\".\"&M326&\".\"&N326&\".\"&O326,IF(K326=4,R$1&\".\"&M326&\".\"&N326&\".\"&O326&\".\"&P326,IF(K326=5,R$1&\".\"&M326&\".\"&N326&\".\"&O326&\".\"&P326&\".\"&Q326))))))","v":"V.1.64.1"},"Never?",null,null,null,null,null,"NA",null,3,null,{"$f":"IF(M325=\"\",1,IF(K326=1,M325+1,M325))","v":1},{"$f":"IF(N325=\"\",0,IF(M325<>M326,0,IF($K326=2,N325+1,N325)))","v":64},{"$f":"IF(O325=\"\",0,IF(N325<>N326,0,IF($K326=3,O325+1,O325)))","v":1},{"$f":"IF(P325=\"\",0,IF(O325<>O326,0,IF($K326=4,P325+1,P325)))","v":0},{"$f":"IF(Q325=\"\",0,IF(P325<>P326,0,IF($K326=5,Q325+1,Q325)))","v":0},{"$f":"IF(OR(Master=\"Master\",K326=0,L326=1),0,IF(ISNA(VLOOKUP(A326,L2_Array,21,FALSE)),0,VLOOKUP(A326,L2_Array,21,FALSE)))","v":0},{"$f":"IF(K326=\"\",\"\",IF(D326=\"\",0,IF(D326=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D326=\"Yes\"),AND($L$1=\"Scaled\",D326>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D326=\"No\"),AND($L$1=\"Scaled\",D326<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(K326=\"\",\"\",IF(R326>0,R326,IF(S326>0,S326,0)))","v":0},{"$f":"IF(OR(K326=\"\",K326=0),\"\",IF(OR(K326=1,U325=\"\"),1,IF(OR(AND(L325=1,(K326-K324<>0)),AND(U325=0,K325=K326),AND(L325=1,K326=K324)),0,1)))","v":1},{"$f":"IF(K326=\"\",V325,IF(AND(T326>1,OR(V325=\"\",V325=0,V325>=K326)),K326,IF(K326>V325,V325,0)))","v":1},{"$f":"IF(Master=\"Master\",S326,IF(W325=\"\",T326,IF(OR(AND(V326>0,T326<W325),AND(V326=1,T326<=W325)),W325,T326)))","v":2},{"$f":"IF(K326=\"\",\"\",IF(OR(AND(U325=1,V326=1),T326>0,AND(U327=0,X327=1)),1,0))","v":1},{"$f":"IF(K326=\"\",\"\",IF(OR(AND(V326>0,U326=1),AND(U326=1,X326=1)),1,0))","v":1},{"$f":"IF(ISNA(VLOOKUP(A326,L2_Array,1,FALSE)),0,1)","v":0},"WP.1.K.11",null,null,{"$f":"IF(AND(K326=1,T326=1),2,IF(AND(W325=1,M326=M325),2,IF(AND(AD325=2,M326=M325),2,IF(K326=1,1,\"\"))))","v":""}]
[3627,"V.1.64.2","Weekly?",null,null,null,null,null,"NA",null,3,null,1,64,2,0,0,0,{"$f":"IF(K327=\"\",\"\",IF(D327=\"\",0,IF(D327=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D327=\"Yes\"),AND($L$1=\"Scaled\",D327>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D327=\"No\"),AND($L$1=\"Scaled\",D327<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.11",null,null,""]
[3628,"V.1.64.3","Monthly?",null,null,null,null,null,"NA",null,3,null,1,64,3,0,0,0,{"$f":"IF(K328=\"\",\"\",IF(D328=\"\",0,IF(D328=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D328=\"Yes\"),AND($L$1=\"Scaled\",D328>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D328=\"No\"),AND($L$1=\"Scaled\",D328<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.11",null,null,""]
[3629,"V.1.64.4","Annually?",null,null,null,null,null,"NA",null,3,null,1,64,4,0,0,0,{"$f":"IF(K329=\"\",\"\",IF(D329=\"\",0,IF(D329=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D329=\"Yes\"),AND($L$1=\"Scaled\",D329>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D329=\"No\"),AND($L$1=\"Scaled\",D329<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.11",null,null,""]
[3630,"V.1.64.5","Dependent on change?",null,null,null,null,null,"NA",null,3,null,1,64,5,0,0,0,{"$f":"IF(K330=\"\",\"\",IF(D330=\"\",0,IF(D330=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D330=\"Yes\"),AND($L$1=\"Scaled\",D330>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D330=\"No\"),AND($L$1=\"Scaled\",D330<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.11",null,null,""]
[3631,"V.1.64.6","Continuous?",null,null,null,null,null,"NA",null,3,null,1,64,6,0,0,0,{"$f":"IF(K331=\"\",\"\",IF(D331=\"\",0,IF(D331=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D331=\"Yes\"),AND($L$1=\"Scaled\",D331>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D331=\"No\"),AND($L$1=\"Scaled\",D331<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.11",null,null,""]
[3632,"V.1.65","Are all suppliers of critical hardware, network services and facility services involved in annual continuity and recovery tests?",null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,null,1,65,0,0,0,2,{"$f":"IF(K332=\"\",\"\",IF(D332=\"\",0,IF(D332=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D332=\"Yes\"),AND($L$1=\"Scaled\",D332>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D332=\"No\"),AND($L$1=\"Scaled\",D332<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.K.11",null,null,""]
[3633,"V.1.66","Is the maturity of IT management processes formally evaluated at least annually using an established benchmark (e.g., COBIT maturity models)?",null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,null,1,66,0,0,0,0,{"$f":"IF(K333=\"\",\"\",IF(D333=\"\",0,IF(D333=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D333=\"Yes\"),AND($L$1=\"Scaled\",D333>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D333=\"No\"),AND($L$1=\"Scaled\",D333<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3634,"V.1.67","Are all critical technology service providers described on an architecture diagram that includes physical systems and facilities?",null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,null,1,67,0,0,0,2,{"$f":"IF(K334=\"\",\"\",IF(D334=\"\",0,IF(D334=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D334=\"Yes\"),AND($L$1=\"Scaled\",D334>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D334=\"No\"),AND($L$1=\"Scaled\",D334<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,"WP.1.E.1",null,null,""]
[3635,"V.1.67.1","Do the BCP failover test scenarios contain fail-over across critical vendors?",null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",3,null,1,67,1,0,0,0,{"$f":"IF(K335=\"\",\"\",IF(D335=\"\",0,IF(D335=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D335=\"Yes\"),AND($L$1=\"Scaled\",D335>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D335=\"No\"),AND($L$1=\"Scaled\",D335<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.6",null,null,""]
[3636,"V.1.67.2","Are there requirements to review and update the BCP for each significant business change to the critical supporting vendors?",null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",3,null,1,67,2,0,0,0,{"$f":"IF(K336=\"\",\"\",IF(D336=\"\",0,IF(D336=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D336=\"Yes\"),AND($L$1=\"Scaled\",D336>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D336=\"No\"),AND($L$1=\"Scaled\",D336<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.12",null,null,""]
[3637,"V.1.68","Are \"Red and Blue\" fully redundant networks run at the physical level?",null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,null,1,68,0,0,0,0,{"$f":"IF(K337=\"\",\"\",IF(D337=\"\",0,IF(D337=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D337=\"Yes\"),AND($L$1=\"Scaled\",D337>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D337=\"No\"),AND($L$1=\"Scaled\",D337<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3638,"V.1.69","Is there sufficient redundancy capacity to ensure services are not impacted in multi-tenancy environments during peak usage and above?",null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,null,1,69,0,0,0,2,{"$f":"IF(K338=\"\",\"\",IF(D338=\"\",0,IF(D338=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D338=\"Yes\"),AND($L$1=\"Scaled\",D338>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D338=\"No\"),AND($L$1=\"Scaled\",D338<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,null,null,null,""]
[3639,"V.1.70","Do contracts include a penalty or remediation clause for breach of availability and continuity SLAs? If yes, is the penalty based on:",null,null,null,null,null,"15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",2,null,1,70,0,0,0,2,{"$f":"IF(K339=\"\",\"\",IF(D339=\"\",0,IF(D339=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D339=\"Yes\"),AND($L$1=\"Scaled\",D339>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D339=\"No\"),AND($L$1=\"Scaled\",D339<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},2,1,1,2,1,1,1,null,null,null,""]
[3640,"V.1.70.1","Direct damages arising from breach of warranty or contract?",null,null,null,null,null,"NA",null,3,null,1,70,1,0,0,0,{"$f":"IF(K340=\"\",\"\",IF(D340=\"\",0,IF(D340=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D340=\"Yes\"),AND($L$1=\"Scaled\",D340>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D340=\"No\"),AND($L$1=\"Scaled\",D340<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3641,"V.1.70.2","Indirect damages arising from breach of warranty or contract?",null,null,null,null,null,"NA",null,3,null,1,70,2,0,0,0,{"$f":"IF(K341=\"\",\"\",IF(D341=\"\",0,IF(D341=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D341=\"Yes\"),AND($L$1=\"Scaled\",D341>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D341=\"No\"),AND($L$1=\"Scaled\",D341<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3642,"V.1.70.3","Indemnification for damages from breach of service obligations (or claims against customer for breach of service obligations)?",null,null,null,null,null,"NA",null,3,null,1,70,3,0,0,0,{"$f":"IF(K342=\"\",\"\",IF(D342=\"\",0,IF(D342=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D342=\"Yes\"),AND($L$1=\"Scaled\",D342>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D342=\"No\"),AND($L$1=\"Scaled\",D342<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3643,"V.1.70.4","Service credits for downtime?",null,null,null,null,null,"NA",null,3,null,1,70,4,0,0,0,{"$f":"IF(K343=\"\",\"\",IF(D343=\"\",0,IF(D343=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D343=\"Yes\"),AND($L$1=\"Scaled\",D343>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D343=\"No\"),AND($L$1=\"Scaled\",D343<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3644,"V.1.70.5","Grant customer a termination and/or refund right?",null,null,null,null,null,"NA",null,3,null,1,70,5,0,0,0,{"$f":"IF(K344=\"\",\"\",IF(D344=\"\",0,IF(D344=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D344=\"Yes\"),AND($L$1=\"Scaled\",D344>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D344=\"No\"),AND($L$1=\"Scaled\",D344<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3645,"V.1.70.6","Continued obligation to apply effort to resolve a problem?",null,null,null,null,null,"NA",null,3,null,1,70,6,0,0,0,{"$f":"IF(K345=\"\",\"\",IF(D345=\"\",0,IF(D345=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D345=\"Yes\"),AND($L$1=\"Scaled\",D345>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D345=\"No\"),AND($L$1=\"Scaled\",D345<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3646,"V.1.70.7","Calculation of business loss based on actual damages?",null,null,null,null,null,"NA",null,3,null,1,70,7,0,0,0,{"$f":"IF(K346=\"\",\"\",IF(D346=\"\",0,IF(D346=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D346=\"Yes\"),AND($L$1=\"Scaled\",D346>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D346=\"No\"),AND($L$1=\"Scaled\",D346<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3647,"V.1.71","Is priority access to resources from suppliers contractually ensured in the event of an adverse situation, affecting multiple customers of suppliers (e.g., fuel oil, recovery center space)?",null,null,null,null,null,"15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",2,null,1,71,0,0,0,0,{"$f":"IF(K347=\"\",\"\",IF(D347=\"\",0,IF(D347=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D347=\"Yes\"),AND($L$1=\"Scaled\",D347>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D347=\"No\"),AND($L$1=\"Scaled\",D347<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3649,"V.1.72","Are Hypervisors used to manage systems used to transmit, process or store Scoped Data? If yes, are there:","No",null,null,null,"V.4 Security Review of Hypervisor Configuration","14.1.2","Securing application services on public networks",2,null,1,72,0,0,0,2,{"$f":"IF(K348=\"\",\"\",IF(D348=\"\",0,IF(D348=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D348=\"Yes\"),AND($L$1=\"Scaled\",D348>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D348=\"No\"),AND($L$1=\"Scaled\",D348<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":2},2,1,1,2,1,1,1,"WP.1.D.1",null,null,""]
[3650,"V.1.72.1","Hypervisor hardening standards applied?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.6.1 ","Management of technical vulnerabilities",3,null,1,72,1,0,0,0,{"$f":"IF(K349=\"\",\"\",IF(D349=\"\",0,IF(D349=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D349=\"Yes\"),AND($L$1=\"Scaled\",D349>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D349=\"No\"),AND($L$1=\"Scaled\",D349<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.3",null,null,""]
[3651,"V.1.72.2","Standard builds/security compliance checks?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.6.1 ","Management of technical vulnerabilities",3,null,1,72,2,0,0,0,{"$f":"IF(K350=\"\",\"\",IF(D350=\"\",0,IF(D350=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D350=\"Yes\"),AND($L$1=\"Scaled\",D350>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D350=\"No\"),AND($L$1=\"Scaled\",D350<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.D.1",null,null,""]
[3652,"V.1.72.3","Current patches?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.6.1 ","Management of technical vulnerabilities",3,null,1,72,3,0,0,0,{"$f":"IF(K351=\"\",\"\",IF(D351=\"\",0,IF(D351=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D351=\"Yes\"),AND($L$1=\"Scaled\",D351>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D351=\"No\"),AND($L$1=\"Scaled\",D351<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.6",null,null,""]
[3653,"V.1.72.4","Unnecessary/unused services turned off?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.6.1 ","Management of technical vulnerabilities",3,null,1,72,4,0,0,0,{"$f":"IF(K352=\"\",\"\",IF(D352=\"\",0,IF(D352=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D352=\"Yes\"),AND($L$1=\"Scaled\",D352>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D352=\"No\"),AND($L$1=\"Scaled\",D352<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.4",null,null,""]
[3654,"V.1.72.5","Regular log reviews using a specific methodology to uncover potential incidents?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.4.1","Event logging",3,null,1,72,5,0,0,0,{"$f":"IF(K353=\"\",\"\",IF(D353=\"\",0,IF(D353=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D353=\"Yes\"),AND($L$1=\"Scaled\",D353>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D353=\"No\"),AND($L$1=\"Scaled\",D353<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.H.9",null,null,""]
[3655,"V.1.72.6","Sufficient information in the logs to evaluate incidents?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.4.1","Event logging",3,null,1,72,6,0,0,0,{"$f":"IF(K354=\"\",\"\",IF(D354=\"\",0,IF(D354=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D354=\"Yes\"),AND($L$1=\"Scaled\",D354>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D354=\"No\"),AND($L$1=\"Scaled\",D354<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.H.9",null,null,""]
[3656,"V.1.72.7","Logs retained for a minimum of one year?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.4.1","Event logging",3,null,1,72,7,0,0,0,{"$f":"IF(K355=\"\",\"\",IF(D355=\"\",0,IF(D355=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D355=\"Yes\"),AND($L$1=\"Scaled\",D355>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D355=\"No\"),AND($L$1=\"Scaled\",D355<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.H.9",null,null,""]
[3657,"V.1.72.8","System generated alerts in the event of an audit log failure?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.4.1","Event logging",3,null,1,72,8,0,0,0,{"$f":"IF(K356=\"\",\"\",IF(D356=\"\",0,IF(D356=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D356=\"Yes\"),AND($L$1=\"Scaled\",D356>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D356=\"No\"),AND($L$1=\"Scaled\",D356<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.H.9, WP.1.H.10",null,null,""]
[3658,"V.1.72.9","Audit logs stored on alternate systems?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.4.1","Event logging",3,null,1,72,9,0,0,0,{"$f":"IF(K357=\"\",\"\",IF(D357=\"\",0,IF(D357=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D357=\"Yes\"),AND($L$1=\"Scaled\",D357>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D357=\"No\"),AND($L$1=\"Scaled\",D357<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.H.9",null,null,""]
[3659,"V.1.72.10","Audit logs protected against modification, deletion, and/or inappropriate access?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.4.1","Event logging",3,null,1,72,10,0,0,0,{"$f":"IF(K358=\"\",\"\",IF(D358=\"\",0,IF(D358=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D358=\"Yes\"),AND($L$1=\"Scaled\",D358>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D358=\"No\"),AND($L$1=\"Scaled\",D358<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.H.9",null,null,""]
[3660,"V.1.72.11","Minimum password length at least eight characters?",null,null,null,null,"H.1 Password Controls","9.3.1","Use of secret authentication information",3,null,1,72,11,0,0,0,{"$f":"IF(K359=\"\",\"\",IF(D359=\"\",0,IF(D359=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D359=\"Yes\"),AND($L$1=\"Scaled\",D359>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D359=\"No\"),AND($L$1=\"Scaled\",D359<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.4",null,null,""]
[3661,"V.1.72.12","Complex passwords required?",null,null,null,null,"H.1 Password Controls","9.3.1","Use of secret authentication information",3,null,1,72,12,0,0,0,{"$f":"IF(K360=\"\",\"\",IF(D360=\"\",0,IF(D360=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D360=\"Yes\"),AND($L$1=\"Scaled\",D360>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D360=\"No\"),AND($L$1=\"Scaled\",D360<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.4",null,null,""]
[3662,"V.1.72.13","Minimum password expiration at least every 90 days?",null,null,null,null,"H.1 Password Controls","9.3.1","Use of secret authentication information",3,null,1,72,13,0,0,0,{"$f":"IF(K361=\"\",\"\",IF(D361=\"\",0,IF(D361=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D361=\"Yes\"),AND($L$1=\"Scaled\",D361>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D361=\"No\"),AND($L$1=\"Scaled\",D361<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.4",null,null,""]
[3663,"V.1.72.14","Password history of 12 before reuse?",null,null,null,null,"H.1 Password Controls","9.3.1","Use of secret authentication information",3,null,1,72,14,0,0,0,{"$f":"IF(K362=\"\",\"\",IF(D362=\"\",0,IF(D362=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D362=\"Yes\"),AND($L$1=\"Scaled\",D362>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D362=\"No\"),AND($L$1=\"Scaled\",D362<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.4",null,null,""]
[3664,"V.1.72.15","Password change requirements at first logon?",null,null,null,null,"H.1 Password Controls","9.3.1","Use of secret authentication information",3,null,1,72,15,0,0,0,{"$f":"IF(K363=\"\",\"\",IF(D363=\"\",0,IF(D363=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D363=\"Yes\"),AND($L$1=\"Scaled\",D363>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D363=\"No\"),AND($L$1=\"Scaled\",D363<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.4",null,null,""]
[3665,"V.1.72.16","Stand alone authentication requirements such as a PIN or secret question?",null,null,null,null,"H.1 Password Controls","9.3.1","Use of secret authentication information",3,null,1,72,16,0,0,0,{"$f":"IF(K364=\"\",\"\",IF(D364=\"\",0,IF(D364=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D364=\"Yes\"),AND($L$1=\"Scaled\",D364>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D364=\"No\"),AND($L$1=\"Scaled\",D364<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.I.4",null,null,""]
[3666,"V.1.72.17","Passwords encrypted in transit?",null,null,null,null,"H.1 Password Controls","9.3.1                                                        10.1.1","Use of secret authentication information,                                        Policy on the use of cryptographic controls",3,null,1,72,17,0,0,0,{"$f":"IF(K365=\"\",\"\",IF(D365=\"\",0,IF(D365=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D365=\"Yes\"),AND($L$1=\"Scaled\",D365>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D365=\"No\"),AND($L$1=\"Scaled\",D365<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3667,"V.1.72.18","Passwords encrypted or hashed in storage?",null,null,null,null,"H.1 Password Controls","9.3.1","Use of secret authentication information",3,null,1,72,18,0,0,0,{"$f":"IF(K366=\"\",\"\",IF(D366=\"\",0,IF(D366=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D366=\"Yes\"),AND($L$1=\"Scaled\",D366>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D366=\"No\"),AND($L$1=\"Scaled\",D366<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3668,"V.1.72.19","Passwords displayed when entered into a system?",null,null,null,null,"H.1 Password Controls","9.3.1","Use of secret authentication information",3,null,1,72,19,0,0,0,{"$f":"IF(K367=\"\",\"\",IF(D367=\"\",0,IF(D367=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D367=\"Yes\"),AND($L$1=\"Scaled\",D367>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D367=\"No\"),AND($L$1=\"Scaled\",D367<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.7",null,null,""]
[3669,"V.1.72.20","User accounts associated to a unique individual?",null,null,null,null,"H.1 Password Controls","9.2.1 ","User registration and de-registration",3,null,1,72,20,0,0,0,{"$f":"IF(K368=\"\",\"\",IF(D368=\"\",0,IF(D368=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D368=\"Yes\"),AND($L$1=\"Scaled\",D368>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D368=\"No\"),AND($L$1=\"Scaled\",D368<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.6",null,null,""]
[3670,"V.1.72.21","System lock requirements after 3-5 invalid login attempts?",null,null,null,null,null,"9.2.4 ","Management of secret authentication information of users",3,null,1,72,21,0,0,0,{"$f":"IF(K369=\"\",\"\",IF(D369=\"\",0,IF(D369=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D369=\"Yes\"),AND($L$1=\"Scaled\",D369>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D369=\"No\"),AND($L$1=\"Scaled\",D369<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.7",null,null,""]
[3671,"V.1.72.22","Restricted administrative access to the management interfaces?",null,null,null,null,"H.3 Logical Access Authorization","9.1.1                                                  9.2.3","Access control policy,               Management of privileged access rights",3,null,1,72,22,0,0,0,{"$f":"IF(K370=\"\",\"\",IF(D370=\"\",0,IF(D370=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D370=\"Yes\"),AND($L$1=\"Scaled\",D370>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D370=\"No\"),AND($L$1=\"Scaled\",D370<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.7",null,null,""]
[3672,"V.1.72.23","Disabling unneeded hypervisor services (e.g., file-sharing between the guest and the host operating system)?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","9.4.1","Information access restriction",3,null,1,72,23,0,0,0,{"$f":"IF(K371=\"\",\"\",IF(D371=\"\",0,IF(D371=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D371=\"Yes\"),AND($L$1=\"Scaled\",D371>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D371=\"No\"),AND($L$1=\"Scaled\",D371<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.7",null,null,""]
[3673,"V.1.72.24","Introspection capabilities to monitor the security of each guest operating system?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.4.1","Event logging",3,null,1,72,24,0,0,0,{"$f":"IF(K372=\"\",\"\",IF(D372=\"\",0,IF(D372=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D372=\"Yes\"),AND($L$1=\"Scaled\",D372>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D372=\"No\"),AND($L$1=\"Scaled\",D372<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.7",null,null,""]
[3674,"V.1.72.25","Introspection capabilities to monitor the security of activity taking place between each guest operating system?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.4.1","Event logging",3,null,1,72,25,0,0,0,{"$f":"IF(K373=\"\",\"\",IF(D373=\"\",0,IF(D373=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D373=\"Yes\"),AND($L$1=\"Scaled\",D373>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D373=\"No\"),AND($L$1=\"Scaled\",D373<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.7",null,null,""]
[3675,"V.1.72.26"," Separate network VLANs for host operating system communication with guest operating systems?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","13.1.3","Segregation in networks",3,null,1,72,26,0,0,0,{"$f":"IF(K374=\"\",\"\",IF(D374=\"\",0,IF(D374=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D374=\"Yes\"),AND($L$1=\"Scaled\",D374>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D374=\"No\"),AND($L$1=\"Scaled\",D374<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.2, WP.1.A.3, WP.1.A.8",null,null,""]
[3676,"V.1.72.27","Guest operating systems communicate on separate VLAN's from other Guest operating systems that they do not need to communicate with?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","13.1.3","Segregation in networks",3,null,1,72,27,0,0,0,{"$f":"IF(K375=\"\",\"\",IF(D375=\"\",0,IF(D375=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D375=\"Yes\"),AND($L$1=\"Scaled\",D375>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D375=\"No\"),AND($L$1=\"Scaled\",D375<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.2, WP.1.A.3, WP.1.A.8",null,null,""]
[3677,"V.1.72.28","Host operating system management interface on a separate network than those used by guest operating systems?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","13.1.3","Segregation in networks",3,null,1,72,28,0,0,0,{"$f":"IF(K376=\"\",\"\",IF(D376=\"\",0,IF(D376=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D376=\"Yes\"),AND($L$1=\"Scaled\",D376>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D376=\"No\"),AND($L$1=\"Scaled\",D376<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.2, WP.1.A.3, WP.1.A.8",null,null,""]
[3678,"V.1.72.29","Two factor authentication for access to the administrative interfaces?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","9.1.1","Access control policy",3,null,1,72,29,0,0,0,{"$f":"IF(K377=\"\",\"\",IF(D377=\"\",0,IF(D377=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D377=\"Yes\"),AND($L$1=\"Scaled\",D377>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D377=\"No\"),AND($L$1=\"Scaled\",D377<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3679,"V.1.72.30","Volume or disk partitioning to prevent inadvertent resource bottlenecks from guest operating systems?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.1.3","Capacity Management",3,null,1,72,30,0,0,0,{"$f":"IF(K378=\"\",\"\",IF(D378=\"\",0,IF(D378=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D378=\"Yes\"),AND($L$1=\"Scaled\",D378>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D378=\"No\"),AND($L$1=\"Scaled\",D378<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.A.2, WP.1.A.3, WP.1.A.8",null,null,""]
[3680,"V.1.72.31","Approval process before VMs can be created to avoid VM sprawl?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.1.2","Change Management",3,null,1,72,31,0,0,0,{"$f":"IF(K379=\"\",\"\",IF(D379=\"\",0,IF(D379=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D379=\"Yes\"),AND($L$1=\"Scaled\",D379>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D379=\"No\"),AND($L$1=\"Scaled\",D379<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3681,"V.1.72.32","Migration of VMs logged including source and target systems, time, user?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.4.1","Event logging",3,null,1,72,32,0,0,0,{"$f":"IF(K380=\"\",\"\",IF(D380=\"\",0,IF(D380=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D380=\"Yes\"),AND($L$1=\"Scaled\",D380>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D380=\"No\"),AND($L$1=\"Scaled\",D380<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]
[3682,"V.1.72.33","VM's in the same host sharing the risk and data classification?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.1.4","Separation Of Development, Test, And Operational Facilities",3,null,1,72,33,0,0,0,{"$f":"IF(K381=\"\",\"\",IF(D381=\"\",0,IF(D381=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D381=\"Yes\"),AND($L$1=\"Scaled\",D381>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D381=\"No\"),AND($L$1=\"Scaled\",D381<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,"WP.1.K.1",null,null,""]
[3683,"V.1.72.34","VM's in the same host sharing system sensitivity level grouping (development and production not present on the same host)?",null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.1.4","Separation Of Development, Test, And Operational Facilities",3,null,1,72,34,0,0,0,{"$f":"IF(K382=\"\",\"\",IF(D382=\"\",0,IF(D382=\"N/A\",3,IF(OR(AND($L$1=\"Binary\",D382=\"Yes\"),AND($L$1=\"Scaled\",D382>Dashboard!$D$10)),1,IF(OR(AND($L$1=\"Binary\",D382=\"No\"),AND($L$1=\"Scaled\",D382<=Dashboard!$D$10)),2,\"Oops there is an error\")))))","v":0},0,1,1,2,1,1,0,null,null,null,""]

{"sheet":"Z. Additional Questions","index":23,"n_rows":53,"n_cols":7,"rows_kept":53,"cut":false,"hidden":false,"merged":[[2,0,2,6]]}
["Z. Additional Questions"]
[]
["This tab is used to supply any additional questions not covered by this SIG. Questions on this tab will not be analyzed by the SIG Management Tool."]
[]
["Ques Num","Question/Request","Response","Additional Information","AUP Reference","ISO Ref Num","ISO Ref Text"]
["MS.01","What kinds of data will you be having access to? \nPlease list out data types, to the best of your knowledge."]
["MS.02","Where will data be physically residing? US only or outside US too?\nPlease list out by country, state/province at the very minimum. "]
["MS.03","What appliance/solution do you use to replicate data between your primary and secondary data centers (e.g. HP Autonomy LiveVault, EMC Legato Networker, Dell NetVault)? Note: if this is performed by your collocation data centers, please reach out to them for a response."]
["MS.04","In case of a disaster at your primary data center, what is your RTO and RPO? Note: if this is performed by your collocation data centers, please reach out to them for a response."]
["MS.05","We conduct comprehensive DR testing exercises on an annual basis. If data were to be hosted on your cloud solution, how would you plan to assist with its DR testing initiatives? Would you be able to provide with a copy of your own DR test exercises showing that you meet the RTO and RPO objectives you have promised? At least once annually? Please provide details of evidence you will provide."]
["MS.06","How will access authentication occur? Single Sign On/Federated Identity?"]
["MS.07","Please describe in detail, how you plan to protect data (e.g. encryption) at rest (in use), in transit (e.g. electronically via email or through access of a web portal over the internet) and in storage (e.g. off site) so that data is unreadable to anyone except authorized users. \n\nPlease include encryption strength (e.g. AES 256)."]
["MS.08","If  would use your services, will a contract be signed with you or any other vendor partners you work with? Will those partners have access to touch (even if read only)  data?"]
["MS.09","In case of extreme emergencies, such as a weather related disaster or a pandemic situation, would you or your vendor partners (located outside the US), be granted access to data located in the US? If so, please provide details of when such access would occur, where such personnel would be located, and what security applies to such access."]
["MS.10","Are you Safe Harbor certified? If so provide evidence. If you aren't Safe Harbor certified, how do you manage cross border transmission and storage of data between the US and the EU?"]
["MS.11","How would you notify should there be a data breach involving  information?"]
["MS.12","Please identify and describe any known security vulnerabilities in the \nsoftware applications.","N/A"]
["MS.13","Personnel often work with data that may contain AMA IMS data. Such data has the following additional requirements\n","N/A"]
["MS.14","Are firewalls used to prevent any network traffic into an entity’s private network through use of IP packet Inspection?\n\n","N/A"]
["MS.15","Does the firewall include at least one physical or virtual Internet Protocol packet filter, Application Control filter, or Host Intrusion Prevention/Host Firewall filter technology placed to inspect and, if necessary, block communications between external hosts and the host system where the AMA-PPD is stored. Do the firewall systems maintain activity logs for audit purposes ","N/A"]
["MS.16","Do you maintain firewall activity logs for audit purposes?","N/A"]
["MS.17","Are you using host based IDS to protect systems and servers on which data would be present?","N/A"]
["MS.18","Do you have access control and/or filtering to prevent the access of data from wireless local area networks?","N/A"]
["MS.19","Please provide a copy of your password policy.\nEnsure that password expired every 90 days, and that passwrd are encrypted stored or transmitted.","N/A"]
["MS.20","Would you be able to maintain log history information for all access to data for a minimum of 6 months? \n\nWould it contain the date and time of access, the username and the IP address of the party accessing the logged area? "]
["MS.21"," Would you be able to provide anti-virus report for all systems and servers where data will be hosted? It should include virus data definitions and data sets."]
["MS.22","Do you perform a SOC2, Type II attestation of your own environment annually? If yes, please send us a copy of the audit report for your own environment."]
["MS.23","Do your data sub processors (e.g. collocation data centers you will use for the purposes of this engagement) perform a SOC2, Type II attestation of their environments annually? If yes, please arrange to send us a copy of their SOC2  audit reports"]
["MS.24","Have you completed the Cloud Security Alliance (CSA) Consensus Assessments Initative Questionnaire? If so, please send us a copy of this questionnaire"]
["MS.25","Does your encryption technology that encodes transmission of the AMA-PPD as it passes through telecommunications and internal networks  and AMA-PPD that is digitally stored on Cloud Hosting Provider systems, devices and backup tapes or DVDs comply with NIST Federal Information Processing standard (symmetric key: AES 128, AES 256 bit and Asymmetric key: RSA, DSA) Please document which encryption strength you use (e.g. AES 256)"]
["MS.26","Is your data center at least Tier 1 certified? \nFor a description of data center Tier levels please see ‘http://en.wikipedia.org/wiki/Data_center’. \n"]
["MS.27","Is two factor authentication required for all remote administration and support access to Cloud Hosting Provider systems"]
["MS.28","Is the acess to Cloud Hosting Provider systems restricted to authorized users? "]
["MS.29","Does the individual have unique assigned user IDs and passwords to gain access to any system housing the AMA-PPD?"]
["MS.30","Two factor authentication required for all remote administration and support access to Cloud Hosting Provider systems"]
["MS.31","Does transmission of the AMA-PPD software support the latest version of the Transport Layer Security (TLS) standard to ensure a secure connection."]
["MS.32","Do you maintain an inventory of onsite and offsite backups?"]
["MS.33","Do you monitor network events on a continuous basis?"]
["MS.34","Is there a separate physical or logical segmentation of data repository containing AMA-PPD."]
["MS.35","Are there any protective measures such as “timeout features” that automatically log a session out after a period of inactivity to prevent unauthorized access to the AMA-PPD implmented on the cloud hosting provider systems."]
["MS.36","Is network access to ports and protocols limited based on business requirements."]
["MS.37","Please provide maintenance of physical security measures at all Cloud Hosting Provider data center locations which include, but are not limited to, simple locks, and electronic access verification (card readers and proximity detectors), electronic and direct surveillance, spatial isolation (hard partitions, disparate buildings, etc.), securing the entrances to all data center facilities by monitored electronic key and by electronic and direct surveillance and spatial isolation (hard partitions, disparate buildings, etc.)"]
["MS.38","Are logs of all access to the AMA-PPD, servers or areas that are accessible through a modem, VPN, the Internet or any other electronic method maintained. At a minimum, such log must contain the date and time of access, the username and the IP address of the party accessing the logged area, which shall be reviewed on a regular basis to monitor and respond to inappropriate or suspicious activity. Cloud Hosting Provider shall retain such logged information for a minimum of six (6) months and shall make such log components available to AMA upon written request if Cloud Hosting Provider’s security has been breached."]
["MS.39","IE – data is encrypted in transit outside of the environment; data is encrypted at rest inside of the environment; but is data encrypted while in transit within the environment?"]
["MS.40","Does your organization have security policies and procedures which require implementation of physical, technical and administrative safeguards in accordance with the requirements of the HIPAA Security Rule?"]
["MS.41","Have those policies been implemented?"]
["MS.42","Have you provided HIPAA security rule and privacy rule training to relevant personnel? What was the content of the training?"]
["MS.43","Has a risk assessment of your information systems been performed?"]
["MS.44"," If yes, was that risk assessment performed in accordance with the HIPAA Security Rule?"]
["MS.45","Was the risk assessment performed internally or by a third party?"]
["MS.46","When was the risk assessment performed?"]
["MS.47","Please provide a copy of the risk assessment report. If you cannot provide a detailed risk assessment report, please provide a summary of the report. If you cannot provide a summary report either, please explain in detail, the basis of your claim that you are \"HIPAA compliant.\" What do you mean by that term?"]
["MS.48"," Since the performance of the risk assessment, have there been any material changes to your information systems that could affect the confidentiality, integrity or security of the system or the information that it processes?"]

{"sheet":"Glossary","index":24,"n_rows":137,"n_cols":3,"rows_kept":137,"cut":false,"hidden":false,"merged":[]}
[]
[null,"Glossary"]
[null,"Term","Definition"]
[null,"Acceptable Use Policy","Part of the information security framework that defines what users are and are not allowed to do with the IT systems of the respondent. It should contain a subset of the information security policy and refer users to the full security policy when relevant. It should also clearly define the sanctions applied if a user violates the policy."]
[null,"Acknowledgement of Acceptable Use","A written attestation from a user of an information system indicating the user's acceptance and willingness to comply with the relevant information systems control policies."]
[null,"Anti-Tailgating / Anti-Piggybacking Mechanism","Two sets of doors whereby access to the second is not granted until the individual has passed through (and closed) the first, often referred to as a \"man trap.\" A controlled turnstile is also considered an anti-tailgating/piggybacking mechanism."]
[null,"Asset Classification","The category or type assigned to an asset, which is derived from the asset classification policy. Asset classifications frequently vary from company to company."]
[null,"Asset Control Tag","A unique identification number assigned to all inventoried assets."]
[null,"Attribute","A property or field of a particular object."]
[null,"Baseline","A benchmark by which subsequent items are measured."]
[null,"Battery","An electrochemical cell (or enclosed and protected material) that can be charged electrically to provide a static potential for power or released electrical charge when needed."]
[null,"Biometric Reader","A device that uses measurable biological characteristics such as fingerprints or iris patterns to assist in authenticating a person to an electronic system."]
[null,"Business Continuity Plan (BCP)","A process that defines exactly how, for which applications, and for how long a business plans to continue functioning after a disruptive event. The business continuity plan is usually an overarching plan that includes both operational and technology-related tasks."]
[null,"Business Impact Analysis (BIA)","This term is applicable across Technology Risk Management, in both information security and business continuity planning domains. An impact analysis results in the differentiation between critical and non-critical business functions. A function may be considered critical if there is an unacceptable impact to stakeholders from damage to the function. The perception of the acceptability of disruption may be modified by the cost of establishing and maintaining appropriate business or technical recovery solutions. A function may also be considered critical if dictated by law."]
[null,"Business Process","An end-to-end service made available to internal or external parties that usually corresponds to standard service products that the Service Provider offers to clients."]
[null,"Change Initiation Request (CIR)","A document (physical or electronic) used to track change requests, including new features, enhancement requests, defects, and changed requirements. The change initiation request document must contain:\n - The name of the person initiating the change\n - The system affected by the change\n - A description of the change, including the file name(s) and file location(s)\n - The date the change will occur\n - An approval signature by someone other than the person initiating the change\n - An approval date"]
[null,"Clean Room","A network segment or subnet where data is sanitized for mobile devices access only."]
[null,"Climate Control System","A combination of sensors and equipment that monitors the temperature and humidity in a sensitive environment (such as a data center) and that automatically heats/cools/dehumidifies as needed to keep the atmosphere within acceptable tolerances."]
[null,"Cloud Computing - NIST Definition","Cloud Computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider  interaction.  This Cloud model promotes availability and is composed of five essential characteristics, three service models, and four deployment models."]
[null,"Cloud Computing – NIST Definition of Deployment Models - Community Cloud","The Cloud infrastructure is shared by several respondents and supports a specific community that has shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be managed by the respondent or subcontractor and may exist on premise or off premise."]
[null,"Cloud Computing – NIST Definition of Deployment Models - Hybrid Cloud","The Cloud infrastructure is a composition of two or more Clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability (e.g., Cloud bursting for load balancing between Clouds)."]
[null,"Cloud Computing – NIST Definition of Deployment Models - Private Cloud","The Cloud infrastructure is operated solely for the respondent. It may be managed by the organization or a third party and may exist on premise or off premise."]
[null,"Cloud Computing – NIST Definition of Deployment Models - Public Cloud","The Cloud infrastructure is made available to the general public or a large industry group and is owned by the Respondent selling Cloud services."]
[null,"Cloud Computing - NIST Definition of Essential Characteristics - Broad Access Network","Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs)."]
[null,"Cloud Computing - NIST Definition of Essential Characteristics - Measured Service","Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service."]
[null,"Cloud Computing - NIST Definition of Essential Characteristics - On-Demand Self-Service","A consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service’s provider."]
[null,"Cloud Computing - NIST Definition of Essential Characteristics - Rapid Elasticity","Capabilities can be rapidly and elastically provisioned, in some cases automatically, to quickly scale out and rapidly released to quickly scale in. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be purchased in any quantity at any time."]
[null,"Cloud Computing - NIST Definition of Essential Characteristics - Resource Pooling","The provider’s computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand. There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter). Examples of resources include storage, processing, memory, network bandwidth, and virtual machines. "]
[null,"Cloud Computing – NIST Definition of Service Models - Cloud Infrastructure as a Service (IaaS)"," The capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying Cloud infrastructure but has control over operating systems, storage, deployed applications, and possibly limited control of select networking components (e.g., host firewalls)."]
[null,"Cloud Computing – NIST Definition of Service Models - Cloud Platform as a Service (PaaS)"," The capability provided to the consumer is to deploy onto the Cloud infrastructure consumer-created or acquired applications created using programming languages and tools supported by the provider. The consumer does not manage or control the underlying Cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly application hosting environment configurations."]
[null,"Cloud Computing – NIST Definition of Service Models - Cloud Software as a Service (SaaS)","The capability provided to the consumer is to use the provider’s applications running on a Cloud infrastructure. The applications are accessible from various client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying Cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application."]
[null,"Cold Site","A remote facility that provides the equipment necessary for data and process restoration."]
[null,"Communications Plan","A tool for communicating information on the considerations and implications of respondent business continuity to improve decision making."]
[null,"Confidentiality","The protection of sensitive information from unauthorized disclosure and sensitive facilities due to physical, technical, or electronic penetration or exploitation."]
[null,"Constituent","An active employee or contractor."]
[null,"Contractor","A contracted professional with expertise in a particular domain or area."]
[null,"Covered Entity","(As defined by the HIPAA Rules requirement) A covered entity can be an Individual, a business and/or an agency who must comply with HIPAA rules to protect the privacy and security of health information and must provide individuals with certain rights related to their health information (i.e. Doctors, Health Insurance Companies, healthcare clearing house)."]
[null,"Demilitarized Zone (DMZ)","A controlled network space, delimited by firewalls or other policy-enforcing devices, which is neither inside an organization's network nor directly part of the Internet. A DMZ is typically used to isolate the respondent's most highly secured information assets while allowing predefined access to those assets that must provide or receive data outside of the respondent. The access and services provided should be restricted to the absolute minimum required."]
[null,"Disaster Recovery","The process, policies and procedures related to preparing for recovery or continuation of technology infrastructure critical to the respondent after a natural or human-induced disaster. Disaster recovery is a subset of business continuity"]
[null,"Enclosed","Closed in, surrounded, or included within."]
[null,"Exception","A result that deviates from the norm or expectation."]
[null,"External Vulnerability Scan","A systematic review process executed from a network address outside of the Scoped Systems and Data network that uses software tools designed to search for and map systems for weaknesses in an application, computer or network. The intent is to determine if there are points of weakness in the security control system that can be exploited from outside the network."]
[null,"Externally Facing","The network entry point that receives inbound traffic."]
[null,"Extranet","An intranet that is partially accessible to authorized outsiders."]
[null,"Facility","A structure or building, or multiple structures or buildings, in which operations are conducted for the services provided. These operations include handling, processing and storage of information, data or systems, as well as personnel that support the operations."]
[null,"Fire Suppression System","A combination of sensors and equipment designed to detect the presence of heat/smoke/fire and actuate a fire retardant or fire extinguishing system."]
[null,"Firewall","A set of related programs, located at a network gateway server, that protects the resources of private networks from other networks. Firewalls may be application/proxy, packet-filtering, or stateful-based. Examples of firewalls are Cisco PIX, Check Point Firewall, Juniper NetScreen and Cyberguard. (Though they contain some firewall functionality, routers are not included in this definition.)"]
[null,"Firewall Rule","Information added to the firewall configuration to define the respondent's security policy through conditional statements that tell the firewall how to react in a particular situation."]
[null,"Fluid Sensor","A mechanical device that is sensitive to the presence of water or moisture that transmits a signal to a measuring or control instrument."]
[null,"Gateway","A node on a network that facilitates the communication of information between two or more nodes."]
[null,"General Perimeter","An area with fully enclosed walls that extend from floor to ceiling (beyond raised floors and ceilings) surrounding the secure perimeter. This may be the same floor as the secure perimeter, if shared by other tenants in the facility, or the facility itself."]
[null,"Generator","A device that converts mechanical energy to electrical energy via an engine (usually fuel-powered) that provides electrical current as input to a power source."]
[null,"Hardware Systems","Includes servers and network devices."]
[null,"Heat Detector","A mechanical device that is sensitive to temperature and transmits a signal to a measuring or control instrument."]
[null,"Hot Site","A duplicate of the respondent’s original site, with full computer systems and near-complete backups of user data."]
[null,"Immediate Perimeter","A rack or cage that houses the Scoped Systems and Data."]
[null,"Incident","Events outside normal operations that disrupt normal operational processes. An incident can be a relatively minor event, such as running out of disk space on a server, or a major disruption, such as a breach of database security and the loss of private and confidential customer information."]
[null,"Incident Severity","A ranking of an event’s significance that uses, at a minimum, a three-point scale: minor, moderately severe, and severe. For each level of severity, the respondent's IT department should define acceptable resolution times, escalation procedures, and reporting procedures."]
[null,"Intermediate Distribution Frame IDF","A free-standing or wall-mounted rack for managing and interconnecting the telecommunications cable between end user devices and a main distribution frame (MDF)."]
[null,"Internal Vulnerability Scan","A systematic review process using software tools designed to search for and map systems for weaknesses in an application, computer or network, executed from a network address within the Scoped Systems and Data network. Internal vulnerability scans are used to determine whether points of weakness in the security control system exist that could be exploited by a user with access to the internal network."]
[null,"Internet","A global network connecting millions of computers. More than 100 countries are linked into exchanges of data, news and opinions."]
[null,"Internet Protocol (IP)","A networking standard that allows messages to be sent back and forth over the Internet or other IP networks."]
[null,"Intranet","An IP network that resides behind a firewall and is accessible only to people who are members of the same organization."]
[null,"Intrusion Detection Systems (IDS)","A security inspection system for computers and networks that can allow for the inspection of systems activity and inbound/outbound network activity. The IDS key function identifies suspicious activity or patterns that may indicate a network or system attack."]
[null,"Intrusion Protection System (IPS)","A more sophisticated Intrusion Detection System (IDS) that allows administrators to configure predefined actions to be taken if suspicious activity is detected."]
[null,"Inventory","An itemized list of current assets."]
[null,"Local Backup","A method for backing up data on the local system. For example, an attached tape or storage device."]
[null,"Main Distribution Frame","A wiring rack that connects outside lines with internal lines. Main distribution frames are used to connect public or private lines entering the building to the respondent’s internal networks"]
[null,"Map of Dependencies","A diagram that illustrates how a business process relates to its supporting capabilities. (“Supporting capabilities” include: people involved in the delivery of the business process, application software, middleware software, servers, storage, networking, physical facilities, and people involved in the IT and physical infrastructure management.)"]
[null,"Master Change Log","A document or database that contains a report of each change initiation request (CIR) (approved or rejected). The document or database must contain:\n - Reference to a CIR\n - Date submitted\n - Date of change\n - Name of affected system\n - Approval status (approved or rejected)"]
[null,"MD5","A one-way cryptographic hash algorithm that produces a unique 128-bit alphanumeric fingerprint of its input."]
[null,"Mobile Code","Software code that is transferred from one computer to another and that executes automatically. Examples of mobile code include scripts (JavaScript, VBScript), Java applets, ActiveX controls, Flash animations, Shockwave movies (and Xtras), and macros embedded in Microsoft Office documents."]
[null,"Modem","A device that allows a computer or terminal to transmit data over an analog telephone line."]
[null,"Network Address Translation (NAT)","A process of rewriting the source and/or destination addresses of IP packets as they pass through a network device."]
[null,"Network Devices","Units that mediate data in a computer network. Computer networking devices are also called network equipment, Intermediate Systems (IS) or InterWorking Unit (IWU)."]
[null,"Network Segment","A portion of a computer network that is separated from the remainder of the network by a device such as a repeater, hub, bridge, switch or router. Each segment may contain one or multiple computers or other hosts. Network segments are typically established for throughput and/or security reasons."]
[null,"Network time protocol (NTP)","A protocol designed to synchronize the clocks of computers over a network."]
[null,"Node","Any physical device with a unique network address."]
[null,"Non-Employees","Auditors, consultants, contractors, and vendors."]
[null,"Owner","An individual or entity that has approved management responsibility for controlling the production, development, maintenance, use and security of the assets. Ownership is not an indication of property rights to the asset."]
[null,"Ownership","A formally assigned responsibility for a given asset."]
[null,"Penetration Testing","A conventional security control and the one most widely used by software vendors."]
[null,"Personal Identification Number (PIN)","A secret shared between a user and a system that can be used to authenticate the user to the system."]
[null,"Physical Media","Any portable device or substance (e.g., paper) used to store data for specific and legitimate purposes. Examples of physical media include:\n - Magnetic tapes and disks\n - Cartridges, including 9-track, DAT, and VHS\n - Optical disks in CD and DVD format\n - Microfilm/fiche\n - Paper (e.g., computer-generated reports and other printouts)\n - Static memory devices, such as USB memory sticks"]
[null,"Port Scan","A systematic scan of a computer's ports that identifies open doors. Used in managing networks, port scanning also can be used maliciously to find a weakened access point from which to break into computer."]
[null,"Post-Deployment Test Document","A document that provides evidence that the change was tested and approved in the production environment. The document must contain:\n - Reference to a CIR\n - Identified deployment resources\n - Deployment start date\n - Deployment end date\n - Expected results\n - Actual results\n - Approval signature\n - Approval date"]
[null,"Power Redundancy","Any type of power delivery mechanism that provides continuous power to connected systems in the event of a failure in the main delivery mechanism for electricity. Such mechanisms include multiple electric feeds, automatic failover generators, and uninterruptible power supplies."]
[null,"Pre-Deployment Test Document","A document (electronic or paper) that provides evidence that the requested changes were tested prior to deployment in the production environment. A pre-deployment test document is inspected for:\n - Reference to a CIR\n - Identified testing resources\n - Testing start date\n - Testing end date\n - Expected test results\n - Actual test results"]
[null,"Protocol","A set of rules and formats that enable the proper exchange of information between different systems."]
[null,"Publicly Accessible","In networking terms, able to accept a connection originating from the public domain, e.g., the Internet."]
[null,"Quality Analysis and User Acceptance Testing (QA UAT)","Testing the quality of a software product and can be done by user acceptance testing. In functional testing and system testing, a company would perform all tests with an attitude to break it. In your UAT, the user would run through real-life examples being focused on how the user would actually utilize the product."]
[null,"Raised Floor","Used in data center construction, a raised floor above the \"true\" floor allows air conditioning flow and wiring to pass freely under equipment. The space between the true and raised floors is accessed by removable floor tiles."]
[null,"Receiver Company","The organization that has contracted with a service provider for a specific service."]
[null,"Residual Risk Rating Scoring Method","A calculation of the risk that remains after security controls have been applied."]
[null,"Risk Prioritization Scoring Method","A systematic approach that quantifies risk in terms of loss potential, then sequences individual risks to determine the order in which compensating controls should be implemented."]
[null,"Sanctions Check","In most countries, organizations are prohibited by law from doing business with drugs and arms merchants and terrorist organizations.  Sanctions lists ranging from OFAC to the EU Consolidated Lists to the Interpol Most Wanted to the Hong Kong and Singapore Monetary Authority exist.  Part of due diligence in vendor selection should include screening of the third party against sanctions lists."]
[null,"Scoped Systems and Data","Computer hardware, software and/or Non-Public Personal Information that is stored, transmitted, or processed by the service provider in scope for the engagement."]
[null,"Scoping Meeting","A meeting held prior to commencement of a Shared Assessments engagement, to determine the Scoped Systems and Data to be included in a company's Standardized Information Gathering Questionnaire (SIG) and Agreed Upon Procedures (AUP) assessment."]
[null,"Secure Code Review","The process of identifying whether software code meets the respondent's security requirements."]
[null,"Secure Perimeter","A space fully enclosed by walls that surround the immediate perimeter and that extend from floor to ceiling (beyond raised floors and ceilings), which is contained, and whose points of entry are secured."]
[null,"Secure Socket Layer (SSL)","A protocol developed by Netscape for transmitting private documents via the Internet. SSL uses a cryptographic system with two keys to encrypt data: a public key known to everyone and a private or secret key known only to the recipient of the message."]
[null,"Secure Workspace","An environment from where people work from their desks with the purpose of accessing, editing or inputting Scoped Systems and Data on a computer, telephone or physical media, e.g., a BPO or call center environment."]
[null,"Secure Workspace Perimeter","A space fully enclosed by walls that surround the Secure Workspace which is contained, and whose points of entry and exit are secured."]
[null,"Security Architecture Risk Analysis","Defines concepts, methods, and techniques for analyzing the architecture and design of software systems for security flaws."]
[null,"Security Policy","A published document or set of documents defining requirements for one or more aspects of information security."]
[null,"Server","A computer that makes services, such as access to data files, programs, and peripheral devices, available to workstations on a network."]
[null,"Service Provider","An subcontractor that provides outsourced services, such as data processing, business operations, applications, systems or staffing."]
[null,"Service Set Identifier (SSID)","A 32-character unique identifier attached to the header of packets sent over a wide area network to identify each packet as part of that network."]
[null,"Simple Mail Transfer Protocol (SMTP)","The de facto standard for email transmissions across the Internet."]
[null,"Smoke Detector","A mechanical device that is sensitive to the presence of smoke or particulate material in the air that transmits a signal to a measuring or control instrument."]
[null,"Software","Vendor developed software code used for custom or commercial-off-the-shelf purposes."]
[null,"Software Architecture","The process of defining a structured software solution that meets all of the technical and operational requirements, while optimizing common quality attributes such as performance, security, and manageability."]
[null,"Software Development Life Cycle (SDLC)","A series of processes which provide a model for the development and lifecycle management of Software Applications."]
[null,"Software Security Group","A group whose charter is to assist in the design, review and implementation of software that protects the information and resources contained in and controlled by that software."]
[null,"Status Change","Change to employment status that is recorded by human resources, such as promotions, demotions or departmental changes."]
[null,"Stewardship","The act of managing and maintaining a given asset."]
[null,"Strong Password","Password length must be a minimum of seven (7) characters, must not to contain a common usage word or a word found in the English dictionary, may not contain user name, any part of a full name or access level of the user and must contain characters from at least three (3) of the following four (4) classes of characters:\n • Upper case letters (A, B, C, ….Z)\n • Lower case letters (a, b, c, ….z)\n • Numbers (0,1, 2, …9)\n • Non-alphanumeric (\"special characters\") such as punctuation symbols"]
[null,"Subcontractor"," is a business or an individual that signs a contract to perform part or all of the obligations of another's contract."]
[null,"System Owner","The business unit that retains financial ownership or decision rights for the business use of the asset."]
[null,"System Steward","The primary assigned administrator responsible for maintenance and day-to-day tasks that support the business."]
[null,"Third Party","All entities or persons that work on behalf of the organization but are not its employees, including consultants, contingent workers, clients, business partners, service providers, subcontractors, vendors, suppliers, affiliates and any other person or entity that accesses Scoped Systems and Data."]
[null,"Threat Impact Calculation Method","A systematic method of determining the loss potential of a particular threat, based on the value of assets affected."]
[null,"Threat Modeling","Threat modeling allows you to systematically identify and rate the threats that are most likely to affect your system. By identifying and rating threats based on a solid understanding of the architecture and implementation of your application, you can address threats with appropriate countermeasures in a logical order, starting with the threats that present the greatest risk.\n\nThreat modeling has a structured approach that is far more cost efficient and effective than applying security features in a haphazard manner without knowing precisely what threats each feature is supposed to address."]
[null,"Threat Probability Calculation Method","A systematic method of determining the potential for a particular threat to occur, based on the likelihood of the occurrence collected from internal staff, past records, and official security records.\n Threats x Vulnerability x Asset Value = Total Risk\n (Threats x Vulnerability x Asset Value) x Controls Gap = Residual Risk"]
[null,"Token","A unique identifier generated on both a host and small, user-held device that allows the user to authenticate to the host."]
[null,"True Ceiling","The permanent overhead interior surface of a room, constructed of solid building materials offering resistance to and evidence of unauthorized entry."]
[null,"True Floor","The permanent bottom interior surface of a room, constructed of solid building materials offering resistance to and evidence of unauthorized entry."]
[null,"Unapproved","Operating without consent."]
[null,"Unidentified","Being or having an unknown or unnamed source."]
[null,"Uninterruptible Power Supply (UPS)","A power supply consisting of a bank of batteries, which is continually charged. When power fails, the UPS becomes the source of electrical current for computer equipment until the batteries are discharged. A UPS is often connected to a generator that can provide electrical power indefinitely."]
[null,"Vibration Alarm Sensor","An alarm that responds to vibrations in the surface onto which it is mounted. A normally closed switch momentarily opens when the sensor is subjected to a vibration of sufficiently large amplitude."]
[null,"Virtual Private Network (VPN)","A communication tunnel running through a shared network, such as the Internet, which uses encryption and other security mechanisms to ensure the data cannot be intercepted and that the data senders and receivers are authenticated."]
[null,"Volumetric Alarm Sensor","An alarm sensor designed and employed to detect an unauthorized person in a confined space when the space is normally unoccupied. Such alarms include ultrasonic, microwave, and infrared sensors."]
[null,"War Walk","Also known as \"war drive,\" using a laptop to \"sniff\" for wireless access points. War walking may be used to locate a public access point for personal use or as a controls assessment to identify access points that are inadequately secured and may indicate an elevated risk of breach."]
[null,"Warm Site","A remote facility which replicates production data in set intervals."]
[null,"Water Sensor","A mechanical device sensitive to the presence of water or moisture that transmits a signal to a measuring or control instrument."]
[null,"Workstation","(1) Single-user computers typically linked together to form a local area network, that can also be used as standalone systems. (2) In networking, any computer connected to a local area network, including a workstation or personal computer."]

{"sheet":"Formula Notes","index":25,"n_rows":44,"n_cols":4,"rows_kept":44,"cut":false,"hidden":false,"merged":[]}
["Formula Notes"]
["Column","Description"]
["A\n<Serial No>","This is a unique record for a question. This value is sequential starting with one on Tab A to the end of questions on last tab. Any row that is not a question will not have a number. The highest value used as a unique identifier is located on this tab in cell C22 (below)."]
["A4","Calculates the highest serial number on the tab. This tab cell C21 identifies the highest serial number used so new question serial numbers can be used. Retired serial numbers are never re-used."]
["D\nConditional Formatting\n<Response>","The conditional formatting looks in column J and U to determine the background of the cell. If the value in column J =1, conditional formatting sets the background to a hash (no response required) to indicated the top of a table question. If the value in column U = 1 the background will be green indicating a \"Yes\" response. If the value in column U = 2 than the background will turn orange indicating a \"No\" response. If the value in column U = 3 the background turns violet to indicate an N/A response. The default background is light blue.",null,"If this SIG will be a master SIG to be used with the SMT, select Master below. If this SIG will be distributed leave blank."]
["E\nConditional Formatting\n<Additional Information>","The conditional formatting looks in column J. If the value in column J =1, conditional formatting sets the background to a hash (no response required) to indicated the top of a table question."]
["I\n<Q Depth>","Values in this column indicate the depth (number of decimal places) the question has."]
["J\n<Table ID>","A value of \"1\" in this cell indicate the top of a table."]
["K\n<1>","This formula is used to calculate the first digit of the question number. It looks to see if there is a value in the cell above, if not it assumes the value should be a 1. Next it looks to see if the depth is 1, If so, it will increment by one, if not it pulls down the value from the cell above."]
["L - O\n<2 - 5>","This formula is used to calculate the second through fifth digits of the question number. It first looks at the cell above and if blank it assumes a 0. If not blank, it looks at it's next highest neighbor above to see if there is a transition, it there is a transition then it resets to 0, Lastly it looks at the question depth to see if it is the same depth as above. If so it increments, if not it will pull down the value from above."]
["P\n<HL Ans>","This formula is used to carry over and convert the answer from the Lite tab to a number on the detail tabs. The VLOOKUP will search the L2_Array named field to find the question serial number and bring back the answer number in that array. For proper SMT operation, if Master (this tab, E5) is selected then high level responses are ignored."]
["Q\n<Loc Ans>","This formula converts the local answer to a number. It first checks to see if the depth is not blank. If it is then assumes the answer should be blank. If the depth field is not blank the formula converts the local answer to a number. 0 = No answer, 1 = \"Yes\", 2 = \"No\" and 3 = \"N/A\"."]
["R\n<Comb Ans>","This formula is used to combine the high level answer and the local answer. If the question depth is blank a blank is assumed. Responses are evaluated in the following order 1st - Lite, 2nd - local response."]
["S\n<Table Calc (Tot Q#)>","The value in this cell determines if the question is actually a question or if it is part of a response list for a question. The logic looks above, below and in column H to make the determination."]
["T\n<Q Carry Dn>","This formula carries parent responses down to it's children. It first looks for a blank in the question depth and if blank will carry down the value from above. If the question has been answered it will bring over the question depth. If the questions not answered it will compare the local question depth to the previous value if the depth is greater the previous value will be carried down, if not it will turn to 0."]
["U\n<Resp Calc>","This formula works with the Q Carry Dn formula to carry the value of the response down. If response is No or N/A those responses values are carried down to the next parent question. For proper SMT operation, if Master is selected (this tab, E5) response carry down is disabled."]
["V\n<T Carry Dn>","The value in this cell identifies if a question in a table has been answered. If any value in a response list is answered the result will be rolled up the next cell until it reaches the list identifier."]
["W\n<Final Ans>","The result in this cell determines if a question has been answered and is used to count the actual questions answered not answers as part of a response list. This is a simple AND function to combine the values in columns T, S and V."]
["X\n<HL Chk>","Identifies if the question is duplicated on the Lite tab"]
[]
["Column (Cell)","Formula","Highest Ser #"]
["A","Hard coded, unique serial number (Rows without questions have no serial numbers)",{"$f":"MAX('Business Information'!A3,Documentation!A2,Lite!A4,'A. Risk Management'!A4,'B. Security Policy'!A4,'C. Organizational Security'!A4,'D. Asset Management'!A4,'E. Human Resource Security'!A4,'F. Physical and Environmental'!A4,'G. Communications and Ops Mgmt'!A4,'H. Access Control'!A4,'I. Info Sys AD&M'!A4,'J. Incident Event & Comm Mgmt'!A4,'K. BC DR'!A4,'L. Compliance'!A4, 'M. Mobile'!A4,'P. Privacy'!A4,'Q. Software Security'!A4,'V. Cloud Security'!A4)","v":4013}]
["A4 (some tabs location is different)","MAX(An:An)"]
["D Conditional Formatting"]
["E Conditional Formatting"]
["I","Manually entered question depth value (0 - 5)"]
["J","Manually entered table top identifier (if 1 than table top)"]
["K","IF(Kn-1=\"\",1,IF(In=1,Kn-1+1,Kn-1))"]
["L (M - O) are similar ","IF(Ln-1=\"\",0,IF(Kn-1<>Kn,0,IF($In=2,Ln-1+1,Ln-1)))"]
["P","IF(OR(Master=\"Master\",In=0,Jn=1),0,IF(ISNA(VLOOKUP(An,L2_Array,21,FALSE)),0,VLOOKUP(An,L2_Array,21,FALSE)))"]
["Q","IF(In=\"\",\"\",IF(Dn=\"Yes\",1,IF(Dn=\"No\",2,IF(Dn=\"N/A\",3,0))))"]
["R","IF(In=\"\",\"\",IF(Pn>0,Pn,IF(Qn>0,Qn,0)))"]
["S","IF(OR(In=\"\",In=0),\"\",IF(OR(In=1,Sn-1=\"\"),1,IF(OR(AND(Jn-1=1,(In-In-2<>0)),AND(Sn-1=0,In-1=I5),AND(Jn-1=1,In=In-2)),0,1)))"]
["T","IF(In=\"\",Tn-1,IF(AND(Rn>1,OR(Tn-1=\"\",Tn-1=0,Tn-1>=In)),In,IF(In>Tn-1,Tn-1,0)))"]
["U","IF(Master=\"Master\",Qn,IF(Un-1=\"\",Rn,IF(OR(AND(Tn>0,Rn<Un-1),AND(Tn=1,Rn<=Un-1)),Un-1,Rn)))"]
["V","IF(In=\"\",\"\",IF(OR(AND(Sn-1=1,Tn=1),Rn>0,AND(Sn+1=0,Vn+1=1)),1,0))"]
["W","IF(In=\"\",\"\",IF(OR(AND(Tn>0,Sn=1),AND(Sn=1,Vn=1)),1,0))"]
["X","IF(ISNA(VLOOKUP(An,L2_Array,1,FALSE)),\"\",1)"]
[]
["Named Range","Formula"]
["Master","Formula Notes'!$D$5"]
["L2_Array","Lv2_Questions!$A$4:$U$568"]
["SIG_Data","Full!$E$3:$H$951"]
["Sheet Protection","8X38YyAC"]

{"sheet":"Full","index":26,"n_rows":1696,"n_cols":17,"rows_kept":1696,"cut":false,"hidden":false,"merged":[]}
["Ser No.","Depth","Table","SL ID","Ques Num","SIG Question Text","Response","Additional Information","AUP 2015 Relevance","ISO 27002:2013 Relevance",null,"Binary",null,"PCI 3.0","FFIEC","COBIT 4.1 Relevance","Shared Assessments Program Cloud Computing White Paper Description"]
[{"$f":"'A. Risk Management'!B1","v":"A. Risk Assessment and Treatment"},null,null,null,{"$f":"'A. Risk Management'!B1","v":"A. Risk Assessment and Treatment"}]
[{"$f":"'A. Risk Management'!A5","v":3198},{"$f":"'A. Risk Management'!I5","v":1},{"$f":"'A. Risk Management'!J5","v":0},{"$f":"'A. Risk Management'!X5","v":1},{"$f":"'A. Risk Management'!B5","v":"A.1"},{"$f":"'A. Risk Management'!C5","v":"Is there a risk assessment program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the program? if yes, does it include:"},{"$f":"'A. Risk Management'!D5","v":"Yes"},{"$f":"'A. Risk Management'!E5","v":"Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'A. Risk Management'!F5","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!G5","v":"5.1                                            6.1.2"},{"$f":"'A. Risk Management'!H5","v":"Leadership & Commitment,                Information Security Risk Assessment"},null,null,12.2,"IS.1.3.1 BCP.1.2.1 BCP.1.3.5 MGMT.1.6.1.1 OPS.1.3","PO9.4"]
[{"$f":"'A. Risk Management'!A6","v":2409},{"$f":"'A. Risk Management'!I6","v":2},{"$f":"'A. Risk Management'!J6","v":0},{"$f":"'A. Risk Management'!X6","v":0},{"$f":"'A. Risk Management'!B6","v":"A.1.1"},{"$f":"'A. Risk Management'!C6","v":"A risk assessment, conducted within the last 12 months?"},{"$f":"'A. Risk Management'!D6","v":"Yes"},{"$f":"'A. Risk Management'!E6","v":"Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'A. Risk Management'!F6","v":"A.2 IT & Infrastructure Risk Assessment Life Cycle"},{"$f":"'A. Risk Management'!G6","v":8.1999999999999993},{"$f":"'A. Risk Management'!H6","v":" Information security risk assessment"},"PO9.1","IT and business risk management alignment management process","12.2.b","IS.1.3.1.3 D&A.1.4.1.1 AUDIT.1.7.1.1","PO9.1, PO9.2, PO9.4, DS4.1, DS4.3"]
[{"$f":"'A. Risk Management'!A7","v":2325},{"$f":"'A. Risk Management'!I7","v":2},{"$f":"'A. Risk Management'!J7","v":0},{"$f":"'A. Risk Management'!X7","v":0},{"$f":"'A. Risk Management'!B7","v":"A.1.2"},{"$f":"'A. Risk Management'!C7","v":"Risk Governance?"},{"$f":"'A. Risk Management'!D7","v":"Yes"},{"$f":"'A. Risk Management'!E7","v":"Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'A. Risk Management'!F7","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!G7","v":"N/A"},{"$f":"'A. Risk Management'!H7","v":0},null,null,"12.2.a","N/A","N/A"]
[{"$f":"'A. Risk Management'!A8","v":2326},{"$f":"'A. Risk Management'!I8","v":2},{"$f":"'A. Risk Management'!J8","v":0},null,{"$f":"'A. Risk Management'!B8","v":"A.1.3"},{"$f":"'A. Risk Management'!C8","v":"Range of assets to include: people, processes, data and technology?"},{"$f":"'A. Risk Management'!D8","v":"Yes"},{"$f":"'A. Risk Management'!E8","v":"Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'A. Risk Management'!F8","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!G8","v":"N/A"},{"$f":"'A. Risk Management'!H8","v":0},null,null,"N/A","IS.1.3.1.1 MGMT.1.5.2.1","N/A"]
[{"$f":"'A. Risk Management'!A9","v":2420},{"$f":"'A. Risk Management'!I9","v":2},{"$f":"'A. Risk Management'!J9","v":0},{"$f":"'A. Risk Management'!X9","v":0},{"$f":"'A. Risk Management'!B9","v":"A.1.4"},{"$f":"'A. Risk Management'!C9","v":"Range of threats to include: malicious, natural, accidental, business changes (transaction volume)?"},{"$f":"'A. Risk Management'!D9","v":"Yes"},{"$f":"'A. Risk Management'!E9","v":"Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'A. Risk Management'!F9","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!G9","v":"6.1.2"},{"$f":"'A. Risk Management'!H9","v":"Information Security Risk Assessment"},null,null,"N/A","N/A","N/A"]
[{"$f":"'A. Risk Management'!A10","v":2425},{"$f":"'A. Risk Management'!I10","v":2},{"$f":"'A. Risk Management'!J10","v":0},{"$f":"'A. Risk Management'!X10","v":0},{"$f":"'A. Risk Management'!B10","v":"A.1.5"},{"$f":"'A. Risk Management'!C10","v":"Risk scoping?"},{"$f":"'A. Risk Management'!D10","v":"Yes"},{"$f":"'A. Risk Management'!E10","v":"Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'A. Risk Management'!F10","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!G10","v":"6.1.2"},{"$f":"'A. Risk Management'!H10","v":"Information Security Risk Assessment"},null,null,"N/A","N/A","PO9.4"]
[{"$f":"'A. Risk Management'!A11","v":2426},{"$f":"'A. Risk Management'!I11","v":2},{"$f":"'A. Risk Management'!J11","v":0},{"$f":"'A. Risk Management'!X11","v":0},{"$f":"'A. Risk Management'!B11","v":"A.1.6"},{"$f":"'A. Risk Management'!C11","v":"Risk context?"},{"$f":"'A. Risk Management'!D11","v":"Yes"},{"$f":"'A. Risk Management'!E11","v":"Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'A. Risk Management'!F11","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!G11","v":"6.1.2"},{"$f":"'A. Risk Management'!H11","v":"Information Security Risk Assessment"},null,null,"N/A","N/A","PO9.4"]
[{"$f":"'A. Risk Management'!A12","v":2427},{"$f":"'A. Risk Management'!I12","v":2},{"$f":"'A. Risk Management'!J12","v":0},{"$f":"'A. Risk Management'!X12","v":0},{"$f":"'A. Risk Management'!B12","v":"A.1.7"},{"$f":"'A. Risk Management'!C12","v":"Risk training plan?"},{"$f":"'A. Risk Management'!D12","v":"Yes"},{"$f":"'A. Risk Management'!E12","v":"Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'A. Risk Management'!F12","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!G12","v":"6.1.2"},{"$f":"'A. Risk Management'!H12","v":"Information Security Risk Assessment"},null,null,"N/A","N/A","PO9.4"]
[{"$f":"'A. Risk Management'!A13","v":2431},{"$f":"'A. Risk Management'!I13","v":2},{"$f":"'A. Risk Management'!J13","v":0},{"$f":"'A. Risk Management'!X13","v":0},{"$f":"'A. Risk Management'!B13","v":"A.1.8"},{"$f":"'A. Risk Management'!C13","v":"Risk evaluation criteria?"},{"$f":"'A. Risk Management'!D13","v":"Yes"},{"$f":"'A. Risk Management'!E13","v":"Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'A. Risk Management'!F13","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!G13","v":"6.1.2"},{"$f":"'A. Risk Management'!H13","v":"Information Security Risk Assessment"},null,null,"N/A","N/A","PO9.4"]
[{"$f":"'A. Risk Management'!A14","v":2429},{"$f":"'A. Risk Management'!I14","v":2},{"$f":"'A. Risk Management'!J14","v":0},{"$f":"'A. Risk Management'!X14","v":0},{"$f":"'A. Risk Management'!B14","v":"A.1.9"},{"$f":"'A. Risk Management'!C14","v":"Risk scenarios? If yes:"},{"$f":"'A. Risk Management'!D14","v":"No"},{"$f":"'A. Risk Management'!E14","v":0},{"$f":"'A. Risk Management'!F14","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!G14","v":"6.1.2"},{"$f":"'A. Risk Management'!H14","v":"Information Security Risk Assessment"},null,null,"N/A","MGMT.1.5.2.1","N/A"]
[{"$f":"'A. Risk Management'!A15","v":2430},{"$f":"'A. Risk Management'!I15","v":3},{"$f":"'A. Risk Management'!J15","v":0},{"$f":"'A. Risk Management'!X15","v":0},{"$f":"'A. Risk Management'!B15","v":"A.1.9.1"},{"$f":"'A. Risk Management'!C15","v":"Have scenarios been created for a variety of events with a range of possible threats that could impact the range of assets?"},{"$f":"'A. Risk Management'!D15","v":0},{"$f":"'A. Risk Management'!E15","v":0},{"$f":"'A. Risk Management'!F15","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!G15","v":"6.1.2"},{"$f":"'A. Risk Management'!H15","v":"Information Security Risk Assessment"},null,null,"N/A","IS.1.3.1.4","N/A"]
[{"$f":"'A. Risk Management'!A16","v":2428},{"$f":"'A. Risk Management'!I16","v":3},{"$f":"'A. Risk Management'!J16","v":0},{"$f":"'A. Risk Management'!X16","v":0},{"$f":"'A. Risk Management'!B16","v":"A.1.9.2"},{"$f":"'A. Risk Management'!C16","v":"Do the scenarios include threat types impacting all assets resulting in business impact?"},{"$f":"'A. Risk Management'!D16","v":0},{"$f":"'A. Risk Management'!E16","v":0},{"$f":"'A. Risk Management'!F16","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!G16","v":"6.1.2"},{"$f":"'A. Risk Management'!H16","v":"Information Security Risk Assessment"},null,null,"N/A","N/A","PO9.4"]
[{"$f":"'A. Risk Management'!A17","v":3285},{"$f":"'A. Risk Management'!I17","v":2},{"$f":"'A. Risk Management'!J17","v":0},{"$f":"'A. Risk Management'!X17","v":0},{"$f":"'A. Risk Management'!B17","v":"A.1.10"},{"$f":"'A. Risk Management'!C17","v":"Ownership, action plan, response plan, management update?"},{"$f":"'A. Risk Management'!D17","v":"Yes"},{"$f":"'A. Risk Management'!E17","v":"Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'A. Risk Management'!F17","v":"A.2 IT & Infrastructure Risk Assessment Life Cycle"},{"$f":"'A. Risk Management'!G17","v":"6.1.2"},{"$f":"'A. Risk Management'!H17","v":"Information Security Risk Assessment"},null,null,"N/A","N/A","N/A"]
[{"$f":"'A. Risk Management'!A18","v":3286},{"$f":"'A. Risk Management'!I18","v":1},{"$f":"'A. Risk Management'!J18","v":0},{"$f":"'A. Risk Management'!X18","v":0},{"$f":"'A. Risk Management'!B18","v":"A.2"},{"$f":"'A. Risk Management'!C18","v":"Are controls identified for each risk classified as: preventive, detective, corrective, predictive (technical or administrative controls)?"},{"$f":"'A. Risk Management'!D18","v":"No"},{"$f":"'A. Risk Management'!E18","v":0},{"$f":"'A. Risk Management'!F18","v":"A.2 IT & Infrastructure Risk Assessment Life Cycle"},{"$f":"'A. Risk Management'!G18","v":"6.1.3"},{"$f":"'A. Risk Management'!H18","v":"Information Security Risk treatment"},null,null,"N/A","IS.1.3.2","PO9.4"]
[{"$f":"'A. Risk Management'!A19","v":0},{"$f":"'A. Risk Management'!I19","v":0},{"$f":"'A. Risk Management'!J19","v":0},{"$f":"'A. Risk Management'!X19","v":0},{"$f":"'A. Risk Management'!B19","v":0},{"$f":"'A. Risk Management'!C19","v":0},{"$f":"'A. Risk Management'!D19","v":0},{"$f":"'A. Risk Management'!E19","v":0},{"$f":"'A. Risk Management'!F19","v":0},{"$f":"'A. Risk Management'!G19","v":0},{"$f":"'A. Risk Management'!H19","v":0}]
[]
[{"$f":"'B. Security Policy'!B1","v":"B. Security Policy"},null,null,null,{"$f":"'B. Security Policy'!B1","v":"B. Security Policy"}]
[{"$f":"'B. Security Policy'!A5","v":3199},{"$f":"'B. Security Policy'!I5","v":1},{"$f":"'B. Security Policy'!J5","v":0},{"$f":"'B. Security Policy'!X5","v":1},{"$f":"'B. Security Policy'!B5","v":"B.1"},{"$f":"'B. Security Policy'!C5","v":"Is there an information security policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy? If yes, does the policy contain:"},{"$f":"'B. Security Policy'!D5","v":"Yes"},{"$f":"'B. Security Policy'!E5","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'B. Security Policy'!F5","v":"B.1 Information Security Policy Content & Maintenance"},{"$f":"'B. Security Policy'!G5","v":"5.1.1"},{"$f":"'B. Security Policy'!H5","v":"Policies for information security"},"PO6.1","IT policy and control environment","5.4, 12.1","IS.1.4.1","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'B. Security Policy'!A6","v":2467},{"$f":"'B. Security Policy'!I6","v":2},{"$f":"'B. Security Policy'!J6","v":0},{"$f":"'B. Security Policy'!X6","v":0},{"$f":"'B. Security Policy'!B6","v":"B.1.1"},{"$f":"'B. Security Policy'!C6","v":"Risk assessment?"},{"$f":"'B. Security Policy'!D6","v":"Yes"},{"$f":"'B. Security Policy'!E6","v":"Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'B. Security Policy'!F6","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'B. Security Policy'!G6","v":0},{"$f":"'B. Security Policy'!H6","v":0},"PO6.1","IT policy and control environment",12.2,"IS.1.3.3.5","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'B. Security Policy'!A7","v":45},{"$f":"'B. Security Policy'!I7","v":2},{"$f":"'B. Security Policy'!J7","v":0},{"$f":"'B. Security Policy'!X7","v":0},{"$f":"'B. Security Policy'!B7","v":"B.1.2"},{"$f":"'B. Security Policy'!C7","v":"Risk management?"},{"$f":"'B. Security Policy'!D7","v":"Yes"},{"$f":"'B. Security Policy'!E7","v":"Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'B. Security Policy'!F7","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'B. Security Policy'!G7","v":0},{"$f":"'B. Security Policy'!H7","v":0},"PO6.1","IT policy and control environment",12.2,"N/A","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'B. Security Policy'!A8","v":47},{"$f":"'B. Security Policy'!I8","v":2},{"$f":"'B. Security Policy'!J8","v":0},{"$f":"'B. Security Policy'!X8","v":0},{"$f":"'B. Security Policy'!B8","v":"B.1.3"},{"$f":"'B. Security Policy'!C8","v":"Security awareness training/education?"},{"$f":"'B. Security Policy'!D8","v":"Yes"},{"$f":"'B. Security Policy'!E8","v":"Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'B. Security Policy'!F8","v":"B.1 Procedure: b.3"},{"$f":"'B. Security Policy'!G8","v":0},{"$f":"'B. Security Policy'!H8","v":0},"PO6.1","IT policy and control environment",12.6,"N/A","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'B. Security Policy'!A9","v":24},{"$f":"'B. Security Policy'!I9","v":2},{"$f":"'B. Security Policy'!J9","v":0},{"$f":"'B. Security Policy'!X9","v":0},{"$f":"'B. Security Policy'!B9","v":"B.1.4"},{"$f":"'B. Security Policy'!C9","v":"Business continuity?"},{"$f":"'B. Security Policy'!D9","v":"Yes"},{"$f":"'B. Security Policy'!E9","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'B. Security Policy'!F9","v":"B.1 Procedure: b.9"},{"$f":"'B. Security Policy'!G9","v":0},{"$f":"'B. Security Policy'!H9","v":0},"PO6.1","IT policy and control environment","N/A","IS.1.4.1.12 BCP.1.4.3.1","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'B. Security Policy'!A10","v":57},{"$f":"'B. Security Policy'!I10","v":2},{"$f":"'B. Security Policy'!J10","v":0},{"$f":"'B. Security Policy'!X10","v":0},{"$f":"'B. Security Policy'!B10","v":"B.1.5"},{"$f":"'B. Security Policy'!C10","v":"Consequences for non-compliance with corporate policies?"},{"$f":"'B. Security Policy'!D10","v":"Yes"},{"$f":"'B. Security Policy'!E10","v":"Cloudamize Security Policy - Cloudamize Information Secuirty Policy - Non-Compliance"},{"$f":"'B. Security Policy'!F10","v":0},{"$f":"'B. Security Policy'!G10","v":0},{"$f":"'B. Security Policy'!H10","v":0},"PO6.1","IT policy and control environment","N/A","IS.1.4.2.2","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'B. Security Policy'!A11","v":2469},{"$f":"'B. Security Policy'!I11","v":2},{"$f":"'B. Security Policy'!J11","v":0},{"$f":"'B. Security Policy'!X11","v":0},{"$f":"'B. Security Policy'!B11","v":"B.1.6"},{"$f":"'B. Security Policy'!C11","v":"Responsibilities for information security management?"},{"$f":"'B. Security Policy'!D11","v":"Yes"},{"$f":"'B. Security Policy'!E11","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'B. Security Policy'!F11","v":0},{"$f":"'B. Security Policy'!G11","v":"5.1.1"},{"$f":"'B. Security Policy'!H11","v":"Policies for information security"},"PO6.1","IT policy and control environment",12.4,"N/A","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'B. Security Policy'!A12","v":21},{"$f":"'B. Security Policy'!I12","v":2},{"$f":"'B. Security Policy'!J12","v":0},{"$f":"'B. Security Policy'!X12","v":0},{"$f":"'B. Security Policy'!B12","v":"B.1.7"},{"$f":"'B. Security Policy'!C12","v":"Acceptable use?"},{"$f":"'B. Security Policy'!D12","v":"Yes"},{"$f":"'B. Security Policy'!E12","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'B. Security Policy'!F12","v":"B.1 Procedure: b.3"},{"$f":"'B. Security Policy'!G12","v":"5.1.1"},{"$f":"'B. Security Policy'!H12","v":"Policies for information security"},"PO4.10","Supervision","12.3.5","IS.1.4.1.1.1","PO4.10, PO6.2"]
[{"$f":"'B. Security Policy'!A13","v":22},{"$f":"'B. Security Policy'!I13","v":2},{"$f":"'B. Security Policy'!J13","v":0},{"$f":"'B. Security Policy'!X13","v":0},{"$f":"'B. Security Policy'!B13","v":"B.1.8"},{"$f":"'B. Security Policy'!C13","v":"Access control?"},{"$f":"'B. Security Policy'!D13","v":"Yes"},{"$f":"'B. Security Policy'!E13","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'B. Security Policy'!F13","v":0},{"$f":"'B. Security Policy'!G13","v":"5.1.1"},{"$f":"'B. Security Policy'!H13","v":"Policies for information security"},null,null,"8,12.5.5","IS.1.4.1.1","N/A"]
[{"$f":"'B. Security Policy'!A14","v":23},{"$f":"'B. Security Policy'!I14","v":2},{"$f":"'B. Security Policy'!J14","v":0},{"$f":"'B. Security Policy'!X14","v":0},{"$f":"'B. Security Policy'!B14","v":"B.1.9"},{"$f":"'B. Security Policy'!C14","v":"Application security?"},{"$f":"'B. Security Policy'!D14","v":"Yes"},{"$f":"'B. Security Policy'!E14","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'B. Security Policy'!F14","v":0},{"$f":"'B. Security Policy'!G14","v":0},{"$f":"'B. Security Policy'!H14","v":0},null,null,"6.3.b","IS.1.4.1.3.3","N/A"]
[{"$f":"'B. Security Policy'!A15","v":25},{"$f":"'B. Security Policy'!I15","v":2},{"$f":"'B. Security Policy'!J15","v":0},{"$f":"'B. Security Policy'!X15","v":0},{"$f":"'B. Security Policy'!B15","v":"B.1.10"},{"$f":"'B. Security Policy'!C15","v":"Change control?"},{"$f":"'B. Security Policy'!D15","v":"Yes"},{"$f":"'B. Security Policy'!E15","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'B. Security Policy'!F15","v":0},{"$f":"'B. Security Policy'!G15","v":0},{"$f":"'B. Security Policy'!H15","v":0},null,null,"6.3.2, 6.4.5","IS.1.4.1.8","N/A"]
[{"$f":"'B. Security Policy'!A16","v":26},{"$f":"'B. Security Policy'!I16","v":2},{"$f":"'B. Security Policy'!J16","v":0},{"$f":"'B. Security Policy'!X16","v":0},{"$f":"'B. Security Policy'!B16","v":"B.1.11"},{"$f":"'B. Security Policy'!C16","v":"Clean desk?"},{"$f":"'B. Security Policy'!D16","v":"Yes"},{"$f":"'B. Security Policy'!E16","v":"Cloudamize Security Policy - Cloudamize Acceptable Use Policy"},{"$f":"'B. Security Policy'!F16","v":0},{"$f":"'B. Security Policy'!G16","v":"5.1.1"},{"$f":"'B. Security Policy'!H16","v":"Policies for information security"},null,null,"N/A","N/A","N/A"]
[{"$f":"'B. Security Policy'!A17","v":27},{"$f":"'B. Security Policy'!I17","v":2},{"$f":"'B. Security Policy'!J17","v":0},{"$f":"'B. Security Policy'!X17","v":0},{"$f":"'B. Security Policy'!B17","v":"B.1.12"},{"$f":"'B. Security Policy'!C17","v":"Computer and communication systems access and use?"},{"$f":"'B. Security Policy'!D17","v":"Yes"},{"$f":"'B. Security Policy'!E17","v":"Cloudamize Security Policy - Cloudamize Acceptable Use Policy"},{"$f":"'B. Security Policy'!F17","v":0},{"$f":"'B. Security Policy'!G17","v":"5.1.1"},{"$f":"'B. Security Policy'!H17","v":"Policies for information security"},null,null,"6.5.8,6.5.10, 7.1, 7.1.2, 7.1.3, 7.2, 8","IS.1.4.1.1 IS.1.4.1.2.3 IS.1.4.1.3.3 IS.1.4.1.4.3","N/A"]
[{"$f":"'B. Security Policy'!A18","v":28},{"$f":"'B. Security Policy'!I18","v":2},{"$f":"'B. Security Policy'!J18","v":0},{"$f":"'B. Security Policy'!X18","v":0},{"$f":"'B. Security Policy'!B18","v":"B.1.13"},{"$f":"'B. Security Policy'!C18","v":"Data handling?"},{"$f":"'B. Security Policy'!D18","v":"Yes"},{"$f":"'B. Security Policy'!E18","v":"Cloudamize Security Policy - Cloudamize Acceptable Use Policy"},{"$f":"'B. Security Policy'!F18","v":0},{"$f":"'B. Security Policy'!G18","v":"5.1.1"},{"$f":"'B. Security Policy'!H18","v":"Policies for information security"},null,null,4,"IS.1.4.1.10","N/A"]
[{"$f":"'B. Security Policy'!A19","v":29},{"$f":"'B. Security Policy'!I19","v":2},{"$f":"'B. Security Policy'!J19","v":0},{"$f":"'B. Security Policy'!X19","v":0},{"$f":"'B. Security Policy'!B19","v":"B.1.14"},{"$f":"'B. Security Policy'!C19","v":"Desktop computing?"},{"$f":"'B. Security Policy'!D19","v":"Yes"},{"$f":"'B. Security Policy'!E19","v":"Cloudamize Security Policy - Cloudamize Acceptable Use Policy"},{"$f":"'B. Security Policy'!F19","v":0},{"$f":"'B. Security Policy'!G19","v":0},{"$f":"'B. Security Policy'!H19","v":0},null,null,"2.2.2, 2.2.4, 2.2.5","IS.1.4.1.4","N/A"]
[{"$f":"'B. Security Policy'!A20","v":30},{"$f":"'B. Security Policy'!I20","v":2},{"$f":"'B. Security Policy'!J20","v":0},{"$f":"'B. Security Policy'!X20","v":0},{"$f":"'B. Security Policy'!B20","v":"B.1.15"},{"$f":"'B. Security Policy'!C20","v":"Disaster recovery?"},{"$f":"'B. Security Policy'!D20","v":"Yes"},{"$f":"'B. Security Policy'!E20","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'B. Security Policy'!F20","v":0},{"$f":"'B. Security Policy'!G20","v":0},{"$f":"'B. Security Policy'!H20","v":0},null,null,"N/A","IS.1.4.1.12","N/A"]
[{"$f":"'B. Security Policy'!A21","v":31},{"$f":"'B. Security Policy'!I21","v":2},{"$f":"'B. Security Policy'!J21","v":0},{"$f":"'B. Security Policy'!X21","v":0},{"$f":"'B. Security Policy'!B21","v":"B.1.16"},{"$f":"'B. Security Policy'!C21","v":"Email?"},{"$f":"'B. Security Policy'!D21","v":"Yes"},{"$f":"'B. Security Policy'!E21","v":"Cloudamize Security Policy - Cloudamize Acceptable Use Policy"},{"$f":"'B. Security Policy'!F21","v":0},{"$f":"'B. Security Policy'!G21","v":0},{"$f":"'B. Security Policy'!H21","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'B. Security Policy'!A22","v":32},{"$f":"'B. Security Policy'!I22","v":2},{"$f":"'B. Security Policy'!J22","v":0},{"$f":"'B. Security Policy'!X22","v":0},{"$f":"'B. Security Policy'!B22","v":"B.1.17"},{"$f":"'B. Security Policy'!C22","v":"Constituent accountability?"},{"$f":"'B. Security Policy'!D22","v":"Yes"},{"$f":"'B. Security Policy'!E22","v":"Cloudamize Security Policy - Cloudamize Information Secuirty Policy - Non-Compliance"},{"$f":"'B. Security Policy'!F22","v":"B.1 Procedure: b.3"},{"$f":"'B. Security Policy'!G22","v":"5.1.1"},{"$f":"'B. Security Policy'!H22","v":"Policies for information security"},null,null,"12.3.10, 12.4, 12.5, 12.6.2","N/A","N/A"]
[{"$f":"'B. Security Policy'!A23","v":33},{"$f":"'B. Security Policy'!I23","v":2},{"$f":"'B. Security Policy'!J23","v":0},{"$f":"'B. Security Policy'!X23","v":0},{"$f":"'B. Security Policy'!B23","v":"B.1.18"},{"$f":"'B. Security Policy'!C23","v":"Encryption?"},{"$f":"'B. Security Policy'!D23","v":"Yes"},{"$f":"'B. Security Policy'!E23","v":"Cloudamize Security Policy - Cloudamize Acceptable Use Policy"},{"$f":"'B. Security Policy'!F23","v":0},{"$f":"'B. Security Policy'!G23","v":0},{"$f":"'B. Security Policy'!H23","v":0},null,null,"3.4, 3.5, 3.6, 4.1, ","IS.1.4.1.6","N/A"]
[{"$f":"'B. Security Policy'!A24","v":34},{"$f":"'B. Security Policy'!I24","v":2},{"$f":"'B. Security Policy'!J24","v":0},{"$f":"'B. Security Policy'!X24","v":0},{"$f":"'B. Security Policy'!B24","v":"B.1.19"},{"$f":"'B. Security Policy'!C24","v":"Exception process?"},{"$f":"'B. Security Policy'!D24","v":"Yes"},{"$f":"'B. Security Policy'!E24","v":"Cloudamize Security Policy - Cloudamize Acceptable Use Policy"},{"$f":"'B. Security Policy'!F24","v":0},{"$f":"'B. Security Policy'!G24","v":"5.1.1"},{"$f":"'B. Security Policy'!H24","v":"Policies for information security"},null,null,"N/A","N/A","N/A"]
[{"$f":"'B. Security Policy'!A25","v":35},{"$f":"'B. Security Policy'!I25","v":2},{"$f":"'B. Security Policy'!J25","v":0},{"$f":"'B. Security Policy'!X25","v":0},{"$f":"'B. Security Policy'!B25","v":"B.1.20"},{"$f":"'B. Security Policy'!C25","v":"Information classification?"},{"$f":"'B. Security Policy'!D25","v":"Yes"},{"$f":"'B. Security Policy'!E25","v":"Cloudamize Security Policy - Cloudamize Informaiton Classification Policy"},{"$f":"'B. Security Policy'!F25","v":0},{"$f":"'B. Security Policy'!G25","v":"5.1.1"},{"$f":"'B. Security Policy'!H25","v":"Policies for information security"},null,null,"N/A","N/A","N/A"]
[{"$f":"'B. Security Policy'!A26","v":36},{"$f":"'B. Security Policy'!I26","v":2},{"$f":"'B. Security Policy'!J26","v":0},{"$f":"'B. Security Policy'!X26","v":0},{"$f":"'B. Security Policy'!B26","v":"B.1.21"},{"$f":"'B. Security Policy'!C26","v":"Internet/Intranet access and use?"},{"$f":"'B. Security Policy'!D26","v":"Yes"},{"$f":"'B. Security Policy'!E26","v":"Cloudamize Security Policy - Cloudamize Acceptable Use Policy"},{"$f":"'B. Security Policy'!F26","v":0},{"$f":"'B. Security Policy'!G26","v":0},{"$f":"'B. Security Policy'!H26","v":0},null,null,"4, 7, 10","IS.1.4.1.2","N/A"]
[{"$f":"'B. Security Policy'!A27","v":37},{"$f":"'B. Security Policy'!I27","v":2},{"$f":"'B. Security Policy'!J27","v":0},{"$f":"'B. Security Policy'!X27","v":0},{"$f":"'B. Security Policy'!B27","v":"B.1.22"},{"$f":"'B. Security Policy'!C27","v":"Mobile computing?"},{"$f":"'B. Security Policy'!D27","v":"Yes"},{"$f":"'B. Security Policy'!E27","v":"Cloudamize Security Policy - Cloudamize Acceptable Use Policy"},{"$f":"'B. Security Policy'!F27","v":0},{"$f":"'B. Security Policy'!G27","v":0},{"$f":"'B. Security Policy'!H27","v":0},null,null,12.3,"IS.1.4.1.4","N/A"]
[{"$f":"'B. Security Policy'!A28","v":38},{"$f":"'B. Security Policy'!I28","v":2},{"$f":"'B. Security Policy'!J28","v":0},{"$f":"'B. Security Policy'!X28","v":0},{"$f":"'B. Security Policy'!B28","v":"B.1.23"},{"$f":"'B. Security Policy'!C28","v":"Network security?"},{"$f":"'B. Security Policy'!D28","v":"Yes"},{"$f":"'B. Security Policy'!E28","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'B. Security Policy'!F28","v":0},{"$f":"'B. Security Policy'!G28","v":0},{"$f":"'B. Security Policy'!H28","v":0},null,null,"1.1.5, 1.1.6, 1.2, 2.2, 6.2, 11.2, 11.4","IS.1.4.1.2","N/A"]
[{"$f":"'B. Security Policy'!A29","v":39},{"$f":"'B. Security Policy'!I29","v":2},{"$f":"'B. Security Policy'!J29","v":0},{"$f":"'B. Security Policy'!X29","v":0},{"$f":"'B. Security Policy'!B29","v":"B.1.24"},{"$f":"'B. Security Policy'!C29","v":"Operating system security?"},{"$f":"'B. Security Policy'!D29","v":"Yes"},{"$f":"'B. Security Policy'!E29","v":"Cloudamize Security Policy - Cloudamize Acceptable Use Policy"},{"$f":"'B. Security Policy'!F29","v":0},{"$f":"'B. Security Policy'!G29","v":0},{"$f":"'B. Security Policy'!H29","v":0},null,null,"1.1.5, 1.1.6, 1.2, 2.2, 6.2, 11.2, 11.5","IS.1.4.1.3.2 IS.1.4.1.4.2","N/A"]
[{"$f":"'B. Security Policy'!A30","v":40},{"$f":"'B. Security Policy'!I30","v":2},{"$f":"'B. Security Policy'!J30","v":0},{"$f":"'B. Security Policy'!X30","v":0},{"$f":"'B. Security Policy'!B30","v":"B.1.25"},{"$f":"'B. Security Policy'!C30","v":"Personnel security and termination?"},{"$f":"'B. Security Policy'!D30","v":"Yes"},{"$f":"'B. Security Policy'!E30","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'B. Security Policy'!F30","v":"B.1 Procedure: b.3"},{"$f":"'B. Security Policy'!G30","v":"5.1.1"},{"$f":"'B. Security Policy'!H30","v":"Policies for information security"},null,null,"12.3, 12.4, 12.5","IS.1.4.1.9","N/A"]
[{"$f":"'B. Security Policy'!A31","v":41},{"$f":"'B. Security Policy'!I31","v":2},{"$f":"'B. Security Policy'!J31","v":0},{"$f":"'B. Security Policy'!X31","v":0},{"$f":"'B. Security Policy'!B31","v":"B.1.26"},{"$f":"'B. Security Policy'!C31","v":"Physical access?"},{"$f":"'B. Security Policy'!D31","v":"Yes"},{"$f":"'B. Security Policy'!E31","v":"1735 Market Street Building Security Plan"},{"$f":"'B. Security Policy'!F31","v":"B.1 Procedure: b.4"},{"$f":"'B. Security Policy'!G31","v":"5.1.1"},{"$f":"'B. Security Policy'!H31","v":"Policies for information security"},null,null,9,"IS.1.4.1.5","N/A"]
[{"$f":"'B. Security Policy'!A32","v":42},{"$f":"'B. Security Policy'!I32","v":2},{"$f":"'B. Security Policy'!J32","v":0},{"$f":"'B. Security Policy'!X32","v":0},{"$f":"'B. Security Policy'!B32","v":"B.1.27"},{"$f":"'B. Security Policy'!C32","v":"Policy maintenance?"},{"$f":"'B. Security Policy'!D32","v":"Yes"},{"$f":"'B. Security Policy'!E32","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'B. Security Policy'!F32","v":"B.1 Procedure: b.1"},{"$f":"'B. Security Policy'!G32","v":"5.1.1"},{"$f":"'B. Security Policy'!H32","v":"Policies for information security"},null,null,12.1,"N/A","N/A"]
[{"$f":"'B. Security Policy'!A33","v":44},{"$f":"'B. Security Policy'!I33","v":2},{"$f":"'B. Security Policy'!J33","v":0},{"$f":"'B. Security Policy'!X33","v":0},{"$f":"'B. Security Policy'!B33","v":"B.1.28"},{"$f":"'B. Security Policy'!C33","v":"Remote access?"},{"$f":"'B. Security Policy'!D33","v":"No"},{"$f":"'B. Security Policy'!E33","v":0},{"$f":"'B. Security Policy'!F33","v":"B.1 Procedure: b.6"},{"$f":"'B. Security Policy'!G33","v":0},{"$f":"'B. Security Policy'!H33","v":0},null,null,"12.3.8, 12.3.9, 12.3.10","IS.1.4.1.2.4","N/A"]
[{"$f":"'B. Security Policy'!A34","v":48},{"$f":"'B. Security Policy'!I34","v":2},{"$f":"'B. Security Policy'!J34","v":0},{"$f":"'B. Security Policy'!X34","v":0},{"$f":"'B. Security Policy'!B34","v":"B.1.29"},{"$f":"'B. Security Policy'!C34","v":"Security incident and privacy event management?"},{"$f":"'B. Security Policy'!D34","v":"Yes"},{"$f":"'B. Security Policy'!E34","v":"Cloudamize Security Policy - Cloudamize Security Working Group / 1735 Market Street Building Security Plan"},{"$f":"'B. Security Policy'!F34","v":"B.1 Procedure: b.8"},{"$f":"'B. Security Policy'!G34","v":"5.1.1"},{"$f":"'B. Security Policy'!H34","v":"Policies for information security"},null,null,"12.5.3","N/A","N/A"]
[{"$f":"'B. Security Policy'!A35","v":46},{"$f":"'B. Security Policy'!I35","v":2},{"$f":"'B. Security Policy'!J35","v":0},{"$f":"'B. Security Policy'!X35","v":0},{"$f":"'B. Security Policy'!B35","v":"B.1.30"},{"$f":"'B. Security Policy'!C35","v":"Secure disposal?"},{"$f":"'B. Security Policy'!D35","v":"Yes"},{"$f":"'B. Security Policy'!E35","v":"Cloudamize Security Policy - Information Disposal Policy"},{"$f":"'B. Security Policy'!F35","v":"B.1 Procedure: b.2"},{"$f":"'B. Security Policy'!G35","v":0},{"$f":"'B. Security Policy'!H35","v":0},null,null,9.8000000000000007,"IS.1.4.1.10","N/A"]
[{"$f":"'B. Security Policy'!A36","v":3287},{"$f":"'B. Security Policy'!I36","v":2},{"$f":"'B. Security Policy'!J36","v":0},{"$f":"'B. Security Policy'!X36","v":0},{"$f":"'B. Security Policy'!B36","v":"B.1.31"},{"$f":"'B. Security Policy'!C36","v":"Social media, social networking?"},{"$f":"'B. Security Policy'!D36","v":"Yes"},{"$f":"'B. Security Policy'!E36","v":"Cloudamize Security Policy - Cloudamize Acceptable Use Policy"},{"$f":"'B. Security Policy'!F36","v":"B.1 Procedure: b.3"},{"$f":"'B. Security Policy'!G36","v":0},{"$f":"'B. Security Policy'!H36","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'B. Security Policy'!A37","v":50},{"$f":"'B. Security Policy'!I37","v":2},{"$f":"'B. Security Policy'!J37","v":0},{"$f":"'B. Security Policy'!X37","v":0},{"$f":"'B. Security Policy'!B37","v":"B.1.32"},{"$f":"'B. Security Policy'!C37","v":"Vulnerability management?"},{"$f":"'B. Security Policy'!D37","v":"Yes"},{"$f":"'B. Security Policy'!E37","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'B. Security Policy'!F37","v":"B.1 Procedure: b.7"},{"$f":"'B. Security Policy'!G37","v":"5.1.1"},{"$f":"'B. Security Policy'!H37","v":"Policies for information security"},null,null,"1.2, 1.3, 1.4, 11","N/A","N/A"]
[{"$f":"'B. Security Policy'!A38","v":2471},{"$f":"'B. Security Policy'!I38","v":2},{"$f":"'B. Security Policy'!J38","v":0},{"$f":"'B. Security Policy'!X38","v":1},{"$f":"'B. Security Policy'!B38","v":"B.1.33"},{"$f":"'B. Security Policy'!C38","v":"Have the policies been reviewed in the last 12 months? If yes, did the review include:"},{"$f":"'B. Security Policy'!D38","v":"Yes"},{"$f":"'B. Security Policy'!E38","v":"MicroStrategy maintains Secure Cloud Security and Availability Policies and related processes that govern the MicroStrategy Secure Cloud engineering and operations activities. These policies and procedures are in place, reviewed, and updated as needed annually. "},{"$f":"'B. Security Policy'!F38","v":"B.1 Procedure: d"},{"$f":"'B. Security Policy'!G38","v":"5.1.2"},{"$f":"'B. Security Policy'!H38","v":"Review of the policies for information security"},"PO3.1","Technological direction planning","12.2.b","IS.1.4.2.7","PO3.1, PO5.3, PO5.4, PO6.3, PO9.4, DS5.2, DS5.3, ME2.2, ME2.5, ME2.7, ME4.7"]
[{"$f":"'B. Security Policy'!A39","v":2473},{"$f":"'B. Security Policy'!I39","v":3},{"$f":"'B. Security Policy'!J39","v":0},{"$f":"'B. Security Policy'!X39","v":0},{"$f":"'B. Security Policy'!B39","v":"B.1.33.1"},{"$f":"'B. Security Policy'!C39","v":"Feedback from interested parties?"},{"$f":"'B. Security Policy'!D39","v":"Yes"},{"$f":"'B. Security Policy'!E39","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'B. Security Policy'!F39","v":0},{"$f":"'B. Security Policy'!G39","v":"5.1.2"},{"$f":"'B. Security Policy'!H39","v":"Review of the policies for information security"},"PO3.1","Technological direction planning","N/A","N/A","PO3.1, PO5.3, PO5.4, PO6.3, PO9.4, DS5.2, DS5.3, ME2.2, ME2.5, ME2.7, ME4.7"]
[{"$f":"'B. Security Policy'!A40","v":2474},{"$f":"'B. Security Policy'!I40","v":3},{"$f":"'B. Security Policy'!J40","v":0},{"$f":"'B. Security Policy'!X40","v":0},{"$f":"'B. Security Policy'!B40","v":"B.1.33.2"},{"$f":"'B. Security Policy'!C40","v":"Results of independent reviews?"},{"$f":"'B. Security Policy'!D40","v":"Yes"},{"$f":"'B. Security Policy'!E40","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'B. Security Policy'!F40","v":0},{"$f":"'B. Security Policy'!G40","v":"5.1.2"},{"$f":"'B. Security Policy'!H40","v":"Review of the policies for information security"},"PO3.1","Technological direction planning","N/A","N/A","PO3.1, PO5.3, PO5.4, PO6.3, PO9.4, DS5.2, DS5.3, ME2.2, ME2.5, ME2.7, ME4.7"]
[{"$f":"'B. Security Policy'!A41","v":2478},{"$f":"'B. Security Policy'!I41","v":3},{"$f":"'B. Security Policy'!J41","v":0},{"$f":"'B. Security Policy'!X41","v":0},{"$f":"'B. Security Policy'!B41","v":"B.1.33.3"},{"$f":"'B. Security Policy'!C41","v":"Policy compliance?"},{"$f":"'B. Security Policy'!D41","v":"Yes"},{"$f":"'B. Security Policy'!E41","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'B. Security Policy'!F41","v":0},{"$f":"'B. Security Policy'!G41","v":"5.1.2"},{"$f":"'B. Security Policy'!H41","v":"Review of the policies for information security"},"PO3.1","Technological direction planning","N/A","N/A","PO3.1, PO5.3, PO5.4, PO6.3, PO9.4, DS5.2, DS5.3, ME2.2, ME2.5, ME2.7, ME4.7"]
[{"$f":"'B. Security Policy'!A42","v":2479},{"$f":"'B. Security Policy'!I42","v":3},{"$f":"'B. Security Policy'!J42","v":0},{"$f":"'B. Security Policy'!X42","v":0},{"$f":"'B. Security Policy'!B42","v":"B.1.33.4"},{"$f":"'B. Security Policy'!C42","v":"Changes that could affect the approach to managing information security?"},{"$f":"'B. Security Policy'!D42","v":"Yes"},{"$f":"'B. Security Policy'!E42","v":"No needed changes we discovered"},{"$f":"'B. Security Policy'!F42","v":0},{"$f":"'B. Security Policy'!G42","v":"5.1.2"},{"$f":"'B. Security Policy'!H42","v":"Review of the policies for information security"},"PO3.1","Technological direction planning","N/A","N/A","PO3.1, PO5.3, PO5.4, PO6.3, PO9.4, DS5.2, DS5.3, ME2.2, ME2.5, ME2.7, ME4.7"]
[{"$f":"'B. Security Policy'!A43","v":2481},{"$f":"'B. Security Policy'!I43","v":3},{"$f":"'B. Security Policy'!J43","v":0},{"$f":"'B. Security Policy'!X43","v":0},{"$f":"'B. Security Policy'!B43","v":"B.1.33.5"},{"$f":"'B. Security Policy'!C43","v":"Reported information security incidents?"},{"$f":"'B. Security Policy'!D43","v":"Yes"},{"$f":"'B. Security Policy'!E43","v":"Cloudamize Security Policy"},{"$f":"'B. Security Policy'!F43","v":0},{"$f":"'B. Security Policy'!G43","v":"5.1.2"},{"$f":"'B. Security Policy'!H43","v":"Review of the policies for information security"},"PO3.1","Technological direction planning","12.5.3","N/A","PO3.1, PO5.3, PO5.4, PO6.3, PO9.4, DS5.2, DS5.3, ME2.2, ME2.5, ME2.7, ME4.7"]
[{"$f":"'B. Security Policy'!A44","v":2482},{"$f":"'B. Security Policy'!I44","v":3},{"$f":"'B. Security Policy'!J44","v":0},{"$f":"'B. Security Policy'!X44","v":0},{"$f":"'B. Security Policy'!B44","v":"B.1.33.6"},{"$f":"'B. Security Policy'!C44","v":"Recommendations provided by relevant authorities?"},{"$f":"'B. Security Policy'!D44","v":"Yes"},{"$f":"'B. Security Policy'!E44","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'B. Security Policy'!F44","v":0},{"$f":"'B. Security Policy'!G44","v":"5.1.2"},{"$f":"'B. Security Policy'!H44","v":"Review of the policies for information security"},"PO3.1","Technological direction planning","N/A","N/A","PO3.1, PO5.3, PO5.4, PO6.3, PO9.4, DS5.2, DS5.3, ME2.2, ME2.5, ME2.7, ME4.7"]
[{"$f":"'B. Security Policy'!A45","v":2483},{"$f":"'B. Security Policy'!I45","v":3},{"$f":"'B. Security Policy'!J45","v":0},{"$f":"'B. Security Policy'!X45","v":0},{"$f":"'B. Security Policy'!B45","v":"B.1.33.7"},{"$f":"'B. Security Policy'!C45","v":"Records management?"},{"$f":"'B. Security Policy'!D45","v":"Yes"},{"$f":"'B. Security Policy'!E45","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'B. Security Policy'!F45","v":0},{"$f":"'B. Security Policy'!G45","v":"5.1.2"},{"$f":"'B. Security Policy'!H45","v":"Review of the policies for information security"},"PO3.1","Technological direction planning","N/A","N/A","PO3.1, PO5.3, PO5.4, PO6.3, PO9.4, DS5.2, DS5.3, ME2.2, ME2.5, ME2.7, ME4.7"]
[{"$f":"'B. Security Policy'!A46","v":53},{"$f":"'B. Security Policy'!I46","v":2},{"$f":"'B. Security Policy'!J46","v":0},{"$f":"'B. Security Policy'!X46","v":0},{"$f":"'B. Security Policy'!B46","v":"B.1.34"},{"$f":"'B. Security Policy'!C46","v":"Is there a process to approve exceptions to the policy? "},{"$f":"'B. Security Policy'!D46","v":"Yes"},{"$f":"'B. Security Policy'!E46","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'B. Security Policy'!F46","v":0},{"$f":"'B. Security Policy'!G46","v":"5.1.2"},{"$f":"'B. Security Policy'!H46","v":"Review of the policies for information security"},null,null,"N/A","N/A","N/A"]
[{"$f":"'B. Security Policy'!A47","v":54},{"$f":"'B. Security Policy'!I47","v":3},{"$f":"'B. Security Policy'!J47","v":0},{"$f":"'B. Security Policy'!X47","v":0},{"$f":"'B. Security Policy'!B47","v":"B.1.34.1"},{"$f":"'B. Security Policy'!C47","v":"Does security own the approval process?"},{"$f":"'B. Security Policy'!D47","v":"Yes"},{"$f":"'B. Security Policy'!E47","v":0},{"$f":"'B. Security Policy'!F47","v":0},{"$f":"'B. Security Policy'!G47","v":"N/A"},{"$f":"'B. Security Policy'!H47","v":0},null,null,12.5,"N/A","N/A"]
[{"$f":"'B. Security Policy'!A48","v":19},{"$f":"'B. Security Policy'!I48","v":2},{"$f":"'B. Security Policy'!J48","v":0},{"$f":"'B. Security Policy'!X48","v":0},{"$f":"'B. Security Policy'!B48","v":"B.1.35"},{"$f":"'B. Security Policy'!C48","v":"Is the information security policy communicated? If yes, is it communicated to:"},{"$f":"'B. Security Policy'!D48","v":"Yes"},{"$f":"'B. Security Policy'!E48","v":"Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'B. Security Policy'!F48","v":0},{"$f":"'B. Security Policy'!G48","v":"5.1.1"},{"$f":"'B. Security Policy'!H48","v":"Policies for information security"},"PO6.1","IT policy and control environment","12.6.2","MGMT.1.2.1.15.1","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'B. Security Policy'!A49","v":223},{"$f":"'B. Security Policy'!I49","v":3},{"$f":"'B. Security Policy'!J49","v":0},{"$f":"'B. Security Policy'!X49","v":0},{"$f":"'B. Security Policy'!B49","v":"B.1.35.1"},{"$f":"'B. Security Policy'!C49","v":"Full time constituents?"},{"$f":"'B. Security Policy'!D49","v":"Yes"},{"$f":"'B. Security Policy'!E49","v":"Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'B. Security Policy'!F49","v":0},{"$f":"'B. Security Policy'!G49","v":"5.1.1"},{"$f":"'B. Security Policy'!H49","v":"Policies for information security"},null,null,"12.6.2","N/A","N/A"]
[{"$f":"'B. Security Policy'!A50","v":224},{"$f":"'B. Security Policy'!I50","v":3},{"$f":"'B. Security Policy'!J50","v":0},{"$f":"'B. Security Policy'!X50","v":0},{"$f":"'B. Security Policy'!B50","v":"B.1.35.2"},{"$f":"'B. Security Policy'!C50","v":"Part time constituents?"},{"$f":"'B. Security Policy'!D50","v":"Yes"},{"$f":"'B. Security Policy'!E50","v":"Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'B. Security Policy'!F50","v":0},{"$f":"'B. Security Policy'!G50","v":"5.1.1"},{"$f":"'B. Security Policy'!H50","v":"Policies for information security"},null,null,"12.6.2","N/A","N/A"]
[{"$f":"'B. Security Policy'!A51","v":225},{"$f":"'B. Security Policy'!I51","v":3},{"$f":"'B. Security Policy'!J51","v":0},{"$f":"'B. Security Policy'!X51","v":0},{"$f":"'B. Security Policy'!B51","v":"B.1.35.3"},{"$f":"'B. Security Policy'!C51","v":"Contractors?"},{"$f":"'B. Security Policy'!D51","v":"Yes"},{"$f":"'B. Security Policy'!E51","v":"Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'B. Security Policy'!F51","v":0},{"$f":"'B. Security Policy'!G51","v":"5.1.1"},{"$f":"'B. Security Policy'!H51","v":"Policies for information security"},null,null,"12.8.2","N/A","N/A"]
[{"$f":"'B. Security Policy'!A52","v":3886},{"$f":"'B. Security Policy'!I52","v":1},{"$f":"'B. Security Policy'!J52","v":0},{"$f":"'B. Security Policy'!X52","v":1},{"$f":"'B. Security Policy'!B52","v":"B.2"},{"$f":"'B. Security Policy'!C52","v":"Is there a vendor management program?"},{"$f":"'B. Security Policy'!D52","v":"Yes"},{"$f":"'B. Security Policy'!E52","v":0},{"$f":"'B. Security Policy'!F52","v":"B.2 Vendor Management Program"},{"$f":"'B. Security Policy'!G52","v":0},{"$f":"'B. Security Policy'!H52","v":0},null,null,12.8,"N/A","N/A"]
[{"$f":"'B. Security Policy'!A53","v":3887},{"$f":"'B. Security Policy'!I53","v":2},{"$f":"'B. Security Policy'!J53","v":0},{"$f":"'B. Security Policy'!X53","v":0},{"$f":"'B. Security Policy'!B53","v":"B.2.1"},{"$f":"'B. Security Policy'!C53","v":"Does the vendor management program include an individual or group responsible for capturing, maintaining and tracking subcontractor information security issues? If yes, is there:"},{"$f":"'B. Security Policy'!D53","v":0},{"$f":"'B. Security Policy'!E53","v":0},{"$f":"'B. Security Policy'!F53","v":0},{"$f":"'B. Security Policy'!G53","v":"N/A"},{"$f":"'B. Security Policy'!H53","v":0},null,null,"12.8.4"]
[{"$f":"'B. Security Policy'!A54","v":3888},{"$f":"'B. Security Policy'!I54","v":3},{"$f":"'B. Security Policy'!J54","v":0},{"$f":"'B. Security Policy'!X54","v":0},{"$f":"'B. Security Policy'!B54","v":"B.2.1.1"},{"$f":"'B. Security Policy'!C54","v":"Risk rating of the issue (e.g., H/M/L, 1-5, etc.)?"},{"$f":"'B. Security Policy'!D54","v":0},{"$f":"'B. Security Policy'!E54","v":0},{"$f":"'B. Security Policy'!F54","v":0},{"$f":"'B. Security Policy'!G54","v":0},{"$f":"'B. Security Policy'!H54","v":0},null,null,"N/A"]
[{"$f":"'B. Security Policy'!A55","v":3889},{"$f":"'B. Security Policy'!I55","v":3},{"$f":"'B. Security Policy'!J55","v":0},{"$f":"'B. Security Policy'!X55","v":0},{"$f":"'B. Security Policy'!B55","v":"B.2.1.2"},{"$f":"'B. Security Policy'!C55","v":"Documented corrective action or remediation plan?"},{"$f":"'B. Security Policy'!D55","v":0},{"$f":"'B. Security Policy'!E55","v":0},{"$f":"'B. Security Policy'!F55","v":0},{"$f":"'B. Security Policy'!G55","v":"N/A"},{"$f":"'B. Security Policy'!H55","v":0},null,null,"N/A"]
[{"$f":"'B. Security Policy'!A56","v":3890},{"$f":"'B. Security Policy'!I56","v":3},{"$f":"'B. Security Policy'!J56","v":0},{"$f":"'B. Security Policy'!X56","v":0},{"$f":"'B. Security Policy'!B56","v":"B.2.1.3"},{"$f":"'B. Security Policy'!C56","v":"Target remediation date?"},{"$f":"'B. Security Policy'!D56","v":0},{"$f":"'B. Security Policy'!E56","v":0},{"$f":"'B. Security Policy'!F56","v":0},{"$f":"'B. Security Policy'!G56","v":"N/A"},{"$f":"'B. Security Policy'!H56","v":0},null,null,"N/A"]
[{"$f":"'B. Security Policy'!A57","v":3891},{"$f":"'B. Security Policy'!I57","v":3},{"$f":"'B. Security Policy'!J57","v":0},{"$f":"'B. Security Policy'!X57","v":0},{"$f":"'B. Security Policy'!B57","v":"B.2.1.4"},{"$f":"'B. Security Policy'!C57","v":"On-going communication with subcontractor to discuss status of remediation? "},{"$f":"'B. Security Policy'!D57","v":0},{"$f":"'B. Security Policy'!E57","v":0},{"$f":"'B. Security Policy'!F57","v":0},{"$f":"'B. Security Policy'!G57","v":"N/A"},{"$f":"'B. Security Policy'!H57","v":0},null,null,"N/A"]
[{"$f":"'B. Security Policy'!A58","v":3892},{"$f":"'B. Security Policy'!I58","v":3},{"$f":"'B. Security Policy'!J58","v":0},{"$f":"'B. Security Policy'!X58","v":0},{"$f":"'B. Security Policy'!B58","v":"B.2.1.5"},{"$f":"'B. Security Policy'!C58","v":"Escalation procedure if the remediation date is not met?"},{"$f":"'B. Security Policy'!D58","v":0},{"$f":"'B. Security Policy'!E58","v":0},{"$f":"'B. Security Policy'!F58","v":0},{"$f":"'B. Security Policy'!G58","v":"N/A"},{"$f":"'B. Security Policy'!H58","v":0},null,null,"N/A"]
[{"$f":"'B. Security Policy'!A59","v":3893},{"$f":"'B. Security Policy'!I59","v":3},{"$f":"'B. Security Policy'!J59","v":0},{"$f":"'B. Security Policy'!X59","v":0},{"$f":"'B. Security Policy'!B59","v":"B.2.1.6"},{"$f":"'B. Security Policy'!C59","v":"Sign-off when remediation is fully implemented?"},{"$f":"'B. Security Policy'!D59","v":0},{"$f":"'B. Security Policy'!E59","v":0},{"$f":"'B. Security Policy'!F59","v":0},{"$f":"'B. Security Policy'!G59","v":"N/A"},{"$f":"'B. Security Policy'!H59","v":0},null,null,"N/A"]
[{"$f":"'B. Security Policy'!A60","v":3894},{"$f":"'B. Security Policy'!I60","v":3},{"$f":"'B. Security Policy'!J60","v":0},{"$f":"'B. Security Policy'!X60","v":0},{"$f":"'B. Security Policy'!B60","v":"B.2.1.7"},{"$f":"'B. Security Policy'!C60","v":"Reporting on remediation? If yes, does it include:"},{"$f":"'B. Security Policy'!D60","v":0},{"$f":"'B. Security Policy'!E60","v":0},{"$f":"'B. Security Policy'!F60","v":0},{"$f":"'B. Security Policy'!G60","v":"N/A"},{"$f":"'B. Security Policy'!H60","v":0},null,null,"N/A"]
[{"$f":"'B. Security Policy'!A61","v":3895},{"$f":"'B. Security Policy'!I61","v":4},{"$f":"'B. Security Policy'!J61","v":0},{"$f":"'B. Security Policy'!X61","v":0},{"$f":"'B. Security Policy'!B61","v":"B.2.1.7.1"},{"$f":"'B. Security Policy'!C61","v":"Identification of stakeholders?"},{"$f":"'B. Security Policy'!D61","v":0},{"$f":"'B. Security Policy'!E61","v":0},{"$f":"'B. Security Policy'!F61","v":0},{"$f":"'B. Security Policy'!G61","v":"N/A"},{"$f":"'B. Security Policy'!H61","v":0},null,null,"N/A"]
[{"$f":"'B. Security Policy'!A62","v":3896},{"$f":"'B. Security Policy'!I62","v":4},{"$f":"'B. Security Policy'!J62","v":0},{"$f":"'B. Security Policy'!X62","v":0},{"$f":"'B. Security Policy'!B62","v":"B.2.1.7.2"},{"$f":"'B. Security Policy'!C62","v":"Reporting frequency?"},{"$f":"'B. Security Policy'!D62","v":0},{"$f":"'B. Security Policy'!E62","v":0},{"$f":"'B. Security Policy'!F62","v":0},{"$f":"'B. Security Policy'!G62","v":"N/A"},{"$f":"'B. Security Policy'!H62","v":0},null,null,"N/A"]
[{"$f":"'B. Security Policy'!A63","v":0},{"$f":"'B. Security Policy'!I63","v":0},{"$f":"'B. Security Policy'!J63","v":0},{"$f":"'B. Security Policy'!X63","v":0},{"$f":"'B. Security Policy'!B63","v":0},{"$f":"'B. Security Policy'!C63","v":0},{"$f":"'B. Security Policy'!D63","v":0},{"$f":"'B. Security Policy'!E63","v":0},{"$f":"'B. Security Policy'!F63","v":0},{"$f":"'B. Security Policy'!G63","v":0},{"$f":"'B. Security Policy'!H63","v":0}]
[]
[{"$f":"'C. Organizational Security'!B1","v":"C. Organizational Security"},null,null,null,{"$f":"'C. Organizational Security'!B1","v":"C. Organizational Security"}]
[{"$f":"'C. Organizational Security'!A5","v":58},{"$f":"'C. Organizational Security'!I5","v":1},{"$f":"'C. Organizational Security'!J5","v":0},{"$f":"'C. Organizational Security'!X5","v":1},{"$f":"'C. Organizational Security'!B5","v":"C.1"},{"$f":"'C. Organizational Security'!C5","v":"Is there a respondent information security function responsible for security initiatives? If yes, does it include:"},{"$f":"'C. Organizational Security'!D5","v":"Yes"},{"$f":"'C. Organizational Security'!E5","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'C. Organizational Security'!F5","v":"C.3 Security Organization Roles/Responsibilities"},{"$f":"'C. Organizational Security'!G5","v":"6.1.1"},{"$f":"'C. Organizational Security'!H5","v":"Information Security Roles and Responsibilities"},"PO3.3","Monitoring of future trends and regulations",12.5,"IS.1.7.4 MGMT.1.6.1.6","PO3.3, PO3.5, PO4.3, PO4.4, PO4.5, PO4.8, PO6.3, PO6.4, PO6.5, DS5.1"]
[{"$f":"'C. Organizational Security'!A6","v":61},{"$f":"'C. Organizational Security'!I6","v":2},{"$f":"'C. Organizational Security'!J6","v":0},{"$f":"'C. Organizational Security'!X6","v":0},{"$f":"'C. Organizational Security'!B6","v":"C.1.1"},{"$f":"'C. Organizational Security'!C6","v":"Creation, review and approve of information security policies?"},{"$f":"'C. Organizational Security'!D6","v":"Yes"},{"$f":"'C. Organizational Security'!E6","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'C. Organizational Security'!F6","v":0},{"$f":"'C. Organizational Security'!G6","v":"5.1.2"},{"$f":"'C. Organizational Security'!H6","v":"Review of the policies for information security"},"PO3.3","Monitoring of future trends and regulations","12.5.1","N/A","PO3.3, PO3.5, PO4.3, PO4.4, PO4.5, PO4.8, PO6.3, PO6.4, PO6.5, DS5.1"]
[{"$f":"'C. Organizational Security'!A7","v":2488},{"$f":"'C. Organizational Security'!I7","v":2},{"$f":"'C. Organizational Security'!J7","v":0},{"$f":"'C. Organizational Security'!X7","v":0},{"$f":"'C. Organizational Security'!B7","v":"C.1.2"},{"$f":"'C. Organizational Security'!C7","v":"Review the effectiveness of information security policy implementation?"},{"$f":"'C. Organizational Security'!D7","v":"Yes"},{"$f":"'C. Organizational Security'!E7","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'C. Organizational Security'!F7","v":0},{"$f":"'C. Organizational Security'!G7","v":"5.1.2"},{"$f":"'C. Organizational Security'!H7","v":"Management commitment to information security"},"PO3.3","Monitoring of future trends and regulations","N/A","N/A","PO3.3, PO3.5, PO4.3, PO4.4, PO4.5, PO4.8, PO6.3, PO6.4, PO6.5, DS5.1"]
[{"$f":"'C. Organizational Security'!A8","v":2490},{"$f":"'C. Organizational Security'!I8","v":2},{"$f":"'C. Organizational Security'!J8","v":0},{"$f":"'C. Organizational Security'!X8","v":0},{"$f":"'C. Organizational Security'!B8","v":"C.1.3"},{"$f":"'C. Organizational Security'!C8","v":"Manage assignment of specific roles and responsibilities for information security?"},{"$f":"'C. Organizational Security'!D8","v":"Yes"},{"$f":"'C. Organizational Security'!E8","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'C. Organizational Security'!F8","v":0},{"$f":"'C. Organizational Security'!G8","v":"6.1.1.c"},{"$f":"'C. Organizational Security'!H8","v":"Management commitment to information security"},"PO3.3","Monitoring of future trends and regulations",12.5,"IS.1.4.2.3","PO3.3, PO3.5, PO4.3, PO4.4, PO4.5, PO4.8, PO6.3, PO6.4, PO6.5, DS5.1"]
[{"$f":"'C. Organizational Security'!A9","v":65},{"$f":"'C. Organizational Security'!I9","v":2},{"$f":"'C. Organizational Security'!J9","v":0},{"$f":"'C. Organizational Security'!X9","v":0},{"$f":"'C. Organizational Security'!B9","v":"C.1.4"},{"$f":"'C. Organizational Security'!C9","v":"Develop and maintain an overall strategic security plan?"},{"$f":"'C. Organizational Security'!D9","v":"Yes"},{"$f":"'C. Organizational Security'!E9","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'C. Organizational Security'!F9","v":0},{"$f":"'C. Organizational Security'!G9","v":6.1},{"$f":"'C. Organizational Security'!H9","v":"Internal Organization"},"PO3.3","Monitoring of future trends and regulations","12.5.1","N/A","PO3.3, PO3.5, PO4.3, PO4.4, PO4.5, PO4.8, PO6.3, PO6.4, PO6.5, DS5.1"]
[{"$f":"'C. Organizational Security'!A10","v":2494},{"$f":"'C. Organizational Security'!I10","v":2},{"$f":"'C. Organizational Security'!J10","v":0},{"$f":"'C. Organizational Security'!X10","v":0},{"$f":"'C. Organizational Security'!B10","v":"C.1.5"},{"$f":"'C. Organizational Security'!C10","v":"Consistent implementation of information security across different parts of the respondent's organization?"},{"$f":"'C. Organizational Security'!D10","v":"Yes"},{"$f":"'C. Organizational Security'!E10","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'C. Organizational Security'!F10","v":0},{"$f":"'C. Organizational Security'!G10","v":"5.1.1"},{"$f":"'C. Organizational Security'!H10","v":"Policies for Information security"},"PO4.4","Organisational placement of the IT function","N/A","N/A","PO4.4, PO4.5, PO4.6, PO4.8, PO4.10, PO6.5, DS5.1, DS5.2, DS5.3"]
[{"$f":"'C. Organizational Security'!A11","v":63},{"$f":"'C. Organizational Security'!I11","v":2},{"$f":"'C. Organizational Security'!J11","v":0},{"$f":"'C. Organizational Security'!X11","v":0},{"$f":"'C. Organizational Security'!B11","v":"C.1.6"},{"$f":"'C. Organizational Security'!C11","v":"Review and monitor information security / privacy incidents or events?"},{"$f":"'C. Organizational Security'!D11","v":"Yes"},{"$f":"'C. Organizational Security'!E11","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'C. Organizational Security'!F11","v":0},{"$f":"'C. Organizational Security'!G11","v":"18.2.1"},{"$f":"'C. Organizational Security'!H11","v":"Independent review of information security"},"PO3.1","Technological direction planning","12.5.3","IS.2.M.1.2","PO3.1, PO5.3, PO5.4, PO6.3, PO9.4, DS5.2, DS5.3, ME2.2, ME2.5, ME2.7, ME4.7"]
[{"$f":"'C. Organizational Security'!A12","v":62},{"$f":"'C. Organizational Security'!I12","v":2},{"$f":"'C. Organizational Security'!J12","v":0},{"$f":"'C. Organizational Security'!X12","v":0},{"$f":"'C. Organizational Security'!B12","v":"C.1.7"},{"$f":"'C. Organizational Security'!C12","v":"Monitor significant changes in the exposure of information assets?"},{"$f":"'C. Organizational Security'!D12","v":"Yes"},{"$f":"'C. Organizational Security'!E12","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'C. Organizational Security'!F12","v":0},{"$f":"'C. Organizational Security'!G12","v":"6.1.1"},{"$f":"'C. Organizational Security'!H12","v":"Information Security Roles and Responsibilities"},"PO4.4","Organisational placement of the IT function",6.4,"N/A","PO4.4, PO4.6, PO4.8, PO4.9, PO4.10"]
[{"$f":"'C. Organizational Security'!A13","v":2500},{"$f":"'C. Organizational Security'!I13","v":2},{"$f":"'C. Organizational Security'!J13","v":0},{"$f":"'C. Organizational Security'!X13","v":0},{"$f":"'C. Organizational Security'!B13","v":"C.1.8"},{"$f":"'C. Organizational Security'!C13","v":"Contacts with information security special interest groups, specialist security forums, or professional associations?"},{"$f":"'C. Organizational Security'!D13","v":"Yes"},{"$f":"'C. Organizational Security'!E13","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'C. Organizational Security'!F13","v":0},{"$f":"'C. Organizational Security'!G13","v":"6.1.4"},{"$f":"'C. Organizational Security'!H13","v":"Contact with special interest groups"},"PO4.15","Relationships","N/A","IS.1.6.3","PO4.15, DS4.1, DS4.2"]
[{"$f":"'C. Organizational Security'!A14","v":67},{"$f":"'C. Organizational Security'!I14","v":2},{"$f":"'C. Organizational Security'!J14","v":0},{"$f":"'C. Organizational Security'!X14","v":0},{"$f":"'C. Organizational Security'!B14","v":"C.1.9"},{"$f":"'C. Organizational Security'!C14","v":"Identify and document instances of non-compliance with security policies?"},{"$f":"'C. Organizational Security'!D14","v":"Yes"},{"$f":"'C. Organizational Security'!E14","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'C. Organizational Security'!F14","v":0},{"$f":"'C. Organizational Security'!G14","v":"18.2.2"},{"$f":"'C. Organizational Security'!H14","v":"Compliance with security policies and standards"},"PO4.8","Responsibility for risk, security and compliance","N/A","N/A","PO4.8, PO6.2, ME2.1, ME2.2, ME2.3, ME2.4, ME2.5, ME2.6, ME2.7"]
[{"$f":"'C. Organizational Security'!A15","v":2889},{"$f":"'C. Organizational Security'!I15","v":2},{"$f":"'C. Organizational Security'!J15","v":0},{"$f":"'C. Organizational Security'!X15","v":0},{"$f":"'C. Organizational Security'!B15","v":"C.1.10"},{"$f":"'C. Organizational Security'!C15","v":"Identify key Information Technology roles?"},{"$f":"'C. Organizational Security'!D15","v":"Yes"},{"$f":"'C. Organizational Security'!E15","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'C. Organizational Security'!F15","v":0},{"$f":"'C. Organizational Security'!G15","v":"6.1.1"},{"$f":"'C. Organizational Security'!H15","v":"Information Security Roles and Responsibilities"},"PO4.13","Key IT personnel",12.5,"IS.1.6.7","N/A"]
[{"$f":"'C. Organizational Security'!A16","v":71},{"$f":"'C. Organizational Security'!I16","v":1},{"$f":"'C. Organizational Security'!J16","v":0},{"$f":"'C. Organizational Security'!X16","v":1},{"$f":"'C. Organizational Security'!B16","v":"C.2"},{"$f":"'C. Organizational Security'!C16","v":"Do external parties have access to Scoped Systems and Data or processing facilities? If yes, is:"},{"$f":"'C. Organizational Security'!D16","v":"Yes"},{"$f":"'C. Organizational Security'!E16","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F16","v":0},{"$f":"'C. Organizational Security'!G16","v":15},{"$f":"'C. Organizational Security'!H16","v":"Supplier relationships"},null,null,12.8,"N/A","PO6.4, DS5.5, ME2.2, ME2.5, ME4.7"]
[{"$f":"'C. Organizational Security'!A17","v":2512},{"$f":"'C. Organizational Security'!I17","v":2},{"$f":"'C. Organizational Security'!J17","v":0},{"$f":"'C. Organizational Security'!X17","v":0},{"$f":"'C. Organizational Security'!B17","v":"C.2.1"},{"$f":"'C. Organizational Security'!C17","v":"Access prohibited prior to a risk assessment being conducted?"},{"$f":"'C. Organizational Security'!D17","v":"Yes"},{"$f":"'C. Organizational Security'!E17","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F17","v":0},{"$f":"'C. Organizational Security'!G17","v":"15.1.1"},{"$f":"'C. Organizational Security'!H17","v":"Information security policy for supplier relationships"},"PO4.14","Contracted staff policies and procedures","12.8.3","IS.1.5.1 IS.1.5.4 O.1.2.1 O.1.3.5 MGMT.1.6.1.5 O.1.2.1.2 E-BANK.1.4.2.13 RPS.1.2.1.5","PO4.14, DS2.1, DS2.3, DS5.4, DS5.9, DS5.11, DS12.3"]
[{"$f":"'C. Organizational Security'!A18","v":2514},{"$f":"'C. Organizational Security'!I18","v":2},{"$f":"'C. Organizational Security'!J18","v":0},{"$f":"'C. Organizational Security'!X18","v":0},{"$f":"'C. Organizational Security'!B18","v":"C.2.2"},{"$f":"'C. Organizational Security'!C18","v":"A risk assessment performed on third parties?"},{"$f":"'C. Organizational Security'!D18","v":"Yes"},{"$f":"'C. Organizational Security'!E18","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F18","v":0},{"$f":"'C. Organizational Security'!G18","v":"15.1.1"},{"$f":"'C. Organizational Security'!H18","v":"Information security policy for supplier relationships"},"PO4.14","Contracted staff policies and procedures","12.8.4","RPS.1.8.4 RPS.1.11.1.3","PO4.14, DS2.1, DS2.3, DS5.4, DS5.9, DS5.11, DS12.3"]
[{"$f":"'C. Organizational Security'!A19","v":101},{"$f":"'C. Organizational Security'!I19","v":2},{"$f":"'C. Organizational Security'!J19","v":0},{"$f":"'C. Organizational Security'!X19","v":0},{"$f":"'C. Organizational Security'!B19","v":"C.2.3"},{"$f":"'C. Organizational Security'!C19","v":"A controls assessment performed on third parties?"},{"$f":"'C. Organizational Security'!D19","v":"Yes"},{"$f":"'C. Organizational Security'!E19","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F19","v":0},{"$f":"'C. Organizational Security'!G19","v":"15.1.1"},{"$f":"'C. Organizational Security'!H19","v":"Information security policy for supplier relationships"},"PO4.14","Contracted staff policies and procedures","12.8.4","IS.1.4.1.11 O.2.D.4 AUDIT.1.13.1 RPS.1.11.2.3","PO4.14, DS2.1, DS2.3, DS5.4, DS5.9, DS5.11, DS12.3"]
[{"$f":"'C. Organizational Security'!A20","v":2516},{"$f":"'C. Organizational Security'!I20","v":2},{"$f":"'C. Organizational Security'!J20","v":0},{"$f":"'C. Organizational Security'!X20","v":0},{"$f":"'C. Organizational Security'!B20","v":"C.2.4"},{"$f":"'C. Organizational Security'!C20","v":"Agreements in place when customers access Scoped Systems and Data?"},{"$f":"'C. Organizational Security'!D20","v":"Yes"},{"$f":"'C. Organizational Security'!E20","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F20","v":0},{"$f":"'C. Organizational Security'!G20","v":"15.1.2"},{"$f":"'C. Organizational Security'!H20","v":"Addressing security within supplier agreements"},"PO6.2","Enterprise IT risk and internal control framework","12.8.2","N/A","PO6.2, DS5.4"]
[{"$f":"'C. Organizational Security'!A21","v":2501},{"$f":"'C. Organizational Security'!I21","v":2},{"$f":"'C. Organizational Security'!J21","v":0},{"$f":"'C. Organizational Security'!X21","v":0},{"$f":"'C. Organizational Security'!B21","v":"C.2.5"},{"$f":"'C. Organizational Security'!C21","v":"Does management require the use of confidentiality or non-disclosure agreements for all third parties? If yes, do they contain:"},{"$f":"'C. Organizational Security'!D21","v":"Yes"},{"$f":"'C. Organizational Security'!E21","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F21","v":0},{"$f":"'C. Organizational Security'!G21","v":"7.1.2.a"},{"$f":"'C. Organizational Security'!H21","v":"Terms and conditions of employment"},"PO4.6","Roles and responsibilities","N/A","IS.1.5.3 IS.2.F.3","PO4.6, PO4.14, PO8.3, AI5.1, AI5.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'C. Organizational Security'!A22","v":2506},{"$f":"'C. Organizational Security'!I22","v":3},{"$f":"'C. Organizational Security'!J22","v":0},{"$f":"'C. Organizational Security'!X22","v":0},{"$f":"'C. Organizational Security'!B22","v":"C.2.5.1"},{"$f":"'C. Organizational Security'!C22","v":"Ownership of information, trade secrets and intellectual property?"},{"$f":"'C. Organizational Security'!D22","v":"Yes"},{"$f":"'C. Organizational Security'!E22","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F22","v":0},{"$f":"'C. Organizational Security'!G22","v":"15.1.2"},{"$f":"'C. Organizational Security'!H22","v":"Addressing security within supplier agreements"},"PO4.6","Roles and responsibilities","N/A","N/A","PO4.6, PO4.14, PO8.3, AI5.1, AI5.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'C. Organizational Security'!A23","v":2507},{"$f":"'C. Organizational Security'!I23","v":3},{"$f":"'C. Organizational Security'!J23","v":0},{"$f":"'C. Organizational Security'!X23","v":0},{"$f":"'C. Organizational Security'!B23","v":"C.2.5.2"},{"$f":"'C. Organizational Security'!C23","v":"Permitted use of confidential information, and granting of rights to the signatory to use information?"},{"$f":"'C. Organizational Security'!D23","v":"Yes"},{"$f":"'C. Organizational Security'!E23","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F23","v":0},{"$f":"'C. Organizational Security'!G23","v":"15.1.2"},{"$f":"'C. Organizational Security'!H23","v":"Addressing security within supplier agreements"},"PO4.6","Roles and responsibilities","N/A","IS.2.M.17","PO4.6, PO4.14, PO8.3, AI5.1, AI5.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'C. Organizational Security'!A24","v":2509},{"$f":"'C. Organizational Security'!I24","v":3},{"$f":"'C. Organizational Security'!J24","v":0},{"$f":"'C. Organizational Security'!X24","v":0},{"$f":"'C. Organizational Security'!B24","v":"C.2.5.3"},{"$f":"'C. Organizational Security'!C24","v":"Process for notification and reporting of unauthorized disclosure or confidential information breaches?"},{"$f":"'C. Organizational Security'!D24","v":"Yes"},{"$f":"'C. Organizational Security'!E24","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F24","v":0},{"$f":"'C. Organizational Security'!G24","v":"15.1.2"},{"$f":"'C. Organizational Security'!H24","v":"Addressing security within supplier agreements"},"PO4.6","Roles and responsibilities","N/A","IS.1.6.10 IS.1.6.11.2 IS.1.6.11.3","PO4.6, PO4.14, PO8.3, AI5.1, AI5.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'C. Organizational Security'!A25","v":2511},{"$f":"'C. Organizational Security'!I25","v":3},{"$f":"'C. Organizational Security'!J25","v":0},{"$f":"'C. Organizational Security'!X25","v":0},{"$f":"'C. Organizational Security'!B25","v":"C.2.5.4"},{"$f":"'C. Organizational Security'!C25","v":"Expected actions to be taken in case of a breach of this agreement?"},{"$f":"'C. Organizational Security'!D25","v":"Yes"},{"$f":"'C. Organizational Security'!E25","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F25","v":0},{"$f":"'C. Organizational Security'!G25","v":"15.1.2"},{"$f":"'C. Organizational Security'!H25","v":"Addressing security within supplier agreements"},"PO4.6","Roles and responsibilities","N/A","N/A","PO4.6, PO4.14, PO8.3, AI5.1, AI5.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'C. Organizational Security'!A26","v":72},{"$f":"'C. Organizational Security'!I26","v":2},{"$f":"'C. Organizational Security'!J26","v":0},{"$f":"'C. Organizational Security'!X26","v":0},{"$f":"'C. Organizational Security'!B26","v":"C.2.6"},{"$f":"'C. Organizational Security'!C26","v":"Are there contracts with third party service providers who have access to Scoped Systems and Data ? If yes, do they include: "},{"$f":"'C. Organizational Security'!D26","v":"Yes"},{"$f":"'C. Organizational Security'!E26","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F26","v":"C.2 Dependent Service Provider Agreements"},{"$f":"'C. Organizational Security'!G26","v":"15.1.2"},{"$f":"'C. Organizational Security'!H26","v":"Addressing security within supplier agreements"},"PO4.14","Contracted staff policies and procedures","12.8.2","IS.1.5.2 O.1.3.4 O.2.C.2 IS.2.J.1 D&A.1.6.1.11 WPS.1.2.2.1 WPS.1.2.2.3 E-BANK.1.3.2.6  RPS.1.1.5.6 RPS.1.3.2.2 RPS.1.8.4","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A27","v":74},{"$f":"'C. Organizational Security'!I27","v":3},{"$f":"'C. Organizational Security'!J27","v":0},{"$f":"'C. Organizational Security'!X27","v":0},{"$f":"'C. Organizational Security'!B27","v":"C.2.6.1"},{"$f":"'C. Organizational Security'!C27","v":"Non-Disclosure Agreement?"},{"$f":"'C. Organizational Security'!D27","v":"Yes"},{"$f":"'C. Organizational Security'!E27","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F27","v":0},{"$f":"'C. Organizational Security'!G27","v":0},{"$f":"'C. Organizational Security'!H27","v":0},"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, DS2.1, DS2.3, DS5.4, DS5.9, DS5.11, DS12.3"]
[{"$f":"'C. Organizational Security'!A28","v":73},{"$f":"'C. Organizational Security'!I28","v":3},{"$f":"'C. Organizational Security'!J28","v":0},{"$f":"'C. Organizational Security'!X28","v":0},{"$f":"'C. Organizational Security'!B28","v":"C.2.6.2"},{"$f":"'C. Organizational Security'!C28","v":"Confidentiality Agreement?"},{"$f":"'C. Organizational Security'!D28","v":"Yes"},{"$f":"'C. Organizational Security'!E28","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F28","v":0},{"$f":"'C. Organizational Security'!G28","v":0},{"$f":"'C. Organizational Security'!H28","v":0},"PO4.14","Contracted staff policies and procedures","N/A","RPS.2.O.4.8","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A29","v":88},{"$f":"'C. Organizational Security'!I29","v":3},{"$f":"'C. Organizational Security'!J29","v":0},{"$f":"'C. Organizational Security'!X29","v":0},{"$f":"'C. Organizational Security'!B29","v":"C.2.6.3"},{"$f":"'C. Organizational Security'!C29","v":"Media handling?"},{"$f":"'C. Organizational Security'!D29","v":"Yes"},{"$f":"'C. Organizational Security'!E29","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F29","v":0},{"$f":"'C. Organizational Security'!G29","v":0},{"$f":"'C. Organizational Security'!H29","v":0},"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A30","v":100},{"$f":"'C. Organizational Security'!I30","v":3},{"$f":"'C. Organizational Security'!J30","v":0},{"$f":"'C. Organizational Security'!X30","v":0},{"$f":"'C. Organizational Security'!B30","v":"C.2.6.4"},{"$f":"'C. Organizational Security'!C30","v":"Requirement of an awareness program to communicate security standards and expectations?"},{"$f":"'C. Organizational Security'!D30","v":"Yes"},{"$f":"'C. Organizational Security'!E30","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F30","v":0},{"$f":"'C. Organizational Security'!G30","v":"15.1.2"},{"$f":"'C. Organizational Security'!H30","v":"Addressing security within supplier agreements"},"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A31","v":2517},{"$f":"'C. Organizational Security'!I31","v":3},{"$f":"'C. Organizational Security'!J31","v":0},{"$f":"'C. Organizational Security'!X31","v":0},{"$f":"'C. Organizational Security'!B31","v":"C.2.6.5"},{"$f":"'C. Organizational Security'!C31","v":"Responsibilities regarding hardware and software installation and maintenance?"},{"$f":"'C. Organizational Security'!D31","v":"Yes"},{"$f":"'C. Organizational Security'!E31","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F31","v":0},{"$f":"'C. Organizational Security'!G31","v":0},{"$f":"'C. Organizational Security'!H31","v":0},"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A32","v":2518},{"$f":"'C. Organizational Security'!I32","v":3},{"$f":"'C. Organizational Security'!J32","v":0},{"$f":"'C. Organizational Security'!X32","v":0},{"$f":"'C. Organizational Security'!B32","v":"C.2.6.6"},{"$f":"'C. Organizational Security'!C32","v":"Clear reporting structure and agreed reporting formats?"},{"$f":"'C. Organizational Security'!D32","v":"Yes"},{"$f":"'C. Organizational Security'!E32","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F32","v":0},{"$f":"'C. Organizational Security'!G32","v":"15.2.1"},{"$f":"'C. Organizational Security'!H32","v":"Monitoring and review of supplier services"},"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A33","v":2519},{"$f":"'C. Organizational Security'!I33","v":3},{"$f":"'C. Organizational Security'!J33","v":0},{"$f":"'C. Organizational Security'!X33","v":0},{"$f":"'C. Organizational Security'!B33","v":"C.2.6.7"},{"$f":"'C. Organizational Security'!C33","v":"Clear and specified process of change management?"},{"$f":"'C. Organizational Security'!D33","v":"Yes"},{"$f":"'C. Organizational Security'!E33","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F33","v":0},{"$f":"'C. Organizational Security'!G33","v":0},{"$f":"'C. Organizational Security'!H33","v":0},"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A34","v":80},{"$f":"'C. Organizational Security'!I34","v":3},{"$f":"'C. Organizational Security'!J34","v":0},{"$f":"'C. Organizational Security'!X34","v":0},{"$f":"'C. Organizational Security'!B34","v":"C.2.6.8"},{"$f":"'C. Organizational Security'!C34","v":"Notification of change?"},{"$f":"'C. Organizational Security'!D34","v":"Yes"},{"$f":"'C. Organizational Security'!E34","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F34","v":0},{"$f":"'C. Organizational Security'!G34","v":0},{"$f":"'C. Organizational Security'!H34","v":0},"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A35","v":99},{"$f":"'C. Organizational Security'!I35","v":3},{"$f":"'C. Organizational Security'!J35","v":0},{"$f":"'C. Organizational Security'!X35","v":0},{"$f":"'C. Organizational Security'!B35","v":"C.2.6.9"},{"$f":"'C. Organizational Security'!C35","v":"Process to address any identified issues?"},{"$f":"'C. Organizational Security'!D35","v":"Yes"},{"$f":"'C. Organizational Security'!E35","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F35","v":0},{"$f":"'C. Organizational Security'!G35","v":"15.1.2"},{"$f":"'C. Organizational Security'!H35","v":"Addressing security within supplier agreements"},"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A36","v":2520},{"$f":"'C. Organizational Security'!I36","v":3},{"$f":"'C. Organizational Security'!J36","v":0},{"$f":"'C. Organizational Security'!X36","v":0},{"$f":"'C. Organizational Security'!B36","v":"C.2.6.10"},{"$f":"'C. Organizational Security'!C36","v":"Access control policy?"},{"$f":"'C. Organizational Security'!D36","v":"Yes"},{"$f":"'C. Organizational Security'!E36","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F36","v":0},{"$f":"'C. Organizational Security'!G36","v":"15.1.2"},{"$f":"'C. Organizational Security'!H36","v":"Addressing security within supplier agreements"},"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A37","v":81},{"$f":"'C. Organizational Security'!I37","v":3},{"$f":"'C. Organizational Security'!J37","v":0},{"$f":"'C. Organizational Security'!X37","v":0},{"$f":"'C. Organizational Security'!B37","v":"C.2.6.11"},{"$f":"'C. Organizational Security'!C37","v":"Breach notification?"},{"$f":"'C. Organizational Security'!D37","v":"Yes"},{"$f":"'C. Organizational Security'!E37","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F37","v":0},{"$f":"'C. Organizational Security'!G37","v":"15.1.2"},{"$f":"'C. Organizational Security'!H37","v":"Addressing security within supplier agreements"},"PO4.14","Contracted staff policies and procedures","N/A","IS.2.J.5 RPS.2.N.5.2.10","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A38","v":2521},{"$f":"'C. Organizational Security'!I38","v":3},{"$f":"'C. Organizational Security'!J38","v":0},{"$f":"'C. Organizational Security'!X38","v":0},{"$f":"'C. Organizational Security'!B38","v":"C.2.6.12"},{"$f":"'C. Organizational Security'!C38","v":"Description of the product or service to be provided?"},{"$f":"'C. Organizational Security'!D38","v":"Yes"},{"$f":"'C. Organizational Security'!E38","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F38","v":0},{"$f":"'C. Organizational Security'!G38","v":"15.1.2"},{"$f":"'C. Organizational Security'!H38","v":"Addressing security within supplier agreements"},"PO4.14","Contracted staff policies and procedures","N/A","E-BANK.1.3.2.1 RPS.2.O.4.1","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A39","v":2522},{"$f":"'C. Organizational Security'!I39","v":3},{"$f":"'C. Organizational Security'!J39","v":0},{"$f":"'C. Organizational Security'!X39","v":0},{"$f":"'C. Organizational Security'!B39","v":"C.2.6.13"},{"$f":"'C. Organizational Security'!C39","v":"Description of the information to be made available along with its security classification?"},{"$f":"'C. Organizational Security'!D39","v":"Yes"},{"$f":"'C. Organizational Security'!E39","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F39","v":0},{"$f":"'C. Organizational Security'!G39","v":"15.1.2"},{"$f":"'C. Organizational Security'!H39","v":"Addressing security within supplier agreements"},"PO4.14","Contracted staff policies and procedures","N/A","RPS.2.N.5.2.4","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A40","v":82},{"$f":"'C. Organizational Security'!I40","v":3},{"$f":"'C. Organizational Security'!J40","v":0},{"$f":"'C. Organizational Security'!X40","v":0},{"$f":"'C. Organizational Security'!B40","v":"C.2.6.14"},{"$f":"'C. Organizational Security'!C40","v":"SLAs?"},{"$f":"'C. Organizational Security'!D40","v":"Yes"},{"$f":"'C. Organizational Security'!E40","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F40","v":0},{"$f":"'C. Organizational Security'!G40","v":"15.1.2"},{"$f":"'C. Organizational Security'!H40","v":"Addressing security within supplier agreements"},"PO4.14","Contracted staff policies and procedures","N/A","O.1.3.4.1 D&A.1.6.1.11.1 AUDIT.2.F.2.7 RPS.2.O.4.2","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A41","v":76},{"$f":"'C. Organizational Security'!I41","v":3},{"$f":"'C. Organizational Security'!J41","v":0},{"$f":"'C. Organizational Security'!X41","v":0},{"$f":"'C. Organizational Security'!B41","v":"C.2.6.15"},{"$f":"'C. Organizational Security'!C41","v":"Audit reporting?"},{"$f":"'C. Organizational Security'!D41","v":"Yes"},{"$f":"'C. Organizational Security'!E41","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F41","v":0},{"$f":"'C. Organizational Security'!G41","v":"15.1.2"},{"$f":"'C. Organizational Security'!H41","v":"Addressing security within supplier agreements"},"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A42","v":92},{"$f":"'C. Organizational Security'!I42","v":3},{"$f":"'C. Organizational Security'!J42","v":0},{"$f":"'C. Organizational Security'!X42","v":0},{"$f":"'C. Organizational Security'!B42","v":"C.2.6.16"},{"$f":"'C. Organizational Security'!C42","v":"Ongoing monitoring?"},{"$f":"'C. Organizational Security'!D42","v":"Yes"},{"$f":"'C. Organizational Security'!E42","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F42","v":0},{"$f":"'C. Organizational Security'!G42","v":"15.1.3"},{"$f":"'C. Organizational Security'!H42","v":"Information and Communication technology supply chain"},"PO4.14","Contracted staff policies and procedures","12.8.4","IS.2.M.10.2 E-BANK.1.3.3.1","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A43","v":98},{"$f":"'C. Organizational Security'!I43","v":3},{"$f":"'C. Organizational Security'!J43","v":0},{"$f":"'C. Organizational Security'!X43","v":0},{"$f":"'C. Organizational Security'!B43","v":"C.2.6.17"},{"$f":"'C. Organizational Security'!C43","v":"A process to regularly monitor to ensure compliance with security standards?"},{"$f":"'C. Organizational Security'!D43","v":"Yes"},{"$f":"'C. Organizational Security'!E43","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F43","v":0},{"$f":"'C. Organizational Security'!G43","v":"15.1.3"},{"$f":"'C. Organizational Security'!H43","v":"Information and Communication technology supply chain"},"PO4.14","Contracted staff policies and procedures","12.8.4","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A44","v":77},{"$f":"'C. Organizational Security'!I44","v":3},{"$f":"'C. Organizational Security'!J44","v":0},{"$f":"'C. Organizational Security'!X44","v":0},{"$f":"'C. Organizational Security'!B44","v":"C.2.6.18"},{"$f":"'C. Organizational Security'!C44","v":"Onsite review?"},{"$f":"'C. Organizational Security'!D44","v":"Yes"},{"$f":"'C. Organizational Security'!E44","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F44","v":0},{"$f":"'C. Organizational Security'!G44","v":"15.1.3"},{"$f":"'C. Organizational Security'!H44","v":"Information and Communication technology supply chain"},"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A45","v":78},{"$f":"'C. Organizational Security'!I45","v":3},{"$f":"'C. Organizational Security'!J45","v":0},{"$f":"'C. Organizational Security'!X45","v":0},{"$f":"'C. Organizational Security'!B45","v":"C.2.6.19"},{"$f":"'C. Organizational Security'!C45","v":"Right to audit?"},{"$f":"'C. Organizational Security'!D45","v":"Yes"},{"$f":"'C. Organizational Security'!E45","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F45","v":0},{"$f":"'C. Organizational Security'!G45","v":"15.1.2"},{"$f":"'C. Organizational Security'!H45","v":"Addressing security within supplier agreements"},"PO4.14","Contracted staff policies and procedures","N/A","E-BANK.1.3.2.17 RPS.2.N.5.2.18 RPS.2.O.4.6","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A46","v":79},{"$f":"'C. Organizational Security'!I46","v":3},{"$f":"'C. Organizational Security'!J46","v":0},{"$f":"'C. Organizational Security'!X46","v":0},{"$f":"'C. Organizational Security'!B46","v":"C.2.6.20"},{"$f":"'C. Organizational Security'!C46","v":"Right to inspect?"},{"$f":"'C. Organizational Security'!D46","v":"Yes"},{"$f":"'C. Organizational Security'!E46","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F46","v":0},{"$f":"'C. Organizational Security'!G46","v":"15.1.2"},{"$f":"'C. Organizational Security'!H46","v":"Addressing security within supplier agreements"},"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A47","v":91},{"$f":"'C. Organizational Security'!I47","v":3},{"$f":"'C. Organizational Security'!J47","v":0},{"$f":"'C. Organizational Security'!X47","v":0},{"$f":"'C. Organizational Security'!B47","v":"C.2.6.21"},{"$f":"'C. Organizational Security'!C47","v":"Problem reporting and escalation procedures?"},{"$f":"'C. Organizational Security'!D47","v":"Yes"},{"$f":"'C. Organizational Security'!E47","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F47","v":0},{"$f":"'C. Organizational Security'!G47","v":"15.1.2"},{"$f":"'C. Organizational Security'!H47","v":"Addressing security within supplier agreements"},"PO4.14","Contracted staff policies and procedures","N/A","E-BANK.1.3.2.10 RPS.2.N.5.2.11","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A48","v":96},{"$f":"'C. Organizational Security'!I48","v":3},{"$f":"'C. Organizational Security'!J48","v":0},{"$f":"'C. Organizational Security'!X48","v":0},{"$f":"'C. Organizational Security'!B48","v":"C.2.6.22"},{"$f":"'C. Organizational Security'!C48","v":"Business resumption responsibilities?"},{"$f":"'C. Organizational Security'!D48","v":"Yes"},{"$f":"'C. Organizational Security'!E48","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F48","v":0},{"$f":"'C. Organizational Security'!G48","v":0},{"$f":"'C. Organizational Security'!H48","v":0},"PO4.14","Contracted staff policies and procedures","N/A","RPS.2.O.4.20","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A49","v":85},{"$f":"'C. Organizational Security'!I49","v":3},{"$f":"'C. Organizational Security'!J49","v":0},{"$f":"'C. Organizational Security'!X49","v":0},{"$f":"'C. Organizational Security'!B49","v":"C.2.6.23"},{"$f":"'C. Organizational Security'!C49","v":"Indemnification/liability?"},{"$f":"'C. Organizational Security'!D49","v":"Yes"},{"$f":"'C. Organizational Security'!E49","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F49","v":0},{"$f":"'C. Organizational Security'!G49","v":"15.1.2"},{"$f":"'C. Organizational Security'!H49","v":"Addressing security within supplier agreements"},"PO4.14","Contracted staff policies and procedures","N/A","RPS.2.N.5.2.3 RPS.2.O.1.7 RPS.2.O.4.10","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A50","v":87},{"$f":"'C. Organizational Security'!I50","v":3},{"$f":"'C. Organizational Security'!J50","v":0},{"$f":"'C. Organizational Security'!X50","v":0},{"$f":"'C. Organizational Security'!B50","v":"C.2.6.24"},{"$f":"'C. Organizational Security'!C50","v":"Privacy requirements?"},{"$f":"'C. Organizational Security'!D50","v":"Yes"},{"$f":"'C. Organizational Security'!E50","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F50","v":0},{"$f":"'C. Organizational Security'!G50","v":"15.1.2"},{"$f":"'C. Organizational Security'!H50","v":"Addressing security within supplier agreements"},"PO4.14","Contracted staff policies and procedures","N/A","D&A.1.6.1.11.2","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A51","v":90},{"$f":"'C. Organizational Security'!I51","v":3},{"$f":"'C. Organizational Security'!J51","v":0},{"$f":"'C. Organizational Security'!X51","v":0},{"$f":"'C. Organizational Security'!B51","v":"C.2.6.25"},{"$f":"'C. Organizational Security'!C51","v":"Dispute resolution?"},{"$f":"'C. Organizational Security'!D51","v":"Yes"},{"$f":"'C. Organizational Security'!E51","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F51","v":0},{"$f":"'C. Organizational Security'!G51","v":"15.1.2"},{"$f":"'C. Organizational Security'!H51","v":"Addressing security within supplier agreements"},"PO4.14","Contracted staff policies and procedures","N/A","RPS.1.11.2.5 RPS.2.N.5.2.8 RPS.2.O.4.12","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A52","v":94},{"$f":"'C. Organizational Security'!I52","v":3},{"$f":"'C. Organizational Security'!J52","v":0},{"$f":"'C. Organizational Security'!X52","v":0},{"$f":"'C. Organizational Security'!B52","v":"C.2.6.26"},{"$f":"'C. Organizational Security'!C52","v":"Choice of venue?"},{"$f":"'C. Organizational Security'!D52","v":"Yes"},{"$f":"'C. Organizational Security'!E52","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F52","v":0},{"$f":"'C. Organizational Security'!G52","v":0},{"$f":"'C. Organizational Security'!H52","v":0},"PO4.14","Contracted staff policies and procedures","N/A","RPS.2.O.4.18","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A53","v":83},{"$f":"'C. Organizational Security'!I53","v":3},{"$f":"'C. Organizational Security'!J53","v":0},{"$f":"'C. Organizational Security'!X53","v":0},{"$f":"'C. Organizational Security'!B53","v":"C.2.6.27"},{"$f":"'C. Organizational Security'!C53","v":"Data ownership?"},{"$f":"'C. Organizational Security'!D53","v":"Yes"},{"$f":"'C. Organizational Security'!E53","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F53","v":0},{"$f":"'C. Organizational Security'!G53","v":"15.1.2"},{"$f":"'C. Organizational Security'!H53","v":"Addressing security within supplier agreements"},"PO4.14","Contracted staff policies and procedures","N/A","E-BANK.1.3.2.15 RPS.2.O.4.7","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A54","v":95},{"$f":"'C. Organizational Security'!I54","v":3},{"$f":"'C. Organizational Security'!J54","v":0},{"$f":"'C. Organizational Security'!X54","v":0},{"$f":"'C. Organizational Security'!B54","v":"C.2.6.28"},{"$f":"'C. Organizational Security'!C54","v":"Ownership of intellectual property?"},{"$f":"'C. Organizational Security'!D54","v":"Yes"},{"$f":"'C. Organizational Security'!E54","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F54","v":0},{"$f":"'C. Organizational Security'!G54","v":"15.1.2"},{"$f":"'C. Organizational Security'!H54","v":"Addressing security within supplier agreements"},"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A55","v":2523},{"$f":"'C. Organizational Security'!I55","v":3},{"$f":"'C. Organizational Security'!J55","v":0},{"$f":"'C. Organizational Security'!X55","v":0},{"$f":"'C. Organizational Security'!B55","v":"C.2.6.29"},{"$f":"'C. Organizational Security'!C55","v":"Involvement of the third party with subcontractors?"},{"$f":"'C. Organizational Security'!D55","v":"Yes"},{"$f":"'C. Organizational Security'!E55","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F55","v":0},{"$f":"'C. Organizational Security'!G55","v":"15.1.2"},{"$f":"'C. Organizational Security'!H55","v":"Addressing security within supplier agreements"},"PO4.14","Contracted staff policies and procedures","N/A","E-BANK.1.3.2.13 RPS.2.O.4.14","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A56","v":2524},{"$f":"'C. Organizational Security'!I56","v":3},{"$f":"'C. Organizational Security'!J56","v":0},{"$f":"'C. Organizational Security'!X56","v":0},{"$f":"'C. Organizational Security'!B56","v":"C.2.6.30"},{"$f":"'C. Organizational Security'!C56","v":"Security controls these subcontractors need to implement?"},{"$f":"'C. Organizational Security'!D56","v":"Yes"},{"$f":"'C. Organizational Security'!E56","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F56","v":0},{"$f":"'C. Organizational Security'!G56","v":"15.1.2"},{"$f":"'C. Organizational Security'!H56","v":"Addressing security within supplier agreements"},"PO4.14","Contracted staff policies and procedures","N/A","RPS.2.O.4.4 RPS.2.O.4.15","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A57","v":86},{"$f":"'C. Organizational Security'!I57","v":3},{"$f":"'C. Organizational Security'!J57","v":0},{"$f":"'C. Organizational Security'!X57","v":0},{"$f":"'C. Organizational Security'!B57","v":"C.2.6.31"},{"$f":"'C. Organizational Security'!C57","v":"Termination/exit clause?"},{"$f":"'C. Organizational Security'!D57","v":"Yes"},{"$f":"'C. Organizational Security'!E57","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F57","v":0},{"$f":"'C. Organizational Security'!G57","v":0},{"$f":"'C. Organizational Security'!H57","v":0},"PO4.14","Contracted staff policies and procedures","N/A","RPS.2.N.5.2.18","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A58","v":2525},{"$f":"'C. Organizational Security'!I58","v":3},{"$f":"'C. Organizational Security'!J58","v":0},{"$f":"'C. Organizational Security'!X58","v":0},{"$f":"'C. Organizational Security'!B58","v":"C.2.6.32"},{"$f":"'C. Organizational Security'!C58","v":"Contingency plan in case either party wishes to terminate the relationship before the end of the agreements?"},{"$f":"'C. Organizational Security'!D58","v":"Yes"},{"$f":"'C. Organizational Security'!E58","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F58","v":0},{"$f":"'C. Organizational Security'!G58","v":0},{"$f":"'C. Organizational Security'!H58","v":0},"PO4.14","Contracted staff policies and procedures","N/A","E-BANK.1.3.2.11","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A59","v":2526},{"$f":"'C. Organizational Security'!I59","v":3},{"$f":"'C. Organizational Security'!J59","v":0},{"$f":"'C. Organizational Security'!X59","v":0},{"$f":"'C. Organizational Security'!B59","v":"C.2.6.33"},{"$f":"'C. Organizational Security'!C59","v":"Renegotiation of agreements if the security requirements of the respondent change?"},{"$f":"'C. Organizational Security'!D59","v":"Yes"},{"$f":"'C. Organizational Security'!E59","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F59","v":0},{"$f":"'C. Organizational Security'!G59","v":0},{"$f":"'C. Organizational Security'!H59","v":0},"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A60","v":2527},{"$f":"'C. Organizational Security'!I60","v":3},{"$f":"'C. Organizational Security'!J60","v":0},{"$f":"'C. Organizational Security'!X60","v":0},{"$f":"'C. Organizational Security'!B60","v":"C.2.6.34"},{"$f":"'C. Organizational Security'!C60","v":"Current documentation of asset lists, licenses, agreements or rights relating to them?"},{"$f":"'C. Organizational Security'!D60","v":"Yes"},{"$f":"'C. Organizational Security'!E60","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"'C. Organizational Security'!F60","v":0},{"$f":"'C. Organizational Security'!G60","v":"15.2.2"},{"$f":"'C. Organizational Security'!H60","v":"Managing changes to supplier services"},"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A61","v":0},{"$f":"'C. Organizational Security'!I61","v":0},{"$f":"'C. Organizational Security'!J61","v":0},{"$f":"'C. Organizational Security'!X61","v":0},{"$f":"'C. Organizational Security'!B61","v":0},{"$f":"'C. Organizational Security'!C61","v":0},{"$f":"'C. Organizational Security'!D61","v":0},{"$f":"'C. Organizational Security'!E61","v":0},{"$f":"'C. Organizational Security'!F61","v":0},{"$f":"'C. Organizational Security'!G61","v":0},{"$f":"'C. Organizational Security'!H61","v":0}]
[]
[{"$f":"'D. Asset Management'!B1","v":"D. Asset Management"},null,null,null,{"$f":"'D. Asset Management'!B1","v":"D. Asset Management"}]
[{"$f":"'D. Asset Management'!A5","v":3200},{"$f":"'D. Asset Management'!I5","v":1},{"$f":"'D. Asset Management'!J5","v":0},{"$f":"'D. Asset Management'!X5","v":1},{"$f":"'D. Asset Management'!B5","v":"D.1"},{"$f":"'D. Asset Management'!C5","v":"Is there an asset management policy or program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"'D. Asset Management'!D5","v":"Yes"},{"$f":"'D. Asset Management'!E5","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"'D. Asset Management'!F5","v":"D. Assessment Management"},{"$f":"'D. Asset Management'!G5","v":8.1},{"$f":"'D. Asset Management'!H5","v":"Responsibility For Assets"},null,null,"N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'D. Asset Management'!A6","v":106},{"$f":"'D. Asset Management'!I6","v":2},{"$f":"'D. Asset Management'!J6","v":0},{"$f":"'D. Asset Management'!X6","v":0},{"$f":"'D. Asset Management'!B6","v":"D.1.1"},{"$f":"'D. Asset Management'!C6","v":"Is there an inventory system for hardware and software assets? If yes, does it include:"},{"$f":"'D. Asset Management'!D6","v":"Yes"},{"$f":"'D. Asset Management'!E6","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"'D. Asset Management'!F6","v":"D.1 Asset Accounting and Inventory"},{"$f":"'D. Asset Management'!G6","v":"8.1.1"},{"$f":"'D. Asset Management'!H6","v":"Inventory Of Assets"},"PO2.1","Enterprise information architecture model",2.4,"D&A.1.11.1.1 OPS.1.4.1 OPS.2.12.A RPS.1.2.2.5","PO2.2, DS9.2, DS9.3"]
[{"$f":"'D. Asset Management'!A7","v":108},{"$f":"'D. Asset Management'!I7","v":3},{"$f":"'D. Asset Management'!J7","v":0},{"$f":"'D. Asset Management'!X7","v":0},{"$f":"'D. Asset Management'!B7","v":"D.1.1.1"},{"$f":"'D. Asset Management'!C7","v":"Asset control tag?"},{"$f":"'D. Asset Management'!D7","v":"Yes"},{"$f":"'D. Asset Management'!E7","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"'D. Asset Management'!F7","v":"D.1.c.1"},{"$f":"'D. Asset Management'!G7","v":"N/A"},{"$f":"'D. Asset Management'!H7","v":""},null,null,"N/A","OPS.2.12.E.11","N/A"]
[{"$f":"'D. Asset Management'!A8","v":113},{"$f":"'D. Asset Management'!I8","v":3},{"$f":"'D. Asset Management'!J8","v":0},{"$f":"'D. Asset Management'!X8","v":0},{"$f":"'D. Asset Management'!B8","v":"D.1.1.2"},{"$f":"'D. Asset Management'!C8","v":"Operating system?"},{"$f":"'D. Asset Management'!D8","v":"Yes"},{"$f":"'D. Asset Management'!E8","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"'D. Asset Management'!F8","v":"D.1.c.4"},{"$f":"'D. Asset Management'!G8","v":"N/A"},{"$f":"'D. Asset Management'!H8","v":""},null,null,"N/A","OPS.2.12.A.1.2","N/A"]
[{"$f":"'D. Asset Management'!A9","v":114},{"$f":"'D. Asset Management'!I9","v":3},{"$f":"'D. Asset Management'!J9","v":0},{"$f":"'D. Asset Management'!X9","v":0},{"$f":"'D. Asset Management'!B9","v":"D.1.1.3"},{"$f":"'D. Asset Management'!C9","v":"Physical location?"},{"$f":"'D. Asset Management'!D9","v":"Yes"},{"$f":"'D. Asset Management'!E9","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"'D. Asset Management'!F9","v":"D.1.c.2"},{"$f":"'D. Asset Management'!G9","v":"N/A"},{"$f":"'D. Asset Management'!H9","v":""},null,null,"N/A","OPS.2.12.A.1.7","N/A"]
[{"$f":"'D. Asset Management'!A10","v":115},{"$f":"'D. Asset Management'!I10","v":3},{"$f":"'D. Asset Management'!J10","v":0},{"$f":"'D. Asset Management'!X10","v":0},{"$f":"'D. Asset Management'!B10","v":"D.1.1.4"},{"$f":"'D. Asset Management'!C10","v":"Serial number?"},{"$f":"'D. Asset Management'!D10","v":"Yes"},{"$f":"'D. Asset Management'!E10","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"'D. Asset Management'!F10","v":0},{"$f":"'D. Asset Management'!G10","v":"N/A"},{"$f":"'D. Asset Management'!H10","v":""},null,null,"N/A","OPS.2.12.A.3.3","N/A"]
[{"$f":"'D. Asset Management'!A11","v":109},{"$f":"'D. Asset Management'!I11","v":3},{"$f":"'D. Asset Management'!J11","v":0},{"$f":"'D. Asset Management'!X11","v":0},{"$f":"'D. Asset Management'!B11","v":"D.1.1.5"},{"$f":"'D. Asset Management'!C11","v":"Business function supported?"},{"$f":"'D. Asset Management'!D11","v":"Yes"},{"$f":"'D. Asset Management'!E11","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"'D. Asset Management'!F11","v":0},{"$f":"'D. Asset Management'!G11","v":"N/A"},{"$f":"'D. Asset Management'!H11","v":""},null,null,"N/A","OPS.2.12.A.1.6","N/A"]
[{"$f":"'D. Asset Management'!A12","v":110},{"$f":"'D. Asset Management'!I12","v":3},{"$f":"'D. Asset Management'!J12","v":0},{"$f":"'D. Asset Management'!X12","v":0},{"$f":"'D. Asset Management'!B12","v":"D.1.1.6"},{"$f":"'D. Asset Management'!C12","v":"Environment (dev, test, etc.)?"},{"$f":"'D. Asset Management'!D12","v":"Yes"},{"$f":"'D. Asset Management'!E12","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"'D. Asset Management'!F12","v":"D.1.c.5"},{"$f":"'D. Asset Management'!G12","v":"N/A"},{"$f":"'D. Asset Management'!H12","v":""},null,null,"N/A","OPS.2.12.A.1.8","N/A"]
[{"$f":"'D. Asset Management'!A13","v":112},{"$f":"'D. Asset Management'!I13","v":3},{"$f":"'D. Asset Management'!J13","v":0},{"$f":"'D. Asset Management'!X13","v":0},{"$f":"'D. Asset Management'!B13","v":"D.1.1.7"},{"$f":"'D. Asset Management'!C13","v":"IP address?"},{"$f":"'D. Asset Management'!D13","v":"Yes"},{"$f":"'D. Asset Management'!E13","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"'D. Asset Management'!F13","v":0},{"$f":"'D. Asset Management'!G13","v":"N/A"},{"$f":"'D. Asset Management'!H13","v":""},null,null,"N/A","OPS.2.12.A.1.7 OPS.2.12.A.2.2","N/A"]
[{"$f":"'D. Asset Management'!A14","v":119},{"$f":"'D. Asset Management'!I14","v":2},{"$f":"'D. Asset Management'!J14","v":0},{"$f":"'D. Asset Management'!X14","v":0},{"$f":"'D. Asset Management'!B14","v":"D.1.2"},{"$f":"'D. Asset Management'!C14","v":"Is there a detailed description of software licenses (number of seats, concurrent users, etc.) ?"},{"$f":"'D. Asset Management'!D14","v":"Yes"},{"$f":"'D. Asset Management'!E14","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"'D. Asset Management'!F14","v":"D.1 Asset Accounting and Inventory"},{"$f":"'D. Asset Management'!G14","v":"N/A"},{"$f":"'D. Asset Management'!H14","v":""},null,null,"N/A","D&A.1.6.1.10.6 OPS.2.12.A.3.6","N/A"]
[{"$f":"'D. Asset Management'!A15","v":120},{"$f":"'D. Asset Management'!I15","v":2},{"$f":"'D. Asset Management'!J15","v":0},{"$f":"'D. Asset Management'!X15","v":0},{"$f":"'D. Asset Management'!B15","v":"D.1.3"},{"$f":"'D. Asset Management'!C15","v":"Is ownership assigned for information and assets? If yes, is the owner responsible to:"},{"$f":"'D. Asset Management'!D15","v":"Yes"},{"$f":"'D. Asset Management'!E15","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"'D. Asset Management'!F15","v":0},{"$f":"'D. Asset Management'!G15","v":"8.1.2"},{"$f":"'D. Asset Management'!H15","v":"Ownership Of Assets"},"PO4.9","Data and system ownership","N/A","N/A","PO4.9, DS9.2"]
[{"$f":"'D. Asset Management'!A16","v":2530},{"$f":"'D. Asset Management'!I16","v":3},{"$f":"'D. Asset Management'!J16","v":0},{"$f":"'D. Asset Management'!X16","v":0},{"$f":"'D. Asset Management'!B16","v":"D.1.3.1"},{"$f":"'D. Asset Management'!C16","v":"Appropriately classify information and assets?"},{"$f":"'D. Asset Management'!D16","v":"Yes"},{"$f":"'D. Asset Management'!E16","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"'D. Asset Management'!F16","v":0},{"$f":"'D. Asset Management'!G16","v":"8.2.1"},{"$f":"'D. Asset Management'!H16","v":"Classification of Information"},"PO4.9","Data and system ownership","2.4, 9.6.1","N/A","PO4.9, DS9.2"]
[{"$f":"'D. Asset Management'!A17","v":121},{"$f":"'D. Asset Management'!I17","v":3},{"$f":"'D. Asset Management'!J17","v":0},{"$f":"'D. Asset Management'!X17","v":0},{"$f":"'D. Asset Management'!B17","v":"D.1.3.2"},{"$f":"'D. Asset Management'!C17","v":"Review and approve access to those information and assets?"},{"$f":"'D. Asset Management'!D17","v":"Yes"},{"$f":"'D. Asset Management'!E17","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"'D. Asset Management'!F17","v":0},{"$f":"'D. Asset Management'!G17","v":"8.1.2"},{"$f":"'D. Asset Management'!H17","v":"Ownership Of Assets"},"PO4.9","Data and system ownership",7,"N/A","PO4.9, DS9.2"]
[{"$f":"'D. Asset Management'!A18","v":2531},{"$f":"'D. Asset Management'!I18","v":3},{"$f":"'D. Asset Management'!J18","v":0},{"$f":"'D. Asset Management'!X18","v":0},{"$f":"'D. Asset Management'!B18","v":"D.1.3.3"},{"$f":"'D. Asset Management'!C18","v":"Establish, document and implement rules for the acceptable use of information and assets?"},{"$f":"'D. Asset Management'!D18","v":"Yes"},{"$f":"'D. Asset Management'!E18","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"'D. Asset Management'!F18","v":0},{"$f":"'D. Asset Management'!G18","v":"8.1.3"},{"$f":"'D. Asset Management'!H18","v":"Acceptable Use Of Assets"},"PO4.10","Supervision","7.2.2","N/A","PO4.10, PO6.2"]
[{"$f":"'D. Asset Management'!A19","v":2532},{"$f":"'D. Asset Management'!I19","v":1},{"$f":"'D. Asset Management'!J19","v":0},{"$f":"'D. Asset Management'!X19","v":1},{"$f":"'D. Asset Management'!B19","v":"D.2"},{"$f":"'D. Asset Management'!C19","v":"Are information and assets classified?"},{"$f":"'D. Asset Management'!D19","v":"Yes"},{"$f":"'D. Asset Management'!E19","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"'D. Asset Management'!F19","v":"D.1.c.6"},{"$f":"'D. Asset Management'!G19","v":"8.2.1"},{"$f":"'D. Asset Management'!H19","v":"Classification of Information"},"PO2.3","Data classification scheme","9.6.1","N/A","PO2, AI2, DS9"]
[{"$f":"'D. Asset Management'!A20","v":3201},{"$f":"'D. Asset Management'!I20","v":2},{"$f":"'D. Asset Management'!J20","v":0},{"$f":"'D. Asset Management'!X20","v":0},{"$f":"'D. Asset Management'!B20","v":"D.2.1"},{"$f":"'D. Asset Management'!C20","v":"Is there an information asset classification policy or program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"'D. Asset Management'!D20","v":"Yes"},{"$f":"'D. Asset Management'!E20","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'D. Asset Management'!F20","v":0},{"$f":"'D. Asset Management'!G20","v":"8.2.1"},{"$f":"'D. Asset Management'!H20","v":"Classification of Information"},"PO2.3","Data classification scheme","N/A","N/A","PO2, AI2, DS9"]
[{"$f":"'D. Asset Management'!A21","v":2533},{"$f":"'D. Asset Management'!I21","v":2},{"$f":"'D. Asset Management'!J21","v":0},{"$f":"'D. Asset Management'!X21","v":0},{"$f":"'D. Asset Management'!B21","v":"D.2.2"},{"$f":"'D. Asset Management'!C21","v":"Is there a procedure for handling of information and assets? If yes, does it include:"},{"$f":"'D. Asset Management'!D21","v":"Yes"},{"$f":"'D. Asset Management'!E21","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'D. Asset Management'!F21","v":"G.15 Physical Media Tracking"},{"$f":"'D. Asset Management'!G21","v":"8.2.3"},{"$f":"'D. Asset Management'!H21","v":"Handling of assets"},"DS9.1","Configuration repository and baseline","N/A","IS.2.L.1.1","PO2, AI2, DS9"]
[{"$f":"'D. Asset Management'!A22","v":136},{"$f":"'D. Asset Management'!I22","v":3},{"$f":"'D. Asset Management'!J22","v":0},{"$f":"'D. Asset Management'!X22","v":0},{"$f":"'D. Asset Management'!B22","v":"D.2.2.1"},{"$f":"'D. Asset Management'!C22","v":"Data ownership?"},{"$f":"'D. Asset Management'!D22","v":"Yes"},{"$f":"'D. Asset Management'!E22","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'D. Asset Management'!F22","v":0},{"$f":"'D. Asset Management'!G22","v":"8.1.2"},{"$f":"'D. Asset Management'!H22","v":"Ownership Of Assets"},"PO4.9","Data and system ownership","N/A","N/A","PO4.9, DS9.2"]
[{"$f":"'D. Asset Management'!A23","v":128},{"$f":"'D. Asset Management'!I23","v":3},{"$f":"'D. Asset Management'!J23","v":0},{"$f":"'D. Asset Management'!X23","v":0},{"$f":"'D. Asset Management'!B23","v":"D.2.2.2"},{"$f":"'D. Asset Management'!C23","v":"Data access controls including authorization?"},{"$f":"'D. Asset Management'!D23","v":"Yes"},{"$f":"'D. Asset Management'!E23","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'D. Asset Management'!F23","v":0},{"$f":"'D. Asset Management'!G23","v":"8.2.3"},{"$f":"'D. Asset Management'!H23","v":"Handling of assets"},null,null,null,"N/A","PO4.9, DS9.2"]
[{"$f":"'D. Asset Management'!A24","v":134},{"$f":"'D. Asset Management'!I24","v":3},{"$f":"'D. Asset Management'!J24","v":0},{"$f":"'D. Asset Management'!X24","v":0},{"$f":"'D. Asset Management'!B24","v":"D.2.2.3"},{"$f":"'D. Asset Management'!C24","v":"Data labeling?"},{"$f":"'D. Asset Management'!D24","v":"Yes"},{"$f":"'D. Asset Management'!E24","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'D. Asset Management'!F24","v":0},{"$f":"'D. Asset Management'!G24","v":"8.2.2"},{"$f":"'D. Asset Management'!H24","v":"Labeling of information"},"DS9.1","Configuration repository and baseline","N/A","N/A","PO6.2, DS11.6"]
[{"$f":"'D. Asset Management'!A25","v":135},{"$f":"'D. Asset Management'!I25","v":3},{"$f":"'D. Asset Management'!J25","v":0},{"$f":"'D. Asset Management'!X25","v":0},{"$f":"'D. Asset Management'!B25","v":"D.2.2.4"},{"$f":"'D. Asset Management'!C25","v":"Data on removable media?"},{"$f":"'D. Asset Management'!D25","v":"Yes"},{"$f":"'D. Asset Management'!E25","v":"Cloudamize Security Policy - Cloudamize Removable Media Policy"},{"$f":"'D. Asset Management'!F25","v":0},{"$f":"'D. Asset Management'!G25","v":"8.3.1"},{"$f":"'D. Asset Management'!H25","v":"Management Of Removable Media"},null,null,null,"N/A","PO2.3, DS11.2, DS11.3, DS11.4"]
[{"$f":"'D. Asset Management'!A26","v":133},{"$f":"'D. Asset Management'!I26","v":3},{"$f":"'D. Asset Management'!J26","v":0},{"$f":"'D. Asset Management'!X26","v":0},{"$f":"'D. Asset Management'!B26","v":"D.2.2.5"},{"$f":"'D. Asset Management'!C26","v":"Data in transit?"},{"$f":"'D. Asset Management'!D26","v":"Yes"},{"$f":"'D. Asset Management'!E26","v":"Cloudamize Security Policy - Cloudamize Removable Media Policy"},{"$f":"'D. Asset Management'!F26","v":"G.16 Security of Media in Transit"},{"$f":"'D. Asset Management'!G26","v":"8.3.3"},{"$f":"'D. Asset Management'!H26","v":"Physical media transfer"},"DS9.1","Configuration repository and baseline","9.6.2","N/A","PO2, AI2, DS9"]
[{"$f":"'D. Asset Management'!A27","v":131},{"$f":"'D. Asset Management'!I27","v":3},{"$f":"'D. Asset Management'!J27","v":0},{"$f":"'D. Asset Management'!X27","v":0},{"$f":"'D. Asset Management'!B27","v":"D.2.2.6"},{"$f":"'D. Asset Management'!C27","v":"Data encryption?"},{"$f":"'D. Asset Management'!D27","v":"Yes"},{"$f":"'D. Asset Management'!E27","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'D. Asset Management'!F27","v":"G.22 Data Security Policy - Encryption"},{"$f":"'D. Asset Management'!G27","v":"10.1.1"},{"$f":"'D. Asset Management'!H27","v":"Policy on the use of cryptographic controls"},"PO6.2","Enterprise IT risk and internal control framework",4,"IS.2.K.1","PO6, AI2, DS5"]
[{"$f":"'D. Asset Management'!A28","v":132},{"$f":"'D. Asset Management'!I28","v":3},{"$f":"'D. Asset Management'!J28","v":0},{"$f":"'D. Asset Management'!X28","v":0},{"$f":"'D. Asset Management'!B28","v":"D.2.2.7"},{"$f":"'D. Asset Management'!C28","v":"Data in storage?"},{"$f":"'D. Asset Management'!D28","v":"Yes"},{"$f":"'D. Asset Management'!E28","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'D. Asset Management'!F28","v":0},{"$f":"'D. Asset Management'!G28","v":"11.2.6"},{"$f":"'D. Asset Management'!H28","v":"Security of equipment and assets off-premise"},"PO6.2","Enterprise IT risk and internal control framework","9.5.1","IS.2.M.10.5","PO6.2, DS11.6"]
[{"$f":"'D. Asset Management'!A29","v":137},{"$f":"'D. Asset Management'!I29","v":3},{"$f":"'D. Asset Management'!J29","v":0},{"$f":"'D. Asset Management'!X29","v":0},{"$f":"'D. Asset Management'!B29","v":"D.2.2.8"},{"$f":"'D. Asset Management'!C29","v":"Data reclassification?"},{"$f":"'D. Asset Management'!D29","v":"Yes"},{"$f":"'D. Asset Management'!E29","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'D. Asset Management'!F29","v":0},{"$f":"'D. Asset Management'!G29","v":"8.1.2"},{"$f":"'D. Asset Management'!H29","v":"Ownership Of Assets"},"PO4.9","Data and system ownership","N/A","N/A","PO4.9, DS9.2"]
[{"$f":"'D. Asset Management'!A30","v":138},{"$f":"'D. Asset Management'!I30","v":3},{"$f":"'D. Asset Management'!J30","v":0},{"$f":"'D. Asset Management'!X30","v":0},{"$f":"'D. Asset Management'!B30","v":"D.2.2.9"},{"$f":"'D. Asset Management'!C30","v":"Data retention?"},{"$f":"'D. Asset Management'!D30","v":"Yes"},{"$f":"'D. Asset Management'!E30","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'D. Asset Management'!F30","v":0},{"$f":"'D. Asset Management'!G30","v":0},{"$f":"'D. Asset Management'!H30","v":""},null,null,"3.1.a","N/A","N/A"]
[{"$f":"'D. Asset Management'!A31","v":129},{"$f":"'D. Asset Management'!I31","v":3},{"$f":"'D. Asset Management'!J31","v":0},{"$f":"'D. Asset Management'!X31","v":0},{"$f":"'D. Asset Management'!B31","v":"D.2.2.10"},{"$f":"'D. Asset Management'!C31","v":"Data destruction?"},{"$f":"'D. Asset Management'!D31","v":"Yes"},{"$f":"'D. Asset Management'!E31","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"'D. Asset Management'!F31","v":"D.2 Asset Destruction"},{"$f":"'D. Asset Management'!G31","v":"8.1.2"},{"$f":"'D. Asset Management'!H31","v":"Ownership Of Assets"},"DS9.1","Configuration repository and baseline","3.1.a","N/A","DS11.3, DS11.4"]
[{"$f":"'D. Asset Management'!A32","v":130},{"$f":"'D. Asset Management'!I32","v":3},{"$f":"'D. Asset Management'!J32","v":0},{"$f":"'D. Asset Management'!X32","v":0},{"$f":"'D. Asset Management'!B32","v":"D.2.2.11"},{"$f":"'D. Asset Management'!C32","v":"Data disposal?"},{"$f":"'D. Asset Management'!D32","v":"Yes"},{"$f":"'D. Asset Management'!E32","v":"Cloudamize Security Policy - Cloudamize Information Disposal Policy"},{"$f":"'D. Asset Management'!F32","v":"D.2 Asset Destruction"},{"$f":"'D. Asset Management'!G32","v":"8.3.2"},{"$f":"'D. Asset Management'!H32","v":"Disposal Of Media"},"DS11.3","Media library management system","3.1.a","N/A","DS11.3, DS11.4"]
[{"$f":"'D. Asset Management'!A33","v":2534},{"$f":"'D. Asset Management'!I33","v":3},{"$f":"'D. Asset Management'!J33","v":0},{"$f":"'D. Asset Management'!X33","v":0},{"$f":"'D. Asset Management'!B33","v":"D.2.2.12"},{"$f":"'D. Asset Management'!C33","v":"Reviewed at least annually?"},{"$f":"'D. Asset Management'!D33","v":"Yes"},{"$f":"'D. Asset Management'!E33","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'D. Asset Management'!F33","v":0},{"$f":"'D. Asset Management'!G33","v":"8.1.2"},{"$f":"'D. Asset Management'!H33","v":"Ownership Of Assets"},"PO2.3","Data classification scheme","12.1.1","IS.2.L.1.4","PO2, AI2, DS9"]
[{"$f":"'D. Asset Management'!A34","v":2535},{"$f":"'D. Asset Management'!I34","v":3},{"$f":"'D. Asset Management'!J34","v":0},{"$f":"'D. Asset Management'!X34","v":0},{"$f":"'D. Asset Management'!B34","v":"D.2.2.13"},{"$f":"'D. Asset Management'!C34","v":"Data handling based on classification?"},{"$f":"'D. Asset Management'!D34","v":"Yes"},{"$f":"'D. Asset Management'!E34","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'D. Asset Management'!F34","v":"G.15 Physical Media Tracking"},{"$f":"'D. Asset Management'!G34","v":"8.2.3"},{"$f":"'D. Asset Management'!H34","v":"Handling of assets"},"DS9.1","Configuration repository and baseline","N/A","N/A","PO2, AI2, DS9"]
[{"$f":"'D. Asset Management'!A35","v":139},{"$f":"'D. Asset Management'!I35","v":3},{"$f":"'D. Asset Management'!J35","v":0},{"$f":"'D. Asset Management'!X35","v":0},{"$f":"'D. Asset Management'!B35","v":"D.2.2.14"},{"$f":"'D. Asset Management'!C35","v":"Physical media destruction?"},{"$f":"'D. Asset Management'!D35","v":"Yes"},{"$f":"'D. Asset Management'!E35","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"'D. Asset Management'!F35","v":"D.2 Asset Destruction"},{"$f":"'D. Asset Management'!G35","v":"8.3.2"},{"$f":"'D. Asset Management'!H35","v":"Disposal Of Media"},"DS11.3","Media library management system",9.8000000000000007,"IS.1.4.1.10 IS.2.C.14 IS.2.D.5 IS.2.E.2 IS.2.L.2.1 IS.2.L.2.1","DS11.3, DS11.4"]
[{"$f":"'D. Asset Management'!A36","v":140},{"$f":"'D. Asset Management'!I36","v":3},{"$f":"'D. Asset Management'!J36","v":0},{"$f":"'D. Asset Management'!X36","v":0},{"$f":"'D. Asset Management'!B36","v":"D.2.2.15"},{"$f":"'D. Asset Management'!C36","v":"Reuse of physical media (tapes, disk drives, etc.)?"},{"$f":"'D. Asset Management'!D36","v":"Yes"},{"$f":"'D. Asset Management'!E36","v":"Cloudamize Security Policy - Cloudamize Removable Media Policy"},{"$f":"'D. Asset Management'!F36","v":0},{"$f":"'D. Asset Management'!G36","v":"11.2.7"},{"$f":"'D. Asset Management'!H36","v":"Secure Disposal Or Re-Use Of Equipment"},"DS11.4","Disposal","9.8.2","IS.2.E.2 IS.2.L.2.1 IS.2.L.2.1","DS11.4"]
[{"$f":"'D. Asset Management'!A40","v":0},{"$f":"'D. Asset Management'!I40","v":0},{"$f":"'D. Asset Management'!J40","v":0},{"$f":"'D. Asset Management'!X40","v":0},{"$f":"'D. Asset Management'!B40","v":0},{"$f":"'D. Asset Management'!C40","v":0},{"$f":"'D. Asset Management'!D40","v":0},{"$f":"'D. Asset Management'!E40","v":0},{"$f":"'D. Asset Management'!F40","v":0},{"$f":"'D. Asset Management'!G40","v":0},{"$f":"'D. Asset Management'!H40","v":0}]
[]
[{"$f":"'E. Human Resource Security'!B1","v":"E. Human Resource Security"},null,null,null,{"$f":"'E. Human Resource Security'!B1","v":"E. Human Resource Security"}]
[{"$f":"'E. Human Resource Security'!A5","v":2536},{"$f":"'E. Human Resource Security'!I5","v":1},{"$f":"'E. Human Resource Security'!J5","v":0},{"$f":"'E. Human Resource Security'!X5","v":1},{"$f":"'E. Human Resource Security'!B5","v":"E.1"},{"$f":"'E. Human Resource Security'!C5","v":"Are security roles and responsibilities of constituents defined and documented in accordance with the respondent’s information security policy?"},{"$f":"'E. Human Resource Security'!D5","v":"Yes"},{"$f":"'E. Human Resource Security'!E5","v":"Cloudamize Security Policy - Cloudamize Security Work Group"},{"$f":"'E. Human Resource Security'!F5","v":"C.3 Security Organization Roles/Responsibilities"},{"$f":"'E. Human Resource Security'!G5","v":"6.1.1"},{"$f":"'E. Human Resource Security'!H5","v":"Information security roles and responsibilities"},"PO4.6","Roles and responsibilities",12.1,"IS.2.M.15.1 MGMT.1.6.1.2 WPS.2.2.1.3.1","PO4.6, PO4.8, PO6.3, PO7.1, PO7.2, PO7.3, DS5.4"]
[{"$f":"'E. Human Resource Security'!A6","v":2538},{"$f":"'E. Human Resource Security'!I6","v":1},{"$f":"'E. Human Resource Security'!J6","v":0},{"$f":"'E. Human Resource Security'!X6","v":1},{"$f":"'E. Human Resource Security'!B6","v":"E.2"},{"$f":"'E. Human Resource Security'!C6","v":"Is a background screening performed prior to allowing constituent access to Scoped Systems and Data? If yes, does it include:"},{"$f":"'E. Human Resource Security'!D6","v":"No"},{"$f":"'E. Human Resource Security'!E6","v":0},{"$f":"'E. Human Resource Security'!F6","v":"E.3 Background Investigation Policy Content"},{"$f":"'E. Human Resource Security'!G6","v":"7.1.1"},{"$f":"'E. Human Resource Security'!H6","v":"Screening"},null,null,12.7,"IS.2.F.1","N/A"]
[{"$f":"'E. Human Resource Security'!A7","v":148},{"$f":"'E. Human Resource Security'!I7","v":2},{"$f":"'E. Human Resource Security'!J7","v":0},{"$f":"'E. Human Resource Security'!X7","v":0},{"$f":"'E. Human Resource Security'!B7","v":"E.2.1"},{"$f":"'E. Human Resource Security'!C7","v":"Criminal?"},{"$f":"'E. Human Resource Security'!D7","v":0},{"$f":"'E. Human Resource Security'!E7","v":0},{"$f":"'E. Human Resource Security'!F7","v":"E.3.b.7"},{"$f":"'E. Human Resource Security'!G7","v":"7.1.1.e "},{"$f":"'E. Human Resource Security'!H7","v":"Screening"},"PO4.6","Roles and responsibilities","N/A","N/A","PO4.6, PO7.1, PO7.6, DS2.3"]
[{"$f":"'E. Human Resource Security'!A8","v":155},{"$f":"'E. Human Resource Security'!I8","v":2},{"$f":"'E. Human Resource Security'!J8","v":0},{"$f":"'E. Human Resource Security'!X8","v":0},{"$f":"'E. Human Resource Security'!B8","v":"E.2.2"},{"$f":"'E. Human Resource Security'!C8","v":"Credit?"},{"$f":"'E. Human Resource Security'!D8","v":0},{"$f":"'E. Human Resource Security'!E8","v":0},{"$f":"'E. Human Resource Security'!F8","v":"E.3.b.6"},{"$f":"'E. Human Resource Security'!G8","v":"7.1.1.e "},{"$f":"'E. Human Resource Security'!H8","v":"Screening"},"PO4.6","Roles and responsibilities","N/A","N/A","PO4.6, PO7.1, PO7.6, DS2.3"]
[{"$f":"'E. Human Resource Security'!A9","v":162},{"$f":"'E. Human Resource Security'!I9","v":2},{"$f":"'E. Human Resource Security'!J9","v":0},{"$f":"'E. Human Resource Security'!X9","v":0},{"$f":"'E. Human Resource Security'!B9","v":"E.2.3"},{"$f":"'E. Human Resource Security'!C9","v":"Academic?"},{"$f":"'E. Human Resource Security'!D9","v":0},{"$f":"'E. Human Resource Security'!E9","v":0},{"$f":"'E. Human Resource Security'!F9","v":"E.3.b.5"},{"$f":"'E. Human Resource Security'!G9","v":"7.1.1.e "},{"$f":"'E. Human Resource Security'!H9","v":"Screening"},"PO4.6","Roles and responsibilities","N/A","N/A","PO4.6, PO7.1, PO7.6, DS2.3"]
[{"$f":"'E. Human Resource Security'!A10","v":169},{"$f":"'E. Human Resource Security'!I10","v":2},{"$f":"'E. Human Resource Security'!J10","v":0},{"$f":"'E. Human Resource Security'!X10","v":0},{"$f":"'E. Human Resource Security'!B10","v":"E.2.4"},{"$f":"'E. Human Resource Security'!C10","v":"Reference?"},{"$f":"'E. Human Resource Security'!D10","v":0},{"$f":"'E. Human Resource Security'!E10","v":0},{"$f":"'E. Human Resource Security'!F10","v":"E.3.b.8"},{"$f":"'E. Human Resource Security'!G10","v":"7.1.1.e "},{"$f":"'E. Human Resource Security'!H10","v":"Screening"},"PO4.6","Roles and responsibilities","N/A","N/A","PO4.6, PO7.1, PO7.6, DS2.3"]
[{"$f":"'E. Human Resource Security'!A11","v":2539},{"$f":"'E. Human Resource Security'!I11","v":2},{"$f":"'E. Human Resource Security'!J11","v":0},{"$f":"'E. Human Resource Security'!X11","v":0},{"$f":"'E. Human Resource Security'!B11","v":"E.2.5"},{"$f":"'E. Human Resource Security'!C11","v":"Resume or curriculum vitae?"},{"$f":"'E. Human Resource Security'!D11","v":0},{"$f":"'E. Human Resource Security'!E11","v":0},{"$f":"'E. Human Resource Security'!F11","v":"E.3.b.4"},{"$f":"'E. Human Resource Security'!G11","v":"7.1.1.e "},{"$f":"'E. Human Resource Security'!H11","v":"Screening"},"PO4.6","Roles and responsibilities","N/A","RPS.1.1.3.1.2","PO4.6, PO7.1, PO7.6, DS2.3"]
[{"$f":"'E. Human Resource Security'!A12","v":176},{"$f":"'E. Human Resource Security'!I12","v":2},{"$f":"'E. Human Resource Security'!J12","v":0},{"$f":"'E. Human Resource Security'!X12","v":0},{"$f":"'E. Human Resource Security'!B12","v":"E.2.6"},{"$f":"'E. Human Resource Security'!C12","v":"Drug Screening?"},{"$f":"'E. Human Resource Security'!D12","v":0},{"$f":"'E. Human Resource Security'!E12","v":0},{"$f":"'E. Human Resource Security'!F12","v":0},{"$f":"'E. Human Resource Security'!G12","v":"NA"},{"$f":"'E. Human Resource Security'!H12","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A13","v":4007},{"$f":"'E. Human Resource Security'!I13","v":1},{"$f":"'E. Human Resource Security'!J13","v":0},{"$f":"'E. Human Resource Security'!X13","v":0},{"$f":"'E. Human Resource Security'!B13","v":"E.3"},{"$f":"'E. Human Resource Security'!C13","v":"Are periodic background checks conducted? If yes, do they include the following individuals:"},{"$f":"'E. Human Resource Security'!D13","v":"No"},{"$f":"'E. Human Resource Security'!E13","v":0},{"$f":"'E. Human Resource Security'!F13","v":0},{"$f":"'E. Human Resource Security'!G13","v":0},{"$f":"'E. Human Resource Security'!H13","v":0}]
[{"$f":"'E. Human Resource Security'!A14","v":4008},{"$f":"'E. Human Resource Security'!I14","v":2},{"$f":"'E. Human Resource Security'!J14","v":0},{"$f":"'E. Human Resource Security'!X14","v":0},{"$f":"'E. Human Resource Security'!B14","v":"E.3.1"},{"$f":"'E. Human Resource Security'!C14","v":"Senior Management?"},{"$f":"'E. Human Resource Security'!D14","v":0},{"$f":"'E. Human Resource Security'!E14","v":0},{"$f":"'E. Human Resource Security'!F14","v":0},{"$f":"'E. Human Resource Security'!G14","v":0},{"$f":"'E. Human Resource Security'!H14","v":0}]
[{"$f":"'E. Human Resource Security'!A15","v":4009},{"$f":"'E. Human Resource Security'!I15","v":2},{"$f":"'E. Human Resource Security'!J15","v":0},{"$f":"'E. Human Resource Security'!X15","v":0},{"$f":"'E. Human Resource Security'!B15","v":"E.3.2"},{"$f":"'E. Human Resource Security'!C15","v":"Subcontractors?"},{"$f":"'E. Human Resource Security'!D15","v":0},{"$f":"'E. Human Resource Security'!E15","v":0},{"$f":"'E. Human Resource Security'!F15","v":0},{"$f":"'E. Human Resource Security'!G15","v":0},{"$f":"'E. Human Resource Security'!H15","v":0}]
[{"$f":"'E. Human Resource Security'!A16","v":4010},{"$f":"'E. Human Resource Security'!I16","v":2},{"$f":"'E. Human Resource Security'!J16","v":0},{"$f":"'E. Human Resource Security'!X16","v":0},{"$f":"'E. Human Resource Security'!B16","v":"E.3.3"},{"$f":"'E. Human Resource Security'!C16","v":"All other employees?"},{"$f":"'E. Human Resource Security'!D16","v":0},{"$f":"'E. Human Resource Security'!E16","v":0},{"$f":"'E. Human Resource Security'!F16","v":0},{"$f":"'E. Human Resource Security'!G16","v":0},{"$f":"'E. Human Resource Security'!H16","v":0}]
[{"$f":"'E. Human Resource Security'!A17","v":183},{"$f":"'E. Human Resource Security'!I17","v":1},{"$f":"'E. Human Resource Security'!J17","v":0},{"$f":"'E. Human Resource Security'!X17","v":1},{"$f":"'E. Human Resource Security'!B17","v":"E.4"},{"$f":"'E. Human Resource Security'!C17","v":"Are new hires required to sign any agreements upon hire? If yes, does it include:"},{"$f":"'E. Human Resource Security'!D17","v":"Yes"},{"$f":"'E. Human Resource Security'!E17","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'E. Human Resource Security'!F17","v":"E.4 Agreements for Employees"},{"$f":"'E. Human Resource Security'!G17","v":"7.1.2"},{"$f":"'E. Human Resource Security'!H17","v":"Terms and conditions of employment"},"PO4.6","Roles and responsibilities","12.6.2","IS.2.A.8.1 IS.2.F.4 IS.2.F.2","PO4.6, PO7.1, PO7.3, DS2.3"]
[{"$f":"'E. Human Resource Security'!A18","v":184},{"$f":"'E. Human Resource Security'!I18","v":2},{"$f":"'E. Human Resource Security'!J18","v":0},{"$f":"'E. Human Resource Security'!X18","v":0},{"$f":"'E. Human Resource Security'!B18","v":"E.4.1"},{"$f":"'E. Human Resource Security'!C18","v":"Acceptable Use?"},{"$f":"'E. Human Resource Security'!D18","v":"Yes"},{"$f":"'E. Human Resource Security'!E18","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'E. Human Resource Security'!F18","v":"E.4 Agreements for Employees"},{"$f":"'E. Human Resource Security'!G18","v":"8.1.3"},{"$f":"'E. Human Resource Security'!H18","v":"Acceptable use of assets"},"PO4.10","Supervision","12.3.5","N/A","PO4.10, PO6.2"]
[{"$f":"'E. Human Resource Security'!A19","v":191},{"$f":"'E. Human Resource Security'!I19","v":2},{"$f":"'E. Human Resource Security'!J19","v":0},{"$f":"'E. Human Resource Security'!X19","v":0},{"$f":"'E. Human Resource Security'!B19","v":"E.4.2"},{"$f":"'E. Human Resource Security'!C19","v":"Code of Conduct / Ethics?"},{"$f":"'E. Human Resource Security'!D19","v":"Yes"},{"$f":"'E. Human Resource Security'!E19","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'E. Human Resource Security'!F19","v":"E.4 Agreements for Employees"},{"$f":"'E. Human Resource Security'!G19","v":"7.1.2"},{"$f":"'E. Human Resource Security'!H19","v":"Terms and conditions of employment"},"PO4.6","Roles and responsibilities","N/A","N/A","PO4.6, PO7.1, PO7.3, DS2.3"]
[{"$f":"'E. Human Resource Security'!A20","v":198},{"$f":"'E. Human Resource Security'!I20","v":2},{"$f":"'E. Human Resource Security'!J20","v":0},{"$f":"'E. Human Resource Security'!X20","v":0},{"$f":"'E. Human Resource Security'!B20","v":"E.4.3"},{"$f":"'E. Human Resource Security'!C20","v":"Non-Disclosure Agreement?"},{"$f":"'E. Human Resource Security'!D20","v":"Yes"},{"$f":"'E. Human Resource Security'!E20","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'E. Human Resource Security'!F20","v":"E.4 Agreements for Employees"},{"$f":"'E. Human Resource Security'!G20","v":"7.1.2"},{"$f":"'E. Human Resource Security'!H20","v":"Terms and conditions of employment"},"PO4.6","Roles and responsibilities","N/A","N/A","PO4.6, PO7.1, PO7.3, DS2.3"]
[{"$f":"'E. Human Resource Security'!A21","v":205},{"$f":"'E. Human Resource Security'!I21","v":2},{"$f":"'E. Human Resource Security'!J21","v":0},{"$f":"'E. Human Resource Security'!X21","v":0},{"$f":"'E. Human Resource Security'!B21","v":"E.4.4"},{"$f":"'E. Human Resource Security'!C21","v":"Confidentiality Agreement?"},{"$f":"'E. Human Resource Security'!D21","v":"Yes"},{"$f":"'E. Human Resource Security'!E21","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'E. Human Resource Security'!F21","v":"E.4 Agreements for Employees"},{"$f":"'E. Human Resource Security'!G21","v":"7.1.2"},{"$f":"'E. Human Resource Security'!H21","v":"Terms and conditions of employment"},"PO4.6","Roles and responsibilities","N/A","N/A","PO4.6, PO7.1, PO7.3, DS2.3"]
[{"$f":"'E. Human Resource Security'!A22","v":2555},{"$f":"'E. Human Resource Security'!I22","v":2},{"$f":"'E. Human Resource Security'!J22","v":0},{"$f":"'E. Human Resource Security'!X22","v":0},{"$f":"'E. Human Resource Security'!B22","v":"E.4.5"},{"$f":"'E. Human Resource Security'!C22","v":"Are constituents required to sign annual acknowledgements? If yes, do they include:"},{"$f":"'E. Human Resource Security'!D22","v":"Yes"},{"$f":"'E. Human Resource Security'!E22","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'E. Human Resource Security'!F22","v":"E.4 Agreements for Employees"},{"$f":"'E. Human Resource Security'!G22","v":"NA"},{"$f":"'E. Human Resource Security'!H22","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A23","v":265},{"$f":"'E. Human Resource Security'!I23","v":3},{"$f":"'E. Human Resource Security'!J23","v":0},{"$f":"'E. Human Resource Security'!X23","v":0},{"$f":"'E. Human Resource Security'!B23","v":"E.4.5.1"},{"$f":"'E. Human Resource Security'!C23","v":"Acceptable Use?"},{"$f":"'E. Human Resource Security'!D23","v":"Yes"},{"$f":"'E. Human Resource Security'!E23","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'E. Human Resource Security'!F23","v":"E.4 Agreements for Employees"},{"$f":"'E. Human Resource Security'!G23","v":"NA"},{"$f":"'E. Human Resource Security'!H23","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A24","v":272},{"$f":"'E. Human Resource Security'!I24","v":3},{"$f":"'E. Human Resource Security'!J24","v":0},{"$f":"'E. Human Resource Security'!X24","v":0},{"$f":"'E. Human Resource Security'!B24","v":"E.4.5.2"},{"$f":"'E. Human Resource Security'!C24","v":"Code of Conduct / Ethics?"},{"$f":"'E. Human Resource Security'!D24","v":"Yes"},{"$f":"'E. Human Resource Security'!E24","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'E. Human Resource Security'!F24","v":"E.4 Agreements for Employees"},{"$f":"'E. Human Resource Security'!G24","v":"NA"},{"$f":"'E. Human Resource Security'!H24","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A25","v":279},{"$f":"'E. Human Resource Security'!I25","v":3},{"$f":"'E. Human Resource Security'!J25","v":0},{"$f":"'E. Human Resource Security'!X25","v":0},{"$f":"'E. Human Resource Security'!B25","v":"E.4.5.3"},{"$f":"'E. Human Resource Security'!C25","v":"Non-Disclosure Agreement?"},{"$f":"'E. Human Resource Security'!D25","v":"Yes"},{"$f":"'E. Human Resource Security'!E25","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'E. Human Resource Security'!F25","v":"E.4 Agreements for Employees"},{"$f":"'E. Human Resource Security'!G25","v":"NA"},{"$f":"'E. Human Resource Security'!H25","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A26","v":286},{"$f":"'E. Human Resource Security'!I26","v":3},{"$f":"'E. Human Resource Security'!J26","v":0},{"$f":"'E. Human Resource Security'!X26","v":0},{"$f":"'E. Human Resource Security'!B26","v":"E.4.5.4"},{"$f":"'E. Human Resource Security'!C26","v":"Confidentiality Agreement?"},{"$f":"'E. Human Resource Security'!D26","v":"Yes"},{"$f":"'E. Human Resource Security'!E26","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'E. Human Resource Security'!F26","v":"E.4 Agreements for Employees"},{"$f":"'E. Human Resource Security'!G26","v":"NA"},{"$f":"'E. Human Resource Security'!H26","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A27","v":212},{"$f":"'E. Human Resource Security'!I27","v":1},{"$f":"'E. Human Resource Security'!J27","v":0},{"$f":"'E. Human Resource Security'!X27","v":1},{"$f":"'E. Human Resource Security'!B27","v":"E.5"},{"$f":"'E. Human Resource Security'!C27","v":"Is there a security awareness training program? If yes, does it include:"},{"$f":"'E. Human Resource Security'!D27","v":"Yes"},{"$f":"'E. Human Resource Security'!E27","v":"Cloudamize Security Policy - Cloudamize Security Training & Maintenance Policy"},{"$f":"'E. Human Resource Security'!F27","v":"E.1 Security Awareness Training Attendance"},{"$f":"'E. Human Resource Security'!G27","v":"7.2.2"},{"$f":"'E. Human Resource Security'!H27","v":"Information security awareness, education, and training"},"PO4.6","Roles and responsibilities",12.6,"IS.1.7.2 E-BANK.1.4.2.11 E-BANK.1.4.2.12","PO4.6, PO6.2, PO6.4, PO7.2, PO7.4, PO7.7, AI1.1, AI7.1, DS5.1, DS5.2, DS5.3, DS7.1, DS7.2"]
[{"$f":"'E. Human Resource Security'!A28","v":214},{"$f":"'E. Human Resource Security'!I28","v":2},{"$f":"'E. Human Resource Security'!J28","v":0},{"$f":"'E. Human Resource Security'!X28","v":0},{"$f":"'E. Human Resource Security'!B28","v":"E.5.1"},{"$f":"'E. Human Resource Security'!C28","v":"Security policies, procedures and processes?"},{"$f":"'E. Human Resource Security'!D28","v":"Yes"},{"$f":"'E. Human Resource Security'!E28","v":"Cloudamize Security Policy - Cloudamize Security Training & Maintenance Policy"},{"$f":"'E. Human Resource Security'!F28","v":"E.1 Security Awareness Training Attendance"},{"$f":"'E. Human Resource Security'!G28","v":"7.2.2"},{"$f":"'E. Human Resource Security'!H28","v":"Information security awareness, education, and training"},"PO4.6","Roles and responsibilities",12.1,"RPS.1.4.2 RPS.2.N.10.1","PO4.6, PO6.2, PO6.4, PO7.2, PO7.4, PO7.7, AI1.1, AI7.1, DS5.1, DS5.2, DS5.3, DS7.1, DS7.2"]
[{"$f":"'E. Human Resource Security'!A29","v":215},{"$f":"'E. Human Resource Security'!I29","v":2},{"$f":"'E. Human Resource Security'!J29","v":0},{"$f":"'E. Human Resource Security'!X29","v":0},{"$f":"'E. Human Resource Security'!B29","v":"E.5.2"},{"$f":"'E. Human Resource Security'!C29","v":"Scored test to evaluate successful completion?"},{"$f":"'E. Human Resource Security'!D29","v":"No"},{"$f":"'E. Human Resource Security'!E29","v":0},{"$f":"'E. Human Resource Security'!F29","v":"E.1 Security Awareness Training Attendance"},{"$f":"'E. Human Resource Security'!G29","v":"NA"},{"$f":"'E. Human Resource Security'!H29","v":0},null,null,"12.6.1","E-BANK.1.4.2.12","N/A"]
[{"$f":"'E. Human Resource Security'!A30","v":3302},{"$f":"'E. Human Resource Security'!I30","v":2},{"$f":"'E. Human Resource Security'!J30","v":0},{"$f":"'E. Human Resource Security'!X30","v":0},{"$f":"'E. Human Resource Security'!B30","v":"E.5.3"},{"$f":"'E. Human Resource Security'!C30","v":"New Hire and annual participation?"},{"$f":"'E. Human Resource Security'!D30","v":"Yes"},{"$f":"'E. Human Resource Security'!E30","v":"Cloudamize Security Policy - Cloudamize Security Training & Maintenance Policy / Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'E. Human Resource Security'!F30","v":"E.1.c"},{"$f":"'E. Human Resource Security'!G30","v":"7.2.2"},{"$f":"'E. Human Resource Security'!H30","v":"Information security awareness, education, and training"},"PO4.6","Roles and responsibilities","12.6.1","N/A","PO4.6, PO6.2, PO6.4, PO7.2, PO7.4, PO7.7, AI1.1, AI7.1, DS5.1, DS5.2, DS5.3, DS7.1, DS7.2"]
[{"$f":"'E. Human Resource Security'!A31","v":218},{"$f":"'E. Human Resource Security'!I31","v":2},{"$f":"'E. Human Resource Security'!J31","v":0},{"$f":"'E. Human Resource Security'!X31","v":0},{"$f":"'E. Human Resource Security'!B31","v":"E.5.4"},{"$f":"'E. Human Resource Security'!C31","v":"Training commensurate with levels of responsibilities and access?"},{"$f":"'E. Human Resource Security'!D31","v":"Yes"},{"$f":"'E. Human Resource Security'!E31","v":"Cloudamize Security Policy - Cloudamize Security Training & Maintenance Policy"},{"$f":"'E. Human Resource Security'!F31","v":0},{"$f":"'E. Human Resource Security'!G31","v":"7.2.2"},{"$f":"'E. Human Resource Security'!H31","v":"Information security awareness, education, and training"},"PO4.6","Roles and responsibilities",12.4,"IS.1.2.8.1","PO4.6, PO6.2, PO6.4, PO7.2, PO7.4, PO7.7, AI1.1, AI7.1, DS5.1, DS5.2, DS5.3, DS7.1, DS7.2"]
[{"$f":"'E. Human Resource Security'!A32","v":219},{"$f":"'E. Human Resource Security'!I32","v":2},{"$f":"'E. Human Resource Security'!J32","v":0},{"$f":"'E. Human Resource Security'!X32","v":0},{"$f":"'E. Human Resource Security'!B32","v":"E.5.5"},{"$f":"'E. Human Resource Security'!C32","v":"Additional training for those responsible for information security?"},{"$f":"'E. Human Resource Security'!D32","v":"No"},{"$f":"'E. Human Resource Security'!E32","v":"All Cloudamize employees and Consitutents are held to the same standard of Information Security. "},{"$f":"'E. Human Resource Security'!F32","v":0},{"$f":"'E. Human Resource Security'!G32","v":"7.2.2"},{"$f":"'E. Human Resource Security'!H32","v":"Information security awareness, education, and training"},"PO4.6","Roles and responsibilities",12.4,"IS.1.2.8.1","PO4.6, PO6.2, PO6.4, PO7.2, PO7.4, PO7.7, AI1.1, AI7.1, DS5.1, DS5.2, DS5.3, DS7.1, DS7.2"]
[{"$f":"'E. Human Resource Security'!A33","v":220},{"$f":"'E. Human Resource Security'!I33","v":1},{"$f":"'E. Human Resource Security'!J33","v":0},{"$f":"'E. Human Resource Security'!X33","v":0},{"$f":"'E. Human Resource Security'!B33","v":"E.6"},{"$f":"'E. Human Resource Security'!C33","v":"Do information security personnel have professional security certifications?"},{"$f":"'E. Human Resource Security'!D33","v":"No"},{"$f":"'E. Human Resource Security'!E33","v":"All Cloudamize employees and Consitutents are held to the same standard of Information Security. "},{"$f":"'E. Human Resource Security'!F33","v":0},{"$f":"'E. Human Resource Security'!G33","v":"6.1.4"},{"$f":"'E. Human Resource Security'!H33","v":"Contact with special interest groups"},"PO4.15","Relationships","N/A","N/A","PO4.15, DS4.1, DS4.2"]
[{"$f":"'E. Human Resource Security'!A34","v":293},{"$f":"'E. Human Resource Security'!I34","v":1},{"$f":"'E. Human Resource Security'!J34","v":0},{"$f":"'E. Human Resource Security'!X34","v":1},{"$f":"'E. Human Resource Security'!B34","v":"E.7"},{"$f":"'E. Human Resource Security'!C34","v":"Is there a disciplinary process for non-compliance with information security policies?"},{"$f":"'E. Human Resource Security'!D34","v":"Yes"},{"$f":"'E. Human Resource Security'!E34","v":"Cloudamize Security Policy - Cloudamize Information Secuirty Policy - Non-Compliance"},{"$f":"'E. Human Resource Security'!F34","v":0},{"$f":"'E. Human Resource Security'!G34","v":"7.2.3"},{"$f":"'E. Human Resource Security'!H34","v":"Disciplinary process"},"PO4.8","Responsibility for risk, security and compliance","N/A","IS.1.7.6","PO4.8, PO7.8, DS5.6"]
[{"$f":"'E. Human Resource Security'!A35","v":2557},{"$f":"'E. Human Resource Security'!I35","v":1},{"$f":"'E. Human Resource Security'!J35","v":0},{"$f":"'E. Human Resource Security'!X35","v":1},{"$f":"'E. Human Resource Security'!B35","v":"E.8"},{"$f":"'E. Human Resource Security'!C35","v":"Is there a constituent termination or change of status process?"},{"$f":"'E. Human Resource Security'!D35","v":"Yes"},{"$f":"'E. Human Resource Security'!E35","v":"Cloudamize Security Policy - Cloudamize Information Secuirty Policy - Non-Compliance"},{"$f":"'E. Human Resource Security'!F35","v":"H.2 Revoke System Access"},{"$f":"'E. Human Resource Security'!G35","v":7.3},{"$f":"'E. Human Resource Security'!H35","v":"Termination responsibilities"},"PO7.8","Job change and termination","N/A","OPS.1.5.3.5","PO4.8, PO7.8, DS5.6"]
[{"$f":"'E. Human Resource Security'!A36","v":294},{"$f":"'E. Human Resource Security'!I36","v":2},{"$f":"'E. Human Resource Security'!J36","v":0},{"$f":"'E. Human Resource Security'!X36","v":0},{"$f":"'E. Human Resource Security'!B36","v":"E.8.1"},{"$f":"'E. Human Resource Security'!C36","v":"Is there a documented termination or change of status policy or process that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"'E. Human Resource Security'!D36","v":"Yes"},{"$f":"'E. Human Resource Security'!E36","v":"Cloudamize Security Policy - Cloudamize Information Secuirty Policy"},{"$f":"'E. Human Resource Security'!F36","v":0},{"$f":"'E. Human Resource Security'!G36","v":7.3},{"$f":"'E. Human Resource Security'!H36","v":"Termination responsibilities"},"PO7.8","Job change and termination","N/A","IS.1.4.1.1.2","PO4.8, PO7.8, DS5.6"]
[{"$f":"'E. Human Resource Security'!A37","v":299},{"$f":"'E. Human Resource Security'!I37","v":2},{"$f":"'E. Human Resource Security'!J37","v":0},{"$f":"'E. Human Resource Security'!X37","v":0},{"$f":"'E. Human Resource Security'!B37","v":"E.8.2"},{"$f":"'E. Human Resource Security'!C37","v":"Does HR notify security / access administration of constituent termination for access rights removal? If yes, is notification provided:"},{"$f":"'E. Human Resource Security'!D37","v":"Yes"},{"$f":"'E. Human Resource Security'!E37","v":"Cloudamize Security Policy - Cloudamize Information Secuirty Policy"},{"$f":"'E. Human Resource Security'!F37","v":"H.2 Revoke System Access"},{"$f":"'E. Human Resource Security'!G37","v":"7.3.1"},{"$f":"'E. Human Resource Security'!H37","v":"Termination or change of employment responsibilities"},"PO7.8","Job change and termination","N/A","IS.2.A.5.1 WPS.2.9.2.6","PO7.8, DS5.4"]
[{"$f":"'E. Human Resource Security'!A38","v":301},{"$f":"'E. Human Resource Security'!I38","v":3},{"$f":"'E. Human Resource Security'!J38","v":0},{"$f":"'E. Human Resource Security'!X38","v":0},{"$f":"'E. Human Resource Security'!B38","v":"E.8.2.1"},{"$f":"'E. Human Resource Security'!C38","v":"On the actual date?"},{"$f":"'E. Human Resource Security'!D38","v":"Yes"},{"$f":"'E. Human Resource Security'!E38","v":"Cloudamize Security Policy - Cloudamize Information Secuirty Policy"},{"$f":"'E. Human Resource Security'!F38","v":0},{"$f":"'E. Human Resource Security'!G38","v":"NA"},{"$f":"'E. Human Resource Security'!H38","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A39","v":302},{"$f":"'E. Human Resource Security'!I39","v":3},{"$f":"'E. Human Resource Security'!J39","v":0},{"$f":"'E. Human Resource Security'!X39","v":0},{"$f":"'E. Human Resource Security'!B39","v":"E.8.2.2"},{"$f":"'E. Human Resource Security'!C39","v":"Two to seven days after termination?"},{"$f":"'E. Human Resource Security'!D39","v":"No"},{"$f":"'E. Human Resource Security'!E39","v":0},{"$f":"'E. Human Resource Security'!F39","v":0},{"$f":"'E. Human Resource Security'!G39","v":"NA"},{"$f":"'E. Human Resource Security'!H39","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A40","v":303},{"$f":"'E. Human Resource Security'!I40","v":3},{"$f":"'E. Human Resource Security'!J40","v":0},{"$f":"'E. Human Resource Security'!X40","v":0},{"$f":"'E. Human Resource Security'!B40","v":"E.8.2.3"},{"$f":"'E. Human Resource Security'!C40","v":"Greater than seven days after termination?"},{"$f":"'E. Human Resource Security'!D40","v":"No"},{"$f":"'E. Human Resource Security'!E40","v":0},{"$f":"'E. Human Resource Security'!F40","v":0},{"$f":"'E. Human Resource Security'!G40","v":"NA"},{"$f":"'E. Human Resource Security'!H40","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A41","v":304},{"$f":"'E. Human Resource Security'!I41","v":2},{"$f":"'E. Human Resource Security'!J41","v":0},{"$f":"'E. Human Resource Security'!X41","v":0},{"$f":"'E. Human Resource Security'!B41","v":"E.8.3"},{"$f":"'E. Human Resource Security'!C41","v":"Does HR notify security / access administration of a constituent change of status for access rights removal? If yes, is notification provided:"},{"$f":"'E. Human Resource Security'!D41","v":"Yes"},{"$f":"'E. Human Resource Security'!E41","v":"Cloudamize Security Policy - Cloudamize Information Secuirty Policy"},{"$f":"'E. Human Resource Security'!F41","v":"H.2 Revoke System Access"},{"$f":"'E. Human Resource Security'!G41","v":"7.3.1"},{"$f":"'E. Human Resource Security'!H41","v":"Termination or change of employment responsibilities"},"PO7.8","Job change and termination","N/A","IS.2.A.5.2 WPS.2.9.2.6","PO7.8, DS5.4"]
[{"$f":"'E. Human Resource Security'!A42","v":306},{"$f":"'E. Human Resource Security'!I42","v":3},{"$f":"'E. Human Resource Security'!J42","v":0},{"$f":"'E. Human Resource Security'!X42","v":0},{"$f":"'E. Human Resource Security'!B42","v":"E.8.3.1"},{"$f":"'E. Human Resource Security'!C42","v":"On the actual date of the change of status?"},{"$f":"'E. Human Resource Security'!D42","v":"Yes"},{"$f":"'E. Human Resource Security'!E42","v":"Cloudamize Security Policy - Cloudamize Information Secuirty Policy"},{"$f":"'E. Human Resource Security'!F42","v":0},{"$f":"'E. Human Resource Security'!G42","v":"NA"},{"$f":"'E. Human Resource Security'!H42","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A43","v":307},{"$f":"'E. Human Resource Security'!I43","v":3},{"$f":"'E. Human Resource Security'!J43","v":0},{"$f":"'E. Human Resource Security'!X43","v":0},{"$f":"'E. Human Resource Security'!B43","v":"E.8.3.2"},{"$f":"'E. Human Resource Security'!C43","v":"Two to seven days after the change of status?"},{"$f":"'E. Human Resource Security'!D43","v":"No"},{"$f":"'E. Human Resource Security'!E43","v":0},{"$f":"'E. Human Resource Security'!F43","v":0},{"$f":"'E. Human Resource Security'!G43","v":"NA"},{"$f":"'E. Human Resource Security'!H43","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A44","v":308},{"$f":"'E. Human Resource Security'!I44","v":3},{"$f":"'E. Human Resource Security'!J44","v":0},{"$f":"'E. Human Resource Security'!X44","v":0},{"$f":"'E. Human Resource Security'!B44","v":"E.8.3.3"},{"$f":"'E. Human Resource Security'!C44","v":"Greater than seven days after the change of status?"},{"$f":"'E. Human Resource Security'!D44","v":"No"},{"$f":"'E. Human Resource Security'!E44","v":0},{"$f":"'E. Human Resource Security'!F44","v":0},{"$f":"'E. Human Resource Security'!G44","v":"NA"},{"$f":"'E. Human Resource Security'!H44","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A45","v":2558},{"$f":"'E. Human Resource Security'!I45","v":2},{"$f":"'E. Human Resource Security'!J45","v":1},{"$f":"'E. Human Resource Security'!X45","v":0},{"$f":"'E. Human Resource Security'!B45","v":"E.8.4"},{"$f":"'E. Human Resource Security'!C45","v":"Are constituents required to return assets (laptop, desktop, PDA, cell phones, access cards, tokens, smart cards, keys, proprietary documentation) upon:"},{"$f":"'E. Human Resource Security'!D45","v":0},{"$f":"'E. Human Resource Security'!E45","v":0},{"$f":"'E. Human Resource Security'!F45","v":0},{"$f":"'E. Human Resource Security'!G45","v":"8.1.4"},{"$f":"'E. Human Resource Security'!H45","v":"Return of assets"},"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, PO7.8"]
[{"$f":"'E. Human Resource Security'!A46","v":310},{"$f":"'E. Human Resource Security'!I46","v":3},{"$f":"'E. Human Resource Security'!J46","v":0},{"$f":"'E. Human Resource Security'!X46","v":0},{"$f":"'E. Human Resource Security'!B46","v":"E.8.4.1"},{"$f":"'E. Human Resource Security'!C46","v":"Termination?"},{"$f":"'E. Human Resource Security'!D46","v":"Yes"},{"$f":"'E. Human Resource Security'!E46","v":0},{"$f":"'E. Human Resource Security'!F46","v":0},{"$f":"'E. Human Resource Security'!G46","v":"8.1.4"},{"$f":"'E. Human Resource Security'!H46","v":"Return of assets"},"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, PO7.8"]
[{"$f":"'E. Human Resource Security'!A47","v":4011},{"$f":"'E. Human Resource Security'!I47","v":1},{"$f":"'E. Human Resource Security'!J47","v":0},{"$f":"'E. Human Resource Security'!X47","v":0},{"$f":"'E. Human Resource Security'!B47","v":"E.9"},{"$f":"'E. Human Resource Security'!C47","v":"Is there a succession and redundancy planning for key management and support personnel? If yes, does it include:"},{"$f":"'E. Human Resource Security'!D47","v":"No"},{"$f":"'E. Human Resource Security'!E47","v":0},{"$f":"'E. Human Resource Security'!F47","v":0},{"$f":"'E. Human Resource Security'!G47","v":0},{"$f":"'E. Human Resource Security'!H47","v":0},"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, PO7.8"]
[{"$f":"'E. Human Resource Security'!A48","v":4012},{"$f":"'E. Human Resource Security'!I48","v":2},{"$f":"'E. Human Resource Security'!J48","v":0},{"$f":"'E. Human Resource Security'!X48","v":0},{"$f":"'E. Human Resource Security'!B48","v":"E.9.1"},{"$f":"'E. Human Resource Security'!C48","v":"Senior Management?"},{"$f":"'E. Human Resource Security'!D48","v":0},{"$f":"'E. Human Resource Security'!E48","v":0},{"$f":"'E. Human Resource Security'!F48","v":0},{"$f":"'E. Human Resource Security'!G48","v":0},{"$f":"'E. Human Resource Security'!H48","v":0}]
[{"$f":"'E. Human Resource Security'!A49","v":4013},{"$f":"'E. Human Resource Security'!I49","v":2},{"$f":"'E. Human Resource Security'!J49","v":0},{"$f":"'E. Human Resource Security'!X49","v":0},{"$f":"'E. Human Resource Security'!B49","v":"E.9.2"},{"$f":"'E. Human Resource Security'!C49","v":"Key support, operations and devleopment areas?"},{"$f":"'E. Human Resource Security'!D49","v":0},{"$f":"'E. Human Resource Security'!E49","v":0},{"$f":"'E. Human Resource Security'!F49","v":0},{"$f":"'E. Human Resource Security'!G49","v":0},{"$f":"'E. Human Resource Security'!H49","v":0}]
[{"$f":"'E. Human Resource Security'!A50","v":0},{"$f":"'E. Human Resource Security'!I50","v":0},{"$f":"'E. Human Resource Security'!J50","v":0},{"$f":"'E. Human Resource Security'!X50","v":0},{"$f":"'E. Human Resource Security'!B50","v":0},{"$f":"'E. Human Resource Security'!C50","v":0},{"$f":"'E. Human Resource Security'!D50","v":0},{"$f":"'E. Human Resource Security'!E50","v":0},{"$f":"'E. Human Resource Security'!F50","v":0},{"$f":"'E. Human Resource Security'!G50","v":0},{"$f":"'E. Human Resource Security'!H50","v":0}]
[]
[{"$f":"'F. Physical and Environmental'!B1","v":"F. Physical and Environmental Security"},null,null,null,{"$f":"'F. Physical and Environmental'!B1","v":"F. Physical and Environmental Security"}]
[{"$f":"'F. Physical and Environmental'!A5","v":2559},{"$f":"'F. Physical and Environmental'!I5","v":1},{"$f":"'F. Physical and Environmental'!J5","v":0},{"$f":"'F. Physical and Environmental'!X5","v":1},{"$f":"'F. Physical and Environmental'!B5","v":"F.1"},{"$f":"'F. Physical and Environmental'!C5","v":"Is there a physical security program?"},{"$f":"'F. Physical and Environmental'!D5","v":"Yes"},{"$f":"'F. Physical and Environmental'!E5","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"'F. Physical and Environmental'!F5","v":0},{"$f":"'F. Physical and Environmental'!G5","v":"5.1.1"},{"$f":"'F. Physical and Environmental'!H5","v":"Policies for information security"},"PO6.1","IT policy and control environment",12.1,"IS.2.E.1 OPS.1.5.1.6 OPS.1.5.1.8 WPS.2.2.1.3.5 AUDIT.2.D.1.10 E-BANK.1.4.2.8 E-BANK.1.5.4 RPS.1.2.2.2","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'F. Physical and Environmental'!A6","v":312},{"$f":"'F. Physical and Environmental'!I6","v":2},{"$f":"'F. Physical and Environmental'!J6","v":0},{"$f":"'F. Physical and Environmental'!X6","v":0},{"$f":"'F. Physical and Environmental'!B6","v":"F.1.1"},{"$f":"'F. Physical and Environmental'!C6","v":"Is there a documented physical security policy approved by management, communicated to constituents and an owner assigned to maintain and review the policy?"},{"$f":"'F. Physical and Environmental'!D6","v":"Yes"},{"$f":"'F. Physical and Environmental'!E6","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"'F. Physical and Environmental'!F6","v":"B.1 Information Security Policy Content"},{"$f":"'F. Physical and Environmental'!G6","v":"5.1.1"},{"$f":"'F. Physical and Environmental'!H6","v":"Policies for information security"},"PO6.1","IT policy and control environment",9.1,"N/A","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'F. Physical and Environmental'!A7","v":2560},{"$f":"'F. Physical and Environmental'!I7","v":2},{"$f":"'F. Physical and Environmental'!J7","v":0},{"$f":"'F. Physical and Environmental'!X7","v":1},{"$f":"'F. Physical and Environmental'!B7","v":"F.1.2"},{"$f":"'F. Physical and Environmental'!C7","v":"Are reasonable physical security and environmental controls present in the building/data center that contains Scoped Systems and Data? If yes, does it include:"},{"$f":"'F. Physical and Environmental'!D7","v":"Yes"},{"$f":"'F. Physical and Environmental'!E7","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy / 1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F7","v":"F. Physical and Environmental Security"},{"$f":"'F. Physical and Environmental'!G7","v":11.1},{"$f":"'F. Physical and Environmental'!H7","v":"Secure areas"},null,null,9.3000000000000007,"N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A8","v":2561},{"$f":"'F. Physical and Environmental'!I8","v":3},{"$f":"'F. Physical and Environmental'!J8","v":0},{"$f":"'F. Physical and Environmental'!X8","v":0},{"$f":"'F. Physical and Environmental'!B8","v":"F.1.2.1"},{"$f":"'F. Physical and Environmental'!C8","v":"Signage to identify the operations of the facility (data center)?"},{"$f":"'F. Physical and Environmental'!D8","v":"Yes"},{"$f":"'F. Physical and Environmental'!E8","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F8","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G8","v":"11.1.3"},{"$f":"'F. Physical and Environmental'!H8","v":"Securing offices, rooms, and facilities"},"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A9","v":351},{"$f":"'F. Physical and Environmental'!I9","v":3},{"$f":"'F. Physical and Environmental'!J9","v":0},{"$f":"'F. Physical and Environmental'!X9","v":0},{"$f":"'F. Physical and Environmental'!B9","v":"F.1.2.2"},{"$f":"'F. Physical and Environmental'!C9","v":"Other tenants using the building?"},{"$f":"'F. Physical and Environmental'!D9","v":"Yes"},{"$f":"'F. Physical and Environmental'!E9","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F9","v":0},{"$f":"'F. Physical and Environmental'!G9","v":"NA"},{"$f":"'F. Physical and Environmental'!H9","v":0},"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A10","v":381},{"$f":"'F. Physical and Environmental'!I10","v":3},{"$f":"'F. Physical and Environmental'!J10","v":0},{"$f":"'F. Physical and Environmental'!X10","v":0},{"$f":"'F. Physical and Environmental'!B10","v":"F.1.2.3"},{"$f":"'F. Physical and Environmental'!C10","v":"Access restricted and logs kept of all access?"},{"$f":"'F. Physical and Environmental'!D10","v":"Yes"},{"$f":"'F. Physical and Environmental'!E10","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F10","v":"F.5 Secure Workspace Access Reporting"},{"$f":"'F. Physical and Environmental'!G10","v":"11.1.2"},{"$f":"'F. Physical and Environmental'!H10","v":"Physical entry controls"},"DS12.2","Physical security measures",9.3000000000000007,"OPS.2.12.E.5 IS.2.E.3.2 WPS.2.9.1.1","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A11","v":387},{"$f":"'F. Physical and Environmental'!I11","v":3},{"$f":"'F. Physical and Environmental'!J11","v":0},{"$f":"'F. Physical and Environmental'!X11","v":0},{"$f":"'F. Physical and Environmental'!B11","v":"F.1.2.4"},{"$f":"'F. Physical and Environmental'!C11","v":"Electronic system (key card, token, fob, biometric reader etc.) to control access?"},{"$f":"'F. Physical and Environmental'!D11","v":"Yes"},{"$f":"'F. Physical and Environmental'!E11","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F11","v":"F.4 Secure Workspace Perimeter"},{"$f":"'F. Physical and Environmental'!G11","v":"11.1.2"},{"$f":"'F. Physical and Environmental'!H11","v":"Physical entry controls"},"DS12.2","Physical security measures",9.1,"N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A12","v":391},{"$f":"'F. Physical and Environmental'!I12","v":3},{"$f":"'F. Physical and Environmental'!J12","v":0},{"$f":"'F. Physical and Environmental'!X12","v":0},{"$f":"'F. Physical and Environmental'!B12","v":"F.1.2.5"},{"$f":"'F. Physical and Environmental'!C12","v":"Cipher locks (electronic or mechanical) to control access within or to the facility? If yes, is there a process to:"},{"$f":"'F. Physical and Environmental'!D12","v":"No"},{"$f":"'F. Physical and Environmental'!E12","v":0},{"$f":"'F. Physical and Environmental'!F12","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G12","v":"11.1.2"},{"$f":"'F. Physical and Environmental'!H12","v":"Physical entry controls"},"DS12.2","Physical security measures",9.1,"N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A13","v":392},{"$f":"'F. Physical and Environmental'!I13","v":4},{"$f":"'F. Physical and Environmental'!J13","v":0},{"$f":"'F. Physical and Environmental'!X13","v":0},{"$f":"'F. Physical and Environmental'!B13","v":"F.1.2.5.1"},{"$f":"'F. Physical and Environmental'!C13","v":"Change the code(s) at least every 90 days?"},{"$f":"'F. Physical and Environmental'!D13","v":0},{"$f":"'F. Physical and Environmental'!E13","v":0},{"$f":"'F. Physical and Environmental'!F13","v":0},{"$f":"'F. Physical and Environmental'!G13","v":"NA"},{"$f":"'F. Physical and Environmental'!H13","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A14","v":394},{"$f":"'F. Physical and Environmental'!I14","v":4},{"$f":"'F. Physical and Environmental'!J14","v":0},{"$f":"'F. Physical and Environmental'!X14","v":0},{"$f":"'F. Physical and Environmental'!B14","v":"F.1.2.5.2"},{"$f":"'F. Physical and Environmental'!C14","v":"Change the code(s) when an authorized individual is terminated or transferred to another role?"},{"$f":"'F. Physical and Environmental'!D14","v":0},{"$f":"'F. Physical and Environmental'!E14","v":0},{"$f":"'F. Physical and Environmental'!F14","v":0},{"$f":"'F. Physical and Environmental'!G14","v":"9.2.1"},{"$f":"'F. Physical and Environmental'!H14","v":"User registration and de-registration"},"PO7.8","Job change and termination","N/A","N/A","PO7.8, DS5.4"]
[{"$f":"'F. Physical and Environmental'!A15","v":374},{"$f":"'F. Physical and Environmental'!I15","v":3},{"$f":"'F. Physical and Environmental'!J15","v":0},{"$f":"'F. Physical and Environmental'!X15","v":0},{"$f":"'F. Physical and Environmental'!B15","v":"F.1.2.6"},{"$f":"'F. Physical and Environmental'!C15","v":"Security guards that provide onsite security services?"},{"$f":"'F. Physical and Environmental'!D15","v":"Yes"},{"$f":"'F. Physical and Environmental'!E15","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F15","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G15","v":"11.1.1.c "},{"$f":"'F. Physical and Environmental'!H15","v":"Physical security perimeter"},"DS12.1","Site selection and layout","N/A","OPS.2.12.E.6","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A16","v":3288},{"$f":"'F. Physical and Environmental'!I16","v":3},{"$f":"'F. Physical and Environmental'!J16","v":0},{"$f":"'F. Physical and Environmental'!X16","v":0},{"$f":"'F. Physical and Environmental'!B16","v":"F.1.2.7"},{"$f":"'F. Physical and Environmental'!C16","v":"Perimeter physical barrier (such as fence or walls)?"},{"$f":"'F. Physical and Environmental'!D16","v":"No"},{"$f":"'F. Physical and Environmental'!E16","v":0},{"$f":"'F. Physical and Environmental'!F16","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G16","v":"11.1.1.d "},{"$f":"'F. Physical and Environmental'!H16","v":"Physical security perimeter"},"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A17","v":371},{"$f":"'F. Physical and Environmental'!I17","v":3},{"$f":"'F. Physical and Environmental'!J17","v":0},{"$f":"'F. Physical and Environmental'!X17","v":0},{"$f":"'F. Physical and Environmental'!B17","v":"F.1.2.8"},{"$f":"'F. Physical and Environmental'!C17","v":"Entry and exit doors alarmed (forced entry, propped open) and/or monitored by security guards?"},{"$f":"'F. Physical and Environmental'!D17","v":"Yes"},{"$f":"'F. Physical and Environmental'!E17","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F17","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G17","v":"11.1.1.e "},{"$f":"'F. Physical and Environmental'!H17","v":"Physical security perimeter"},"DS12.1","Site selection and layout","9.1.1","OPS.2.12.E.10","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A18","v":395},{"$f":"'F. Physical and Environmental'!I18","v":3},{"$f":"'F. Physical and Environmental'!J18","v":0},{"$f":"'F. Physical and Environmental'!X18","v":0},{"$f":"'F. Physical and Environmental'!B18","v":"F.1.2.9"},{"$f":"'F. Physical and Environmental'!C18","v":"A mechanism to prevent tailgating / piggybacking?"},{"$f":"'F. Physical and Environmental'!D18","v":"Yes"},{"$f":"'F. Physical and Environmental'!E18","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F18","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G18","v":"11.1.1.c "},{"$f":"'F. Physical and Environmental'!H18","v":"Physical entry controls"},"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A19","v":360},{"$f":"'F. Physical and Environmental'!I19","v":3},{"$f":"'F. Physical and Environmental'!J19","v":0},{"$f":"'F. Physical and Environmental'!X19","v":0},{"$f":"'F. Physical and Environmental'!B19","v":"F.1.2.10"},{"$f":"'F. Physical and Environmental'!C19","v":"External lighting?"},{"$f":"'F. Physical and Environmental'!D19","v":"Yes"},{"$f":"'F. Physical and Environmental'!E19","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F19","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G19","v":0},{"$f":"'F. Physical and Environmental'!H19","v":0},"DS12.1","Site selection and layout","N/A","OPS.2.12.E.4","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A20","v":364},{"$f":"'F. Physical and Environmental'!I20","v":3},{"$f":"'F. Physical and Environmental'!J20","v":0},{"$f":"'F. Physical and Environmental'!X20","v":0},{"$f":"'F. Physical and Environmental'!B20","v":"F.1.2.11"},{"$f":"'F. Physical and Environmental'!C20","v":"Lighting on all doors?"},{"$f":"'F. Physical and Environmental'!D20","v":"Yes"},{"$f":"'F. Physical and Environmental'!E20","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F20","v":0},{"$f":"'F. Physical and Environmental'!G20","v":0},{"$f":"'F. Physical and Environmental'!H20","v":0},"DS12.1","Site selection and layout","N/A","OPS.2.12.E.4","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A21","v":365},{"$f":"'F. Physical and Environmental'!I21","v":3},{"$f":"'F. Physical and Environmental'!J21","v":0},{"$f":"'F. Physical and Environmental'!X21","v":0},{"$f":"'F. Physical and Environmental'!B21","v":"F.1.2.12"},{"$f":"'F. Physical and Environmental'!C21","v":"Exterior doors with external hinge pins?"},{"$f":"'F. Physical and Environmental'!D21","v":"Yes"},{"$f":"'F. Physical and Environmental'!E21","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F21","v":0},{"$f":"'F. Physical and Environmental'!G21","v":"11.1.1.b "},{"$f":"'F. Physical and Environmental'!H21","v":"Physical security perimeter"},null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A22","v":358},{"$f":"'F. Physical and Environmental'!I22","v":3},{"$f":"'F. Physical and Environmental'!J22","v":0},{"$f":"'F. Physical and Environmental'!X22","v":0},{"$f":"'F. Physical and Environmental'!B22","v":"F.1.2.13"},{"$f":"'F. Physical and Environmental'!C22","v":"Windows with contact or break alarms on all windows?"},{"$f":"'F. Physical and Environmental'!D22","v":"Yes"},{"$f":"'F. Physical and Environmental'!E22","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F22","v":0},{"$f":"'F. Physical and Environmental'!G22","v":"11.1.1.b "},{"$f":"'F. Physical and Environmental'!H22","v":"Physical security perimeter"},"DS12.1","Site selection and layout","N/A","OPS.2.12.E.10","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A23","v":366},{"$f":"'F. Physical and Environmental'!I23","v":3},{"$f":"'F. Physical and Environmental'!J23","v":0},{"$f":"'F. Physical and Environmental'!X23","v":0},{"$f":"'F. Physical and Environmental'!B23","v":"F.1.2.14"},{"$f":"'F. Physical and Environmental'!C23","v":"CCTV with video stored at least 90 days?"},{"$f":"'F. Physical and Environmental'!D23","v":"Yes"},{"$f":"'F. Physical and Environmental'!E23","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F23","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G23","v":"NA"},{"$f":"'F. Physical and Environmental'!H23","v":0},null,null,"N/A","IS.2.E.3.2","N/A"]
[{"$f":"'F. Physical and Environmental'!A24","v":566},{"$f":"'F. Physical and Environmental'!I24","v":3},{"$f":"'F. Physical and Environmental'!J24","v":0},{"$f":"'F. Physical and Environmental'!X24","v":0},{"$f":"'F. Physical and Environmental'!B24","v":"F.1.2.15"},{"$f":"'F. Physical and Environmental'!C24","v":"Fluid or water sensor?"},{"$f":"'F. Physical and Environmental'!D24","v":"No"},{"$f":"'F. Physical and Environmental'!E24","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F24","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G24","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!H24","v":"Protecting against external and environmental threats"},"DS5.7","Protection of security technology","N/A","OPS.2.12.D.6","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A25","v":3297},{"$f":"'F. Physical and Environmental'!I25","v":3},{"$f":"'F. Physical and Environmental'!J25","v":0},{"$f":"'F. Physical and Environmental'!X25","v":0},{"$f":"'F. Physical and Environmental'!B25","v":"F.1.2.16"},{"$f":"'F. Physical and Environmental'!C25","v":"Air conditioning and humidity controls?"},{"$f":"'F. Physical and Environmental'!D25","v":"Yes"},{"$f":"'F. Physical and Environmental'!E25","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F25","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G25","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!H25","v":"Protecting against external and environmental threats"},"DS5.7","Protection of security technology","N/A","OPS.1.7.1.3","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A26","v":3298},{"$f":"'F. Physical and Environmental'!I26","v":3},{"$f":"'F. Physical and Environmental'!J26","v":0},{"$f":"'F. Physical and Environmental'!X26","v":0},{"$f":"'F. Physical and Environmental'!B26","v":"F.1.2.17"},{"$f":"'F. Physical and Environmental'!C26","v":"Heat detection?"},{"$f":"'F. Physical and Environmental'!D26","v":"No"},{"$f":"'F. Physical and Environmental'!E26","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F26","v":0},{"$f":"'F. Physical and Environmental'!G26","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!H26","v":"Protecting against external and environmental threats"},"DS5.7","Protection of security technology","N/A","N/A","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A27","v":569},{"$f":"'F. Physical and Environmental'!I27","v":3},{"$f":"'F. Physical and Environmental'!J27","v":0},{"$f":"'F. Physical and Environmental'!X27","v":0},{"$f":"'F. Physical and Environmental'!B27","v":"F.1.2.18"},{"$f":"'F. Physical and Environmental'!C27","v":"Smoke detection?"},{"$f":"'F. Physical and Environmental'!D27","v":"Yes"},{"$f":"'F. Physical and Environmental'!E27","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F27","v":0},{"$f":"'F. Physical and Environmental'!G27","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!H27","v":"Protecting against external and environmental threats"},"DS5.7","Protection of security technology","N/A","OPS.1.7.1.6 OPS.2.12.D.5","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A28","v":3303},{"$f":"'F. Physical and Environmental'!I28","v":3},{"$f":"'F. Physical and Environmental'!J28","v":0},{"$f":"'F. Physical and Environmental'!X28","v":0},{"$f":"'F. Physical and Environmental'!B28","v":"F.1.2.19"},{"$f":"'F. Physical and Environmental'!C28","v":"Fire suppression?"},{"$f":"'F. Physical and Environmental'!D28","v":"Yes"},{"$f":"'F. Physical and Environmental'!E28","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F28","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G28","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!H28","v":"Protecting against external and environmental threats"},"DS12.4","Protection against environmental factors","N/A","OPS.1.7.1.6 OPS.2.12.D.5","DS12.4"]
[{"$f":"'F. Physical and Environmental'!A29","v":3289},{"$f":"'F. Physical and Environmental'!I29","v":3},{"$f":"'F. Physical and Environmental'!J29","v":0},{"$f":"'F. Physical and Environmental'!X29","v":0},{"$f":"'F. Physical and Environmental'!B29","v":"F.1.2.20"},{"$f":"'F. Physical and Environmental'!C29","v":"Multiple power feeds?"},{"$f":"'F. Physical and Environmental'!D29","v":"Yes"},{"$f":"'F. Physical and Environmental'!E29","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F29","v":0},{"$f":"'F. Physical and Environmental'!G29","v":"11.2.2"},{"$f":"'F. Physical and Environmental'!H29","v":"Supporting utilities"},"DS12.4","Protection against environmental factors","N/A","OPS.1.7.1.1","DS12.4, DS12.5"]
[{"$f":"'F. Physical and Environmental'!A30","v":3290},{"$f":"'F. Physical and Environmental'!I30","v":3},{"$f":"'F. Physical and Environmental'!J30","v":0},{"$f":"'F. Physical and Environmental'!X30","v":0},{"$f":"'F. Physical and Environmental'!B30","v":"F.1.2.21"},{"$f":"'F. Physical and Environmental'!C30","v":"Multiple communication feeds?"},{"$f":"'F. Physical and Environmental'!D30","v":"Yes"},{"$f":"'F. Physical and Environmental'!E30","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F30","v":0},{"$f":"'F. Physical and Environmental'!G30","v":"11.2.2"},{"$f":"'F. Physical and Environmental'!H30","v":"Supporting utilities"},"DS12.4","Protection against environmental factors","N/A","N/A","DS12.4, DS12.5"]
[{"$f":"'F. Physical and Environmental'!A31","v":382},{"$f":"'F. Physical and Environmental'!I31","v":3},{"$f":"'F. Physical and Environmental'!J31","v":0},{"$f":"'F. Physical and Environmental'!X31","v":0},{"$f":"'F. Physical and Environmental'!B31","v":"F.1.2.22"},{"$f":"'F. Physical and Environmental'!C31","v":"Physical access control procedures? If yes, is there:"},{"$f":"'F. Physical and Environmental'!D31","v":"Yes"},{"$f":"'F. Physical and Environmental'!E31","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F31","v":0},{"$f":"'F. Physical and Environmental'!G31","v":"11.1.1.a "},{"$f":"'F. Physical and Environmental'!H31","v":"Physical security perimeter"},"DS12.1","Site selection and layout","N/A","IS.2.E.3.1","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A32","v":383},{"$f":"'F. Physical and Environmental'!I32","v":4},{"$f":"'F. Physical and Environmental'!J32","v":0},{"$f":"'F. Physical and Environmental'!X32","v":0},{"$f":"'F. Physical and Environmental'!B32","v":"F.1.2.22.1"},{"$f":"'F. Physical and Environmental'!C32","v":"Segregation of duties for issuing and approving access to the facility (keys, badge, etc.)?"},{"$f":"'F. Physical and Environmental'!D32","v":"Yes"},{"$f":"'F. Physical and Environmental'!E32","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F32","v":0},{"$f":"'F. Physical and Environmental'!G32","v":"9.1.1.f "},{"$f":"'F. Physical and Environmental'!H32","v":"Access control policy"},"PO2.1","Enterprise information architecture model","N/A","N/A","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'F. Physical and Environmental'!A33","v":384},{"$f":"'F. Physical and Environmental'!I33","v":4},{"$f":"'F. Physical and Environmental'!J33","v":0},{"$f":"'F. Physical and Environmental'!X33","v":0},{"$f":"'F. Physical and Environmental'!B33","v":"F.1.2.22.2"},{"$f":"'F. Physical and Environmental'!C33","v":"Access reviews at least every six months?"},{"$f":"'F. Physical and Environmental'!D33","v":"Yes"},{"$f":"'F. Physical and Environmental'!E33","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F33","v":0},{"$f":"'F. Physical and Environmental'!G33","v":"9.1.1.h                                       9.2.5"},{"$f":"'F. Physical and Environmental'!H33","v":"Access control policy,         Review of user access rights"},"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A34","v":389},{"$f":"'F. Physical and Environmental'!I34","v":4},{"$f":"'F. Physical and Environmental'!J34","v":0},{"$f":"'F. Physical and Environmental'!X34","v":0},{"$f":"'F. Physical and Environmental'!B34","v":"F.1.2.22.3"},{"$f":"'F. Physical and Environmental'!C34","v":"Collection of access equipment (badges, keys, change pin numbers, etc.) when a constituent is terminated or changes status and no longer require access?"},{"$f":"'F. Physical and Environmental'!D34","v":"Yes"},{"$f":"'F. Physical and Environmental'!E34","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F34","v":"H.6 Revoke Physical Access"},{"$f":"'F. Physical and Environmental'!G34","v":"9.1.1.i "},{"$f":"'F. Physical and Environmental'!H34","v":"Access control policy"},"DS12.2","Physical security measures","N/A","IS.2.E.3.3","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A35","v":390},{"$f":"'F. Physical and Environmental'!I35","v":4},{"$f":"'F. Physical and Environmental'!J35","v":0},{"$f":"'F. Physical and Environmental'!X35","v":0},{"$f":"'F. Physical and Environmental'!B35","v":"F.1.2.22.4"},{"$f":"'F. Physical and Environmental'!C35","v":"A process to report lost or stolen access cards / keys?"},{"$f":"'F. Physical and Environmental'!D35","v":"Yes"},{"$f":"'F. Physical and Environmental'!E35","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F35","v":0},{"$f":"'F. Physical and Environmental'!G35","v":"11.1.2.d "},{"$f":"'F. Physical and Environmental'!H35","v":"Physical entry controls"},"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A36","v":396},{"$f":"'F. Physical and Environmental'!I36","v":2},{"$f":"'F. Physical and Environmental'!J36","v":0},{"$f":"'F. Physical and Environmental'!X36","v":1},{"$f":"'F. Physical and Environmental'!B36","v":"F.1.3"},{"$f":"'F. Physical and Environmental'!C36","v":"Are visitors permitted in the facility? If yes, are they required to:"},{"$f":"'F. Physical and Environmental'!D36","v":"Yes"},{"$f":"'F. Physical and Environmental'!E36","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F36","v":0},{"$f":"'F. Physical and Environmental'!G36","v":"11.1.2 "},{"$f":"'F. Physical and Environmental'!H36","v":"Physical entry controls"},"DS12.2","Physical security measures",9.4,"OPS.2.12.E.9 WPS.2.9.1.2","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A37","v":397},{"$f":"'F. Physical and Environmental'!I37","v":3},{"$f":"'F. Physical and Environmental'!J37","v":0},{"$f":"'F. Physical and Environmental'!X37","v":0},{"$f":"'F. Physical and Environmental'!B37","v":"F.1.3.1"},{"$f":"'F. Physical and Environmental'!C37","v":"Sign in and out?"},{"$f":"'F. Physical and Environmental'!D37","v":"Yes"},{"$f":"'F. Physical and Environmental'!E37","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F37","v":0},{"$f":"'F. Physical and Environmental'!G37","v":"11.1.2.a "},{"$f":"'F. Physical and Environmental'!H37","v":"Physical entry controls"},"DS12.2","Physical security measures","9.4.4","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A38","v":398},{"$f":"'F. Physical and Environmental'!I38","v":3},{"$f":"'F. Physical and Environmental'!J38","v":0},{"$f":"'F. Physical and Environmental'!X38","v":0},{"$f":"'F. Physical and Environmental'!B38","v":"F.1.3.2"},{"$f":"'F. Physical and Environmental'!C38","v":"Provide a government issued ID?"},{"$f":"'F. Physical and Environmental'!D38","v":"Yes"},{"$f":"'F. Physical and Environmental'!E38","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F38","v":0},{"$f":"'F. Physical and Environmental'!G38","v":"11.1.2.a "},{"$f":"'F. Physical and Environmental'!H38","v":"Physical entry controls"},"DS12.2","Physical security measures","9.4.2","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A39","v":399},{"$f":"'F. Physical and Environmental'!I39","v":3},{"$f":"'F. Physical and Environmental'!J39","v":0},{"$f":"'F. Physical and Environmental'!X39","v":0},{"$f":"'F. Physical and Environmental'!B39","v":"F.1.3.3"},{"$f":"'F. Physical and Environmental'!C39","v":"Be escorted through secure areas?"},{"$f":"'F. Physical and Environmental'!D39","v":"Yes"},{"$f":"'F. Physical and Environmental'!E39","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F39","v":0},{"$f":"'F. Physical and Environmental'!G39","v":0},{"$f":"'F. Physical and Environmental'!H39","v":0},"DS12.2","Physical security measures","9.4.1","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A40","v":2944},{"$f":"'F. Physical and Environmental'!I40","v":3},{"$f":"'F. Physical and Environmental'!J40","v":0},{"$f":"'F. Physical and Environmental'!X40","v":0},{"$f":"'F. Physical and Environmental'!B40","v":"F.1.3.4"},{"$f":"'F. Physical and Environmental'!C40","v":"Wear badge distinguishing them from employees?"},{"$f":"'F. Physical and Environmental'!D40","v":"Yes"},{"$f":"'F. Physical and Environmental'!E40","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F40","v":0},{"$f":"'F. Physical and Environmental'!G40","v":"11.1.2.a "},{"$f":"'F. Physical and Environmental'!H40","v":"Physical entry controls"},null,null,"9.4.2","OPS.2.12.E.9","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A41","v":400},{"$f":"'F. Physical and Environmental'!I41","v":3},{"$f":"'F. Physical and Environmental'!J41","v":0},{"$f":"'F. Physical and Environmental'!X41","v":0},{"$f":"'F. Physical and Environmental'!B41","v":"F.1.3.5"},{"$f":"'F. Physical and Environmental'!C41","v":"Are visitor logs maintained for at least 90 days?"},{"$f":"'F. Physical and Environmental'!D41","v":"Yes"},{"$f":"'F. Physical and Environmental'!E41","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F41","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G41","v":"NA"},{"$f":"'F. Physical and Environmental'!H41","v":0},"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A42","v":492},{"$f":"'F. Physical and Environmental'!I42","v":2},{"$f":"'F. Physical and Environmental'!J42","v":0},{"$f":"'F. Physical and Environmental'!X42","v":0},{"$f":"'F. Physical and Environmental'!B42","v":"F.1.4"},{"$f":"'F. Physical and Environmental'!C42","v":"Is there a loading dock at the facility? If yes, is there:"},{"$f":"'F. Physical and Environmental'!D42","v":"Yes"},{"$f":"'F. Physical and Environmental'!E42","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F42","v":0},{"$f":"'F. Physical and Environmental'!G42","v":"11.1.6"},{"$f":"'F. Physical and Environmental'!H42","v":"Delivery and loading areas"},"AI7.10","System distribution","N/A","N/A","DS5.7, DS12.1, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A43","v":493},{"$f":"'F. Physical and Environmental'!I43","v":3},{"$f":"'F. Physical and Environmental'!J43","v":0},{"$f":"'F. Physical and Environmental'!X43","v":0},{"$f":"'F. Physical and Environmental'!B43","v":"F.1.4.1"},{"$f":"'F. Physical and Environmental'!C43","v":"Any other tenants using the loading dock?"},{"$f":"'F. Physical and Environmental'!D43","v":"Yes"},{"$f":"'F. Physical and Environmental'!E43","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F43","v":0},{"$f":"'F. Physical and Environmental'!G43","v":"NA"},{"$f":"'F. Physical and Environmental'!H43","v":0},"AI7.10","System distribution","N/A","N/A","DS5.7, DS12.1, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A44","v":495},{"$f":"'F. Physical and Environmental'!I44","v":3},{"$f":"'F. Physical and Environmental'!J44","v":0},{"$f":"'F. Physical and Environmental'!X44","v":0},{"$f":"'F. Physical and Environmental'!B44","v":"F.1.4.2"},{"$f":"'F. Physical and Environmental'!C44","v":"A security guards at each point of entry?"},{"$f":"'F. Physical and Environmental'!D44","v":"Yes"},{"$f":"'F. Physical and Environmental'!E44","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F44","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G44","v":"NA"},{"$f":"'F. Physical and Environmental'!H44","v":0},"AI7.10","System distribution","N/A","N/A","DS5.7, DS12.1, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A45","v":513},{"$f":"'F. Physical and Environmental'!I45","v":3},{"$f":"'F. Physical and Environmental'!J45","v":0},{"$f":"'F. Physical and Environmental'!X45","v":0},{"$f":"'F. Physical and Environmental'!B45","v":"F.1.4.3"},{"$f":"'F. Physical and Environmental'!C45","v":"Smoke detector?"},{"$f":"'F. Physical and Environmental'!D45","v":"Yes"},{"$f":"'F. Physical and Environmental'!E45","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F45","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G45","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!H45","v":"Protecting against external and environmental threats"},"DS5.7","Protection of security technology","N/A","OPS.1.7.1.6 OPS.2.12.D.5","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A46","v":514},{"$f":"'F. Physical and Environmental'!I46","v":3},{"$f":"'F. Physical and Environmental'!J46","v":0},{"$f":"'F. Physical and Environmental'!X46","v":0},{"$f":"'F. Physical and Environmental'!B46","v":"F.1.4.4"},{"$f":"'F. Physical and Environmental'!C46","v":"Fire alarm?"},{"$f":"'F. Physical and Environmental'!D46","v":"Yes"},{"$f":"'F. Physical and Environmental'!E46","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F46","v":0},{"$f":"'F. Physical and Environmental'!G46","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!H46","v":"Protecting against external and environmental threats"},"DS5.7","Protection of security technology","N/A","N/A","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A47","v":516},{"$f":"'F. Physical and Environmental'!I47","v":3},{"$f":"'F. Physical and Environmental'!J47","v":0},{"$f":"'F. Physical and Environmental'!X47","v":0},{"$f":"'F. Physical and Environmental'!B47","v":"F.1.4.5"},{"$f":"'F. Physical and Environmental'!C47","v":"Fire suppression?"},{"$f":"'F. Physical and Environmental'!D47","v":"Yes"},{"$f":"'F. Physical and Environmental'!E47","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F47","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G47","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!H47","v":"Protecting against external and environmental threats"},"DS12.4","Protection against environmental factors","N/A","N/A","DS12.4"]
[{"$f":"'F. Physical and Environmental'!A48","v":508},{"$f":"'F. Physical and Environmental'!I48","v":3},{"$f":"'F. Physical and Environmental'!J48","v":0},{"$f":"'F. Physical and Environmental'!X48","v":0},{"$f":"'F. Physical and Environmental'!B48","v":"F.1.4.6"},{"$f":"'F. Physical and Environmental'!C48","v":"CCTV and the video stored for at least 90 days?"},{"$f":"'F. Physical and Environmental'!D48","v":"Yes"},{"$f":"'F. Physical and Environmental'!E48","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F48","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G48","v":"NA"},{"$f":"'F. Physical and Environmental'!H48","v":0},"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A49","v":3203},{"$f":"'F. Physical and Environmental'!I49","v":3},{"$f":"'F. Physical and Environmental'!J49","v":0},{"$f":"'F. Physical and Environmental'!X49","v":0},{"$f":"'F. Physical and Environmental'!B49","v":"F.1.4.7"},{"$f":"'F. Physical and Environmental'!C49","v":"Restricted access and logs kept of all access?"},{"$f":"'F. Physical and Environmental'!D49","v":"Yes"},{"$f":"'F. Physical and Environmental'!E49","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F49","v":0},{"$f":"'F. Physical and Environmental'!G49","v":"11.1.2.c "},{"$f":"'F. Physical and Environmental'!H49","v":"Physical entry controls"},"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A50","v":541},{"$f":"'F. Physical and Environmental'!I50","v":2},{"$f":"'F. Physical and Environmental'!J50","v":0},{"$f":"'F. Physical and Environmental'!X50","v":0},{"$f":"'F. Physical and Environmental'!B50","v":"F.1.5"},{"$f":"'F. Physical and Environmental'!C50","v":"Is there a battery/UPS room? If yes, does it contain:"},{"$f":"'F. Physical and Environmental'!D50","v":"No"},{"$f":"'F. Physical and Environmental'!E50","v":0},{"$f":"'F. Physical and Environmental'!F50","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G50","v":"11.2.2 "},{"$f":"'F. Physical and Environmental'!H50","v":"Supporting utilities"},"DS12.4","Protection against environmental factors","N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A51","v":543},{"$f":"'F. Physical and Environmental'!I51","v":3},{"$f":"'F. Physical and Environmental'!J51","v":0},{"$f":"'F. Physical and Environmental'!X51","v":0},{"$f":"'F. Physical and Environmental'!B51","v":"F.1.5.1"},{"$f":"'F. Physical and Environmental'!C51","v":"Hydrogen sensors?"},{"$f":"'F. Physical and Environmental'!D51","v":0},{"$f":"'F. Physical and Environmental'!E51","v":0},{"$f":"'F. Physical and Environmental'!F51","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G51","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!H51","v":"Protecting against external and environmental threats"},"DS5.7","Protection of security technology","N/A","N/A","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A52","v":570},{"$f":"'F. Physical and Environmental'!I52","v":3},{"$f":"'F. Physical and Environmental'!J52","v":0},{"$f":"'F. Physical and Environmental'!X52","v":0},{"$f":"'F. Physical and Environmental'!B52","v":"F.1.5.2"},{"$f":"'F. Physical and Environmental'!C52","v":"Monitored fire alarm?"},{"$f":"'F. Physical and Environmental'!D52","v":0},{"$f":"'F. Physical and Environmental'!E52","v":0},{"$f":"'F. Physical and Environmental'!F52","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G52","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!H52","v":"Protecting against external and environmental threats"},"DS5.7","Protection of security technology","N/A","N/A","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A53","v":3204},{"$f":"'F. Physical and Environmental'!I53","v":3},{"$f":"'F. Physical and Environmental'!J53","v":0},{"$f":"'F. Physical and Environmental'!X53","v":0},{"$f":"'F. Physical and Environmental'!B53","v":"F.1.5.3"},{"$f":"'F. Physical and Environmental'!C53","v":"Fire suppression system?"},{"$f":"'F. Physical and Environmental'!D53","v":0},{"$f":"'F. Physical and Environmental'!E53","v":0},{"$f":"'F. Physical and Environmental'!F53","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G53","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!H53","v":"Protecting against external and environmental threats"},"DS12.4","Protection against environmental factors","N/A","OPS.1.7.1.6 OPS.2.12.D.5","DS12.4"]
[{"$f":"'F. Physical and Environmental'!A54","v":560},{"$f":"'F. Physical and Environmental'!I54","v":3},{"$f":"'F. Physical and Environmental'!J54","v":0},{"$f":"'F. Physical and Environmental'!X54","v":0},{"$f":"'F. Physical and Environmental'!B54","v":"F.1.5.4"},{"$f":"'F. Physical and Environmental'!C54","v":"CCTV and the video stored for at least 90 days?"},{"$f":"'F. Physical and Environmental'!D54","v":0},{"$f":"'F. Physical and Environmental'!E54","v":0},{"$f":"'F. Physical and Environmental'!F54","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G54","v":"NA"},{"$f":"'F. Physical and Environmental'!H54","v":0},"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A55","v":546},{"$f":"'F. Physical and Environmental'!I55","v":3},{"$f":"'F. Physical and Environmental'!J55","v":0},{"$f":"'F. Physical and Environmental'!X55","v":0},{"$f":"'F. Physical and Environmental'!B55","v":"F.1.5.5"},{"$f":"'F. Physical and Environmental'!C55","v":"Restricted access and logs kept of all access?"},{"$f":"'F. Physical and Environmental'!D55","v":0},{"$f":"'F. Physical and Environmental'!E55","v":0},{"$f":"'F. Physical and Environmental'!F55","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G55","v":"11.1.2.c"},{"$f":"'F. Physical and Environmental'!H55","v":"Physical entry controls"},"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A56","v":454},{"$f":"'F. Physical and Environmental'!I56","v":3},{"$f":"'F. Physical and Environmental'!J56","v":0},{"$f":"'F. Physical and Environmental'!X56","v":0},{"$f":"'F. Physical and Environmental'!B56","v":"F.1.5.6"},{"$f":"'F. Physical and Environmental'!C56","v":"Does UPS support N+1?"},{"$f":"'F. Physical and Environmental'!D56","v":0},{"$f":"'F. Physical and Environmental'!E56","v":0},{"$f":"'F. Physical and Environmental'!F56","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G56","v":"11.2.2 "},{"$f":"'F. Physical and Environmental'!H56","v":"Supporting utilities"},"DS12.4","Protection against environmental factors","N/A","N/A","DS12.4, DS12.5"]
[{"$f":"'F. Physical and Environmental'!A57","v":621},{"$f":"'F. Physical and Environmental'!I57","v":2},{"$f":"'F. Physical and Environmental'!J57","v":0},{"$f":"'F. Physical and Environmental'!X57","v":0},{"$f":"'F. Physical and Environmental'!B57","v":"F.1.6"},{"$f":"'F. Physical and Environmental'!C57","v":"Is there a generator or generator area? If yes, is there:"},{"$f":"'F. Physical and Environmental'!D57","v":"No"},{"$f":"'F. Physical and Environmental'!E57","v":0},{"$f":"'F. Physical and Environmental'!F57","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G57","v":"11.2.2 "},{"$f":"'F. Physical and Environmental'!H57","v":"Supporting utilities"},"DS12.4","Protection against environmental factors","N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A58","v":627},{"$f":"'F. Physical and Environmental'!I58","v":3},{"$f":"'F. Physical and Environmental'!J58","v":0},{"$f":"'F. Physical and Environmental'!X58","v":0},{"$f":"'F. Physical and Environmental'!B58","v":"F.1.6.1"},{"$f":"'F. Physical and Environmental'!C58","v":"A fuel supply readily available to ensure uninterrupted service?"},{"$f":"'F. Physical and Environmental'!D58","v":0},{"$f":"'F. Physical and Environmental'!E58","v":0},{"$f":"'F. Physical and Environmental'!F58","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G58","v":"11.2.2 "},{"$f":"'F. Physical and Environmental'!H58","v":"Supporting utilities"},"DS12.4","Protection against environmental factors","N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A59","v":628},{"$f":"'F. Physical and Environmental'!I59","v":3},{"$f":"'F. Physical and Environmental'!J59","v":0},{"$f":"'F. Physical and Environmental'!X59","v":0},{"$f":"'F. Physical and Environmental'!B59","v":"F.1.6.2"},{"$f":"'F. Physical and Environmental'!C59","v":"Adequate capacity to supply power for at least 48 hours?"},{"$f":"'F. Physical and Environmental'!D59","v":0},{"$f":"'F. Physical and Environmental'!E59","v":0},{"$f":"'F. Physical and Environmental'!F59","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G59","v":"11.2.2 "},{"$f":"'F. Physical and Environmental'!H59","v":"Supporting utilities"},"DS12.4","Protection against environmental factors","N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A60","v":629},{"$f":"'F. Physical and Environmental'!I60","v":3},{"$f":"'F. Physical and Environmental'!J60","v":0},{"$f":"'F. Physical and Environmental'!X60","v":0},{"$f":"'F. Physical and Environmental'!B60","v":"F.1.6.3"},{"$f":"'F. Physical and Environmental'!C60","v":"Restricted access and logs kept of all access?"},{"$f":"'F. Physical and Environmental'!D60","v":0},{"$f":"'F. Physical and Environmental'!E60","v":0},{"$f":"'F. Physical and Environmental'!F60","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G60","v":"11.1.2.c"},{"$f":"'F. Physical and Environmental'!H60","v":"Physical Entry Controls"},"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A61","v":640},{"$f":"'F. Physical and Environmental'!I61","v":3},{"$f":"'F. Physical and Environmental'!J61","v":0},{"$f":"'F. Physical and Environmental'!X61","v":0},{"$f":"'F. Physical and Environmental'!B61","v":"F.1.6.4"},{"$f":"'F. Physical and Environmental'!C61","v":"CCTV and the video stored for at least 90 days?"},{"$f":"'F. Physical and Environmental'!D61","v":0},{"$f":"'F. Physical and Environmental'!E61","v":0},{"$f":"'F. Physical and Environmental'!F61","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G61","v":"NA"},{"$f":"'F. Physical and Environmental'!H61","v":0},"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A62","v":656},{"$f":"'F. Physical and Environmental'!I62","v":2},{"$f":"'F. Physical and Environmental'!J62","v":0},{"$f":"'F. Physical and Environmental'!X62","v":0},{"$f":"'F. Physical and Environmental'!B62","v":"F.1.7"},{"$f":"'F. Physical and Environmental'!C62","v":"Is there a mailroom that handles Scoped Data? If yes, is access:"},{"$f":"'F. Physical and Environmental'!D62","v":"No"},{"$f":"'F. Physical and Environmental'!E62","v":0},{"$f":"'F. Physical and Environmental'!F62","v":0},{"$f":"'F. Physical and Environmental'!G62","v":"12.1.1"},{"$f":"'F. Physical and Environmental'!H62","v":"Documented operating procedures"},"AI1.1","Definition and maintenance of business functional and technical requirements","N/A","N/A","AI1.1, AI4.4, DS13.1"]
[{"$f":"'F. Physical and Environmental'!A63","v":660},{"$f":"'F. Physical and Environmental'!I63","v":3},{"$f":"'F. Physical and Environmental'!J63","v":0},{"$f":"'F. Physical and Environmental'!X63","v":0},{"$f":"'F. Physical and Environmental'!B63","v":"F.1.7.1"},{"$f":"'F. Physical and Environmental'!C63","v":"Restricted access and logs kept of all access?"},{"$f":"'F. Physical and Environmental'!D63","v":0},{"$f":"'F. Physical and Environmental'!E63","v":0},{"$f":"'F. Physical and Environmental'!F63","v":0},{"$f":"'F. Physical and Environmental'!G63","v":"11.1.2.c"},{"$f":"'F. Physical and Environmental'!H63","v":"Physical entry controls"},"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A64","v":3291},{"$f":"'F. Physical and Environmental'!I64","v":3},{"$f":"'F. Physical and Environmental'!J64","v":0},{"$f":"'F. Physical and Environmental'!X64","v":0},{"$f":"'F. Physical and Environmental'!B64","v":"F.1.7.2"},{"$f":"'F. Physical and Environmental'!C64","v":"CCTV and the video stored for at least 90 days?"},{"$f":"'F. Physical and Environmental'!D64","v":0},{"$f":"'F. Physical and Environmental'!E64","v":0},{"$f":"'F. Physical and Environmental'!F64","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G64","v":"NA"},{"$f":"'F. Physical and Environmental'!H64","v":0},"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A65","v":685},{"$f":"'F. Physical and Environmental'!I65","v":2},{"$f":"'F. Physical and Environmental'!J65","v":0},{"$f":"'F. Physical and Environmental'!X65","v":0},{"$f":"'F. Physical and Environmental'!B65","v":"F.1.8"},{"$f":"'F. Physical and Environmental'!C65","v":"Is there a media library to store Scoped Data? If yes, is access:"},{"$f":"'F. Physical and Environmental'!D65","v":"No"},{"$f":"'F. Physical and Environmental'!E65","v":0},{"$f":"'F. Physical and Environmental'!F65","v":0},{"$f":"'F. Physical and Environmental'!G65","v":"12.1.1"},{"$f":"'F. Physical and Environmental'!H65","v":"Documented operating procedures"},null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A66","v":694},{"$f":"'F. Physical and Environmental'!I66","v":3},{"$f":"'F. Physical and Environmental'!J66","v":0},{"$f":"'F. Physical and Environmental'!X66","v":0},{"$f":"'F. Physical and Environmental'!B66","v":"F.1.8.1"},{"$f":"'F. Physical and Environmental'!C66","v":"Restricted and logs kept of all access?"},{"$f":"'F. Physical and Environmental'!D66","v":0},{"$f":"'F. Physical and Environmental'!E66","v":0},{"$f":"'F. Physical and Environmental'!F66","v":0},{"$f":"'F. Physical and Environmental'!G66","v":"11.1.2.c"},{"$f":"'F. Physical and Environmental'!H66","v":"Physical entry controls"},"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A67","v":3292},{"$f":"'F. Physical and Environmental'!I67","v":3},{"$f":"'F. Physical and Environmental'!J67","v":0},{"$f":"'F. Physical and Environmental'!X67","v":0},{"$f":"'F. Physical and Environmental'!B67","v":"F.1.8.2"},{"$f":"'F. Physical and Environmental'!C67","v":"CCTV and the video stored for at least 90 days?"},{"$f":"'F. Physical and Environmental'!D67","v":0},{"$f":"'F. Physical and Environmental'!E67","v":0},{"$f":"'F. Physical and Environmental'!F67","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G67","v":"NA"},{"$f":"'F. Physical and Environmental'!H67","v":0},"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A68","v":778},{"$f":"'F. Physical and Environmental'!I68","v":2},{"$f":"'F. Physical and Environmental'!J68","v":0},{"$f":"'F. Physical and Environmental'!X68","v":0},{"$f":"'F. Physical and Environmental'!B68","v":"F.1.9"},{"$f":"'F. Physical and Environmental'!C68","v":"Is there a separate room for telecom equipment? If yes, is access:"},{"$f":"'F. Physical and Environmental'!D68","v":"Yes"},{"$f":"'F. Physical and Environmental'!E68","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F68","v":0},{"$f":"'F. Physical and Environmental'!G68","v":"12.1.1"},{"$f":"'F. Physical and Environmental'!H68","v":"Documented operating procedures"},null,null,"N/A","OPS.1.7.1.2","N/A"]
[{"$f":"'F. Physical and Environmental'!A69","v":781},{"$f":"'F. Physical and Environmental'!I69","v":3},{"$f":"'F. Physical and Environmental'!J69","v":0},{"$f":"'F. Physical and Environmental'!X69","v":0},{"$f":"'F. Physical and Environmental'!B69","v":"F.1.9.1"},{"$f":"'F. Physical and Environmental'!C69","v":"Monitored with CCTV and the video stored for 90 days?"},{"$f":"'F. Physical and Environmental'!D69","v":"Yes"},{"$f":"'F. Physical and Environmental'!E69","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F69","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G69","v":"NA"},{"$f":"'F. Physical and Environmental'!H69","v":0},"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A70","v":786},{"$f":"'F. Physical and Environmental'!I70","v":3},{"$f":"'F. Physical and Environmental'!J70","v":0},{"$f":"'F. Physical and Environmental'!X70","v":0},{"$f":"'F. Physical and Environmental'!B70","v":"F.1.9.2"},{"$f":"'F. Physical and Environmental'!C70","v":"Restricted and logs kept of all access?"},{"$f":"'F. Physical and Environmental'!D70","v":"Yes"},{"$f":"'F. Physical and Environmental'!E70","v":"1735 Market St Building Security Plan"},{"$f":"'F. Physical and Environmental'!F70","v":0},{"$f":"'F. Physical and Environmental'!G70","v":"11.1.2.c"},{"$f":"'F. Physical and Environmental'!H70","v":"Physical entry controls"},"DS5.7","Protection of security technology","N/A","OPS.1.8.2.1","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A71","v":401},{"$f":"'F. Physical and Environmental'!I71","v":1},{"$f":"'F. Physical and Environmental'!J71","v":0},{"$f":"'F. Physical and Environmental'!X71","v":0},{"$f":"'F. Physical and Environmental'!B71","v":"F.2"},{"$f":"'F. Physical and Environmental'!C71","v":"Do the Scoped Systems and Data reside in a data center? If yes, is there:"},{"$f":"'F. Physical and Environmental'!D71","v":"Yes"},{"$f":"'F. Physical and Environmental'!E71","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F71","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G71","v":"11.2.1.b"},{"$f":"'F. Physical and Environmental'!H71","v":"Equipment siting and protection"},null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A72","v":435},{"$f":"'F. Physical and Environmental'!I72","v":2},{"$f":"'F. Physical and Environmental'!J72","v":0},{"$f":"'F. Physical and Environmental'!X72","v":0},{"$f":"'F. Physical and Environmental'!B72","v":"F.2.1"},{"$f":"'F. Physical and Environmental'!C72","v":"Fluid or water sensor?"},{"$f":"'F. Physical and Environmental'!D72","v":"N/A"},{"$f":"'F. Physical and Environmental'!E72","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F72","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G72","v":0},{"$f":"'F. Physical and Environmental'!H72","v":0},"DS5.7","Protection of security technology","N/A","OPS.2.12.D.6","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A73","v":434},{"$f":"'F. Physical and Environmental'!I73","v":2},{"$f":"'F. Physical and Environmental'!J73","v":0},{"$f":"'F. Physical and Environmental'!X73","v":0},{"$f":"'F. Physical and Environmental'!B73","v":"F.2.2"},{"$f":"'F. Physical and Environmental'!C73","v":"Air conditioning?"},{"$f":"'F. Physical and Environmental'!D73","v":"N/A"},{"$f":"'F. Physical and Environmental'!E73","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F73","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G73","v":"11.2.1.e"},{"$f":"'F. Physical and Environmental'!H73","v":"Equipment siting and protection"},"DS5.7","Protection of security technology","N/A","OPS.1.7.1.3","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A74","v":436},{"$f":"'F. Physical and Environmental'!I74","v":2},{"$f":"'F. Physical and Environmental'!J74","v":0},{"$f":"'F. Physical and Environmental'!X74","v":0},{"$f":"'F. Physical and Environmental'!B74","v":"F.2.3"},{"$f":"'F. Physical and Environmental'!C74","v":"Heat detection?"},{"$f":"'F. Physical and Environmental'!D74","v":"N/A"},{"$f":"'F. Physical and Environmental'!E74","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F74","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G74","v":"11.2.1.e"},{"$f":"'F. Physical and Environmental'!H74","v":"Equipment siting and protection"},"DS5.7","Protection of security technology","N/A","N/A","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A75","v":439},{"$f":"'F. Physical and Environmental'!I75","v":2},{"$f":"'F. Physical and Environmental'!J75","v":0},{"$f":"'F. Physical and Environmental'!X75","v":0},{"$f":"'F. Physical and Environmental'!B75","v":"F.2.4"},{"$f":"'F. Physical and Environmental'!C75","v":"Smoke detection?"},{"$f":"'F. Physical and Environmental'!D75","v":"N/A"},{"$f":"'F. Physical and Environmental'!E75","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F75","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G75","v":"11.2.1.e"},{"$f":"'F. Physical and Environmental'!H75","v":"Equipment siting and protection"},"DS5.7","Protection of security technology","N/A","OPS.1.7.1.6 OPS.2.12.D.5","DS12.4, DS12.5"]
[{"$f":"'F. Physical and Environmental'!A76","v":441},{"$f":"'F. Physical and Environmental'!I76","v":2},{"$f":"'F. Physical and Environmental'!J76","v":0},{"$f":"'F. Physical and Environmental'!X76","v":0},{"$f":"'F. Physical and Environmental'!B76","v":"F.2.5"},{"$f":"'F. Physical and Environmental'!C76","v":"Vibration alarm / sensor?"},{"$f":"'F. Physical and Environmental'!D76","v":"N/A"},{"$f":"'F. Physical and Environmental'!E76","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F76","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G76","v":"11.2.1.e"},{"$f":"'F. Physical and Environmental'!H76","v":"Equipment siting and protection"},"DS5.7","Protection of security technology","N/A","N/A","DS12.4, DS12.5"]
[{"$f":"'F. Physical and Environmental'!A77","v":442},{"$f":"'F. Physical and Environmental'!I77","v":2},{"$f":"'F. Physical and Environmental'!J77","v":0},{"$f":"'F. Physical and Environmental'!X77","v":0},{"$f":"'F. Physical and Environmental'!B77","v":"F.2.6"},{"$f":"'F. Physical and Environmental'!C77","v":"Monitored fire alarm?"},{"$f":"'F. Physical and Environmental'!D77","v":"N/A"},{"$f":"'F. Physical and Environmental'!E77","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F77","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G77","v":"11.2.1.e"},{"$f":"'F. Physical and Environmental'!H77","v":"Equipment siting and protection"},"DS5.7","Protection of security technology","N/A","N/A","DS12.4, DS12.5"]
[{"$f":"'F. Physical and Environmental'!A78","v":443},{"$f":"'F. Physical and Environmental'!I78","v":2},{"$f":"'F. Physical and Environmental'!J78","v":0},{"$f":"'F. Physical and Environmental'!X78","v":0},{"$f":"'F. Physical and Environmental'!B78","v":"F.2.7"},{"$f":"'F. Physical and Environmental'!C78","v":"Fire suppression (e.g., dry, chemical, wet pipe)?"},{"$f":"'F. Physical and Environmental'!D78","v":"N/A"},{"$f":"'F. Physical and Environmental'!E78","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F78","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G78","v":"11.2.1.e"},{"$f":"'F. Physical and Environmental'!H78","v":"Equipment siting and protection"},"DS12.4","Protection against environmental factors","N/A","OPS.1.7.1.6 OPS.2.12.D.5","DS12.4"]
[{"$f":"'F. Physical and Environmental'!A79","v":447},{"$f":"'F. Physical and Environmental'!I79","v":2},{"$f":"'F. Physical and Environmental'!J79","v":0},{"$f":"'F. Physical and Environmental'!X79","v":0},{"$f":"'F. Physical and Environmental'!B79","v":"F.2.8"},{"$f":"'F. Physical and Environmental'!C79","v":"Multiple power feeds?"},{"$f":"'F. Physical and Environmental'!D79","v":"N/A"},{"$f":"'F. Physical and Environmental'!E79","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F79","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G79","v":"11.2.2"},{"$f":"'F. Physical and Environmental'!H79","v":"Supporting utilities"},"DS12.4","Protection against environmental factors","N/A","OPS.1.7.1.1","DS12.4, DS12.5"]
[{"$f":"'F. Physical and Environmental'!A80","v":448},{"$f":"'F. Physical and Environmental'!I80","v":2},{"$f":"'F. Physical and Environmental'!J80","v":0},{"$f":"'F. Physical and Environmental'!X80","v":0},{"$f":"'F. Physical and Environmental'!B80","v":"F.2.9"},{"$f":"'F. Physical and Environmental'!C80","v":"Multiple communication feeds?"},{"$f":"'F. Physical and Environmental'!D80","v":"N/A"},{"$f":"'F. Physical and Environmental'!E80","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F80","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G80","v":"11.2.2"},{"$f":"'F. Physical and Environmental'!H80","v":"Supporting utilities"},"DS12.4","Protection against environmental factors","N/A","N/A","DS12.4, DS12.5"]
[{"$f":"'F. Physical and Environmental'!A81","v":455},{"$f":"'F. Physical and Environmental'!I81","v":2},{"$f":"'F. Physical and Environmental'!J81","v":0},{"$f":"'F. Physical and Environmental'!X81","v":0},{"$f":"'F. Physical and Environmental'!B81","v":"F.2.10"},{"$f":"'F. Physical and Environmental'!C81","v":"Are there generator(s)?"},{"$f":"'F. Physical and Environmental'!D81","v":"N/A"},{"$f":"'F. Physical and Environmental'!E81","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F81","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!G81","v":"11.2.2"},{"$f":"'F. Physical and Environmental'!H81","v":"Supporting utilities"},"DS12.4","Protection against environmental factors","N/A","N/A","DS12.4, DS12.5"]
[{"$f":"'F. Physical and Environmental'!A82","v":403},{"$f":"'F. Physical and Environmental'!I82","v":2},{"$f":"'F. Physical and Environmental'!J82","v":0},{"$f":"'F. Physical and Environmental'!X82","v":0},{"$f":"'F. Physical and Environmental'!B82","v":"F.2.11"},{"$f":"'F. Physical and Environmental'!C82","v":"Is access to the data center restricted and logs kept of all access?"},{"$f":"'F. Physical and Environmental'!D82","v":"N/A"},{"$f":"'F. Physical and Environmental'!E82","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F82","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G82","v":"11.1.2.c"},{"$f":"'F. Physical and Environmental'!H82","v":"Physical entry controls"},"DS12.1","Site selection and layout","9.1.1","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A83","v":411},{"$f":"'F. Physical and Environmental'!I83","v":3},{"$f":"'F. Physical and Environmental'!J83","v":0},{"$f":"'F. Physical and Environmental'!X83","v":0},{"$f":"'F. Physical and Environmental'!B83","v":"F.2.11.1"},{"$f":"'F. Physical and Environmental'!C83","v":"Badge readers at points of entry?"},{"$f":"'F. Physical and Environmental'!D83","v":"N/A"},{"$f":"'F. Physical and Environmental'!E83","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F83","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G83","v":"11.1.2"},{"$f":"'F. Physical and Environmental'!H83","v":"Physical entry controls"},"DS12.2","Physical security measures","9.1.1","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A84","v":413},{"$f":"'F. Physical and Environmental'!I84","v":3},{"$f":"'F. Physical and Environmental'!J84","v":0},{"$f":"'F. Physical and Environmental'!X84","v":0},{"$f":"'F. Physical and Environmental'!B84","v":"F.2.11.2"},{"$f":"'F. Physical and Environmental'!C84","v":"Locked doors requiring a key or PIN at points of entry?"},{"$f":"'F. Physical and Environmental'!D84","v":"N/A"},{"$f":"'F. Physical and Environmental'!E84","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F84","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G84","v":"11.1.2"},{"$f":"'F. Physical and Environmental'!H84","v":"Physical entry controls"},"DS12.2","Physical security measures","9.1.1","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A85","v":404},{"$f":"'F. Physical and Environmental'!I85","v":3},{"$f":"'F. Physical and Environmental'!J85","v":0},{"$f":"'F. Physical and Environmental'!X85","v":0},{"$f":"'F. Physical and Environmental'!B85","v":"F.2.11.3"},{"$f":"'F. Physical and Environmental'!C85","v":"Access request procedures?"},{"$f":"'F. Physical and Environmental'!D85","v":"N/A"},{"$f":"'F. Physical and Environmental'!E85","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F85","v":"H.7 Physical Access Authorization"},{"$f":"'F. Physical and Environmental'!G85","v":"9.1.1.g"},{"$f":"'F. Physical and Environmental'!H85","v":"Access control policy"},"DS12.2","Physical security measures",9.3000000000000007,"N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A86","v":406},{"$f":"'F. Physical and Environmental'!I86","v":4},{"$f":"'F. Physical and Environmental'!J86","v":0},{"$f":"'F. Physical and Environmental'!X86","v":0},{"$f":"'F. Physical and Environmental'!B86","v":"F.2.11.3.1"},{"$f":"'F. Physical and Environmental'!C86","v":"Segregation of duties for issuing and approving access?"},{"$f":"'F. Physical and Environmental'!D86","v":"N/A"},{"$f":"'F. Physical and Environmental'!E86","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F86","v":"H.7 Physical Access Authorization"},{"$f":"'F. Physical and Environmental'!G86","v":"9.1.1.f"},{"$f":"'F. Physical and Environmental'!H86","v":"Access control policy"},"PO2.1","Enterprise information architecture model","N/A","N/A","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'F. Physical and Environmental'!A87","v":407},{"$f":"'F. Physical and Environmental'!I87","v":4},{"$f":"'F. Physical and Environmental'!J87","v":0},{"$f":"'F. Physical and Environmental'!X87","v":0},{"$f":"'F. Physical and Environmental'!B87","v":"F.2.11.3.2"},{"$f":"'F. Physical and Environmental'!C87","v":"Access reviews conducted at least every six months?"},{"$f":"'F. Physical and Environmental'!D87","v":"N/A"},{"$f":"'F. Physical and Environmental'!E87","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F87","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G87","v":"9.1.1.h                                       9.2.5"},{"$f":"'F. Physical and Environmental'!H87","v":"Access control policy,         Review of user access rights"},"DS12.1","Site selection and layout","9.1.1","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A88","v":420},{"$f":"'F. Physical and Environmental'!I88","v":3},{"$f":"'F. Physical and Environmental'!J88","v":0},{"$f":"'F. Physical and Environmental'!X88","v":0},{"$f":"'F. Physical and Environmental'!B88","v":"F.2.11.4"},{"$f":"'F. Physical and Environmental'!C88","v":"Is there a mechanism to thwart tailgating / piggybacking into the data center?"},{"$f":"'F. Physical and Environmental'!D88","v":"N/A"},{"$f":"'F. Physical and Environmental'!E88","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F88","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G88","v":"NA"},{"$f":"'F. Physical and Environmental'!H88","v":0},"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A89","v":414},{"$f":"'F. Physical and Environmental'!I89","v":2},{"$f":"'F. Physical and Environmental'!J89","v":0},{"$f":"'F. Physical and Environmental'!X89","v":0},{"$f":"'F. Physical and Environmental'!B89","v":"F.2.12"},{"$f":"'F. Physical and Environmental'!C89","v":"Are there security guards at points of entry?"},{"$f":"'F. Physical and Environmental'!D89","v":"N/A"},{"$f":"'F. Physical and Environmental'!E89","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F89","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G89","v":"11.1.1.c"},{"$f":"'F. Physical and Environmental'!H89","v":"Physical security perimeter"},"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A90","v":415},{"$f":"'F. Physical and Environmental'!I90","v":3},{"$f":"'F. Physical and Environmental'!J90","v":0},{"$f":"'F. Physical and Environmental'!X90","v":0},{"$f":"'F. Physical and Environmental'!B90","v":"F.2.12.1"},{"$f":"'F. Physical and Environmental'!C90","v":"Do the security guards monitor security systems and alarms?"},{"$f":"'F. Physical and Environmental'!D90","v":"N/A"},{"$f":"'F. Physical and Environmental'!E90","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F90","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G90","v":"11.1.1.c"},{"$f":"'F. Physical and Environmental'!H90","v":"Physical security perimeter"},"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A91","v":417},{"$f":"'F. Physical and Environmental'!I91","v":2},{"$f":"'F. Physical and Environmental'!J91","v":0},{"$f":"'F. Physical and Environmental'!X91","v":0},{"$f":"'F. Physical and Environmental'!B91","v":"F.2.13"},{"$f":"'F. Physical and Environmental'!C91","v":"Are visitors permitted in the data center?"},{"$f":"'F. Physical and Environmental'!D91","v":"N/A"},{"$f":"'F. Physical and Environmental'!E91","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F91","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G91","v":"11.1.2"},{"$f":"'F. Physical and Environmental'!H91","v":"Physical entry controls"},"DS12.2","Physical security measures","9.4.1","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A92","v":418},{"$f":"'F. Physical and Environmental'!I92","v":3},{"$f":"'F. Physical and Environmental'!J92","v":0},{"$f":"'F. Physical and Environmental'!X92","v":0},{"$f":"'F. Physical and Environmental'!B92","v":"F.2.13.1"},{"$f":"'F. Physical and Environmental'!C92","v":"Are they required to sign in and out of the data center?"},{"$f":"'F. Physical and Environmental'!D92","v":"N/A"},{"$f":"'F. Physical and Environmental'!E92","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F92","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G92","v":"11.1.2.a"},{"$f":"'F. Physical and Environmental'!H92","v":"Physical entry controls"},"DS12.2","Physical security measures","9.4.4","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A93","v":419},{"$f":"'F. Physical and Environmental'!I93","v":3},{"$f":"'F. Physical and Environmental'!J93","v":0},{"$f":"'F. Physical and Environmental'!X93","v":0},{"$f":"'F. Physical and Environmental'!B93","v":"F.2.13.2"},{"$f":"'F. Physical and Environmental'!C93","v":"Are they escorted within the data center?"},{"$f":"'F. Physical and Environmental'!D93","v":"N/A"},{"$f":"'F. Physical and Environmental'!E93","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F93","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G93","v":"11.1.2.a"},{"$f":"'F. Physical and Environmental'!H93","v":"Physical entry controls"},"DS12.2","Physical security measures","9.4.1","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A94","v":421},{"$f":"'F. Physical and Environmental'!I94","v":2},{"$f":"'F. Physical and Environmental'!J94","v":0},{"$f":"'F. Physical and Environmental'!X94","v":0},{"$f":"'F. Physical and Environmental'!B94","v":"F.2.14"},{"$f":"'F. Physical and Environmental'!C94","v":"Are all entry and exit points to the data center alarmed?"},{"$f":"'F. Physical and Environmental'!D94","v":"N/A"},{"$f":"'F. Physical and Environmental'!E94","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F94","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G94","v":"11.1.1.f"},{"$f":"'F. Physical and Environmental'!H94","v":"Physical security perimeter"},"DS12.1","Site selection and layout","9.1.1","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A95","v":422},{"$f":"'F. Physical and Environmental'!I95","v":3},{"$f":"'F. Physical and Environmental'!J95","v":0},{"$f":"'F. Physical and Environmental'!X95","v":0},{"$f":"'F. Physical and Environmental'!B95","v":"F.2.14.1"},{"$f":"'F. Physical and Environmental'!C95","v":"Are there alarm motion sensors monitoring the data center?"},{"$f":"'F. Physical and Environmental'!D95","v":"N/A"},{"$f":"'F. Physical and Environmental'!E95","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F95","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G95","v":"11.1.1.f"},{"$f":"'F. Physical and Environmental'!H95","v":"Physical security perimeter"},"DS12.1","Site selection and layout","9.1.1","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A96","v":2578},{"$f":"'F. Physical and Environmental'!I96","v":2},{"$f":"'F. Physical and Environmental'!J96","v":0},{"$f":"'F. Physical and Environmental'!X96","v":0},{"$f":"'F. Physical and Environmental'!B96","v":"F.2.15"},{"$f":"'F. Physical and Environmental'!C96","v":"Is access to the Data center monitored with CCTV and the video stored for at least 90 days?"},{"$f":"'F. Physical and Environmental'!D96","v":"N/A"},{"$f":"'F. Physical and Environmental'!E96","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F96","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G96","v":"NA"},{"$f":"'F. Physical and Environmental'!H96","v":0},"DS12.1","Site selection and layout","9.1.1","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A97","v":430},{"$f":"'F. Physical and Environmental'!I97","v":2},{"$f":"'F. Physical and Environmental'!J97","v":0},{"$f":"'F. Physical and Environmental'!X97","v":0},{"$f":"'F. Physical and Environmental'!B97","v":"F.2.16"},{"$f":"'F. Physical and Environmental'!C97","v":"Walls extending from true floor to true ceiling?"},{"$f":"'F. Physical and Environmental'!D97","v":"N/A"},{"$f":"'F. Physical and Environmental'!E97","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F97","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G97","v":"11.1.1.b"},{"$f":"'F. Physical and Environmental'!H97","v":"Physical security perimeter"},"DS5.7","Protection of security technology","N/A","N/A","DS12.4, DS12.5"]
[{"$f":"'F. Physical and Environmental'!A98","v":432},{"$f":"'F. Physical and Environmental'!I98","v":2},{"$f":"'F. Physical and Environmental'!J98","v":0},{"$f":"'F. Physical and Environmental'!X98","v":0},{"$f":"'F. Physical and Environmental'!B98","v":"F.2.17"},{"$f":"'F. Physical and Environmental'!C98","v":"Windows or glass walls along the perimeter?"},{"$f":"'F. Physical and Environmental'!D98","v":"N/A"},{"$f":"'F. Physical and Environmental'!E98","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F98","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G98","v":"11.1.1.b"},{"$f":"'F. Physical and Environmental'!H98","v":"Physical security perimeter"},"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A99","v":457},{"$f":"'F. Physical and Environmental'!I99","v":2},{"$f":"'F. Physical and Environmental'!J99","v":0},{"$f":"'F. Physical and Environmental'!X99","v":0},{"$f":"'F. Physical and Environmental'!B99","v":"F.2.18"},{"$f":"'F. Physical and Environmental'!C99","v":"Do the Scoped Systems and Data reside in a caged environment within a data center? If yes, is there a:"},{"$f":"'F. Physical and Environmental'!D99","v":"N/A"},{"$f":"'F. Physical and Environmental'!E99","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F99","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G99","v":"NA"},{"$f":"'F. Physical and Environmental'!H99","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A100","v":461},{"$f":"'F. Physical and Environmental'!I100","v":3},{"$f":"'F. Physical and Environmental'!J100","v":0},{"$f":"'F. Physical and Environmental'!X100","v":0},{"$f":"'F. Physical and Environmental'!B100","v":"F.2.18.1"},{"$f":"'F. Physical and Environmental'!C100","v":"Lock requiring a key or PIN used at points of entry?"},{"$f":"'F. Physical and Environmental'!D100","v":"N/A"},{"$f":"'F. Physical and Environmental'!E100","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F100","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G100","v":"11.1.2"},{"$f":"'F. Physical and Environmental'!H100","v":"Physical entry controls"},"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A101","v":462},{"$f":"'F. Physical and Environmental'!I101","v":3},{"$f":"'F. Physical and Environmental'!J101","v":0},{"$f":"'F. Physical and Environmental'!X101","v":0},{"$f":"'F. Physical and Environmental'!B101","v":"F.2.18.2"},{"$f":"'F. Physical and Environmental'!C101","v":"Process for requesting access?"},{"$f":"'F. Physical and Environmental'!D101","v":"N/A"},{"$f":"'F. Physical and Environmental'!E101","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F101","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G101","v":"9.1.1.g"},{"$f":"'F. Physical and Environmental'!H101","v":"Access control policy"},"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A102","v":463},{"$f":"'F. Physical and Environmental'!I102","v":4},{"$f":"'F. Physical and Environmental'!J102","v":0},{"$f":"'F. Physical and Environmental'!X102","v":0},{"$f":"'F. Physical and Environmental'!B102","v":"F.2.18.2.1"},{"$f":"'F. Physical and Environmental'!C102","v":"Segregation of duties for granting and storage of access devices (badges, keys, etc.)?"},{"$f":"'F. Physical and Environmental'!D102","v":"N/A"},{"$f":"'F. Physical and Environmental'!E102","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F102","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G102","v":"9.1.1.f"},{"$f":"'F. Physical and Environmental'!H102","v":"Access control policy"},"PO2.1","Enterprise information architecture model","N/A","N/A","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'F. Physical and Environmental'!A103","v":465},{"$f":"'F. Physical and Environmental'!I103","v":3},{"$f":"'F. Physical and Environmental'!J103","v":0},{"$f":"'F. Physical and Environmental'!X103","v":0},{"$f":"'F. Physical and Environmental'!B103","v":"F.2.18.3"},{"$f":"'F. Physical and Environmental'!C103","v":"List maintained of personnel with cards / keys to the caged environment?"},{"$f":"'F. Physical and Environmental'!D103","v":"N/A"},{"$f":"'F. Physical and Environmental'!E103","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F103","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G103","v":"11.1.1.c"},{"$f":"'F. Physical and Environmental'!H103","v":"Physical security perimeter"},"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A104","v":466},{"$f":"'F. Physical and Environmental'!I104","v":3},{"$f":"'F. Physical and Environmental'!J104","v":0},{"$f":"'F. Physical and Environmental'!X104","v":0},{"$f":"'F. Physical and Environmental'!B104","v":"F.2.18.4"},{"$f":"'F. Physical and Environmental'!C104","v":"Process to report lost access cards / keys?"},{"$f":"'F. Physical and Environmental'!D104","v":"N/A"},{"$f":"'F. Physical and Environmental'!E104","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F104","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G104","v":"11.1.2.d"},{"$f":"'F. Physical and Environmental'!H104","v":"Physical entry controls"},"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A105","v":467},{"$f":"'F. Physical and Environmental'!I105","v":3},{"$f":"'F. Physical and Environmental'!J105","v":0},{"$f":"'F. Physical and Environmental'!X105","v":0},{"$f":"'F. Physical and Environmental'!B105","v":"F.2.18.5"},{"$f":"'F. Physical and Environmental'!C105","v":"Process to review access to the cage at least every six months?"},{"$f":"'F. Physical and Environmental'!D105","v":"N/A"},{"$f":"'F. Physical and Environmental'!E105","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F105","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G105","v":"9.1.1.h                                       9.2.5"},{"$f":"'F. Physical and Environmental'!H105","v":"Access control policy,         Review of user access rights"},"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A106","v":469},{"$f":"'F. Physical and Environmental'!I106","v":3},{"$f":"'F. Physical and Environmental'!J106","v":0},{"$f":"'F. Physical and Environmental'!X106","v":0},{"$f":"'F. Physical and Environmental'!B106","v":"F.2.18.6"},{"$f":"'F. Physical and Environmental'!C106","v":"Process to collect access equipment (badges, keys, change pin numbers, etc.) when a constituent is terminated or changes status and no longer requires access?"},{"$f":"'F. Physical and Environmental'!D106","v":"N/A"},{"$f":"'F. Physical and Environmental'!E106","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F106","v":"H.6 Revoke Physical Access"},{"$f":"'F. Physical and Environmental'!G106","v":"9.1.1.i"},{"$f":"'F. Physical and Environmental'!H106","v":"Access control policy"},"DS12.2","Physical security measures",9.3000000000000007,"N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A107","v":471},{"$f":"'F. Physical and Environmental'!I107","v":3},{"$f":"'F. Physical and Environmental'!J107","v":0},{"$f":"'F. Physical and Environmental'!X107","v":0},{"$f":"'F. Physical and Environmental'!B107","v":"F.2.18.7"},{"$f":"'F. Physical and Environmental'!C107","v":"Are visitors permitted in the caged environment? If yes, are they:"},{"$f":"'F. Physical and Environmental'!D107","v":"N/A"},{"$f":"'F. Physical and Environmental'!E107","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F107","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G107","v":"11.1.2"},{"$f":"'F. Physical and Environmental'!H107","v":"Physical entry controls"},"DS12.2","Physical security measures","9.4.1","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A108","v":472},{"$f":"'F. Physical and Environmental'!I108","v":4},{"$f":"'F. Physical and Environmental'!J108","v":0},{"$f":"'F. Physical and Environmental'!X108","v":0},{"$f":"'F. Physical and Environmental'!B108","v":"F.2.18.7.1"},{"$f":"'F. Physical and Environmental'!C108","v":"Required to sign in and out?"},{"$f":"'F. Physical and Environmental'!D108","v":"N/A"},{"$f":"'F. Physical and Environmental'!E108","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F108","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G108","v":"11.1.2.a"},{"$f":"'F. Physical and Environmental'!H108","v":"Physical entry controls"},"DS12.2","Physical security measures","9.4.4","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A109","v":473},{"$f":"'F. Physical and Environmental'!I109","v":4},{"$f":"'F. Physical and Environmental'!J109","v":0},{"$f":"'F. Physical and Environmental'!X109","v":0},{"$f":"'F. Physical and Environmental'!B109","v":"F.2.18.7.2"},{"$f":"'F. Physical and Environmental'!C109","v":"Escorted?"},{"$f":"'F. Physical and Environmental'!D109","v":"N/A"},{"$f":"'F. Physical and Environmental'!E109","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F109","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G109","v":"11.1.2.a Physical entry controls"},{"$f":"'F. Physical and Environmental'!H109","v":"Physical entry controls"},"DS12.2","Physical security measures","9.4.1","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A110","v":474},{"$f":"'F. Physical and Environmental'!I110","v":3},{"$f":"'F. Physical and Environmental'!J110","v":0},{"$f":"'F. Physical and Environmental'!X110","v":0},{"$f":"'F. Physical and Environmental'!B110","v":"F.2.18.8"},{"$f":"'F. Physical and Environmental'!C110","v":"Monitored with CCTV and the video stored for at least 90 days?"},{"$f":"'F. Physical and Environmental'!D110","v":"N/A"},{"$f":"'F. Physical and Environmental'!E110","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F110","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G110","v":"NA"},{"$f":"'F. Physical and Environmental'!H110","v":0},"DS12.1","Site selection and layout","9.1.1","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A111","v":477},{"$f":"'F. Physical and Environmental'!I111","v":2},{"$f":"'F. Physical and Environmental'!J111","v":0},{"$f":"'F. Physical and Environmental'!X111","v":0},{"$f":"'F. Physical and Environmental'!B111","v":"F.2.19"},{"$f":"'F. Physical and Environmental'!C111","v":"Do the Scoped Systems and Data reside in a locked cabinet? If yes, is there:"},{"$f":"'F. Physical and Environmental'!D111","v":"N/A"},{"$f":"'F. Physical and Environmental'!E111","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F111","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G111","v":"NA"},{"$f":"'F. Physical and Environmental'!H111","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A112","v":478},{"$f":"'F. Physical and Environmental'!I112","v":3},{"$f":"'F. Physical and Environmental'!J112","v":0},{"$f":"'F. Physical and Environmental'!X112","v":0},{"$f":"'F. Physical and Environmental'!B112","v":"F.2.19.1"},{"$f":"'F. Physical and Environmental'!C112","v":"Shared cabinets?"},{"$f":"'F. Physical and Environmental'!D112","v":"N/A"},{"$f":"'F. Physical and Environmental'!E112","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F112","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G112","v":"NA"},{"$f":"'F. Physical and Environmental'!H112","v":0},"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A113","v":479},{"$f":"'F. Physical and Environmental'!I113","v":3},{"$f":"'F. Physical and Environmental'!J113","v":0},{"$f":"'F. Physical and Environmental'!X113","v":0},{"$f":"'F. Physical and Environmental'!B113","v":"F.2.19.2"},{"$f":"'F. Physical and Environmental'!C113","v":"Restricted access and logs kept of all access?"},{"$f":"'F. Physical and Environmental'!D113","v":"N/A"},{"$f":"'F. Physical and Environmental'!E113","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F113","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G113","v":"11.1.2.c"},{"$f":"'F. Physical and Environmental'!H113","v":"Physical entry controls"},"DS12.1","Site selection and layout",9.3000000000000007,"N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A114","v":480},{"$f":"'F. Physical and Environmental'!I114","v":3},{"$f":"'F. Physical and Environmental'!J114","v":0},{"$f":"'F. Physical and Environmental'!X114","v":0},{"$f":"'F. Physical and Environmental'!B114","v":"F.2.19.3"},{"$f":"'F. Physical and Environmental'!C114","v":"Access request procedures?"},{"$f":"'F. Physical and Environmental'!D114","v":"N/A"},{"$f":"'F. Physical and Environmental'!E114","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F114","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G114","v":"9.1.1.g"},{"$f":"'F. Physical and Environmental'!H114","v":"Access control policy"},"DS12.1","Site selection and layout",9.3000000000000007,"N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A115","v":481},{"$f":"'F. Physical and Environmental'!I115","v":3},{"$f":"'F. Physical and Environmental'!J115","v":0},{"$f":"'F. Physical and Environmental'!X115","v":0},{"$f":"'F. Physical and Environmental'!B115","v":"F.2.19.4"},{"$f":"'F. Physical and Environmental'!C115","v":"Segregation of duties for issuing, approving access and storing devices (badges, keys, etc.)?"},{"$f":"'F. Physical and Environmental'!D115","v":"N/A"},{"$f":"'F. Physical and Environmental'!E115","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F115","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G115","v":"9.1.1.f"},{"$f":"'F. Physical and Environmental'!H115","v":"Access control policy"},"PO2.1","Enterprise information architecture model","N/A","N/A","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'F. Physical and Environmental'!A116","v":483},{"$f":"'F. Physical and Environmental'!I116","v":3},{"$f":"'F. Physical and Environmental'!J116","v":0},{"$f":"'F. Physical and Environmental'!X116","v":0},{"$f":"'F. Physical and Environmental'!B116","v":"F.2.19.5"},{"$f":"'F. Physical and Environmental'!C116","v":"A list of personnel with cards / keys to the cabinet?"},{"$f":"'F. Physical and Environmental'!D116","v":"N/A"},{"$f":"'F. Physical and Environmental'!E116","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F116","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G116","v":"11.1.1.c"},{"$f":"'F. Physical and Environmental'!H116","v":"Physical security perimeter"},"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A117","v":484},{"$f":"'F. Physical and Environmental'!I117","v":3},{"$f":"'F. Physical and Environmental'!J117","v":0},{"$f":"'F. Physical and Environmental'!X117","v":0},{"$f":"'F. Physical and Environmental'!B117","v":"F.2.19.6"},{"$f":"'F. Physical and Environmental'!C117","v":"A process to report lost access cards / keys?"},{"$f":"'F. Physical and Environmental'!D117","v":"N/A"},{"$f":"'F. Physical and Environmental'!E117","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F117","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G117","v":"11.1.2.d"},{"$f":"'F. Physical and Environmental'!H117","v":"Physical entry controls"},"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A118","v":485},{"$f":"'F. Physical and Environmental'!I118","v":3},{"$f":"'F. Physical and Environmental'!J118","v":0},{"$f":"'F. Physical and Environmental'!X118","v":0},{"$f":"'F. Physical and Environmental'!B118","v":"F.2.19.7"},{"$f":"'F. Physical and Environmental'!C118","v":"Collection access equipment (badges, keys, change pin numbers, etc.) when a constituent is terminated or changes status and no longer requires access?"},{"$f":"'F. Physical and Environmental'!D118","v":"N/A"},{"$f":"'F. Physical and Environmental'!E118","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F118","v":"H.6 Revoke Physical Access"},{"$f":"'F. Physical and Environmental'!G118","v":"9.1.1.i"},{"$f":"'F. Physical and Environmental'!H118","v":"Access control policy"},"DS12.2","Physical security measures",9.3000000000000007,"N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A119","v":487},{"$f":"'F. Physical and Environmental'!I119","v":3},{"$f":"'F. Physical and Environmental'!J119","v":0},{"$f":"'F. Physical and Environmental'!X119","v":0},{"$f":"'F. Physical and Environmental'!B119","v":"F.2.19.8"},{"$f":"'F. Physical and Environmental'!C119","v":"Cabinets monitored with CCTV and the video stored for at least 90 days?"},{"$f":"'F. Physical and Environmental'!D119","v":"N/A"},{"$f":"'F. Physical and Environmental'!E119","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F119","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G119","v":"NA"},{"$f":"'F. Physical and Environmental'!H119","v":0},"DS12.1","Site selection and layout","9.1.1","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A120","v":490},{"$f":"'F. Physical and Environmental'!I120","v":2},{"$f":"'F. Physical and Environmental'!J120","v":0},{"$f":"'F. Physical and Environmental'!X120","v":0},{"$f":"'F. Physical and Environmental'!B120","v":"F.2.20"},{"$f":"'F. Physical and Environmental'!C120","v":"Is there a policy on using locking screensavers on unattended system displays or locks on consoles within the data center?"},{"$f":"'F. Physical and Environmental'!D120","v":"N/A"},{"$f":"'F. Physical and Environmental'!E120","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F120","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G120","v":"11.2.8                                       11.2.9"},{"$f":"'F. Physical and Environmental'!H120","v":"Unattended user equipment, Clear desk and clear screen policy"},"PO6.2","Enterprise IT risk and internal control framework","8.1.7","N/A","PO6.2, DS5.7"]
[{"$f":"'F. Physical and Environmental'!A121","v":491},{"$f":"'F. Physical and Environmental'!I121","v":2},{"$f":"'F. Physical and Environmental'!J121","v":0},{"$f":"'F. Physical and Environmental'!X121","v":0},{"$f":"'F. Physical and Environmental'!B121","v":"F.2.21"},{"$f":"'F. Physical and Environmental'!C121","v":"Is there a procedure for equipment removal from the data center?"},{"$f":"'F. Physical and Environmental'!D121","v":"N/A"},{"$f":"'F. Physical and Environmental'!E121","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F121","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G121","v":"11.2.6"},{"$f":"'F. Physical and Environmental'!H121","v":"Security of equipment and assets off-premises"},"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A122","v":526},{"$f":"'F. Physical and Environmental'!I122","v":2},{"$f":"'F. Physical and Environmental'!J122","v":1},{"$f":"'F. Physical and Environmental'!X122","v":0},{"$f":"'F. Physical and Environmental'!B122","v":"F.2.22"},{"$f":"'F. Physical and Environmental'!C122","v":"Is there a preventive maintenance or current maintenance contracts for:"},{"$f":"'F. Physical and Environmental'!D122","v":0},{"$f":"'F. Physical and Environmental'!E122","v":0},{"$f":"'F. Physical and Environmental'!F122","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G122","v":"11.2.4"},{"$f":"'F. Physical and Environmental'!H122","v":"Equipment maintenance"},null,null,"N/A","OPS.1.7.1.8 OPS.2.12.D.7","N/A"]
[{"$f":"'F. Physical and Environmental'!A123","v":527},{"$f":"'F. Physical and Environmental'!I123","v":3},{"$f":"'F. Physical and Environmental'!J123","v":0},{"$f":"'F. Physical and Environmental'!X123","v":0},{"$f":"'F. Physical and Environmental'!B123","v":"F.2.22.1"},{"$f":"'F. Physical and Environmental'!C123","v":"UPS system?"},{"$f":"'F. Physical and Environmental'!D123","v":"N/A"},{"$f":"'F. Physical and Environmental'!E123","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F123","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G123","v":"11.2.4"},{"$f":"'F. Physical and Environmental'!H123","v":"Equipment maintenance"},"AI3.3","Infrastructure maintenance","N/A","N/A","AI3.3, DS12.5, DS13.5"]
[{"$f":"'F. Physical and Environmental'!A124","v":528},{"$f":"'F. Physical and Environmental'!I124","v":3},{"$f":"'F. Physical and Environmental'!J124","v":0},{"$f":"'F. Physical and Environmental'!X124","v":0},{"$f":"'F. Physical and Environmental'!B124","v":"F.2.22.2"},{"$f":"'F. Physical and Environmental'!C124","v":"Security system?"},{"$f":"'F. Physical and Environmental'!D124","v":"N/A"},{"$f":"'F. Physical and Environmental'!E124","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F124","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G124","v":"11.2.4"},{"$f":"'F. Physical and Environmental'!H124","v":"Equipment maintenance"},"AI3.3","Infrastructure maintenance","N/A","N/A","AI3.3, DS12.5, DS13.5"]
[{"$f":"'F. Physical and Environmental'!A125","v":529},{"$f":"'F. Physical and Environmental'!I125","v":3},{"$f":"'F. Physical and Environmental'!J125","v":0},{"$f":"'F. Physical and Environmental'!X125","v":0},{"$f":"'F. Physical and Environmental'!B125","v":"F.2.22.3"},{"$f":"'F. Physical and Environmental'!C125","v":"Generator?"},{"$f":"'F. Physical and Environmental'!D125","v":"N/A"},{"$f":"'F. Physical and Environmental'!E125","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F125","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G125","v":"11.2.4"},{"$f":"'F. Physical and Environmental'!H125","v":"Equipment maintenance"},"AI3.3","Infrastructure maintenance","N/A","N/A","AI3.3, DS12.5, DS13.5"]
[{"$f":"'F. Physical and Environmental'!A126","v":530},{"$f":"'F. Physical and Environmental'!I126","v":3},{"$f":"'F. Physical and Environmental'!J126","v":0},{"$f":"'F. Physical and Environmental'!X126","v":0},{"$f":"'F. Physical and Environmental'!B126","v":"F.2.22.4"},{"$f":"'F. Physical and Environmental'!C126","v":"Batteries?"},{"$f":"'F. Physical and Environmental'!D126","v":"N/A"},{"$f":"'F. Physical and Environmental'!E126","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F126","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G126","v":"11.2.4"},{"$f":"'F. Physical and Environmental'!H126","v":"Equipment maintenance"},"AI3.3","Infrastructure maintenance","N/A","N/A","AI3.3, DS12.5, DS13.5"]
[{"$f":"'F. Physical and Environmental'!A127","v":531},{"$f":"'F. Physical and Environmental'!I127","v":3},{"$f":"'F. Physical and Environmental'!J127","v":0},{"$f":"'F. Physical and Environmental'!X127","v":0},{"$f":"'F. Physical and Environmental'!B127","v":"F.2.22.5"},{"$f":"'F. Physical and Environmental'!C127","v":"Monitored fire alarm?"},{"$f":"'F. Physical and Environmental'!D127","v":"N/A"},{"$f":"'F. Physical and Environmental'!E127","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F127","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G127","v":"11.2.4"},{"$f":"'F. Physical and Environmental'!H127","v":"Equipment maintenance"},"AI3.3","Infrastructure maintenance","N/A","N/A","AI3.3, DS12.5, DS13.5"]
[{"$f":"'F. Physical and Environmental'!A128","v":532},{"$f":"'F. Physical and Environmental'!I128","v":3},{"$f":"'F. Physical and Environmental'!J128","v":0},{"$f":"'F. Physical and Environmental'!X128","v":0},{"$f":"'F. Physical and Environmental'!B128","v":"F.2.22.6"},{"$f":"'F. Physical and Environmental'!C128","v":"Fire suppression systems?"},{"$f":"'F. Physical and Environmental'!D128","v":"N/A"},{"$f":"'F. Physical and Environmental'!E128","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F128","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G128","v":"11.2.4"},{"$f":"'F. Physical and Environmental'!H128","v":"Equipment maintenance"},"AI3.3","Infrastructure maintenance","N/A","OPS.1.7.1.6 OPS.2.12.D.5","AI3.3, DS12.5, DS13.5"]
[{"$f":"'F. Physical and Environmental'!A129","v":533},{"$f":"'F. Physical and Environmental'!I129","v":3},{"$f":"'F. Physical and Environmental'!J129","v":0},{"$f":"'F. Physical and Environmental'!X129","v":0},{"$f":"'F. Physical and Environmental'!B129","v":"F.2.22.7"},{"$f":"'F. Physical and Environmental'!C129","v":"HVAC?"},{"$f":"'F. Physical and Environmental'!D129","v":"N/A"},{"$f":"'F. Physical and Environmental'!E129","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F129","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G129","v":"11.2.4"},{"$f":"'F. Physical and Environmental'!H129","v":"Equipment maintenance"},"AI3.3","Infrastructure maintenance","N/A","N/A","AI3.3, DS12.5, DS13.5"]
[{"$f":"'F. Physical and Environmental'!A130","v":534},{"$f":"'F. Physical and Environmental'!I130","v":2},{"$f":"'F. Physical and Environmental'!J130","v":1},{"$f":"'F. Physical and Environmental'!X130","v":0},{"$f":"'F. Physical and Environmental'!B130","v":"F.2.23"},{"$f":"'F. Physical and Environmental'!C130","v":"Are the following tested:"},{"$f":"'F. Physical and Environmental'!D130","v":0},{"$f":"'F. Physical and Environmental'!E130","v":0},{"$f":"'F. Physical and Environmental'!F130","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G130","v":"NA"},{"$f":"'F. Physical and Environmental'!H130","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A131","v":535},{"$f":"'F. Physical and Environmental'!I131","v":3},{"$f":"'F. Physical and Environmental'!J131","v":0},{"$f":"'F. Physical and Environmental'!X131","v":0},{"$f":"'F. Physical and Environmental'!B131","v":"F.2.23.1"},{"$f":"'F. Physical and Environmental'!C131","v":"UPS system - annually?"},{"$f":"'F. Physical and Environmental'!D131","v":"N/A"},{"$f":"'F. Physical and Environmental'!E131","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F131","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G131","v":"NA"},{"$f":"'F. Physical and Environmental'!H131","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A132","v":536},{"$f":"'F. Physical and Environmental'!I132","v":3},{"$f":"'F. Physical and Environmental'!J132","v":0},{"$f":"'F. Physical and Environmental'!X132","v":0},{"$f":"'F. Physical and Environmental'!B132","v":"F.2.23.2"},{"$f":"'F. Physical and Environmental'!C132","v":"Security alarm system - annually?"},{"$f":"'F. Physical and Environmental'!D132","v":"N/A"},{"$f":"'F. Physical and Environmental'!E132","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F132","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G132","v":"NA"},{"$f":"'F. Physical and Environmental'!H132","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A133","v":537},{"$f":"'F. Physical and Environmental'!I133","v":3},{"$f":"'F. Physical and Environmental'!J133","v":0},{"$f":"'F. Physical and Environmental'!X133","v":0},{"$f":"'F. Physical and Environmental'!B133","v":"F.2.23.3"},{"$f":"'F. Physical and Environmental'!C133","v":"Fire alarms - annually?"},{"$f":"'F. Physical and Environmental'!D133","v":"N/A"},{"$f":"'F. Physical and Environmental'!E133","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F133","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G133","v":"NA"},{"$f":"'F. Physical and Environmental'!H133","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A134","v":538},{"$f":"'F. Physical and Environmental'!I134","v":3},{"$f":"'F. Physical and Environmental'!J134","v":0},{"$f":"'F. Physical and Environmental'!X134","v":0},{"$f":"'F. Physical and Environmental'!B134","v":"F.2.23.4"},{"$f":"'F. Physical and Environmental'!C134","v":"Fire suppression system - annually?"},{"$f":"'F. Physical and Environmental'!D134","v":"N/A"},{"$f":"'F. Physical and Environmental'!E134","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F134","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G134","v":"NA"},{"$f":"'F. Physical and Environmental'!H134","v":0},null,null,"N/A","OPS.1.7.1.6 OPS.2.12.D.5","N/A"]
[{"$f":"'F. Physical and Environmental'!A135","v":539},{"$f":"'F. Physical and Environmental'!I135","v":3},{"$f":"'F. Physical and Environmental'!J135","v":0},{"$f":"'F. Physical and Environmental'!X135","v":0},{"$f":"'F. Physical and Environmental'!B135","v":"F.2.23.5"},{"$f":"'F. Physical and Environmental'!C135","v":"Generators - monthly?"},{"$f":"'F. Physical and Environmental'!D135","v":"N/A"},{"$f":"'F. Physical and Environmental'!E135","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F135","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G135","v":"NA"},{"$f":"'F. Physical and Environmental'!H135","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A136","v":540},{"$f":"'F. Physical and Environmental'!I136","v":3},{"$f":"'F. Physical and Environmental'!J136","v":0},{"$f":"'F. Physical and Environmental'!X136","v":0},{"$f":"'F. Physical and Environmental'!B136","v":"F.2.23.6"},{"$f":"'F. Physical and Environmental'!C136","v":"Generators full load tested - monthly?"},{"$f":"'F. Physical and Environmental'!D136","v":"N/A"},{"$f":"'F. Physical and Environmental'!E136","v":"Data Center Security is provided by Microsoft, Google and Amazon Cloud Services. The facilities and practices are considered confidentail. "},{"$f":"'F. Physical and Environmental'!F136","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!G136","v":"NA"},{"$f":"'F. Physical and Environmental'!H136","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A137","v":0},{"$f":"'F. Physical and Environmental'!I137","v":0},{"$f":"'F. Physical and Environmental'!J137","v":0},{"$f":"'F. Physical and Environmental'!X137","v":0},{"$f":"'F. Physical and Environmental'!B137","v":0},{"$f":"'F. Physical and Environmental'!C137","v":0},{"$f":"'F. Physical and Environmental'!D137","v":0},{"$f":"'F. Physical and Environmental'!E137","v":0},{"$f":"'F. Physical and Environmental'!F137","v":0},{"$f":"'F. Physical and Environmental'!G137","v":0},{"$f":"'F. Physical and Environmental'!H137","v":0}]
[]
[{"$f":"'G. Communications and Ops Mgmt'!B1","v":"G. Communications and Operations Management"},null,null,null,{"$f":"'G. Communications and Ops Mgmt'!B1","v":"G. Communications and Operations Management"}]
[{"$f":"'G. Communications and Ops Mgmt'!A5","v":2582},{"$f":"'G. Communications and Ops Mgmt'!I5","v":1},{"$f":"'G. Communications and Ops Mgmt'!J5","v":0},{"$f":"'G. Communications and Ops Mgmt'!X5","v":1},{"$f":"'G. Communications and Ops Mgmt'!B5","v":"G.1"},{"$f":"'G. Communications and Ops Mgmt'!C5","v":"Are management approved operating procedures utilized? If yes, are they:"},{"$f":"'G. Communications and Ops Mgmt'!D5","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E5","v":"Cloudamize Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F5","v":"G. Communications and Operations Management"},{"$f":"'G. Communications and Ops Mgmt'!G5","v":"12.1.1"},{"$f":"'G. Communications and Ops Mgmt'!H5","v":"Documented Operating Procedure"},"AI1.1","Definition and maintenance of business functional and technical requirements","N/A","MGMT.1.6.1.4 OPS.1.5 WPS.2.2.1.3.2 AUDIT.2.D.1.11","AI1.1, AI4.4, DS13.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A6","v":2583},{"$f":"'G. Communications and Ops Mgmt'!I6","v":2},{"$f":"'G. Communications and Ops Mgmt'!J6","v":0},{"$f":"'G. Communications and Ops Mgmt'!X6","v":0},{"$f":"'G. Communications and Ops Mgmt'!B6","v":"G.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C6","v":"Documented, maintained, and made available to all users?"},{"$f":"'G. Communications and Ops Mgmt'!D6","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E6","v":"Cloudamize Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F6","v":"G. Communications and Operations Management"},{"$f":"'G. Communications and Ops Mgmt'!G6","v":"12.1.1"},{"$f":"'G. Communications and Ops Mgmt'!H6","v":"Documented Operating Procedure"},"AI1.1","Definition and maintenance of business functional and technical requirements","N/A","OPS.1.4.4 AUDIT.2.D.1.3","AI1.1, AI4.4, DS13.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A7","v":816},{"$f":"'G. Communications and Ops Mgmt'!I7","v":1},{"$f":"'G. Communications and Ops Mgmt'!J7","v":0},{"$f":"'G. Communications and Ops Mgmt'!X7","v":1},{"$f":"'G. Communications and Ops Mgmt'!B7","v":"G.2"},{"$f":"'G. Communications and Ops Mgmt'!C7","v":"Is there an operational change management / change control policy or program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy? If yes, does it include:"},{"$f":"'G. Communications and Ops Mgmt'!D7","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E7","v":"Cloudamize Security Policy -Change Management"},{"$f":"'G. Communications and Ops Mgmt'!F7","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!G7","v":"12.1.2"},{"$f":"'G. Communications and Ops Mgmt'!H7","v":"Change Management"},"AI6.1","Change standards and procedures",6.4,"IS.1.7.8 OPS.1.5.1.3","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A8","v":828},{"$f":"'G. Communications and Ops Mgmt'!I8","v":2},{"$f":"'G. Communications and Ops Mgmt'!J8","v":0},{"$f":"'G. Communications and Ops Mgmt'!X8","v":0},{"$f":"'G. Communications and Ops Mgmt'!B8","v":"G.2.1"},{"$f":"'G. Communications and Ops Mgmt'!C8","v":"Documentation of changes?"},{"$f":"'G. Communications and Ops Mgmt'!D8","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E8","v":"Cloudamize Security Policy -Change Management"},{"$f":"'G. Communications and Ops Mgmt'!F8","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!G8","v":"12.1.2.a"},{"$f":"'G. Communications and Ops Mgmt'!H8","v":"Change Management"},"AI6.1","Change standards and procedures","6.4.5","D&A.1.7.1.3 D&A.1.7.1.5 D&A.1.10.1.1.3 D&A.1.10.1.1.5","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A9","v":823},{"$f":"'G. Communications and Ops Mgmt'!I9","v":2},{"$f":"'G. Communications and Ops Mgmt'!J9","v":0},{"$f":"'G. Communications and Ops Mgmt'!X9","v":0},{"$f":"'G. Communications and Ops Mgmt'!B9","v":"G.2.2"},{"$f":"'G. Communications and Ops Mgmt'!C9","v":"Request, review and approval of proposed changes?"},{"$f":"'G. Communications and Ops Mgmt'!D9","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E9","v":"Cloudamize Security Policy -Change Management"},{"$f":"'G. Communications and Ops Mgmt'!F9","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!G9","v":"12.1.2.d"},{"$f":"'G. Communications and Ops Mgmt'!H9","v":"Change Management"},"AI6.1","Change standards and procedures","6.4.5.2","D&A.1.5.1.7 D&A.1.7.1.1 D&A.1.10.1.1.1","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A10","v":829},{"$f":"'G. Communications and Ops Mgmt'!I10","v":2},{"$f":"'G. Communications and Ops Mgmt'!J10","v":0},{"$f":"'G. Communications and Ops Mgmt'!X10","v":0},{"$f":"'G. Communications and Ops Mgmt'!B10","v":"G.2.3"},{"$f":"'G. Communications and Ops Mgmt'!C10","v":"Pre-implementation testing?"},{"$f":"'G. Communications and Ops Mgmt'!D10","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E10","v":"Cloudamize Security Policy -Change Management"},{"$f":"'G. Communications and Ops Mgmt'!F10","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!G10","v":"12.1.2.b"},{"$f":"'G. Communications and Ops Mgmt'!H10","v":"Change Management"},"AI6.1","Change standards and procedures","6.4.5.3","D&A.1.7.1.2 D&A.1.10.1.1.2","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A11","v":830},{"$f":"'G. Communications and Ops Mgmt'!I11","v":2},{"$f":"'G. Communications and Ops Mgmt'!J11","v":0},{"$f":"'G. Communications and Ops Mgmt'!X11","v":0},{"$f":"'G. Communications and Ops Mgmt'!B11","v":"G.2.4"},{"$f":"'G. Communications and Ops Mgmt'!C11","v":"Post-implementation testing?"},{"$f":"'G. Communications and Ops Mgmt'!D11","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E11","v":"Cloudamize Security Policy -Change Management"},{"$f":"'G. Communications and Ops Mgmt'!F11","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!G11","v":"12.1.2.b"},{"$f":"'G. Communications and Ops Mgmt'!H11","v":"Change Management"},"AI6.1","Change standards and procedures","6.4.5.3","D&A.1.7.1.2 D&A.1.10.1.1.2","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A12","v":824},{"$f":"'G. Communications and Ops Mgmt'!I12","v":2},{"$f":"'G. Communications and Ops Mgmt'!J12","v":0},{"$f":"'G. Communications and Ops Mgmt'!X12","v":0},{"$f":"'G. Communications and Ops Mgmt'!B12","v":"G.2.5"},{"$f":"'G. Communications and Ops Mgmt'!C12","v":"Review for potential security impact?"},{"$f":"'G. Communications and Ops Mgmt'!D12","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E12","v":"Cloudamize Security Policy -Change Management"},{"$f":"'G. Communications and Ops Mgmt'!F12","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!G12","v":"12.1.2.c"},{"$f":"'G. Communications and Ops Mgmt'!H12","v":"Change Management"},"AI6.1","Change standards and procedures","6.4.5.1","N/A","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A13","v":826},{"$f":"'G. Communications and Ops Mgmt'!I13","v":2},{"$f":"'G. Communications and Ops Mgmt'!J13","v":0},{"$f":"'G. Communications and Ops Mgmt'!X13","v":0},{"$f":"'G. Communications and Ops Mgmt'!B13","v":"G.2.6"},{"$f":"'G. Communications and Ops Mgmt'!C13","v":"Review for potential operational impact?"},{"$f":"'G. Communications and Ops Mgmt'!D13","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E13","v":"Cloudamize Security Policy -Change Management"},{"$f":"'G. Communications and Ops Mgmt'!F13","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!G13","v":"12.1.2.c"},{"$f":"'G. Communications and Ops Mgmt'!H13","v":"Change Management"},"AI6.1","Change standards and procedures","6.4.5.1","D&A.1.7.1.4","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A14","v":2593},{"$f":"'G. Communications and Ops Mgmt'!I14","v":2},{"$f":"'G. Communications and Ops Mgmt'!J14","v":0},{"$f":"'G. Communications and Ops Mgmt'!X14","v":0},{"$f":"'G. Communications and Ops Mgmt'!B14","v":"G.2.7"},{"$f":"'G. Communications and Ops Mgmt'!C14","v":"Communication of changes to all relevant constituents?"},{"$f":"'G. Communications and Ops Mgmt'!D14","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E14","v":"Cloudamize Security Policy -Change Management"},{"$f":"'G. Communications and Ops Mgmt'!F14","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!G14","v":"12.1.2.f"},{"$f":"'G. Communications and Ops Mgmt'!H14","v":"Change Management"},"AI6.1","Change standards and procedures","N/A","D&A.1.7.1.6 D&A.1.10.1.1.6","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A15","v":831},{"$f":"'G. Communications and Ops Mgmt'!I15","v":2},{"$f":"'G. Communications and Ops Mgmt'!J15","v":0},{"$f":"'G. Communications and Ops Mgmt'!X15","v":0},{"$f":"'G. Communications and Ops Mgmt'!B15","v":"G.2.8"},{"$f":"'G. Communications and Ops Mgmt'!C15","v":"Rollback procedures?"},{"$f":"'G. Communications and Ops Mgmt'!D15","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E15","v":"Cloudamize Security Policy -Change Management"},{"$f":"'G. Communications and Ops Mgmt'!F15","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!G15","v":"12.1.2.g"},{"$f":"'G. Communications and Ops Mgmt'!H15","v":"Change Management"},"AI6.1","Change standards and procedures","6.4.5.4","D&A.1.10.1.1.4 D&A.1.11.1.6","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A16","v":841},{"$f":"'G. Communications and Ops Mgmt'!I16","v":2},{"$f":"'G. Communications and Ops Mgmt'!J16","v":0},{"$f":"'G. Communications and Ops Mgmt'!X16","v":0},{"$f":"'G. Communications and Ops Mgmt'!B16","v":"G.2.9"},{"$f":"'G. Communications and Ops Mgmt'!C16","v":"Maintenance of change control logs?"},{"$f":"'G. Communications and Ops Mgmt'!D16","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E16","v":"Cloudamize Security Policy -Change Management"},{"$f":"'G. Communications and Ops Mgmt'!F16","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!G16","v":"14.2.2.j"},{"$f":"'G. Communications and Ops Mgmt'!H16","v":"System change control procedures"},"AI6.1","Change standards and procedures","N/A","N/A","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A17","v":837},{"$f":"'G. Communications and Ops Mgmt'!I17","v":2},{"$f":"'G. Communications and Ops Mgmt'!J17","v":0},{"$f":"'G. Communications and Ops Mgmt'!X17","v":0},{"$f":"'G. Communications and Ops Mgmt'!B17","v":"G.2.10"},{"$f":"'G. Communications and Ops Mgmt'!C17","v":"Code reviewed by information security prior to the implementation of internally developed applications and / or application updates?"},{"$f":"'G. Communications and Ops Mgmt'!D17","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E17","v":"Cloudamize Security Policy -Change Management"},{"$f":"'G. Communications and Ops Mgmt'!F17","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!G17","v":"14.2.2.e"},{"$f":"'G. Communications and Ops Mgmt'!H17","v":"System change control procedures"},"AI2.6","Major upgrades to existing systems","6.3.2","N/A","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'G. Communications and Ops Mgmt'!A18","v":839},{"$f":"'G. Communications and Ops Mgmt'!I18","v":2},{"$f":"'G. Communications and Ops Mgmt'!J18","v":0},{"$f":"'G. Communications and Ops Mgmt'!X18","v":0},{"$f":"'G. Communications and Ops Mgmt'!B18","v":"G.2.11"},{"$f":"'G. Communications and Ops Mgmt'!C18","v":"Is Information security's approval required prior to implementation changes?"},{"$f":"'G. Communications and Ops Mgmt'!D18","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E18","v":"Cloudamize Security Policy -Change Management"},{"$f":"'G. Communications and Ops Mgmt'!F18","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!G18","v":"14.2.2.f"},{"$f":"'G. Communications and Ops Mgmt'!H18","v":"System change control procedures"},null,null,"6.4.5.2","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A19","v":832},{"$f":"'G. Communications and Ops Mgmt'!I19","v":2},{"$f":"'G. Communications and Ops Mgmt'!J19","v":1},{"$f":"'G. Communications and Ops Mgmt'!X19","v":0},{"$f":"'G. Communications and Ops Mgmt'!B19","v":"G.2.12"},{"$f":"'G. Communications and Ops Mgmt'!C19","v":"Are the following changes to the production environment subject to the change control process:"},{"$f":"'G. Communications and Ops Mgmt'!D19","v":0},{"$f":"'G. Communications and Ops Mgmt'!E19","v":0},{"$f":"'G. Communications and Ops Mgmt'!F19","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!G19","v":"12.1.2                                      14.2.2"},{"$f":"'G. Communications and Ops Mgmt'!H19","v":"Change Management      System change control procedures"},"AI6.1","Change standards and procedures","N/A","N/A","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A20","v":833},{"$f":"'G. Communications and Ops Mgmt'!I20","v":3},{"$f":"'G. Communications and Ops Mgmt'!J20","v":0},{"$f":"'G. Communications and Ops Mgmt'!X20","v":0},{"$f":"'G. Communications and Ops Mgmt'!B20","v":"G.2.12.1"},{"$f":"'G. Communications and Ops Mgmt'!C20","v":"Network?"},{"$f":"'G. Communications and Ops Mgmt'!D20","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E20","v":"Cloudamize Security Policy -Change Management"},{"$f":"'G. Communications and Ops Mgmt'!F20","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!G20","v":"14.2.2"},{"$f":"'G. Communications and Ops Mgmt'!H20","v":"System change control procedures"},null,null,"N/A","IS.2.B.1.2 IS.2.B.2.1 IS.2.B.10.9","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A21","v":834},{"$f":"'G. Communications and Ops Mgmt'!I21","v":3},{"$f":"'G. Communications and Ops Mgmt'!J21","v":0},{"$f":"'G. Communications and Ops Mgmt'!X21","v":0},{"$f":"'G. Communications and Ops Mgmt'!B21","v":"G.2.12.2"},{"$f":"'G. Communications and Ops Mgmt'!C21","v":"Systems?"},{"$f":"'G. Communications and Ops Mgmt'!D21","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E21","v":"Cloudamize Security Policy -Change Management"},{"$f":"'G. Communications and Ops Mgmt'!F21","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!G21","v":"14.2.2"},{"$f":"'G. Communications and Ops Mgmt'!H21","v":"System change control procedures"},"AI6.1","Change standards and procedures","N/A","N/A","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A22","v":835},{"$f":"'G. Communications and Ops Mgmt'!I22","v":3},{"$f":"'G. Communications and Ops Mgmt'!J22","v":0},{"$f":"'G. Communications and Ops Mgmt'!X22","v":0},{"$f":"'G. Communications and Ops Mgmt'!B22","v":"G.2.12.3"},{"$f":"'G. Communications and Ops Mgmt'!C22","v":"Application updates?"},{"$f":"'G. Communications and Ops Mgmt'!D22","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E22","v":"Cloudamize Security Policy -Change Management"},{"$f":"'G. Communications and Ops Mgmt'!F22","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!G22","v":"14.2.2"},{"$f":"'G. Communications and Ops Mgmt'!H22","v":"System change control procedures"},"AI6.1","Change standards and procedures","N/A","N/A","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A23","v":836},{"$f":"'G. Communications and Ops Mgmt'!I23","v":3},{"$f":"'G. Communications and Ops Mgmt'!J23","v":0},{"$f":"'G. Communications and Ops Mgmt'!X23","v":0},{"$f":"'G. Communications and Ops Mgmt'!B23","v":"G.2.12.4"},{"$f":"'G. Communications and Ops Mgmt'!C23","v":"Code changes?"},{"$f":"'G. Communications and Ops Mgmt'!D23","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E23","v":"Cloudamize Security Policy -Change Management"},{"$f":"'G. Communications and Ops Mgmt'!F23","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!G23","v":"14.2.2"},{"$f":"'G. Communications and Ops Mgmt'!H23","v":"System change control procedures"},"AI6.1","Change standards and procedures","N/A","N/A","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A24","v":838},{"$f":"'G. Communications and Ops Mgmt'!I24","v":2},{"$f":"'G. Communications and Ops Mgmt'!J24","v":0},{"$f":"'G. Communications and Ops Mgmt'!X24","v":0},{"$f":"'G. Communications and Ops Mgmt'!B24","v":"G.2.13"},{"$f":"'G. Communications and Ops Mgmt'!C24","v":"Is there a segregation of duties between those requesting, approving and implementing a change?"},{"$f":"'G. Communications and Ops Mgmt'!D24","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E24","v":"Cloudamize Security Policy -Change Management"},{"$f":"'G. Communications and Ops Mgmt'!F24","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!G24","v":"6.1.2"},{"$f":"'G. Communications and Ops Mgmt'!H24","v":"Segregation Of Duties"},"PO4.11","Segregation of duties","N/A","N/A","PO4.11, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A25","v":853},{"$f":"'G. Communications and Ops Mgmt'!I25","v":1},{"$f":"'G. Communications and Ops Mgmt'!J25","v":0},{"$f":"'G. Communications and Ops Mgmt'!X25","v":1},{"$f":"'G. Communications and Ops Mgmt'!B25","v":"G.3"},{"$f":"'G. Communications and Ops Mgmt'!C25","v":"Do Subcontractors have access to Scoped Systems and Data? (backup vendors, service providers, equipment support maintenance, software maintenance vendors, data recovery vendors, etc.)? If yes, is there:"},{"$f":"'G. Communications and Ops Mgmt'!D25","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E25","v":"Cloudamize Security Policy - Cloudamize Network Security"},{"$f":"'G. Communications and Ops Mgmt'!F25","v":0},{"$f":"'G. Communications and Ops Mgmt'!G25","v":15},{"$f":"'G. Communications and Ops Mgmt'!H25","v":"Supplier relationships"},"DS1.1","Service level management framework",12.8,"IS.1.4.1.11 IS.1.5.1 O.1.3.1.1 O.1.3.3","DS1.1, DS1.2, DS1.3, DS2.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A26","v":3897},{"$f":"'G. Communications and Ops Mgmt'!I26","v":2},{"$f":"'G. Communications and Ops Mgmt'!J26","v":0},{"$f":"'G. Communications and Ops Mgmt'!X26","v":0},{"$f":"'G. Communications and Ops Mgmt'!B26","v":"G.3.1"},{"$f":"'G. Communications and Ops Mgmt'!C26","v":"Is there a documented subcontractor management process in place for the selection and oversight of third party vendors? If yes, does it include:"},{"$f":"'G. Communications and Ops Mgmt'!D26","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E26","v":"Cloudamize Security Policy - Cloudamize Network Security"},{"$f":"'G. Communications and Ops Mgmt'!F26","v":"M.1 Subcontractor Selection and Management Process"},{"$f":"'G. Communications and Ops Mgmt'!G26","v":"15.1.1"},{"$f":"'G. Communications and Ops Mgmt'!H26","v":"Information security policy for supplier relationships"},"DS1.5","Monitoring and reporting of service level achievements","N/A","IS.1.4.1.11 IS.1.5.4 O.1.3.1.2 O.2.D.1","DS1.5, DS2.4, ME2.6"]
[{"$f":"'G. Communications and Ops Mgmt'!A27","v":3898},{"$f":"'G. Communications and Ops Mgmt'!I27","v":3},{"$f":"'G. Communications and Ops Mgmt'!J27","v":0},{"$f":"'G. Communications and Ops Mgmt'!X27","v":0},{"$f":"'G. Communications and Ops Mgmt'!B27","v":"G.3.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C27","v":"Approval by management?"},{"$f":"'G. Communications and Ops Mgmt'!D27","v":0},{"$f":"'G. Communications and Ops Mgmt'!E27","v":0},{"$f":"'G. Communications and Ops Mgmt'!F27","v":"M.1 Subcontractor Selection and Management Process"},{"$f":"'G. Communications and Ops Mgmt'!G27","v":"5.1.1"},{"$f":"'G. Communications and Ops Mgmt'!H27","v":"Policies on information security"},"PO4.14","Contracted staff policies and procedures","12.8.4","IS.1.5.1 IS.1.5.4 O.1.2.1 O.1.3.5 IS.2.J.2","PO4.14, DS2.1, DS2.3, DS5.4, DS5.9, DS5.11, DS12.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A28","v":3899},{"$f":"'G. Communications and Ops Mgmt'!I28","v":3},{"$f":"'G. Communications and Ops Mgmt'!J28","v":0},{"$f":"'G. Communications and Ops Mgmt'!X28","v":0},{"$f":"'G. Communications and Ops Mgmt'!B28","v":"G.3.1.2"},{"$f":"'G. Communications and Ops Mgmt'!C28","v":"Annual review?"},{"$f":"'G. Communications and Ops Mgmt'!D28","v":0},{"$f":"'G. Communications and Ops Mgmt'!E28","v":0},{"$f":"'G. Communications and Ops Mgmt'!F28","v":"M.1 Subcontractor Selection and Management Process"},{"$f":"'G. Communications and Ops Mgmt'!G28","v":"5.1.2"},{"$f":"'G. Communications and Ops Mgmt'!H28","v":"Review of the policies for information security"},"PO4.14","Contracted staff policies and procedures","N/A","IS.1.5.3","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'G. Communications and Ops Mgmt'!A29","v":3900},{"$f":"'G. Communications and Ops Mgmt'!I29","v":3},{"$f":"'G. Communications and Ops Mgmt'!J29","v":0},{"$f":"'G. Communications and Ops Mgmt'!X29","v":0},{"$f":"'G. Communications and Ops Mgmt'!B29","v":"G.3.1.3"},{"$f":"'G. Communications and Ops Mgmt'!C29","v":"Review of the subcontractor's vendor management policy and procedures?"},{"$f":"'G. Communications and Ops Mgmt'!D29","v":0},{"$f":"'G. Communications and Ops Mgmt'!E29","v":0},{"$f":"'G. Communications and Ops Mgmt'!F29","v":"M.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!G29","v":"15.2.1.g"},{"$f":"'G. Communications and Ops Mgmt'!H29","v":"Monitoring and review of supplier services"},"DS1.5","Monitoring and reporting of service level achievements","N/A","N/A","DS1.5, DS2.2, DS2.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A30","v":3901},{"$f":"'G. Communications and Ops Mgmt'!I30","v":2},{"$f":"'G. Communications and Ops Mgmt'!J30","v":0},{"$f":"'G. Communications and Ops Mgmt'!X30","v":0},{"$f":"'G. Communications and Ops Mgmt'!B30","v":"G.3.2"},{"$f":"'G. Communications and Ops Mgmt'!C30","v":"Is there a process to identify and log subcontractor information security, privacy and/or data breach issues?"},{"$f":"'G. Communications and Ops Mgmt'!D30","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E30","v":"Cloudamize Security Policy - Cloudamize Network Security"},{"$f":"'G. Communications and Ops Mgmt'!F30","v":"M.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!G30","v":"15.2.1.e"},{"$f":"'G. Communications and Ops Mgmt'!H30","v":"Monitoring and review of supplier services"},"DS3.1","Performance and capacity planning","N/A","E-BANK.1.4.3.1 RPS.1.1.5.3","DS3.1, DS3.2, DS3.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A31","v":3902},{"$f":"'G. Communications and Ops Mgmt'!I31","v":2},{"$f":"'G. Communications and Ops Mgmt'!J31","v":1},{"$f":"'G. Communications and Ops Mgmt'!X31","v":0},{"$f":"'G. Communications and Ops Mgmt'!B31","v":"G.3.3"},{"$f":"'G. Communications and Ops Mgmt'!C31","v":"Do subcontractor's, as part of their vendor risk management program include the following:"},{"$f":"'G. Communications and Ops Mgmt'!D31","v":0},{"$f":"'G. Communications and Ops Mgmt'!E31","v":0},{"$f":"'G. Communications and Ops Mgmt'!F31","v":0},{"$f":"'G. Communications and Ops Mgmt'!G31","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H31","v":0},"PO3.4","Technology standards","N/A","D&A.1.6.1.9","PO3.4, AI1.1, AI1.4, AI2.4, AI2.8, AI4.4, AI7.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A32","v":3903},{"$f":"'G. Communications and Ops Mgmt'!I32","v":3},{"$f":"'G. Communications and Ops Mgmt'!J32","v":0},{"$f":"'G. Communications and Ops Mgmt'!X32","v":0},{"$f":"'G. Communications and Ops Mgmt'!B32","v":"G.3.3.1"},{"$f":"'G. Communications and Ops Mgmt'!C32","v":"Comprehensive financial analysis?"},{"$f":"'G. Communications and Ops Mgmt'!D32","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E32","v":0},{"$f":"'G. Communications and Ops Mgmt'!F32","v":"M.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!G32","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H32","v":0},"PO3.4","Technology standards","N/A","D&A.1.6.1.9.2 OPS.1.5.1.1 RPS.1.1.5.3","PO3.4, AI1.1, AI1.4, AI2.4, AI2.8, AI4.4, AI7.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A33","v":3904},{"$f":"'G. Communications and Ops Mgmt'!I33","v":3},{"$f":"'G. Communications and Ops Mgmt'!J33","v":0},{"$f":"'G. Communications and Ops Mgmt'!X33","v":0},{"$f":"'G. Communications and Ops Mgmt'!B33","v":"G.3.3.2"},{"$f":"'G. Communications and Ops Mgmt'!C33","v":"Vendor reputational review?"},{"$f":"'G. Communications and Ops Mgmt'!D33","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E33","v":0},{"$f":"'G. Communications and Ops Mgmt'!F33","v":"M.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!G33","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H33","v":0},"PO3.4","Technology standards","N/A","N/A","PO3.4, AI1.1, AI1.4, AI2.4, AI2.8, AI4.4, AI7.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A34","v":3905},{"$f":"'G. Communications and Ops Mgmt'!I34","v":3},{"$f":"'G. Communications and Ops Mgmt'!J34","v":0},{"$f":"'G. Communications and Ops Mgmt'!X34","v":0},{"$f":"'G. Communications and Ops Mgmt'!B34","v":"G.3.3.3"},{"$f":"'G. Communications and Ops Mgmt'!C34","v":"Compliance checks (e.g., Office of Foreign Assets Controls (OFAC), etc.)?"},{"$f":"'G. Communications and Ops Mgmt'!D34","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E34","v":0},{"$f":"'G. Communications and Ops Mgmt'!F34","v":"M.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!G34","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H34","v":0},"PO3.4","Technology standards","N/A","D&A.1.6.1.10.4","PO3.4, AI1.1, AI1.4, AI2.4, AI2.8, AI4.4, AI7.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A35","v":3906},{"$f":"'G. Communications and Ops Mgmt'!I35","v":3},{"$f":"'G. Communications and Ops Mgmt'!J35","v":0},{"$f":"'G. Communications and Ops Mgmt'!X35","v":0},{"$f":"'G. Communications and Ops Mgmt'!B35","v":"G.3.3.4"},{"$f":"'G. Communications and Ops Mgmt'!C35","v":"Defined risk assessment and classification method for vendors?"},{"$f":"'G. Communications and Ops Mgmt'!D35","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E35","v":0},{"$f":"'G. Communications and Ops Mgmt'!F35","v":"M.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!G35","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H35","v":0},"PO3.4","Technology standards","N/A","D&A.1.6.1.9.1","PO3.4, AI1.1, AI1.4, AI2.4, AI2.8, AI4.4, AI7.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A36","v":3907},{"$f":"'G. Communications and Ops Mgmt'!I36","v":3},{"$f":"'G. Communications and Ops Mgmt'!J36","v":0},{"$f":"'G. Communications and Ops Mgmt'!X36","v":0},{"$f":"'G. Communications and Ops Mgmt'!B36","v":"G.3.3.5"},{"$f":"'G. Communications and Ops Mgmt'!C36","v":"Management of subcontractor risk, compliance and performance?"},{"$f":"'G. Communications and Ops Mgmt'!D36","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E36","v":0},{"$f":"'G. Communications and Ops Mgmt'!F36","v":"M.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!G36","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H36","v":0},"PO3.4","Technology standards","N/A","N/A","PO3.4, AI1.1, AI1.4, AI2.4, AI2.8, AI4.4, AI7.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A37","v":3908},{"$f":"'G. Communications and Ops Mgmt'!I37","v":3},{"$f":"'G. Communications and Ops Mgmt'!J37","v":0},{"$f":"'G. Communications and Ops Mgmt'!X37","v":0},{"$f":"'G. Communications and Ops Mgmt'!B37","v":"G.3.3.6"},{"$f":"'G. Communications and Ops Mgmt'!C37","v":"Ability and right to audit controls? "},{"$f":"'G. Communications and Ops Mgmt'!D37","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E37","v":0},{"$f":"'G. Communications and Ops Mgmt'!F37","v":"M.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!G37","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H37","v":0},"PO3.4","Technology standards","N/A","BCP.1.4.3.2","PO3.4, AI1.1, AI1.4, AI2.4, AI2.8, AI4.4, AI7.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A38","v":3909},{"$f":"'G. Communications and Ops Mgmt'!I38","v":3},{"$f":"'G. Communications and Ops Mgmt'!J38","v":0},{"$f":"'G. Communications and Ops Mgmt'!X38","v":0},{"$f":"'G. Communications and Ops Mgmt'!B38","v":"G.3.3.7"},{"$f":"'G. Communications and Ops Mgmt'!C38","v":"Notification of new or change in subcontractors?"},{"$f":"'G. Communications and Ops Mgmt'!D38","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E38","v":0},{"$f":"'G. Communications and Ops Mgmt'!F38","v":"M.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!G38","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H38","v":0},"PO3.4","Technology standards","N/A","N/A","PO3.4, AI1.1, AI1.4, AI2.4, AI2.8, AI4.4, AI7.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A39","v":3910},{"$f":"'G. Communications and Ops Mgmt'!I39","v":3},{"$f":"'G. Communications and Ops Mgmt'!J39","v":0},{"$f":"'G. Communications and Ops Mgmt'!X39","v":0},{"$f":"'G. Communications and Ops Mgmt'!B39","v":"G.3.3.8"},{"$f":"'G. Communications and Ops Mgmt'!C39","v":"Defined procedures for subcontractor management?"},{"$f":"'G. Communications and Ops Mgmt'!D39","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E39","v":0},{"$f":"'G. Communications and Ops Mgmt'!F39","v":"M.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!G39","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H39","v":0},"PO3.4","Technology standards","N/A","N/A","PO3.4, AI1.1, AI1.4, AI2.4, AI2.8, AI4.4, AI7.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A40","v":3911},{"$f":"'G. Communications and Ops Mgmt'!I40","v":3},{"$f":"'G. Communications and Ops Mgmt'!J40","v":0},{"$f":"'G. Communications and Ops Mgmt'!X40","v":0},{"$f":"'G. Communications and Ops Mgmt'!B40","v":"G.3.3.9"},{"$f":"'G. Communications and Ops Mgmt'!C40","v":"Oversight and Governance of program adherence?"},{"$f":"'G. Communications and Ops Mgmt'!D40","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E40","v":0},{"$f":"'G. Communications and Ops Mgmt'!F40","v":"M.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!G40","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H40","v":0},"PO4.11","Segregation of duties",5.0999999999999996,"IS.2.B.1 OPS.1.5.1.5 AUDIT.2.D.1.14","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A41","v":873},{"$f":"'G. Communications and Ops Mgmt'!I41","v":3},{"$f":"'G. Communications and Ops Mgmt'!J41","v":0},{"$f":"'G. Communications and Ops Mgmt'!X41","v":0},{"$f":"'G. Communications and Ops Mgmt'!B41","v":"G.3.3.10"},{"$f":"'G. Communications and Ops Mgmt'!C41","v":"Security review prior to engaging their services (logical, physical, other controls)?"},{"$f":"'G. Communications and Ops Mgmt'!D41","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E41","v":0},{"$f":"'G. Communications and Ops Mgmt'!F41","v":"M.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!G41","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H41","v":0},"DS5.5","Security testing, surveillance and monitoring","5.2.b","IS.2.B.10.10 WPS.1.2.1.1","DS5.5, DS5.7, ME2.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A42","v":874},{"$f":"'G. Communications and Ops Mgmt'!I42","v":3},{"$f":"'G. Communications and Ops Mgmt'!J42","v":0},{"$f":"'G. Communications and Ops Mgmt'!X42","v":0},{"$f":"'G. Communications and Ops Mgmt'!B42","v":"G.3.3.11"},{"$f":"'G. Communications and Ops Mgmt'!C42","v":"Security review at least annually?"},{"$f":"'G. Communications and Ops Mgmt'!D42","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E42","v":0},{"$f":"'G. Communications and Ops Mgmt'!F42","v":"M.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!G42","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H42","v":0},"DS5.10","Network security","N/A","IS.1.4.1.2.2 IS.2.B.9.1 IS.2.B.9.3","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A43","v":875},{"$f":"'G. Communications and Ops Mgmt'!I43","v":3},{"$f":"'G. Communications and Ops Mgmt'!J43","v":0},{"$f":"'G. Communications and Ops Mgmt'!X43","v":0},{"$f":"'G. Communications and Ops Mgmt'!B43","v":"G.3.3.12"},{"$f":"'G. Communications and Ops Mgmt'!C43","v":"Risk assessments or review?"},{"$f":"'G. Communications and Ops Mgmt'!D43","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E43","v":0},{"$f":"'G. Communications and Ops Mgmt'!F43","v":"M.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!G43","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H43","v":0},"DS5.10","Network security","N/A","IS.2.B.2.2 IS.2.B.10.4 IS.2.M.4.3","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A44","v":878},{"$f":"'G. Communications and Ops Mgmt'!I44","v":3},{"$f":"'G. Communications and Ops Mgmt'!J44","v":0},{"$f":"'G. Communications and Ops Mgmt'!X44","v":0},{"$f":"'G. Communications and Ops Mgmt'!B44","v":"G.3.3.13"},{"$f":"'G. Communications and Ops Mgmt'!C44","v":"Confidentiality and/or Non Disclosure Agreement requirements?"},{"$f":"'G. Communications and Ops Mgmt'!D44","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E44","v":0},{"$f":"'G. Communications and Ops Mgmt'!F44","v":"M.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!G44","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H44","v":0},"PO2.1","Enterprise information architecture model","N/A","IS.2.B.10.3","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A45","v":879},{"$f":"'G. Communications and Ops Mgmt'!I45","v":3},{"$f":"'G. Communications and Ops Mgmt'!J45","v":0},{"$f":"'G. Communications and Ops Mgmt'!X45","v":0},{"$f":"'G. Communications and Ops Mgmt'!B45","v":"G.3.3.14"},{"$f":"'G. Communications and Ops Mgmt'!C45","v":"Notification of changes affecting services rendered?"},{"$f":"'G. Communications and Ops Mgmt'!D45","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E45","v":0},{"$f":"'G. Communications and Ops Mgmt'!F45","v":"M.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!G45","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H45","v":0},"DS5.3","Identity management","N/A","IS.2.B.7 IS.2.B.10.2","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A46","v":895},{"$f":"'G. Communications and Ops Mgmt'!I46","v":1},{"$f":"'G. Communications and Ops Mgmt'!J46","v":0},{"$f":"'G. Communications and Ops Mgmt'!X46","v":1},{"$f":"'G. Communications and Ops Mgmt'!B46","v":"G.4"},{"$f":"'G. Communications and Ops Mgmt'!C46","v":"Is there an anti-virus / malware policy or program (workstations, servers, mobile devices) that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"'G. Communications and Ops Mgmt'!D46","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E46","v":"Cloudamize Security Policy - Cloudamize Personnel Acceptable Use Policy"},{"$f":"'G. Communications and Ops Mgmt'!F46","v":"G.7 Virus Protection (Servers), G.8 Virus Protection (Workstations)"},{"$f":"'G. Communications and Ops Mgmt'!G46","v":"12.2.1"},{"$f":"'G. Communications and Ops Mgmt'!H46","v":"Controls Against Malware"},"PO4.11","Segregation of duties","N/A","IS.2.B.9.4 IS.2.M.5","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A47","v":912},{"$f":"'G. Communications and Ops Mgmt'!I47","v":2},{"$f":"'G. Communications and Ops Mgmt'!J47","v":1},{"$f":"'G. Communications and Ops Mgmt'!X47","v":0},{"$f":"'G. Communications and Ops Mgmt'!B47","v":"G.4.1"},{"$f":"'G. Communications and Ops Mgmt'!C47","v":"What is the interval between the availability of a new signature update and its deployment:"},{"$f":"'G. Communications and Ops Mgmt'!D47","v":0},{"$f":"'G. Communications and Ops Mgmt'!E47","v":0},{"$f":"'G. Communications and Ops Mgmt'!F47","v":"G.1 Network Security – IDS/IPS Signature Updates"},{"$f":"'G. Communications and Ops Mgmt'!G47","v":"12.6.1"},{"$f":"'G. Communications and Ops Mgmt'!H47","v":"Management of technical vulnerabilities"},"PO4.11","Segregation of duties","N/A","IS.2.A.7 IS.2.B.12 IS.2.B.17.5","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A48","v":913},{"$f":"'G. Communications and Ops Mgmt'!I48","v":3},{"$f":"'G. Communications and Ops Mgmt'!J48","v":0},{"$f":"'G. Communications and Ops Mgmt'!X48","v":0},{"$f":"'G. Communications and Ops Mgmt'!B48","v":"G.4.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C48","v":"Hourly?"},{"$f":"'G. Communications and Ops Mgmt'!D48","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E48","v":"Cloudamize Security Policy - Cloudamize Personnel Acceptable Use Policy"},{"$f":"'G. Communications and Ops Mgmt'!F48","v":"G.1 Network Security – IDS/IPS Signature Updates"},{"$f":"'G. Communications and Ops Mgmt'!G48","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H48","v":""},"AI2.3","Application control and auditability","9.5.1","N/A","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A49","v":914},{"$f":"'G. Communications and Ops Mgmt'!I49","v":3},{"$f":"'G. Communications and Ops Mgmt'!J49","v":0},{"$f":"'G. Communications and Ops Mgmt'!X49","v":0},{"$f":"'G. Communications and Ops Mgmt'!B49","v":"G.4.1.2"},{"$f":"'G. Communications and Ops Mgmt'!C49","v":"Daily?"},{"$f":"'G. Communications and Ops Mgmt'!D49","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E49","v":"Cloudamize Security Policy - Cloudamize Personnel Acceptable Use Policy"},{"$f":"'G. Communications and Ops Mgmt'!F49","v":"G.1 Network Security – IDS/IPS Signature Updates"},{"$f":"'G. Communications and Ops Mgmt'!G49","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H49","v":""},"DS5.5","Security testing, surveillance and monitoring","N/A","N/A","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A50","v":915},{"$f":"'G. Communications and Ops Mgmt'!I50","v":3},{"$f":"'G. Communications and Ops Mgmt'!J50","v":0},{"$f":"'G. Communications and Ops Mgmt'!X50","v":0},{"$f":"'G. Communications and Ops Mgmt'!B50","v":"G.4.1.3"},{"$f":"'G. Communications and Ops Mgmt'!C50","v":"Weekly?"},{"$f":"'G. Communications and Ops Mgmt'!D50","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E50","v":"Cloudamize Security Policy - Cloudamize Personnel Acceptable Use Policy"},{"$f":"'G. Communications and Ops Mgmt'!F50","v":"G.1 Network Security – IDS/IPS Signature Updates"},{"$f":"'G. Communications and Ops Mgmt'!G50","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H50","v":""},"DS5.5","Security testing, surveillance and monitoring","9.5.1","IS.2.M.1.1 IS.2.M.7","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A51","v":916},{"$f":"'G. Communications and Ops Mgmt'!I51","v":3},{"$f":"'G. Communications and Ops Mgmt'!J51","v":0},{"$f":"'G. Communications and Ops Mgmt'!X51","v":0},{"$f":"'G. Communications and Ops Mgmt'!B51","v":"G.4.1.4"},{"$f":"'G. Communications and Ops Mgmt'!C51","v":"Monthly?"},{"$f":"'G. Communications and Ops Mgmt'!D51","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E51","v":"Cloudamize Security Policy - Cloudamize Personnel Acceptable Use Policy"},{"$f":"'G. Communications and Ops Mgmt'!F51","v":"G.1 Network Security – IDS/IPS Signature Updates"},{"$f":"'G. Communications and Ops Mgmt'!G51","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H51","v":""},"AI3.3","Infrastructure maintenance","9.6.2","IS.2.B.9.5 D&A.1.11.1.2","AI3.3, AI6.2, AI6.3, DS5.5, DS5.7, DS9.2"]
[{"$f":"'G. Communications and Ops Mgmt'!A52","v":922},{"$f":"'G. Communications and Ops Mgmt'!I52","v":1},{"$f":"'G. Communications and Ops Mgmt'!J52","v":0},{"$f":"'G. Communications and Ops Mgmt'!X52","v":1},{"$f":"'G. Communications and Ops Mgmt'!B52","v":"G.5"},{"$f":"'G. Communications and Ops Mgmt'!C52","v":"Are system backups of Scoped Systems and Data performed?"},{"$f":"'G. Communications and Ops Mgmt'!D52","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E52","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F52","v":"G.20 Backup Media Restoration"},{"$f":"'G. Communications and Ops Mgmt'!G52","v":"12.3.1"},{"$f":"'G. Communications and Ops Mgmt'!H52","v":"Information Back-Up"},"AI6.1","Change standards and procedures","9.6.2","IS.2.B.9.6","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A53","v":923},{"$f":"'G. Communications and Ops Mgmt'!I53","v":2},{"$f":"'G. Communications and Ops Mgmt'!J53","v":0},{"$f":"'G. Communications and Ops Mgmt'!X53","v":0},{"$f":"'G. Communications and Ops Mgmt'!B53","v":"G.5.1"},{"$f":"'G. Communications and Ops Mgmt'!C53","v":"Is there a policy or process for the backup of production data? If yes, does it include a requirement to:"},{"$f":"'G. Communications and Ops Mgmt'!D53","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E53","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F53","v":"G.20 Backup Media Restoration"},{"$f":"'G. Communications and Ops Mgmt'!G53","v":"12.3.1"},{"$f":"'G. Communications and Ops Mgmt'!H53","v":"Information Back-Up"},"DS5.7","Protection of security technology","9.6.2","N/A","DS5.7, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A54","v":2601},{"$f":"'G. Communications and Ops Mgmt'!I54","v":3},{"$f":"'G. Communications and Ops Mgmt'!J54","v":0},{"$f":"'G. Communications and Ops Mgmt'!X54","v":0},{"$f":"'G. Communications and Ops Mgmt'!B54","v":"G.5.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C54","v":"Store backups to avoid any damage from a disaster at the main site?"},{"$f":"'G. Communications and Ops Mgmt'!D54","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E54","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F54","v":"G.20 Backup Media Restoration"},{"$f":"'G. Communications and Ops Mgmt'!G54","v":"12.3.1.c"},{"$f":"'G. Communications and Ops Mgmt'!H54","v":"Information Back-Up"},"DS5.10","Network security","1.1.4, 1.2, 1.2.3","IS.2.B.2.3","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A55","v":2602},{"$f":"'G. Communications and Ops Mgmt'!I55","v":3},{"$f":"'G. Communications and Ops Mgmt'!J55","v":0},{"$f":"'G. Communications and Ops Mgmt'!X55","v":0},{"$f":"'G. Communications and Ops Mgmt'!B55","v":"G.5.1.2"},{"$f":"'G. Communications and Ops Mgmt'!C55","v":"Test backup media and restoration procedures at least annually?"},{"$f":"'G. Communications and Ops Mgmt'!D55","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E55","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F55","v":"G.20 Backup Media Restoration"},{"$f":"'G. Communications and Ops Mgmt'!G55","v":"12.3.1.e"},{"$f":"'G. Communications and Ops Mgmt'!H55","v":"Information Back-Up"},"DS5.7","Protection of security technology","1.2.3","AUDIT.2.D.1.17","DS5.7, DS5.9, DS5.11, DS9.2"]
[{"$f":"'G. Communications and Ops Mgmt'!A56","v":951},{"$f":"'G. Communications and Ops Mgmt'!I56","v":2},{"$f":"'G. Communications and Ops Mgmt'!J56","v":0},{"$f":"'G. Communications and Ops Mgmt'!X56","v":0},{"$f":"'G. Communications and Ops Mgmt'!B56","v":"G.5.2"},{"$f":"'G. Communications and Ops Mgmt'!C56","v":"Is backup media stored offsite? If yes, is there:"},{"$f":"'G. Communications and Ops Mgmt'!D56","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E56","v":0},{"$f":"'G. Communications and Ops Mgmt'!F56","v":"G.20 Backup Media Restoration"},{"$f":"'G. Communications and Ops Mgmt'!G56","v":"12.3.1.c"},{"$f":"'G. Communications and Ops Mgmt'!H56","v":"Information Back-Up"},"DS5.10","Network security",1.2,"IS.1.4.1.2.2","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A57","v":953},{"$f":"'G. Communications and Ops Mgmt'!I57","v":3},{"$f":"'G. Communications and Ops Mgmt'!J57","v":0},{"$f":"'G. Communications and Ops Mgmt'!X57","v":0},{"$f":"'G. Communications and Ops Mgmt'!B57","v":"G.5.2.1"},{"$f":"'G. Communications and Ops Mgmt'!C57","v":"Secure transport?"},{"$f":"'G. Communications and Ops Mgmt'!D57","v":0},{"$f":"'G. Communications and Ops Mgmt'!E57","v":0},{"$f":"'G. Communications and Ops Mgmt'!F57","v":"G.20 Backup Media Restoration"},{"$f":"'G. Communications and Ops Mgmt'!G57","v":"8.3.3"},{"$f":"'G. Communications and Ops Mgmt'!H57","v":"Physical media transfer"},"DS5.3","Identity management","N/A","N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A58","v":954},{"$f":"'G. Communications and Ops Mgmt'!I58","v":3},{"$f":"'G. Communications and Ops Mgmt'!J58","v":0},{"$f":"'G. Communications and Ops Mgmt'!X58","v":0},{"$f":"'G. Communications and Ops Mgmt'!B58","v":"G.5.2.2"},{"$f":"'G. Communications and Ops Mgmt'!C58","v":"Tracking shipments?"},{"$f":"'G. Communications and Ops Mgmt'!D58","v":0},{"$f":"'G. Communications and Ops Mgmt'!E58","v":0},{"$f":"'G. Communications and Ops Mgmt'!F58","v":"G.20 Backup Media Restoration"},{"$f":"'G. Communications and Ops Mgmt'!G58","v":"8.3.3.e"},{"$f":"'G. Communications and Ops Mgmt'!H58","v":"Exchange Agreements"},"DS5.3","Identity management","1.1.7","N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A59","v":955},{"$f":"'G. Communications and Ops Mgmt'!I59","v":3},{"$f":"'G. Communications and Ops Mgmt'!J59","v":0},{"$f":"'G. Communications and Ops Mgmt'!X59","v":0},{"$f":"'G. Communications and Ops Mgmt'!B59","v":"G.5.2.3"},{"$f":"'G. Communications and Ops Mgmt'!C59","v":"Verification of receipt?"},{"$f":"'G. Communications and Ops Mgmt'!D59","v":0},{"$f":"'G. Communications and Ops Mgmt'!E59","v":0},{"$f":"'G. Communications and Ops Mgmt'!F59","v":"G.20 Backup Media Restoration"},{"$f":"'G. Communications and Ops Mgmt'!G59","v":"8.3.3.e"},{"$f":"'G. Communications and Ops Mgmt'!H59","v":"Exchange Agreements"},"DS5.7","Protection of security technology",6.1,"IS.2.B.4","DS5.7, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A60","v":3688},{"$f":"'G. Communications and Ops Mgmt'!I60","v":1},{"$f":"'G. Communications and Ops Mgmt'!J60","v":0},{"$f":"'G. Communications and Ops Mgmt'!X60","v":1},{"$f":"'G. Communications and Ops Mgmt'!B60","v":"G.6"},{"$f":"'G. Communications and Ops Mgmt'!C60","v":"Are firewalls in use for both internal and external connections?"},{"$f":"'G. Communications and Ops Mgmt'!D60","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E60","v":"Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'G. Communications and Ops Mgmt'!F60","v":"G.2 Network Security – Firewall(s)"},{"$f":"'G. Communications and Ops Mgmt'!G60","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!H60","v":"Segregation in networks"},"PO6.2","Enterprise IT risk and internal control framework",6.1,"N/A","PO6.2, DS5.2, DS5.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A61","v":976},{"$f":"'G. Communications and Ops Mgmt'!I61","v":2},{"$f":"'G. Communications and Ops Mgmt'!J61","v":0},{"$f":"'G. Communications and Ops Mgmt'!X61","v":0},{"$f":"'G. Communications and Ops Mgmt'!B61","v":"G.6.1"},{"$f":"'G. Communications and Ops Mgmt'!C61","v":"Is every connection to an external network terminated at a firewall?"},{"$f":"'G. Communications and Ops Mgmt'!D61","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E61","v":0},{"$f":"'G. Communications and Ops Mgmt'!F61","v":"G.2 Network Security – Firewall(s)"},{"$f":"'G. Communications and Ops Mgmt'!G61","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!H61","v":"Segregation In Networks"},null,null,"N/A","AUDIT.2.D.1.14, E-BANK.1.4.1.3","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A62","v":3689},{"$f":"'G. Communications and Ops Mgmt'!I62","v":2},{"$f":"'G. Communications and Ops Mgmt'!J62","v":0},{"$f":"'G. Communications and Ops Mgmt'!X62","v":0},{"$f":"'G. Communications and Ops Mgmt'!B62","v":"G.6.2"},{"$f":"'G. Communications and Ops Mgmt'!C62","v":"Are firewalls used to segment internal networks?"},{"$f":"'G. Communications and Ops Mgmt'!D62","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E62","v":0},{"$f":"'G. Communications and Ops Mgmt'!F62","v":"G.2 Network Security – Firewall(s)"},{"$f":"'G. Communications and Ops Mgmt'!G62","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!H62","v":"Segregation In Networks"},null,null,6.1,"IS.2.B.5","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A63","v":3693},{"$f":"'G. Communications and Ops Mgmt'!I63","v":2},{"$f":"'G. Communications and Ops Mgmt'!J63","v":0},{"$f":"'G. Communications and Ops Mgmt'!X63","v":0},{"$f":"'G. Communications and Ops Mgmt'!B63","v":"G.6.3"},{"$f":"'G. Communications and Ops Mgmt'!C63","v":"Do the firewalls have any rules that permit 'any' network, sub network, host, protocol or port on any of the firewalls (internal or external)?"},{"$f":"'G. Communications and Ops Mgmt'!D63","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E63","v":0},{"$f":"'G. Communications and Ops Mgmt'!F63","v":"G.2 Network Security – Firewall(s)"},{"$f":"'G. Communications and Ops Mgmt'!G63","v":"9.1.1.f"},{"$f":"'G. Communications and Ops Mgmt'!H63","v":"Access control policy"},null,null,6.1,"N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A64","v":3705},{"$f":"'G. Communications and Ops Mgmt'!I64","v":2},{"$f":"'G. Communications and Ops Mgmt'!J64","v":0},{"$f":"'G. Communications and Ops Mgmt'!X64","v":0},{"$f":"'G. Communications and Ops Mgmt'!B64","v":"G.6.4"},{"$f":"'G. Communications and Ops Mgmt'!C64","v":"Are all firewall rules reviewed and updated at least quarterly to identify and remove any networks, sub networks, hosts, protocols or ports no longer in use?"},{"$f":"'G. Communications and Ops Mgmt'!D64","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E64","v":"Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'G. Communications and Ops Mgmt'!F64","v":"G.2 Network Security – Firewall(s)"},{"$f":"'G. Communications and Ops Mgmt'!G64","v":"18.2.2"},{"$f":"'G. Communications and Ops Mgmt'!H64","v":"Compliance with security policies and standards"},"DS5.10","Network security",10.3,"N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A65","v":3706},{"$f":"'G. Communications and Ops Mgmt'!I65","v":1},{"$f":"'G. Communications and Ops Mgmt'!J65","v":0},{"$f":"'G. Communications and Ops Mgmt'!X65","v":1},{"$f":"'G. Communications and Ops Mgmt'!B65","v":"G.7"},{"$f":"'G. Communications and Ops Mgmt'!C65","v":"Are vulnerability assessments, scans or penetration tests on internal or external networks performed at least annually? If yes, are they:"},{"$f":"'G. Communications and Ops Mgmt'!D65","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E65","v":"Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'G. Communications and Ops Mgmt'!F65","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!G65","v":"12.6.1"},{"$f":"'G. Communications and Ops Mgmt'!H65","v":"Control of technical vulnerabilities"},"DS5.10","Network security",11.3,"N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A66","v":3710},{"$f":"'G. Communications and Ops Mgmt'!I66","v":2},{"$f":"'G. Communications and Ops Mgmt'!J66","v":0},{"$f":"'G. Communications and Ops Mgmt'!X66","v":0},{"$f":"'G. Communications and Ops Mgmt'!B66","v":"G.7.1"},{"$f":"'G. Communications and Ops Mgmt'!C66","v":"Performed by trained and experienced personnel?"},{"$f":"'G. Communications and Ops Mgmt'!D66","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E66","v":"Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'G. Communications and Ops Mgmt'!F66","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!G66","v":"18.2.3"},{"$f":"'G. Communications and Ops Mgmt'!H66","v":"Technical compliance review"},"DS5.10","Network security",6.1,"N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A67","v":3912},{"$f":"'G. Communications and Ops Mgmt'!I67","v":2},{"$f":"'G. Communications and Ops Mgmt'!J67","v":1},{"$f":"'G. Communications and Ops Mgmt'!X67","v":0},{"$f":"'G. Communications and Ops Mgmt'!B67","v":"G.7.2"},{"$f":"'G. Communications and Ops Mgmt'!C67","v":"For Internal Networks:"},{"$f":"'G. Communications and Ops Mgmt'!D67","v":0},{"$f":"'G. Communications and Ops Mgmt'!E67","v":0},{"$f":"'G. Communications and Ops Mgmt'!F67","v":0},{"$f":"'G. Communications and Ops Mgmt'!G67","v":0},{"$f":"'G. Communications and Ops Mgmt'!H67","v":0},"DS5.10","Network security",10.3,"N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A68","v":3711},{"$f":"'G. Communications and Ops Mgmt'!I68","v":3},{"$f":"'G. Communications and Ops Mgmt'!J68","v":0},{"$f":"'G. Communications and Ops Mgmt'!X68","v":0},{"$f":"'G. Communications and Ops Mgmt'!B68","v":"G.7.2.1"},{"$f":"'G. Communications and Ops Mgmt'!C68","v":"Are vulnerability assessments or scans performed? If yes, are issues:"},{"$f":"'G. Communications and Ops Mgmt'!D68","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E68","v":"Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'G. Communications and Ops Mgmt'!F68","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!G68","v":"12.6.1"},{"$f":"'G. Communications and Ops Mgmt'!H68","v":"Control of technical vulnerabilities"},null,null,null,"N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A69","v":3913},{"$f":"'G. Communications and Ops Mgmt'!I69","v":4},{"$f":"'G. Communications and Ops Mgmt'!J69","v":0},{"$f":"'G. Communications and Ops Mgmt'!X69","v":0},{"$f":"'G. Communications and Ops Mgmt'!B69","v":"G.7.2.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C69","v":"Risk ranked for importance to the system and the vulnerability identified?"},{"$f":"'G. Communications and Ops Mgmt'!D69","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E69","v":"Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'G. Communications and Ops Mgmt'!F69","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!G69","v":"12.6.1.d"},{"$f":"'G. Communications and Ops Mgmt'!H69","v":"Control of technical vulnerabilities"},"DS5.7","Protection of security technology",6.1,"IS.1.4.1.2.2 IS.1.4.1.7 IS.1.7.7 IS.2.M.9.1 E-BANK.1.4.2.7","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A70","v":3716},{"$f":"'G. Communications and Ops Mgmt'!I70","v":4},{"$f":"'G. Communications and Ops Mgmt'!J70","v":0},{"$f":"'G. Communications and Ops Mgmt'!X70","v":0},{"$f":"'G. Communications and Ops Mgmt'!B70","v":"G.7.2.1.2"},{"$f":"'G. Communications and Ops Mgmt'!C70","v":"Documented and tracked to remediation?"},{"$f":"'G. Communications and Ops Mgmt'!D70","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E70","v":"Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'G. Communications and Ops Mgmt'!F70","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!G70","v":"12.6.1.h"},{"$f":"'G. Communications and Ops Mgmt'!H70","v":"Control of technical vulnerabilities"},"DS5.9","Malicious software prevention, detection and correction",6.1,"N/A","DS 5.5, ME1.2, ME2.2, ME2.5, ME4.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A71","v":3721},{"$f":"'G. Communications and Ops Mgmt'!I71","v":3},{"$f":"'G. Communications and Ops Mgmt'!J71","v":0},{"$f":"'G. Communications and Ops Mgmt'!X71","v":0},{"$f":"'G. Communications and Ops Mgmt'!B71","v":"G.7.2.2"},{"$f":"'G. Communications and Ops Mgmt'!C71","v":"Are penetration tests performed? If yes, are issues:"},{"$f":"'G. Communications and Ops Mgmt'!D71","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E71","v":"Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'G. Communications and Ops Mgmt'!F71","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!G71","v":"12.6.1"},{"$f":"'G. Communications and Ops Mgmt'!H71","v":"Control of technical vulnerabilities"},"PO4.11","Segregation of duties",10.3,"N/A","DS5.9"]
[{"$f":"'G. Communications and Ops Mgmt'!A72","v":3914},{"$f":"'G. Communications and Ops Mgmt'!I72","v":4},{"$f":"'G. Communications and Ops Mgmt'!J72","v":0},{"$f":"'G. Communications and Ops Mgmt'!X72","v":0},{"$f":"'G. Communications and Ops Mgmt'!B72","v":"G.7.2.2.1"},{"$f":"'G. Communications and Ops Mgmt'!C72","v":"Risk ranked for importance to the system and the vulnerability identified?"},{"$f":"'G. Communications and Ops Mgmt'!D72","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E72","v":"Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'G. Communications and Ops Mgmt'!F72","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!G72","v":"12.6.1.d"},{"$f":"'G. Communications and Ops Mgmt'!H72","v":"Control of technical vulnerabilities"},"DS5.5","Security testing, surveillance and monitoring",11.3,"E-BANK.1.4.3.6","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A73","v":3725},{"$f":"'G. Communications and Ops Mgmt'!I73","v":4},{"$f":"'G. Communications and Ops Mgmt'!J73","v":0},{"$f":"'G. Communications and Ops Mgmt'!X73","v":0},{"$f":"'G. Communications and Ops Mgmt'!B73","v":"G.7.2.2.2"},{"$f":"'G. Communications and Ops Mgmt'!C73","v":"Documented and tracked to remediation?"},{"$f":"'G. Communications and Ops Mgmt'!D73","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E73","v":"Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'G. Communications and Ops Mgmt'!F73","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!G73","v":"12.6.1.h"},{"$f":"'G. Communications and Ops Mgmt'!H73","v":"Control of technical vulnerabilities"},"DS5.7","Protection of security technology",6.1,"N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A74","v":3915},{"$f":"'G. Communications and Ops Mgmt'!I74","v":2},{"$f":"'G. Communications and Ops Mgmt'!J74","v":1},{"$f":"'G. Communications and Ops Mgmt'!X74","v":0},{"$f":"'G. Communications and Ops Mgmt'!B74","v":"G.7.3"},{"$f":"'G. Communications and Ops Mgmt'!C74","v":"For External Networks:"},{"$f":"'G. Communications and Ops Mgmt'!D74","v":0},{"$f":"'G. Communications and Ops Mgmt'!E74","v":0},{"$f":"'G. Communications and Ops Mgmt'!F74","v":0},{"$f":"'G. Communications and Ops Mgmt'!G74","v":0},{"$f":"'G. Communications and Ops Mgmt'!H74","v":0},"DS5.10","Network security",10.3,"IS.2.B.17.4","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A75","v":3717},{"$f":"'G. Communications and Ops Mgmt'!I75","v":3},{"$f":"'G. Communications and Ops Mgmt'!J75","v":0},{"$f":"'G. Communications and Ops Mgmt'!X75","v":0},{"$f":"'G. Communications and Ops Mgmt'!B75","v":"G.7.3.1"},{"$f":"'G. Communications and Ops Mgmt'!C75","v":"Are vulnerability assessments or scans performed? If yes, are issues:"},{"$f":"'G. Communications and Ops Mgmt'!D75","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E75","v":"Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'G. Communications and Ops Mgmt'!F75","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!G75","v":"12.6.1"},{"$f":"'G. Communications and Ops Mgmt'!H75","v":"Control of technical vulnerabilities"},"DS5.10","Network security","N/A","N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A76","v":3916},{"$f":"'G. Communications and Ops Mgmt'!I76","v":4},{"$f":"'G. Communications and Ops Mgmt'!J76","v":0},{"$f":"'G. Communications and Ops Mgmt'!X76","v":0},{"$f":"'G. Communications and Ops Mgmt'!B76","v":"G.7.3.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C76","v":"Risk ranked for importance to the system and the vulnerability identified?"},{"$f":"'G. Communications and Ops Mgmt'!D76","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E76","v":"Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'G. Communications and Ops Mgmt'!F76","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!G76","v":"12.6.1.d"},{"$f":"'G. Communications and Ops Mgmt'!H76","v":"Control of technical vulnerabilities"},"PO2.3","Data classification scheme",7,"N/A","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A77","v":3720},{"$f":"'G. Communications and Ops Mgmt'!I77","v":4},{"$f":"'G. Communications and Ops Mgmt'!J77","v":0},{"$f":"'G. Communications and Ops Mgmt'!X77","v":0},{"$f":"'G. Communications and Ops Mgmt'!B77","v":"G.7.3.1.2"},{"$f":"'G. Communications and Ops Mgmt'!C77","v":"Documented and tracked to remediation?"},{"$f":"'G. Communications and Ops Mgmt'!D77","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E77","v":"Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'G. Communications and Ops Mgmt'!F77","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!G77","v":"12.6.1.h"},{"$f":"'G. Communications and Ops Mgmt'!H77","v":"Control of technical vulnerabilities"},"PO3.1","Technological direction planning","N/A","N/A","PO2.3, PO6.2, DS11.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A78","v":3726},{"$f":"'G. Communications and Ops Mgmt'!I78","v":3},{"$f":"'G. Communications and Ops Mgmt'!J78","v":0},{"$f":"'G. Communications and Ops Mgmt'!X78","v":0},{"$f":"'G. Communications and Ops Mgmt'!B78","v":"G.7.3.2"},{"$f":"'G. Communications and Ops Mgmt'!C78","v":"Are penetration tests performed on external networks? If yes, are issues:"},{"$f":"'G. Communications and Ops Mgmt'!D78","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E78","v":"Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'G. Communications and Ops Mgmt'!F78","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!G78","v":"12.6.1"},{"$f":"'G. Communications and Ops Mgmt'!H78","v":"Control of technical vulnerabilities"},"DS5.10","Network security",1.3,"N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A79","v":3917},{"$f":"'G. Communications and Ops Mgmt'!I79","v":4},{"$f":"'G. Communications and Ops Mgmt'!J79","v":0},{"$f":"'G. Communications and Ops Mgmt'!X79","v":0},{"$f":"'G. Communications and Ops Mgmt'!B79","v":"G.7.3.2.1"},{"$f":"'G. Communications and Ops Mgmt'!C79","v":"Risk ranked for importance to the system and the vulnerability identified?"},{"$f":"'G. Communications and Ops Mgmt'!D79","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E79","v":"Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'G. Communications and Ops Mgmt'!F79","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!G79","v":"12.6.1.d"},{"$f":"'G. Communications and Ops Mgmt'!H79","v":"Control of technical vulnerabilities"},"DS5.10","Network security","1.2.1","IS.2.A.13","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A80","v":3728},{"$f":"'G. Communications and Ops Mgmt'!I80","v":4},{"$f":"'G. Communications and Ops Mgmt'!J80","v":0},{"$f":"'G. Communications and Ops Mgmt'!X80","v":0},{"$f":"'G. Communications and Ops Mgmt'!B80","v":"G.7.3.2.2"},{"$f":"'G. Communications and Ops Mgmt'!C80","v":"Documented and tracked to remediation?"},{"$f":"'G. Communications and Ops Mgmt'!D80","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E80","v":"Cloudamize Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"'G. Communications and Ops Mgmt'!F80","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!G80","v":"12.6.1.h"},{"$f":"'G. Communications and Ops Mgmt'!H80","v":"Control of technical vulnerabilities"},null,null,7,"N/A","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A81","v":975},{"$f":"'G. Communications and Ops Mgmt'!I81","v":1},{"$f":"'G. Communications and Ops Mgmt'!J81","v":0},{"$f":"'G. Communications and Ops Mgmt'!X81","v":1},{"$f":"'G. Communications and Ops Mgmt'!B81","v":"G.8"},{"$f":"'G. Communications and Ops Mgmt'!C81","v":"Are there external network connections (Internet, extranet, etc.)? If yes, is there:"},{"$f":"'G. Communications and Ops Mgmt'!D81","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E81","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F81","v":0},{"$f":"'G. Communications and Ops Mgmt'!G81","v":"13.1.1"},{"$f":"'G. Communications and Ops Mgmt'!H81","v":"Network Controls"},null,null,"10.5.4","N/A","DS5.7, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A82","v":998},{"$f":"'G. Communications and Ops Mgmt'!I82","v":2},{"$f":"'G. Communications and Ops Mgmt'!J82","v":0},{"$f":"'G. Communications and Ops Mgmt'!X82","v":0},{"$f":"'G. Communications and Ops Mgmt'!B82","v":"G.8.1"},{"$f":"'G. Communications and Ops Mgmt'!C82","v":"Security and hardening standards for network devices (baseline configuration, patching, passwords, access control)?"},{"$f":"'G. Communications and Ops Mgmt'!D82","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E82","v":"Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards"},{"$f":"'G. Communications and Ops Mgmt'!F82","v":0},{"$f":"'G. Communications and Ops Mgmt'!G82","v":"13.1.1.c"},{"$f":"'G. Communications and Ops Mgmt'!H82","v":"Network Controls"},null,null,"10.2.4","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A83","v":1008},{"$f":"'G. Communications and Ops Mgmt'!I83","v":3},{"$f":"'G. Communications and Ops Mgmt'!J83","v":0},{"$f":"'G. Communications and Ops Mgmt'!X83","v":0},{"$f":"'G. Communications and Ops Mgmt'!B83","v":"G.8.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C83","v":"Regular review and/or monitoring of network devices for continued compliance to security requirements?"},{"$f":"'G. Communications and Ops Mgmt'!D83","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E83","v":"Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards"},{"$f":"'G. Communications and Ops Mgmt'!F83","v":0},{"$f":"'G. Communications and Ops Mgmt'!G83","v":"13.1.1.d                                  18.2.3"},{"$f":"'G. Communications and Ops Mgmt'!H83","v":"Network controls,                   Technical compliance review"},"PO3.1","Technological direction planning","10.2.6","IS.1.4.1.10 IS.2.E.2 IS.2.L.2.1 IS.2.L.2.1","PO2.3, DS11.2, DS11.3, DS11.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A84","v":977},{"$f":"'G. Communications and Ops Mgmt'!I84","v":2},{"$f":"'G. Communications and Ops Mgmt'!J84","v":0},{"$f":"'G. Communications and Ops Mgmt'!X84","v":0},{"$f":"'G. Communications and Ops Mgmt'!B84","v":"G.8.2"},{"$f":"'G. Communications and Ops Mgmt'!C84","v":"Are network devices configured to prevent communications from unapproved networks?"},{"$f":"'G. Communications and Ops Mgmt'!D84","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E84","v":"Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards"},{"$f":"'G. Communications and Ops Mgmt'!F84","v":"G.2 Network Security – Firewall(s)"},{"$f":"'G. Communications and Ops Mgmt'!G84","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!H84","v":"Segregation In Networks"},"PO2.3","Data classification scheme","10.5.5","IS.2.J.8 RPS.2.C.2.8","PO2.3, PO6.2, DS11.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A85","v":979},{"$f":"'G. Communications and Ops Mgmt'!I85","v":2},{"$f":"'G. Communications and Ops Mgmt'!J85","v":0},{"$f":"'G. Communications and Ops Mgmt'!X85","v":0},{"$f":"'G. Communications and Ops Mgmt'!B85","v":"G.8.3"},{"$f":"'G. Communications and Ops Mgmt'!C85","v":"Do network devices deny all access by default?"},{"$f":"'G. Communications and Ops Mgmt'!D85","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E85","v":"Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards"},{"$f":"'G. Communications and Ops Mgmt'!F85","v":0},{"$f":"'G. Communications and Ops Mgmt'!G85","v":"9.1.1"},{"$f":"'G. Communications and Ops Mgmt'!H85","v":"Access Control Policy"},"DS11.3","Media library management system","10.4.1","N/A","PO6, AI2, DS5"]
[{"$f":"'G. Communications and Ops Mgmt'!A86","v":980},{"$f":"'G. Communications and Ops Mgmt'!I86","v":2},{"$f":"'G. Communications and Ops Mgmt'!J86","v":0},{"$f":"'G. Communications and Ops Mgmt'!X86","v":0},{"$f":"'G. Communications and Ops Mgmt'!B86","v":"G.8.4"},{"$f":"'G. Communications and Ops Mgmt'!C86","v":"A process to request, approve, log, and review access to networks across network devices?"},{"$f":"'G. Communications and Ops Mgmt'!D86","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E86","v":"Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards"},{"$f":"'G. Communications and Ops Mgmt'!F86","v":0},{"$f":"'G. Communications and Ops Mgmt'!G86","v":"9.1.1.h"},{"$f":"'G. Communications and Ops Mgmt'!H86","v":"Policy On Use Of Network Services"},"DS11.3","Media library management system","N/A","OPS.1.9.3 OPS.2.12.H.2","DS11.3, DS11.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A87","v":981},{"$f":"'G. Communications and Ops Mgmt'!I87","v":2},{"$f":"'G. Communications and Ops Mgmt'!J87","v":0},{"$f":"'G. Communications and Ops Mgmt'!X87","v":0},{"$f":"'G. Communications and Ops Mgmt'!B87","v":"G.8.5"},{"$f":"'G. Communications and Ops Mgmt'!C87","v":"Network traffic logged to support forensics? If yes, do logs contain:"},{"$f":"'G. Communications and Ops Mgmt'!D87","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E87","v":"Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards"},{"$f":"'G. Communications and Ops Mgmt'!F87","v":"G.6 Network Logging"},{"$f":"'G. Communications and Ops Mgmt'!G87","v":"13.1.1.d"},{"$f":"'G. Communications and Ops Mgmt'!H87","v":"Network Controls"},"DS11.4","Disposal","10.5.5","N/A","DS11.3, DS11.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A88","v":3865},{"$f":"'G. Communications and Ops Mgmt'!I88","v":3},{"$f":"'G. Communications and Ops Mgmt'!J88","v":0},{"$f":"'G. Communications and Ops Mgmt'!X88","v":0},{"$f":"'G. Communications and Ops Mgmt'!B88","v":"G.8.5.1"},{"$f":"'G. Communications and Ops Mgmt'!C88","v":"Failed login attempts?"},{"$f":"'G. Communications and Ops Mgmt'!D88","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E88","v":0},{"$f":"'G. Communications and Ops Mgmt'!F88","v":"G.6 Network Logging"},{"$f":"'G. Communications and Ops Mgmt'!G88","v":"13.1.1.d"},{"$f":"'G. Communications and Ops Mgmt'!H88","v":"Network Controls"},"DS11.3","Media library management system","10.5.2","N/A","DS11.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A89","v":3866},{"$f":"'G. Communications and Ops Mgmt'!I89","v":3},{"$f":"'G. Communications and Ops Mgmt'!J89","v":0},{"$f":"'G. Communications and Ops Mgmt'!X89","v":0},{"$f":"'G. Communications and Ops Mgmt'!B89","v":"G.8.5.2"},{"$f":"'G. Communications and Ops Mgmt'!C89","v":"Disabling of audit logs?"},{"$f":"'G. Communications and Ops Mgmt'!D89","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E89","v":0},{"$f":"'G. Communications and Ops Mgmt'!F89","v":"G.6 Network Logging"},{"$f":"'G. Communications and Ops Mgmt'!G89","v":"13.1.1.d"},{"$f":"'G. Communications and Ops Mgmt'!H89","v":"Network Controls"},null,null,"N/A","IS.1.4.1.10","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A90","v":3869},{"$f":"'G. Communications and Ops Mgmt'!I90","v":3},{"$f":"'G. Communications and Ops Mgmt'!J90","v":0},{"$f":"'G. Communications and Ops Mgmt'!X90","v":0},{"$f":"'G. Communications and Ops Mgmt'!B90","v":"G.8.5.3"},{"$f":"'G. Communications and Ops Mgmt'!C90","v":"Changes?"},{"$f":"'G. Communications and Ops Mgmt'!D90","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E90","v":"Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards"},{"$f":"'G. Communications and Ops Mgmt'!F90","v":"G.6 Network Logging"},{"$f":"'G. Communications and Ops Mgmt'!G90","v":"13.1.1.d"},{"$f":"'G. Communications and Ops Mgmt'!H90","v":"Network Controls"},"DS5.11","Exchange of sensitive data",6.2,"N/A","DS11.6"]
[{"$f":"'G. Communications and Ops Mgmt'!A91","v":3870},{"$f":"'G. Communications and Ops Mgmt'!I91","v":3},{"$f":"'G. Communications and Ops Mgmt'!J91","v":0},{"$f":"'G. Communications and Ops Mgmt'!X91","v":0},{"$f":"'G. Communications and Ops Mgmt'!B91","v":"G.8.5.4"},{"$f":"'G. Communications and Ops Mgmt'!C91","v":"Timestamps?"},{"$f":"'G. Communications and Ops Mgmt'!D91","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E91","v":"Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards"},{"$f":"'G. Communications and Ops Mgmt'!F91","v":"G.6 Network Logging"},{"$f":"'G. Communications and Ops Mgmt'!G91","v":"13.1.1.d"},{"$f":"'G. Communications and Ops Mgmt'!H91","v":"Network Controls"},null,null,6.4,"IS.2.B.15 IS.2.J.8 E-BANK.1.5.2.2 RPS.1.3.2.1 RPS.2.C.4","PO2.3, PO6.2, DS11.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A92","v":3871},{"$f":"'G. Communications and Ops Mgmt'!I92","v":3},{"$f":"'G. Communications and Ops Mgmt'!J92","v":0},{"$f":"'G. Communications and Ops Mgmt'!X92","v":0},{"$f":"'G. Communications and Ops Mgmt'!B92","v":"G.8.5.5"},{"$f":"'G. Communications and Ops Mgmt'!C92","v":"IP info"},{"$f":"'G. Communications and Ops Mgmt'!D92","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E92","v":"Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards"},{"$f":"'G. Communications and Ops Mgmt'!F92","v":"G.6 Network Logging"},{"$f":"'G. Communications and Ops Mgmt'!G92","v":"13.1.1.d"},{"$f":"'G. Communications and Ops Mgmt'!H92","v":"Network Controls"},"PO2.3","Data classification scheme","1.1.1","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A93","v":3294},{"$f":"'G. Communications and Ops Mgmt'!I93","v":3},{"$f":"'G. Communications and Ops Mgmt'!J93","v":0},{"$f":"'G. Communications and Ops Mgmt'!X93","v":0},{"$f":"'G. Communications and Ops Mgmt'!B93","v":"G.8.5.6"},{"$f":"'G. Communications and Ops Mgmt'!C93","v":"In the event of a network device audit log failure, does the network device generate an alert and prevent further connections?"},{"$f":"'G. Communications and Ops Mgmt'!D93","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E93","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F93","v":0},{"$f":"'G. Communications and Ops Mgmt'!G93","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!H93","v":"Event logging"},"PO2.3","Data classification scheme","1.3.7","IS.2.B.19 E-BANK.1.4.2.6","PO2.3, PO6.2, DS11.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A94","v":1093},{"$f":"'G. Communications and Ops Mgmt'!I94","v":3},{"$f":"'G. Communications and Ops Mgmt'!J94","v":0},{"$f":"'G. Communications and Ops Mgmt'!X94","v":0},{"$f":"'G. Communications and Ops Mgmt'!B94","v":"G.8.5.7"},{"$f":"'G. Communications and Ops Mgmt'!C94","v":"Is the overwriting of audit logs disabled?"},{"$f":"'G. Communications and Ops Mgmt'!D94","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E94","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F94","v":0},{"$f":"'G. Communications and Ops Mgmt'!G94","v":"12.4.2.b"},{"$f":"'G. Communications and Ops Mgmt'!H94","v":"Protection Of Log Information"},"PO2.3","Data classification scheme",9.1,"IS.2.L.1.3","PO2.3, PO6.2, DS11.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A95","v":993},{"$f":"'G. Communications and Ops Mgmt'!I95","v":3},{"$f":"'G. Communications and Ops Mgmt'!J95","v":0},{"$f":"'G. Communications and Ops Mgmt'!X95","v":0},{"$f":"'G. Communications and Ops Mgmt'!B95","v":"G.8.5.8"},{"$f":"'G. Communications and Ops Mgmt'!C95","v":"Are the logs from network devices aggregated to a central server?"},{"$f":"'G. Communications and Ops Mgmt'!D95","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E95","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F95","v":0},{"$f":"'G. Communications and Ops Mgmt'!G95","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!H95","v":"Protection Of Log Information"},null,null,"N/A","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A96","v":994},{"$f":"'G. Communications and Ops Mgmt'!I96","v":2},{"$f":"'G. Communications and Ops Mgmt'!J96","v":0},{"$f":"'G. Communications and Ops Mgmt'!X96","v":0},{"$f":"'G. Communications and Ops Mgmt'!B96","v":"G.8.6"},{"$f":"'G. Communications and Ops Mgmt'!C96","v":"Are security patches reviewed and applied to network devices?"},{"$f":"'G. Communications and Ops Mgmt'!D96","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E96","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F96","v":0},{"$f":"'G. Communications and Ops Mgmt'!G96","v":"12.6.1.g"},{"$f":"'G. Communications and Ops Mgmt'!H96","v":"Management of technical vulnerabilities"},"PO2.3","Data classification scheme",1.3,"RPS.2.E.1.4 RPS.2.L.4","DS11.6"]
[{"$f":"'G. Communications and Ops Mgmt'!A97","v":995},{"$f":"'G. Communications and Ops Mgmt'!I97","v":2},{"$f":"'G. Communications and Ops Mgmt'!J97","v":0},{"$f":"'G. Communications and Ops Mgmt'!X97","v":0},{"$f":"'G. Communications and Ops Mgmt'!B97","v":"G.8.7"},{"$f":"'G. Communications and Ops Mgmt'!C97","v":"Is there an approval process prior to installing a network device?"},{"$f":"'G. Communications and Ops Mgmt'!D97","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E97","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F97","v":0},{"$f":"'G. Communications and Ops Mgmt'!G97","v":"12.1.2.d"},{"$f":"'G. Communications and Ops Mgmt'!H97","v":"Change Management"},null,null,"1.1.6","RPS.2.E.1.4 RPS.2.L.4","DS11.6"]
[{"$f":"'G. Communications and Ops Mgmt'!A98","v":997},{"$f":"'G. Communications and Ops Mgmt'!I98","v":2},{"$f":"'G. Communications and Ops Mgmt'!J98","v":0},{"$f":"'G. Communications and Ops Mgmt'!X98","v":0},{"$f":"'G. Communications and Ops Mgmt'!B98","v":"G.8.8"},{"$f":"'G. Communications and Ops Mgmt'!C98","v":"Is there an approval process for the ports allowed through the network devices?"},{"$f":"'G. Communications and Ops Mgmt'!D98","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E98","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F98","v":"G.19 Network Security – Authorized Network Traffic"},{"$f":"'G. Communications and Ops Mgmt'!G98","v":"13.1.2.c"},{"$f":"'G. Communications and Ops Mgmt'!H98","v":"Security Of Network Services"},"PO2.3","Data classification scheme",7.1,"N/A","PO2.3, PO3.4, AI5.2, DS2.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A99","v":1010},{"$f":"'G. Communications and Ops Mgmt'!I99","v":2},{"$f":"'G. Communications and Ops Mgmt'!J99","v":0},{"$f":"'G. Communications and Ops Mgmt'!X99","v":0},{"$f":"'G. Communications and Ops Mgmt'!B99","v":"G.8.9"},{"$f":"'G. Communications and Ops Mgmt'!C99","v":"Are critical network segments isolated?"},{"$f":"'G. Communications and Ops Mgmt'!D99","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E99","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F99","v":"G.2 Network Security – Firewall(s)"},{"$f":"'G. Communications and Ops Mgmt'!G99","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!H99","v":"Segregation In Networks"},"PO2.3","Data classification scheme","N/A","N/A","PO2.3, PO6.2, DS11.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A100","v":1011},{"$f":"'G. Communications and Ops Mgmt'!I100","v":2},{"$f":"'G. Communications and Ops Mgmt'!J100","v":0},{"$f":"'G. Communications and Ops Mgmt'!X100","v":0},{"$f":"'G. Communications and Ops Mgmt'!B100","v":"G.8.10"},{"$f":"'G. Communications and Ops Mgmt'!C100","v":"Is there a process to prevent unauthorized devices from physically connecting to the internal network?"},{"$f":"'G. Communications and Ops Mgmt'!D100","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E100","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F100","v":0},{"$f":"'G. Communications and Ops Mgmt'!G100","v":"13.1.2"},{"$f":"'G. Communications and Ops Mgmt'!H100","v":"Security Of Network Services"},"DS5.9","Malicious software prevention, detection and correction","1.1.7","N/A","PO2.3, PO6.2, DS11.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A101","v":1014},{"$f":"'G. Communications and Ops Mgmt'!I101","v":2},{"$f":"'G. Communications and Ops Mgmt'!J101","v":0},{"$f":"'G. Communications and Ops Mgmt'!X101","v":0},{"$f":"'G. Communications and Ops Mgmt'!B101","v":"G.8.11"},{"$f":"'G. Communications and Ops Mgmt'!C101","v":"Are internal systems required to pass through a content filtering proxy prior to accessing the Internet?"},{"$f":"'G. Communications and Ops Mgmt'!D101","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E101","v":0},{"$f":"'G. Communications and Ops Mgmt'!F101","v":0},{"$f":"'G. Communications and Ops Mgmt'!G101","v":"13.1.2"},{"$f":"'G. Communications and Ops Mgmt'!H101","v":"Security Of Network Services"},null,null,"N/A","N/A","DS5.9"]
[{"$f":"'G. Communications and Ops Mgmt'!A102","v":1015},{"$f":"'G. Communications and Ops Mgmt'!I102","v":2},{"$f":"'G. Communications and Ops Mgmt'!J102","v":0},{"$f":"'G. Communications and Ops Mgmt'!X102","v":0},{"$f":"'G. Communications and Ops Mgmt'!B102","v":"G.8.12"},{"$f":"'G. Communications and Ops Mgmt'!C102","v":"Is there an approval process to allow extranet connections?"},{"$f":"'G. Communications and Ops Mgmt'!D102","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E102","v":0},{"$f":"'G. Communications and Ops Mgmt'!F102","v":0},{"$f":"'G. Communications and Ops Mgmt'!G102","v":"9.1.2.b"},{"$f":"'G. Communications and Ops Mgmt'!H102","v":"Access to networks and network services"},"DS5.7","Protection of security technology","N/A","IS.2.B.12","DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A103","v":1016},{"$f":"'G. Communications and Ops Mgmt'!I103","v":2},{"$f":"'G. Communications and Ops Mgmt'!J103","v":0},{"$f":"'G. Communications and Ops Mgmt'!X103","v":0},{"$f":"'G. Communications and Ops Mgmt'!B103","v":"G.8.13"},{"$f":"'G. Communications and Ops Mgmt'!C103","v":"Are insecure protocols (telnet) used to access network devices?"},{"$f":"'G. Communications and Ops Mgmt'!D103","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E103","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F103","v":"G.4 Network Management – Encrypted Authentication Credentials"},{"$f":"'G. Communications and Ops Mgmt'!G103","v":"9.1.2.d"},{"$f":"'G. Communications and Ops Mgmt'!H103","v":"Access to networks and network services"},"DS5.5","Security testing, surveillance and monitoring","N/A","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A104","v":2612},{"$f":"'G. Communications and Ops Mgmt'!I104","v":2},{"$f":"'G. Communications and Ops Mgmt'!J104","v":0},{"$f":"'G. Communications and Ops Mgmt'!X104","v":0},{"$f":"'G. Communications and Ops Mgmt'!B104","v":"G.8.14"},{"$f":"'G. Communications and Ops Mgmt'!C104","v":"Is access to diagnostic or maintenance ports on network devices restricted?"},{"$f":"'G. Communications and Ops Mgmt'!D104","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E104","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F104","v":"G.5 Externally Facing Open Administrative Ports"},{"$f":"'G. Communications and Ops Mgmt'!G104","v":"9.1.2.a"},{"$f":"'G. Communications and Ops Mgmt'!H104","v":"Access to networks and network services"},"PO4.8","Responsibility for risk, security and compliance",11.4,"IS.1.4.1.3.1 IS.2.C.1 OPS.1.5.1.5 E-BANK.1.4.2.5","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A105","v":1065},{"$f":"'G. Communications and Ops Mgmt'!I105","v":2},{"$f":"'G. Communications and Ops Mgmt'!J105","v":0},{"$f":"'G. Communications and Ops Mgmt'!X105","v":0},{"$f":"'G. Communications and Ops Mgmt'!B105","v":"G.8.15"},{"$f":"'G. Communications and Ops Mgmt'!C105","v":"Is there a separate network segment or endpoints for remote access?"},{"$f":"'G. Communications and Ops Mgmt'!D105","v":"N/A"},{"$f":"'G. Communications and Ops Mgmt'!E105","v":0},{"$f":"'G. Communications and Ops Mgmt'!F105","v":0},{"$f":"'G. Communications and Ops Mgmt'!G105","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!H105","v":"Segregation in networks"},"AI4.4","Knowledge transfer to operations and support staff",11.5,"IS.2.C.4","DS5.5, DS5.7, ME2.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A106","v":2947},{"$f":"'G. Communications and Ops Mgmt'!I106","v":2},{"$f":"'G. Communications and Ops Mgmt'!J106","v":0},{"$f":"'G. Communications and Ops Mgmt'!X106","v":0},{"$f":"'G. Communications and Ops Mgmt'!B106","v":"G.8.16"},{"$f":"'G. Communications and Ops Mgmt'!C106","v":"Are firewall rules and network access control lists regularly reviewed?"},{"$f":"'G. Communications and Ops Mgmt'!D106","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E106","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F106","v":0},{"$f":"'G. Communications and Ops Mgmt'!G106","v":"18.2.3"},{"$f":"'G. Communications and Ops Mgmt'!H106","v":"Technical Compliance review"},"PO6.2","Enterprise IT risk and internal control framework",6.2,"N/A","DS5.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A107","v":2614},{"$f":"'G. Communications and Ops Mgmt'!I107","v":2},{"$f":"'G. Communications and Ops Mgmt'!J107","v":0},{"$f":"'G. Communications and Ops Mgmt'!X107","v":0},{"$f":"'G. Communications and Ops Mgmt'!B107","v":"G.8.17"},{"$f":"'G. Communications and Ops Mgmt'!C107","v":"Is there a DMZ environment within the network that transmits, processes or stores Scoped Systems and Data? If yes, is it:"},{"$f":"'G. Communications and Ops Mgmt'!D107","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E107","v":0},{"$f":"'G. Communications and Ops Mgmt'!F107","v":0},{"$f":"'G. Communications and Ops Mgmt'!G107","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H107","v":""},"AI6.3","Emergency changes","12.5.5, 12.10.3","IS.2.C.5","PO6.2, DS5.2, DS5.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A108","v":1049},{"$f":"'G. Communications and Ops Mgmt'!I108","v":3},{"$f":"'G. Communications and Ops Mgmt'!J108","v":0},{"$f":"'G. Communications and Ops Mgmt'!X108","v":0},{"$f":"'G. Communications and Ops Mgmt'!B108","v":"G.8.17.1"},{"$f":"'G. Communications and Ops Mgmt'!C108","v":"Limited to only those servers that require access from the Internet?"},{"$f":"'G. Communications and Ops Mgmt'!D108","v":0},{"$f":"'G. Communications and Ops Mgmt'!E108","v":0},{"$f":"'G. Communications and Ops Mgmt'!F108","v":0},{"$f":"'G. Communications and Ops Mgmt'!G108","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!H108","v":"Segregation In Networks"},"AI6.3","Emergency changes","12.5.3","IS.2.C.5","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A109","v":1056},{"$f":"'G. Communications and Ops Mgmt'!I109","v":3},{"$f":"'G. Communications and Ops Mgmt'!J109","v":0},{"$f":"'G. Communications and Ops Mgmt'!X109","v":0},{"$f":"'G. Communications and Ops Mgmt'!B109","v":"G.8.17.2"},{"$f":"'G. Communications and Ops Mgmt'!C109","v":"Separated with DMZ segments for devices that initiate outbound traffic to the Internet?"},{"$f":"'G. Communications and Ops Mgmt'!D109","v":0},{"$f":"'G. Communications and Ops Mgmt'!E109","v":0},{"$f":"'G. Communications and Ops Mgmt'!F109","v":0},{"$f":"'G. Communications and Ops Mgmt'!G109","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!H109","v":"Segregation In Networks"},"DS5.5","Security testing, surveillance and monitoring","7.1.4","N/A","AI6.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A110","v":1068},{"$f":"'G. Communications and Ops Mgmt'!I110","v":2},{"$f":"'G. Communications and Ops Mgmt'!J110","v":0},{"$f":"'G. Communications and Ops Mgmt'!X110","v":0},{"$f":"'G. Communications and Ops Mgmt'!B110","v":"G.8.18"},{"$f":"'G. Communications and Ops Mgmt'!C110","v":"Is Intrusion Detection/Prevention System employed in all network zones? If yes, does it include:"},{"$f":"'G. Communications and Ops Mgmt'!D110","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E110","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F110","v":"G.3 Network Security – IDS/IPS Attributes"},{"$f":"'G. Communications and Ops Mgmt'!G110","v":"13.1.2"},{"$f":"'G. Communications and Ops Mgmt'!H110","v":"Security Of Network Services"},"DS5.5","Security testing, surveillance and monitoring","N/A","IS.2.C.2","AI6.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A111","v":1075},{"$f":"'G. Communications and Ops Mgmt'!I111","v":3},{"$f":"'G. Communications and Ops Mgmt'!J111","v":0},{"$f":"'G. Communications and Ops Mgmt'!X111","v":0},{"$f":"'G. Communications and Ops Mgmt'!B111","v":"G.8.18.1"},{"$f":"'G. Communications and Ops Mgmt'!C111","v":"Configuration to generate alerts when incidents and values exceed predetermined thresholds?"},{"$f":"'G. Communications and Ops Mgmt'!D111","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E111","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F111","v":0},{"$f":"'G. Communications and Ops Mgmt'!G111","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!H111","v":"Event logging"},"AI2.3","Application control and auditability","N/A","IS.1.4.1.3.5 OPS.2.12.B AUDIT.2.D.1.7 E-BANK.1.4.3.5","DS 5.5, ME1.2, ME2.2, ME2.5, ME4.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A112","v":1076},{"$f":"'G. Communications and Ops Mgmt'!I112","v":3},{"$f":"'G. Communications and Ops Mgmt'!J112","v":0},{"$f":"'G. Communications and Ops Mgmt'!X112","v":0},{"$f":"'G. Communications and Ops Mgmt'!B112","v":"G.8.18.2"},{"$f":"'G. Communications and Ops Mgmt'!C112","v":"Regularly updated signatures based on new threats?"},{"$f":"'G. Communications and Ops Mgmt'!D112","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E112","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F112","v":"G.3 Network Security – IDS/IPS Signature Updates"},{"$f":"'G. Communications and Ops Mgmt'!G112","v":"13.6.1"},{"$f":"'G. Communications and Ops Mgmt'!H112","v":"Management of technical vulnerabilities"},"AI2.3","Application control and auditability","N/A","IS.2.A.7 IS.2.C.9 IS.2.M.9.2","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A113","v":1077},{"$f":"'G. Communications and Ops Mgmt'!I113","v":3},{"$f":"'G. Communications and Ops Mgmt'!J113","v":0},{"$f":"'G. Communications and Ops Mgmt'!X113","v":0},{"$f":"'G. Communications and Ops Mgmt'!B113","v":"G.8.18.3"},{"$f":"'G. Communications and Ops Mgmt'!C113","v":"System monitoring 24x7x365?"},{"$f":"'G. Communications and Ops Mgmt'!D113","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E113","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F113","v":0},{"$f":"'G. Communications and Ops Mgmt'!G113","v":"13.1.1.d"},{"$f":"'G. Communications and Ops Mgmt'!H113","v":"Network Controls"},null,null,"N/A","IS.2.C.9 OPS.2.12.B","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A114","v":1080},{"$f":"'G. Communications and Ops Mgmt'!I114","v":3},{"$f":"'G. Communications and Ops Mgmt'!J114","v":0},{"$f":"'G. Communications and Ops Mgmt'!X114","v":0},{"$f":"'G. Communications and Ops Mgmt'!B114","v":"G.8.18.4"},{"$f":"'G. Communications and Ops Mgmt'!C114","v":"Event feeds into the Incident Management process?"},{"$f":"'G. Communications and Ops Mgmt'!D114","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E114","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F114","v":0},{"$f":"'G. Communications and Ops Mgmt'!G114","v":"12.2.1.i"},{"$f":"'G. Communications and Ops Mgmt'!H114","v":"Controls against malware"},null,null,"N/A","N/A","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A115","v":1121},{"$f":"'G. Communications and Ops Mgmt'!I115","v":2},{"$f":"'G. Communications and Ops Mgmt'!J115","v":0},{"$f":"'G. Communications and Ops Mgmt'!X115","v":0},{"$f":"'G. Communications and Ops Mgmt'!B115","v":"G.8.19"},{"$f":"'G. Communications and Ops Mgmt'!C115","v":"Is approval required prior to connecting any outbound or inbound modem lines, cable modem lines, DSL phone lines or wireless access points to a desktop or other access point directly connected to the company-managed network?"},{"$f":"'G. Communications and Ops Mgmt'!D115","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E115","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F115","v":0},{"$f":"'G. Communications and Ops Mgmt'!G115","v":"9.1.2.b"},{"$f":"'G. Communications and Ops Mgmt'!H115","v":"Access to networks and network services"},null,null,"N/A","N/A","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A116","v":1095},{"$f":"'G. Communications and Ops Mgmt'!I116","v":1},{"$f":"'G. Communications and Ops Mgmt'!J116","v":0},{"$f":"'G. Communications and Ops Mgmt'!X116","v":1},{"$f":"'G. Communications and Ops Mgmt'!B116","v":"G.9"},{"$f":"'G. Communications and Ops Mgmt'!C116","v":"Is wireless networking technology used? Is yes, is there:"},{"$f":"'G. Communications and Ops Mgmt'!D116","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E116","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Local Office"},{"$f":"'G. Communications and Ops Mgmt'!F116","v":"G.17 Unapproved Wireless Networks"},{"$f":"'G. Communications and Ops Mgmt'!G116","v":"13.1.1.c"},{"$f":"'G. Communications and Ops Mgmt'!H116","v":"Network Controls"},null,null,"N/A","IS.2.M.6","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A117","v":1096},{"$f":"'G. Communications and Ops Mgmt'!I117","v":2},{"$f":"'G. Communications and Ops Mgmt'!J117","v":0},{"$f":"'G. Communications and Ops Mgmt'!X117","v":0},{"$f":"'G. Communications and Ops Mgmt'!B117","v":"G.9.1"},{"$f":"'G. Communications and Ops Mgmt'!C117","v":"Approved and fully implemented wireless networking policy?"},{"$f":"'G. Communications and Ops Mgmt'!D117","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E117","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Local Office"},{"$f":"'G. Communications and Ops Mgmt'!F117","v":"G.17 Unapproved Wireless Networks"},{"$f":"'G. Communications and Ops Mgmt'!G117","v":"13.1.1.a"},{"$f":"'G. Communications and Ops Mgmt'!H117","v":"Network Controls"},null,null,6.6,"N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A118","v":1107},{"$f":"'G. Communications and Ops Mgmt'!I118","v":2},{"$f":"'G. Communications and Ops Mgmt'!J118","v":0},{"$f":"'G. Communications and Ops Mgmt'!X118","v":0},{"$f":"'G. Communications and Ops Mgmt'!B118","v":"G.9.2"},{"$f":"'G. Communications and Ops Mgmt'!C118","v":"Two active network connections allowed at the same time (split-tunneling)?"},{"$f":"'G. Communications and Ops Mgmt'!D118","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E118","v":0},{"$f":"'G. Communications and Ops Mgmt'!F118","v":"G.17 Unapproved Wireless Networks"},{"$f":"'G. Communications and Ops Mgmt'!G118","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H118","v":""},null,null,"N/A","IS.2.A.4.4","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A119","v":1108},{"$f":"'G. Communications and Ops Mgmt'!I119","v":2},{"$f":"'G. Communications and Ops Mgmt'!J119","v":0},{"$f":"'G. Communications and Ops Mgmt'!X119","v":0},{"$f":"'G. Communications and Ops Mgmt'!B119","v":"G.9.3"},{"$f":"'G. Communications and Ops Mgmt'!C119","v":"Wireless connections authenticated using multi-factor authentication?"},{"$f":"'G. Communications and Ops Mgmt'!D119","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E119","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Local Office"},{"$f":"'G. Communications and Ops Mgmt'!F119","v":"G.17 Unapproved Wireless Networks"},{"$f":"'G. Communications and Ops Mgmt'!G119","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!H119","v":"Segregation In Networks"},null,null,"8.2.1","IS.2.A.4.3 AUDIT.2.D.1.5 E-BANK.1.4.5.4 RPS.2.C.3","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A120","v":1111},{"$f":"'G. Communications and Ops Mgmt'!I120","v":2},{"$f":"'G. Communications and Ops Mgmt'!J120","v":0},{"$f":"'G. Communications and Ops Mgmt'!X120","v":0},{"$f":"'G. Communications and Ops Mgmt'!B120","v":"G.9.4"},{"$f":"'G. Communications and Ops Mgmt'!C120","v":"Encrypted using strong encryption (WPA2 or higher)?"},{"$f":"'G. Communications and Ops Mgmt'!D120","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E120","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Local Office"},{"$f":"'G. Communications and Ops Mgmt'!F120","v":"G.18 Wireless Networks Encryption "},{"$f":"'G. Communications and Ops Mgmt'!G120","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!H120","v":"Segregation In Networks"},"DS5.3","Identity management",9.8000000000000007,"N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A121","v":1117},{"$f":"'G. Communications and Ops Mgmt'!I121","v":2},{"$f":"'G. Communications and Ops Mgmt'!J121","v":0},{"$f":"'G. Communications and Ops Mgmt'!X121","v":0},{"$f":"'G. Communications and Ops Mgmt'!B121","v":"G.9.5"},{"$f":"'G. Communications and Ops Mgmt'!C121","v":"Wireless access points SNMP community strings changed?"},{"$f":"'G. Communications and Ops Mgmt'!D121","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E121","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Local Office"},{"$f":"'G. Communications and Ops Mgmt'!F121","v":0},{"$f":"'G. Communications and Ops Mgmt'!G121","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H121","v":0},"DS5.3","Identity management","9.7.1","IS.2.A.5.1","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A122","v":1118},{"$f":"'G. Communications and Ops Mgmt'!I122","v":2},{"$f":"'G. Communications and Ops Mgmt'!J122","v":0},{"$f":"'G. Communications and Ops Mgmt'!X122","v":0},{"$f":"'G. Communications and Ops Mgmt'!B122","v":"G.9.6"},{"$f":"'G. Communications and Ops Mgmt'!C122","v":"Quarterly scans for rogue wireless access points?"},{"$f":"'G. Communications and Ops Mgmt'!D122","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E122","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Local Office"},{"$f":"'G. Communications and Ops Mgmt'!F122","v":0},{"$f":"'G. Communications and Ops Mgmt'!G122","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H122","v":""},"DS5.3","Identity management","9.8.2","IS.2.A.5 IS.2.A.5.2 AUDIT.2.D.1.5 E-BANK.1.4.5.11 RPS.2.C.3","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A123","v":3295},{"$f":"'G. Communications and Ops Mgmt'!I123","v":1},{"$f":"'G. Communications and Ops Mgmt'!J123","v":0},{"$f":"'G. Communications and Ops Mgmt'!X123","v":1},{"$f":"'G. Communications and Ops Mgmt'!B123","v":"G.10"},{"$f":"'G. Communications and Ops Mgmt'!C123","v":"Is there a removable media policy or program (CDs, DVDs, tapes, disk drives) that has been approved by management, communicated to appropriate constituents, and an owner to maintain and review the policy? If yes, is:"},{"$f":"'G. Communications and Ops Mgmt'!D123","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E123","v":"Cloudamize Security Policy - Cloudamize Removable Media Policy"},{"$f":"'G. Communications and Ops Mgmt'!F123","v":"G.15 Physical Media Tracking"},{"$f":"'G. Communications and Ops Mgmt'!G123","v":"8.3.1"},{"$f":"'G. Communications and Ops Mgmt'!H123","v":"Management Of Removable Media"},"DS5.3","Identity management","9.7.1","N/A","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A124","v":1872},{"$f":"'G. Communications and Ops Mgmt'!I124","v":2},{"$f":"'G. Communications and Ops Mgmt'!J124","v":0},{"$f":"'G. Communications and Ops Mgmt'!X124","v":0},{"$f":"'G. Communications and Ops Mgmt'!B124","v":"G.10.1"},{"$f":"'G. Communications and Ops Mgmt'!C124","v":"Data encrypted while stored?"},{"$f":"'G. Communications and Ops Mgmt'!D124","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E124","v":"Cloudamize Security Policy - Cloudamize Removable Media Policy"},{"$f":"'G. Communications and Ops Mgmt'!F124","v":"G. 22 Data Security Policy - Encryption"},{"$f":"'G. Communications and Ops Mgmt'!G124","v":"10.1.1.c"},{"$f":"'G. Communications and Ops Mgmt'!H124","v":"Policy On The Use Of Cryptographic Controls"},null,null,"4.1, 9.6","E-BANK.1.4.6.1","DS5.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A125","v":1137},{"$f":"'G. Communications and Ops Mgmt'!I125","v":2},{"$f":"'G. Communications and Ops Mgmt'!J125","v":0},{"$f":"'G. Communications and Ops Mgmt'!X125","v":0},{"$f":"'G. Communications and Ops Mgmt'!B125","v":"G.10.2"},{"$f":"'G. Communications and Ops Mgmt'!C125","v":"Sensitive data encrypted?"},{"$f":"'G. Communications and Ops Mgmt'!D125","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E125","v":"Cloudamize Security Policy - Cloudamize Removable Media Policy"},{"$f":"'G. Communications and Ops Mgmt'!F125","v":"G. 22 Data Security Policy - Encryption"},{"$f":"'G. Communications and Ops Mgmt'!G125","v":"8.3.1.d                                    10.1.1.Section2a "},{"$f":"'G. Communications and Ops Mgmt'!H125","v":"Management of removable media,                                         Policy On The Use Of Cryptographic Controls"},null,null,4.0999999999999996,"E-BANK.1.4.5.3","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A126","v":1138},{"$f":"'G. Communications and Ops Mgmt'!I126","v":2},{"$f":"'G. Communications and Ops Mgmt'!J126","v":0},{"$f":"'G. Communications and Ops Mgmt'!X126","v":0},{"$f":"'G. Communications and Ops Mgmt'!B126","v":"G.10.3"},{"$f":"'G. Communications and Ops Mgmt'!C126","v":"Is all media containing Scoped Systems and Data disposed of securely to prevent recovery? If yes, is it:"},{"$f":"'G. Communications and Ops Mgmt'!D126","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E126","v":"Cloudamize Security Policy - Cloudamize Removable Media Policy"},{"$f":"'G. Communications and Ops Mgmt'!F126","v":"D.2 Asset Destruction"},{"$f":"'G. Communications and Ops Mgmt'!G126","v":"8.3.2"},{"$f":"'G. Communications and Ops Mgmt'!H126","v":"Disposal Of Media"},"DS5.5","Security testing, surveillance and monitoring",4.3,"N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A127","v":1153},{"$f":"'G. Communications and Ops Mgmt'!I127","v":3},{"$f":"'G. Communications and Ops Mgmt'!J127","v":0},{"$f":"'G. Communications and Ops Mgmt'!X127","v":0},{"$f":"'G. Communications and Ops Mgmt'!B127","v":"G.10.3.1"},{"$f":"'G. Communications and Ops Mgmt'!C127","v":"Logged to maintain an audit trail?"},{"$f":"'G. Communications and Ops Mgmt'!D127","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E127","v":"Cloudamize Security Policy - Cloudamize Removable Media Policy"},{"$f":"'G. Communications and Ops Mgmt'!F127","v":"D.2 Asset Destruction"},{"$f":"'G. Communications and Ops Mgmt'!G127","v":"8.3.2.e"},{"$f":"'G. Communications and Ops Mgmt'!H127","v":"Disposal Of Media"},"PO4.8","Responsibility for risk, security and compliance","5.1.2","IS.1.4.1.3.1 IS.2.C.1 OPS.1.5.1.5 E-BANK.1.4.2.5","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A128","v":2624},{"$f":"'G. Communications and Ops Mgmt'!I128","v":3},{"$f":"'G. Communications and Ops Mgmt'!J128","v":0},{"$f":"'G. Communications and Ops Mgmt'!X128","v":0},{"$f":"'G. Communications and Ops Mgmt'!B128","v":"G.10.3.2"},{"$f":"'G. Communications and Ops Mgmt'!C128","v":"Made unrecoverable (wiped or overwritten) prior to asset reuse?"},{"$f":"'G. Communications and Ops Mgmt'!D128","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E128","v":"Cloudamize Security Policy - Cloudamize Removable Media Policy"},{"$f":"'G. Communications and Ops Mgmt'!F128","v":0},{"$f":"'G. Communications and Ops Mgmt'!G128","v":"8.3.1.a                                     11.2.7 "},{"$f":"'G. Communications and Ops Mgmt'!H128","v":"Disposal of media,                   Secure disposal or re-use of equipment"},"AI4.4","Knowledge transfer to operations and support staff","N/A","IS.2.C.4","DS5.5, DS5.7, ME2.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A129","v":2950},{"$f":"'G. Communications and Ops Mgmt'!I129","v":3},{"$f":"'G. Communications and Ops Mgmt'!J129","v":0},{"$f":"'G. Communications and Ops Mgmt'!X129","v":0},{"$f":"'G. Communications and Ops Mgmt'!B129","v":"G.10.3.3"},{"$f":"'G. Communications and Ops Mgmt'!C129","v":"Inventoried at least quarterly?"},{"$f":"'G. Communications and Ops Mgmt'!D129","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E129","v":"Cloudamize Security Policy - Cloudamize Removable Media Policy"},{"$f":"'G. Communications and Ops Mgmt'!F129","v":"D.1 Asset Accounting and Inventory"},{"$f":"'G. Communications and Ops Mgmt'!G129","v":"8.1.1 Inventory of assets"},{"$f":"'G. Communications and Ops Mgmt'!H129","v":0},null,null,"N/A","IS.2.C.3","AI3.3, AI6.2, AI6.3, DS5.5, DS5.7, DS9.2"]
[{"$f":"'G. Communications and Ops Mgmt'!A130","v":1208},{"$f":"'G. Communications and Ops Mgmt'!I130","v":1},{"$f":"'G. Communications and Ops Mgmt'!J130","v":0},{"$f":"'G. Communications and Ops Mgmt'!X130","v":1},{"$f":"'G. Communications and Ops Mgmt'!B130","v":"G.11"},{"$f":"'G. Communications and Ops Mgmt'!C130","v":"Is Scoped Data sent or received electronically or via physical media? If yes, is there:"},{"$f":"'G. Communications and Ops Mgmt'!D130","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E130","v":"Cloudamize Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F130","v":"G.4 Network Management – Encrypted Authentication Credentials"},{"$f":"'G. Communications and Ops Mgmt'!G130","v":"8.3.3"},{"$f":"'G. Communications and Ops Mgmt'!H130","v":"Physical media in transit"},"DS5.5","Security testing, surveillance and monitoring","N/A","IS.2.C.2","AI6.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A131","v":1871},{"$f":"'G. Communications and Ops Mgmt'!I131","v":2},{"$f":"'G. Communications and Ops Mgmt'!J131","v":0},{"$f":"'G. Communications and Ops Mgmt'!X131","v":0},{"$f":"'G. Communications and Ops Mgmt'!B131","v":"G.11.1"},{"$f":"'G. Communications and Ops Mgmt'!C131","v":"Encryption in transit while outside the network?"},{"$f":"'G. Communications and Ops Mgmt'!D131","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E131","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F131","v":"G.4 Network Management – Encrypted Authentication Credentials"},{"$f":"'G. Communications and Ops Mgmt'!G131","v":"13.2.1.f"},{"$f":"'G. Communications and Ops Mgmt'!H131","v":"Information transfer policies and procedures"},"AI2.3","Application control and auditability","N/A","IS.1.4.1.3.5 OPS.2.12.B AUDIT.2.D.1.7 E-BANK.1.4.3.5","DS 5.5, ME1.2, ME2.2, ME2.5, ME4.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A132","v":1193},{"$f":"'G. Communications and Ops Mgmt'!I132","v":2},{"$f":"'G. Communications and Ops Mgmt'!J132","v":0},{"$f":"'G. Communications and Ops Mgmt'!X132","v":0},{"$f":"'G. Communications and Ops Mgmt'!B132","v":"G.11.2"},{"$f":"'G. Communications and Ops Mgmt'!C132","v":"Encryption in transit within the network?"},{"$f":"'G. Communications and Ops Mgmt'!D132","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E132","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F132","v":"G.4 Network Management – Encrypted Authentication Credentials"},{"$f":"'G. Communications and Ops Mgmt'!G132","v":"13.2.1.f"},{"$f":"'G. Communications and Ops Mgmt'!H132","v":"Information transfer policies and procedures"},"AI2.3","Application control and auditability","9.6.2","IS.2.A.7 IS.2.C.9 IS.2.M.9.2","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A133","v":2629},{"$f":"'G. Communications and Ops Mgmt'!I133","v":2},{"$f":"'G. Communications and Ops Mgmt'!J133","v":0},{"$f":"'G. Communications and Ops Mgmt'!X133","v":0},{"$f":"'G. Communications and Ops Mgmt'!B133","v":"G.11.3"},{"$f":"'G. Communications and Ops Mgmt'!C133","v":"Protection against malicious code?"},{"$f":"'G. Communications and Ops Mgmt'!D133","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E133","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F133","v":0},{"$f":"'G. Communications and Ops Mgmt'!G133","v":"13.2.1.b"},{"$f":"'G. Communications and Ops Mgmt'!H133","v":"Information transfer policies and procedures"},null,null,9.6,"IS.2.C.9 OPS.2.12.B","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A134","v":1177},{"$f":"'G. Communications and Ops Mgmt'!I134","v":2},{"$f":"'G. Communications and Ops Mgmt'!J134","v":0},{"$f":"'G. Communications and Ops Mgmt'!X134","v":0},{"$f":"'G. Communications and Ops Mgmt'!B134","v":"G.11.4"},{"$f":"'G. Communications and Ops Mgmt'!C134","v":"Confidentiality / integrity of data following any transmissions?"},{"$f":"'G. Communications and Ops Mgmt'!D134","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E134","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F134","v":"G.16 Security of Media in Transit"},{"$f":"'G. Communications and Ops Mgmt'!G134","v":"13.2.4"},{"$f":"'G. Communications and Ops Mgmt'!H134","v":"Confidentiality or non-disclosure agreements"},null,null,4.2,"N/A","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A135","v":1186},{"$f":"'G. Communications and Ops Mgmt'!I135","v":2},{"$f":"'G. Communications and Ops Mgmt'!J135","v":0},{"$f":"'G. Communications and Ops Mgmt'!X135","v":0},{"$f":"'G. Communications and Ops Mgmt'!B135","v":"G.11.5"},{"$f":"'G. Communications and Ops Mgmt'!C135","v":"Review and approval process for transmissions?"},{"$f":"'G. Communications and Ops Mgmt'!D135","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E135","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F135","v":"G.16 Security of Media in Transit"},{"$f":"'G. Communications and Ops Mgmt'!G135","v":"13.2.1"},{"$f":"'G. Communications and Ops Mgmt'!H135","v":"Information transfer policies and procedures"},null,null,"N/A","N/A","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A136","v":2634},{"$f":"'G. Communications and Ops Mgmt'!I136","v":2},{"$f":"'G. Communications and Ops Mgmt'!J136","v":0},{"$f":"'G. Communications and Ops Mgmt'!X136","v":0},{"$f":"'G. Communications and Ops Mgmt'!B136","v":"G.11.6"},{"$f":"'G. Communications and Ops Mgmt'!C136","v":"Transport containers to protect against physical damage?"},{"$f":"'G. Communications and Ops Mgmt'!D136","v":"N/A"},{"$f":"'G. Communications and Ops Mgmt'!E136","v":0},{"$f":"'G. Communications and Ops Mgmt'!F136","v":"G.16 Security of Media in Transit"},{"$f":"'G. Communications and Ops Mgmt'!G136","v":"8.3.3.d"},{"$f":"'G. Communications and Ops Mgmt'!H136","v":"Physical media in transit"},null,null,10.4,"IS.2.M.6","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A137","v":2635},{"$f":"'G. Communications and Ops Mgmt'!I137","v":2},{"$f":"'G. Communications and Ops Mgmt'!J137","v":0},{"$f":"'G. Communications and Ops Mgmt'!X137","v":0},{"$f":"'G. Communications and Ops Mgmt'!B137","v":"G.11.7"},{"$f":"'G. Communications and Ops Mgmt'!C137","v":"Locked or tamper evident transport containers?"},{"$f":"'G. Communications and Ops Mgmt'!D137","v":"N/A"},{"$f":"'G. Communications and Ops Mgmt'!E137","v":0},{"$f":"'G. Communications and Ops Mgmt'!F137","v":"G.16 Security of Media in Transit"},{"$f":"'G. Communications and Ops Mgmt'!G137","v":"8.3.3.d"},{"$f":"'G. Communications and Ops Mgmt'!H137","v":"Physical media in transit"},null,null,"N/A","N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A138","v":1209},{"$f":"'G. Communications and Ops Mgmt'!I138","v":2},{"$f":"'G. Communications and Ops Mgmt'!J138","v":0},{"$f":"'G. Communications and Ops Mgmt'!X138","v":0},{"$f":"'G. Communications and Ops Mgmt'!B138","v":"G.11.8"},{"$f":"'G. Communications and Ops Mgmt'!C138","v":"Physical media tracking?"},{"$f":"'G. Communications and Ops Mgmt'!D138","v":"N/A"},{"$f":"'G. Communications and Ops Mgmt'!E138","v":0},{"$f":"'G. Communications and Ops Mgmt'!F138","v":"G.15 Physical Media Tracking"},{"$f":"'G. Communications and Ops Mgmt'!G138","v":"8.3.3.e"},{"$f":"'G. Communications and Ops Mgmt'!H138","v":"Physical media in transit"},null,null,"N/A","IS.2.A.4.4","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A139","v":1243},{"$f":"'G. Communications and Ops Mgmt'!I139","v":2},{"$f":"'G. Communications and Ops Mgmt'!J139","v":0},{"$f":"'G. Communications and Ops Mgmt'!X139","v":0},{"$f":"'G. Communications and Ops Mgmt'!B139","v":"G.11.9"},{"$f":"'G. Communications and Ops Mgmt'!C139","v":"Protection when transmitted through email?"},{"$f":"'G. Communications and Ops Mgmt'!D139","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E139","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F139","v":"G. 22 Data Security Policy - Encryption"},{"$f":"'G. Communications and Ops Mgmt'!G139","v":"13.2.3"},{"$f":"'G. Communications and Ops Mgmt'!H139","v":"Electronic messaging"},null,null,"12.1.1","IS.2.A.4.3 AUDIT.2.D.1.5 E-BANK.1.4.5.4 RPS.2.C.3","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A140","v":1245},{"$f":"'G. Communications and Ops Mgmt'!I140","v":2},{"$f":"'G. Communications and Ops Mgmt'!J140","v":0},{"$f":"'G. Communications and Ops Mgmt'!X140","v":0},{"$f":"'G. Communications and Ops Mgmt'!B140","v":"G.11.10"},{"$f":"'G. Communications and Ops Mgmt'!C140","v":"Encryption when sent through email?"},{"$f":"'G. Communications and Ops Mgmt'!D140","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E140","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F140","v":"G. 22 Data Security Policy - Encryption"},{"$f":"'G. Communications and Ops Mgmt'!G140","v":"13.2.1.f"},{"$f":"'G. Communications and Ops Mgmt'!H140","v":"Information transfer policies and procedures"},null,null,"N/A","N/A","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A141","v":1247},{"$f":"'G. Communications and Ops Mgmt'!I141","v":2},{"$f":"'G. Communications and Ops Mgmt'!J141","v":0},{"$f":"'G. Communications and Ops Mgmt'!X141","v":0},{"$f":"'G. Communications and Ops Mgmt'!B141","v":"G.11.11"},{"$f":"'G. Communications and Ops Mgmt'!C141","v":"Content filtering scans performed on incoming/outgoing email to enforce email policy?"},{"$f":"'G. Communications and Ops Mgmt'!D141","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E141","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F141","v":"G. 22 Data Security Policy - Encryption"},{"$f":"'G. Communications and Ops Mgmt'!G141","v":"12.2.1.d"},{"$f":"'G. Communications and Ops Mgmt'!H141","v":"Controls against malware"},"DS5.3","Identity management",8.3000000000000007,"N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A142","v":1272},{"$f":"'G. Communications and Ops Mgmt'!I142","v":1},{"$f":"'G. Communications and Ops Mgmt'!J142","v":0},{"$f":"'G. Communications and Ops Mgmt'!X142","v":0},{"$f":"'G. Communications and Ops Mgmt'!B142","v":"G.12"},{"$f":"'G. Communications and Ops Mgmt'!C142","v":"Do systems and network devices utilize a common time synchronization service?"},{"$f":"'G. Communications and Ops Mgmt'!D142","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E142","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F142","v":0},{"$f":"'G. Communications and Ops Mgmt'!G142","v":"12.4.4"},{"$f":"'G. Communications and Ops Mgmt'!H142","v":"Clock Synchronization"},"DS5.3","Identity management",8.3000000000000007,"N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A143","v":1281},{"$f":"'G. Communications and Ops Mgmt'!I143","v":1},{"$f":"'G. Communications and Ops Mgmt'!J143","v":0},{"$f":"'G. Communications and Ops Mgmt'!X143","v":0},{"$f":"'G. Communications and Ops Mgmt'!B143","v":"G.13"},{"$f":"'G. Communications and Ops Mgmt'!C143","v":"Are UNIX or Linux operating systems used for transmitting, processing or storing Scoped Data? If yes, is there:"},{"$f":"'G. Communications and Ops Mgmt'!D143","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E143","v":0},{"$f":"'G. Communications and Ops Mgmt'!F143","v":0},{"$f":"'G. Communications and Ops Mgmt'!G143","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H143","v":""},"DS5.3","Identity management","N/A","IS.2.A.5.1","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A144","v":1282},{"$f":"'G. Communications and Ops Mgmt'!I144","v":2},{"$f":"'G. Communications and Ops Mgmt'!J144","v":0},{"$f":"'G. Communications and Ops Mgmt'!X144","v":0},{"$f":"'G. Communications and Ops Mgmt'!B144","v":"G.13.1"},{"$f":"'G. Communications and Ops Mgmt'!C144","v":" UNIX hardening standards?"},{"$f":"'G. Communications and Ops Mgmt'!D144","v":0},{"$f":"'G. Communications and Ops Mgmt'!E144","v":0},{"$f":"'G. Communications and Ops Mgmt'!F144","v":"I.3 Secure System Hardening Standards"},{"$f":"'G. Communications and Ops Mgmt'!G144","v":"13.1.1.e"},{"$f":"'G. Communications and Ops Mgmt'!H144","v":"Network Controls"},null,null,"N/A","IS.2.A.5 IS.2.A.5.2 AUDIT.2.D.1.5 E-BANK.1.4.5.11 RPS.2.C.3","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A145","v":1304},{"$f":"'G. Communications and Ops Mgmt'!I145","v":3},{"$f":"'G. Communications and Ops Mgmt'!J145","v":0},{"$f":"'G. Communications and Ops Mgmt'!X145","v":0},{"$f":"'G. Communications and Ops Mgmt'!B145","v":"G.13.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C145","v":"Periodic monitoring for continued compliance to build standards and security requirements?"},{"$f":"'G. Communications and Ops Mgmt'!D145","v":0},{"$f":"'G. Communications and Ops Mgmt'!E145","v":0},{"$f":"'G. Communications and Ops Mgmt'!F145","v":0},{"$f":"'G. Communications and Ops Mgmt'!G145","v":"18.2.3"},{"$f":"'G. Communications and Ops Mgmt'!H145","v":"Technical compliance review"},null,null,10.6,"RPS.2.C.3","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A146","v":1292},{"$f":"'G. Communications and Ops Mgmt'!I146","v":2},{"$f":"'G. Communications and Ops Mgmt'!J146","v":0},{"$f":"'G. Communications and Ops Mgmt'!X146","v":0},{"$f":"'G. Communications and Ops Mgmt'!B146","v":"G.13.2"},{"$f":"'G. Communications and Ops Mgmt'!C146","v":"Are users required to ‘su’ or ‘sudo’ into root?"},{"$f":"'G. Communications and Ops Mgmt'!D146","v":0},{"$f":"'G. Communications and Ops Mgmt'!E146","v":0},{"$f":"'G. Communications and Ops Mgmt'!F146","v":0},{"$f":"'G. Communications and Ops Mgmt'!G146","v":"9.2.1"},{"$f":"'G. Communications and Ops Mgmt'!H146","v":"User registration and de-registration"},null,null,10.3,"E-BANK.1.4.6.1","DS5.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A147","v":1294},{"$f":"'G. Communications and Ops Mgmt'!I147","v":2},{"$f":"'G. Communications and Ops Mgmt'!J147","v":0},{"$f":"'G. Communications and Ops Mgmt'!X147","v":0},{"$f":"'G. Communications and Ops Mgmt'!B147","v":"G.13.3"},{"$f":"'G. Communications and Ops Mgmt'!C147","v":"Does remote SU/root access require multi-factor authentication?"},{"$f":"'G. Communications and Ops Mgmt'!D147","v":0},{"$f":"'G. Communications and Ops Mgmt'!E147","v":0},{"$f":"'G. Communications and Ops Mgmt'!F147","v":0},{"$f":"'G. Communications and Ops Mgmt'!G147","v":"9.1.2"},{"$f":"'G. Communications and Ops Mgmt'!H147","v":"Access to networks and network services"},null,null,10.7,"E-BANK.1.4.5.3","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A148","v":1301},{"$f":"'G. Communications and Ops Mgmt'!I148","v":2},{"$f":"'G. Communications and Ops Mgmt'!J148","v":0},{"$f":"'G. Communications and Ops Mgmt'!X148","v":0},{"$f":"'G. Communications and Ops Mgmt'!B148","v":"G.13.4"},{"$f":"'G. Communications and Ops Mgmt'!C148","v":"Are remote access tools that do not require authentication (e.g., rhost, shost) allowed?"},{"$f":"'G. Communications and Ops Mgmt'!D148","v":0},{"$f":"'G. Communications and Ops Mgmt'!E148","v":0},{"$f":"'G. Communications and Ops Mgmt'!F148","v":0},{"$f":"'G. Communications and Ops Mgmt'!G148","v":"9.1.2"},{"$f":"'G. Communications and Ops Mgmt'!H148","v":"Access to networks and network services"},"PO4.8","Responsibility for risk, security and compliance","10.5.5","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A149","v":1302},{"$f":"'G. Communications and Ops Mgmt'!I149","v":2},{"$f":"'G. Communications and Ops Mgmt'!J149","v":0},{"$f":"'G. Communications and Ops Mgmt'!X149","v":0},{"$f":"'G. Communications and Ops Mgmt'!B149","v":"G.13.5"},{"$f":"'G. Communications and Ops Mgmt'!C149","v":"Is access to modify startup and shutdown scripts restricted to root-level users?"},{"$f":"'G. Communications and Ops Mgmt'!D149","v":0},{"$f":"'G. Communications and Ops Mgmt'!E149","v":0},{"$f":"'G. Communications and Ops Mgmt'!F149","v":0},{"$f":"'G. Communications and Ops Mgmt'!G149","v":"9.4.4.d"},{"$f":"'G. Communications and Ops Mgmt'!H149","v":"Use of privileged utility programs"},"PO4.8","Responsibility for risk, security and compliance","10.5.4","N/A","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A150","v":1303},{"$f":"'G. Communications and Ops Mgmt'!I150","v":2},{"$f":"'G. Communications and Ops Mgmt'!J150","v":0},{"$f":"'G. Communications and Ops Mgmt'!X150","v":0},{"$f":"'G. Communications and Ops Mgmt'!B150","v":"G.13.6"},{"$f":"'G. Communications and Ops Mgmt'!C150","v":"Are all unnecessary/unused services turned off?"},{"$f":"'G. Communications and Ops Mgmt'!D150","v":0},{"$f":"'G. Communications and Ops Mgmt'!E150","v":0},{"$f":"'G. Communications and Ops Mgmt'!F150","v":0},{"$f":"'G. Communications and Ops Mgmt'!G150","v":"9.4.4.h"},{"$f":"'G. Communications and Ops Mgmt'!H150","v":"Use of privileged utility programs"},"AI4.4","Knowledge transfer to operations and support staff","10.5.2","N/A","PO4.8, PO6.2, ME2.1, ME2.2, ME2.3, ME2.4, ME2.5, ME2.6, ME2.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A151","v":1314},{"$f":"'G. Communications and Ops Mgmt'!I151","v":2},{"$f":"'G. Communications and Ops Mgmt'!J151","v":0},{"$f":"'G. Communications and Ops Mgmt'!X151","v":0},{"$f":"'G. Communications and Ops Mgmt'!B151","v":"G.13.7"},{"$f":"'G. Communications and Ops Mgmt'!C151","v":"Are logs regularly reviewed using a specific methodology to uncover potential incidents?"},{"$f":"'G. Communications and Ops Mgmt'!D151","v":0},{"$f":"'G. Communications and Ops Mgmt'!E151","v":0},{"$f":"'G. Communications and Ops Mgmt'!F151","v":0},{"$f":"'G. Communications and Ops Mgmt'!G151","v":"9.4.4.f"},{"$f":"'G. Communications and Ops Mgmt'!H151","v":"Use of privileged utility programs"},null,null,"8.2.3","N/A","PO2.3, PO6.2, DS11.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A152","v":1316},{"$f":"'G. Communications and Ops Mgmt'!I152","v":2},{"$f":"'G. Communications and Ops Mgmt'!J152","v":0},{"$f":"'G. Communications and Ops Mgmt'!X152","v":0},{"$f":"'G. Communications and Ops Mgmt'!B152","v":"G.13.8"},{"$f":"'G. Communications and Ops Mgmt'!C152","v":"Do operating system event logs contain sufficient detail to support incident investigation including failed login attempts?"},{"$f":"'G. Communications and Ops Mgmt'!D152","v":0},{"$f":"'G. Communications and Ops Mgmt'!E152","v":0},{"$f":"'G. Communications and Ops Mgmt'!F152","v":"G.9 Administrative Activity Logging, G.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!G152","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!H152","v":"Event logging"},null,null,"8.2.3","N/A","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A153","v":1307},{"$f":"'G. Communications and Ops Mgmt'!I153","v":2},{"$f":"'G. Communications and Ops Mgmt'!J153","v":0},{"$f":"'G. Communications and Ops Mgmt'!X153","v":0},{"$f":"'G. Communications and Ops Mgmt'!B153","v":"G.13.9"},{"$f":"'G. Communications and Ops Mgmt'!C153","v":"Are operating system logs retained for a minimum of one year?"},{"$f":"'G. Communications and Ops Mgmt'!D153","v":0},{"$f":"'G. Communications and Ops Mgmt'!E153","v":0},{"$f":"'G. Communications and Ops Mgmt'!F153","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!G153","v":"12.4.2 "},{"$f":"'G. Communications and Ops Mgmt'!H153","v":"Protection Of Log Information"},"AI6.3","Emergency changes","8.2.4","N/A","AI6.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A154","v":1329},{"$f":"'G. Communications and Ops Mgmt'!I154","v":2},{"$f":"'G. Communications and Ops Mgmt'!J154","v":0},{"$f":"'G. Communications and Ops Mgmt'!X154","v":0},{"$f":"'G. Communications and Ops Mgmt'!B154","v":"G.13.10"},{"$f":"'G. Communications and Ops Mgmt'!C154","v":"In the event of an operating system audit log failure, does the system generate an alert?"},{"$f":"'G. Communications and Ops Mgmt'!D154","v":0},{"$f":"'G. Communications and Ops Mgmt'!E154","v":0},{"$f":"'G. Communications and Ops Mgmt'!F154","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!G154","v":"12.4.2 "},{"$f":"'G. Communications and Ops Mgmt'!H154","v":"Protection Of Log Information"},"PO6.2","Enterprise IT risk and internal control framework","8.2.5","OPS.2.12.C","AI6.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A155","v":1333},{"$f":"'G. Communications and Ops Mgmt'!I155","v":2},{"$f":"'G. Communications and Ops Mgmt'!J155","v":0},{"$f":"'G. Communications and Ops Mgmt'!X155","v":0},{"$f":"'G. Communications and Ops Mgmt'!B155","v":"G.13.11"},{"$f":"'G. Communications and Ops Mgmt'!C155","v":"Are audit logs stored on alternate systems?"},{"$f":"'G. Communications and Ops Mgmt'!D155","v":0},{"$f":"'G. Communications and Ops Mgmt'!E155","v":0},{"$f":"'G. Communications and Ops Mgmt'!F155","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!G155","v":"12.4.2 "},{"$f":"'G. Communications and Ops Mgmt'!H155","v":"Protection Of Log Information"},"DS5.5","Security testing, surveillance and monitoring","8.2.6","N/A","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A156","v":1334},{"$f":"'G. Communications and Ops Mgmt'!I156","v":2},{"$f":"'G. Communications and Ops Mgmt'!J156","v":0},{"$f":"'G. Communications and Ops Mgmt'!X156","v":0},{"$f":"'G. Communications and Ops Mgmt'!B156","v":"G.13.12"},{"$f":"'G. Communications and Ops Mgmt'!C156","v":"Are audit logs protected against modification, deletion, and/or inappropriate access?"},{"$f":"'G. Communications and Ops Mgmt'!D156","v":0},{"$f":"'G. Communications and Ops Mgmt'!E156","v":0},{"$f":"'G. Communications and Ops Mgmt'!F156","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!G156","v":"12.4.2 "},{"$f":"'G. Communications and Ops Mgmt'!H156","v":"Protection Of Log Information"},"AI2.3","Application control and auditability","8.2.1","IS.1.4.1.3.5 OPS.2.12.B AUDIT.2.D.1.7 E-BANK.1.4.3.5","DS 5.5, ME1.2, ME2.2, ME2.5, ME4.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A157","v":1342},{"$f":"'G. Communications and Ops Mgmt'!I157","v":2},{"$f":"'G. Communications and Ops Mgmt'!J157","v":0},{"$f":"'G. Communications and Ops Mgmt'!X157","v":0},{"$f":"'G. Communications and Ops Mgmt'!B157","v":"G.13.13"},{"$f":"'G. Communications and Ops Mgmt'!C157","v":"Minimum password length at least eight characters?"},{"$f":"'G. Communications and Ops Mgmt'!D157","v":0},{"$f":"'G. Communications and Ops Mgmt'!E157","v":0},{"$f":"'G. Communications and Ops Mgmt'!F157","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G157","v":"9.3.1.d"},{"$f":"'G. Communications and Ops Mgmt'!H157","v":"Use of secret authentication information"},"AI2.3","Application control and auditability",3.3,"IS.2.A.7 IS.2.C.9 IS.2.M.9.2","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A158","v":1348},{"$f":"'G. Communications and Ops Mgmt'!I158","v":2},{"$f":"'G. Communications and Ops Mgmt'!J158","v":0},{"$f":"'G. Communications and Ops Mgmt'!X158","v":0},{"$f":"'G. Communications and Ops Mgmt'!B158","v":"G.13.14"},{"$f":"'G. Communications and Ops Mgmt'!C158","v":"Complex passwords required?"},{"$f":"'G. Communications and Ops Mgmt'!D158","v":0},{"$f":"'G. Communications and Ops Mgmt'!E158","v":0},{"$f":"'G. Communications and Ops Mgmt'!F158","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G158","v":"9.3.1.d                                     9.4.3.c"},{"$f":"'G. Communications and Ops Mgmt'!H158","v":"Use of secret authentication information,                 Password management system"},null,null,3.3,"IS.2.C.9 OPS.2.12.B","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A159","v":1353},{"$f":"'G. Communications and Ops Mgmt'!I159","v":2},{"$f":"'G. Communications and Ops Mgmt'!J159","v":0},{"$f":"'G. Communications and Ops Mgmt'!X159","v":0},{"$f":"'G. Communications and Ops Mgmt'!B159","v":"G.13.15"},{"$f":"'G. Communications and Ops Mgmt'!C159","v":"Minimum password expiration at least 90 days?"},{"$f":"'G. Communications and Ops Mgmt'!D159","v":0},{"$f":"'G. Communications and Ops Mgmt'!E159","v":0},{"$f":"'G. Communications and Ops Mgmt'!F159","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G159","v":"9.4.3.e"},{"$f":"'G. Communications and Ops Mgmt'!H159","v":"Password Management System"},null,null,"8.1.1","IS.2.M.6","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A160","v":1358},{"$f":"'G. Communications and Ops Mgmt'!I160","v":2},{"$f":"'G. Communications and Ops Mgmt'!J160","v":0},{"$f":"'G. Communications and Ops Mgmt'!X160","v":0},{"$f":"'G. Communications and Ops Mgmt'!B160","v":"G.13.16"},{"$f":"'G. Communications and Ops Mgmt'!C160","v":"Password history at least 12 before reuse?"},{"$f":"'G. Communications and Ops Mgmt'!D160","v":0},{"$f":"'G. Communications and Ops Mgmt'!E160","v":0},{"$f":"'G. Communications and Ops Mgmt'!F160","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G160","v":"9.4.3.f"},{"$f":"'G. Communications and Ops Mgmt'!H160","v":"Password Management System"},null,null,"8.1.6","N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A161","v":2636},{"$f":"'G. Communications and Ops Mgmt'!I161","v":2},{"$f":"'G. Communications and Ops Mgmt'!J161","v":0},{"$f":"'G. Communications and Ops Mgmt'!X161","v":0},{"$f":"'G. Communications and Ops Mgmt'!B161","v":"G.13.17"},{"$f":"'G. Communications and Ops Mgmt'!C161","v":"Initial password required to be changed at first logon?"},{"$f":"'G. Communications and Ops Mgmt'!D161","v":0},{"$f":"'G. Communications and Ops Mgmt'!E161","v":0},{"$f":"'G. Communications and Ops Mgmt'!F161","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G161","v":"9.4.3.d"},{"$f":"'G. Communications and Ops Mgmt'!H161","v":"Password Management System"},null,null,"N/A","IS.2.A.4.4","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A162","v":1378},{"$f":"'G. Communications and Ops Mgmt'!I162","v":2},{"$f":"'G. Communications and Ops Mgmt'!J162","v":0},{"$f":"'G. Communications and Ops Mgmt'!X162","v":0},{"$f":"'G. Communications and Ops Mgmt'!B162","v":"G.13.18"},{"$f":"'G. Communications and Ops Mgmt'!C162","v":"Passwords encrypted in transit?"},{"$f":"'G. Communications and Ops Mgmt'!D162","v":0},{"$f":"'G. Communications and Ops Mgmt'!E162","v":0},{"$f":"'G. Communications and Ops Mgmt'!F162","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G162","v":"9.4.3.i"},{"$f":"'G. Communications and Ops Mgmt'!H162","v":"Password Management System"},null,null,"N/A","IS.2.A.4.3 AUDIT.2.D.1.5 E-BANK.1.4.5.4 RPS.2.C.3","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A163","v":1379},{"$f":"'G. Communications and Ops Mgmt'!I163","v":2},{"$f":"'G. Communications and Ops Mgmt'!J163","v":0},{"$f":"'G. Communications and Ops Mgmt'!X163","v":0},{"$f":"'G. Communications and Ops Mgmt'!B163","v":"G.13.19"},{"$f":"'G. Communications and Ops Mgmt'!C163","v":"Passwords encrypted or hashed in storage?"},{"$f":"'G. Communications and Ops Mgmt'!D163","v":0},{"$f":"'G. Communications and Ops Mgmt'!E163","v":0},{"$f":"'G. Communications and Ops Mgmt'!F163","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G163","v":"9.4.3.i"},{"$f":"'G. Communications and Ops Mgmt'!H163","v":"Password Management System"},null,null,"N/A","N/A","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A164","v":1380},{"$f":"'G. Communications and Ops Mgmt'!I164","v":2},{"$f":"'G. Communications and Ops Mgmt'!J164","v":0},{"$f":"'G. Communications and Ops Mgmt'!X164","v":0},{"$f":"'G. Communications and Ops Mgmt'!B164","v":"G.13.20"},{"$f":"'G. Communications and Ops Mgmt'!C164","v":"Passwords displayed when entered into a system?"},{"$f":"'G. Communications and Ops Mgmt'!D164","v":0},{"$f":"'G. Communications and Ops Mgmt'!E164","v":0},{"$f":"'G. Communications and Ops Mgmt'!F164","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G164","v":"9.4.3.g"},{"$f":"'G. Communications and Ops Mgmt'!H164","v":"Password Management System"},null,null,12.1,"N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A165","v":1287},{"$f":"'G. Communications and Ops Mgmt'!I165","v":2},{"$f":"'G. Communications and Ops Mgmt'!J165","v":0},{"$f":"'G. Communications and Ops Mgmt'!X165","v":0},{"$f":"'G. Communications and Ops Mgmt'!B165","v":"G.13.21"},{"$f":"'G. Communications and Ops Mgmt'!C165","v":"User accounts associated to a unique individual?"},{"$f":"'G. Communications and Ops Mgmt'!D165","v":0},{"$f":"'G. Communications and Ops Mgmt'!E165","v":0},{"$f":"'G. Communications and Ops Mgmt'!F165","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G165","v":"9.4.3.a"},{"$f":"'G. Communications and Ops Mgmt'!H165","v":"Password Management System"},"DS5.3","Identity management","N/A","N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A166","v":1362},{"$f":"'G. Communications and Ops Mgmt'!I166","v":2},{"$f":"'G. Communications and Ops Mgmt'!J166","v":0},{"$f":"'G. Communications and Ops Mgmt'!X166","v":0},{"$f":"'G. Communications and Ops Mgmt'!B166","v":"G.13.22"},{"$f":"'G. Communications and Ops Mgmt'!C166","v":"Does the system lock an account when three to five invalid login attempts are made?"},{"$f":"'G. Communications and Ops Mgmt'!D166","v":0},{"$f":"'G. Communications and Ops Mgmt'!E166","v":0},{"$f":"'G. Communications and Ops Mgmt'!F166","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G166","v":"9.4.2"},{"$f":"'G. Communications and Ops Mgmt'!H166","v":"Secure Log-On Procedures"},"DS5.3","Identity management",10.6,"N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A167","v":1382},{"$f":"'G. Communications and Ops Mgmt'!I167","v":1},{"$f":"'G. Communications and Ops Mgmt'!J167","v":0},{"$f":"'G. Communications and Ops Mgmt'!X167","v":0},{"$f":"'G. Communications and Ops Mgmt'!B167","v":"G.14"},{"$f":"'G. Communications and Ops Mgmt'!C167","v":"Are Windows systems used to transmit, process or store Scoped Data? If yes, are there:"},{"$f":"'G. Communications and Ops Mgmt'!D167","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E167","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F167","v":0},{"$f":"'G. Communications and Ops Mgmt'!G167","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H167","v":""},"DS5.3","Identity management",10.3,"IS.2.A.5.1","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A168","v":1383},{"$f":"'G. Communications and Ops Mgmt'!I168","v":2},{"$f":"'G. Communications and Ops Mgmt'!J168","v":0},{"$f":"'G. Communications and Ops Mgmt'!X168","v":0},{"$f":"'G. Communications and Ops Mgmt'!B168","v":"G.14.1"},{"$f":"'G. Communications and Ops Mgmt'!C168","v":"Windows hardening standards?"},{"$f":"'G. Communications and Ops Mgmt'!D168","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E168","v":"Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards"},{"$f":"'G. Communications and Ops Mgmt'!F168","v":"I.3 Secure System Hardening Standards"},{"$f":"'G. Communications and Ops Mgmt'!G168","v":"13.1.1.e"},{"$f":"'G. Communications and Ops Mgmt'!H168","v":"Network Controls"},"DS5.3","Identity management",10.7,"IS.2.A.5 IS.2.A.5.2 AUDIT.2.D.1.5 E-BANK.1.4.5.11 RPS.2.C.3","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A169","v":1441},{"$f":"'G. Communications and Ops Mgmt'!I169","v":3},{"$f":"'G. Communications and Ops Mgmt'!J169","v":0},{"$f":"'G. Communications and Ops Mgmt'!X169","v":0},{"$f":"'G. Communications and Ops Mgmt'!B169","v":"G.14.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C169","v":"Standard builds/security compliance checks?"},{"$f":"'G. Communications and Ops Mgmt'!D169","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E169","v":"Cloudamize Security Policy - Cloudamize Network Security Policy."},{"$f":"'G. Communications and Ops Mgmt'!F169","v":0},{"$f":"'G. Communications and Ops Mgmt'!G169","v":"18.2.3"},{"$f":"'G. Communications and Ops Mgmt'!H169","v":"Technical Compliance review"},"DS5.3","Identity management","10.5.5","RPS.2.C.3","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A170","v":1439},{"$f":"'G. Communications and Ops Mgmt'!I170","v":2},{"$f":"'G. Communications and Ops Mgmt'!J170","v":0},{"$f":"'G. Communications and Ops Mgmt'!X170","v":0},{"$f":"'G. Communications and Ops Mgmt'!B170","v":"G.14.2"},{"$f":"'G. Communications and Ops Mgmt'!C170","v":"Current patches?"},{"$f":"'G. Communications and Ops Mgmt'!D170","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E170","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F170","v":"I.4 System Patching"},{"$f":"'G. Communications and Ops Mgmt'!G170","v":"12.6.1.d"},{"$f":"'G. Communications and Ops Mgmt'!H170","v":"Control of technical vulnerabilities"},null,null,"10.5.4","E-BANK.1.4.6.1","DS5.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A171","v":1395},{"$f":"'G. Communications and Ops Mgmt'!I171","v":2},{"$f":"'G. Communications and Ops Mgmt'!J171","v":0},{"$f":"'G. Communications and Ops Mgmt'!X171","v":0},{"$f":"'G. Communications and Ops Mgmt'!B171","v":"G.14.3"},{"$f":"'G. Communications and Ops Mgmt'!C171","v":"Unnecessary/unused services turned off?"},{"$f":"'G. Communications and Ops Mgmt'!D171","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E171","v":"Cloudamize Security Policy - Cloudamize Network Security Policy. All Cloudamize Networks conform to PCI DSS standards"},{"$f":"'G. Communications and Ops Mgmt'!F171","v":0},{"$f":"'G. Communications and Ops Mgmt'!G171","v":"9.4.4.h"},{"$f":"'G. Communications and Ops Mgmt'!H171","v":"Use of privileged utility programs"},null,null,"10.5.2","E-BANK.1.4.5.3","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A172","v":1451},{"$f":"'G. Communications and Ops Mgmt'!I172","v":2},{"$f":"'G. Communications and Ops Mgmt'!J172","v":0},{"$f":"'G. Communications and Ops Mgmt'!X172","v":0},{"$f":"'G. Communications and Ops Mgmt'!B172","v":"G.14.4"},{"$f":"'G. Communications and Ops Mgmt'!C172","v":"Regular log reviews using a specific methodology to uncover potential incidents?"},{"$f":"'G. Communications and Ops Mgmt'!D172","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E172","v":"Cloudamize Security Policy - Cloudamize Network Security Policy / Cloudamize Security Working Group"},{"$f":"'G. Communications and Ops Mgmt'!F172","v":0},{"$f":"'G. Communications and Ops Mgmt'!G172","v":"9.4.4.f"},{"$f":"'G. Communications and Ops Mgmt'!H172","v":"Use of privileged utility programs"},null,null,"8.2.3","N/A","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A173","v":1453},{"$f":"'G. Communications and Ops Mgmt'!I173","v":2},{"$f":"'G. Communications and Ops Mgmt'!J173","v":0},{"$f":"'G. Communications and Ops Mgmt'!X173","v":0},{"$f":"'G. Communications and Ops Mgmt'!B173","v":"G.14.5"},{"$f":"'G. Communications and Ops Mgmt'!C173","v":"Sufficient information in the logs to evaluate incidents?"},{"$f":"'G. Communications and Ops Mgmt'!D173","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E173","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F173","v":"G.9 Administrative Activity Logging, G.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!G173","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!H173","v":"Event logging"},"DS5.5","Security testing, surveillance and monitoring","8.2.3","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A174","v":1444},{"$f":"'G. Communications and Ops Mgmt'!I174","v":2},{"$f":"'G. Communications and Ops Mgmt'!J174","v":0},{"$f":"'G. Communications and Ops Mgmt'!X174","v":0},{"$f":"'G. Communications and Ops Mgmt'!B174","v":"G.14.6"},{"$f":"'G. Communications and Ops Mgmt'!C174","v":"Logs retained for a minimum of one year?"},{"$f":"'G. Communications and Ops Mgmt'!D174","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E174","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F174","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!G174","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!H174","v":"Protection Of Log Information"},"PO4.8","Responsibility for risk, security and compliance","8.2.4","N/A","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A175","v":1464},{"$f":"'G. Communications and Ops Mgmt'!I175","v":2},{"$f":"'G. Communications and Ops Mgmt'!J175","v":0},{"$f":"'G. Communications and Ops Mgmt'!X175","v":0},{"$f":"'G. Communications and Ops Mgmt'!B175","v":"G.14.7"},{"$f":"'G. Communications and Ops Mgmt'!C175","v":"System generated alerts in the event of an audit log failure?"},{"$f":"'G. Communications and Ops Mgmt'!D175","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E175","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F175","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!G175","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!H175","v":"Protection Of Log Information"},"AI4.4","Knowledge transfer to operations and support staff","8.2.5","IS.2.C.4","DS5.5, DS5.7, ME2.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A176","v":1468},{"$f":"'G. Communications and Ops Mgmt'!I176","v":2},{"$f":"'G. Communications and Ops Mgmt'!J176","v":0},{"$f":"'G. Communications and Ops Mgmt'!X176","v":0},{"$f":"'G. Communications and Ops Mgmt'!B176","v":"G.14.8"},{"$f":"'G. Communications and Ops Mgmt'!C176","v":"Audit logs stored on alternate systems?"},{"$f":"'G. Communications and Ops Mgmt'!D176","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E176","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F176","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!G176","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!H176","v":"Protection Of Log Information"},"PO2.1","Enterprise information architecture model","8.2.6","N/A","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A177","v":1469},{"$f":"'G. Communications and Ops Mgmt'!I177","v":2},{"$f":"'G. Communications and Ops Mgmt'!J177","v":0},{"$f":"'G. Communications and Ops Mgmt'!X177","v":0},{"$f":"'G. Communications and Ops Mgmt'!B177","v":"G.14.9"},{"$f":"'G. Communications and Ops Mgmt'!C177","v":"Audit logs protected against modification, deletion, and/or inappropriate access?"},{"$f":"'G. Communications and Ops Mgmt'!D177","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E177","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F177","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!G177","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!H177","v":"Protection Of Log Information"},"DS5.4","User account management",8.3000000000000007,"N/A","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A178","v":1396},{"$f":"'G. Communications and Ops Mgmt'!I178","v":2},{"$f":"'G. Communications and Ops Mgmt'!J178","v":0},{"$f":"'G. Communications and Ops Mgmt'!X178","v":0},{"$f":"'G. Communications and Ops Mgmt'!B178","v":"G.14.10"},{"$f":"'G. Communications and Ops Mgmt'!C178","v":"Minimum password length at least eight characters?"},{"$f":"'G. Communications and Ops Mgmt'!D178","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E178","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F178","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G178","v":"9.3.1.d"},{"$f":"'G. Communications and Ops Mgmt'!H178","v":"Use of secret authentication information"},"DS5.4","User account management","8.2.1","N/A","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A179","v":1402},{"$f":"'G. Communications and Ops Mgmt'!I179","v":2},{"$f":"'G. Communications and Ops Mgmt'!J179","v":0},{"$f":"'G. Communications and Ops Mgmt'!X179","v":0},{"$f":"'G. Communications and Ops Mgmt'!B179","v":"G.14.11"},{"$f":"'G. Communications and Ops Mgmt'!C179","v":"Complex passwords required?"},{"$f":"'G. Communications and Ops Mgmt'!D179","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E179","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F179","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G179","v":"9.3.1.d                                     9.4.3.c"},{"$f":"'G. Communications and Ops Mgmt'!H179","v":"Use of secret authentication information,                 Password management system"},"AI2.3","Application control and auditability",3.3,"IS.1.4.1.3.5 OPS.2.12.B AUDIT.2.D.1.7 E-BANK.1.4.3.5","DS 5.5, ME1.2, ME2.2, ME2.5, ME4.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A180","v":1407},{"$f":"'G. Communications and Ops Mgmt'!I180","v":2},{"$f":"'G. Communications and Ops Mgmt'!J180","v":0},{"$f":"'G. Communications and Ops Mgmt'!X180","v":0},{"$f":"'G. Communications and Ops Mgmt'!B180","v":"G.14.12"},{"$f":"'G. Communications and Ops Mgmt'!C180","v":"Minimum password expiration at least every 90 days?"},{"$f":"'G. Communications and Ops Mgmt'!D180","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E180","v":0},{"$f":"'G. Communications and Ops Mgmt'!F180","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G180","v":"9.4.3.e"},{"$f":"'G. Communications and Ops Mgmt'!H180","v":"Password Management System"},"AI2.3","Application control and auditability",3.3,"IS.2.A.7 IS.2.C.9 IS.2.M.9.2","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A181","v":1412},{"$f":"'G. Communications and Ops Mgmt'!I181","v":2},{"$f":"'G. Communications and Ops Mgmt'!J181","v":0},{"$f":"'G. Communications and Ops Mgmt'!X181","v":0},{"$f":"'G. Communications and Ops Mgmt'!B181","v":"G.14.13"},{"$f":"'G. Communications and Ops Mgmt'!C181","v":"Password history of 12 before reuse?"},{"$f":"'G. Communications and Ops Mgmt'!D181","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E181","v":0},{"$f":"'G. Communications and Ops Mgmt'!F181","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G181","v":"9.4.3.f"},{"$f":"'G. Communications and Ops Mgmt'!H181","v":"Password Management System"},null,null,"8.1.1","IS.2.C.9 OPS.2.12.B","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A182","v":2637},{"$f":"'G. Communications and Ops Mgmt'!I182","v":2},{"$f":"'G. Communications and Ops Mgmt'!J182","v":0},{"$f":"'G. Communications and Ops Mgmt'!X182","v":0},{"$f":"'G. Communications and Ops Mgmt'!B182","v":"G.14.14"},{"$f":"'G. Communications and Ops Mgmt'!C182","v":"Initial password required to be changed at first logon?"},{"$f":"'G. Communications and Ops Mgmt'!D182","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E182","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F182","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G182","v":"9.4.3.d"},{"$f":"'G. Communications and Ops Mgmt'!H182","v":"Password Management System"},null,null,"8.1.6","N/A","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A183","v":1431},{"$f":"'G. Communications and Ops Mgmt'!I183","v":2},{"$f":"'G. Communications and Ops Mgmt'!J183","v":0},{"$f":"'G. Communications and Ops Mgmt'!X183","v":0},{"$f":"'G. Communications and Ops Mgmt'!B183","v":"G.14.15"},{"$f":"'G. Communications and Ops Mgmt'!C183","v":"Can a PIN or secret question be a stand-alone method of authentication?"},{"$f":"'G. Communications and Ops Mgmt'!D183","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E183","v":0},{"$f":"'G. Communications and Ops Mgmt'!F183","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G183","v":"9.4.2"},{"$f":"'G. Communications and Ops Mgmt'!H183","v":"Secure Log-On Procedures"},null,null,"N/A","IS.2.M.6","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A184","v":1432},{"$f":"'G. Communications and Ops Mgmt'!I184","v":2},{"$f":"'G. Communications and Ops Mgmt'!J184","v":0},{"$f":"'G. Communications and Ops Mgmt'!X184","v":0},{"$f":"'G. Communications and Ops Mgmt'!B184","v":"G.14.16"},{"$f":"'G. Communications and Ops Mgmt'!C184","v":"Passwords encrypted in transit?"},{"$f":"'G. Communications and Ops Mgmt'!D184","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E184","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F184","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G184","v":"9.4.3.i"},{"$f":"'G. Communications and Ops Mgmt'!H184","v":"Password Management System"},null,null,12.1,"N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A185","v":1433},{"$f":"'G. Communications and Ops Mgmt'!I185","v":2},{"$f":"'G. Communications and Ops Mgmt'!J185","v":0},{"$f":"'G. Communications and Ops Mgmt'!X185","v":0},{"$f":"'G. Communications and Ops Mgmt'!B185","v":"G.14.17"},{"$f":"'G. Communications and Ops Mgmt'!C185","v":"Passwords encrypted or hashed in storage?"},{"$f":"'G. Communications and Ops Mgmt'!D185","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E185","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F185","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G185","v":"9.4.3.i"},{"$f":"'G. Communications and Ops Mgmt'!H185","v":"Password Management System"},null,null,"12.1.1","IS.2.A.4.4","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A186","v":1434},{"$f":"'G. Communications and Ops Mgmt'!I186","v":2},{"$f":"'G. Communications and Ops Mgmt'!J186","v":0},{"$f":"'G. Communications and Ops Mgmt'!X186","v":0},{"$f":"'G. Communications and Ops Mgmt'!B186","v":"G.14.18"},{"$f":"'G. Communications and Ops Mgmt'!C186","v":"Passwords displayed when entered into a system?"},{"$f":"'G. Communications and Ops Mgmt'!D186","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E186","v":0},{"$f":"'G. Communications and Ops Mgmt'!F186","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G186","v":"9.4.3.g"},{"$f":"'G. Communications and Ops Mgmt'!H186","v":"Password Management System"},null,null,4.0999999999999996,"IS.2.A.4.3 AUDIT.2.D.1.5 E-BANK.1.4.5.4 RPS.2.C.3","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A187","v":2638},{"$f":"'G. Communications and Ops Mgmt'!I187","v":2},{"$f":"'G. Communications and Ops Mgmt'!J187","v":0},{"$f":"'G. Communications and Ops Mgmt'!X187","v":0},{"$f":"'G. Communications and Ops Mgmt'!B187","v":"G.14.19"},{"$f":"'G. Communications and Ops Mgmt'!C187","v":"User accounts associated to a unique individual?"},{"$f":"'G. Communications and Ops Mgmt'!D187","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E187","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F187","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G187","v":"9.4.3.a"},{"$f":"'G. Communications and Ops Mgmt'!H187","v":"Password Management System"},null,null,8.1999999999999993,"N/A","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A188","v":1416},{"$f":"'G. Communications and Ops Mgmt'!I188","v":2},{"$f":"'G. Communications and Ops Mgmt'!J188","v":0},{"$f":"'G. Communications and Ops Mgmt'!X188","v":0},{"$f":"'G. Communications and Ops Mgmt'!B188","v":"G.14.20"},{"$f":"'G. Communications and Ops Mgmt'!C188","v":"Does the system lock an account when three to five invalid login attempts are made?"},{"$f":"'G. Communications and Ops Mgmt'!D188","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E188","v":0},{"$f":"'G. Communications and Ops Mgmt'!F188","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G188","v":"9.4.2"},{"$f":"'G. Communications and Ops Mgmt'!H188","v":"Secure Log-On Procedures"},"DS5.3","Identity management",2.2000000000000002,"N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A189","v":1478},{"$f":"'G. Communications and Ops Mgmt'!I189","v":1},{"$f":"'G. Communications and Ops Mgmt'!J189","v":0},{"$f":"'G. Communications and Ops Mgmt'!X189","v":0},{"$f":"'G. Communications and Ops Mgmt'!B189","v":"G.15"},{"$f":"'G. Communications and Ops Mgmt'!C189","v":"Is a mainframe used to transmit, process or store Scoped Systems and Data? If yes, are:"},{"$f":"'G. Communications and Ops Mgmt'!D189","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E189","v":0},{"$f":"'G. Communications and Ops Mgmt'!F189","v":0},{"$f":"'G. Communications and Ops Mgmt'!G189","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H189","v":""},"DS5.3","Identity management","N/A","N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A190","v":1503},{"$f":"'G. Communications and Ops Mgmt'!I190","v":2},{"$f":"'G. Communications and Ops Mgmt'!J190","v":0},{"$f":"'G. Communications and Ops Mgmt'!X190","v":0},{"$f":"'G. Communications and Ops Mgmt'!B190","v":"G.15.1"},{"$f":"'G. Communications and Ops Mgmt'!C190","v":"Mainframe security controls documented?"},{"$f":"'G. Communications and Ops Mgmt'!D190","v":0},{"$f":"'G. Communications and Ops Mgmt'!E190","v":0},{"$f":"'G. Communications and Ops Mgmt'!F190","v":0},{"$f":"'G. Communications and Ops Mgmt'!G190","v":"13.1.1.a"},{"$f":"'G. Communications and Ops Mgmt'!H190","v":"Network controls"},"DS5.3","Identity management","N/A","IS.2.A.5.1","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A191","v":1504},{"$f":"'G. Communications and Ops Mgmt'!I191","v":3},{"$f":"'G. Communications and Ops Mgmt'!J191","v":0},{"$f":"'G. Communications and Ops Mgmt'!X191","v":0},{"$f":"'G. Communications and Ops Mgmt'!B191","v":"G.15.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C191","v":"Reviews performed to validate compliance with documented standards?"},{"$f":"'G. Communications and Ops Mgmt'!D191","v":0},{"$f":"'G. Communications and Ops Mgmt'!E191","v":0},{"$f":"'G. Communications and Ops Mgmt'!F191","v":0},{"$f":"'G. Communications and Ops Mgmt'!G191","v":"18.2.3"},{"$f":"'G. Communications and Ops Mgmt'!H191","v":"Technical compliance review"},"DS5.3","Identity management",10.6,"IS.2.A.5 IS.2.A.5.2 AUDIT.2.D.1.5 E-BANK.1.4.5.11 RPS.2.C.3","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A192","v":1489},{"$f":"'G. Communications and Ops Mgmt'!I192","v":2},{"$f":"'G. Communications and Ops Mgmt'!J192","v":0},{"$f":"'G. Communications and Ops Mgmt'!X192","v":0},{"$f":"'G. Communications and Ops Mgmt'!B192","v":"G.15.2"},{"$f":"'G. Communications and Ops Mgmt'!C192","v":"Transmission encrypted?"},{"$f":"'G. Communications and Ops Mgmt'!D192","v":0},{"$f":"'G. Communications and Ops Mgmt'!E192","v":0},{"$f":"'G. Communications and Ops Mgmt'!F192","v":0},{"$f":"'G. Communications and Ops Mgmt'!G192","v":"13.2.1.f"},{"$f":"'G. Communications and Ops Mgmt'!H192","v":"Information transfer policies and procedures"},"DS5.3","Identity management","10.5.5","RPS.2.C.3","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A193","v":1492},{"$f":"'G. Communications and Ops Mgmt'!I193","v":2},{"$f":"'G. Communications and Ops Mgmt'!J193","v":0},{"$f":"'G. Communications and Ops Mgmt'!X193","v":0},{"$f":"'G. Communications and Ops Mgmt'!B193","v":"G.15.3"},{"$f":"'G. Communications and Ops Mgmt'!C193","v":"Authentication required for access to any transaction or database system?"},{"$f":"'G. Communications and Ops Mgmt'!D193","v":0},{"$f":"'G. Communications and Ops Mgmt'!E193","v":0},{"$f":"'G. Communications and Ops Mgmt'!F193","v":0},{"$f":"'G. Communications and Ops Mgmt'!G193","v":"9.4.2"},{"$f":"'G. Communications and Ops Mgmt'!H193","v":"Secure Log-On Procedures"},null,null,10.7,"E-BANK.1.4.6.1","DS5.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A194","v":1496},{"$f":"'G. Communications and Ops Mgmt'!I194","v":2},{"$f":"'G. Communications and Ops Mgmt'!J194","v":0},{"$f":"'G. Communications and Ops Mgmt'!X194","v":0},{"$f":"'G. Communications and Ops Mgmt'!B194","v":"G.15.4"},{"$f":"'G. Communications and Ops Mgmt'!C194","v":"Job scheduling systems secured to control the submission of production jobs?"},{"$f":"'G. Communications and Ops Mgmt'!D194","v":0},{"$f":"'G. Communications and Ops Mgmt'!E194","v":0},{"$f":"'G. Communications and Ops Mgmt'!F194","v":0},{"$f":"'G. Communications and Ops Mgmt'!G194","v":"9.4.4"},{"$f":"'G. Communications and Ops Mgmt'!H194","v":"Use of privileged utility programs"},null,null,"10.5.2","E-BANK.1.4.5.3","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A195","v":1497},{"$f":"'G. Communications and Ops Mgmt'!I195","v":2},{"$f":"'G. Communications and Ops Mgmt'!J195","v":0},{"$f":"'G. Communications and Ops Mgmt'!X195","v":0},{"$f":"'G. Communications and Ops Mgmt'!B195","v":"G.15.5"},{"$f":"'G. Communications and Ops Mgmt'!C195","v":"Storage management personnel (tape operators) given privileged access to mainframe systems?"},{"$f":"'G. Communications and Ops Mgmt'!D195","v":0},{"$f":"'G. Communications and Ops Mgmt'!E195","v":0},{"$f":"'G. Communications and Ops Mgmt'!F195","v":0},{"$f":"'G. Communications and Ops Mgmt'!G195","v":"9.4.4"},{"$f":"'G. Communications and Ops Mgmt'!H195","v":"Use of privileged utility programs"},"PO4.11","Segregation of duties","8.2.3","N/A","PO6.2, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A196","v":1502},{"$f":"'G. Communications and Ops Mgmt'!I196","v":2},{"$f":"'G. Communications and Ops Mgmt'!J196","v":0},{"$f":"'G. Communications and Ops Mgmt'!X196","v":0},{"$f":"'G. Communications and Ops Mgmt'!B196","v":"G.15.6"},{"$f":"'G. Communications and Ops Mgmt'!C196","v":"ESM (RACF) and inherent security configuration settings configured to support the access control standards and requirements?"},{"$f":"'G. Communications and Ops Mgmt'!D196","v":0},{"$f":"'G. Communications and Ops Mgmt'!E196","v":0},{"$f":"'G. Communications and Ops Mgmt'!F196","v":0},{"$f":"'G. Communications and Ops Mgmt'!G196","v":"13.1.1.f"},{"$f":"'G. Communications and Ops Mgmt'!H196","v":"Network Controls"},"DS5.5","Security testing, surveillance and monitoring","8.2.3","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A197","v":1513},{"$f":"'G. Communications and Ops Mgmt'!I197","v":2},{"$f":"'G. Communications and Ops Mgmt'!J197","v":0},{"$f":"'G. Communications and Ops Mgmt'!X197","v":0},{"$f":"'G. Communications and Ops Mgmt'!B197","v":"G.15.7"},{"$f":"'G. Communications and Ops Mgmt'!C197","v":"Regular review of logs using a specific methodology to uncover potential incidents?"},{"$f":"'G. Communications and Ops Mgmt'!D197","v":0},{"$f":"'G. Communications and Ops Mgmt'!E197","v":0},{"$f":"'G. Communications and Ops Mgmt'!F197","v":0},{"$f":"'G. Communications and Ops Mgmt'!G197","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!H197","v":"Event logging"},"DS5.5","Security testing, surveillance and monitoring","8.2.4","N/A","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A198","v":1515},{"$f":"'G. Communications and Ops Mgmt'!I198","v":2},{"$f":"'G. Communications and Ops Mgmt'!J198","v":0},{"$f":"'G. Communications and Ops Mgmt'!X198","v":0},{"$f":"'G. Communications and Ops Mgmt'!B198","v":"G.15.8"},{"$f":"'G. Communications and Ops Mgmt'!C198","v":"System generated alerts in the event of an audit log failure?"},{"$f":"'G. Communications and Ops Mgmt'!D198","v":0},{"$f":"'G. Communications and Ops Mgmt'!E198","v":0},{"$f":"'G. Communications and Ops Mgmt'!F198","v":"G.9 Administrative Activity Logging, G.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!G198","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!H198","v":"Protection Of Log Information"},"AI2.3","Application control and auditability","8.2.5","IS.1.4.1.3.5 OPS.2.12.B AUDIT.2.D.1.7 E-BANK.1.4.3.5","DS 5.5, ME1.2, ME2.2, ME2.5, ME4.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A199","v":1506},{"$f":"'G. Communications and Ops Mgmt'!I199","v":2},{"$f":"'G. Communications and Ops Mgmt'!J199","v":0},{"$f":"'G. Communications and Ops Mgmt'!X199","v":0},{"$f":"'G. Communications and Ops Mgmt'!B199","v":"G.15.9"},{"$f":"'G. Communications and Ops Mgmt'!C199","v":"Logs retained for a minimum of one year?"},{"$f":"'G. Communications and Ops Mgmt'!D199","v":0},{"$f":"'G. Communications and Ops Mgmt'!E199","v":0},{"$f":"'G. Communications and Ops Mgmt'!F199","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!G199","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H199","v":0},"AI2.3","Application control and auditability","8.2.5","IS.2.A.7 IS.2.C.9 IS.2.M.9.2","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A200","v":1531},{"$f":"'G. Communications and Ops Mgmt'!I200","v":2},{"$f":"'G. Communications and Ops Mgmt'!J200","v":0},{"$f":"'G. Communications and Ops Mgmt'!X200","v":0},{"$f":"'G. Communications and Ops Mgmt'!B200","v":"G.15.10"},{"$f":"'G. Communications and Ops Mgmt'!C200","v":"Audit logs adequately protected against modification, deletion, and/or inappropriate access?"},{"$f":"'G. Communications and Ops Mgmt'!D200","v":0},{"$f":"'G. Communications and Ops Mgmt'!E200","v":0},{"$f":"'G. Communications and Ops Mgmt'!F200","v":"G.9 Administrative Activity Logging, G.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!G200","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!H200","v":"Protection Of Log Information"},null,null,"8.2.6","IS.2.C.9 OPS.2.12.B","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A201","v":1539},{"$f":"'G. Communications and Ops Mgmt'!I201","v":2},{"$f":"'G. Communications and Ops Mgmt'!J201","v":0},{"$f":"'G. Communications and Ops Mgmt'!X201","v":0},{"$f":"'G. Communications and Ops Mgmt'!B201","v":"G.15.11"},{"$f":"'G. Communications and Ops Mgmt'!C201","v":"Minimum password length at least eight characters?"},{"$f":"'G. Communications and Ops Mgmt'!D201","v":0},{"$f":"'G. Communications and Ops Mgmt'!E201","v":0},{"$f":"'G. Communications and Ops Mgmt'!F201","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G201","v":"9.3.1.d"},{"$f":"'G. Communications and Ops Mgmt'!H201","v":"Use of secret authentication information"},null,null,8.3000000000000007,"N/A","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A202","v":1545},{"$f":"'G. Communications and Ops Mgmt'!I202","v":2},{"$f":"'G. Communications and Ops Mgmt'!J202","v":0},{"$f":"'G. Communications and Ops Mgmt'!X202","v":0},{"$f":"'G. Communications and Ops Mgmt'!B202","v":"G.15.12"},{"$f":"'G. Communications and Ops Mgmt'!C202","v":"Complex passwords required?"},{"$f":"'G. Communications and Ops Mgmt'!D202","v":0},{"$f":"'G. Communications and Ops Mgmt'!E202","v":0},{"$f":"'G. Communications and Ops Mgmt'!F202","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G202","v":"9.3.1.d                                     9.4.3.c"},{"$f":"'G. Communications and Ops Mgmt'!H202","v":"Use of secret authentication information,                 Password management system"},null,null,"8.2.1","IS.2.M.6","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A203","v":1550},{"$f":"'G. Communications and Ops Mgmt'!I203","v":2},{"$f":"'G. Communications and Ops Mgmt'!J203","v":0},{"$f":"'G. Communications and Ops Mgmt'!X203","v":0},{"$f":"'G. Communications and Ops Mgmt'!B203","v":"G.15.13"},{"$f":"'G. Communications and Ops Mgmt'!C203","v":"Minimum password expiration at least 90 days?"},{"$f":"'G. Communications and Ops Mgmt'!D203","v":0},{"$f":"'G. Communications and Ops Mgmt'!E203","v":0},{"$f":"'G. Communications and Ops Mgmt'!F203","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G203","v":"9.4.3.e"},{"$f":"'G. Communications and Ops Mgmt'!H203","v":"Password Management System"},null,null,3.3,"N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A204","v":1555},{"$f":"'G. Communications and Ops Mgmt'!I204","v":2},{"$f":"'G. Communications and Ops Mgmt'!J204","v":0},{"$f":"'G. Communications and Ops Mgmt'!X204","v":0},{"$f":"'G. Communications and Ops Mgmt'!B204","v":"G.15.14"},{"$f":"'G. Communications and Ops Mgmt'!C204","v":"Password history of 12 before reuse?"},{"$f":"'G. Communications and Ops Mgmt'!D204","v":0},{"$f":"'G. Communications and Ops Mgmt'!E204","v":0},{"$f":"'G. Communications and Ops Mgmt'!F204","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G204","v":"9.4.3.f"},{"$f":"'G. Communications and Ops Mgmt'!H204","v":"Password Management System"},null,null,3.3,"IS.2.A.4.4","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A205","v":1570},{"$f":"'G. Communications and Ops Mgmt'!I205","v":2},{"$f":"'G. Communications and Ops Mgmt'!J205","v":0},{"$f":"'G. Communications and Ops Mgmt'!X205","v":0},{"$f":"'G. Communications and Ops Mgmt'!B205","v":"G.15.15"},{"$f":"'G. Communications and Ops Mgmt'!C205","v":"Password minimum age?"},{"$f":"'G. Communications and Ops Mgmt'!D205","v":0},{"$f":"'G. Communications and Ops Mgmt'!E205","v":0},{"$f":"'G. Communications and Ops Mgmt'!F205","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G205","v":"9.4.3.e"},{"$f":"'G. Communications and Ops Mgmt'!H205","v":"Password Management System"},null,null,"8.1.1","IS.2.A.4.3 AUDIT.2.D.1.5 E-BANK.1.4.5.4 RPS.2.C.3","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A206","v":2639},{"$f":"'G. Communications and Ops Mgmt'!I206","v":2},{"$f":"'G. Communications and Ops Mgmt'!J206","v":0},{"$f":"'G. Communications and Ops Mgmt'!X206","v":0},{"$f":"'G. Communications and Ops Mgmt'!B206","v":"G.15.16"},{"$f":"'G. Communications and Ops Mgmt'!C206","v":"Initial password required to be changed at first logon?"},{"$f":"'G. Communications and Ops Mgmt'!D206","v":0},{"$f":"'G. Communications and Ops Mgmt'!E206","v":0},{"$f":"'G. Communications and Ops Mgmt'!F206","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G206","v":"9.4.3.d"},{"$f":"'G. Communications and Ops Mgmt'!H206","v":"Password Management System"},null,null,"8.1.6","N/A","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A207","v":1574},{"$f":"'G. Communications and Ops Mgmt'!I207","v":2},{"$f":"'G. Communications and Ops Mgmt'!J207","v":0},{"$f":"'G. Communications and Ops Mgmt'!X207","v":0},{"$f":"'G. Communications and Ops Mgmt'!B207","v":"G.15.17"},{"$f":"'G. Communications and Ops Mgmt'!C207","v":"Can a PIN or secret question be a stand alone method of authentication?"},{"$f":"'G. Communications and Ops Mgmt'!D207","v":0},{"$f":"'G. Communications and Ops Mgmt'!E207","v":0},{"$f":"'G. Communications and Ops Mgmt'!F207","v":0},{"$f":"'G. Communications and Ops Mgmt'!G207","v":"9.4.2 "},{"$f":"'G. Communications and Ops Mgmt'!H207","v":"Secure Log-On Procedures"},"DS5.3","Identity management","8.2.2","N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A208","v":1575},{"$f":"'G. Communications and Ops Mgmt'!I208","v":2},{"$f":"'G. Communications and Ops Mgmt'!J208","v":0},{"$f":"'G. Communications and Ops Mgmt'!X208","v":0},{"$f":"'G. Communications and Ops Mgmt'!B208","v":"G.15.18"},{"$f":"'G. Communications and Ops Mgmt'!C208","v":"Passwords encrypted in transit?"},{"$f":"'G. Communications and Ops Mgmt'!D208","v":0},{"$f":"'G. Communications and Ops Mgmt'!E208","v":0},{"$f":"'G. Communications and Ops Mgmt'!F208","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G208","v":"9.4.3.i"},{"$f":"'G. Communications and Ops Mgmt'!H208","v":"Password Management System"},"DS5.3","Identity management","N/A","N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A209","v":1576},{"$f":"'G. Communications and Ops Mgmt'!I209","v":2},{"$f":"'G. Communications and Ops Mgmt'!J209","v":0},{"$f":"'G. Communications and Ops Mgmt'!X209","v":0},{"$f":"'G. Communications and Ops Mgmt'!B209","v":"G.15.19"},{"$f":"'G. Communications and Ops Mgmt'!C209","v":"Passwords encrypted or hashed in storage?"},{"$f":"'G. Communications and Ops Mgmt'!D209","v":0},{"$f":"'G. Communications and Ops Mgmt'!E209","v":0},{"$f":"'G. Communications and Ops Mgmt'!F209","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G209","v":"9.4.3.i"},{"$f":"'G. Communications and Ops Mgmt'!H209","v":"Password Management System"},"DS5.3","Identity management",12.1,"IS.2.A.5.1","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A210","v":1577},{"$f":"'G. Communications and Ops Mgmt'!I210","v":2},{"$f":"'G. Communications and Ops Mgmt'!J210","v":0},{"$f":"'G. Communications and Ops Mgmt'!X210","v":0},{"$f":"'G. Communications and Ops Mgmt'!B210","v":"G.15.20"},{"$f":"'G. Communications and Ops Mgmt'!C210","v":"Passwords displayed when entered into a system?"},{"$f":"'G. Communications and Ops Mgmt'!D210","v":0},{"$f":"'G. Communications and Ops Mgmt'!E210","v":0},{"$f":"'G. Communications and Ops Mgmt'!F210","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G210","v":"9.4.3.g"},{"$f":"'G. Communications and Ops Mgmt'!H210","v":"Password Management System"},"DS5.3","Identity management","12.1.1","IS.2.A.5 IS.2.A.5.2 AUDIT.2.D.1.5 E-BANK.1.4.5.11 RPS.2.C.3","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A211","v":2640},{"$f":"'G. Communications and Ops Mgmt'!I211","v":2},{"$f":"'G. Communications and Ops Mgmt'!J211","v":0},{"$f":"'G. Communications and Ops Mgmt'!X211","v":0},{"$f":"'G. Communications and Ops Mgmt'!B211","v":"G.15.21"},{"$f":"'G. Communications and Ops Mgmt'!C211","v":"User accounts associated to a unique individual?"},{"$f":"'G. Communications and Ops Mgmt'!D211","v":0},{"$f":"'G. Communications and Ops Mgmt'!E211","v":0},{"$f":"'G. Communications and Ops Mgmt'!F211","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G211","v":"9.4.3.a"},{"$f":"'G. Communications and Ops Mgmt'!H211","v":"Password Management System"},"DS5.3","Identity management","7.1.1","RPS.2.C.3","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A212","v":1559},{"$f":"'G. Communications and Ops Mgmt'!I212","v":2},{"$f":"'G. Communications and Ops Mgmt'!J212","v":0},{"$f":"'G. Communications and Ops Mgmt'!X212","v":0},{"$f":"'G. Communications and Ops Mgmt'!B212","v":"G.15.22"},{"$f":"'G. Communications and Ops Mgmt'!C212","v":"Does the system lock an account when three to five invalid login attempts are made?"},{"$f":"'G. Communications and Ops Mgmt'!D212","v":0},{"$f":"'G. Communications and Ops Mgmt'!E212","v":0},{"$f":"'G. Communications and Ops Mgmt'!F212","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G212","v":"9.4.2"},{"$f":"'G. Communications and Ops Mgmt'!H212","v":"Secure Log-On Procedures"},null,null,7.1,"IS.1.4.1.2.2 E-BANK.1.4.6.1","DS5.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A213","v":1564},{"$f":"'G. Communications and Ops Mgmt'!I213","v":2},{"$f":"'G. Communications and Ops Mgmt'!J213","v":0},{"$f":"'G. Communications and Ops Mgmt'!X213","v":0},{"$f":"'G. Communications and Ops Mgmt'!B213","v":"G.15.23"},{"$f":"'G. Communications and Ops Mgmt'!C213","v":"Administrator intervention required to unlock an account?"},{"$f":"'G. Communications and Ops Mgmt'!D213","v":0},{"$f":"'G. Communications and Ops Mgmt'!E213","v":0},{"$f":"'G. Communications and Ops Mgmt'!F213","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G213","v":"9.4.2"},{"$f":"'G. Communications and Ops Mgmt'!H213","v":"Secure Log-On Procedures"},null,null,"7.1.2","E-BANK.1.4.5.3","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A214","v":1579},{"$f":"'G. Communications and Ops Mgmt'!I214","v":1},{"$f":"'G. Communications and Ops Mgmt'!J214","v":0},{"$f":"'G. Communications and Ops Mgmt'!X214","v":0},{"$f":"'G. Communications and Ops Mgmt'!B214","v":"G.16"},{"$f":"'G. Communications and Ops Mgmt'!C214","v":"Is an AS400 used to transmit, process or store Scoped Systems and Data? If yes, are:"},{"$f":"'G. Communications and Ops Mgmt'!D214","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E214","v":0},{"$f":"'G. Communications and Ops Mgmt'!F214","v":0},{"$f":"'G. Communications and Ops Mgmt'!G214","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H214","v":""},"DS5.11","Exchange of sensitive data",10.6,"N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A215","v":2641},{"$f":"'G. Communications and Ops Mgmt'!I215","v":2},{"$f":"'G. Communications and Ops Mgmt'!J215","v":0},{"$f":"'G. Communications and Ops Mgmt'!X215","v":0},{"$f":"'G. Communications and Ops Mgmt'!B215","v":"G.16.1"},{"$f":"'G. Communications and Ops Mgmt'!C215","v":"Security controls documented?"},{"$f":"'G. Communications and Ops Mgmt'!D215","v":0},{"$f":"'G. Communications and Ops Mgmt'!E215","v":0},{"$f":"'G. Communications and Ops Mgmt'!F215","v":0},{"$f":"'G. Communications and Ops Mgmt'!G215","v":"13.1.1.a"},{"$f":"'G. Communications and Ops Mgmt'!H215","v":"Network Controls"},"DS5.11","Exchange of sensitive data",10.3,"N/A","AC4, AC6, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A216","v":1598},{"$f":"'G. Communications and Ops Mgmt'!I216","v":3},{"$f":"'G. Communications and Ops Mgmt'!J216","v":0},{"$f":"'G. Communications and Ops Mgmt'!X216","v":0},{"$f":"'G. Communications and Ops Mgmt'!B216","v":"G.16.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C216","v":"Systems periodically monitored to ensure continued compliance with the documented standards?"},{"$f":"'G. Communications and Ops Mgmt'!D216","v":0},{"$f":"'G. Communications and Ops Mgmt'!E216","v":0},{"$f":"'G. Communications and Ops Mgmt'!F216","v":0},{"$f":"'G. Communications and Ops Mgmt'!G216","v":"18.2.3"},{"$f":"'G. Communications and Ops Mgmt'!H216","v":"Technical Compliance review"},"AC9","Data processing integrity",10.7,"N/A","AC4, AC6, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A217","v":1580},{"$f":"'G. Communications and Ops Mgmt'!I217","v":2},{"$f":"'G. Communications and Ops Mgmt'!J217","v":0},{"$f":"'G. Communications and Ops Mgmt'!X217","v":0},{"$f":"'G. Communications and Ops Mgmt'!B217","v":"G.16.2"},{"$f":"'G. Communications and Ops Mgmt'!C217","v":"Group profile assignments based on constituent role?"},{"$f":"'G. Communications and Ops Mgmt'!D217","v":0},{"$f":"'G. Communications and Ops Mgmt'!E217","v":0},{"$f":"'G. Communications and Ops Mgmt'!F217","v":0},{"$f":"'G. Communications and Ops Mgmt'!G217","v":"9.1.1.k"},{"$f":"'G. Communications and Ops Mgmt'!H217","v":"Access Control Policy"},null,null,"10.5.5","N/A","AC4, AC6, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A218","v":1581},{"$f":"'G. Communications and Ops Mgmt'!I218","v":2},{"$f":"'G. Communications and Ops Mgmt'!J218","v":0},{"$f":"'G. Communications and Ops Mgmt'!X218","v":0},{"$f":"'G. Communications and Ops Mgmt'!B218","v":"G.16.3"},{"$f":"'G. Communications and Ops Mgmt'!C218","v":"Group profile assignments approved?"},{"$f":"'G. Communications and Ops Mgmt'!D218","v":0},{"$f":"'G. Communications and Ops Mgmt'!E218","v":0},{"$f":"'G. Communications and Ops Mgmt'!F218","v":0},{"$f":"'G. Communications and Ops Mgmt'!G218","v":"9.1.1.g"},{"$f":"'G. Communications and Ops Mgmt'!H218","v":"Access Control Policy"},"PO2.3","Data classification scheme","10.2.5","N/A","AC3, AC4, AC5, AC6"]
[{"$f":"'G. Communications and Ops Mgmt'!A219","v":1582},{"$f":"'G. Communications and Ops Mgmt'!I219","v":2},{"$f":"'G. Communications and Ops Mgmt'!J219","v":0},{"$f":"'G. Communications and Ops Mgmt'!X219","v":0},{"$f":"'G. Communications and Ops Mgmt'!B219","v":"G.16.4"},{"$f":"'G. Communications and Ops Mgmt'!C219","v":"User profiles created with the principle of least privilege?"},{"$f":"'G. Communications and Ops Mgmt'!D219","v":0},{"$f":"'G. Communications and Ops Mgmt'!E219","v":0},{"$f":"'G. Communications and Ops Mgmt'!F219","v":0},{"$f":"'G. Communications and Ops Mgmt'!G219","v":"9.1.1.b"},{"$f":"'G. Communications and Ops Mgmt'!H219","v":"Access Control Policy"},"DS5.4","User account management","8.2.3","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A220","v":1607},{"$f":"'G. Communications and Ops Mgmt'!I220","v":2},{"$f":"'G. Communications and Ops Mgmt'!J220","v":0},{"$f":"'G. Communications and Ops Mgmt'!X220","v":0},{"$f":"'G. Communications and Ops Mgmt'!B220","v":"G.16.5"},{"$f":"'G. Communications and Ops Mgmt'!C220","v":"Logs regularly reviewed using a specific methodology to uncover potential incidents?"},{"$f":"'G. Communications and Ops Mgmt'!D220","v":0},{"$f":"'G. Communications and Ops Mgmt'!E220","v":0},{"$f":"'G. Communications and Ops Mgmt'!F220","v":"G.9 Administrative Activity Logging, G.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!G220","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!H220","v":"Event logging"},"PO2.3","Data classification scheme","8.2.3","N/A","PO2.3, PO3.4, AI5.2, DS2.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A221","v":1609},{"$f":"'G. Communications and Ops Mgmt'!I221","v":2},{"$f":"'G. Communications and Ops Mgmt'!J221","v":0},{"$f":"'G. Communications and Ops Mgmt'!X221","v":0},{"$f":"'G. Communications and Ops Mgmt'!B221","v":"G.16.6"},{"$f":"'G. Communications and Ops Mgmt'!C221","v":"Sufficient information in the logs to evaluate incidents?"},{"$f":"'G. Communications and Ops Mgmt'!D221","v":0},{"$f":"'G. Communications and Ops Mgmt'!E221","v":0},{"$f":"'G. Communications and Ops Mgmt'!F221","v":"G.9 Administrative Activity Logging, G.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!G221","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!H221","v":"Event logging"},null,null,"8.2.4","N/A","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A222","v":1600},{"$f":"'G. Communications and Ops Mgmt'!I222","v":2},{"$f":"'G. Communications and Ops Mgmt'!J222","v":0},{"$f":"'G. Communications and Ops Mgmt'!X222","v":0},{"$f":"'G. Communications and Ops Mgmt'!B222","v":"G.16.7"},{"$f":"'G. Communications and Ops Mgmt'!C222","v":"Logs retained for a minimum of one year?"},{"$f":"'G. Communications and Ops Mgmt'!D222","v":0},{"$f":"'G. Communications and Ops Mgmt'!E222","v":0},{"$f":"'G. Communications and Ops Mgmt'!F222","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!G222","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!H222","v":"Protection Of Log Information"},"AI6.3","Emergency changes","8.2.5","N/A","PO2.3, PO6.2, DS11.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A223","v":1620},{"$f":"'G. Communications and Ops Mgmt'!I223","v":2},{"$f":"'G. Communications and Ops Mgmt'!J223","v":0},{"$f":"'G. Communications and Ops Mgmt'!X223","v":0},{"$f":"'G. Communications and Ops Mgmt'!B223","v":"G.16.8"},{"$f":"'G. Communications and Ops Mgmt'!C223","v":"System generated alerts in the event of an audit log failure?"},{"$f":"'G. Communications and Ops Mgmt'!D223","v":0},{"$f":"'G. Communications and Ops Mgmt'!E223","v":0},{"$f":"'G. Communications and Ops Mgmt'!F223","v":"G.9 Administrative Activity Logging, G.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!G223","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!H223","v":"Event logging"},"AI2.3","Application control and auditability","8.2.6","N/A","AI6.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A224","v":1625},{"$f":"'G. Communications and Ops Mgmt'!I224","v":2},{"$f":"'G. Communications and Ops Mgmt'!J224","v":0},{"$f":"'G. Communications and Ops Mgmt'!X224","v":0},{"$f":"'G. Communications and Ops Mgmt'!B224","v":"G.16.9"},{"$f":"'G. Communications and Ops Mgmt'!C224","v":"Audit logs protected against modification, deletion, and/or inappropriate access?"},{"$f":"'G. Communications and Ops Mgmt'!D224","v":0},{"$f":"'G. Communications and Ops Mgmt'!E224","v":0},{"$f":"'G. Communications and Ops Mgmt'!F224","v":"G.9 Administrative Activity Logging, G.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!G224","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!H224","v":"Protection Of Log Information"},"AI6.3","Emergency changes",8.3000000000000007,"N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A225","v":1633},{"$f":"'G. Communications and Ops Mgmt'!I225","v":2},{"$f":"'G. Communications and Ops Mgmt'!J225","v":0},{"$f":"'G. Communications and Ops Mgmt'!X225","v":0},{"$f":"'G. Communications and Ops Mgmt'!B225","v":"G.16.10"},{"$f":"'G. Communications and Ops Mgmt'!C225","v":"Minimum password length at least eight characters:"},{"$f":"'G. Communications and Ops Mgmt'!D225","v":0},{"$f":"'G. Communications and Ops Mgmt'!E225","v":0},{"$f":"'G. Communications and Ops Mgmt'!F225","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G225","v":"9.3.1.d"},{"$f":"'G. Communications and Ops Mgmt'!H225","v":"Use of secret authentication information"},"DS5.4","User account management","8.2.1","N/A","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A226","v":1639},{"$f":"'G. Communications and Ops Mgmt'!I226","v":2},{"$f":"'G. Communications and Ops Mgmt'!J226","v":0},{"$f":"'G. Communications and Ops Mgmt'!X226","v":0},{"$f":"'G. Communications and Ops Mgmt'!B226","v":"G.16.11"},{"$f":"'G. Communications and Ops Mgmt'!C226","v":"Complex passwords required?"},{"$f":"'G. Communications and Ops Mgmt'!D226","v":0},{"$f":"'G. Communications and Ops Mgmt'!E226","v":0},{"$f":"'G. Communications and Ops Mgmt'!F226","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G226","v":"9.3.1.d                                     9.4.3.c"},{"$f":"'G. Communications and Ops Mgmt'!H226","v":"Use of secret authentication information,                 Password management system"},null,null,3.3,"N/A","AI6.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A227","v":1644},{"$f":"'G. Communications and Ops Mgmt'!I227","v":2},{"$f":"'G. Communications and Ops Mgmt'!J227","v":0},{"$f":"'G. Communications and Ops Mgmt'!X227","v":0},{"$f":"'G. Communications and Ops Mgmt'!B227","v":"G.16.12"},{"$f":"'G. Communications and Ops Mgmt'!C227","v":"Minimum password expiration at least 90 days?"},{"$f":"'G. Communications and Ops Mgmt'!D227","v":0},{"$f":"'G. Communications and Ops Mgmt'!E227","v":0},{"$f":"'G. Communications and Ops Mgmt'!F227","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G227","v":"9.4.3.e"},{"$f":"'G. Communications and Ops Mgmt'!H227","v":"Password Management System"},null,null,3.3,"N/A","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A228","v":1649},{"$f":"'G. Communications and Ops Mgmt'!I228","v":2},{"$f":"'G. Communications and Ops Mgmt'!J228","v":0},{"$f":"'G. Communications and Ops Mgmt'!X228","v":0},{"$f":"'G. Communications and Ops Mgmt'!B228","v":"G.16.13"},{"$f":"'G. Communications and Ops Mgmt'!C228","v":"Password history of 12 before reuse?"},{"$f":"'G. Communications and Ops Mgmt'!D228","v":0},{"$f":"'G. Communications and Ops Mgmt'!E228","v":0},{"$f":"'G. Communications and Ops Mgmt'!F228","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G228","v":"9.4.3.f"},{"$f":"'G. Communications and Ops Mgmt'!H228","v":"Password Management System"},"AI2.3","Application control and auditability","8.1.1","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A229","v":2642},{"$f":"'G. Communications and Ops Mgmt'!I229","v":2},{"$f":"'G. Communications and Ops Mgmt'!J229","v":0},{"$f":"'G. Communications and Ops Mgmt'!X229","v":0},{"$f":"'G. Communications and Ops Mgmt'!B229","v":"G.16.14"},{"$f":"'G. Communications and Ops Mgmt'!C229","v":"Initial password required to be changed at first logon?"},{"$f":"'G. Communications and Ops Mgmt'!D229","v":0},{"$f":"'G. Communications and Ops Mgmt'!E229","v":0},{"$f":"'G. Communications and Ops Mgmt'!F229","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G229","v":"9.4.3.d"},{"$f":"'G. Communications and Ops Mgmt'!H229","v":"Password Management System"},"PO2.3","Data classification scheme","8.1.6","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A230","v":1668},{"$f":"'G. Communications and Ops Mgmt'!I230","v":2},{"$f":"'G. Communications and Ops Mgmt'!J230","v":0},{"$f":"'G. Communications and Ops Mgmt'!X230","v":0},{"$f":"'G. Communications and Ops Mgmt'!B230","v":"G.16.15"},{"$f":"'G. Communications and Ops Mgmt'!C230","v":"Can a PIN or secret question be a stand alone method of authentication?"},{"$f":"'G. Communications and Ops Mgmt'!D230","v":0},{"$f":"'G. Communications and Ops Mgmt'!E230","v":0},{"$f":"'G. Communications and Ops Mgmt'!F230","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G230","v":"9.4.2"},{"$f":"'G. Communications and Ops Mgmt'!H230","v":"Secure Log-On Procedures"},"DS5.4","User account management","N/A","N/A","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A231","v":1669},{"$f":"'G. Communications and Ops Mgmt'!I231","v":2},{"$f":"'G. Communications and Ops Mgmt'!J231","v":0},{"$f":"'G. Communications and Ops Mgmt'!X231","v":0},{"$f":"'G. Communications and Ops Mgmt'!B231","v":"G.16.16"},{"$f":"'G. Communications and Ops Mgmt'!C231","v":"Passwords encrypted in transit?"},{"$f":"'G. Communications and Ops Mgmt'!D231","v":0},{"$f":"'G. Communications and Ops Mgmt'!E231","v":0},{"$f":"'G. Communications and Ops Mgmt'!F231","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G231","v":"9.4.3.i"},{"$f":"'G. Communications and Ops Mgmt'!H231","v":"Password Management System"},null,null,"N/A","N/A","PO2.3, PO3.4, AI5.2, DS2.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A232","v":1670},{"$f":"'G. Communications and Ops Mgmt'!I232","v":2},{"$f":"'G. Communications and Ops Mgmt'!J232","v":0},{"$f":"'G. Communications and Ops Mgmt'!X232","v":0},{"$f":"'G. Communications and Ops Mgmt'!B232","v":"G.16.17"},{"$f":"'G. Communications and Ops Mgmt'!C232","v":"Passwords encrypted or hashed in storage?"},{"$f":"'G. Communications and Ops Mgmt'!D232","v":0},{"$f":"'G. Communications and Ops Mgmt'!E232","v":0},{"$f":"'G. Communications and Ops Mgmt'!F232","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G232","v":"9.4.3.i"},{"$f":"'G. Communications and Ops Mgmt'!H232","v":"Password Management System"},null,null,"7.2.2","N/A","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A233","v":1671},{"$f":"'G. Communications and Ops Mgmt'!I233","v":2},{"$f":"'G. Communications and Ops Mgmt'!J233","v":0},{"$f":"'G. Communications and Ops Mgmt'!X233","v":0},{"$f":"'G. Communications and Ops Mgmt'!B233","v":"G.16.18"},{"$f":"'G. Communications and Ops Mgmt'!C233","v":"Passwords displayed when entered into a system?"},{"$f":"'G. Communications and Ops Mgmt'!D233","v":0},{"$f":"'G. Communications and Ops Mgmt'!E233","v":0},{"$f":"'G. Communications and Ops Mgmt'!F233","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G233","v":"9.4.3.g"},{"$f":"'G. Communications and Ops Mgmt'!H233","v":"Password Management System"},null,null,"10.6.2","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A234","v":2643},{"$f":"'G. Communications and Ops Mgmt'!I234","v":2},{"$f":"'G. Communications and Ops Mgmt'!J234","v":0},{"$f":"'G. Communications and Ops Mgmt'!X234","v":0},{"$f":"'G. Communications and Ops Mgmt'!B234","v":"G.16.19"},{"$f":"'G. Communications and Ops Mgmt'!C234","v":"User accounts associated to a unique individual?"},{"$f":"'G. Communications and Ops Mgmt'!D234","v":0},{"$f":"'G. Communications and Ops Mgmt'!E234","v":0},{"$f":"'G. Communications and Ops Mgmt'!F234","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G234","v":"9.4.3.a"},{"$f":"'G. Communications and Ops Mgmt'!H234","v":"Password Management System"},"AI6.3","Emergency changes",10.3,"N/A","DS11.6"]
[{"$f":"'G. Communications and Ops Mgmt'!A235","v":1653},{"$f":"'G. Communications and Ops Mgmt'!I235","v":2},{"$f":"'G. Communications and Ops Mgmt'!J235","v":0},{"$f":"'G. Communications and Ops Mgmt'!X235","v":0},{"$f":"'G. Communications and Ops Mgmt'!B235","v":"G.16.20"},{"$f":"'G. Communications and Ops Mgmt'!C235","v":"Does the system lock an account when three to five invalid login attempts are made?"},{"$f":"'G. Communications and Ops Mgmt'!D235","v":0},{"$f":"'G. Communications and Ops Mgmt'!E235","v":0},{"$f":"'G. Communications and Ops Mgmt'!F235","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G235","v":"9.4.2"},{"$f":"'G. Communications and Ops Mgmt'!H235","v":"Secure Log-On Procedures"},"DS5.4","User account management",10.7,"N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A236","v":2644},{"$f":"'G. Communications and Ops Mgmt'!I236","v":2},{"$f":"'G. Communications and Ops Mgmt'!J236","v":0},{"$f":"'G. Communications and Ops Mgmt'!X236","v":0},{"$f":"'G. Communications and Ops Mgmt'!B236","v":"G.16.21"},{"$f":"'G. Communications and Ops Mgmt'!C236","v":"Users required to log off when the session is finished?"},{"$f":"'G. Communications and Ops Mgmt'!D236","v":0},{"$f":"'G. Communications and Ops Mgmt'!E236","v":0},{"$f":"'G. Communications and Ops Mgmt'!F236","v":0},{"$f":"'G. Communications and Ops Mgmt'!G236","v":"11.2.8.a"},{"$f":"'G. Communications and Ops Mgmt'!H236","v":"Unattended User Equipment"},null,null,"10.5.5","N/A","AI6.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A237","v":1672},{"$f":"'G. Communications and Ops Mgmt'!I237","v":1},{"$f":"'G. Communications and Ops Mgmt'!J237","v":0},{"$f":"'G. Communications and Ops Mgmt'!X237","v":0},{"$f":"'G. Communications and Ops Mgmt'!B237","v":"G.17"},{"$f":"'G. Communications and Ops Mgmt'!C237","v":"Is an Open VMS (VAX or Alpha) system used to transmit, process or store Scoped Systems and Data? If yes, are:"},{"$f":"'G. Communications and Ops Mgmt'!D237","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E237","v":0},{"$f":"'G. Communications and Ops Mgmt'!F237","v":0},{"$f":"'G. Communications and Ops Mgmt'!G237","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H237","v":""},"PO2.1","Enterprise information architecture model","10.5.2","N/A","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A238","v":1679},{"$f":"'G. Communications and Ops Mgmt'!I238","v":2},{"$f":"'G. Communications and Ops Mgmt'!J238","v":0},{"$f":"'G. Communications and Ops Mgmt'!X238","v":0},{"$f":"'G. Communications and Ops Mgmt'!B238","v":"G.17.1"},{"$f":"'G. Communications and Ops Mgmt'!C238","v":"Administrative privilege restricted to those responsible for VMS administration?"},{"$f":"'G. Communications and Ops Mgmt'!D238","v":0},{"$f":"'G. Communications and Ops Mgmt'!E238","v":0},{"$f":"'G. Communications and Ops Mgmt'!F238","v":0},{"$f":"'G. Communications and Ops Mgmt'!G238","v":"9.4.4.c"},{"$f":"'G. Communications and Ops Mgmt'!H238","v":"Use of privileged utility programs"},null,null,"8.2.3","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A239","v":1705},{"$f":"'G. Communications and Ops Mgmt'!I239","v":2},{"$f":"'G. Communications and Ops Mgmt'!J239","v":0},{"$f":"'G. Communications and Ops Mgmt'!X239","v":0},{"$f":"'G. Communications and Ops Mgmt'!B239","v":"G.17.2"},{"$f":"'G. Communications and Ops Mgmt'!C239","v":"Logs regularly reviewed using a specific methodology to uncover potential incidents?"},{"$f":"'G. Communications and Ops Mgmt'!D239","v":0},{"$f":"'G. Communications and Ops Mgmt'!E239","v":0},{"$f":"'G. Communications and Ops Mgmt'!F239","v":0},{"$f":"'G. Communications and Ops Mgmt'!G239","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!H239","v":"Event logging"},"PO4.11","Segregation of duties","8.2.3","IS.1.6.8 IS.2.A.1.2 IS.2.B.6 D&A.1.3.1.3 MGMT.1.2.1.4 OPS.1.5.3.3 OPS.2.12.H.3 FEDLINE.1.5.2.1 RPS.1.3.1.3","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A240","v":1707},{"$f":"'G. Communications and Ops Mgmt'!I240","v":2},{"$f":"'G. Communications and Ops Mgmt'!J240","v":0},{"$f":"'G. Communications and Ops Mgmt'!X240","v":0},{"$f":"'G. Communications and Ops Mgmt'!B240","v":"G.17.3"},{"$f":"'G. Communications and Ops Mgmt'!C240","v":"Sufficient information to investigate incidents including (failed login attempts)?"},{"$f":"'G. Communications and Ops Mgmt'!D240","v":0},{"$f":"'G. Communications and Ops Mgmt'!E240","v":0},{"$f":"'G. Communications and Ops Mgmt'!F240","v":"G.9 Administrative Activity Logging, G.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!G240","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!H240","v":"Event logging"},"DS5.10","Network security","8.2.4","IS.1.6.8 D&A.1.3.1.3","PO4.11, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A241","v":1698},{"$f":"'G. Communications and Ops Mgmt'!I241","v":2},{"$f":"'G. Communications and Ops Mgmt'!J241","v":0},{"$f":"'G. Communications and Ops Mgmt'!X241","v":0},{"$f":"'G. Communications and Ops Mgmt'!B241","v":"G.17.4"},{"$f":"'G. Communications and Ops Mgmt'!C241","v":"Logs retained for a minimum of one year?"},{"$f":"'G. Communications and Ops Mgmt'!D241","v":0},{"$f":"'G. Communications and Ops Mgmt'!E241","v":0},{"$f":"'G. Communications and Ops Mgmt'!F241","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!G241","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!H241","v":"Protection Of Log Information"},"PO4.11","Segregation of duties","8.2.5","IS.1.4.1.10, OPS.1.5.2.4","PO2.3, DS11.2, DS11.3, DS11.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A242","v":1718},{"$f":"'G. Communications and Ops Mgmt'!I242","v":2},{"$f":"'G. Communications and Ops Mgmt'!J242","v":0},{"$f":"'G. Communications and Ops Mgmt'!X242","v":0},{"$f":"'G. Communications and Ops Mgmt'!B242","v":"G.17.5"},{"$f":"'G. Communications and Ops Mgmt'!C242","v":"System generated alerts in the event of an audit log failure?"},{"$f":"'G. Communications and Ops Mgmt'!D242","v":0},{"$f":"'G. Communications and Ops Mgmt'!E242","v":0},{"$f":"'G. Communications and Ops Mgmt'!F242","v":"G.9 Administrative Activity Logging, G.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!G242","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!H242","v":"Event logging"},"PO4.11","Segregation of duties","8.2.6","IS.2.M.8","PO4.11, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A243","v":1723},{"$f":"'G. Communications and Ops Mgmt'!I243","v":2},{"$f":"'G. Communications and Ops Mgmt'!J243","v":0},{"$f":"'G. Communications and Ops Mgmt'!X243","v":0},{"$f":"'G. Communications and Ops Mgmt'!B243","v":"G.17.6"},{"$f":"'G. Communications and Ops Mgmt'!C243","v":"Are audit logs protected against modification, deletion, and/or inappropriate access?"},{"$f":"'G. Communications and Ops Mgmt'!D243","v":0},{"$f":"'G. Communications and Ops Mgmt'!E243","v":0},{"$f":"'G. Communications and Ops Mgmt'!F243","v":"G.9 Administrative Activity Logging, G.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!G243","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!H243","v":"Protection Of Log Information"},"PO4.11","Segregation of duties",8.3000000000000007,"IS.1.6.8","PO4.11, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A244","v":1731},{"$f":"'G. Communications and Ops Mgmt'!I244","v":2},{"$f":"'G. Communications and Ops Mgmt'!J244","v":0},{"$f":"'G. Communications and Ops Mgmt'!X244","v":0},{"$f":"'G. Communications and Ops Mgmt'!B244","v":"G.17.7"},{"$f":"'G. Communications and Ops Mgmt'!C244","v":"Minimum password length at least eight characters?"},{"$f":"'G. Communications and Ops Mgmt'!D244","v":0},{"$f":"'G. Communications and Ops Mgmt'!E244","v":0},{"$f":"'G. Communications and Ops Mgmt'!F244","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G244","v":"9.3.1.d"},{"$f":"'G. Communications and Ops Mgmt'!H244","v":"Use of secret authentication information"},"PO4.14","Contracted staff policies and procedures","8.2.1","IS.2.D.1","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A245","v":1737},{"$f":"'G. Communications and Ops Mgmt'!I245","v":2},{"$f":"'G. Communications and Ops Mgmt'!J245","v":0},{"$f":"'G. Communications and Ops Mgmt'!X245","v":0},{"$f":"'G. Communications and Ops Mgmt'!B245","v":"G.17.8"},{"$f":"'G. Communications and Ops Mgmt'!C245","v":"Complex passwords required?"},{"$f":"'G. Communications and Ops Mgmt'!D245","v":0},{"$f":"'G. Communications and Ops Mgmt'!E245","v":0},{"$f":"'G. Communications and Ops Mgmt'!F245","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G245","v":"9.3.1.d                                     9.4.3.c"},{"$f":"'G. Communications and Ops Mgmt'!H245","v":"Use of secret authentication information,                 Password management system"},"PO4.14","Contracted staff policies and procedures",3.3,"N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A246","v":1742},{"$f":"'G. Communications and Ops Mgmt'!I246","v":2},{"$f":"'G. Communications and Ops Mgmt'!J246","v":0},{"$f":"'G. Communications and Ops Mgmt'!X246","v":0},{"$f":"'G. Communications and Ops Mgmt'!B246","v":"G.17.9"},{"$f":"'G. Communications and Ops Mgmt'!C246","v":"Minimum password expiration at least every 90 days?"},{"$f":"'G. Communications and Ops Mgmt'!D246","v":0},{"$f":"'G. Communications and Ops Mgmt'!E246","v":0},{"$f":"'G. Communications and Ops Mgmt'!F246","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G246","v":"9.4.3.e"},{"$f":"'G. Communications and Ops Mgmt'!H246","v":"Password Management System"},null,null,3.3,"N/A","PO4.14, PO6.2, DS9.2, DS9.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A247","v":1747},{"$f":"'G. Communications and Ops Mgmt'!I247","v":2},{"$f":"'G. Communications and Ops Mgmt'!J247","v":0},{"$f":"'G. Communications and Ops Mgmt'!X247","v":0},{"$f":"'G. Communications and Ops Mgmt'!B247","v":"G.17.10"},{"$f":"'G. Communications and Ops Mgmt'!C247","v":"Password history of 12 before reuse?"},{"$f":"'G. Communications and Ops Mgmt'!D247","v":0},{"$f":"'G. Communications and Ops Mgmt'!E247","v":0},{"$f":"'G. Communications and Ops Mgmt'!F247","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G247","v":"9.4.3.f"},{"$f":"'G. Communications and Ops Mgmt'!H247","v":"Password Management System"},"DS5.3","Identity management","8.1.1","N/A","PO4.14, PO6.2, DS9.2, DS9.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A248","v":2646},{"$f":"'G. Communications and Ops Mgmt'!I248","v":2},{"$f":"'G. Communications and Ops Mgmt'!J248","v":0},{"$f":"'G. Communications and Ops Mgmt'!X248","v":0},{"$f":"'G. Communications and Ops Mgmt'!B248","v":"G.17.11"},{"$f":"'G. Communications and Ops Mgmt'!C248","v":"Initial password required to be changed at first logon?"},{"$f":"'G. Communications and Ops Mgmt'!D248","v":0},{"$f":"'G. Communications and Ops Mgmt'!E248","v":0},{"$f":"'G. Communications and Ops Mgmt'!F248","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G248","v":"9.4.3.d"},{"$f":"'G. Communications and Ops Mgmt'!H248","v":"Password Management System"},"DS5.9","Malicious software prevention, detection and correction","8.1.6","N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A249","v":1766},{"$f":"'G. Communications and Ops Mgmt'!I249","v":2},{"$f":"'G. Communications and Ops Mgmt'!J249","v":0},{"$f":"'G. Communications and Ops Mgmt'!X249","v":0},{"$f":"'G. Communications and Ops Mgmt'!B249","v":"G.17.12"},{"$f":"'G. Communications and Ops Mgmt'!C249","v":"Can a PIN or secret question be a stand alone method of authentication?"},{"$f":"'G. Communications and Ops Mgmt'!D249","v":0},{"$f":"'G. Communications and Ops Mgmt'!E249","v":0},{"$f":"'G. Communications and Ops Mgmt'!F249","v":0},{"$f":"'G. Communications and Ops Mgmt'!G249","v":"9.4.2"},{"$f":"'G. Communications and Ops Mgmt'!H249","v":"Secure Log-On Procedures"},"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","DS11.6"]
[{"$f":"'G. Communications and Ops Mgmt'!A250","v":1767},{"$f":"'G. Communications and Ops Mgmt'!I250","v":2},{"$f":"'G. Communications and Ops Mgmt'!J250","v":0},{"$f":"'G. Communications and Ops Mgmt'!X250","v":0},{"$f":"'G. Communications and Ops Mgmt'!B250","v":"G.17.13"},{"$f":"'G. Communications and Ops Mgmt'!C250","v":"Passwords encrypted in transit?"},{"$f":"'G. Communications and Ops Mgmt'!D250","v":0},{"$f":"'G. Communications and Ops Mgmt'!E250","v":0},{"$f":"'G. Communications and Ops Mgmt'!F250","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G250","v":"9.4.3.i"},{"$f":"'G. Communications and Ops Mgmt'!H250","v":"Password Management System"},"PO6.2","Enterprise IT risk and internal control framework","N/A","IS.2.B.10.6","DS5.9"]
[{"$f":"'G. Communications and Ops Mgmt'!A251","v":1768},{"$f":"'G. Communications and Ops Mgmt'!I251","v":2},{"$f":"'G. Communications and Ops Mgmt'!J251","v":0},{"$f":"'G. Communications and Ops Mgmt'!X251","v":0},{"$f":"'G. Communications and Ops Mgmt'!B251","v":"G.17.14"},{"$f":"'G. Communications and Ops Mgmt'!C251","v":"Passwords encrypted or hashed in storage?"},{"$f":"'G. Communications and Ops Mgmt'!D251","v":0},{"$f":"'G. Communications and Ops Mgmt'!E251","v":0},{"$f":"'G. Communications and Ops Mgmt'!F251","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G251","v":"9.4.3.i"},{"$f":"'G. Communications and Ops Mgmt'!H251","v":"Password Management System"},"PO6.2","Enterprise IT risk and internal control framework","4.1.1","N/A","PO6.2, DS5.2, DS5.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A252","v":1769},{"$f":"'G. Communications and Ops Mgmt'!I252","v":2},{"$f":"'G. Communications and Ops Mgmt'!J252","v":0},{"$f":"'G. Communications and Ops Mgmt'!X252","v":0},{"$f":"'G. Communications and Ops Mgmt'!B252","v":"G.17.15"},{"$f":"'G. Communications and Ops Mgmt'!C252","v":"Passwords displayed when entered into a system?"},{"$f":"'G. Communications and Ops Mgmt'!D252","v":0},{"$f":"'G. Communications and Ops Mgmt'!E252","v":0},{"$f":"'G. Communications and Ops Mgmt'!F252","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G252","v":"9.4.3.g"},{"$f":"'G. Communications and Ops Mgmt'!H252","v":"Password Management System"},null,null,8.1999999999999993,"N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A253","v":2647},{"$f":"'G. Communications and Ops Mgmt'!I253","v":2},{"$f":"'G. Communications and Ops Mgmt'!J253","v":0},{"$f":"'G. Communications and Ops Mgmt'!X253","v":0},{"$f":"'G. Communications and Ops Mgmt'!B253","v":"G.17.16"},{"$f":"'G. Communications and Ops Mgmt'!C253","v":"User accounts associated to a unique individual?"},{"$f":"'G. Communications and Ops Mgmt'!D253","v":0},{"$f":"'G. Communications and Ops Mgmt'!E253","v":0},{"$f":"'G. Communications and Ops Mgmt'!F253","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G253","v":"9.4.3.a"},{"$f":"'G. Communications and Ops Mgmt'!H253","v":"Password Management System"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A254","v":1751},{"$f":"'G. Communications and Ops Mgmt'!I254","v":2},{"$f":"'G. Communications and Ops Mgmt'!J254","v":0},{"$f":"'G. Communications and Ops Mgmt'!X254","v":0},{"$f":"'G. Communications and Ops Mgmt'!B254","v":"G.17.17"},{"$f":"'G. Communications and Ops Mgmt'!C254","v":"Does the system lock an account when three to five invalid login attempts are made?"},{"$f":"'G. Communications and Ops Mgmt'!D254","v":0},{"$f":"'G. Communications and Ops Mgmt'!E254","v":0},{"$f":"'G. Communications and Ops Mgmt'!F254","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!G254","v":"9.4.2"},{"$f":"'G. Communications and Ops Mgmt'!H254","v":"Secure Log-On Procedures"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A255","v":1770},{"$f":"'G. Communications and Ops Mgmt'!I255","v":1},{"$f":"'G. Communications and Ops Mgmt'!J255","v":0},{"$f":"'G. Communications and Ops Mgmt'!X255","v":1},{"$f":"'G. Communications and Ops Mgmt'!B255","v":"G.18"},{"$f":"'G. Communications and Ops Mgmt'!C255","v":"Are Web services provided? If yes, are:"},{"$f":"'G. Communications and Ops Mgmt'!D255","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E255","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F255","v":0},{"$f":"'G. Communications and Ops Mgmt'!G255","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H255","v":""},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A256","v":2649},{"$f":"'G. Communications and Ops Mgmt'!I256","v":2},{"$f":"'G. Communications and Ops Mgmt'!J256","v":0},{"$f":"'G. Communications and Ops Mgmt'!X256","v":0},{"$f":"'G. Communications and Ops Mgmt'!B256","v":"G.18.1"},{"$f":"'G. Communications and Ops Mgmt'!C256","v":"Electronic commerce web sites or applications used to transmit, process or store Scoped Systems and Data?"},{"$f":"'G. Communications and Ops Mgmt'!D256","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E256","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F256","v":"G.13 Website – Client Encryption"},{"$f":"'G. Communications and Ops Mgmt'!G256","v":"14.1.2"},{"$f":"'G. Communications and Ops Mgmt'!H256","v":"Securing application services on public networks"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A257","v":2650},{"$f":"'G. Communications and Ops Mgmt'!I257","v":3},{"$f":"'G. Communications and Ops Mgmt'!J257","v":0},{"$f":"'G. Communications and Ops Mgmt'!X257","v":0},{"$f":"'G. Communications and Ops Mgmt'!B257","v":"G.18.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C257","v":"Cryptographic controls used for the electronic commerce application (SSL)?"},{"$f":"'G. Communications and Ops Mgmt'!D257","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E257","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F257","v":"G.13 Website – Client Encryption"},{"$f":"'G. Communications and Ops Mgmt'!G257","v":"14.1.2"},{"$f":"'G. Communications and Ops Mgmt'!H257","v":"Securing application services on public networks"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A258","v":2651},{"$f":"'G. Communications and Ops Mgmt'!I258","v":3},{"$f":"'G. Communications and Ops Mgmt'!J258","v":0},{"$f":"'G. Communications and Ops Mgmt'!X258","v":0},{"$f":"'G. Communications and Ops Mgmt'!B258","v":"G.18.1.2"},{"$f":"'G. Communications and Ops Mgmt'!C258","v":"Users required to authenticate to the application?"},{"$f":"'G. Communications and Ops Mgmt'!D258","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E258","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F258","v":"G.13 Website – Client Encryption"},{"$f":"'G. Communications and Ops Mgmt'!G258","v":"14.1.3"},{"$f":"'G. Communications and Ops Mgmt'!H258","v":"Protecting application services transactions"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A259","v":2652},{"$f":"'G. Communications and Ops Mgmt'!I259","v":3},{"$f":"'G. Communications and Ops Mgmt'!J259","v":0},{"$f":"'G. Communications and Ops Mgmt'!X259","v":0},{"$f":"'G. Communications and Ops Mgmt'!B259","v":"G.18.1.3"},{"$f":"'G. Communications and Ops Mgmt'!C259","v":"Transaction details stored in the DMZ?"},{"$f":"'G. Communications and Ops Mgmt'!D259","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E259","v":0},{"$f":"'G. Communications and Ops Mgmt'!F259","v":0},{"$f":"'G. Communications and Ops Mgmt'!G259","v":"14.1.3.e"},{"$f":"'G. Communications and Ops Mgmt'!H259","v":"Protecting application services transactions"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A260","v":1771},{"$f":"'G. Communications and Ops Mgmt'!I260","v":2},{"$f":"'G. Communications and Ops Mgmt'!J260","v":0},{"$f":"'G. Communications and Ops Mgmt'!X260","v":0},{"$f":"'G. Communications and Ops Mgmt'!B260","v":"G.18.2"},{"$f":"'G. Communications and Ops Mgmt'!C260","v":"Is Windows IIS for these Web services used? If yes, is:"},{"$f":"'G. Communications and Ops Mgmt'!D260","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E260","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F260","v":0},{"$f":"'G. Communications and Ops Mgmt'!G260","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H260","v":""},null,null,10.3]
[{"$f":"'G. Communications and Ops Mgmt'!A261","v":1772},{"$f":"'G. Communications and Ops Mgmt'!I261","v":3},{"$f":"'G. Communications and Ops Mgmt'!J261","v":0},{"$f":"'G. Communications and Ops Mgmt'!X261","v":0},{"$f":"'G. Communications and Ops Mgmt'!B261","v":"G.18.2.1"},{"$f":"'G. Communications and Ops Mgmt'!C261","v":"Anonymous access to FTP disabled?"},{"$f":"'G. Communications and Ops Mgmt'!D261","v":0},{"$f":"'G. Communications and Ops Mgmt'!E261","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F261","v":0},{"$f":"'G. Communications and Ops Mgmt'!G261","v":"13.2.2"},{"$f":"'G. Communications and Ops Mgmt'!H261","v":"Agreements on information transfer"},null,null,"6.3.1, 6.4.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A262","v":1773},{"$f":"'G. Communications and Ops Mgmt'!I262","v":3},{"$f":"'G. Communications and Ops Mgmt'!J262","v":0},{"$f":"'G. Communications and Ops Mgmt'!X262","v":0},{"$f":"'G. Communications and Ops Mgmt'!B262","v":"G.18.2.2"},{"$f":"'G. Communications and Ops Mgmt'!C262","v":"Membership to the IIS Administrators group restricted to those with web administration roles and responsibilities?"},{"$f":"'G. Communications and Ops Mgmt'!D262","v":0},{"$f":"'G. Communications and Ops Mgmt'!E262","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F262","v":0},{"$f":"'G. Communications and Ops Mgmt'!G262","v":"9.2.3.b"},{"$f":"'G. Communications and Ops Mgmt'!H262","v":"management of privileged access rights"},null,null,"7.1.2"]
[{"$f":"'G. Communications and Ops Mgmt'!A263","v":1774},{"$f":"'G. Communications and Ops Mgmt'!I263","v":3},{"$f":"'G. Communications and Ops Mgmt'!J263","v":0},{"$f":"'G. Communications and Ops Mgmt'!X263","v":0},{"$f":"'G. Communications and Ops Mgmt'!B263","v":"G.18.2.3"},{"$f":"'G. Communications and Ops Mgmt'!C263","v":"Dedicated virtual directory structure used for each website?"},{"$f":"'G. Communications and Ops Mgmt'!D263","v":0},{"$f":"'G. Communications and Ops Mgmt'!E263","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F263","v":0},{"$f":"'G. Communications and Ops Mgmt'!G263","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!H263","v":"Segregation In Networks"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A264","v":1776},{"$f":"'G. Communications and Ops Mgmt'!I264","v":3},{"$f":"'G. Communications and Ops Mgmt'!J264","v":0},{"$f":"'G. Communications and Ops Mgmt'!X264","v":0},{"$f":"'G. Communications and Ops Mgmt'!B264","v":"G.18.2.4"},{"$f":"'G. Communications and Ops Mgmt'!C264","v":"Unused services turned off on IIS servers?"},{"$f":"'G. Communications and Ops Mgmt'!D264","v":0},{"$f":"'G. Communications and Ops Mgmt'!E264","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F264","v":0},{"$f":"'G. Communications and Ops Mgmt'!G264","v":"9.4.4.h"},{"$f":"'G. Communications and Ops Mgmt'!H264","v":"Use of privileged utility programs"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A265","v":1777},{"$f":"'G. Communications and Ops Mgmt'!I265","v":3},{"$f":"'G. Communications and Ops Mgmt'!J265","v":0},{"$f":"'G. Communications and Ops Mgmt'!X265","v":0},{"$f":"'G. Communications and Ops Mgmt'!B265","v":"G.18.2.5"},{"$f":"'G. Communications and Ops Mgmt'!C265","v":"Services running on standard ports?"},{"$f":"'G. Communications and Ops Mgmt'!D265","v":0},{"$f":"'G. Communications and Ops Mgmt'!E265","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F265","v":0},{"$f":"'G. Communications and Ops Mgmt'!G265","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H265","v":""},null,null,10.3]
[{"$f":"'G. Communications and Ops Mgmt'!A266","v":1778},{"$f":"'G. Communications and Ops Mgmt'!I266","v":3},{"$f":"'G. Communications and Ops Mgmt'!J266","v":0},{"$f":"'G. Communications and Ops Mgmt'!X266","v":0},{"$f":"'G. Communications and Ops Mgmt'!B266","v":"G.18.2.6"},{"$f":"'G. Communications and Ops Mgmt'!C266","v":"Logging configured to support incident investigation?"},{"$f":"'G. Communications and Ops Mgmt'!D266","v":0},{"$f":"'G. Communications and Ops Mgmt'!E266","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F266","v":0},{"$f":"'G. Communications and Ops Mgmt'!G266","v":12.4},{"$f":"'G. Communications and Ops Mgmt'!H266","v":"Logging and monitoring"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A267","v":1779},{"$f":"'G. Communications and Ops Mgmt'!I267","v":3},{"$f":"'G. Communications and Ops Mgmt'!J267","v":0},{"$f":"'G. Communications and Ops Mgmt'!X267","v":0},{"$f":"'G. Communications and Ops Mgmt'!B267","v":"G.18.2.7"},{"$f":"'G. Communications and Ops Mgmt'!C267","v":"Sample applications and scripts removed?"},{"$f":"'G. Communications and Ops Mgmt'!D267","v":0},{"$f":"'G. Communications and Ops Mgmt'!E267","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F267","v":0},{"$f":"'G. Communications and Ops Mgmt'!G267","v":"9.4.4.h"},{"$f":"'G. Communications and Ops Mgmt'!H267","v":"Use of privileged utility programs"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A268","v":1780},{"$f":"'G. Communications and Ops Mgmt'!I268","v":3},{"$f":"'G. Communications and Ops Mgmt'!J268","v":0},{"$f":"'G. Communications and Ops Mgmt'!X268","v":0},{"$f":"'G. Communications and Ops Mgmt'!B268","v":"G.18.2.8"},{"$f":"'G. Communications and Ops Mgmt'!C268","v":"Least privilege used when setting IIS content permissions?"},{"$f":"'G. Communications and Ops Mgmt'!D268","v":0},{"$f":"'G. Communications and Ops Mgmt'!E268","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F268","v":0},{"$f":"'G. Communications and Ops Mgmt'!G268","v":"9.1.1"},{"$f":"'G. Communications and Ops Mgmt'!H268","v":"Access Control Policy"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A269","v":1781},{"$f":"'G. Communications and Ops Mgmt'!I269","v":3},{"$f":"'G. Communications and Ops Mgmt'!J269","v":0},{"$f":"'G. Communications and Ops Mgmt'!X269","v":0},{"$f":"'G. Communications and Ops Mgmt'!B269","v":"G.18.2.9"},{"$f":"'G. Communications and Ops Mgmt'!C269","v":"Content folder on the same drive as the operating system?"},{"$f":"'G. Communications and Ops Mgmt'!D269","v":0},{"$f":"'G. Communications and Ops Mgmt'!E269","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"'G. Communications and Ops Mgmt'!F269","v":0},{"$f":"'G. Communications and Ops Mgmt'!G269","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H269","v":""},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A270","v":1782},{"$f":"'G. Communications and Ops Mgmt'!I270","v":2},{"$f":"'G. Communications and Ops Mgmt'!J270","v":0},{"$f":"'G. Communications and Ops Mgmt'!X270","v":0},{"$f":"'G. Communications and Ops Mgmt'!B270","v":"G.18.3"},{"$f":"'G. Communications and Ops Mgmt'!C270","v":"Is Apache used for these Web services? If yes, is:"},{"$f":"'G. Communications and Ops Mgmt'!D270","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E270","v":0},{"$f":"'G. Communications and Ops Mgmt'!F270","v":0},{"$f":"'G. Communications and Ops Mgmt'!G270","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H270","v":""},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A271","v":1783},{"$f":"'G. Communications and Ops Mgmt'!I271","v":3},{"$f":"'G. Communications and Ops Mgmt'!J271","v":0},{"$f":"'G. Communications and Ops Mgmt'!X271","v":0},{"$f":"'G. Communications and Ops Mgmt'!B271","v":"G.18.3.1"},{"$f":"'G. Communications and Ops Mgmt'!C271","v":"Logging configured to support incident investigation?"},{"$f":"'G. Communications and Ops Mgmt'!D271","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E271","v":0},{"$f":"'G. Communications and Ops Mgmt'!F271","v":0},{"$f":"'G. Communications and Ops Mgmt'!G271","v":12.4},{"$f":"'G. Communications and Ops Mgmt'!H271","v":"Logging and monitoring"},null,null,"6.3.1, 6.4.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A272","v":1784},{"$f":"'G. Communications and Ops Mgmt'!I272","v":3},{"$f":"'G. Communications and Ops Mgmt'!J272","v":0},{"$f":"'G. Communications and Ops Mgmt'!X272","v":0},{"$f":"'G. Communications and Ops Mgmt'!B272","v":"G.18.3.2"},{"$f":"'G. Communications and Ops Mgmt'!C272","v":"Anonymous access to FTP disabled?"},{"$f":"'G. Communications and Ops Mgmt'!D272","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E272","v":0},{"$f":"'G. Communications and Ops Mgmt'!F272","v":0},{"$f":"'G. Communications and Ops Mgmt'!G272","v":"13.2.2"},{"$f":"'G. Communications and Ops Mgmt'!H272","v":"Agreements on information transfer"},null,null,"7.1.2"]
[{"$f":"'G. Communications and Ops Mgmt'!A273","v":1785},{"$f":"'G. Communications and Ops Mgmt'!I273","v":3},{"$f":"'G. Communications and Ops Mgmt'!J273","v":0},{"$f":"'G. Communications and Ops Mgmt'!X273","v":0},{"$f":"'G. Communications and Ops Mgmt'!B273","v":"G.18.3.3"},{"$f":"'G. Communications and Ops Mgmt'!C273","v":"Membership to the Apache group restricted to those with web administration roles and responsibilities?"},{"$f":"'G. Communications and Ops Mgmt'!D273","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E273","v":0},{"$f":"'G. Communications and Ops Mgmt'!F273","v":0},{"$f":"'G. Communications and Ops Mgmt'!G273","v":"9.2.3.b"},{"$f":"'G. Communications and Ops Mgmt'!H273","v":"management of privileged access rights"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A274","v":1786},{"$f":"'G. Communications and Ops Mgmt'!I274","v":3},{"$f":"'G. Communications and Ops Mgmt'!J274","v":0},{"$f":"'G. Communications and Ops Mgmt'!X274","v":0},{"$f":"'G. Communications and Ops Mgmt'!B274","v":"G.18.3.4"},{"$f":"'G. Communications and Ops Mgmt'!C274","v":"Dedicated virtual directory structure used for each website?"},{"$f":"'G. Communications and Ops Mgmt'!D274","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E274","v":0},{"$f":"'G. Communications and Ops Mgmt'!F274","v":0},{"$f":"'G. Communications and Ops Mgmt'!G274","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!H274","v":"Segregation In Networks"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A275","v":1787},{"$f":"'G. Communications and Ops Mgmt'!I275","v":3},{"$f":"'G. Communications and Ops Mgmt'!J275","v":0},{"$f":"'G. Communications and Ops Mgmt'!X275","v":0},{"$f":"'G. Communications and Ops Mgmt'!B275","v":"G.18.3.5"},{"$f":"'G. Communications and Ops Mgmt'!C275","v":"Configuration options restricted to authorized users?"},{"$f":"'G. Communications and Ops Mgmt'!D275","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E275","v":0},{"$f":"'G. Communications and Ops Mgmt'!F275","v":0},{"$f":"'G. Communications and Ops Mgmt'!G275","v":"9.1.1"},{"$f":"'G. Communications and Ops Mgmt'!H275","v":"Access Control Policy"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A276","v":1788},{"$f":"'G. Communications and Ops Mgmt'!I276","v":3},{"$f":"'G. Communications and Ops Mgmt'!J276","v":0},{"$f":"'G. Communications and Ops Mgmt'!X276","v":0},{"$f":"'G. Communications and Ops Mgmt'!B276","v":"G.18.3.6"},{"$f":"'G. Communications and Ops Mgmt'!C276","v":"Services run on standard ports?"},{"$f":"'G. Communications and Ops Mgmt'!D276","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E276","v":0},{"$f":"'G. Communications and Ops Mgmt'!F276","v":0},{"$f":"'G. Communications and Ops Mgmt'!G276","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H276","v":""},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A277","v":1789},{"$f":"'G. Communications and Ops Mgmt'!I277","v":3},{"$f":"'G. Communications and Ops Mgmt'!J277","v":0},{"$f":"'G. Communications and Ops Mgmt'!X277","v":0},{"$f":"'G. Communications and Ops Mgmt'!B277","v":"G.18.3.7"},{"$f":"'G. Communications and Ops Mgmt'!C277","v":"Sample applications and scripts removed?"},{"$f":"'G. Communications and Ops Mgmt'!D277","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E277","v":0},{"$f":"'G. Communications and Ops Mgmt'!F277","v":0},{"$f":"'G. Communications and Ops Mgmt'!G277","v":"9.4.4.h"},{"$f":"'G. Communications and Ops Mgmt'!H277","v":"Use of privileged utility programs"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A278","v":1790},{"$f":"'G. Communications and Ops Mgmt'!I278","v":3},{"$f":"'G. Communications and Ops Mgmt'!J278","v":0},{"$f":"'G. Communications and Ops Mgmt'!X278","v":0},{"$f":"'G. Communications and Ops Mgmt'!B278","v":"G.18.3.8"},{"$f":"'G. Communications and Ops Mgmt'!C278","v":"Least privilege used when setting permissions?"},{"$f":"'G. Communications and Ops Mgmt'!D278","v":"Yes"},{"$f":"'G. Communications and Ops Mgmt'!E278","v":0},{"$f":"'G. Communications and Ops Mgmt'!F278","v":"H.3 Logical Access Authorization"},{"$f":"'G. Communications and Ops Mgmt'!G278","v":"9.1.1"},{"$f":"'G. Communications and Ops Mgmt'!H278","v":"Access Control Policy"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A279","v":1791},{"$f":"'G. Communications and Ops Mgmt'!I279","v":1},{"$f":"'G. Communications and Ops Mgmt'!J279","v":0},{"$f":"'G. Communications and Ops Mgmt'!X279","v":0},{"$f":"'G. Communications and Ops Mgmt'!B279","v":"G.19"},{"$f":"'G. Communications and Ops Mgmt'!C279","v":"Are desktop computers used to transmit, process or store Scoped Systems and Data. If yes, is:"},{"$f":"'G. Communications and Ops Mgmt'!D279","v":"No"},{"$f":"'G. Communications and Ops Mgmt'!E279","v":0},{"$f":"'G. Communications and Ops Mgmt'!F279","v":0},{"$f":"'G. Communications and Ops Mgmt'!G279","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H279","v":""},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A280","v":842},{"$f":"'G. Communications and Ops Mgmt'!I280","v":2},{"$f":"'G. Communications and Ops Mgmt'!J280","v":0},{"$f":"'G. Communications and Ops Mgmt'!X280","v":0},{"$f":"'G. Communications and Ops Mgmt'!B280","v":"G.19.1"},{"$f":"'G. Communications and Ops Mgmt'!C280","v":"Segregation of duties for granting access and approving access?"},{"$f":"'G. Communications and Ops Mgmt'!D280","v":0},{"$f":"'G. Communications and Ops Mgmt'!E280","v":0},{"$f":"'G. Communications and Ops Mgmt'!F280","v":0},{"$f":"'G. Communications and Ops Mgmt'!G280","v":"9.1.1.f"},{"$f":"'G. Communications and Ops Mgmt'!H280","v":"Access Control Policy"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A281","v":845},{"$f":"'G. Communications and Ops Mgmt'!I281","v":2},{"$f":"'G. Communications and Ops Mgmt'!J281","v":0},{"$f":"'G. Communications and Ops Mgmt'!X281","v":0},{"$f":"'G. Communications and Ops Mgmt'!B281","v":"G.19.2"},{"$f":"'G. Communications and Ops Mgmt'!C281","v":"Segregation of duties for approving and implementing access requests?"},{"$f":"'G. Communications and Ops Mgmt'!D281","v":0},{"$f":"'G. Communications and Ops Mgmt'!E281","v":0},{"$f":"'G. Communications and Ops Mgmt'!F281","v":0},{"$f":"'G. Communications and Ops Mgmt'!G281","v":"6.1.2 "},{"$f":"'G. Communications and Ops Mgmt'!H281","v":"Segregation Of Duties"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A282","v":2954},{"$f":"'G. Communications and Ops Mgmt'!I282","v":2},{"$f":"'G. Communications and Ops Mgmt'!J282","v":0},{"$f":"'G. Communications and Ops Mgmt'!X282","v":0},{"$f":"'G. Communications and Ops Mgmt'!B282","v":"G.19.3"},{"$f":"'G. Communications and Ops Mgmt'!C282","v":"User able to use removable media (floppy disk, recordable CD, USB drive) without detection?"},{"$f":"'G. Communications and Ops Mgmt'!D282","v":0},{"$f":"'G. Communications and Ops Mgmt'!E282","v":0},{"$f":"'G. Communications and Ops Mgmt'!F282","v":0},{"$f":"'G. Communications and Ops Mgmt'!G282","v":"8.3.1.b"},{"$f":"'G. Communications and Ops Mgmt'!H282","v":"Management of removable media"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A283","v":843},{"$f":"'G. Communications and Ops Mgmt'!I283","v":2},{"$f":"'G. Communications and Ops Mgmt'!J283","v":0},{"$f":"'G. Communications and Ops Mgmt'!X283","v":0},{"$f":"'G. Communications and Ops Mgmt'!B283","v":"G.19.4"},{"$f":"'G. Communications and Ops Mgmt'!C283","v":"User of a system also responsible for reviewing its security audit logs?"},{"$f":"'G. Communications and Ops Mgmt'!D283","v":0},{"$f":"'G. Communications and Ops Mgmt'!E283","v":0},{"$f":"'G. Communications and Ops Mgmt'!F283","v":0},{"$f":"'G. Communications and Ops Mgmt'!G283","v":"6.1.2 "},{"$f":"'G. Communications and Ops Mgmt'!H283","v":"Segregation Of Duties"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A284","v":844},{"$f":"'G. Communications and Ops Mgmt'!I284","v":2},{"$f":"'G. Communications and Ops Mgmt'!J284","v":0},{"$f":"'G. Communications and Ops Mgmt'!X284","v":0},{"$f":"'G. Communications and Ops Mgmt'!B284","v":"G.19.5"},{"$f":"'G. Communications and Ops Mgmt'!C284","v":"Segregation of duties to prevent the user of a system from modifying or deleting its security audit logs?"},{"$f":"'G. Communications and Ops Mgmt'!D284","v":0},{"$f":"'G. Communications and Ops Mgmt'!E284","v":0},{"$f":"'G. Communications and Ops Mgmt'!F284","v":0},{"$f":"'G. Communications and Ops Mgmt'!G284","v":"6.1.2 "},{"$f":"'G. Communications and Ops Mgmt'!H284","v":"Segregation Of Duties"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A285","v":1792},{"$f":"'G. Communications and Ops Mgmt'!I285","v":2},{"$f":"'G. Communications and Ops Mgmt'!J285","v":0},{"$f":"'G. Communications and Ops Mgmt'!X285","v":0},{"$f":"'G. Communications and Ops Mgmt'!B285","v":"G.19.6"},{"$f":"'G. Communications and Ops Mgmt'!C285","v":"Standard operating environment required?"},{"$f":"'G. Communications and Ops Mgmt'!D285","v":0},{"$f":"'G. Communications and Ops Mgmt'!E285","v":0},{"$f":"'G. Communications and Ops Mgmt'!F285","v":0},{"$f":"'G. Communications and Ops Mgmt'!G285","v":"13.1.1.e"},{"$f":"'G. Communications and Ops Mgmt'!H285","v":"Network Controls"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A286","v":1013},{"$f":"'G. Communications and Ops Mgmt'!I286","v":2},{"$f":"'G. Communications and Ops Mgmt'!J286","v":0},{"$f":"'G. Communications and Ops Mgmt'!X286","v":0},{"$f":"'G. Communications and Ops Mgmt'!B286","v":"G.19.7"},{"$f":"'G. Communications and Ops Mgmt'!C286","v":"Content filtering proxy used prior to accessing the Internet?"},{"$f":"'G. Communications and Ops Mgmt'!D286","v":0},{"$f":"'G. Communications and Ops Mgmt'!E286","v":0},{"$f":"'G. Communications and Ops Mgmt'!F286","v":0},{"$f":"'G. Communications and Ops Mgmt'!G286","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H286","v":"Network Routing Control"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A287","v":1793},{"$f":"'G. Communications and Ops Mgmt'!I287","v":2},{"$f":"'G. Communications and Ops Mgmt'!J287","v":0},{"$f":"'G. Communications and Ops Mgmt'!X287","v":0},{"$f":"'G. Communications and Ops Mgmt'!B287","v":"G.19.8"},{"$f":"'G. Communications and Ops Mgmt'!C287","v":"Security approval required prior to implementing non-standard operating equipment?"},{"$f":"'G. Communications and Ops Mgmt'!D287","v":0},{"$f":"'G. Communications and Ops Mgmt'!E287","v":0},{"$f":"'G. Communications and Ops Mgmt'!F287","v":0},{"$f":"'G. Communications and Ops Mgmt'!G287","v":"13.1.1"},{"$f":"'G. Communications and Ops Mgmt'!H287","v":"Network Controls"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A288","v":1794},{"$f":"'G. Communications and Ops Mgmt'!I288","v":2},{"$f":"'G. Communications and Ops Mgmt'!J288","v":0},{"$f":"'G. Communications and Ops Mgmt'!X288","v":0},{"$f":"'G. Communications and Ops Mgmt'!B288","v":"G.19.9"},{"$f":"'G. Communications and Ops Mgmt'!C288","v":"Security approval required prior to implementing freeware or shareware applications?"},{"$f":"'G. Communications and Ops Mgmt'!D288","v":0},{"$f":"'G. Communications and Ops Mgmt'!E288","v":0},{"$f":"'G. Communications and Ops Mgmt'!F288","v":0},{"$f":"'G. Communications and Ops Mgmt'!G288","v":"13.1.1"},{"$f":"'G. Communications and Ops Mgmt'!H288","v":"Network Controls"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A289","v":1797},{"$f":"'G. Communications and Ops Mgmt'!I289","v":2},{"$f":"'G. Communications and Ops Mgmt'!J289","v":0},{"$f":"'G. Communications and Ops Mgmt'!X289","v":0},{"$f":"'G. Communications and Ops Mgmt'!B289","v":"G.19.10"},{"$f":"'G. Communications and Ops Mgmt'!C289","v":"Non-company managed PCs used to connect to the company network?"},{"$f":"'G. Communications and Ops Mgmt'!D289","v":0},{"$f":"'G. Communications and Ops Mgmt'!E289","v":0},{"$f":"'G. Communications and Ops Mgmt'!F289","v":0},{"$f":"'G. Communications and Ops Mgmt'!G289","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!H289","v":""},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A290","v":1798},{"$f":"'G. Communications and Ops Mgmt'!I290","v":2},{"$f":"'G. Communications and Ops Mgmt'!J290","v":0},{"$f":"'G. Communications and Ops Mgmt'!X290","v":0},{"$f":"'G. Communications and Ops Mgmt'!B290","v":"G.19.11"},{"$f":"'G. Communications and Ops Mgmt'!C290","v":"Installation of software on company-owned equipment (workstations, mobile devices) restricted to administrators?"},{"$f":"'G. Communications and Ops Mgmt'!D290","v":0},{"$f":"'G. Communications and Ops Mgmt'!E290","v":0},{"$f":"'G. Communications and Ops Mgmt'!F290","v":0},{"$f":"'G. Communications and Ops Mgmt'!G290","v":"13.1.1"},{"$f":"'G. Communications and Ops Mgmt'!H290","v":"Network Controls"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A291","v":2653},{"$f":"'G. Communications and Ops Mgmt'!I291","v":2},{"$f":"'G. Communications and Ops Mgmt'!J291","v":0},{"$f":"'G. Communications and Ops Mgmt'!X291","v":0},{"$f":"'G. Communications and Ops Mgmt'!B291","v":"G.19.12"},{"$f":"'G. Communications and Ops Mgmt'!C291","v":"Users permitted to execute mobile code?"},{"$f":"'G. Communications and Ops Mgmt'!D291","v":0},{"$f":"'G. Communications and Ops Mgmt'!E291","v":0},{"$f":"'G. Communications and Ops Mgmt'!F291","v":0},{"$f":"'G. Communications and Ops Mgmt'!G291","v":"12.2.1"},{"$f":"'G. Communications and Ops Mgmt'!H291","v":"Controls against malware"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A292","v":1803},{"$f":"'G. Communications and Ops Mgmt'!I292","v":2},{"$f":"'G. Communications and Ops Mgmt'!J292","v":0},{"$f":"'G. Communications and Ops Mgmt'!X292","v":0},{"$f":"'G. Communications and Ops Mgmt'!B292","v":"G.19.13"},{"$f":"'G. Communications and Ops Mgmt'!C292","v":"Mobile devices used?"},{"$f":"'G. Communications and Ops Mgmt'!D292","v":0},{"$f":"'G. Communications and Ops Mgmt'!E292","v":0},{"$f":"'G. Communications and Ops Mgmt'!F292","v":0},{"$f":"'G. Communications and Ops Mgmt'!G292","v":"6.2.1"},{"$f":"'G. Communications and Ops Mgmt'!H292","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A293","v":1805},{"$f":"'G. Communications and Ops Mgmt'!I293","v":2},{"$f":"'G. Communications and Ops Mgmt'!J293","v":0},{"$f":"'G. Communications and Ops Mgmt'!X293","v":0},{"$f":"'G. Communications and Ops Mgmt'!B293","v":"G.19.14"},{"$f":"'G. Communications and Ops Mgmt'!C293","v":"Encryption used to secure mobile computing devices?"},{"$f":"'G. Communications and Ops Mgmt'!D293","v":0},{"$f":"'G. Communications and Ops Mgmt'!E293","v":0},{"$f":"'G. Communications and Ops Mgmt'!F293","v":0},{"$f":"'G. Communications and Ops Mgmt'!G293","v":"6.2.1.g"},{"$f":"'G. Communications and Ops Mgmt'!H293","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A310","v":0},{"$f":"'G. Communications and Ops Mgmt'!I310","v":0},{"$f":"'G. Communications and Ops Mgmt'!J310","v":0},{"$f":"'G. Communications and Ops Mgmt'!X310","v":0},{"$f":"'G. Communications and Ops Mgmt'!B310","v":0},{"$f":"'G. Communications and Ops Mgmt'!C310","v":0},{"$f":"'G. Communications and Ops Mgmt'!D310","v":0},{"$f":"'G. Communications and Ops Mgmt'!E310","v":0},{"$f":"'G. Communications and Ops Mgmt'!F310","v":0},{"$f":"'G. Communications and Ops Mgmt'!G310","v":0},{"$f":"'G. Communications and Ops Mgmt'!H310","v":0}]
[]
[{"$f":"'H. Access Control'!B1","v":"H. Access Control"},null,null,null,{"$f":"'H. Access Control'!B1","v":"H. Access Control"}]
[{"$f":"'H. Access Control'!A5","v":1998},{"$f":"'H. Access Control'!I5","v":1},{"$f":"'H. Access Control'!J5","v":0},{"$f":"'H. Access Control'!X5","v":1},{"$f":"'H. Access Control'!B5","v":"H.1"},{"$f":"'H. Access Control'!C5","v":"Are electronic systems used to transmit, process or store Scoped Systems and Data?"},{"$f":"'H. Access Control'!D5","v":"Yes"},{"$f":"'H. Access Control'!E5","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'H. Access Control'!F5","v":0},{"$f":"'H. Access Control'!G5","v":"NA"},{"$f":"'H. Access Control'!H5","v":""},null,null,"N/A","N/A","N/A"]
[{"$f":"'H. Access Control'!A6","v":1903},{"$f":"'H. Access Control'!I6","v":2},{"$f":"'H. Access Control'!J6","v":0},{"$f":"'H. Access Control'!X6","v":0},{"$f":"'H. Access Control'!B6","v":"H.1.1"},{"$f":"'H. Access Control'!C6","v":"Is there an access control policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"'H. Access Control'!D6","v":"Yes"},{"$f":"'H. Access Control'!E6","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'H. Access Control'!F6","v":"B.1 Information Security Policy Content"},{"$f":"'H. Access Control'!G6","v":"9.1.1"},{"$f":"'H. Access Control'!H6","v":"Access control policy"},"PO2.1","Enterprise information architecture model",7.3,"IS.1.4.1.1 IS.2.A.1 IS.2.G.4 OPS.1.5.1.2 E-BANK.1.4.2.9","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'H. Access Control'!A7","v":1908},{"$f":"'H. Access Control'!I7","v":2},{"$f":"'H. Access Control'!J7","v":0},{"$f":"'H. Access Control'!X7","v":0},{"$f":"'H. Access Control'!B7","v":"H.1.2"},{"$f":"'H. Access Control'!C7","v":"Does access control on applications, operating systems, databases, and network devices ensure users have least privilege?"},{"$f":"'H. Access Control'!D7","v":"Yes"},{"$f":"'H. Access Control'!E7","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'H. Access Control'!F7","v":0},{"$f":"'H. Access Control'!G7","v":"9.1.1.b"},{"$f":"'H. Access Control'!H7","v":"Access control policy"},"PO2.1","Enterprise information architecture model",7.2,"IS.1.4.1.3.2 IS.1.4.1.3.3 IS.2.A.1.1 IS.2.A.2.2 IS.2.B.8","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'H. Access Control'!A8","v":1911},{"$f":"'H. Access Control'!I8","v":1},{"$f":"'H. Access Control'!J8","v":0},{"$f":"'H. Access Control'!X8","v":1},{"$f":"'H. Access Control'!B8","v":"H.2"},{"$f":"'H. Access Control'!C8","v":"Are unique user IDs used for access?"},{"$f":"'H. Access Control'!D8","v":"Yes"},{"$f":"'H. Access Control'!E8","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'H. Access Control'!F8","v":0},{"$f":"'H. Access Control'!G8","v":"9.2.1.a"},{"$f":"'H. Access Control'!H8","v":"User registration and de-registration"},"DS5.4","User account management","8.1.1","IS.2.A.2.1 IS.2.A.2.3 IS.2.A.4.7&\" \"&","DS5.4"]
[{"$f":"'H. Access Control'!A9","v":1913},{"$f":"'H. Access Control'!I9","v":2},{"$f":"'H. Access Control'!J9","v":0},{"$f":"'H. Access Control'!X9","v":0},{"$f":"'H. Access Control'!B9","v":"H.2.1"},{"$f":"'H. Access Control'!C9","v":"Can a user ID contain personal information (SSN, access level, admin of the user)?"},{"$f":"'H. Access Control'!D9","v":"No"},{"$f":"'H. Access Control'!E9","v":0},{"$f":"'H. Access Control'!F9","v":0},{"$f":"'H. Access Control'!G9","v":"9.4.3.c"},{"$f":"'H. Access Control'!H9","v":"Password Management System"},null,null,"8.2.1","E-BANK.1.4.5.13","N/A"]
[{"$f":"'H. Access Control'!A10","v":3205},{"$f":"'H. Access Control'!I10","v":2},{"$f":"'H. Access Control'!J10","v":0},{"$f":"'H. Access Control'!X10","v":0},{"$f":"'H. Access Control'!B10","v":"H.2.2"},{"$f":"'H. Access Control'!C10","v":"Is an inactive user ID deleted or disabled within 90 days?"},{"$f":"'H. Access Control'!D10","v":"No"},{"$f":"'H. Access Control'!E10","v":0},{"$f":"'H. Access Control'!F10","v":"H.4 Inactive Accounts"},{"$f":"'H. Access Control'!G10","v":"9.2.6"},{"$f":"'H. Access Control'!H10","v":"Removal or adjustment of access rights"},null,null,"8.1.4","IS.2.A.5.1","N/A"]
[{"$f":"'H. Access Control'!A11","v":1915},{"$f":"'H. Access Control'!I11","v":2},{"$f":"'H. Access Control'!J11","v":0},{"$f":"'H. Access Control'!X11","v":0},{"$f":"'H. Access Control'!B11","v":"H.2.3"},{"$f":"'H. Access Control'!C11","v":"Can a user ID be shared?"},{"$f":"'H. Access Control'!D11","v":"No"},{"$f":"'H. Access Control'!E11","v":0},{"$f":"'H. Access Control'!F11","v":0},{"$f":"'H. Access Control'!G11","v":"9.3.1.e"},{"$f":"'H. Access Control'!H11","v":"Use of secret authentication information"},"DS5.4","User account management",8.5,"N/A","DS5.4"]
[{"$f":"'H. Access Control'!A12","v":1916},{"$f":"'H. Access Control'!I12","v":2},{"$f":"'H. Access Control'!J12","v":0},{"$f":"'H. Access Control'!X12","v":0},{"$f":"'H. Access Control'!B12","v":"H.2.4"},{"$f":"'H. Access Control'!C12","v":"Is there a process to grant and approve access to systems transmitting, processing or storing Scoped Systems and Data?"},{"$f":"'H. Access Control'!D12","v":"Yes"},{"$f":"'H. Access Control'!E12","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'H. Access Control'!F12","v":0},{"$f":"'H. Access Control'!G12","v":"9.1.2.b"},{"$f":"'H. Access Control'!H12","v":"Access to networks and network services"},"DS5.4","User account management","8.1.2","IS.2.C.6 AUDIT.2.D.1.13 AUDIT.2.D.1.15","DS5.4"]
[{"$f":"'H. Access Control'!A13","v":3206},{"$f":"'H. Access Control'!I13","v":3},{"$f":"'H. Access Control'!J13","v":0},{"$f":"'H. Access Control'!X13","v":0},{"$f":"'H. Access Control'!B13","v":"H.2.4.1"},{"$f":"'H. Access Control'!C13","v":"Does access to electronic systems include a formal request and management approval?"},{"$f":"'H. Access Control'!D13","v":"Yes"},{"$f":"'H. Access Control'!E13","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'H. Access Control'!F13","v":"H.3 Logical Access Authorization"},{"$f":"'H. Access Control'!G13","v":"9.1.2.b"},{"$f":"'H. Access Control'!H13","v":"Access to networks and network services"},"DS5.4","User account management","8.1.2","IS.2.C.6 AUDIT.2.D.1.13 AUDIT.2.D.1.15","DS5.4"]
[{"$f":"'H. Access Control'!A14","v":1922},{"$f":"'H. Access Control'!I14","v":3},{"$f":"'H. Access Control'!J14","v":0},{"$f":"'H. Access Control'!X14","v":0},{"$f":"'H. Access Control'!B14","v":"H.2.4.2"},{"$f":"'H. Access Control'!C14","v":"Are approved requests for granting access logged, archived and maintained?"},{"$f":"'H. Access Control'!D14","v":"Yes"},{"$f":"'H. Access Control'!E14","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'H. Access Control'!F14","v":0},{"$f":"'H. Access Control'!G14","v":"9.2.5.e"},{"$f":"'H. Access Control'!H14","v":"Review of user access rights"},"DS5.4","User account management","8.1.2","N/A","DS5.4"]
[{"$f":"'H. Access Control'!A15","v":1939},{"$f":"'H. Access Control'!I15","v":2},{"$f":"'H. Access Control'!J15","v":1},{"$f":"'H. Access Control'!X15","v":0},{"$f":"'H. Access Control'!B15","v":"H.2.5"},{"$f":"'H. Access Control'!C15","v":"Is system access limited by:"},{"$f":"'H. Access Control'!D15","v":0},{"$f":"'H. Access Control'!E15","v":0},{"$f":"'H. Access Control'!F15","v":0},{"$f":"'H. Access Control'!G15","v":"9.4.1"},{"$f":"'H. Access Control'!H15","v":"Information access restriction"},"DS5.4","User account management",7.1,"N/A","DS5.4"]
[{"$f":"'H. Access Control'!A16","v":1940},{"$f":"'H. Access Control'!I16","v":3},{"$f":"'H. Access Control'!J16","v":0},{"$f":"'H. Access Control'!X16","v":0},{"$f":"'H. Access Control'!B16","v":"H.2.5.1"},{"$f":"'H. Access Control'!C16","v":"Time of day?"},{"$f":"'H. Access Control'!D16","v":"No"},{"$f":"'H. Access Control'!E16","v":0},{"$f":"'H. Access Control'!F16","v":0},{"$f":"'H. Access Control'!G16","v":"NA"},{"$f":"'H. Access Control'!H16","v":0},"DS5.3","Identity management","N/A","WPS.2.9.4.2","DS5.7"]
[{"$f":"'H. Access Control'!A17","v":1943},{"$f":"'H. Access Control'!I17","v":3},{"$f":"'H. Access Control'!J17","v":0},{"$f":"'H. Access Control'!X17","v":0},{"$f":"'H. Access Control'!B17","v":"H.2.5.2"},{"$f":"'H. Access Control'!C17","v":"Physical location?"},{"$f":"'H. Access Control'!D17","v":"No"},{"$f":"'H. Access Control'!E17","v":0},{"$f":"'H. Access Control'!F17","v":0},{"$f":"'H. Access Control'!G17","v":"NA"},{"$f":"'H. Access Control'!H17","v":""},null,null,"N/A","N/A","N/A"]
[{"$f":"'H. Access Control'!A18","v":1945},{"$f":"'H. Access Control'!I18","v":3},{"$f":"'H. Access Control'!J18","v":0},{"$f":"'H. Access Control'!X18","v":0},{"$f":"'H. Access Control'!B18","v":"H.2.5.3"},{"$f":"'H. Access Control'!C18","v":"Network subnet?"},{"$f":"'H. Access Control'!D18","v":"No"},{"$f":"'H. Access Control'!E18","v":0},{"$f":"'H. Access Control'!F18","v":0},{"$f":"'H. Access Control'!G18","v":"NA"},{"$f":"'H. Access Control'!H18","v":""},null,null,"N/A","N/A","N/A"]
[{"$f":"'H. Access Control'!A19","v":3207},{"$f":"'H. Access Control'!I19","v":2},{"$f":"'H. Access Control'!J19","v":0},{"$f":"'H. Access Control'!X19","v":0},{"$f":"'H. Access Control'!B19","v":"H.2.6"},{"$f":"'H. Access Control'!C19","v":"Are user access rights reviewed at least quarterly?"},{"$f":"'H. Access Control'!D19","v":"Yes"},{"$f":"'H. Access Control'!E19","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'H. Access Control'!F19","v":0},{"$f":"'H. Access Control'!G19","v":"9.2.5.a"},{"$f":"'H. Access Control'!H19","v":"Review Of User Access Rights"},"DS5.4","User account management","10.6.2","IS.2.A.5","DS5.4"]
[{"$f":"'H. Access Control'!A20","v":2654},{"$f":"'H. Access Control'!I20","v":2},{"$f":"'H. Access Control'!J20","v":0},{"$f":"'H. Access Control'!X20","v":0},{"$f":"'H. Access Control'!B20","v":"H.2.7"},{"$f":"'H. Access Control'!C20","v":"Are access rights reviewed when a constituent changes roles?"},{"$f":"'H. Access Control'!D20","v":"Yes"},{"$f":"'H. Access Control'!E20","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'H. Access Control'!F20","v":0},{"$f":"'H. Access Control'!G20","v":"9.2.5.b"},{"$f":"'H. Access Control'!H20","v":"Review Of User Access Rights"},"DS5.4","User account management","N/A","IS.2.A.5.2","DS5.4"]
[{"$f":"'H. Access Control'!A21","v":2655},{"$f":"'H. Access Control'!I21","v":2},{"$f":"'H. Access Control'!J21","v":0},{"$f":"'H. Access Control'!X21","v":0},{"$f":"'H. Access Control'!B21","v":"H.2.8"},{"$f":"'H. Access Control'!C21","v":"Are reviews of privileged systems conducted to ensure unauthorized privileges have not been obtained?"},{"$f":"'H. Access Control'!D21","v":"Yes"},{"$f":"'H. Access Control'!E21","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'H. Access Control'!F21","v":0},{"$f":"'H. Access Control'!G21","v":"9.2.5.d"},{"$f":"'H. Access Control'!H21","v":"Review Of User Access Rights"},"DS5.4","User account management","12.5.5","IS.2.A.1.3","DS5.4"]
[{"$f":"'H. Access Control'!A22","v":3208},{"$f":"'H. Access Control'!I22","v":2},{"$f":"'H. Access Control'!J22","v":0},{"$f":"'H. Access Control'!X22","v":0},{"$f":"'H. Access Control'!B22","v":"H.2.9"},{"$f":"'H. Access Control'!C22","v":"Are privileged user access rights reviewed at least quarterly?"},{"$f":"'H. Access Control'!D22","v":"Yes"},{"$f":"'H. Access Control'!E22","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'H. Access Control'!F22","v":0},{"$f":"'H. Access Control'!G22","v":"9.2.5.c"},{"$f":"'H. Access Control'!H22","v":"Review Of User Access Rights"},"DS5.4","User account management","N/A","IS.2.A.4","DS5.4"]
[{"$f":"'H. Access Control'!A23","v":2656},{"$f":"'H. Access Control'!I23","v":2},{"$f":"'H. Access Control'!J23","v":0},{"$f":"'H. Access Control'!X23","v":0},{"$f":"'H. Access Control'!B23","v":"H.2.10"},{"$f":"'H. Access Control'!C23","v":"Are changes to privileged user access rights logged?"},{"$f":"'H. Access Control'!D23","v":"Yes"},{"$f":"'H. Access Control'!E23","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'H. Access Control'!F23","v":0},{"$f":"'H. Access Control'!G23","v":"9.2.5.e"},{"$f":"'H. Access Control'!H23","v":"Review Of User Access Rights"},"DS5.4","User account management",6.4,"IS.2.A.2","DS5.4"]
[{"$f":"'H. Access Control'!A24","v":3209},{"$f":"'H. Access Control'!I24","v":2},{"$f":"'H. Access Control'!J24","v":0},{"$f":"'H. Access Control'!X24","v":0},{"$f":"'H. Access Control'!B24","v":"H.2.11"},{"$f":"'H. Access Control'!C24","v":"Are there logon banners for all electronic systems access?"},{"$f":"'H. Access Control'!D24","v":"No"},{"$f":"'H. Access Control'!E24","v":0},{"$f":"'H. Access Control'!F24","v":"L.1 Presence of Log-on Banners"},{"$f":"'H. Access Control'!G24","v":"9.4.2.b"},{"$f":"'H. Access Control'!H24","v":"Secure Log-On Procedures"},"DS5.3","Identity management","N/A","IS.2.A.8 IS.2.B.16 IS.2.C.11 IS.2.G.6","DS5.4, DS5.7"]
[{"$f":"'H. Access Control'!A25","v":2006},{"$f":"'H. Access Control'!I25","v":2},{"$f":"'H. Access Control'!J25","v":0},{"$f":"'H. Access Control'!X25","v":0},{"$f":"'H. Access Control'!B25","v":"H.2.12"},{"$f":"'H. Access Control'!C25","v":"Upon logon failure, does the error message describe the cause of the failure to the user (Invalid password, invalid user ID, etc.)?"},{"$f":"'H. Access Control'!D25","v":"Yes"},{"$f":"'H. Access Control'!E25","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'H. Access Control'!F25","v":0},{"$f":"'H. Access Control'!G25","v":"9.4.2.d"},{"$f":"'H. Access Control'!H25","v":"Secure Log-On Procedures"},"DS5.3","Identity management","N/A","IS.2.A.8","DS5.4, DS5.7"]
[{"$f":"'H. Access Control'!A26","v":2007},{"$f":"'H. Access Control'!I26","v":2},{"$f":"'H. Access Control'!J26","v":0},{"$f":"'H. Access Control'!X26","v":0},{"$f":"'H. Access Control'!B26","v":"H.2.13"},{"$f":"'H. Access Control'!C26","v":"Upon successful logon, does a message indicate the last time of successful logon?"},{"$f":"'H. Access Control'!D26","v":"No"},{"$f":"'H. Access Control'!E26","v":0},{"$f":"'H. Access Control'!F26","v":0},{"$f":"'H. Access Control'!G26","v":"9.4.2.h"},{"$f":"'H. Access Control'!H26","v":"Secure Log-On Procedures"},"DS5.3","Identity management","N/A","N/A","DS5.4, DS5.7"]
[{"$f":"'H. Access Control'!A27","v":1910},{"$f":"'H. Access Control'!I27","v":2},{"$f":"'H. Access Control'!J27","v":0},{"$f":"'H. Access Control'!X27","v":0},{"$f":"'H. Access Control'!B27","v":"H.2.14"},{"$f":"'H. Access Control'!C27","v":"Is multi-factor authentication deployed for “high-risk” environments?"},{"$f":"'H. Access Control'!D27","v":"Yes"},{"$f":"'H. Access Control'!E27","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'H. Access Control'!F27","v":0},{"$f":"'H. Access Control'!G27","v":"9.1.2.e"},{"$f":"'H. Access Control'!H27","v":"Access to networks and network services"},"DS5.3","Identity management",8.3000000000000007,"IS.2.A.4.5 E-BANK.1.4.4.1","DS5.3"]
[{"$f":"'H. Access Control'!A28","v":1912},{"$f":"'H. Access Control'!I28","v":2},{"$f":"'H. Access Control'!J28","v":0},{"$f":"'H. Access Control'!X28","v":0},{"$f":"'H. Access Control'!B28","v":"H.2.15"},{"$f":"'H. Access Control'!C28","v":"Do all users have a unique user ID when accessing applications?"},{"$f":"'H. Access Control'!D28","v":"Yes"},{"$f":"'H. Access Control'!E28","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'H. Access Control'!F28","v":0},{"$f":"'H. Access Control'!G28","v":"9.2.1.a"},{"$f":"'H. Access Control'!H28","v":"User registration and de-registration"},"DS5.3","Identity management","8.1.1","E-BANK.1.4.6.1","DS5.3"]
[{"$f":"'H. Access Control'!A29","v":2657},{"$f":"'H. Access Control'!I29","v":2},{"$f":"'H. Access Control'!J29","v":0},{"$f":"'H. Access Control'!X29","v":0},{"$f":"'H. Access Control'!B29","v":"H.2.16"},{"$f":"'H. Access Control'!C29","v":"Is the use of system utilities restricted to authorized users only?"},{"$f":"'H. Access Control'!D29","v":"Yes"},{"$f":"'H. Access Control'!E29","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'H. Access Control'!F29","v":0},{"$f":"'H. Access Control'!G29","v":"9.4.4"},{"$f":"'H. Access Control'!H29","v":"Use of privileged utility programs"},"AI6.3","Emergency changes","N/A","IS.2.A.1.4 IS.2.C.7","AI6.3, DS5.7"]
[{"$f":"'H. Access Control'!A30","v":3210},{"$f":"'H. Access Control'!I30","v":2},{"$f":"'H. Access Control'!J30","v":0},{"$f":"'H. Access Control'!X30","v":0},{"$f":"'H. Access Control'!B30","v":"H.2.17"},{"$f":"'H. Access Control'!C30","v":"Do inactive workstation lock within 15 minutes?"},{"$f":"'H. Access Control'!D30","v":"Yes"},{"$f":"'H. Access Control'!E30","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'H. Access Control'!F30","v":"H.5 Controls for Unattended Systems"},{"$f":"'H. Access Control'!G30","v":"9.4.2.k"},{"$f":"'H. Access Control'!H30","v":"Secure Log-On Procedures"},"DS5.3","Identity management","8.1.8","IS.2.D.6","DS5.7"]
[{"$f":"'H. Access Control'!A31","v":3211},{"$f":"'H. Access Control'!I31","v":2},{"$f":"'H. Access Control'!J31","v":0},{"$f":"'H. Access Control'!X31","v":0},{"$f":"'H. Access Control'!B31","v":"H.2.18"},{"$f":"'H. Access Control'!C31","v":"Do inactive sessions timeout within 15 minutes?"},{"$f":"'H. Access Control'!D31","v":"Yes"},{"$f":"'H. Access Control'!E31","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'H. Access Control'!F31","v":"H.5 Controls for Unattended Systems"},{"$f":"'H. Access Control'!G31","v":"9.4.2.k"},{"$f":"'H. Access Control'!H31","v":"Secure Log-On Procedures"},"DS5.3","Identity management","8.1.6","IS.2.D.6 WPS.2.9.4.1 RPS.2.C.3","DS5.7"]
[{"$f":"'H. Access Control'!A32","v":1948},{"$f":"'H. Access Control'!I32","v":1},{"$f":"'H. Access Control'!J32","v":0},{"$f":"'H. Access Control'!X32","v":1},{"$f":"'H. Access Control'!B32","v":"H.3"},{"$f":"'H. Access Control'!C32","v":"Are passwords required to access systems transmitting, processing or storing Scoped Systems and Data?"},{"$f":"'H. Access Control'!D32","v":"Yes"},{"$f":"'H. Access Control'!E32","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'H. Access Control'!F32","v":"H.1 Access Controls"},{"$f":"'H. Access Control'!G32","v":"9.4.3"},{"$f":"'H. Access Control'!H32","v":"Password Management System"},"DS5.3","Identity management",8.1,"N/A","DS5.3"]
[{"$f":"'H. Access Control'!A33","v":1949},{"$f":"'H. Access Control'!I33","v":2},{"$f":"'H. Access Control'!J33","v":0},{"$f":"'H. Access Control'!X33","v":0},{"$f":"'H. Access Control'!B33","v":"H.3.1"},{"$f":"'H. Access Control'!C33","v":"Is there a password policy for systems that transmit, process or store Scoped Systems and Data that has been approved by management and communicated to appropriate constituents? If yes, does it include:"},{"$f":"'H. Access Control'!D33","v":"Yes"},{"$f":"'H. Access Control'!E33","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'H. Access Control'!F33","v":"B.1 Information Security Policy Content"},{"$f":"'H. Access Control'!G33","v":"9.4.3"},{"$f":"'H. Access Control'!H33","v":"Password Management System"},"DS5.3","Identity management",8.1,"IS.2.A.14","DS5.3"]
[{"$f":"'H. Access Control'!A34","v":2661},{"$f":"'H. Access Control'!I34","v":3},{"$f":"'H. Access Control'!J34","v":0},{"$f":"'H. Access Control'!X34","v":0},{"$f":"'H. Access Control'!B34","v":"H.3.1.1"},{"$f":"'H. Access Control'!C34","v":"Keep passwords confidential?"},{"$f":"'H. Access Control'!D34","v":"Yes"},{"$f":"'H. Access Control'!E34","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'H. Access Control'!F34","v":"B.1 Information Security Policy Content"},{"$f":"'H. Access Control'!G34","v":"9.3.1.a"},{"$f":"'H. Access Control'!H34","v":"User responsibilities"},"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, DS5.4"]
[{"$f":"'H. Access Control'!A35","v":2662},{"$f":"'H. Access Control'!I35","v":3},{"$f":"'H. Access Control'!J35","v":0},{"$f":"'H. Access Control'!X35","v":0},{"$f":"'H. Access Control'!B35","v":"H.3.1.2"},{"$f":"'H. Access Control'!C35","v":"Not keep a record of passwords (paper, software file or handheld device)?"},{"$f":"'H. Access Control'!D35","v":"Yes"},{"$f":"'H. Access Control'!E35","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'H. Access Control'!F35","v":"B.1 Information Security Policy Content"},{"$f":"'H. Access Control'!G35","v":"9.3.1.b"},{"$f":"'H. Access Control'!H35","v":"User responsibilities"},"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, DS5.4"]
[{"$f":"'H. Access Control'!A36","v":1977},{"$f":"'H. Access Control'!I36","v":3},{"$f":"'H. Access Control'!J36","v":0},{"$f":"'H. Access Control'!X36","v":0},{"$f":"'H. Access Control'!B36","v":"H.3.1.3"},{"$f":"'H. Access Control'!C36","v":"Change passwords when there is an indication of possible system or password compromise?"},{"$f":"'H. Access Control'!D36","v":"Yes"},{"$f":"'H. Access Control'!E36","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'H. Access Control'!F36","v":"B.1 Information Security Policy Content"},{"$f":"'H. Access Control'!G36","v":"9.3.1.c"},{"$f":"'H. Access Control'!H36","v":"User responsibilities"},"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, DS5.4"]
[{"$f":"'H. Access Control'!A37","v":1978},{"$f":"'H. Access Control'!I37","v":3},{"$f":"'H. Access Control'!J37","v":0},{"$f":"'H. Access Control'!X37","v":0},{"$f":"'H. Access Control'!B37","v":"H.3.1.4"},{"$f":"'H. Access Control'!C37","v":"Change passwords at regular intervals?"},{"$f":"'H. Access Control'!D37","v":"Yes"},{"$f":"'H. Access Control'!E37","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'H. Access Control'!F37","v":"B.1 Information Security Policy Content"},{"$f":"'H. Access Control'!G37","v":"9.4.3.e"},{"$f":"'H. Access Control'!H37","v":"Password Management System"},"PO6.2","Enterprise IT risk and internal control framework","8.2.4","IS.2.A.4.3 E-BANK.1.4.5.5 RPS.2.C.3","PO6.2, DS5.4"]
[{"$f":"'H. Access Control'!A38","v":2663},{"$f":"'H. Access Control'!I38","v":3},{"$f":"'H. Access Control'!J38","v":0},{"$f":"'H. Access Control'!X38","v":0},{"$f":"'H. Access Control'!B38","v":"H.3.1.5"},{"$f":"'H. Access Control'!C38","v":"Change temporary passwords at first logon?"},{"$f":"'H. Access Control'!D38","v":"Yes"},{"$f":"'H. Access Control'!E38","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'H. Access Control'!F38","v":"B.1 Information Security Policy Content"},{"$f":"'H. Access Control'!G38","v":"9.4.3.d"},{"$f":"'H. Access Control'!H38","v":"Password Management System"},"PO6.2","Enterprise IT risk and internal control framework","8.2.6","E-BANK.1.4.5.9","PO6.2, DS5.4"]
[{"$f":"'H. Access Control'!A39","v":1979},{"$f":"'H. Access Control'!I39","v":3},{"$f":"'H. Access Control'!J39","v":0},{"$f":"'H. Access Control'!X39","v":0},{"$f":"'H. Access Control'!B39","v":"H.3.1.6"},{"$f":"'H. Access Control'!C39","v":"Not include passwords in automated logon processes? (stored in a macro or function key)?"},{"$f":"'H. Access Control'!D39","v":"Yes"},{"$f":"'H. Access Control'!E39","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'H. Access Control'!F39","v":"B.1 Information Security Policy Content"},{"$f":"'H. Access Control'!G39","v":"9.3.1.f"},{"$f":"'H. Access Control'!H39","v":"User responsibilities"},"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, DS5.4"]
[{"$f":"'H. Access Control'!A40","v":1981},{"$f":"'H. Access Control'!I40","v":3},{"$f":"'H. Access Control'!J40","v":0},{"$f":"'H. Access Control'!X40","v":0},{"$f":"'H. Access Control'!B40","v":"H.3.1.7"},{"$f":"'H. Access Control'!C40","v":"Terminate or secure active sessions when finished?"},{"$f":"'H. Access Control'!D40","v":"Yes"},{"$f":"'H. Access Control'!E40","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'H. Access Control'!F40","v":"B.1 Information Security Policy Content"},{"$f":"'H. Access Control'!G40","v":"11.2.8.a"},{"$f":"'H. Access Control'!H40","v":"Unattended User Equipment"},"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, DS5.7"]
[{"$f":"'H. Access Control'!A41","v":2664},{"$f":"'H. Access Control'!I41","v":3},{"$f":"'H. Access Control'!J41","v":0},{"$f":"'H. Access Control'!X41","v":0},{"$f":"'H. Access Control'!B41","v":"H.3.1.8"},{"$f":"'H. Access Control'!C41","v":"Logoff terminals, PC or servers when the session is finished?"},{"$f":"'H. Access Control'!D41","v":"Yes"},{"$f":"'H. Access Control'!E41","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'H. Access Control'!F41","v":"B.1 Information Security Policy Content"},{"$f":"'H. Access Control'!G41","v":"11.2.8.b"},{"$f":"'H. Access Control'!H41","v":"Unattended User Equipment"},"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, DS5.7"]
[{"$f":"'H. Access Control'!A42","v":1980},{"$f":"'H. Access Control'!I42","v":3},{"$f":"'H. Access Control'!J42","v":0},{"$f":"'H. Access Control'!X42","v":0},{"$f":"'H. Access Control'!B42","v":"H.3.1.9"},{"$f":"'H. Access Control'!C42","v":"Lock (using key lock or equivalent control) when systems are unattended?"},{"$f":"'H. Access Control'!D42","v":"Yes"},{"$f":"'H. Access Control'!E42","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'H. Access Control'!F42","v":"B.1 Information Security Policy Content"},{"$f":"'H. Access Control'!G42","v":"11.2.8.c"},{"$f":"'H. Access Control'!H42","v":"Unattended User Equipment"},"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, DS5.7"]
[{"$f":"'H. Access Control'!A43","v":1974},{"$f":"'H. Access Control'!I43","v":3},{"$f":"'H. Access Control'!J43","v":0},{"$f":"'H. Access Control'!X43","v":0},{"$f":"'H. Access Control'!B43","v":"H.3.1.10"},{"$f":"'H. Access Control'!C43","v":"Prohibit users from sharing passwords?"},{"$f":"'H. Access Control'!D43","v":"Yes"},{"$f":"'H. Access Control'!E43","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'H. Access Control'!F43","v":"B.1 Information Security Policy Content"},{"$f":"'H. Access Control'!G43","v":"9.3.1.g"},{"$f":"'H. Access Control'!H43","v":"User responsibilities"},"DS5.3","Identity management","N/A","IS.2.A.4.1","DS5.3"]
[{"$f":"'H. Access Control'!A44","v":1975},{"$f":"'H. Access Control'!I44","v":2},{"$f":"'H. Access Control'!J44","v":0},{"$f":"'H. Access Control'!X44","v":0},{"$f":"'H. Access Control'!B44","v":"H.3.2"},{"$f":"'H. Access Control'!C44","v":"Are strong passwords required on systems transmitting, processing storing Scoped Systems and Data?"},{"$f":"'H. Access Control'!D44","v":"Yes"},{"$f":"'H. Access Control'!E44","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'H. Access Control'!F44","v":"B.1 Information Security Policy Content"},{"$f":"'H. Access Control'!G44","v":"9.3.1.d,                                    9.4.3.c"},{"$f":"'H. Access Control'!H44","v":"Use of secret authentication information,                                    Password management system"},"DS5.3","Identity management","8.2.3","IS.2.A.4.4 RPS.1.2.2.2 RPS.2.C.2.4","DS5.3"]
[{"$f":"'H. Access Control'!A45","v":2008},{"$f":"'H. Access Control'!I45","v":2},{"$f":"'H. Access Control'!J45","v":0},{"$f":"'H. Access Control'!X45","v":0},{"$f":"'H. Access Control'!B45","v":"H.3.3"},{"$f":"'H. Access Control'!C45","v":"Are password files and application system data stored in different file systems?"},{"$f":"'H. Access Control'!D45","v":"Yes"},{"$f":"'H. Access Control'!E45","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'H. Access Control'!F45","v":"B.1 Information Security Policy Content"},{"$f":"'H. Access Control'!G45","v":"9.4.3.h"},{"$f":"'H. Access Control'!H45","v":"Password Management System"},"DS5.3","Identity management","N/A","IS.2.A.6","DS5.4"]
[{"$f":"'H. Access Control'!A46","v":3212},{"$f":"'H. Access Control'!I46","v":2},{"$f":"'H. Access Control'!J46","v":0},{"$f":"'H. Access Control'!X46","v":0},{"$f":"'H. Access Control'!B46","v":"H.3.4"},{"$f":"'H. Access Control'!C46","v":"Are user ID and passwords communicated/distributed via separate media (e-mail and phone)?"},{"$f":"'H. Access Control'!D46","v":"Yes"},{"$f":"'H. Access Control'!E46","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'H. Access Control'!F46","v":"B.1 Information Security Policy Content"},{"$f":"'H. Access Control'!G46","v":"9.2.4.d "},{"$f":"'H. Access Control'!H46","v":"Management of secret authentication information for users"},null,null,"N/A","IS.2.A.2.6 E-BANK.1.4.5.7","N/A"]
[{"$f":"'H. Access Control'!A47","v":1964},{"$f":"'H. Access Control'!I47","v":2},{"$f":"'H. Access Control'!J47","v":0},{"$f":"'H. Access Control'!X47","v":0},{"$f":"'H. Access Control'!B47","v":"H.3.5"},{"$f":"'H. Access Control'!C47","v":"Are new constituents issued random initial single use passwords?"},{"$f":"'H. Access Control'!D47","v":"Yes"},{"$f":"'H. Access Control'!E47","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'H. Access Control'!F47","v":"B.1 Information Security Policy Content"},{"$f":"'H. Access Control'!G47","v":"9.4.3.b"},{"$f":"'H. Access Control'!H47","v":"Password Management System"},"DS5.3","Identity management","8.2.6","N/A","DS5.3"]
[{"$f":"'H. Access Control'!A48","v":3213},{"$f":"'H. Access Control'!I48","v":2},{"$f":"'H. Access Control'!J48","v":0},{"$f":"'H. Access Control'!X48","v":0},{"$f":"'H. Access Control'!B48","v":"H.3.6"},{"$f":"'H. Access Control'!C48","v":"Do temporary passwords expire within 10 days?"},{"$f":"'H. Access Control'!D48","v":"No"},{"$f":"'H. Access Control'!E48","v":"Invalid after the first login"},{"$f":"'H. Access Control'!F48","v":"B.1 Information Security Policy Content"},{"$f":"'H. Access Control'!G48","v":"NA"},{"$f":"'H. Access Control'!H48","v":0},null,null,"N/A","IS.2.A.5.1","N/A"]
[{"$f":"'H. Access Control'!A49","v":3214},{"$f":"'H. Access Control'!I49","v":2},{"$f":"'H. Access Control'!J49","v":0},{"$f":"'H. Access Control'!X49","v":0},{"$f":"'H. Access Control'!B49","v":"H.3.7"},{"$f":"'H. Access Control'!C49","v":"Is a user’s identity verified prior to resetting a password?"},{"$f":"'H. Access Control'!D49","v":"Yes"},{"$f":"'H. Access Control'!E49","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'H. Access Control'!F49","v":"B.1 Information Security Policy Content"},{"$f":"'H. Access Control'!G49","v":"9.2.4.c"},{"$f":"'H. Access Control'!H49","v":"Management of secret authentication information for users"},"DS5.3","Identity management","8.2.2","N/A","DS5.3"]
[{"$f":"'H. Access Control'!A50","v":2659},{"$f":"'H. Access Control'!I50","v":2},{"$f":"'H. Access Control'!J50","v":0},{"$f":"'H. Access Control'!X50","v":0},{"$f":"'H. Access Control'!B50","v":"H.3.8"},{"$f":"'H. Access Control'!C50","v":"Are vendor default passwords removed, disabled or changed prior to placing the device or system into production?"},{"$f":"'H. Access Control'!D50","v":"Yes"},{"$f":"'H. Access Control'!E50","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'H. Access Control'!F50","v":"B.1 Information Security Policy Content"},{"$f":"'H. Access Control'!G50","v":"9.2.4.g"},{"$f":"'H. Access Control'!H50","v":"Management of secret authentication information for users"},"DS5.3","Identity management","6.3.1","IS.2.A.1","DS5.3"]
[{"$f":"'H. Access Control'!A51","v":2971},{"$f":"'H. Access Control'!I51","v":2},{"$f":"'H. Access Control'!J51","v":0},{"$f":"'H. Access Control'!X51","v":0},{"$f":"'H. Access Control'!B51","v":"H.3.9"},{"$f":"'H. Access Control'!C51","v":"Is password reset authority restricted to authorized persons and/or an automated password reset tool?"},{"$f":"'H. Access Control'!D51","v":"Yes"},{"$f":"'H. Access Control'!E51","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'H. Access Control'!F51","v":"B.1 Information Security Policy Content"},{"$f":"'H. Access Control'!G51","v":"9.3.1.f"},{"$f":"'H. Access Control'!H51","v":"User responsibilities"},null,null,"N/A","RPS.2.B.7","DS5.3"]
[{"$f":"'H. Access Control'!A52","v":2028},{"$f":"'H. Access Control'!I52","v":1},{"$f":"'H. Access Control'!J52","v":0},{"$f":"'H. Access Control'!X52","v":1},{"$f":"'H. Access Control'!B52","v":"H.4"},{"$f":"'H. Access Control'!C52","v":"Is remote access permitted?"},{"$f":"'H. Access Control'!D52","v":"No"},{"$f":"'H. Access Control'!E52","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"'H. Access Control'!F52","v":0},{"$f":"'H. Access Control'!G52","v":6.2},{"$f":"'H. Access Control'!H52","v":"Mobile devices and teleworking"},null,null,"N/A","N/A","AI1.2, AI2.4, DS5.7, DS5.10, DS5.11"]
[{"$f":"'H. Access Control'!A53","v":3215},{"$f":"'H. Access Control'!I53","v":2},{"$f":"'H. Access Control'!J53","v":0},{"$f":"'H. Access Control'!X53","v":0},{"$f":"'H. Access Control'!B53","v":"H.4.1"},{"$f":"'H. Access Control'!C53","v":"Is there a remote access policy for systems transmitting, processing and storing Scoped Systems and Data that has been approved by management and communicated to appropriate constituents?"},{"$f":"'H. Access Control'!D53","v":0},{"$f":"'H. Access Control'!E53","v":0},{"$f":"'H. Access Control'!F53","v":0},{"$f":"'H. Access Control'!G53","v":"6.2.1                                        6.2.2"},{"$f":"'H. Access Control'!H53","v":"Mobile device policy,                  Teleworking"},"PO6.2","Enterprise IT risk and internal control framework","12.3.2","BCP.1.4.3.7 IS.2.B.3","PO6.2, DS5.2, DS5.3, DS5.7"]
[{"$f":"'H. Access Control'!A54","v":2972},{"$f":"'H. Access Control'!I54","v":2},{"$f":"'H. Access Control'!J54","v":0},{"$f":"'H. Access Control'!X54","v":0},{"$f":"'H. Access Control'!B54","v":"H.4.2"},{"$f":"'H. Access Control'!C54","v":"Is split tunneling or bridged internet connections allowed by policy and/or technical control?"},{"$f":"'H. Access Control'!D54","v":0},{"$f":"'H. Access Control'!E54","v":0},{"$f":"'H. Access Control'!F54","v":0},{"$f":"'H. Access Control'!G54","v":"NA"},{"$f":"'H. Access Control'!H54","v":""},null,null,"N/A","N/A","N/A"]
[{"$f":"'H. Access Control'!A55","v":3216},{"$f":"'H. Access Control'!I55","v":2},{"$f":"'H. Access Control'!J55","v":0},{"$f":"'H. Access Control'!X55","v":0},{"$f":"'H. Access Control'!B55","v":"H.4.3"},{"$f":"'H. Access Control'!C55","v":"Is only company owned equipment permitted to connect remotely?"},{"$f":"'H. Access Control'!D55","v":0},{"$f":"'H. Access Control'!E55","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'H. Access Control'!F55","v":0},{"$f":"'H. Access Control'!G55","v":"6.2.1                                        6.2.2 "},{"$f":"'H. Access Control'!H55","v":"Mobile device policy,                  Teleworking"},"DS5.9","Malicious software prevention, detection and correction","N/A","N/A","DS5.9, DS5.11"]
[{"$f":"'H. Access Control'!A56","v":3217},{"$f":"'H. Access Control'!I56","v":2},{"$f":"'H. Access Control'!J56","v":0},{"$f":"'H. Access Control'!X56","v":0},{"$f":"'H. Access Control'!B56","v":"H.4.4"},{"$f":"'H. Access Control'!C56","v":"Is remote desktop technology (Citrix) used to access the network remotely?"},{"$f":"'H. Access Control'!D56","v":0},{"$f":"'H. Access Control'!E56","v":0},{"$f":"'H. Access Control'!F56","v":0},{"$f":"'H. Access Control'!G56","v":"6.2.2.d"},{"$f":"'H. Access Control'!H56","v":"Teleworking"},null,null,"N/A","N/A","N/A"]
[{"$f":"'H. Access Control'!A57","v":3218},{"$f":"'H. Access Control'!I57","v":2},{"$f":"'H. Access Control'!J57","v":0},{"$f":"'H. Access Control'!X57","v":0},{"$f":"'H. Access Control'!B57","v":"H.4.5"},{"$f":"'H. Access Control'!C57","v":"Are remote users prevented from copying data to remote devices?"},{"$f":"'H. Access Control'!D57","v":0},{"$f":"'H. Access Control'!E57","v":0},{"$f":"'H. Access Control'!F57","v":0},{"$f":"'H. Access Control'!G57","v":"6.2.2.d"},{"$f":"'H. Access Control'!H57","v":"Teleworking"},null,null,"N/A","N/A","N/A"]
[{"$f":"'H. Access Control'!A58","v":2964},{"$f":"'H. Access Control'!I58","v":2},{"$f":"'H. Access Control'!J58","v":0},{"$f":"'H. Access Control'!X58","v":0},{"$f":"'H. Access Control'!B58","v":"H.4.6"},{"$f":"'H. Access Control'!C58","v":"Are encrypted communications required for all remote connections?"},{"$f":"'H. Access Control'!D58","v":0},{"$f":"'H. Access Control'!E58","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'H. Access Control'!F58","v":0},{"$f":"'H. Access Control'!G58","v":"10.1.1.c"},{"$f":"'H. Access Control'!H58","v":"Policy on the use of cryptographic controls"},null,null,"N/A","IS.2.B.15","PO6, AI2, DS5"]
[{"$f":"'H. Access Control'!A59","v":2048},{"$f":"'H. Access Control'!I59","v":2},{"$f":"'H. Access Control'!J59","v":0},{"$f":"'H. Access Control'!X59","v":0},{"$f":"'H. Access Control'!B59","v":"H.4.7"},{"$f":"'H. Access Control'!C59","v":"Is multi-factor authentication required for remote access?"},{"$f":"'H. Access Control'!D59","v":0},{"$f":"'H. Access Control'!E59","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"'H. Access Control'!F59","v":"H.8 Two-Factor Authentication for Remote Access"},{"$f":"'H. Access Control'!G59","v":"9.1.2.d"},{"$f":"'H. Access Control'!H59","v":"Access to networks and network services"},"PO6.2","Enterprise IT risk and internal control framework",8.3000000000000007,"IS.2.A.13 IS.2.B.17.3","PO6.2, DS5.2, DS5.3, DS5.7"]
[{"$f":"'H. Access Control'!A60","v":0},{"$f":"'H. Access Control'!I60","v":0},{"$f":"'H. Access Control'!J60","v":0},{"$f":"'H. Access Control'!X60","v":0},{"$f":"'H. Access Control'!B60","v":0},{"$f":"'H. Access Control'!C60","v":0},{"$f":"'H. Access Control'!D60","v":0},{"$f":"'H. Access Control'!E60","v":0},{"$f":"'H. Access Control'!F60","v":0},{"$f":"'H. Access Control'!G60","v":0},{"$f":"'H. Access Control'!H60","v":0}]
[]
[{"$f":"'I. Info Sys AD&M'!B1","v":"I. Information Systems Acquisition Development & Maintenance"},null,null,null,{"$f":"'I. Info Sys AD&M'!B1","v":"I. Information Systems Acquisition Development & Maintenance"}]
[{"$f":"'I. Info Sys AD&M'!A5","v":2665},{"$f":"'I. Info Sys AD&M'!I5","v":1},{"$f":"'I. Info Sys AD&M'!J5","v":0},{"$f":"'I. Info Sys AD&M'!X5","v":1},{"$f":"'I. Info Sys AD&M'!B5","v":"I.1"},{"$f":"'I. Info Sys AD&M'!C5","v":"Are business information systems used to transmit, process or store Scoped Systems and Data? If yes, are:"},{"$f":"'I. Info Sys AD&M'!D5","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E5","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F5","v":0},{"$f":"'I. Info Sys AD&M'!G5","v":14.1},{"$f":"'I. Info Sys AD&M'!H5","v":"Security requirements of information systems"},"AI1.2","Risk analysis report","N/A","N/A","AI1.2, AI2.4, AI3.2"]
[{"$f":"'I. Info Sys AD&M'!A6","v":2666},{"$f":"'I. Info Sys AD&M'!I6","v":2},{"$f":"'I. Info Sys AD&M'!J6","v":0},{"$f":"'I. Info Sys AD&M'!X6","v":0},{"$f":"'I. Info Sys AD&M'!B6","v":"I.1.1"},{"$f":"'I. Info Sys AD&M'!C6","v":"Security requirements documented?"},{"$f":"'I. Info Sys AD&M'!D6","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E6","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F6","v":"I.5 Application Security Program Governance, procedure b.1"},{"$f":"'I. Info Sys AD&M'!G6","v":"14.1.1 "},{"$f":"'I. Info Sys AD&M'!H6","v":"Information security requirements analysis and specification"},"AI1.2","Risk analysis report",12.1,"N/A","AI1.2, AI2.4, AI3.2"]
[{"$f":"'I. Info Sys AD&M'!A7","v":1795},{"$f":"'I. Info Sys AD&M'!I7","v":2},{"$f":"'I. Info Sys AD&M'!J7","v":0},{"$f":"'I. Info Sys AD&M'!X7","v":0},{"$f":"'I. Info Sys AD&M'!B7","v":"I.1.2"},{"$f":"'I. Info Sys AD&M'!C7","v":"Information security reviews conducted and approved for the use or installation of open source software (Linux, Apache, etc.)?"},{"$f":"'I. Info Sys AD&M'!D7","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E7","v":0},{"$f":"'I. Info Sys AD&M'!F7","v":0},{"$f":"'I. Info Sys AD&M'!G7","v":"14.1.1 "},{"$f":"'I. Info Sys AD&M'!H7","v":"Information security requirements analysis and specification"},"AI1.2","Risk analysis report","12.1.1","N/A","AI1.2, AI2.4, AI3.2"]
[{"$f":"'I. Info Sys AD&M'!A8","v":2058},{"$f":"'I. Info Sys AD&M'!I8","v":1},{"$f":"'I. Info Sys AD&M'!J8","v":0},{"$f":"'I. Info Sys AD&M'!X8","v":1},{"$f":"'I. Info Sys AD&M'!B8","v":"I.2"},{"$f":"'I. Info Sys AD&M'!C8","v":"Is application development performed? If yes, does it provide:"},{"$f":"'I. Info Sys AD&M'!D8","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E8","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F8","v":0},{"$f":"'I. Info Sys AD&M'!G8","v":"14.2.1"},{"$f":"'I. Info Sys AD&M'!H8","v":"Secure development policy"},"N/A",0,"N/A","N/A","AI2.4, AI7.4, AI7.6, DS11.3, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A9","v":2198},{"$f":"'I. Info Sys AD&M'!I9","v":2},{"$f":"'I. Info Sys AD&M'!J9","v":0},{"$f":"'I. Info Sys AD&M'!X9","v":0},{"$f":"'I. Info Sys AD&M'!B9","v":"I.2.1"},{"$f":"'I. Info Sys AD&M'!C9","v":"Independent security evaluation or certification?"},{"$f":"'I. Info Sys AD&M'!D9","v":"No"},{"$f":"'I. Info Sys AD&M'!E9","v":0},{"$f":"'I. Info Sys AD&M'!F9","v":0},{"$f":"'I. Info Sys AD&M'!G9","v":"NA"},{"$f":"'I. Info Sys AD&M'!H9","v":0},"N/A",0,"N/A","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A10","v":2111},{"$f":"'I. Info Sys AD&M'!I10","v":2},{"$f":"'I. Info Sys AD&M'!J10","v":0},{"$f":"'I. Info Sys AD&M'!X10","v":0},{"$f":"'I. Info Sys AD&M'!B10","v":"I.2.2"},{"$f":"'I. Info Sys AD&M'!C10","v":"Formal application methodology (OWASP)?"},{"$f":"'I. Info Sys AD&M'!D10","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E10","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F10","v":"I.2 Secure Systems Development Life Cycle (SDLC) code reviews"},{"$f":"'I. Info Sys AD&M'!G10","v":"14.2.1 "},{"$f":"'I. Info Sys AD&M'!H10","v":"Secure development policy"},"N/A",0,"N/A","IS.2.A.9 D&A.1.5.1.9","N/A"]
[{"$f":"'I. Info Sys AD&M'!A11","v":2125},{"$f":"'I. Info Sys AD&M'!I11","v":2},{"$f":"'I. Info Sys AD&M'!J11","v":0},{"$f":"'I. Info Sys AD&M'!X11","v":0},{"$f":"'I. Info Sys AD&M'!B11","v":"I.2.3"},{"$f":"'I. Info Sys AD&M'!C11","v":"An authenticated and maintained state for every data transaction?"},{"$f":"'I. Info Sys AD&M'!D11","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E11","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F11","v":0},{"$f":"'I. Info Sys AD&M'!G11","v":"14.1.3.b.1"},{"$f":"'I. Info Sys AD&M'!H11","v":"Protecting application serivices transactions"},"DS5.3","Identity management","4.1.1","IS.2.G.5","DS5.7"]
[{"$f":"'I. Info Sys AD&M'!A12","v":2126},{"$f":"'I. Info Sys AD&M'!I12","v":2},{"$f":"'I. Info Sys AD&M'!J12","v":0},{"$f":"'I. Info Sys AD&M'!X12","v":0},{"$f":"'I. Info Sys AD&M'!B12","v":"I.2.4"},{"$f":"'I. Info Sys AD&M'!C12","v":"A means for secure session management?"},{"$f":"'I. Info Sys AD&M'!D12","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E12","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F12","v":0},{"$f":"'I. Info Sys AD&M'!G12","v":"14.1.3.d"},{"$f":"'I. Info Sys AD&M'!H12","v":"Protecting application serivices transactions"},"DS5.3","Identity management","4.1.1","N/A","DS5.7"]
[{"$f":"'I. Info Sys AD&M'!A13","v":2129},{"$f":"'I. Info Sys AD&M'!I13","v":2},{"$f":"'I. Info Sys AD&M'!J13","v":0},{"$f":"'I. Info Sys AD&M'!X13","v":0},{"$f":"'I. Info Sys AD&M'!B13","v":"I.2.5"},{"$f":"'I. Info Sys AD&M'!C13","v":"Comprehensive secure error handling?"},{"$f":"'I. Info Sys AD&M'!D13","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E13","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F13","v":0},{"$f":"'I. Info Sys AD&M'!G13","v":"14.2.5 "},{"$f":"'I. Info Sys AD&M'!H13","v":"Secure system engineering principles"},"AI2.3","Application control and auditability","6.5.5","N/A","AI2.3"]
[{"$f":"'I. Info Sys AD&M'!A14","v":1269},{"$f":"'I. Info Sys AD&M'!I14","v":2},{"$f":"'I. Info Sys AD&M'!J14","v":0},{"$f":"'I. Info Sys AD&M'!X14","v":0},{"$f":"'I. Info Sys AD&M'!B14","v":"I.2.6"},{"$f":"'I. Info Sys AD&M'!C14","v":"Audit log failures and generate an alert?"},{"$f":"'I. Info Sys AD&M'!D14","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E14","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F14","v":0},{"$f":"'I. Info Sys AD&M'!G14","v":"12.4.1"},{"$f":"'I. Info Sys AD&M'!H14","v":"Event logging"},"AI2.3","Application control and auditability","10.5.5","N/A","AI2.3, DS5.7"]
[{"$f":"'I. Info Sys AD&M'!A15","v":2182},{"$f":"'I. Info Sys AD&M'!I15","v":2},{"$f":"'I. Info Sys AD&M'!J15","v":0},{"$f":"'I. Info Sys AD&M'!X15","v":0},{"$f":"'I. Info Sys AD&M'!B15","v":"I.2.7"},{"$f":"'I. Info Sys AD&M'!C15","v":"Development, test, and staging environment separate from the production environment? If so how are they separated:"},{"$f":"'I. Info Sys AD&M'!D15","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E15","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F15","v":0},{"$f":"'I. Info Sys AD&M'!G15","v":"12.1.4"},{"$f":"'I. Info Sys AD&M'!H15","v":"Separation of development, testing and operational environments"},"N/A",0,"6.4.1","D&A.1.9.1.6.4","N/A"]
[{"$f":"'I. Info Sys AD&M'!A16","v":849},{"$f":"'I. Info Sys AD&M'!I16","v":3},{"$f":"'I. Info Sys AD&M'!J16","v":0},{"$f":"'I. Info Sys AD&M'!X16","v":0},{"$f":"'I. Info Sys AD&M'!B16","v":"I.2.7.1"},{"$f":"'I. Info Sys AD&M'!C16","v":"Logically?"},{"$f":"'I. Info Sys AD&M'!D16","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E16","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F16","v":0},{"$f":"'I. Info Sys AD&M'!G16","v":"12.1.4"},{"$f":"'I. Info Sys AD&M'!H16","v":"Separation of development, testing and operational environments"},"N/A",0,"N/A","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A17","v":850},{"$f":"'I. Info Sys AD&M'!I17","v":3},{"$f":"'I. Info Sys AD&M'!J17","v":0},{"$f":"'I. Info Sys AD&M'!X17","v":0},{"$f":"'I. Info Sys AD&M'!B17","v":"I.2.7.2"},{"$f":"'I. Info Sys AD&M'!C17","v":"Physically?"},{"$f":"'I. Info Sys AD&M'!D17","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E17","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F17","v":0},{"$f":"'I. Info Sys AD&M'!G17","v":"12.1.4"},{"$f":"'I. Info Sys AD&M'!H17","v":"Separation of development, testing and operational environments"},"N/A",0,"N/A","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A18","v":852},{"$f":"'I. Info Sys AD&M'!I18","v":3},{"$f":"'I. Info Sys AD&M'!J18","v":0},{"$f":"'I. Info Sys AD&M'!X18","v":0},{"$f":"'I. Info Sys AD&M'!B18","v":"I.2.7.3"},{"$f":"'I. Info Sys AD&M'!C18","v":"No segregation?"},{"$f":"'I. Info Sys AD&M'!D18","v":"No"},{"$f":"'I. Info Sys AD&M'!E18","v":0},{"$f":"'I. Info Sys AD&M'!F18","v":0},{"$f":"'I. Info Sys AD&M'!G18","v":"12.1.4"},{"$f":"'I. Info Sys AD&M'!H18","v":"Separation of development, testing and operational environments"},"N/A",0,"N/A","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A19","v":2059},{"$f":"'I. Info Sys AD&M'!I19","v":2},{"$f":"'I. Info Sys AD&M'!J19","v":0},{"$f":"'I. Info Sys AD&M'!X19","v":1},{"$f":"'I. Info Sys AD&M'!B19","v":"I.2.8"},{"$f":"'I. Info Sys AD&M'!C19","v":"Is there a formal Software Development Life Cycle (SDLC) process? If yes, does it include:"},{"$f":"'I. Info Sys AD&M'!D19","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E19","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F19","v":"I.7 Application Security SDLC Phases"},{"$f":"'I. Info Sys AD&M'!G19","v":"14.2.1 "},{"$f":"'I. Info Sys AD&M'!H19","v":"Secure development policy"},"N/A",0,"N/A","IS.1.4.1.8 MGMT.1.6.1.3","AI2.4, AI7.4, AI7.6, DS11.3, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A20","v":2098},{"$f":"'I. Info Sys AD&M'!I20","v":3},{"$f":"'I. Info Sys AD&M'!J20","v":0},{"$f":"'I. Info Sys AD&M'!X20","v":0},{"$f":"'I. Info Sys AD&M'!B20","v":"I.2.8.1"},{"$f":"'I. Info Sys AD&M'!C20","v":"Peer code review, integration testing, and acceptance testing?"},{"$f":"'I. Info Sys AD&M'!D20","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E20","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F20","v":0},{"$f":"'I. Info Sys AD&M'!G20","v":"14.2.2 "},{"$f":"'I. Info Sys AD&M'!H20","v":"System change control procedures"},"AI2.6","Major upgrades to existing systems","6.3.2, 6.4.5.3","IS.2.H.2 IS.2.H.8 IS.2.H.9.1 D&A.1.5.1.4","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A21","v":847},{"$f":"'I. Info Sys AD&M'!I21","v":3},{"$f":"'I. Info Sys AD&M'!J21","v":0},{"$f":"'I. Info Sys AD&M'!X21","v":0},{"$f":"'I. Info Sys AD&M'!B21","v":"I.2.8.2"},{"$f":"'I. Info Sys AD&M'!C21","v":"Separate source code repositories for production and non-production?"},{"$f":"'I. Info Sys AD&M'!D21","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E21","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F21","v":0},{"$f":"'I. Info Sys AD&M'!G21","v":"9.4.5 "},{"$f":"'I. Info Sys AD&M'!H21","v":"Access control to program source code"},"AI2.4","Application security and availability","6.4.1","N/A","AI2.4, AI7.4, AI7.6, DS11.3, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A22","v":2668},{"$f":"'I. Info Sys AD&M'!I22","v":2},{"$f":"'I. Info Sys AD&M'!J22","v":0},{"$f":"'I. Info Sys AD&M'!X22","v":0},{"$f":"'I. Info Sys AD&M'!B22","v":"I.2.9"},{"$f":"'I. Info Sys AD&M'!C22","v":"Do IT support personnel have access to program source libraries?"},{"$f":"'I. Info Sys AD&M'!D22","v":"No"},{"$f":"'I. Info Sys AD&M'!E22","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F22","v":0},{"$f":"'I. Info Sys AD&M'!G22","v":"9.4.5.c"},{"$f":"'I. Info Sys AD&M'!H22","v":"Access control to program source code"},"AI2.4","Application security and availability","6.4.2","IS.2.G.1","AI2.4, AI7.4, AI7.6, DS11.3, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A23","v":2669},{"$f":"'I. Info Sys AD&M'!I23","v":2},{"$f":"'I. Info Sys AD&M'!J23","v":0},{"$f":"'I. Info Sys AD&M'!X23","v":0},{"$f":"'I. Info Sys AD&M'!B23","v":"I.2.10"},{"$f":"'I. Info Sys AD&M'!C23","v":"Is all access to program source libraries logged?"},{"$f":"'I. Info Sys AD&M'!D23","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E23","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F23","v":0},{"$f":"'I. Info Sys AD&M'!G23","v":"9.4.5.f"},{"$f":"'I. Info Sys AD&M'!H23","v":"Access control to program source code"},"AI2.4","Application security and availability",10.1,"IS.2.H.7","AI2.4, AI7.4, AI7.6, DS11.3, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A24","v":2670},{"$f":"'I. Info Sys AD&M'!I24","v":2},{"$f":"'I. Info Sys AD&M'!J24","v":0},{"$f":"'I. Info Sys AD&M'!X24","v":0},{"$f":"'I. Info Sys AD&M'!B24","v":"I.2.11"},{"$f":"'I. Info Sys AD&M'!C24","v":"Are change control procedures required for all changes to the production environment?"},{"$f":"'I. Info Sys AD&M'!D24","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E24","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F24","v":"G.21 Change Control"},{"$f":"'I. Info Sys AD&M'!G24","v":"9.4.5.g"},{"$f":"'I. Info Sys AD&M'!H24","v":"Access control to program source code"},"AI2.4","Application security and availability",6.4,"IS.1.7.8 D&A.1.5.1.10 D&A.1.6.1.12","AI2.4, AI7.4, AI7.6, DS11.3, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A25","v":2144},{"$f":"'I. Info Sys AD&M'!I25","v":2},{"$f":"'I. Info Sys AD&M'!J25","v":0},{"$f":"'I. Info Sys AD&M'!X25","v":0},{"$f":"'I. Info Sys AD&M'!B25","v":"I.2.12"},{"$f":"'I. Info Sys AD&M'!C25","v":"Do applications provide granular and comprehensive logging?"},{"$f":"'I. Info Sys AD&M'!D25","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E25","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F25","v":0},{"$f":"'I. Info Sys AD&M'!G25","v":"12.4.1"},{"$f":"'I. Info Sys AD&M'!H25","v":"Event logging"},"AI2.3","Application control and auditability","N/A","IS.2.G.7 IS.2.L.4","AI2.3, DS5.7"]
[{"$f":"'I. Info Sys AD&M'!A26","v":2070},{"$f":"'I. Info Sys AD&M'!I26","v":2},{"$f":"'I. Info Sys AD&M'!J26","v":0},{"$f":"'I. Info Sys AD&M'!X26","v":0},{"$f":"'I. Info Sys AD&M'!B26","v":"I.2.13"},{"$f":"'I. Info Sys AD&M'!C26","v":"Are application sessions set to time out within 15 minutes or less?"},{"$f":"'I. Info Sys AD&M'!D26","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E26","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F26","v":"H.5 Controls for Unattended Systems"},{"$f":"'I. Info Sys AD&M'!G26","v":"9.4.2.k"},{"$f":"'I. Info Sys AD&M'!H26","v":"Secure log-on procedures"},"DS5.3","Identity management","8.1.8","N/A","DS5.7"]
[{"$f":"'I. Info Sys AD&M'!A27","v":2153},{"$f":"'I. Info Sys AD&M'!I27","v":2},{"$f":"'I. Info Sys AD&M'!J27","v":0},{"$f":"'I. Info Sys AD&M'!X27","v":0},{"$f":"'I. Info Sys AD&M'!B27","v":"I.2.14"},{"$f":"'I. Info Sys AD&M'!C27","v":"Is application development third party / outsourced developers onshore?"},{"$f":"'I. Info Sys AD&M'!D27","v":"No"},{"$f":"'I. Info Sys AD&M'!E27","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F27","v":0},{"$f":"'I. Info Sys AD&M'!G27","v":"14.2.7 "},{"$f":"'I. Info Sys AD&M'!H27","v":"Outsourced development"},"PO8.3","Development and acquisition standards","N/A","N/A","PO8.3, AI2.7, AI5.2, DS2.4, PO8"]
[{"$f":"'I. Info Sys AD&M'!A28","v":2154},{"$f":"'I. Info Sys AD&M'!I28","v":2},{"$f":"'I. Info Sys AD&M'!J28","v":0},{"$f":"'I. Info Sys AD&M'!X28","v":0},{"$f":"'I. Info Sys AD&M'!B28","v":"I.2.15"},{"$f":"'I. Info Sys AD&M'!C28","v":"Is application development third party / outsourced developers offshore?"},{"$f":"'I. Info Sys AD&M'!D28","v":"No"},{"$f":"'I. Info Sys AD&M'!E28","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F28","v":0},{"$f":"'I. Info Sys AD&M'!G28","v":"14.2.7 "},{"$f":"'I. Info Sys AD&M'!H28","v":"Outsourced development"},"PO8.3","Development and acquisition standards","N/A","N/A","PO8.3, AI2.7, AI5.2, DS2.4, PO8"]
[{"$f":"'I. Info Sys AD&M'!A29","v":2155},{"$f":"'I. Info Sys AD&M'!I29","v":2},{"$f":"'I. Info Sys AD&M'!J29","v":0},{"$f":"'I. Info Sys AD&M'!X29","v":0},{"$f":"'I. Info Sys AD&M'!B29","v":"I.2.16"},{"$f":"'I. Info Sys AD&M'!C29","v":"Are there access controls to protect source code and test data?"},{"$f":"'I. Info Sys AD&M'!D29","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E29","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F29","v":0},{"$f":"'I. Info Sys AD&M'!G29","v":"9.4.5 "},{"$f":"'I. Info Sys AD&M'!H29","v":"Access control to program source code"},"AI2.4","Application security and availability","6.4.1.b","N/A","AI2.4, AI7.4, AI7.6, DS11.3, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A30","v":2160},{"$f":"'I. Info Sys AD&M'!I30","v":2},{"$f":"'I. Info Sys AD&M'!J30","v":0},{"$f":"'I. Info Sys AD&M'!X30","v":0},{"$f":"'I. Info Sys AD&M'!B30","v":"I.2.17"},{"$f":"'I. Info Sys AD&M'!C30","v":"Does the version management system provide segregation of code, data and environments?"},{"$f":"'I. Info Sys AD&M'!D30","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E30","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F30","v":0},{"$f":"'I. Info Sys AD&M'!G30","v":"9.4.5 "},{"$f":"'I. Info Sys AD&M'!H30","v":"Access control to program source code"},"N/A",0,"6.4.1.a","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A31","v":2164},{"$f":"'I. Info Sys AD&M'!I31","v":2},{"$f":"'I. Info Sys AD&M'!J31","v":0},{"$f":"'I. Info Sys AD&M'!X31","v":0},{"$f":"'I. Info Sys AD&M'!B31","v":"I.2.18"},{"$f":"'I. Info Sys AD&M'!C31","v":"Do changes to applications or application code go through a risk assessment including application testing?"},{"$f":"'I. Info Sys AD&M'!D31","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E31","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F31","v":0},{"$f":"'I. Info Sys AD&M'!G31","v":"14.2.2                                       14.2.4.a"},{"$f":"'I. Info Sys AD&M'!H31","v":"System change control procedures,                                Restrictions on changes to software packages"},"AI2.6","Major upgrades to existing systems",6.4,"N/A","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A32","v":2169},{"$f":"'I. Info Sys AD&M'!I32","v":2},{"$f":"'I. Info Sys AD&M'!J32","v":0},{"$f":"'I. Info Sys AD&M'!X32","v":0},{"$f":"'I. Info Sys AD&M'!B32","v":"I.2.19"},{"$f":"'I. Info Sys AD&M'!C32","v":"Is Scoped Systems and Data ever used in the test, development, or QA environments? If yes, is:"},{"$f":"'I. Info Sys AD&M'!D32","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E32","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F32","v":0},{"$f":"'I. Info Sys AD&M'!G32","v":"14.3.1 "},{"$f":"'I. Info Sys AD&M'!H32","v":"Protection of test data"},"AI3.3","Infrastructure maintenance","6.4.3","N/A","AI3.3, DS2.4, DS9.1, DS9.2, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A33","v":2672},{"$f":"'I. Info Sys AD&M'!I33","v":3},{"$f":"'I. Info Sys AD&M'!J33","v":0},{"$f":"'I. Info Sys AD&M'!X33","v":0},{"$f":"'I. Info Sys AD&M'!B33","v":"I.2.19.1"},{"$f":"'I. Info Sys AD&M'!C33","v":"Authorization required when production data is copied to the test environment?"},{"$f":"'I. Info Sys AD&M'!D33","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E33","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F33","v":"I.7 Application Security SDLC Phases"},{"$f":"'I. Info Sys AD&M'!G33","v":"14.3.1.b"},{"$f":"'I. Info Sys AD&M'!H33","v":"Protection of test data"},"AI3.3","Infrastructure maintenance","N/A","N/A","AI3.3, DS2.4, DS9.1, DS9.2, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A34","v":2171},{"$f":"'I. Info Sys AD&M'!I34","v":3},{"$f":"'I. Info Sys AD&M'!J34","v":0},{"$f":"'I. Info Sys AD&M'!X34","v":0},{"$f":"'I. Info Sys AD&M'!B34","v":"I.2.19.2"},{"$f":"'I. Info Sys AD&M'!C34","v":"Test data destroyed following the testing phase?"},{"$f":"'I. Info Sys AD&M'!D34","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E34","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F34","v":0},{"$f":"'I. Info Sys AD&M'!G34","v":"14.3.1.c"},{"$f":"'I. Info Sys AD&M'!H34","v":"Protection of test data"},"AI3.3","Infrastructure maintenance","6.3.1","N/A","AI3.3, DS2.4, DS9.1, DS9.2, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A35","v":2170},{"$f":"'I. Info Sys AD&M'!I35","v":3},{"$f":"'I. Info Sys AD&M'!J35","v":0},{"$f":"'I. Info Sys AD&M'!X35","v":0},{"$f":"'I. Info Sys AD&M'!B35","v":"I.2.19.3"},{"$f":"'I. Info Sys AD&M'!C35","v":"Test data masked or obfuscated during the testing phase?"},{"$f":"'I. Info Sys AD&M'!D35","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E35","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F35","v":0},{"$f":"'I. Info Sys AD&M'!G35","v":"14.3.1"},{"$f":"'I. Info Sys AD&M'!H35","v":"Protection of test data"},"AI3.3","Infrastructure maintenance","N/A","N/A","AI3.3, DS2.4, DS9.1, DS9.2, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A36","v":2673},{"$f":"'I. Info Sys AD&M'!I36","v":3},{"$f":"'I. Info Sys AD&M'!J36","v":0},{"$f":"'I. Info Sys AD&M'!X36","v":0},{"$f":"'I. Info Sys AD&M'!B36","v":"I.2.19.4"},{"$f":"'I. Info Sys AD&M'!C36","v":"Copying to the test environment logged?"},{"$f":"'I. Info Sys AD&M'!D36","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E36","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F36","v":0},{"$f":"'I. Info Sys AD&M'!G36","v":"14.3.1.d"},{"$f":"'I. Info Sys AD&M'!H36","v":"Protection of test data"},"AI3.3","Infrastructure maintenance","N/A","N/A","AI3.3, DS2.4, DS9.1, DS9.2, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A37","v":2019},{"$f":"'I. Info Sys AD&M'!I37","v":2},{"$f":"'I. Info Sys AD&M'!J37","v":0},{"$f":"'I. Info Sys AD&M'!X37","v":0},{"$f":"'I. Info Sys AD&M'!B37","v":"I.2.20"},{"$f":"'I. Info Sys AD&M'!C37","v":"Are developers permitted to:"},{"$f":"'I. Info Sys AD&M'!D37","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E37","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F37","v":0},{"$f":"'I. Info Sys AD&M'!G37","v":"14.2.1"},{"$f":"'I. Info Sys AD&M'!H37","v":"Secure development policy"},"N/A",0,"N/A","N/A","DS5.7"]
[{"$f":"'I. Info Sys AD&M'!A38","v":2020},{"$f":"'I. Info Sys AD&M'!I38","v":3},{"$f":"'I. Info Sys AD&M'!J38","v":0},{"$f":"'I. Info Sys AD&M'!X38","v":0},{"$f":"'I. Info Sys AD&M'!B38","v":"I.2.20.1"},{"$f":"'I. Info Sys AD&M'!C38","v":"Access production environments, including read only access?"},{"$f":"'I. Info Sys AD&M'!D38","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E38","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F38","v":0},{"$f":"'I. Info Sys AD&M'!G38","v":"14.2.1.b"},{"$f":"'I. Info Sys AD&M'!H38","v":"Secure development policy"},"AI2.4","Application security and availability",7.1,"N/A","AI2.4, AI7.4, AI7.6, DS11.3, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A39","v":1909},{"$f":"'I. Info Sys AD&M'!I39","v":3},{"$f":"'I. Info Sys AD&M'!J39","v":0},{"$f":"'I. Info Sys AD&M'!X39","v":0},{"$f":"'I. Info Sys AD&M'!B39","v":"I.2.20.2"},{"$f":"'I. Info Sys AD&M'!C39","v":"Access systems and applications based on established profiles that define responsibilities or job functions?"},{"$f":"'I. Info Sys AD&M'!D39","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E39","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F39","v":0},{"$f":"'I. Info Sys AD&M'!G39","v":"9.1.1"},{"$f":"'I. Info Sys AD&M'!H39","v":"Access Control Policy"},"PO2.1","Enterprise information architecture model",7.1,"IS.2.L.3 E-BANK.1.5.1","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'I. Info Sys AD&M'!A40","v":2027},{"$f":"'I. Info Sys AD&M'!I40","v":3},{"$f":"'I. Info Sys AD&M'!J40","v":0},{"$f":"'I. Info Sys AD&M'!X40","v":0},{"$f":"'I. Info Sys AD&M'!B40","v":"I.2.20.3"},{"$f":"'I. Info Sys AD&M'!C40","v":"Request or obtain access outside an established role (emergency access)?"},{"$f":"'I. Info Sys AD&M'!D40","v":"No"},{"$f":"'I. Info Sys AD&M'!E40","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F40","v":0},{"$f":"'I. Info Sys AD&M'!G40","v":"9.2.3.b"},{"$f":"'I. Info Sys AD&M'!H40","v":"Management of privileged access rights"},"DS5.4","User account management","N/A","N/A","DS5.4"]
[{"$f":"'I. Info Sys AD&M'!A41","v":2970},{"$f":"'I. Info Sys AD&M'!I41","v":2},{"$f":"'I. Info Sys AD&M'!J41","v":0},{"$f":"'I. Info Sys AD&M'!X41","v":0},{"$f":"'I. Info Sys AD&M'!B41","v":"I.2.21"},{"$f":"'I. Info Sys AD&M'!C41","v":"Are system, vendor, or service accounts disallowed for normal operations and monitored for usage?"},{"$f":"'I. Info Sys AD&M'!D41","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E41","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F41","v":0},{"$f":"'I. Info Sys AD&M'!G41","v":"NA"},{"$f":"'I. Info Sys AD&M'!H41","v":0},"N/A",0,"N/A","WPS.2.9.2.5","N/A"]
[{"$f":"'I. Info Sys AD&M'!A42","v":2674},{"$f":"'I. Info Sys AD&M'!I42","v":2},{"$f":"'I. Info Sys AD&M'!J42","v":0},{"$f":"'I. Info Sys AD&M'!X42","v":0},{"$f":"'I. Info Sys AD&M'!B42","v":"I.2.22"},{"$f":"'I. Info Sys AD&M'!C42","v":"Are access control procedures the same for both the test and production environment?"},{"$f":"'I. Info Sys AD&M'!D42","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E42","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F42","v":"H.5 Controls for Unattended Systems"},{"$f":"'I. Info Sys AD&M'!G42","v":"14.3.1.a"},{"$f":"'I. Info Sys AD&M'!H42","v":"Protection of test data"},"AI3.3","Infrastructure maintenance","6.4.2","D&A.1.10.1.4.1 WPS.2.9.5.3","AI3.3, DS2.4, DS9.1, DS9.2, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A43","v":2172},{"$f":"'I. Info Sys AD&M'!I43","v":2},{"$f":"'I. Info Sys AD&M'!J43","v":0},{"$f":"'I. Info Sys AD&M'!X43","v":0},{"$f":"'I. Info Sys AD&M'!B43","v":"I.2.23"},{"$f":"'I. Info Sys AD&M'!C43","v":"Prior to implementation, do applications go through a risk assessment and approval by security?"},{"$f":"'I. Info Sys AD&M'!D43","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E43","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F43","v":"I.7 Application Security SDLC Phases, I.8 Security Review of Internal and External Applications"},{"$f":"'I. Info Sys AD&M'!G43","v":"14.2.2                                       14.2.4.a"},{"$f":"'I. Info Sys AD&M'!H43","v":"System change control procedures,                                Restrictions on changes to software packages"},"AI2.6","Major upgrades to existing systems","6.4.5.3","IS.2.H.8.1","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A44","v":2177},{"$f":"'I. Info Sys AD&M'!I44","v":2},{"$f":"'I. Info Sys AD&M'!J44","v":0},{"$f":"'I. Info Sys AD&M'!X44","v":0},{"$f":"'I. Info Sys AD&M'!B44","v":"I.2.24"},{"$f":"'I. Info Sys AD&M'!C44","v":"Is Internet facing software and infrastructure tested prior to implementation? If yes, does the testing include:"},{"$f":"'I. Info Sys AD&M'!D44","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E44","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F44","v":"I.6 Application Security Vulnerability Assessment and Remediation"},{"$f":"'I. Info Sys AD&M'!G44","v":"14.1.1"},{"$f":"'I. Info Sys AD&M'!H44","v":"Information security requirements analysis and specification"},"PO6.4","Policy rollout",6.6,"IS.2.H.8.3","PO6.4, DS5.5, ME2.2, ME2.5, ME4.7"]
[{"$f":"'I. Info Sys AD&M'!A45","v":2179},{"$f":"'I. Info Sys AD&M'!I45","v":3},{"$f":"'I. Info Sys AD&M'!J45","v":0},{"$f":"'I. Info Sys AD&M'!X45","v":0},{"$f":"'I. Info Sys AD&M'!B45","v":"I.2.24.1"},{"$f":"'I. Info Sys AD&M'!C45","v":"Issue tracking and resolution?"},{"$f":"'I. Info Sys AD&M'!D45","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E45","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F45","v":0},{"$f":"'I. Info Sys AD&M'!G45","v":"14.1.1"},{"$f":"'I. Info Sys AD&M'!H45","v":"Information security requirements analysis and specification"},"PO6.4","Policy rollout",6.6,"D&A.1.9.1.5","PO6.4, DS5.5, ME2.2, ME2.5, ME4.7"]
[{"$f":"'I. Info Sys AD&M'!A46","v":2180},{"$f":"'I. Info Sys AD&M'!I46","v":3},{"$f":"'I. Info Sys AD&M'!J46","v":0},{"$f":"'I. Info Sys AD&M'!X46","v":0},{"$f":"'I. Info Sys AD&M'!B46","v":"I.2.24.2"},{"$f":"'I. Info Sys AD&M'!C46","v":"Metrics on software defects and release incidents?"},{"$f":"'I. Info Sys AD&M'!D46","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E46","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F46","v":0},{"$f":"'I. Info Sys AD&M'!G46","v":"14.1.1"},{"$f":"'I. Info Sys AD&M'!H46","v":"Information security requirements analysis and specification"},"PO6.4","Policy rollout","N/A","D&A.1.9.1.4","PO6.4, DS5.5, ME2.2, ME2.5, ME4.7"]
[{"$f":"'I. Info Sys AD&M'!A47","v":2204},{"$f":"'I. Info Sys AD&M'!I47","v":2},{"$f":"'I. Info Sys AD&M'!J47","v":0},{"$f":"'I. Info Sys AD&M'!X47","v":0},{"$f":"'I. Info Sys AD&M'!B47","v":"I.2.25"},{"$f":"'I. Info Sys AD&M'!C47","v":"Is there a documented change management / change control process? If yes, does it include:"},{"$f":"'I. Info Sys AD&M'!D47","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E47","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F47","v":"G.21 Change Control"},{"$f":"'I. Info Sys AD&M'!G47","v":"14.2.2 "},{"$f":"'I. Info Sys AD&M'!H47","v":"System change control procedures"},"AI2.6","Major upgrades to existing systems",6.4,"IS.2.H.6","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A48","v":2206},{"$f":"'I. Info Sys AD&M'!I48","v":3},{"$f":"'I. Info Sys AD&M'!J48","v":0},{"$f":"'I. Info Sys AD&M'!X48","v":0},{"$f":"'I. Info Sys AD&M'!B48","v":"I.2.25.1"},{"$f":"'I. Info Sys AD&M'!C48","v":"Testing prior to deployment?"},{"$f":"'I. Info Sys AD&M'!D48","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E48","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F48","v":"I.7 Application Security SDLC Phases"},{"$f":"'I. Info Sys AD&M'!G48","v":"12.5.1.c "},{"$f":"'I. Info Sys AD&M'!H48","v":"Installation of software on operational systems"},"DS5.7","Protection of security technology",6.1,"N/A","DS5.7, DS9.1"]
[{"$f":"'I. Info Sys AD&M'!A49","v":2207},{"$f":"'I. Info Sys AD&M'!I49","v":3},{"$f":"'I. Info Sys AD&M'!J49","v":0},{"$f":"'I. Info Sys AD&M'!X49","v":0},{"$f":"'I. Info Sys AD&M'!B49","v":"I.2.25.2"},{"$f":"'I. Info Sys AD&M'!C49","v":"Management approval prior to deployment?"},{"$f":"'I. Info Sys AD&M'!D49","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E49","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F49","v":"I.8 Security Review of Internal and External Applications"},{"$f":"'I. Info Sys AD&M'!G49","v":"12.5.1.a                                    14.2.2.f "},{"$f":"'I. Info Sys AD&M'!H49","v":"Installation of software on operational systems                              System change control procedures"},"AI2.6","Major upgrades to existing systems","6.3.2","N/A","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A50","v":2208},{"$f":"'I. Info Sys AD&M'!I50","v":3},{"$f":"'I. Info Sys AD&M'!J50","v":0},{"$f":"'I. Info Sys AD&M'!X50","v":0},{"$f":"'I. Info Sys AD&M'!B50","v":"I.2.25.3"},{"$f":"'I. Info Sys AD&M'!C50","v":"Establishment of restart points?"},{"$f":"'I. Info Sys AD&M'!D50","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E50","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F50","v":0},{"$f":"'I. Info Sys AD&M'!G50","v":"12.5.1.e"},{"$f":"'I. Info Sys AD&M'!H50","v":"Control Of Operational Software"},"DS5.7","Protection of security technology","N/A","N/A","DS5.7, DS9.1"]
[{"$f":"'I. Info Sys AD&M'!A51","v":2209},{"$f":"'I. Info Sys AD&M'!I51","v":3},{"$f":"'I. Info Sys AD&M'!J51","v":0},{"$f":"'I. Info Sys AD&M'!X51","v":0},{"$f":"'I. Info Sys AD&M'!B51","v":"I.2.25.4"},{"$f":"'I. Info Sys AD&M'!C51","v":"Management approval for changes?"},{"$f":"'I. Info Sys AD&M'!D51","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E51","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F51","v":0},{"$f":"'I. Info Sys AD&M'!G51","v":"14.2.2.f"},{"$f":"'I. Info Sys AD&M'!H51","v":"System change control procedures"},"AI2.6","Major upgrades to existing systems","6.3.2","N/A","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A52","v":2675},{"$f":"'I. Info Sys AD&M'!I52","v":3},{"$f":"'I. Info Sys AD&M'!J52","v":0},{"$f":"'I. Info Sys AD&M'!X52","v":0},{"$f":"'I. Info Sys AD&M'!B52","v":"I.2.25.5"},{"$f":"'I. Info Sys AD&M'!C52","v":"Requirements for the transfer of software from development to production?"},{"$f":"'I. Info Sys AD&M'!D52","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E52","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F52","v":0},{"$f":"'I. Info Sys AD&M'!G52","v":"12.1.4.a "},{"$f":"'I. Info Sys AD&M'!H52","v":"Separation of development, testing and operational environments"},"N/A",0,"N/A","D&A.1.10.1.2","DS5.9"]
[{"$f":"'I. Info Sys AD&M'!A53","v":2210},{"$f":"'I. Info Sys AD&M'!I53","v":3},{"$f":"'I. Info Sys AD&M'!J53","v":0},{"$f":"'I. Info Sys AD&M'!X53","v":0},{"$f":"'I. Info Sys AD&M'!B53","v":"I.2.25.6"},{"$f":"'I. Info Sys AD&M'!C53","v":"Review of code changes by information security?"},{"$f":"'I. Info Sys AD&M'!D53","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E53","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F53","v":"I.2 Secure Systems Development Life Cycle (SDLC) code reviews"},{"$f":"'I. Info Sys AD&M'!G53","v":"12.5.1.c "},{"$f":"'I. Info Sys AD&M'!H53","v":"Installation of software on operational systems"},"DS5.7","Protection of security technology","N/A","N/A","DS5.7, DS9.1"]
[{"$f":"'I. Info Sys AD&M'!A54","v":2676},{"$f":"'I. Info Sys AD&M'!I54","v":3},{"$f":"'I. Info Sys AD&M'!J54","v":0},{"$f":"'I. Info Sys AD&M'!X54","v":0},{"$f":"'I. Info Sys AD&M'!B54","v":"I.2.25.7"},{"$f":"'I. Info Sys AD&M'!C54","v":"Stakeholder communication and/or approvals?"},{"$f":"'I. Info Sys AD&M'!D54","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E54","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F54","v":"G.21 Change Control"},{"$f":"'I. Info Sys AD&M'!G54","v":"14.2.2.f"},{"$f":"'I. Info Sys AD&M'!H54","v":"System change control procedures"},"AI2.6","Major upgrades to existing systems","N/A","N/A","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A55","v":2677},{"$f":"'I. Info Sys AD&M'!I55","v":3},{"$f":"'I. Info Sys AD&M'!J55","v":0},{"$f":"'I. Info Sys AD&M'!X55","v":0},{"$f":"'I. Info Sys AD&M'!B55","v":"I.2.25.8"},{"$f":"'I. Info Sys AD&M'!C55","v":"A list of individuals authorized to approve changes?"},{"$f":"'I. Info Sys AD&M'!D55","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E55","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F55","v":"G.21 Change Control"},{"$f":"'I. Info Sys AD&M'!G55","v":"14.2.2.a"},{"$f":"'I. Info Sys AD&M'!H55","v":"System change control procedures"},"AI2.6","Major upgrades to existing systems","N/A","D&A.1.5.1.11","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A56","v":2678},{"$f":"'I. Info Sys AD&M'!I56","v":3},{"$f":"'I. Info Sys AD&M'!J56","v":0},{"$f":"'I. Info Sys AD&M'!X56","v":0},{"$f":"'I. Info Sys AD&M'!B56","v":"I.2.25.9"},{"$f":"'I. Info Sys AD&M'!C56","v":"An impact assessment to review all affected systems and applications?"},{"$f":"'I. Info Sys AD&M'!D56","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E56","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F56","v":0},{"$f":"'I. Info Sys AD&M'!G56","v":"14.2.2.e"},{"$f":"'I. Info Sys AD&M'!H56","v":"System change control procedures"},"AI2.6","Major upgrades to existing systems","6.4.5.1","D&A.1.5.1.12","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A57","v":2679},{"$f":"'I. Info Sys AD&M'!I57","v":3},{"$f":"'I. Info Sys AD&M'!J57","v":0},{"$f":"'I. Info Sys AD&M'!X57","v":0},{"$f":"'I. Info Sys AD&M'!B57","v":"I.2.25.10"},{"$f":"'I. Info Sys AD&M'!C57","v":"Documentation for all system changes?"},{"$f":"'I. Info Sys AD&M'!D57","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E57","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F57","v":"G.21 Change Control"},{"$f":"'I. Info Sys AD&M'!G57","v":"14.2.2.h"},{"$f":"'I. Info Sys AD&M'!H57","v":"System change control procedures"},"AI2.6","Major upgrades to existing systems",6.4,"N/A","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A58","v":2680},{"$f":"'I. Info Sys AD&M'!I58","v":3},{"$f":"'I. Info Sys AD&M'!J58","v":0},{"$f":"'I. Info Sys AD&M'!X58","v":0},{"$f":"'I. Info Sys AD&M'!B58","v":"I.2.25.11"},{"$f":"'I. Info Sys AD&M'!C58","v":"Version control for all software?"},{"$f":"'I. Info Sys AD&M'!D58","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E58","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F58","v":0},{"$f":"'I. Info Sys AD&M'!G58","v":"14.2.2.i"},{"$f":"'I. Info Sys AD&M'!H58","v":"System change control procedures"},"AI2.6","Major upgrades to existing systems","N/A","D&A.1.10.1.5","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A59","v":2681},{"$f":"'I. Info Sys AD&M'!I59","v":3},{"$f":"'I. Info Sys AD&M'!J59","v":0},{"$f":"'I. Info Sys AD&M'!X59","v":0},{"$f":"'I. Info Sys AD&M'!B59","v":"I.2.25.12"},{"$f":"'I. Info Sys AD&M'!C59","v":"Logging of all change requests?"},{"$f":"'I. Info Sys AD&M'!D59","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E59","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F59","v":"G.21 Change Control"},{"$f":"'I. Info Sys AD&M'!G59","v":"14.2.2.j"},{"$f":"'I. Info Sys AD&M'!H59","v":"System change control procedures"},"AI2.6","Major upgrades to existing systems","N/A","D&A.1.12.4.1","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A60","v":2682},{"$f":"'I. Info Sys AD&M'!I60","v":3},{"$f":"'I. Info Sys AD&M'!J60","v":0},{"$f":"'I. Info Sys AD&M'!X60","v":0},{"$f":"'I. Info Sys AD&M'!B60","v":"I.2.25.13"},{"$f":"'I. Info Sys AD&M'!C60","v":"Changes only take place during specified and agreed upon times (green zone)?"},{"$f":"'I. Info Sys AD&M'!D60","v":"No"},{"$f":"'I. Info Sys AD&M'!E60","v":0},{"$f":"'I. Info Sys AD&M'!F60","v":"G.21 Change Control"},{"$f":"'I. Info Sys AD&M'!G60","v":"14.2.2.l"},{"$f":"'I. Info Sys AD&M'!H60","v":"System change control procedures"},"AI2.6","Major upgrades to existing systems","N/A","N/A","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A61","v":2212},{"$f":"'I. Info Sys AD&M'!I61","v":3},{"$f":"'I. Info Sys AD&M'!J61","v":0},{"$f":"'I. Info Sys AD&M'!X61","v":0},{"$f":"'I. Info Sys AD&M'!B61","v":"I.2.25.14"},{"$f":"'I. Info Sys AD&M'!C61","v":"Modifications and changes to software are strictly controlled?"},{"$f":"'I. Info Sys AD&M'!D61","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E61","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F61","v":"G.21 Change Control"},{"$f":"'I. Info Sys AD&M'!G61","v":"14.2.2.e"},{"$f":"'I. Info Sys AD&M'!H61","v":"System change control procedures"},"AI2.6","Major upgrades to existing systems",6.4,"N/A","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A62","v":2683},{"$f":"'I. Info Sys AD&M'!I62","v":2},{"$f":"'I. Info Sys AD&M'!J62","v":0},{"$f":"'I. Info Sys AD&M'!X62","v":0},{"$f":"'I. Info Sys AD&M'!B62","v":"I.2.26"},{"$f":"'I. Info Sys AD&M'!C62","v":"Are audit logs maintained and reviewed for all program library updates?"},{"$f":"'I. Info Sys AD&M'!D62","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E62","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F62","v":0},{"$f":"'I. Info Sys AD&M'!G62","v":"12.5.1.f "},{"$f":"'I. Info Sys AD&M'!H62","v":"Installation of software on operational systems"},"DS5.7","Protection of security technology","10.6.2","D&A.1.7.1.7 D&A.1.10.1.4 D&A.1.10.1.4.2","DS5.7, DS9.1"]
[{"$f":"'I. Info Sys AD&M'!A63","v":2684},{"$f":"'I. Info Sys AD&M'!I63","v":2},{"$f":"'I. Info Sys AD&M'!J63","v":0},{"$f":"'I. Info Sys AD&M'!X63","v":0},{"$f":"'I. Info Sys AD&M'!B63","v":"I.2.27"},{"$f":"'I. Info Sys AD&M'!C63","v":"Are compilers, editors or other development tools present in the production environment?"},{"$f":"'I. Info Sys AD&M'!D63","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E63","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F63","v":0},{"$f":"'I. Info Sys AD&M'!G63","v":"12.1.4.e"},{"$f":"'I. Info Sys AD&M'!H63","v":"Separation of development, testing and operational environments"},"PO4.11","Segregation of duties","N/A","D&A.1.7.1.8 D&A.1.10.1.3","PO4.11, AI3.4, AI7.4"]
[{"$f":"'I. Info Sys AD&M'!A64","v":2872},{"$f":"'I. Info Sys AD&M'!I64","v":1},{"$f":"'I. Info Sys AD&M'!J64","v":0},{"$f":"'I. Info Sys AD&M'!X64","v":0},{"$f":"'I. Info Sys AD&M'!B64","v":"I.3"},{"$f":"'I. Info Sys AD&M'!C64","v":"Are criteria for accepting new information systems, upgrades, and new versions established? If yes, do they include:"},{"$f":"'I. Info Sys AD&M'!D64","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E64","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F64","v":0},{"$f":"'I. Info Sys AD&M'!G64","v":"12.1.3                                      14.2.9"},{"$f":"'I. Info Sys AD&M'!H64","v":"Capacity management, System acceptance"},"DS4.9","Offsite backup storage","N/A","BCP.1.4.1.2","DS4.9, DS11.2, DS11.5, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A65","v":2874},{"$f":"'I. Info Sys AD&M'!I65","v":2},{"$f":"'I. Info Sys AD&M'!J65","v":0},{"$f":"'I. Info Sys AD&M'!X65","v":0},{"$f":"'I. Info Sys AD&M'!B65","v":"I.3.1"},{"$f":"'I. Info Sys AD&M'!C65","v":"Performance and computer capacity requirements?"},{"$f":"'I. Info Sys AD&M'!D65","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E65","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F65","v":0},{"$f":"'I. Info Sys AD&M'!G65","v":"12.1.3"},{"$f":"'I. Info Sys AD&M'!H65","v":"Capacity management"},"DS4.9","Offsite backup storage","N/A","IS.2.I.1","DS4.9, DS11.2, DS11.5, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A66","v":2875},{"$f":"'I. Info Sys AD&M'!I66","v":2},{"$f":"'I. Info Sys AD&M'!J66","v":0},{"$f":"'I. Info Sys AD&M'!X66","v":0},{"$f":"'I. Info Sys AD&M'!B66","v":"I.3.2"},{"$f":"'I. Info Sys AD&M'!C66","v":"Error recovery and restart procedures?"},{"$f":"'I. Info Sys AD&M'!D66","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E66","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F66","v":0},{"$f":"'I. Info Sys AD&M'!G66","v":"12.1.1.h"},{"$f":"'I. Info Sys AD&M'!H66","v":"Documented operating procedures"},"DS4.9","Offsite backup storage","N/A","BCP.1.4.1.3 BCP.1.4.3.4","DS4.9, DS11.2, DS11.5, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A67","v":2876},{"$f":"'I. Info Sys AD&M'!I67","v":2},{"$f":"'I. Info Sys AD&M'!J67","v":0},{"$f":"'I. Info Sys AD&M'!X67","v":0},{"$f":"'I. Info Sys AD&M'!B67","v":"I.3.3"},{"$f":"'I. Info Sys AD&M'!C67","v":"Preparation and testing of operating procedures?"},{"$f":"'I. Info Sys AD&M'!D67","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E67","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F67","v":0},{"$f":"'I. Info Sys AD&M'!G67","v":"14.2.2"},{"$f":"'I. Info Sys AD&M'!H67","v":"System change control procedures"},"DS4.9","Offsite backup storage","N/A","N/A","DS4.9, DS11.2, DS11.5, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A68","v":2877},{"$f":"'I. Info Sys AD&M'!I68","v":2},{"$f":"'I. Info Sys AD&M'!J68","v":0},{"$f":"'I. Info Sys AD&M'!X68","v":0},{"$f":"'I. Info Sys AD&M'!B68","v":"I.3.4"},{"$f":"'I. Info Sys AD&M'!C68","v":"Agreed set of security controls?"},{"$f":"'I. Info Sys AD&M'!D68","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E68","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F68","v":0},{"$f":"'I. Info Sys AD&M'!G68","v":"14.2.9"},{"$f":"'I. Info Sys AD&M'!H68","v":"System acceptance testing"},"DS4.9","Offsite backup storage","N/A","BCP.1.4.2.5","DS4.9, DS11.2, DS11.5, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A69","v":2878},{"$f":"'I. Info Sys AD&M'!I69","v":2},{"$f":"'I. Info Sys AD&M'!J69","v":0},{"$f":"'I. Info Sys AD&M'!X69","v":0},{"$f":"'I. Info Sys AD&M'!B69","v":"I.3.5"},{"$f":"'I. Info Sys AD&M'!C69","v":"Effective manual procedures?"},{"$f":"'I. Info Sys AD&M'!D69","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E69","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F69","v":0},{"$f":"'I. Info Sys AD&M'!G69","v":0},{"$f":"'I. Info Sys AD&M'!H69","v":0},"DS5.11","Exchange of sensitive data","N/A","N/A","DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A70","v":2879},{"$f":"'I. Info Sys AD&M'!I70","v":2},{"$f":"'I. Info Sys AD&M'!J70","v":0},{"$f":"'I. Info Sys AD&M'!X70","v":0},{"$f":"'I. Info Sys AD&M'!B70","v":"I.3.6"},{"$f":"'I. Info Sys AD&M'!C70","v":"Business continuity arrangements?"},{"$f":"'I. Info Sys AD&M'!D70","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E70","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F70","v":0},{"$f":"'I. Info Sys AD&M'!G70","v":"14.2.3.c"},{"$f":"'I. Info Sys AD&M'!H70","v":"Technical review of applications after operating platform changes"},"PO2.3","Data classification scheme","N/A","N/A","PO2.3, PO3.4, AI5.2, DS2.3"]
[{"$f":"'I. Info Sys AD&M'!A71","v":2880},{"$f":"'I. Info Sys AD&M'!I71","v":2},{"$f":"'I. Info Sys AD&M'!J71","v":0},{"$f":"'I. Info Sys AD&M'!X71","v":0},{"$f":"'I. Info Sys AD&M'!B71","v":"I.3.7"},{"$f":"'I. Info Sys AD&M'!C71","v":"Evidence that new system will not adversely affect existing systems, particularly at peak processing times, such as month end?"},{"$f":"'I. Info Sys AD&M'!D71","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E71","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F71","v":0},{"$f":"'I. Info Sys AD&M'!G71","v":"14.2.3.a"},{"$f":"'I. Info Sys AD&M'!H71","v":"Technical review of applications after operating platform changes"},"PO2.3","Data classification scheme","N/A","N/A","PO2.3, PO3.4, AI5.2, DS2.3"]
[{"$f":"'I. Info Sys AD&M'!A72","v":2881},{"$f":"'I. Info Sys AD&M'!I72","v":2},{"$f":"'I. Info Sys AD&M'!J72","v":0},{"$f":"'I. Info Sys AD&M'!X72","v":0},{"$f":"'I. Info Sys AD&M'!B72","v":"I.3.8"},{"$f":"'I. Info Sys AD&M'!C72","v":"Evidence of the effect on the overall security of the respondent?"},{"$f":"'I. Info Sys AD&M'!D72","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E72","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F72","v":0},{"$f":"'I. Info Sys AD&M'!G72","v":"14.2.2.c"},{"$f":"'I. Info Sys AD&M'!H72","v":"System change control procedures"},"N/A",0,"N/A","IS.1.2.3 OPS.1.4.2 OPS.1.4.3 E-BANK.1.4.2.4","N/A"]
[{"$f":"'I. Info Sys AD&M'!A73","v":2595},{"$f":"'I. Info Sys AD&M'!I73","v":1},{"$f":"'I. Info Sys AD&M'!J73","v":0},{"$f":"'I. Info Sys AD&M'!X73","v":0},{"$f":"'I. Info Sys AD&M'!B73","v":"I.4"},{"$f":"'I. Info Sys AD&M'!C73","v":"Are system resources reviewed to ensure adequate capacity is maintained?"},{"$f":"'I. Info Sys AD&M'!D73","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E73","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F73","v":0},{"$f":"'I. Info Sys AD&M'!G73","v":"12.1.3"},{"$f":"'I. Info Sys AD&M'!H73","v":"Capacity Management"},"N/A",0,"N/A","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A74","v":2213},{"$f":"'I. Info Sys AD&M'!I74","v":1},{"$f":"'I. Info Sys AD&M'!J74","v":0},{"$f":"'I. Info Sys AD&M'!X74","v":1},{"$f":"'I. Info Sys AD&M'!B74","v":"I.5"},{"$f":"'I. Info Sys AD&M'!C74","v":"Are systems and applications patched? If yes, does it include:"},{"$f":"'I. Info Sys AD&M'!D74","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E74","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F74","v":"I.4 System Patching"},{"$f":"'I. Info Sys AD&M'!G74","v":"12.6.1 "},{"$f":"'I. Info Sys AD&M'!H74","v":"Management of technical vulnerabilities"},"AI3.3","Infrastructure maintenance",6.2,"D&A.1.11","AI3.3, AI6.2, AI6.3, DS5.5, DS5.7, DS9.2"]
[{"$f":"'I. Info Sys AD&M'!A75","v":2215},{"$f":"'I. Info Sys AD&M'!I75","v":2},{"$f":"'I. Info Sys AD&M'!J75","v":0},{"$f":"'I. Info Sys AD&M'!X75","v":0},{"$f":"'I. Info Sys AD&M'!B75","v":"I.5.1"},{"$f":"'I. Info Sys AD&M'!C75","v":"Testing of patches, service packs, and hot fixes prior to installation?"},{"$f":"'I. Info Sys AD&M'!D75","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E75","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F75","v":"I.4 System Patching"},{"$f":"'I. Info Sys AD&M'!G75","v":"12.6.1.g"},{"$f":"'I. Info Sys AD&M'!H75","v":"Management of technical vulnerabilities"},"AI3.3","Infrastructure maintenance","6.4.5","D&A.1.11.1.5","AI3.3, AI6.2, AI6.3, DS5.5, DS5.7, DS9.2"]
[{"$f":"'I. Info Sys AD&M'!A76","v":2217},{"$f":"'I. Info Sys AD&M'!I76","v":2},{"$f":"'I. Info Sys AD&M'!J76","v":0},{"$f":"'I. Info Sys AD&M'!X76","v":0},{"$f":"'I. Info Sys AD&M'!B76","v":"I.5.2"},{"$f":"'I. Info Sys AD&M'!C76","v":"Evaluation and prioritize vulnerabilities?"},{"$f":"'I. Info Sys AD&M'!D76","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E76","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F76","v":"I.6 Application Security Vulnerability Assessment and Remediation"},{"$f":"'I. Info Sys AD&M'!G76","v":"12.6.1.f"},{"$f":"'I. Info Sys AD&M'!H76","v":"Management of technical vulnerabilities"},"AI3.3","Infrastructure maintenance",6.1,"IS.1.6.9 D&A.1.11.1.3","AI3.3, AI6.2, AI6.3, DS5.5, DS5.7, DS9.2"]
[{"$f":"'I. Info Sys AD&M'!A77","v":2686},{"$f":"'I. Info Sys AD&M'!I77","v":2},{"$f":"'I. Info Sys AD&M'!J77","v":0},{"$f":"'I. Info Sys AD&M'!X77","v":0},{"$f":"'I. Info Sys AD&M'!B77","v":"I.5.3"},{"$f":"'I. Info Sys AD&M'!C77","v":"Logging?"},{"$f":"'I. Info Sys AD&M'!D77","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E77","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F77","v":0},{"$f":"'I. Info Sys AD&M'!G77","v":"12.6.1.h"},{"$f":"'I. Info Sys AD&M'!H77","v":"Management of technical vulnerabilities"},"AI3.3","Infrastructure maintenance","N/A","D&A.1.11.1.8","AI3.3, AI6.2, AI6.3, DS5.5, DS5.7, DS9.2"]
[{"$f":"'I. Info Sys AD&M'!A78","v":2687},{"$f":"'I. Info Sys AD&M'!I78","v":2},{"$f":"'I. Info Sys AD&M'!J78","v":0},{"$f":"'I. Info Sys AD&M'!X78","v":0},{"$f":"'I. Info Sys AD&M'!B78","v":"I.5.4"},{"$f":"'I. Info Sys AD&M'!C78","v":"Priority patching of high-risk systems first?"},{"$f":"'I. Info Sys AD&M'!D78","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E78","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F78","v":"I.4 System Patching"},{"$f":"'I. Info Sys AD&M'!G78","v":"12.6.1.j"},{"$f":"'I. Info Sys AD&M'!H78","v":"Management of technical vulnerabilities"},"AI3.3","Infrastructure maintenance",6.2,"N/A","AI3.3, AI6.2, AI6.3, DS5.5, DS5.7, DS9.2"]
[{"$f":"'I. Info Sys AD&M'!A79","v":2216},{"$f":"'I. Info Sys AD&M'!I79","v":2},{"$f":"'I. Info Sys AD&M'!J79","v":0},{"$f":"'I. Info Sys AD&M'!X79","v":0},{"$f":"'I. Info Sys AD&M'!B79","v":"I.5.5"},{"$f":"'I. Info Sys AD&M'!C79","v":"Are third party alert services used to keep up to date with the latest vulnerabilities?"},{"$f":"'I. Info Sys AD&M'!D79","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E79","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F79","v":0},{"$f":"'I. Info Sys AD&M'!G79","v":"12.6.1.b"},{"$f":"'I. Info Sys AD&M'!H79","v":"Management of technical vulnerabilities"},"AI3.3","Infrastructure maintenance","N/A","N/A","AI3.3, AI6.2, AI6.3, DS5.5, DS5.7, DS9.2"]
[{"$f":"'I. Info Sys AD&M'!A80","v":2230},{"$f":"'I. Info Sys AD&M'!I80","v":1},{"$f":"'I. Info Sys AD&M'!J80","v":0},{"$f":"'I. Info Sys AD&M'!X80","v":1},{"$f":"'I. Info Sys AD&M'!B80","v":"I.6"},{"$f":"'I. Info Sys AD&M'!C80","v":"Is a web site supported, hosted or maintained that has access to Scoped Systems and Data? If yes, is there:"},{"$f":"'I. Info Sys AD&M'!D80","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E80","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F80","v":0},{"$f":"'I. Info Sys AD&M'!G80","v":"NA"},{"$f":"'I. Info Sys AD&M'!H80","v":0},"N/A",0,"N/A","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A81","v":2231},{"$f":"'I. Info Sys AD&M'!I81","v":2},{"$f":"'I. Info Sys AD&M'!J81","v":0},{"$f":"'I. Info Sys AD&M'!X81","v":0},{"$f":"'I. Info Sys AD&M'!B81","v":"I.6.1"},{"$f":"'I. Info Sys AD&M'!C81","v":"Regular penetration tests executed against web-based applications?"},{"$f":"'I. Info Sys AD&M'!D81","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E81","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F81","v":"I.1 Application Vulnerability Assessments/Ethical Hacking"},{"$f":"'I. Info Sys AD&M'!G81","v":"18.2.3 "},{"$f":"'I. Info Sys AD&M'!H81","v":"Technical compliance review"},"DS5.5","Security testing, surveillance and monitoring",11.3,"E-BANK.1.4.8.3 E-BANK.1.1.1.8.4","DS5.5, DS5.7, ME2.5"]
[{"$f":"'I. Info Sys AD&M'!A82","v":2076},{"$f":"'I. Info Sys AD&M'!I82","v":2},{"$f":"'I. Info Sys AD&M'!J82","v":0},{"$f":"'I. Info Sys AD&M'!X82","v":0},{"$f":"'I. Info Sys AD&M'!B82","v":"I.6.2"},{"$f":"'I. Info Sys AD&M'!C82","v":"Physical separation of server components (web, application, database)?"},{"$f":"'I. Info Sys AD&M'!D82","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E82","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F82","v":0},{"$f":"'I. Info Sys AD&M'!G82","v":"13.1.3 "},{"$f":"'I. Info Sys AD&M'!H82","v":"Segragation in networks"},"DS5.3","Identity management","2.2.1","N/A","DS5.4"]
[{"$f":"'I. Info Sys AD&M'!A83","v":2081},{"$f":"'I. Info Sys AD&M'!I83","v":2},{"$f":"'I. Info Sys AD&M'!J83","v":0},{"$f":"'I. Info Sys AD&M'!X83","v":0},{"$f":"'I. Info Sys AD&M'!B83","v":"I.6.3"},{"$f":"'I. Info Sys AD&M'!C83","v":"Web applications configured to follow best practices or security guidelines (OWASP)?"},{"$f":"'I. Info Sys AD&M'!D83","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E83","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F83","v":0},{"$f":"'I. Info Sys AD&M'!G83","v":"13.1.1"},{"$f":"'I. Info Sys AD&M'!H83","v":"Network Controls"},"N/A",0,"N/A","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A84","v":2109},{"$f":"'I. Info Sys AD&M'!I84","v":2},{"$f":"'I. Info Sys AD&M'!J84","v":0},{"$f":"'I. Info Sys AD&M'!X84","v":0},{"$f":"'I. Info Sys AD&M'!B84","v":"I.6.4"},{"$f":"'I. Info Sys AD&M'!C84","v":"Data input into applications validated for accuracy?"},{"$f":"'I. Info Sys AD&M'!D84","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E84","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F84","v":0},{"$f":"'I. Info Sys AD&M'!G84","v":"14.2.1"},{"$f":"'I. Info Sys AD&M'!H84","v":"Securing application services on public networks"},"AI2.3","Application control and auditability","N/A","IS.2.G.2","AI2.3"]
[{"$f":"'I. Info Sys AD&M'!A85","v":2110},{"$f":"'I. Info Sys AD&M'!I85","v":2},{"$f":"'I. Info Sys AD&M'!J85","v":0},{"$f":"'I. Info Sys AD&M'!X85","v":0},{"$f":"'I. Info Sys AD&M'!B85","v":"I.6.5"},{"$f":"'I. Info Sys AD&M'!C85","v":"Validation checks include cross site scripting and SQL injections?"},{"$f":"'I. Info Sys AD&M'!D85","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E85","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"'I. Info Sys AD&M'!F85","v":0},{"$f":"'I. Info Sys AD&M'!G85","v":"14.2.1"},{"$f":"'I. Info Sys AD&M'!H85","v":"Securing application services on public networks"},"AI2.3","Application control and auditability","6.5.7","N/A","AI2.3"]
[{"$f":"'I. Info Sys AD&M'!A86","v":2225},{"$f":"'I. Info Sys AD&M'!I86","v":1},{"$f":"'I. Info Sys AD&M'!J86","v":0},{"$f":"'I. Info Sys AD&M'!X86","v":1},{"$f":"'I. Info Sys AD&M'!B86","v":"I.7"},{"$f":"'I. Info Sys AD&M'!C86","v":"Are vulnerability tests (internal/external) performed on all applications at least annually? If yes, are there:"},{"$f":"'I. Info Sys AD&M'!D86","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E86","v":"Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)"},{"$f":"'I. Info Sys AD&M'!F86","v":"I.1 Application Vulnerability Assessments/Ethical Hacking"},{"$f":"'I. Info Sys AD&M'!G86","v":"18.2.3"},{"$f":"'I. Info Sys AD&M'!H86","v":"Technical compliance review"},"DS5.5","Security testing, surveillance and monitoring",11.2,"IS.2.M.10.3 E-BANK.1.2.5.2 E-BANK.1.1.1.8.3","DS5.5, DS5.7, ME2.5"]
[{"$f":"'I. Info Sys AD&M'!A87","v":2220},{"$f":"'I. Info Sys AD&M'!I87","v":2},{"$f":"'I. Info Sys AD&M'!J87","v":0},{"$f":"'I. Info Sys AD&M'!X87","v":0},{"$f":"'I. Info Sys AD&M'!B87","v":"I.7.1"},{"$f":"'I. Info Sys AD&M'!C87","v":"Results tracked, remediated and reported to management?"},{"$f":"'I. Info Sys AD&M'!D87","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E87","v":"Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)"},{"$f":"'I. Info Sys AD&M'!F87","v":0},{"$f":"'I. Info Sys AD&M'!G87","v":"18.2.2"},{"$f":"'I. Info Sys AD&M'!H87","v":"Compliance With Security Policies And Standards"},"PO4.8","Responsibility for risk, security and compliance",11.2,"N/A","PO4.8, PO6.2, ME2.1, ME2.2, ME2.3, ME2.4, ME2.5, ME2.6, ME2.7"]
[{"$f":"'I. Info Sys AD&M'!A88","v":2233},{"$f":"'I. Info Sys AD&M'!I88","v":2},{"$f":"'I. Info Sys AD&M'!J88","v":0},{"$f":"'I. Info Sys AD&M'!X88","v":0},{"$f":"'I. Info Sys AD&M'!B88","v":"I.7.2"},{"$f":"'I. Info Sys AD&M'!C88","v":"Processes to manage threat and vulnerability assessment tools and the data they collect?"},{"$f":"'I. Info Sys AD&M'!D88","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E88","v":"Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)"},{"$f":"'I. Info Sys AD&M'!F88","v":"I.5 Application Security Program Governance"},{"$f":"'I. Info Sys AD&M'!G88","v":"12.6.1"},{"$f":"'I. Info Sys AD&M'!H88","v":"Management of technical vulnerabilities"},"AI2.3","Application control and auditability",11.2,"N/A","AI2.3, AI2.4, DS5.7"]
[{"$f":"'I. Info Sys AD&M'!A89","v":1806},{"$f":"'I. Info Sys AD&M'!I89","v":1},{"$f":"'I. Info Sys AD&M'!J89","v":0},{"$f":"'I. Info Sys AD&M'!X89","v":1},{"$f":"'I. Info Sys AD&M'!B89","v":"I.8"},{"$f":"'I. Info Sys AD&M'!C89","v":"Are encryption tools managed and maintained for Scoped Data? If yes, is there:"},{"$f":"'I. Info Sys AD&M'!D89","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E89","v":"Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)"},{"$f":"'I. Info Sys AD&M'!F89","v":"G.22 Data Security Policy - Encryption"},{"$f":"'I. Info Sys AD&M'!G89","v":10.1},{"$f":"'I. Info Sys AD&M'!H89","v":"Cytographic controls"},"N/A",0,3.6,"WPS.2.5","N/A"]
[{"$f":"'I. Info Sys AD&M'!A90","v":1807},{"$f":"'I. Info Sys AD&M'!I90","v":2},{"$f":"'I. Info Sys AD&M'!J90","v":0},{"$f":"'I. Info Sys AD&M'!X90","v":0},{"$f":"'I. Info Sys AD&M'!B90","v":"I.8.1"},{"$f":"'I. Info Sys AD&M'!C90","v":"An encryption policy?"},{"$f":"'I. Info Sys AD&M'!D90","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E90","v":"Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)"},{"$f":"'I. Info Sys AD&M'!F90","v":"G.22 Data Security Policy - Encryption"},{"$f":"'I. Info Sys AD&M'!G90","v":"10.1.1"},{"$f":"'I. Info Sys AD&M'!H90","v":"Policy On The Use Of Cryptographic Controls"},"PO6.2","Enterprise IT risk and internal control framework",4.3,"N/A","PO6, AI2, DS5"]
[{"$f":"'I. Info Sys AD&M'!A91","v":1813},{"$f":"'I. Info Sys AD&M'!I91","v":2},{"$f":"'I. Info Sys AD&M'!J91","v":0},{"$f":"'I. Info Sys AD&M'!X91","v":0},{"$f":"'I. Info Sys AD&M'!B91","v":"I.8.2"},{"$f":"'I. Info Sys AD&M'!C91","v":"Encryption in storage / at rest?"},{"$f":"'I. Info Sys AD&M'!D91","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E91","v":"Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)"},{"$f":"'I. Info Sys AD&M'!F91","v":"G.22 Data Security Policy - Encryption"},{"$f":"'I. Info Sys AD&M'!G91","v":"10.1.1 Section 2.a"},{"$f":"'I. Info Sys AD&M'!H91","v":"Policy On The Use Of Cryptographic Controls"},"N/A",0,"3.5, 3.5.2","OPS.1.6.1 RPS.2.C.2.8","PO2.3, PO6.2, DS11.1"]
[{"$f":"'I. Info Sys AD&M'!A92","v":3219},{"$f":"'I. Info Sys AD&M'!I92","v":2},{"$f":"'I. Info Sys AD&M'!J92","v":0},{"$f":"'I. Info Sys AD&M'!X92","v":0},{"$f":"'I. Info Sys AD&M'!B92","v":"I.8.3"},{"$f":"'I. Info Sys AD&M'!C92","v":"Clear text data ever visible by anyone, including system administrators?"},{"$f":"'I. Info Sys AD&M'!D92","v":"No"},{"$f":"'I. Info Sys AD&M'!E92","v":"Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)"},{"$f":"'I. Info Sys AD&M'!F92","v":0},{"$f":"'I. Info Sys AD&M'!G92","v":"NA"},{"$f":"'I. Info Sys AD&M'!H92","v":0},"N/A",0,"3.3, 3.4","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A93","v":1814},{"$f":"'I. Info Sys AD&M'!I93","v":2},{"$f":"'I. Info Sys AD&M'!J93","v":0},{"$f":"'I. Info Sys AD&M'!X93","v":0},{"$f":"'I. Info Sys AD&M'!B93","v":"I.8.4"},{"$f":"'I. Info Sys AD&M'!C93","v":"Centralized key management system?"},{"$f":"'I. Info Sys AD&M'!D93","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E93","v":"Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)"},{"$f":"'I. Info Sys AD&M'!F93","v":"G.22 Data Security Policy - Encryption"},{"$f":"'I. Info Sys AD&M'!G93","v":"10.1.2"},{"$f":"'I. Info Sys AD&M'!H93","v":"Key Management"},"DS5.8","Cryptographic key management","N/A","N/A","DS5"]
[{"$f":"'I. Info Sys AD&M'!A94","v":1815},{"$f":"'I. Info Sys AD&M'!I94","v":2},{"$f":"'I. Info Sys AD&M'!J94","v":0},{"$f":"'I. Info Sys AD&M'!X94","v":0},{"$f":"'I. Info Sys AD&M'!B94","v":"I.8.5"},{"$f":"'I. Info Sys AD&M'!C94","v":"Encryption keys encrypted at rest and when transmitted?"},{"$f":"'I. Info Sys AD&M'!D94","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E94","v":"Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)"},{"$f":"'I. Info Sys AD&M'!F94","v":"G.22 Data Security Policy - Encryption"},{"$f":"'I. Info Sys AD&M'!G94","v":"10.1.2"},{"$f":"'I. Info Sys AD&M'!H94","v":"Key Management"},"N/A",0,"3.6.2, 3.6.3","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A95","v":1902},{"$f":"'I. Info Sys AD&M'!I95","v":2},{"$f":"'I. Info Sys AD&M'!J95","v":0},{"$f":"'I. Info Sys AD&M'!X95","v":0},{"$f":"'I. Info Sys AD&M'!B95","v":"I.8.6"},{"$f":"'I. Info Sys AD&M'!C95","v":"Segregation of duties between key management duties and normal operational duties?"},{"$f":"'I. Info Sys AD&M'!D95","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E95","v":"Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)"},{"$f":"'I. Info Sys AD&M'!F95","v":0},{"$f":"'I. Info Sys AD&M'!G95","v":"6.1.2"},{"$f":"'I. Info Sys AD&M'!H95","v":"Segregation Of Duties"},"PO4.11","Segregation of duties","N/A","IS.1.6.8 MGMT.1.2.1.3 RPS.1.3.1.3","PO4.11, DS5.4"]
[{"$f":"'I. Info Sys AD&M'!A96","v":1865},{"$f":"'I. Info Sys AD&M'!I96","v":2},{"$f":"'I. Info Sys AD&M'!J96","v":0},{"$f":"'I. Info Sys AD&M'!X96","v":0},{"$f":"'I. Info Sys AD&M'!B96","v":"I.8.7"},{"$f":"'I. Info Sys AD&M'!C96","v":"Key/certificate sharing between production and non-production?"},{"$f":"'I. Info Sys AD&M'!D96","v":"No"},{"$f":"'I. Info Sys AD&M'!E96","v":0},{"$f":"'I. Info Sys AD&M'!F96","v":0},{"$f":"'I. Info Sys AD&M'!G96","v":"12.1.4.g"},{"$f":"'I. Info Sys AD&M'!H96","v":"Separation Of Development, Test, And Operational Facilities"},"PO4.11","Segregation of duties","N/A","N/A","PO4.11, AI3.4, AI7.4"]
[{"$f":"'I. Info Sys AD&M'!A97","v":1866},{"$f":"'I. Info Sys AD&M'!I97","v":2},{"$f":"'I. Info Sys AD&M'!J97","v":0},{"$f":"'I. Info Sys AD&M'!X97","v":0},{"$f":"'I. Info Sys AD&M'!B97","v":"I.8.8"},{"$f":"'I. Info Sys AD&M'!C97","v":"Default certificates provided by vendors replaced with proprietary certificates?"},{"$f":"'I. Info Sys AD&M'!D97","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E97","v":"Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)"},{"$f":"'I. Info Sys AD&M'!F97","v":0},{"$f":"'I. Info Sys AD&M'!G97","v":"10.1.2.e"},{"$f":"'I. Info Sys AD&M'!H97","v":"Key Management"},"DS5.3","Identity management","2.1.1","IS.2.A.1","DS5.3"]
[{"$f":"'I. Info Sys AD&M'!A98","v":1859},{"$f":"'I. Info Sys AD&M'!I98","v":2},{"$f":"'I. Info Sys AD&M'!J98","v":0},{"$f":"'I. Info Sys AD&M'!X98","v":0},{"$f":"'I. Info Sys AD&M'!B98","v":"I.8.9"},{"$f":"'I. Info Sys AD&M'!C98","v":"Segregation of access to both parts of an asymmetric key?"},{"$f":"'I. Info Sys AD&M'!D98","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E98","v":"Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)"},{"$f":"'I. Info Sys AD&M'!F98","v":0},{"$f":"'I. Info Sys AD&M'!G98","v":"10.1.2.d"},{"$f":"'I. Info Sys AD&M'!H98","v":"Key Management"},"DS5.8","Cryptographic key management","N/A","IS.2.K.3.4","DS5"]
[{"$f":"'I. Info Sys AD&M'!A99","v":1860},{"$f":"'I. Info Sys AD&M'!I99","v":2},{"$f":"'I. Info Sys AD&M'!J99","v":0},{"$f":"'I. Info Sys AD&M'!X99","v":0},{"$f":"'I. Info Sys AD&M'!B99","v":"I.8.10"},{"$f":"'I. Info Sys AD&M'!C99","v":"Asymmetric encryption key length a minimum of 2048 bit?"},{"$f":"'I. Info Sys AD&M'!D99","v":"Yes"},{"$f":"'I. Info Sys AD&M'!E99","v":"Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)"},{"$f":"'I. Info Sys AD&M'!F99","v":0},{"$f":"'I. Info Sys AD&M'!G99","v":"NA"},{"$f":"'I. Info Sys AD&M'!H99","v":0},"N/A",0,"N/A","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A100","v":0},{"$f":"'I. Info Sys AD&M'!I100","v":0},{"$f":"'I. Info Sys AD&M'!J100","v":0},{"$f":"'I. Info Sys AD&M'!X100","v":0},{"$f":"'I. Info Sys AD&M'!B100","v":0},{"$f":"'I. Info Sys AD&M'!C100","v":0},{"$f":"'I. Info Sys AD&M'!D100","v":0},{"$f":"'I. Info Sys AD&M'!E100","v":0},{"$f":"'I. Info Sys AD&M'!F100","v":0},{"$f":"'I. Info Sys AD&M'!G100","v":0},{"$f":"'I. Info Sys AD&M'!H100","v":0}]
[]
[{"$f":"'J. Incident Event & Comm Mgmt'!B1","v":"J. Incident Event and Communications Management"},null,null,null,{"$f":"'J. Incident Event & Comm Mgmt'!B1","v":"J. Incident Event and Communications Management"}]
[{"$f":"'J. Incident Event & Comm Mgmt'!A5","v":2241},{"$f":"'J. Incident Event & Comm Mgmt'!I5","v":1},{"$f":"'J. Incident Event & Comm Mgmt'!J5","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X5","v":1},{"$f":"'J. Incident Event & Comm Mgmt'!B5","v":"J.1"},{"$f":"'J. Incident Event & Comm Mgmt'!C5","v":"Is there an Incident Management program?"},{"$f":"'J. Incident Event & Comm Mgmt'!D5","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E5","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F5","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G5","v":16},{"$f":"'J. Incident Event & Comm Mgmt'!H5","v":" Information security incident management"},null,null,"N/A","IS.2.M.13 OPS.1.5.1.9 OPS.1.10","N/A"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A6","v":2698},{"$f":"'J. Incident Event & Comm Mgmt'!I6","v":2},{"$f":"'J. Incident Event & Comm Mgmt'!J6","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X6","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B6","v":"J.1.1"},{"$f":"'J. Incident Event & Comm Mgmt'!C6","v":"Is there a documented policy for incident management that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"'J. Incident Event & Comm Mgmt'!D6","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E6","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F6","v":"J.1 Information Security Incident Management Policy \n and Procedures Content"},{"$f":"'J. Incident Event & Comm Mgmt'!G6","v":"16.1.1 "},{"$f":"'J. Incident Event & Comm Mgmt'!H6","v":"Responsibilities and procedures"},"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A7","v":2246},{"$f":"'J. Incident Event & Comm Mgmt'!I7","v":2},{"$f":"'J. Incident Event & Comm Mgmt'!J7","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X7","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B7","v":"J.1.2"},{"$f":"'J. Incident Event & Comm Mgmt'!C7","v":"Is there a formal Incident Response Plan. If yes, does it include:"},{"$f":"'J. Incident Event & Comm Mgmt'!D7","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E7","v":"Cloudamize Security Policy - Cloudamize Security Incident Response Policy"},{"$f":"'J. Incident Event & Comm Mgmt'!F7","v":"J.1 procedure b.5"},{"$f":"'J. Incident Event & Comm Mgmt'!G7","v":"16.1.1.a.1"},{"$f":"'J. Incident Event & Comm Mgmt'!H7","v":"Responsibilities and procedures"},"PO9.3","Event identification","N/A","IS.1.6.5 E-BANK.1.4.7.3","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A8","v":2274},{"$f":"'J. Incident Event & Comm Mgmt'!I8","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!J8","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X8","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B8","v":"J.1.2.1"},{"$f":"'J. Incident Event & Comm Mgmt'!C8","v":"Reporting procedure for an information security event?"},{"$f":"'J. Incident Event & Comm Mgmt'!D8","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E8","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F8","v":"J.1 procedure b.5.g"},{"$f":"'J. Incident Event & Comm Mgmt'!G8","v":"16.1.1.a.2"},{"$f":"'J. Incident Event & Comm Mgmt'!H8","v":"Responsibilities and procedures"},"PO9.3","Event identification","12.5.3","IS.1.7.9 OPS.1.10.1.2 OPS.2.12.F.3 E-BANK.1.4.7.1","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A9","v":2699},{"$f":"'J. Incident Event & Comm Mgmt'!I9","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!J9","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X9","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B9","v":"J.1.2.2"},{"$f":"'J. Incident Event & Comm Mgmt'!C9","v":"Escalation procedure?"},{"$f":"'J. Incident Event & Comm Mgmt'!D9","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E9","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F9","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G9","v":"16.1.1.a.6"},{"$f":"'J. Incident Event & Comm Mgmt'!H9","v":"Responsibilities and procedures"},"PO9.3","Event identification","N/A","IS.2.M.13.3","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A10","v":2276},{"$f":"'J. Incident Event & Comm Mgmt'!I10","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!J10","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X10","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B10","v":"J.1.2.3"},{"$f":"'J. Incident Event & Comm Mgmt'!C10","v":"An Incident / Event Response team with defined roles and response related qualifications available 24x7x365?"},{"$f":"'J. Incident Event & Comm Mgmt'!D10","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E10","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F10","v":"J.1 procedure b.2"},{"$f":"'J. Incident Event & Comm Mgmt'!G10","v":"16.1.5 "},{"$f":"'J. Incident Event & Comm Mgmt'!H10","v":"Response to information security incidents"},"PO9.3","Event identification",12.5,"IS.2.M.14 IS.2.M.20","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A11","v":2280},{"$f":"'J. Incident Event & Comm Mgmt'!I11","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!J11","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X11","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B11","v":"J.1.2.4"},{"$f":"'J. Incident Event & Comm Mgmt'!C11","v":"Procedures to collect and maintain a chain of custody for evidence during incident investigation?"},{"$f":"'J. Incident Event & Comm Mgmt'!D11","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E11","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F11","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G11","v":"16.1.7"},{"$f":"'J. Incident Event & Comm Mgmt'!H11","v":"Collection Of Evidence"},"AI2.3","Application control and auditability","N/A","IS.1.6.6","AI2.3, DS5.6, DS5.7, DS8.2, DS8.3, DS8.4"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A12","v":2702},{"$f":"'J. Incident Event & Comm Mgmt'!I12","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!J12","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X12","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B12","v":"J.1.2.5"},{"$f":"'J. Incident Event & Comm Mgmt'!C12","v":"Feedback process to ensure those reporting information security events are notified of the results after the issue has been dealt with and closed?"},{"$f":"'J. Incident Event & Comm Mgmt'!D12","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E12","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F12","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G12","v":"16.1.1.c.4"},{"$f":"'J. Incident Event & Comm Mgmt'!H12","v":"Responsibilities and procedures"},"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A13","v":2703},{"$f":"'J. Incident Event & Comm Mgmt'!I13","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!J13","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X13","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B13","v":"J.1.2.6"},{"$f":"'J. Incident Event & Comm Mgmt'!C13","v":"Event reporting mechanism to support the reporting action, and to list all necessary actions in case of an information security event?"},{"$f":"'J. Incident Event & Comm Mgmt'!D13","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E13","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F13","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G13","v":"16.1.1.a.2"},{"$f":"'J. Incident Event & Comm Mgmt'!H13","v":"Responsibilities and procedures"},"PO9.3","Event identification",10.3,"E-BANK.1.4.7.4","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A14","v":2704},{"$f":"'J. Incident Event & Comm Mgmt'!I14","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!J14","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X14","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B14","v":"J.1.2.7"},{"$f":"'J. Incident Event & Comm Mgmt'!C14","v":"Actions to be taken in the event of an information security event?"},{"$f":"'J. Incident Event & Comm Mgmt'!D14","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E14","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F14","v":"J.1 procedure b.5"},{"$f":"'J. Incident Event & Comm Mgmt'!G14","v":"16.1.1.c.1"},{"$f":"'J. Incident Event & Comm Mgmt'!H14","v":"Responsibilities and procedures"},"PO9.3","Event identification","12.5.3","IS.1.6.11.1","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A15","v":2705},{"$f":"'J. Incident Event & Comm Mgmt'!I15","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!J15","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X15","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B15","v":"J.1.2.8"},{"$f":"'J. Incident Event & Comm Mgmt'!C15","v":"Formal disciplinary process for dealing with those who commit a security breach?"},{"$f":"'J. Incident Event & Comm Mgmt'!D15","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E15","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F15","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G15","v":"16.1.1.c.3"},{"$f":"'J. Incident Event & Comm Mgmt'!H15","v":"Responsibilities and procedures"},"PO9.3","Event identification","N/A","IS.2.F.6","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A16","v":2273},{"$f":"'J. Incident Event & Comm Mgmt'!I16","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!J16","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X16","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B16","v":"J.1.2.9"},{"$f":"'J. Incident Event & Comm Mgmt'!C16","v":"Process for assessing and executing client and third party notification requirements (legal, regulatory, and contractual)?"},{"$f":"'J. Incident Event & Comm Mgmt'!D16","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E16","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F16","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G16","v":"16.1.1.b.3"},{"$f":"'J. Incident Event & Comm Mgmt'!H16","v":"Responsibilities and procedures"},"PO9.3","Event identification","12.10.1","IS.1.6.11.2 IS.1.6.11.3 IS.2.M.21.3","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A17","v":2275},{"$f":"'J. Incident Event & Comm Mgmt'!I17","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!J17","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X17","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B17","v":"J.1.2.10"},{"$f":"'J. Incident Event & Comm Mgmt'!C17","v":"Postmortem to include root cause analysis and remediation plan, provided to leadership?"},{"$f":"'J. Incident Event & Comm Mgmt'!D17","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E17","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F17","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G17","v":"16.1.5 "},{"$f":"'J. Incident Event & Comm Mgmt'!H17","v":"Response to information security incidents"},"PO9.3","Event identification","12.10.1","N/A","PO9.3, DS5.5, DS5.6, DS5.7, DS8.2, DS8.3"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A18","v":2249},{"$f":"'J. Incident Event & Comm Mgmt'!I18","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!J18","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X18","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B18","v":"J.1.2.11"},{"$f":"'J. Incident Event & Comm Mgmt'!C18","v":"Is there an identification of incident process? If yes, does it include:"},{"$f":"'J. Incident Event & Comm Mgmt'!D18","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E18","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F18","v":"J.1 procedure b.5.a"},{"$f":"'J. Incident Event & Comm Mgmt'!G18","v":"16.1.1.a.5"},{"$f":"'J. Incident Event & Comm Mgmt'!H18","v":"Responsibilities and procedures"},null,null,"12.5.2","N/A","N/A"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A19","v":2266},{"$f":"'J. Incident Event & Comm Mgmt'!I19","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!J19","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X19","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B19","v":"J.1.2.11.1"},{"$f":"'J. Incident Event & Comm Mgmt'!C19","v":"Unauthorized physical access?"},{"$f":"'J. Incident Event & Comm Mgmt'!D19","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E19","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F19","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G19","v":"16.1.2.e"},{"$f":"'J. Incident Event & Comm Mgmt'!H19","v":"Reporting information security events"},"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A20","v":2259},{"$f":"'J. Incident Event & Comm Mgmt'!I20","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!J20","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X20","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B20","v":"J.1.2.11.2"},{"$f":"'J. Incident Event & Comm Mgmt'!C20","v":"Information system failure or loss of service?"},{"$f":"'J. Incident Event & Comm Mgmt'!D20","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E20","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F20","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G20","v":"16.1.2.g"},{"$f":"'J. Incident Event & Comm Mgmt'!H20","v":"Reporting information security events"},"PO6.1","IT policy and control environment","N/A","OPS.1.10.2.1","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A21","v":2264},{"$f":"'J. Incident Event & Comm Mgmt'!I21","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!J21","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X21","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B21","v":"J.1.2.11.3"},{"$f":"'J. Incident Event & Comm Mgmt'!C21","v":"Malware activity (anti-virus, worms, Trojans)?"},{"$f":"'J. Incident Event & Comm Mgmt'!D21","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E21","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F21","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G21","v":"16.1.2.h"},{"$f":"'J. Incident Event & Comm Mgmt'!H21","v":"Reporting information security events"},"PO6.1","IT policy and control environment","N/A","IS.2.M.9.2.5","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A22","v":2260},{"$f":"'J. Incident Event & Comm Mgmt'!I22","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!J22","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X22","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B22","v":"J.1.2.11.4"},{"$f":"'J. Incident Event & Comm Mgmt'!C22","v":"Denial of service?"},{"$f":"'J. Incident Event & Comm Mgmt'!D22","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E22","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F22","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G22","v":"16.1.2.f"},{"$f":"'J. Incident Event & Comm Mgmt'!H22","v":"Reporting information security events"},"PO6.1","IT policy and control environment","N/A","N/A","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A23","v":2707},{"$f":"'J. Incident Event & Comm Mgmt'!I23","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!J23","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X23","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B23","v":"J.1.2.11.5"},{"$f":"'J. Incident Event & Comm Mgmt'!C23","v":"Errors resulting from incomplete or inaccurate business data?"},{"$f":"'J. Incident Event & Comm Mgmt'!D23","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E23","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F23","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G23","v":"16.1.2.b"},{"$f":"'J. Incident Event & Comm Mgmt'!H23","v":"Reporting information security events"},"PO6.1","IT policy and control environment","N/A","OPS.1.10.2.2 E-BANK.1.4.3.7","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A24","v":2262},{"$f":"'J. Incident Event & Comm Mgmt'!I24","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!J24","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X24","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B24","v":"J.1.2.11.6"},{"$f":"'J. Incident Event & Comm Mgmt'!C24","v":"Breach or loss of confidentiality?"},{"$f":"'J. Incident Event & Comm Mgmt'!D24","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E24","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F24","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G24","v":"16.1.2.b"},{"$f":"'J. Incident Event & Comm Mgmt'!H24","v":"Reporting information security events"},"PO6.1","IT policy and control environment","N/A","N/A","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A25","v":2261},{"$f":"'J. Incident Event & Comm Mgmt'!I25","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!J25","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X25","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B25","v":"J.1.2.11.7"},{"$f":"'J. Incident Event & Comm Mgmt'!C25","v":"System exploit?"},{"$f":"'J. Incident Event & Comm Mgmt'!D25","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E25","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F25","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G25","v":"16.1.2.f"},{"$f":"'J. Incident Event & Comm Mgmt'!H25","v":"Reporting information security events"},"PO6.1","IT policy and control environment","N/A","N/A","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A26","v":2267},{"$f":"'J. Incident Event & Comm Mgmt'!I26","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!J26","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X26","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B26","v":"J.1.2.11.8"},{"$f":"'J. Incident Event & Comm Mgmt'!C26","v":"Unauthorized logical access or use of system resources?"},{"$f":"'J. Incident Event & Comm Mgmt'!D26","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E26","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F26","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G26","v":"16.1.2.h"},{"$f":"'J. Incident Event & Comm Mgmt'!H26","v":"Reporting information security events"},"PO6.1","IT policy and control environment","N/A","OPS.1.10.2.3","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A27","v":2251},{"$f":"'J. Incident Event & Comm Mgmt'!I27","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!J27","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X27","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B27","v":"J.1.2.11.9"},{"$f":"'J. Incident Event & Comm Mgmt'!C27","v":"Containment?"},{"$f":"'J. Incident Event & Comm Mgmt'!D27","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E27","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F27","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G27","v":"NA"},{"$f":"'J. Incident Event & Comm Mgmt'!H27","v":0},"PO6.1","IT policy and control environment","N/A","N/A","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A28","v":2256},{"$f":"'J. Incident Event & Comm Mgmt'!I28","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!J28","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X28","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B28","v":"J.1.2.11.10"},{"$f":"'J. Incident Event & Comm Mgmt'!C28","v":"Remediation?"},{"$f":"'J. Incident Event & Comm Mgmt'!D28","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E28","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F28","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G28","v":"16.1.5.f "},{"$f":"'J. Incident Event & Comm Mgmt'!H28","v":"Response to information security incidents"},"PO6.1","IT policy and control environment","N/A","IS.2.M.19","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A29","v":2250},{"$f":"'J. Incident Event & Comm Mgmt'!I29","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!J29","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X29","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B29","v":"J.1.2.11.11"},{"$f":"'J. Incident Event & Comm Mgmt'!C29","v":"Notification of stakeholders?"},{"$f":"'J. Incident Event & Comm Mgmt'!D29","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E29","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F29","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G29","v":"16.1.1.a.6"},{"$f":"'J. Incident Event & Comm Mgmt'!H29","v":"Responsibilities and procedures"},"PO6.1","IT policy and control environment","N/A","N/A","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A30","v":2253},{"$f":"'J. Incident Event & Comm Mgmt'!I30","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!J30","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X30","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B30","v":"J.1.2.11.12"},{"$f":"'J. Incident Event & Comm Mgmt'!C30","v":"Tracking?"},{"$f":"'J. Incident Event & Comm Mgmt'!D30","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E30","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F30","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G30","v":"16.1.1.a.2"},{"$f":"'J. Incident Event & Comm Mgmt'!H30","v":"Responsibilities and procedures"},null,null,"N/A","IS.2.M.18","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A31","v":2254},{"$f":"'J. Incident Event & Comm Mgmt'!I31","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!J31","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X31","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B31","v":"J.1.2.11.13"},{"$f":"'J. Incident Event & Comm Mgmt'!C31","v":"Repair?"},{"$f":"'J. Incident Event & Comm Mgmt'!D31","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E31","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F31","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G31","v":"16.1.5.g"},{"$f":"'J. Incident Event & Comm Mgmt'!H31","v":"Response to information security incidents"},null,null,"N/A","N/A","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A32","v":2255},{"$f":"'J. Incident Event & Comm Mgmt'!I32","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!J32","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X32","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B32","v":"J.1.2.11.14"},{"$f":"'J. Incident Event & Comm Mgmt'!C32","v":"Recovery?"},{"$f":"'J. Incident Event & Comm Mgmt'!D32","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E32","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F32","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G32","v":"16.1.1.a.6"},{"$f":"'J. Incident Event & Comm Mgmt'!H32","v":"Responsibilities and procedures"},null,null,"N/A","N/A","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A33","v":2257},{"$f":"'J. Incident Event & Comm Mgmt'!I33","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!J33","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X33","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B33","v":"J.1.2.11.15"},{"$f":"'J. Incident Event & Comm Mgmt'!C33","v":"Feedback and lessons learned?"},{"$f":"'J. Incident Event & Comm Mgmt'!D33","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E33","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F33","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G33","v":"16.1.6 "},{"$f":"'J. Incident Event & Comm Mgmt'!H33","v":"Learning from information security incidents"},"PO5.4","Cost management","N/A","IS.2.M.14.6","PO5.4, AI4.4, DS8.4, DS8.5, DS10.1, DS10.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A34","v":3046},{"$f":"'J. Incident Event & Comm Mgmt'!I34","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!J34","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X34","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B34","v":"J.1.2.11.16"},{"$f":"'J. Incident Event & Comm Mgmt'!C34","v":"Unique, specific, applicable data breach notification requirements, including timing of notification (HIPAA/HITECH, state breach laws, client contracts)?"},{"$f":"'J. Incident Event & Comm Mgmt'!D34","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E34","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F34","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G34","v":"16.1.1.a.6"},{"$f":"'J. Incident Event & Comm Mgmt'!H34","v":"Responsibilities and procedures"},null,null,"N/A","E-BANK.1.4.7.3","PO6.2, DS5.4"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A35","v":2708},{"$f":"'J. Incident Event & Comm Mgmt'!I35","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!J35","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X35","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B35","v":"J.1.2.11.17"},{"$f":"'J. Incident Event & Comm Mgmt'!C35","v":"Annual testing of the procedures?"},{"$f":"'J. Incident Event & Comm Mgmt'!D35","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E35","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'J. Incident Event & Comm Mgmt'!F35","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G35","v":"16.1.6 "},{"$f":"'J. Incident Event & Comm Mgmt'!H35","v":"Learning from information security incidents"},"PO5.4","Cost management","12.10.2","OPS.2.12.F","PO5.4, AI4.4, DS8.4, DS8.5, DS10.1, DS10.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A36","v":2709},{"$f":"'J. Incident Event & Comm Mgmt'!I36","v":2},{"$f":"'J. Incident Event & Comm Mgmt'!J36","v":1},{"$f":"'J. Incident Event & Comm Mgmt'!X36","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B36","v":"J.1.3"},{"$f":"'J. Incident Event & Comm Mgmt'!C36","v":"Are the following considered Information Security events:"},{"$f":"'J. Incident Event & Comm Mgmt'!D36","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E36","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F36","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G36","v":"16.1.2"},{"$f":"'J. Incident Event & Comm Mgmt'!H36","v":"Reporting information security events"},null,null,"N/A","N/A","N/A"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A37","v":2710},{"$f":"'J. Incident Event & Comm Mgmt'!I37","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!J37","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X37","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B37","v":"J.1.3.1"},{"$f":"'J. Incident Event & Comm Mgmt'!C37","v":"Loss of service (equipment or facility)?"},{"$f":"'J. Incident Event & Comm Mgmt'!D37","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E37","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F37","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G37","v":"16.1.2.f"},{"$f":"'J. Incident Event & Comm Mgmt'!H37","v":"Reporting information security events"},"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A38","v":2711},{"$f":"'J. Incident Event & Comm Mgmt'!I38","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!J38","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X38","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B38","v":"J.1.3.2"},{"$f":"'J. Incident Event & Comm Mgmt'!C38","v":"System malfunction or overload?"},{"$f":"'J. Incident Event & Comm Mgmt'!D38","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E38","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'J. Incident Event & Comm Mgmt'!F38","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G38","v":"16.1.2.g"},{"$f":"'J. Incident Event & Comm Mgmt'!H38","v":"Reporting information security events"},"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A39","v":2712},{"$f":"'J. Incident Event & Comm Mgmt'!I39","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!J39","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X39","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B39","v":"J.1.3.3"},{"$f":"'J. Incident Event & Comm Mgmt'!C39","v":"Human error?"},{"$f":"'J. Incident Event & Comm Mgmt'!D39","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E39","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'J. Incident Event & Comm Mgmt'!F39","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G39","v":"16.1.2.c"},{"$f":"'J. Incident Event & Comm Mgmt'!H39","v":"Reporting information security events"},"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A40","v":2713},{"$f":"'J. Incident Event & Comm Mgmt'!I40","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!J40","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X40","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B40","v":"J.1.3.4"},{"$f":"'J. Incident Event & Comm Mgmt'!C40","v":"Non-compliance with policy or guidelines?"},{"$f":"'J. Incident Event & Comm Mgmt'!D40","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E40","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'J. Incident Event & Comm Mgmt'!F40","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G40","v":"16.1.2.d"},{"$f":"'J. Incident Event & Comm Mgmt'!H40","v":"Reporting information security events"},"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A41","v":2714},{"$f":"'J. Incident Event & Comm Mgmt'!I41","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!J41","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X41","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B41","v":"J.1.3.5"},{"$f":"'J. Incident Event & Comm Mgmt'!C41","v":"Breach of physical security arrangement?"},{"$f":"'J. Incident Event & Comm Mgmt'!D41","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E41","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'J. Incident Event & Comm Mgmt'!F41","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G41","v":"16.1.2.e"},{"$f":"'J. Incident Event & Comm Mgmt'!H41","v":"Reporting information security events"},"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A42","v":2715},{"$f":"'J. Incident Event & Comm Mgmt'!I42","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!J42","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X42","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B42","v":"J.1.3.6"},{"$f":"'J. Incident Event & Comm Mgmt'!C42","v":"Uncontrolled system change?"},{"$f":"'J. Incident Event & Comm Mgmt'!D42","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E42","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'J. Incident Event & Comm Mgmt'!F42","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G42","v":"16.1.2.f"},{"$f":"'J. Incident Event & Comm Mgmt'!H42","v":"Reporting information security events"},"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A43","v":2716},{"$f":"'J. Incident Event & Comm Mgmt'!I43","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!J43","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X43","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B43","v":"J.1.3.7"},{"$f":"'J. Incident Event & Comm Mgmt'!C43","v":"Malfunction of software or hardware?"},{"$f":"'J. Incident Event & Comm Mgmt'!D43","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E43","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'J. Incident Event & Comm Mgmt'!F43","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G43","v":"16.1.2.g"},{"$f":"'J. Incident Event & Comm Mgmt'!H43","v":"Reporting information security events"},"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A44","v":2272},{"$f":"'J. Incident Event & Comm Mgmt'!I44","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!J44","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X44","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B44","v":"J.1.3.8"},{"$f":"'J. Incident Event & Comm Mgmt'!C44","v":"Access violation?"},{"$f":"'J. Incident Event & Comm Mgmt'!D44","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E44","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'J. Incident Event & Comm Mgmt'!F44","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G44","v":"16.1.2.h"},{"$f":"'J. Incident Event & Comm Mgmt'!H44","v":"Reporting information security events"},"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A45","v":2265},{"$f":"'J. Incident Event & Comm Mgmt'!I45","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!J45","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X45","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B45","v":"J.1.3.9"},{"$f":"'J. Incident Event & Comm Mgmt'!C45","v":"Physical asset loss or theft?"},{"$f":"'J. Incident Event & Comm Mgmt'!D45","v":"Yes"},{"$f":"'J. Incident Event & Comm Mgmt'!E45","v":"Cloudamize Security Policy - Incident Management Procedure"},{"$f":"'J. Incident Event & Comm Mgmt'!F45","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G45","v":"16.1.2.a"},{"$f":"'J. Incident Event & Comm Mgmt'!H45","v":"Reporting information security events"},null,null,"N/A","N/A","N/A"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A46","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!I46","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!J46","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!X46","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B46","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!C46","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!D46","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E46","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F46","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G46","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!H46","v":0}]
[]
[{"$f":"'K. BC DR'!B1","v":"K. Business Continuity and Disaster Recovery"},null,null,null,{"$f":"'K. BC DR'!B1","v":"K. Business Continuity and Disaster Recovery"}]
[{"$f":"'K. BC DR'!A5","v":2281},{"$f":"'K. BC DR'!I5","v":1},{"$f":"'K. BC DR'!J5","v":0},{"$f":"'K. BC DR'!X5","v":1},{"$f":"'K. BC DR'!B5","v":"K.1"},{"$f":"'K. BC DR'!C5","v":"Is there a documented policy for business continuity and disaster recovery that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"'K. BC DR'!D5","v":"Yes"},{"$f":"'K. BC DR'!E5","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F5","v":"B.1 Information Security Policy Content"},{"$f":"'K. BC DR'!G5","v":17.100000000000001},{"$f":"'K. BC DR'!H5","v":"Information security continuity"},null,null,"N/A","AUDIT.2.F.2.3","N/A"]
[{"$f":"'K. BC DR'!A6","v":2287},{"$f":"'K. BC DR'!I6","v":2},{"$f":"'K. BC DR'!J6","v":0},{"$f":"'K. BC DR'!X6","v":0},{"$f":"'K. BC DR'!B6","v":"K.1.1"},{"$f":"'K. BC DR'!C6","v":"Has a third party evaluated the BC/DR Program within the past 12 months?"},{"$f":"'K. BC DR'!D6","v":"Yes"},{"$f":"'K. BC DR'!E6","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F6","v":0},{"$f":"'K. BC DR'!G6","v":"NA"},{"$f":"'K. BC DR'!H6","v":0},null,null,"N/A","BCP.1.10.3","N/A"]
[{"$f":"'K. BC DR'!A7","v":2719},{"$f":"'K. BC DR'!I7","v":2},{"$f":"'K. BC DR'!J7","v":0},{"$f":"'K. BC DR'!X7","v":0},{"$f":"'K. BC DR'!B7","v":"K.1.2"},{"$f":"'K. BC DR'!C7","v":"Is there a BC/DR Program that has been approved by management, communicated to appropriate constituents and an owner or group to maintain and review the plan? If yes ,does it include:"},{"$f":"'K. BC DR'!D7","v":"Yes"},{"$f":"'K. BC DR'!E7","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F7","v":0},{"$f":"'K. BC DR'!G7","v":"17.1.2"},{"$f":"'K. BC DR'!H7","v":"Implementing information security continuity"},"PO6.1","IT policy and control environment","N/A","RPS.1.3.3.1","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'K. BC DR'!A8","v":2341},{"$f":"'K. BC DR'!I8","v":3},{"$f":"'K. BC DR'!J8","v":0},{"$f":"'K. BC DR'!X8","v":0},{"$f":"'K. BC DR'!B8","v":"K.1.2.1"},{"$f":"'K. BC DR'!C8","v":"Annual management review of the BC program for adequacy of resources (people, technology, facilities, and funding)?"},{"$f":"'K. BC DR'!D8","v":"Yes"},{"$f":"'K. BC DR'!E8","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F8","v":"K.3 Business Continuity Governance"},{"$f":"'K. BC DR'!G8","v":"17.1.3 "},{"$f":"'K. BC DR'!H8","v":"Verify, review and evaluate information security continuity"},null,null,"N/A","BCP.1.4.7.2","N/A"]
[{"$f":"'K. BC DR'!A9","v":2342},{"$f":"'K. BC DR'!I9","v":3},{"$f":"'K. BC DR'!J9","v":0},{"$f":"'K. BC DR'!X9","v":0},{"$f":"'K. BC DR'!B9","v":"K.1.2.2"},{"$f":"'K. BC DR'!C9","v":"Virtual or physical command center where management can meet, organize, and conduct emergency operations in a secure setting?"},{"$f":"'K. BC DR'!D9","v":"Yes"},{"$f":"'K. BC DR'!E9","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F9","v":0},{"$f":"'K. BC DR'!G9","v":"NA"},{"$f":"'K. BC DR'!H9","v":""},null,null,"N/A","BCP.1.4.1.1.2 BCP.2.2.1.2","N/A"]
[{"$f":"'K. BC DR'!A10","v":2765},{"$f":"'K. BC DR'!I10","v":3},{"$f":"'K. BC DR'!J10","v":0},{"$f":"'K. BC DR'!X10","v":0},{"$f":"'K. BC DR'!B10","v":"K.1.2.3"},{"$f":"'K. BC DR'!C10","v":"The product or service in scope have an assured business continuity capability?"},{"$f":"'K. BC DR'!D10","v":"Yes"},{"$f":"'K. BC DR'!E10","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F10","v":"K.4 Business Process Level Readiness"},{"$f":"'K. BC DR'!G10","v":"17.1.2 "},{"$f":"'K. BC DR'!H10","v":"Implementing information security continuity"},"DS4.1","IT continuity framework","N/A","N/A","DS4.1, DS8.1, DS8.3"]
[{"$f":"'K. BC DR'!A11","v":2289},{"$f":"'K. BC DR'!I11","v":3},{"$f":"'K. BC DR'!J11","v":0},{"$f":"'K. BC DR'!X11","v":0},{"$f":"'K. BC DR'!B11","v":"K.1.2.4"},{"$f":"'K. BC DR'!C11","v":"Conditions for activating the plan, and the associated roles and responsibilities?"},{"$f":"'K. BC DR'!D11","v":"Yes"},{"$f":"'K. BC DR'!E11","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F11","v":"K.3 Business Continuity Governance"},{"$f":"'K. BC DR'!G11","v":"17.1.2.b"},{"$f":"'K. BC DR'!H11","v":"Implementing information security continuity"},"DS4.1","IT continuity framework","N/A","BCP.1.5.1.4.4 OPS.1.10.1.1","DS4.1, DS8.1, DS8.3"]
[{"$f":"'K. BC DR'!A12","v":2292},{"$f":"'K. BC DR'!I12","v":3},{"$f":"'K. BC DR'!J12","v":0},{"$f":"'K. BC DR'!X12","v":0},{"$f":"'K. BC DR'!B12","v":"K.1.2.5"},{"$f":"'K. BC DR'!C12","v":"Maintenance schedule to revise and test the plan?"},{"$f":"'K. BC DR'!D12","v":"Yes"},{"$f":"'K. BC DR'!E12","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F12","v":0},{"$f":"'K. BC DR'!G12","v":"17.1.3"},{"$f":"'K. BC DR'!H12","v":"Verify, review and evaluate information security continuity"},"DS4.1","IT continuity framework","N/A","BCP.1.2.4","DS4.1, DS8.1, DS8.3"]
[{"$f":"'K. BC DR'!A13","v":2293},{"$f":"'K. BC DR'!I13","v":3},{"$f":"'K. BC DR'!J13","v":0},{"$f":"'K. BC DR'!X13","v":0},{"$f":"'K. BC DR'!B13","v":"K.1.2.6"},{"$f":"'K. BC DR'!C13","v":"Awareness and education activities?"},{"$f":"'K. BC DR'!D13","v":"Yes"},{"$f":"'K. BC DR'!E13","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F13","v":0},{"$f":"'K. BC DR'!G13","v":"7.2.2 .d "},{"$f":"'K. BC DR'!H13","v":"Information security awareness, education and training"},"DS4.1","IT continuity framework","N/A","BCP.1.4.3.8 BCP.1.4.4 BCP.1.4.6.2","DS4.1, DS8.1, DS8.3"]
[{"$f":"'K. BC DR'!A14","v":2294},{"$f":"'K. BC DR'!I14","v":3},{"$f":"'K. BC DR'!J14","v":0},{"$f":"'K. BC DR'!X14","v":0},{"$f":"'K. BC DR'!B14","v":"K.1.2.7"},{"$f":"'K. BC DR'!C14","v":"Roles and responsibilities for those who invoke and execute the plan?"},{"$f":"'K. BC DR'!D14","v":"Yes"},{"$f":"'K. BC DR'!E14","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F14","v":"K.3 Business Continuity Governance"},{"$f":"'K. BC DR'!G14","v":"17.1.2.b"},{"$f":"'K. BC DR'!H14","v":"Implementing information security continuity"},"DS4.1","IT continuity framework","N/A","BCP.1.5.1.4.2","DS4.1, DS8.1, DS8.3"]
[{"$f":"'K. BC DR'!A15","v":2298},{"$f":"'K. BC DR'!I15","v":3},{"$f":"'K. BC DR'!J15","v":0},{"$f":"'K. BC DR'!X15","v":0},{"$f":"'K. BC DR'!B15","v":"K.1.2.8"},{"$f":"'K. BC DR'!C15","v":"Change management to ensure changes are replicated to contingency environments?"},{"$f":"'K. BC DR'!D15","v":"Yes"},{"$f":"'K. BC DR'!E15","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F15","v":0},{"$f":"'K. BC DR'!G15","v":"12.1.2"},{"$f":"'K. BC DR'!H15","v":"Change Management"},null,null,"N/A","BCP.1.4.3.3","N/A"]
[{"$f":"'K. BC DR'!A16","v":2299},{"$f":"'K. BC DR'!I16","v":3},{"$f":"'K. BC DR'!J16","v":0},{"$f":"'K. BC DR'!X16","v":0},{"$f":"'K. BC DR'!B16","v":"K.1.2.9"},{"$f":"'K. BC DR'!C16","v":"Identification of applications, equipment, facilities, personnel, supplies and vital records necessary for recovery?"},{"$f":"'K. BC DR'!D16","v":"Yes"},{"$f":"'K. BC DR'!E16","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F16","v":"K.5 Business Continuity Threat Assessments"},{"$f":"'K. BC DR'!G16","v":"17.1.2.c"},{"$f":"'K. BC DR'!H16","v":"Implementing information security continuity"},"PO3.1","Technological direction planning","N/A","BCP.1.4.1.3.4 BCP.1.5.1.4.6 BCP.1.10.7 BCP.1.5.1.3.1","PO3.1, PO9.1, PO9.2, DS4.1, DS4.3, DS4.8, DS8.3"]
[{"$f":"'K. BC DR'!A17","v":2300},{"$f":"'K. BC DR'!I17","v":3},{"$f":"'K. BC DR'!J17","v":0},{"$f":"'K. BC DR'!X17","v":0},{"$f":"'K. BC DR'!B17","v":"K.1.2.10"},{"$f":"'K. BC DR'!C17","v":"Updates from the inventory of IT and telecom assets?"},{"$f":"'K. BC DR'!D17","v":"Yes"},{"$f":"'K. BC DR'!E17","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F17","v":0},{"$f":"'K. BC DR'!G17","v":"17.1.2.c"},{"$f":"'K. BC DR'!H17","v":"Implementing information security continuity"},"PO3.1","Technological direction planning","N/A","BCP.1.6.5","PO3.1, PO9.1, PO9.2, DS4.1, DS4.3, DS4.8, DS8.3"]
[{"$f":"'K. BC DR'!A18","v":2303},{"$f":"'K. BC DR'!I18","v":3},{"$f":"'K. BC DR'!J18","v":0},{"$f":"'K. BC DR'!X18","v":0},{"$f":"'K. BC DR'!B18","v":"K.1.2.11"},{"$f":"'K. BC DR'!C18","v":"Alternate and diverse means of communications in the event standard communication channels are unavailable?"},{"$f":"'K. BC DR'!D18","v":"Yes"},{"$f":"'K. BC DR'!E18","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F18","v":0},{"$f":"'K. BC DR'!G18","v":"17.1.2.Section 2.c"},{"$f":"'K. BC DR'!H18","v":"Implementing information security continuity"},"DS4.2","IT continuity plans","N/A","AUDIT.2.D.1.16","DS4.2, DS4.8"]
[{"$f":"'K. BC DR'!A19","v":2725},{"$f":"'K. BC DR'!I19","v":3},{"$f":"'K. BC DR'!J19","v":0},{"$f":"'K. BC DR'!X19","v":0},{"$f":"'K. BC DR'!B19","v":"K.1.2.12"},{"$f":"'K. BC DR'!C19","v":"Interaction with the media during an event?"},{"$f":"'K. BC DR'!D19","v":"Yes"},{"$f":"'K. BC DR'!E19","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F19","v":0},{"$f":"'K. BC DR'!G19","v":"NA"},{"$f":"'K. BC DR'!H19","v":""},null,null,"N/A","BCP.1.5.1.4.7 BCP.1.5.1.3.2","N/A"]
[{"$f":"'K. BC DR'!A20","v":2726},{"$f":"'K. BC DR'!I20","v":3},{"$f":"'K. BC DR'!J20","v":0},{"$f":"'K. BC DR'!X20","v":0},{"$f":"'K. BC DR'!B20","v":"K.1.2.13"},{"$f":"'K. BC DR'!C20","v":"Resumption procedures to return to normal business operations?"},{"$f":"'K. BC DR'!D20","v":"Yes"},{"$f":"'K. BC DR'!E20","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F20","v":0},{"$f":"'K. BC DR'!G20","v":"17.1.2"},{"$f":"'K. BC DR'!H20","v":"Implementing information security continuity"},"DS4.1","IT continuity framework","N/A","BCP.1.4.1.6 WPS.1.2.3.2 WPS.2.10.1.5","DS4.1, DS8.1, DS8.3"]
[{"$f":"'K. BC DR'!A21","v":2728},{"$f":"'K. BC DR'!I21","v":3},{"$f":"'K. BC DR'!J21","v":0},{"$f":"'K. BC DR'!X21","v":0},{"$f":"'K. BC DR'!B21","v":"K.1.2.14"},{"$f":"'K. BC DR'!C21","v":"Notification and escalation to clients?"},{"$f":"'K. BC DR'!D21","v":"Yes"},{"$f":"'K. BC DR'!E21","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F21","v":0},{"$f":"'K. BC DR'!G21","v":"17.1.2.c"},{"$f":"'K. BC DR'!H21","v":"Implementing information security continuity"},null,null,"N/A","BCP.1.4.3.9 BCP.1.5.1.3.2 AUDIT.2.F.1.7","N/A"]
[{"$f":"'K. BC DR'!A22","v":2729},{"$f":"'K. BC DR'!I22","v":3},{"$f":"'K. BC DR'!J22","v":0},{"$f":"'K. BC DR'!X22","v":0},{"$f":"'K. BC DR'!B22","v":"K.1.2.15"},{"$f":"'K. BC DR'!C22","v":"Dependencies upon critical service providers. If yes, does it include:"},{"$f":"'K. BC DR'!D22","v":"Yes"},{"$f":"'K. BC DR'!E22","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F22","v":"K.5 Business Continuity Threat Assessments"},{"$f":"'K. BC DR'!G22","v":"17.1.2.c"},{"$f":"'K. BC DR'!H22","v":"Implementing information security continuity"},"DS4.2","IT continuity plans","N/A","BCP.1.3.4 BCP.1.5.1.2 BCP.1.9","DS4.2, DS4.8"]
[{"$f":"'K. BC DR'!A23","v":2308},{"$f":"'K. BC DR'!I23","v":4},{"$f":"'K. BC DR'!J23","v":0},{"$f":"'K. BC DR'!X23","v":0},{"$f":"'K. BC DR'!B23","v":"K.1.2.15.1"},{"$f":"'K. BC DR'!C23","v":"Contact information for key personnel, which is updated at least annually?"},{"$f":"'K. BC DR'!D23","v":"Yes"},{"$f":"'K. BC DR'!E23","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F23","v":0},{"$f":"'K. BC DR'!G23","v":"17.1.2.c"},{"$f":"'K. BC DR'!H23","v":"Implementing information security continuity"},"DS4.1","IT continuity framework","N/A","O.2.B.2.7","DS4.1, DS8.1, DS8.3"]
[{"$f":"'K. BC DR'!A24","v":2295},{"$f":"'K. BC DR'!I24","v":4},{"$f":"'K. BC DR'!J24","v":0},{"$f":"'K. BC DR'!X24","v":0},{"$f":"'K. BC DR'!B24","v":"K.1.2.15.2"},{"$f":"'K. BC DR'!C24","v":"Notification and escalation?"},{"$f":"'K. BC DR'!D24","v":"Yes"},{"$f":"'K. BC DR'!E24","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F24","v":0},{"$f":"'K. BC DR'!G24","v":"17.1.2.c"},{"$f":"'K. BC DR'!H24","v":"Implementing information security continuity"},"DS4.1","IT continuity framework","N/A","BCP.1.5.1.3.2","DS4.1, DS8.1, DS8.3"]
[{"$f":"'K. BC DR'!A25","v":2730},{"$f":"'K. BC DR'!I25","v":4},{"$f":"'K. BC DR'!J25","v":0},{"$f":"'K. BC DR'!X25","v":0},{"$f":"'K. BC DR'!B25","v":"K.1.2.15.3"},{"$f":"'K. BC DR'!C25","v":"Communication in the event of a disruption at their facility?"},{"$f":"'K. BC DR'!D25","v":"Yes"},{"$f":"'K. BC DR'!E25","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F25","v":0},{"$f":"'K. BC DR'!G25","v":"17.1.2.c"},{"$f":"'K. BC DR'!H25","v":"Implementing information security continuity"},"DS4.2","IT continuity plans","N/A","BCP.1.9.1 BCP.1.9.2 BCP.1.9.3","DS4.2, DS4.8"]
[{"$f":"'K. BC DR'!A26","v":2296},{"$f":"'K. BC DR'!I26","v":4},{"$f":"'K. BC DR'!J26","v":0},{"$f":"'K. BC DR'!X26","v":0},{"$f":"'K. BC DR'!B26","v":"K.1.2.15.4"},{"$f":"'K. BC DR'!C26","v":"Capabilities adequate to support the plan through contract requirements, SSAE16 reviews or both?"},{"$f":"'K. BC DR'!D26","v":"Yes"},{"$f":"'K. BC DR'!E26","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F26","v":0},{"$f":"'K. BC DR'!G26","v":"NA"},{"$f":"'K. BC DR'!H26","v":0},"DS4.2","IT continuity plans","N/A","BCP.1.10 O.2.B.2.7 E-BANK.1.3.3.5","DS4.2, DS4.8"]
[{"$f":"'K. BC DR'!A27","v":2731},{"$f":"'K. BC DR'!I27","v":4},{"$f":"'K. BC DR'!J27","v":0},{"$f":"'K. BC DR'!X27","v":0},{"$f":"'K. BC DR'!B27","v":"K.1.2.15.5"},{"$f":"'K. BC DR'!C27","v":"Notification when their BCP is modified?"},{"$f":"'K. BC DR'!D27","v":"Yes"},{"$f":"'K. BC DR'!E27","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F27","v":0},{"$f":"'K. BC DR'!G27","v":"17.1.3"},{"$f":"'K. BC DR'!H27","v":"Verify, review and evaluate information security continuity"},"DS4.2","IT continuity plans","N/A","BCP.1.6.6 E-BANK.1.3.3.4","DS4.2, DS4.8"]
[{"$f":"'K. BC DR'!A28","v":2286},{"$f":"'K. BC DR'!I28","v":3},{"$f":"'K. BC DR'!J28","v":0},{"$f":"'K. BC DR'!X28","v":0},{"$f":"'K. BC DR'!B28","v":"K.1.2.16"},{"$f":"'K. BC DR'!C28","v":"Annual review which includes: critical functions, known and emerging threats, organizational structure and personnel changes?"},{"$f":"'K. BC DR'!D28","v":"Yes"},{"$f":"'K. BC DR'!E28","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F28","v":0},{"$f":"'K. BC DR'!G28","v":"17.1.3"},{"$f":"'K. BC DR'!H28","v":"Verify, review and evaluate information security continuity"},null,null,"N/A","BCP.1.2.5","N/A"]
[{"$f":"'K. BC DR'!A29","v":2343},{"$f":"'K. BC DR'!I29","v":2},{"$f":"'K. BC DR'!J29","v":0},{"$f":"'K. BC DR'!X29","v":1},{"$f":"'K. BC DR'!B29","v":"K.1.3"},{"$f":"'K. BC DR'!C29","v":"Is there an annual schedule of required tests? If yes, does it include:"},{"$f":"'K. BC DR'!D29","v":"Yes"},{"$f":"'K. BC DR'!E29","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F29","v":0},{"$f":"'K. BC DR'!G29","v":"17.1.3"},{"$f":"'K. BC DR'!H29","v":"Verify, review and evaluate information security continuity"},"PO3.1","Technological direction planning","N/A","BCP.1.10.3 BCP.1.10.2 BCP.2.2.1 BCP.2.2.1.7 WPS.2.10.1.2 RPS.2.E.1.6 RPS.2.L.1","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[{"$f":"'K. BC DR'!A30","v":2346},{"$f":"'K. BC DR'!I30","v":3},{"$f":"'K. BC DR'!J30","v":0},{"$f":"'K. BC DR'!X30","v":0},{"$f":"'K. BC DR'!B30","v":"K.1.3.1"},{"$f":"'K. BC DR'!C30","v":"Test objectives for a technology outage, loss of facility or personnel, identification of parties involved, and the evaluation of testing results?"},{"$f":"'K. BC DR'!D30","v":"Yes"},{"$f":"'K. BC DR'!E30","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F30","v":"K.6 Business Continuity Process Testing procedure 4. Test Scenarios"},{"$f":"'K. BC DR'!G30","v":"17.1.3"},{"$f":"'K. BC DR'!H30","v":"Verify, review and evaluate information security continuity"},null,null,"N/A","BCP.2.2.2 BCP.2.2.2.1 BCP.2.2.1.4","N/A"]
[{"$f":"'K. BC DR'!A31","v":2779},{"$f":"'K. BC DR'!I31","v":2},{"$f":"'K. BC DR'!J31","v":0},{"$f":"'K. BC DR'!X31","v":1},{"$f":"'K. BC DR'!B31","v":"K.1.4"},{"$f":"'K. BC DR'!C31","v":"Is a BC/DR test conducted at least annually?  If yes, does it include:"},{"$f":"'K. BC DR'!D31","v":"Yes"},{"$f":"'K. BC DR'!E31","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F31","v":0},{"$f":"'K. BC DR'!G31","v":"17.1.3"},{"$f":"'K. BC DR'!H31","v":"Verify, review and evaluate information security continuity"},"PO3.1","Technological direction planning","N/A","N/A","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[{"$f":"'K. BC DR'!A32","v":2351},{"$f":"'K. BC DR'!I32","v":3},{"$f":"'K. BC DR'!J32","v":0},{"$f":"'K. BC DR'!X32","v":0},{"$f":"'K. BC DR'!B32","v":"K.1.4.1"},{"$f":"'K. BC DR'!C32","v":"Evacuation drills?"},{"$f":"'K. BC DR'!D32","v":"Yes"},{"$f":"'K. BC DR'!E32","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F32","v":"K.6 Business Continuity Process Testing procedure 5. Test Types"},{"$f":"'K. BC DR'!G32","v":"NA"},{"$f":"'K. BC DR'!H32","v":""},null,null,"N/A","N/A","N/A"]
[{"$f":"'K. BC DR'!A33","v":2352},{"$f":"'K. BC DR'!I33","v":3},{"$f":"'K. BC DR'!J33","v":0},{"$f":"'K. BC DR'!X33","v":0},{"$f":"'K. BC DR'!B33","v":"K.1.4.2"},{"$f":"'K. BC DR'!C33","v":"Notification tests?"},{"$f":"'K. BC DR'!D33","v":"Yes"},{"$f":"'K. BC DR'!E33","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F33","v":0},{"$f":"'K. BC DR'!G33","v":"NA"},{"$f":"'K. BC DR'!H33","v":""},null,null,"N/A","N/A","N/A"]
[{"$f":"'K. BC DR'!A34","v":2353},{"$f":"'K. BC DR'!I34","v":3},{"$f":"'K. BC DR'!J34","v":0},{"$f":"'K. BC DR'!X34","v":0},{"$f":"'K. BC DR'!B34","v":"K.1.4.3"},{"$f":"'K. BC DR'!C34","v":"Tabletop exercises?"},{"$f":"'K. BC DR'!D34","v":"Yes"},{"$f":"'K. BC DR'!E34","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F34","v":"K.6 Business Continuity Process Testing procedure 5. Test Types"},{"$f":"'K. BC DR'!G34","v":"17.1.3"},{"$f":"'K. BC DR'!H34","v":"Verify, review and evaluate information security continuity"},"PO3.1","Technological direction planning","N/A","N/A","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[{"$f":"'K. BC DR'!A35","v":2354},{"$f":"'K. BC DR'!I35","v":3},{"$f":"'K. BC DR'!J35","v":0},{"$f":"'K. BC DR'!X35","v":0},{"$f":"'K. BC DR'!B35","v":"K.1.4.4"},{"$f":"'K. BC DR'!C35","v":"Application recovery tests?"},{"$f":"'K. BC DR'!D35","v":"Yes"},{"$f":"'K. BC DR'!E35","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F35","v":0},{"$f":"'K. BC DR'!G35","v":"17.1.3"},{"$f":"'K. BC DR'!H35","v":"Verify, review and evaluate information security continuity"},null,null,"N/A","BCP.2.1.2.1","N/A"]
[{"$f":"'K. BC DR'!A36","v":2355},{"$f":"'K. BC DR'!I36","v":3},{"$f":"'K. BC DR'!J36","v":0},{"$f":"'K. BC DR'!X36","v":0},{"$f":"'K. BC DR'!B36","v":"K.1.4.5"},{"$f":"'K. BC DR'!C36","v":"Remote access tests?"},{"$f":"'K. BC DR'!D36","v":"Yes"},{"$f":"'K. BC DR'!E36","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F36","v":0},{"$f":"'K. BC DR'!G36","v":"17.1.3"},{"$f":"'K. BC DR'!H36","v":"Verify, review and evaluate information security continuity"},null,null,"N/A","BCP.2.1.2.1","N/A"]
[{"$f":"'K. BC DR'!A37","v":2357},{"$f":"'K. BC DR'!I37","v":3},{"$f":"'K. BC DR'!J37","v":0},{"$f":"'K. BC DR'!X37","v":0},{"$f":"'K. BC DR'!B37","v":"K.1.4.6"},{"$f":"'K. BC DR'!C37","v":"Full scale exercises?"},{"$f":"'K. BC DR'!D37","v":"Yes"},{"$f":"'K. BC DR'!E37","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F37","v":"K.6 Business Continuity Process Testing procedure 5. Test Types"},{"$f":"'K. BC DR'!G37","v":"17.1.3"},{"$f":"'K. BC DR'!H37","v":"Verify, review and evaluate information security continuity"},"PO3.1","Technological direction planning","N/A","BCP.2.1.3 BCP.2.1.3.1 BCP.2.1.3.2 BCP.2.1.3.3","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[{"$f":"'K. BC DR'!A38","v":2762},{"$f":"'K. BC DR'!I38","v":3},{"$f":"'K. BC DR'!J38","v":0},{"$f":"'K. BC DR'!X38","v":0},{"$f":"'K. BC DR'!B38","v":"K.1.4.7"},{"$f":"'K. BC DR'!C38","v":"Business relocation test?"},{"$f":"'K. BC DR'!D38","v":"Yes"},{"$f":"'K. BC DR'!E38","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F38","v":0},{"$f":"'K. BC DR'!G38","v":"17.1.3"},{"$f":"'K. BC DR'!H38","v":"Verify, review and evaluate information security continuity"},"PO3.1","Technological direction planning","N/A","N/A","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[{"$f":"'K. BC DR'!A39","v":2723},{"$f":"'K. BC DR'!I39","v":3},{"$f":"'K. BC DR'!J39","v":0},{"$f":"'K. BC DR'!X39","v":0},{"$f":"'K. BC DR'!B39","v":"K.1.4.8"},{"$f":"'K. BC DR'!C39","v":"Business disruptions?"},{"$f":"'K. BC DR'!D39","v":"Yes"},{"$f":"'K. BC DR'!E39","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F39","v":"K.6 Business Continuity Process Testing procedure 5. Test Types"},{"$f":"'K. BC DR'!G39","v":"17.1.3"},{"$f":"'K. BC DR'!H39","v":"Verify, review and evaluate information security continuity"},"PO9.1","IT and business risk management alignment management process","N/A","BCP.1.10.3","PO9.1, PO9.2, PO9.4, DS4.1, DS4.3"]
[{"$f":"'K. BC DR'!A40","v":2763},{"$f":"'K. BC DR'!I40","v":3},{"$f":"'K. BC DR'!J40","v":0},{"$f":"'K. BC DR'!X40","v":0},{"$f":"'K. BC DR'!B40","v":"K.1.4.9"},{"$f":"'K. BC DR'!C40","v":"Data center failover test?"},{"$f":"'K. BC DR'!D40","v":"Yes"},{"$f":"'K. BC DR'!E40","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F40","v":0},{"$f":"'K. BC DR'!G40","v":"17.1.3"},{"$f":"'K. BC DR'!H40","v":"Verify, review and evaluate information security continuity"},"PO3.1","Technological direction planning","N/A","BCP.2.1.2.1","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[{"$f":"'K. BC DR'!A41","v":2764},{"$f":"'K. BC DR'!I41","v":3},{"$f":"'K. BC DR'!J41","v":0},{"$f":"'K. BC DR'!X41","v":0},{"$f":"'K. BC DR'!B41","v":"K.1.4.10"},{"$f":"'K. BC DR'!C41","v":"Critical service providers included in testing?"},{"$f":"'K. BC DR'!D41","v":"Yes"},{"$f":"'K. BC DR'!E41","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F41","v":0},{"$f":"'K. BC DR'!G41","v":"17.1.3"},{"$f":"'K. BC DR'!H41","v":"Verify, review and evaluate information security continuity"},"PO3.1","Technological direction planning","N/A","RPS.2.N.13.2.2","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[{"$f":"'K. BC DR'!A42","v":2356},{"$f":"'K. BC DR'!I42","v":3},{"$f":"'K. BC DR'!J42","v":0},{"$f":"'K. BC DR'!X42","v":0},{"$f":"'K. BC DR'!B42","v":"K.1.4.11"},{"$f":"'K. BC DR'!C42","v":"Recovery site tests?"},{"$f":"'K. BC DR'!D42","v":"Yes"},{"$f":"'K. BC DR'!E42","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F42","v":0},{"$f":"'K. BC DR'!G42","v":"17.1.3"},{"$f":"'K. BC DR'!H42","v":"Verify, review and evaluate information security continuity"},"PO3.1","Technological direction planning","N/A","BCP.1.10.10","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[{"$f":"'K. BC DR'!A43","v":2348},{"$f":"'K. BC DR'!I43","v":3},{"$f":"'K. BC DR'!J43","v":0},{"$f":"'K. BC DR'!X43","v":0},{"$f":"'K. BC DR'!B43","v":"K.1.4.12"},{"$f":"'K. BC DR'!C43","v":"Assessment of the Ability to retrieve vital records?"},{"$f":"'K. BC DR'!D43","v":"Yes"},{"$f":"'K. BC DR'!E43","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F43","v":0},{"$f":"'K. BC DR'!G43","v":"17.1.3"},{"$f":"'K. BC DR'!H43","v":"Verify, review and evaluate information security continuity"},"PO3.1","Technological direction planning","N/A","BCP.2.1.1.7","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[{"$f":"'K. BC DR'!A44","v":2305},{"$f":"'K. BC DR'!I44","v":1},{"$f":"'K. BC DR'!J44","v":0},{"$f":"'K. BC DR'!X44","v":1},{"$f":"'K. BC DR'!B44","v":"K.2"},{"$f":"'K. BC DR'!C44","v":"Is there a Pandemic Plan? If yes, does it include:"},{"$f":"'K. BC DR'!D44","v":"No"},{"$f":"'K. BC DR'!E44","v":0},{"$f":"'K. BC DR'!F44","v":0},{"$f":"'K. BC DR'!G44","v":"NA"},{"$f":"'K. BC DR'!H44","v":0},"PO9.1","IT and business risk management alignment management process","N/A","BCP.1.8.1","PO9.1, PO9.2, PO9.4, DS4.1, DS4.3"]
[{"$f":"'K. BC DR'!A45","v":2751},{"$f":"'K. BC DR'!I45","v":2},{"$f":"'K. BC DR'!J45","v":0},{"$f":"'K. BC DR'!X45","v":0},{"$f":"'K. BC DR'!B45","v":"K.2.1"},{"$f":"'K. BC DR'!C45","v":"Trigger points for activating the plan?"},{"$f":"'K. BC DR'!D45","v":0},{"$f":"'K. BC DR'!E45","v":0},{"$f":"'K. BC DR'!F45","v":0},{"$f":"'K. BC DR'!G45","v":"NA"},{"$f":"'K. BC DR'!H45","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'K. BC DR'!A46","v":2752},{"$f":"'K. BC DR'!I46","v":2},{"$f":"'K. BC DR'!J46","v":0},{"$f":"'K. BC DR'!X46","v":0},{"$f":"'K. BC DR'!B46","v":"K.2.2"},{"$f":"'K. BC DR'!C46","v":"Travel and visitor restrictions?"},{"$f":"'K. BC DR'!D46","v":0},{"$f":"'K. BC DR'!E46","v":0},{"$f":"'K. BC DR'!F46","v":0},{"$f":"'K. BC DR'!G46","v":"NA"},{"$f":"'K. BC DR'!H46","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'K. BC DR'!A47","v":2753},{"$f":"'K. BC DR'!I47","v":2},{"$f":"'K. BC DR'!J47","v":0},{"$f":"'K. BC DR'!X47","v":0},{"$f":"'K. BC DR'!B47","v":"K.2.3"},{"$f":"'K. BC DR'!C47","v":"Cleaning and disinfecting protocols?"},{"$f":"'K. BC DR'!D47","v":0},{"$f":"'K. BC DR'!E47","v":0},{"$f":"'K. BC DR'!F47","v":0},{"$f":"'K. BC DR'!G47","v":"NA"},{"$f":"'K. BC DR'!H47","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'K. BC DR'!A48","v":2754},{"$f":"'K. BC DR'!I48","v":2},{"$f":"'K. BC DR'!J48","v":0},{"$f":"'K. BC DR'!X48","v":0},{"$f":"'K. BC DR'!B48","v":"K.2.4"},{"$f":"'K. BC DR'!C48","v":"Pandemic-specific HR policies and procedures?"},{"$f":"'K. BC DR'!D48","v":0},{"$f":"'K. BC DR'!E48","v":0},{"$f":"'K. BC DR'!F48","v":0},{"$f":"'K. BC DR'!G48","v":"NA"},{"$f":"'K. BC DR'!H48","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'K. BC DR'!A49","v":2755},{"$f":"'K. BC DR'!I49","v":2},{"$f":"'K. BC DR'!J49","v":0},{"$f":"'K. BC DR'!X49","v":0},{"$f":"'K. BC DR'!B49","v":"K.2.5"},{"$f":"'K. BC DR'!C49","v":"Specific \"Social Distancing\" criteria / techniques (work from home)?"},{"$f":"'K. BC DR'!D49","v":0},{"$f":"'K. BC DR'!E49","v":0},{"$f":"'K. BC DR'!F49","v":0},{"$f":"'K. BC DR'!G49","v":"NA"},{"$f":"'K. BC DR'!H49","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'K. BC DR'!A50","v":2756},{"$f":"'K. BC DR'!I50","v":2},{"$f":"'K. BC DR'!J50","v":0},{"$f":"'K. BC DR'!X50","v":0},{"$f":"'K. BC DR'!B50","v":"K.2.6"},{"$f":"'K. BC DR'!C50","v":"Personal protective equipment for constituents (face masks)?"},{"$f":"'K. BC DR'!D50","v":0},{"$f":"'K. BC DR'!E50","v":0},{"$f":"'K. BC DR'!F50","v":0},{"$f":"'K. BC DR'!G50","v":"NA"},{"$f":"'K. BC DR'!H50","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'K. BC DR'!A51","v":2757},{"$f":"'K. BC DR'!I51","v":2},{"$f":"'K. BC DR'!J51","v":0},{"$f":"'K. BC DR'!X51","v":0},{"$f":"'K. BC DR'!B51","v":"K.2.7"},{"$f":"'K. BC DR'!C51","v":"Special food handling in cafeterias?"},{"$f":"'K. BC DR'!D51","v":0},{"$f":"'K. BC DR'!E51","v":0},{"$f":"'K. BC DR'!F51","v":0},{"$f":"'K. BC DR'!G51","v":"NA"},{"$f":"'K. BC DR'!H51","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'K. BC DR'!A52","v":2759},{"$f":"'K. BC DR'!I52","v":2},{"$f":"'K. BC DR'!J52","v":0},{"$f":"'K. BC DR'!X52","v":0},{"$f":"'K. BC DR'!B52","v":"K.2.8"},{"$f":"'K. BC DR'!C52","v":"Seasonal flu vaccinations for constituents?"},{"$f":"'K. BC DR'!D52","v":0},{"$f":"'K. BC DR'!E52","v":0},{"$f":"'K. BC DR'!F52","v":0},{"$f":"'K. BC DR'!G52","v":"NA"},{"$f":"'K. BC DR'!H52","v":0},null,null,"N/A","N/A","N/A"]
[{"$f":"'K. BC DR'!A53","v":2743},{"$f":"'K. BC DR'!I53","v":2},{"$f":"'K. BC DR'!J53","v":0},{"$f":"'K. BC DR'!X53","v":0},{"$f":"'K. BC DR'!B53","v":"K.2.9"},{"$f":"'K. BC DR'!C53","v":"Annual review?"},{"$f":"'K. BC DR'!D53","v":0},{"$f":"'K. BC DR'!E53","v":0},{"$f":"'K. BC DR'!F53","v":0},{"$f":"'K. BC DR'!G53","v":"NA"},{"$f":"'K. BC DR'!H53","v":0},null,null,"N/A","BCP.1.8.3.5","N/A"]
[{"$f":"'K. BC DR'!A54","v":2747},{"$f":"'K. BC DR'!I54","v":2},{"$f":"'K. BC DR'!J54","v":0},{"$f":"'K. BC DR'!X54","v":0},{"$f":"'K. BC DR'!B54","v":"K.2.10"},{"$f":"'K. BC DR'!C54","v":"Periodic testing of the plan?"},{"$f":"'K. BC DR'!D54","v":0},{"$f":"'K. BC DR'!E54","v":0},{"$f":"'K. BC DR'!F54","v":0},{"$f":"'K. BC DR'!G54","v":"NA"},{"$f":"'K. BC DR'!H54","v":0},null,null,"N/A","BCP.1.8.11","N/A"]
[{"$f":"'K. BC DR'!A55","v":2748},{"$f":"'K. BC DR'!I55","v":2},{"$f":"'K. BC DR'!J55","v":0},{"$f":"'K. BC DR'!X55","v":0},{"$f":"'K. BC DR'!B55","v":"K.2.11"},{"$f":"'K. BC DR'!C55","v":"Verification of critical service provider pandemic plans?"},{"$f":"'K. BC DR'!D55","v":0},{"$f":"'K. BC DR'!E55","v":0},{"$f":"'K. BC DR'!F55","v":0},{"$f":"'K. BC DR'!G55","v":"NA"},{"$f":"'K. BC DR'!H55","v":0},null,null,"N/A","BCP.1.8.7","N/A"]
[{"$f":"'K. BC DR'!A56","v":2749},{"$f":"'K. BC DR'!I56","v":2},{"$f":"'K. BC DR'!J56","v":0},{"$f":"'K. BC DR'!X56","v":0},{"$f":"'K. BC DR'!B56","v":"K.2.12"},{"$f":"'K. BC DR'!C56","v":"Business Impact Analysis?"},{"$f":"'K. BC DR'!D56","v":0},{"$f":"'K. BC DR'!E56","v":0},{"$f":"'K. BC DR'!F56","v":0},{"$f":"'K. BC DR'!G56","v":"17.1.1 "},{"$f":"'K. BC DR'!H56","v":"Planning information security continuity"},"PO9.1","IT and business risk management alignment management process","N/A","BCP.1.8.4","PO9.1, PO9.2, PO9.4, DS4.1, DS4.3"]
[{"$f":"'K. BC DR'!A57","v":2329},{"$f":"'K. BC DR'!I57","v":1},{"$f":"'K. BC DR'!J57","v":0},{"$f":"'K. BC DR'!X57","v":1},{"$f":"'K. BC DR'!B57","v":"K.3"},{"$f":"'K. BC DR'!C57","v":"Is a Business Impact Analysis conducted at least annually? If yes, does it include:"},{"$f":"'K. BC DR'!D57","v":"Yes"},{"$f":"'K. BC DR'!E57","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F57","v":"K.1 Business Impact Analysis"},{"$f":"'K. BC DR'!G57","v":"17.1.1 "},{"$f":"'K. BC DR'!H57","v":"Planning information security continuity"},"PO9.1","IT and business risk management alignment management process","N/A","BCP.1.3","PO9.1, PO9.2, PO9.4, DS4.1, DS4.3"]
[{"$f":"'K. BC DR'!A58","v":2334},{"$f":"'K. BC DR'!I58","v":2},{"$f":"'K. BC DR'!J58","v":0},{"$f":"'K. BC DR'!X58","v":0},{"$f":"'K. BC DR'!B58","v":"K.3.1"},{"$f":"'K. BC DR'!C58","v":"Business Process Criticality (high, medium, low or numerical rating) that distinguishes the relative importance of each process?"},{"$f":"'K. BC DR'!D58","v":"Yes"},{"$f":"'K. BC DR'!E58","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F58","v":"K.1 Business Impact Analysis"},{"$f":"'K. BC DR'!G58","v":"17.1.1 "},{"$f":"'K. BC DR'!H58","v":"Planning information security continuity"},"PO3.1","Technological direction planning","N/A","BCP.1.3.2 BCP.1.5.1.1","PO3.1, PO9.1, PO9.2, DS4.1, DS4.3, DS4.8, DS8.3"]
[{"$f":"'K. BC DR'!A59","v":2335},{"$f":"'K. BC DR'!I59","v":2},{"$f":"'K. BC DR'!J59","v":0},{"$f":"'K. BC DR'!X59","v":0},{"$f":"'K. BC DR'!B59","v":"K.3.2"},{"$f":"'K. BC DR'!C59","v":"Recovery Time Objective?"},{"$f":"'K. BC DR'!D59","v":"Yes"},{"$f":"'K. BC DR'!E59","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F59","v":0},{"$f":"'K. BC DR'!G59","v":"NA"},{"$f":"'K. BC DR'!H59","v":""},null,null,"N/A","N/A","N/A"]
[{"$f":"'K. BC DR'!A60","v":2337},{"$f":"'K. BC DR'!I60","v":2},{"$f":"'K. BC DR'!J60","v":0},{"$f":"'K. BC DR'!X60","v":0},{"$f":"'K. BC DR'!B60","v":"K.3.3"},{"$f":"'K. BC DR'!C60","v":"Recovery Point Objective?"},{"$f":"'K. BC DR'!D60","v":"Yes"},{"$f":"'K. BC DR'!E60","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F60","v":0},{"$f":"'K. BC DR'!G60","v":"NA"},{"$f":"'K. BC DR'!H60","v":""},null,null,"N/A","N/A","N/A"]
[{"$f":"'K. BC DR'!A61","v":2338},{"$f":"'K. BC DR'!I61","v":2},{"$f":"'K. BC DR'!J61","v":0},{"$f":"'K. BC DR'!X61","v":0},{"$f":"'K. BC DR'!B61","v":"K.3.4"},{"$f":"'K. BC DR'!C61","v":"Maximum allowable downtime?"},{"$f":"'K. BC DR'!D61","v":"Yes"},{"$f":"'K. BC DR'!E61","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F61","v":"K.1 Business Impact Analysis"},{"$f":"'K. BC DR'!G61","v":"NA"},{"$f":"'K. BC DR'!H61","v":""},null,null,"N/A","N/A","N/A"]
[{"$f":"'K. BC DR'!A62","v":2760},{"$f":"'K. BC DR'!I62","v":2},{"$f":"'K. BC DR'!J62","v":0},{"$f":"'K. BC DR'!X62","v":0},{"$f":"'K. BC DR'!B62","v":"K.3.5"},{"$f":"'K. BC DR'!C62","v":"Impact to clients?"},{"$f":"'K. BC DR'!D62","v":"Yes"},{"$f":"'K. BC DR'!E62","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F62","v":0},{"$f":"'K. BC DR'!G62","v":"NA"},{"$f":"'K. BC DR'!H62","v":""},null,null,"N/A","N/A","N/A"]
[{"$f":"'K. BC DR'!A63","v":2365},{"$f":"'K. BC DR'!I63","v":1},{"$f":"'K. BC DR'!J63","v":0},{"$f":"'K. BC DR'!X63","v":1},{"$f":"'K. BC DR'!B63","v":"K.4"},{"$f":"'K. BC DR'!C63","v":"Is there insurance coverage for business interruptions or general services interruption? If yes, are there:"},{"$f":"'K. BC DR'!D63","v":"Yes"},{"$f":"'K. BC DR'!E63","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"'K. BC DR'!F63","v":"K.4 Business Insurance"},{"$f":"'K. BC DR'!G63","v":"NA"},{"$f":"'K. BC DR'!H63","v":0},"PO3.1","Technological direction planning","N/A","BCP.1.4.3.10 MGMT.1.3.8","PO3.1, PO9.1, PO9.2, DS4.1, DS4.3, DS4.8, DS8.3"]
[{"$f":"'K. BC DR'!A64","v":2366},{"$f":"'K. BC DR'!I64","v":2},{"$f":"'K. BC DR'!J64","v":0},{"$f":"'K. BC DR'!X64","v":0},{"$f":"'K. BC DR'!B64","v":"K.4.1"},{"$f":"'K. BC DR'!C64","v":"Limitations based on the cause of the interruption?"},{"$f":"'K. BC DR'!D64","v":"No"},{"$f":"'K. BC DR'!E64","v":0},{"$f":"'K. BC DR'!F64","v":"K.4 Business Insurance"},{"$f":"'K. BC DR'!G64","v":"NA"},{"$f":"'K. BC DR'!H64","v":0},"PO3.1","Technological direction planning","N/A","N/A","PO3.1, PO9.1, PO9.2, DS4.1, DS4.3, DS4.8, DS8.3"]
[{"$f":"'K. BC DR'!A65","v":2367},{"$f":"'K. BC DR'!I65","v":2},{"$f":"'K. BC DR'!J65","v":0},{"$f":"'K. BC DR'!X65","v":0},{"$f":"'K. BC DR'!B65","v":"K.4.2"},{"$f":"'K. BC DR'!C65","v":"Insurance coverage for products and services provided to clients?"},{"$f":"'K. BC DR'!D65","v":"No"},{"$f":"'K. BC DR'!E65","v":0},{"$f":"'K. BC DR'!F65","v":"K.4 Business Insurance"},{"$f":"'K. BC DR'!G65","v":"NA"},{"$f":"'K. BC DR'!H65","v":0},"PO3.1","Technological direction planning","N/A","N/A","PO3.1, PO9.1, PO9.2, DS4.1, DS4.3, DS4.8, DS8.3"]
[{"$f":"'K. BC DR'!A66","v":0},{"$f":"'K. BC DR'!I66","v":0},{"$f":"'K. BC DR'!J66","v":0},{"$f":"'K. BC DR'!X66","v":0},{"$f":"'K. BC DR'!B66","v":0},{"$f":"'K. BC DR'!C66","v":0},{"$f":"'K. BC DR'!D66","v":0},{"$f":"'K. BC DR'!E66","v":0},{"$f":"'K. BC DR'!F66","v":0},{"$f":"'K. BC DR'!G66","v":0},{"$f":"'K. BC DR'!H66","v":0}]
[]
[{"$f":"'L. Compliance'!B1","v":"L. Compliance"},null,null,null,{"$f":"'L. Compliance'!B1","v":"L. Compliance"}]
[{"$f":"'L. Compliance'!A5","v":2826},{"$f":"'L. Compliance'!I5","v":1},{"$f":"'L. Compliance'!J5","v":0},{"$f":"'L. Compliance'!X5","v":1},{"$f":"'L. Compliance'!B5","v":"L.1"},{"$f":"'L. Compliance'!C5","v":"Is there an internal audit, risk management or compliance department with responsibility for identifying and tracking resolution of outstanding regulatory issues?"},{"$f":"'L. Compliance'!D5","v":"Yes"},{"$f":"'L. Compliance'!E5","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'L. Compliance'!F5","v":0},{"$f":"'L. Compliance'!G5","v":"18.1.1 "},{"$f":"'L. Compliance'!H5","v":"Identification of applicable legislation and contractual requirements"},"PO4.4","Organisational placement of the IT function","N/A","MGMT.1.2.1.15.2 RPS.1.4.3","PO4.4, PO4.5, PO4.6, PO4.8, PO4.10, PO6.5, DS5.1, DS5.2, DS5.3"]
[{"$f":"'L. Compliance'!A6","v":2376},{"$f":"'L. Compliance'!I6","v":1},{"$f":"'L. Compliance'!J6","v":0},{"$f":"'L. Compliance'!X6","v":0},{"$f":"'L. Compliance'!B6","v":"L.2"},{"$f":"'L. Compliance'!C6","v":"Are audits performed to ensure compliance with any legal, regulatory or industry requirements?"},{"$f":"'L. Compliance'!D6","v":"Yes"},{"$f":"'L. Compliance'!E6","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'L. Compliance'!F6","v":0},{"$f":"'L. Compliance'!G6","v":"NA"},{"$f":"'L. Compliance'!H6","v":""},null,null,"N/A","RPS.1.2.1.4","N/A"]
[{"$f":"'L. Compliance'!A7","v":2829},{"$f":"'L. Compliance'!I7","v":1},{"$f":"'L. Compliance'!J7","v":0},{"$f":"'L. Compliance'!X7","v":0},{"$f":"'L. Compliance'!B7","v":"L.3"},{"$f":"'L. Compliance'!C7","v":"Is there a process used to manage the controls on a life cycle basis?"},{"$f":"'L. Compliance'!D7","v":"Yes"},{"$f":"'L. Compliance'!E7","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'L. Compliance'!F7","v":0},{"$f":"'L. Compliance'!G7","v":"NA"},{"$f":"'L. Compliance'!H7","v":0},null,null,"N/A","IS.1.2.7","N/A"]
[{"$f":"'L. Compliance'!A8","v":2830},{"$f":"'L. Compliance'!I8","v":1},{"$f":"'L. Compliance'!J8","v":0},{"$f":"'L. Compliance'!X8","v":0},{"$f":"'L. Compliance'!B8","v":"L.4"},{"$f":"'L. Compliance'!C8","v":"Are there procedures to ensure compliance with legislative, regulatory, and contractual requirements on the use of material where intellectual property rights may be applied and on the use of proprietary software products?"},{"$f":"'L. Compliance'!D8","v":"Yes"},{"$f":"'L. Compliance'!E8","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'L. Compliance'!F8","v":0},{"$f":"'L. Compliance'!G8","v":"18.1.2"},{"$f":"'L. Compliance'!H8","v":"Intellectual property rights"},"PO4.8","Responsibility for risk, security and compliance","N/A","N/A","PO4.8"]
[{"$f":"'L. Compliance'!A9","v":2837},{"$f":"'L. Compliance'!I9","v":1},{"$f":"'L. Compliance'!J9","v":0},{"$f":"'L. Compliance'!X9","v":0},{"$f":"'L. Compliance'!B9","v":"L.5"},{"$f":"'L. Compliance'!C9","v":"Is there a records retention policy covering paper and electronic records, including email, in support of applicable regulations, standards and contractual requirements?"},{"$f":"'L. Compliance'!D9","v":"Yes"},{"$f":"'L. Compliance'!E9","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'L. Compliance'!F9","v":0},{"$f":"'L. Compliance'!G9","v":"18.1.3 "},{"$f":"'L. Compliance'!H9","v":"Protection of records"},"PO4.8","Responsibility for risk, security and compliance","N/A","N/A","PO4.8, DS11.2"]
[{"$f":"'L. Compliance'!A10","v":2849},{"$f":"'L. Compliance'!I10","v":1},{"$f":"'L. Compliance'!J10","v":0},{"$f":"'L. Compliance'!X10","v":0},{"$f":"'L. Compliance'!B10","v":"L.6"},{"$f":"'L. Compliance'!C10","v":"Are encryption tools managed and maintained?"},{"$f":"'L. Compliance'!D10","v":"Yes"},{"$f":"'L. Compliance'!E10","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'L. Compliance'!F10","v":0},{"$f":"'L. Compliance'!G10","v":"18.1.3 "},{"$f":"'L. Compliance'!H10","v":"Protection of records"},null,null,3.6,"N/A","N/A"]
[{"$f":"'L. Compliance'!A11","v":2857},{"$f":"'L. Compliance'!I11","v":1},{"$f":"'L. Compliance'!J11","v":0},{"$f":"'L. Compliance'!X11","v":0},{"$f":"'L. Compliance'!B11","v":"L.7"},{"$f":"'L. Compliance'!C11","v":"Does management regularly review the compliance of information processing within their area of responsibility with the appropriate security policies, standards, and any other security requirements?"},{"$f":"'L. Compliance'!D11","v":"Yes"},{"$f":"'L. Compliance'!E11","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'L. Compliance'!F11","v":0},{"$f":"'L. Compliance'!G11","v":"18.2.2 "},{"$f":"'L. Compliance'!H11","v":"Compliance with the security policies and standards"},"PO4.8","Responsibility for risk, security and compliance","N/A","IS.1.1.1 IS.2.M.10","PO4.8, PO6.2, ME2.1, ME2.2, ME2.3, ME2.4, ME2.5, ME2.6, ME2.7"]
[{"$f":"'L. Compliance'!A12","v":2390},{"$f":"'L. Compliance'!I12","v":1},{"$f":"'L. Compliance'!J12","v":0},{"$f":"'L. Compliance'!X12","v":0},{"$f":"'L. Compliance'!B12","v":"L.8"},{"$f":"'L. Compliance'!C12","v":"Has a review of security policies, standards, procedures, and/or guidelines been performed within the last 12 months?"},{"$f":"'L. Compliance'!D12","v":"Yes"},{"$f":"'L. Compliance'!E12","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'L. Compliance'!F12","v":"B.1 Information Security Policy Content and Maintenance"},{"$f":"'L. Compliance'!G12","v":"18.2.2 "},{"$f":"'L. Compliance'!H12","v":"Compliance with the security policies and standards"},"PO4.8","Responsibility for risk, security and compliance","12.1.1","OPS.1.2.1","PO4.8, PO6.2, ME2.1, ME2.2, ME2.3, ME2.4, ME2.5, ME2.6, ME2.7"]
[{"$f":"'L. Compliance'!A13","v":2868},{"$f":"'L. Compliance'!I13","v":1},{"$f":"'L. Compliance'!J13","v":0},{"$f":"'L. Compliance'!X13","v":0},{"$f":"'L. Compliance'!B13","v":"L.9"},{"$f":"'L. Compliance'!C13","v":"Are information systems regularly checked for compliance with security implementation standards?"},{"$f":"'L. Compliance'!D13","v":"Yes"},{"$f":"'L. Compliance'!E13","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"'L. Compliance'!F13","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'L. Compliance'!G13","v":"18.2.3 "},{"$f":"'L. Compliance'!H13","v":"Technical compliance review"},"DS5.5","Security testing, surveillance and monitoring","N/A","N/A","DS5.5, DS5.7, ME2.5"]
[{"$f":"'L. Compliance'!A14","v":2404},{"$f":"'L. Compliance'!I14","v":1},{"$f":"'L. Compliance'!J14","v":0},{"$f":"'L. Compliance'!X14","v":0},{"$f":"'L. Compliance'!B14","v":"L.10"},{"$f":"'L. Compliance'!C14","v":"Has a network penetration test been conducted within the last 12 months?"},{"$f":"'L. Compliance'!D14","v":"Yes"},{"$f":"'L. Compliance'!E14","v":"Cloudamize Security Policy - Cloudamize Network Security"},{"$f":"'L. Compliance'!F14","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'L. Compliance'!G14","v":"18.2.3 "},{"$f":"'L. Compliance'!H14","v":"Technical compliance review"},"DS5.5","Security testing, surveillance and monitoring",11.3,"N/A","DS5.5, DS5.7, ME2.5"]
[{"$f":"'L. Compliance'!A15","v":2869},{"$f":"'L. Compliance'!I15","v":1},{"$f":"'L. Compliance'!J15","v":0},{"$f":"'L. Compliance'!X15","v":0},{"$f":"'L. Compliance'!B15","v":"L.11"},{"$f":"'L. Compliance'!C15","v":"Does the respondent have an independent audit function?"},{"$f":"'L. Compliance'!D15","v":"Yes"},{"$f":"'L. Compliance'!E15","v":"Curently pursuing a SOC 2 audit reivew"},{"$f":"'L. Compliance'!F15","v":0},{"$f":"'L. Compliance'!G15","v":"18.2.1"},{"$f":"'L. Compliance'!H15","v":"Independent review of information security"},"AI2.3","Application control and auditability","N/A","MGMT.1.6.1.8","AI2.3, DS5.5, ME2.5"]
[{"$f":"'L. Compliance'!A16","v":2871},{"$f":"'L. Compliance'!I16","v":1},{"$f":"'L. Compliance'!J16","v":0},{"$f":"'L. Compliance'!X16","v":0},{"$f":"'L. Compliance'!B16","v":"L.12"},{"$f":"'L. Compliance'!C16","v":"Are any information systems audit tools (e.g., software or data files) accessible to any users in any unprotected area?"},{"$f":"'L. Compliance'!D16","v":"Yes"},{"$f":"'L. Compliance'!E16","v":"Cloudamize Security Policy - Cloudamize Security Work Group"},{"$f":"'L. Compliance'!F16","v":0},{"$f":"'L. Compliance'!G16","v":"NA"},{"$f":"'L. Compliance'!H16","v":0},"AI2.3","Application control and auditability",10.5,"N/A","AI2.3, AI2.4, DS5.7"]
[{"$f":"'L. Compliance'!A17","v":3733},{"$f":"'L. Compliance'!I17","v":1},{"$f":"'L. Compliance'!J17","v":0},{"$f":"'L. Compliance'!X17","v":1},{"$f":"'L. Compliance'!B17","v":"L.13"},{"$f":"'L. Compliance'!C17","v":"Is there an internal compliance and ethics reporting mechanism and training program for constituents to report compliance issues?"},{"$f":"'L. Compliance'!D17","v":"Yes"},{"$f":"'L. Compliance'!E17","v":"Cloudamize Security Policy - Cloudamize Security Work Group"},{"$f":"'L. Compliance'!F17","v":0},{"$f":"'L. Compliance'!G17","v":"NA"},{"$f":"'L. Compliance'!H17","v":0},null,null,"N/A"]
[{"$f":"'L. Compliance'!A18","v":0},{"$f":"'L. Compliance'!I18","v":0},{"$f":"'L. Compliance'!J18","v":0},{"$f":"'L. Compliance'!X18","v":0},{"$f":"'L. Compliance'!B18","v":0},{"$f":"'L. Compliance'!C18","v":0},{"$f":"'L. Compliance'!D18","v":0},{"$f":"'L. Compliance'!E18","v":0},{"$f":"'L. Compliance'!F18","v":0},{"$f":"'L. Compliance'!G18","v":0},{"$f":"'L. Compliance'!H18","v":0}]
[]
[{"$f":"'M. Mobile'!B1","v":"M. Mobile"},null,null,null,{"$f":"'M. Mobile'!B1","v":"M. Mobile"}]
[{"$f":"'M. Mobile'!A5","v":3883},{"$f":"'M. Mobile'!I5","v":1},{"$f":"'M. Mobile'!J5","v":0},{"$f":"'M. Mobile'!K5","v":1},{"$f":"'M. Mobile'!B5","v":"M.1"},{"$f":"'M. Mobile'!C5","v":"Are mobile devices able to access Scoped Systems and Data"},{"$f":"'M. Mobile'!D5","v":"No"},{"$f":"'M. Mobile'!E5","v":0},{"$f":"'M. Mobile'!F5","v":0},{"$f":"'M. Mobile'!G5","v":6.2},{"$f":"'M. Mobile'!H5","v":"Mobile devices and teleworking"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A6","v":3881},{"$f":"'M. Mobile'!I6","v":2},{"$f":"'M. Mobile'!J6","v":0},{"$f":"'M. Mobile'!K6","v":1},{"$f":"'M. Mobile'!B6","v":"M.1.1"},{"$f":"'M. Mobile'!C6","v":"Is there a policy for mobile device use that has been approved by management? If yes, does it contain:"},{"$f":"'M. Mobile'!D6","v":0},{"$f":"'M. Mobile'!E6","v":0},{"$f":"'M. Mobile'!F6","v":0},{"$f":"'M. Mobile'!G6","v":"6.2.1"},{"$f":"'M. Mobile'!H6","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A7","v":3882},{"$f":"'M. Mobile'!I7","v":3},{"$f":"'M. Mobile'!J7","v":0},{"$f":"'M. Mobile'!K7","v":1},{"$f":"'M. Mobile'!B7","v":"M.1.1.1"},{"$f":"'M. Mobile'!C7","v":"Security awareness training/education?"},{"$f":"'M. Mobile'!D7","v":0},{"$f":"'M. Mobile'!E7","v":0},{"$f":"'M. Mobile'!F7","v":0},{"$f":"'M. Mobile'!G7","v":"6.2.1"},{"$f":"'M. Mobile'!H7","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A8","v":3738},{"$f":"'M. Mobile'!I8","v":3},{"$f":"'M. Mobile'!J8","v":0},{"$f":"'M. Mobile'!K8","v":1},{"$f":"'M. Mobile'!B8","v":"M.1.1.2"},{"$f":"'M. Mobile'!C8","v":"Acceptable use?"},{"$f":"'M. Mobile'!D8","v":0},{"$f":"'M. Mobile'!E8","v":0},{"$f":"'M. Mobile'!F8","v":0},{"$f":"'M. Mobile'!G8","v":"6.2.1"},{"$f":"'M. Mobile'!H8","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A9","v":3884},{"$f":"'M. Mobile'!I9","v":3},{"$f":"'M. Mobile'!J9","v":0},{"$f":"'M. Mobile'!K9","v":1},{"$f":"'M. Mobile'!B9","v":"M.1.1.3"},{"$f":"'M. Mobile'!C9","v":"Operating system security?"},{"$f":"'M. Mobile'!D9","v":0},{"$f":"'M. Mobile'!E9","v":0},{"$f":"'M. Mobile'!F9","v":0},{"$f":"'M. Mobile'!G9","v":"6.2.1"},{"$f":"'M. Mobile'!H9","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A10","v":3740},{"$f":"'M. Mobile'!I10","v":3},{"$f":"'M. Mobile'!J10","v":0},{"$f":"'M. Mobile'!K10","v":1},{"$f":"'M. Mobile'!B10","v":"M.1.1.4"},{"$f":"'M. Mobile'!C10","v":"User responsibilities?"},{"$f":"'M. Mobile'!D10","v":0},{"$f":"'M. Mobile'!E10","v":0},{"$f":"'M. Mobile'!F10","v":0},{"$f":"'M. Mobile'!G10","v":"6.2.1"},{"$f":"'M. Mobile'!H10","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A11","v":3741},{"$f":"'M. Mobile'!I11","v":3},{"$f":"'M. Mobile'!J11","v":0},{"$f":"'M. Mobile'!K11","v":1},{"$f":"'M. Mobile'!B11","v":"M.1.1.5"},{"$f":"'M. Mobile'!C11","v":"Access control?"},{"$f":"'M. Mobile'!D11","v":0},{"$f":"'M. Mobile'!E11","v":0},{"$f":"'M. Mobile'!F11","v":0},{"$f":"'M. Mobile'!G11","v":"6.2.1"},{"$f":"'M. Mobile'!H11","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A12","v":3742},{"$f":"'M. Mobile'!I12","v":3},{"$f":"'M. Mobile'!J12","v":0},{"$f":"'M. Mobile'!K12","v":1},{"$f":"'M. Mobile'!B12","v":"M.1.1.6"},{"$f":"'M. Mobile'!C12","v":"Data handling?"},{"$f":"'M. Mobile'!D12","v":0},{"$f":"'M. Mobile'!E12","v":0},{"$f":"'M. Mobile'!F12","v":0},{"$f":"'M. Mobile'!G12","v":"6.2.1"},{"$f":"'M. Mobile'!H12","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A13","v":3743},{"$f":"'M. Mobile'!I13","v":3},{"$f":"'M. Mobile'!J13","v":0},{"$f":"'M. Mobile'!K13","v":1},{"$f":"'M. Mobile'!B13","v":"M.1.1.7"},{"$f":"'M. Mobile'!C13","v":"Individual responsibility for co-mingling personal and Scoped Data on the mobile device?"},{"$f":"'M. Mobile'!D13","v":0},{"$f":"'M. Mobile'!E13","v":0},{"$f":"'M. Mobile'!F13","v":0},{"$f":"'M. Mobile'!G13","v":"6.2.1"},{"$f":"'M. Mobile'!H13","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A14","v":3744},{"$f":"'M. Mobile'!I14","v":3},{"$f":"'M. Mobile'!J14","v":0},{"$f":"'M. Mobile'!K14","v":1},{"$f":"'M. Mobile'!B14","v":"M.1.1.8"},{"$f":"'M. Mobile'!C14","v":"Constituent accountability?"},{"$f":"'M. Mobile'!D14","v":0},{"$f":"'M. Mobile'!E14","v":0},{"$f":"'M. Mobile'!F14","v":0},{"$f":"'M. Mobile'!G14","v":"6.2.1"},{"$f":"'M. Mobile'!H14","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A15","v":3745},{"$f":"'M. Mobile'!I15","v":3},{"$f":"'M. Mobile'!J15","v":0},{"$f":"'M. Mobile'!K15","v":1},{"$f":"'M. Mobile'!B15","v":"M.1.1.9"},{"$f":"'M. Mobile'!C15","v":"Secure disposal of device at end of life?"},{"$f":"'M. Mobile'!D15","v":0},{"$f":"'M. Mobile'!E15","v":0},{"$f":"'M. Mobile'!F15","v":0},{"$f":"'M. Mobile'!G15","v":"6.2.1"},{"$f":"'M. Mobile'!H15","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A16","v":3746},{"$f":"'M. Mobile'!I16","v":3},{"$f":"'M. Mobile'!J16","v":0},{"$f":"'M. Mobile'!K16","v":1},{"$f":"'M. Mobile'!B16","v":"M.1.1.10"},{"$f":"'M. Mobile'!C16","v":"Vulnerability management?"},{"$f":"'M. Mobile'!D16","v":0},{"$f":"'M. Mobile'!E16","v":0},{"$f":"'M. Mobile'!F16","v":0},{"$f":"'M. Mobile'!G16","v":"6.2.1"},{"$f":"'M. Mobile'!H16","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A17","v":3747},{"$f":"'M. Mobile'!I17","v":3},{"$f":"'M. Mobile'!J17","v":0},{"$f":"'M. Mobile'!K17","v":1},{"$f":"'M. Mobile'!B17","v":"M.1.1.11"},{"$f":"'M. Mobile'!C17","v":"Responsibility for ensuring mobile device operating system is updated?"},{"$f":"'M. Mobile'!D17","v":0},{"$f":"'M. Mobile'!E17","v":0},{"$f":"'M. Mobile'!F17","v":0},{"$f":"'M. Mobile'!G17","v":"6.2.1"},{"$f":"'M. Mobile'!H17","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A18","v":3748},{"$f":"'M. Mobile'!I18","v":3},{"$f":"'M. Mobile'!J18","v":0},{"$f":"'M. Mobile'!K18","v":1},{"$f":"'M. Mobile'!B18","v":"M.1.1.12"},{"$f":"'M. Mobile'!C18","v":"Responsibility for ensuring mobile device applications are updated?"},{"$f":"'M. Mobile'!D18","v":0},{"$f":"'M. Mobile'!E18","v":0},{"$f":"'M. Mobile'!F18","v":0},{"$f":"'M. Mobile'!G18","v":"6.2.1"},{"$f":"'M. Mobile'!H18","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A19","v":3749},{"$f":"'M. Mobile'!I19","v":3},{"$f":"'M. Mobile'!J19","v":0},{"$f":"'M. Mobile'!K19","v":1},{"$f":"'M. Mobile'!B19","v":"M.1.1.13"},{"$f":"'M. Mobile'!C19","v":"Reporting information security incidents in the event of loss or theft?"},{"$f":"'M. Mobile'!D19","v":0},{"$f":"'M. Mobile'!E19","v":0},{"$f":"'M. Mobile'!F19","v":0},{"$f":"'M. Mobile'!G19","v":"6.2.1"},{"$f":"'M. Mobile'!H19","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A20","v":3750},{"$f":"'M. Mobile'!I20","v":3},{"$f":"'M. Mobile'!J20","v":0},{"$f":"'M. Mobile'!K20","v":1},{"$f":"'M. Mobile'!B20","v":"M.1.1.14"},{"$f":"'M. Mobile'!C20","v":"Prohibit sharing mobile device with other users, including family and friends?"},{"$f":"'M. Mobile'!D20","v":0},{"$f":"'M. Mobile'!E20","v":0},{"$f":"'M. Mobile'!F20","v":0},{"$f":"'M. Mobile'!G20","v":"6.2.1"},{"$f":"'M. Mobile'!H20","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A21","v":3751},{"$f":"'M. Mobile'!I21","v":3},{"$f":"'M. Mobile'!J21","v":0},{"$f":"'M. Mobile'!K21","v":1},{"$f":"'M. Mobile'!B21","v":"M.1.1.15"},{"$f":"'M. Mobile'!C21","v":"Ownership of data on the device?"},{"$f":"'M. Mobile'!D21","v":0},{"$f":"'M. Mobile'!E21","v":0},{"$f":"'M. Mobile'!F21","v":0},{"$f":"'M. Mobile'!G21","v":"6.2.1"},{"$f":"'M. Mobile'!H21","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A22","v":3752},{"$f":"'M. Mobile'!I22","v":3},{"$f":"'M. Mobile'!J22","v":0},{"$f":"'M. Mobile'!K22","v":1},{"$f":"'M. Mobile'!B22","v":"M.1.1.16"},{"$f":"'M. Mobile'!C22","v":"Legal ownership and rights of the mobile device and contents?"},{"$f":"'M. Mobile'!D22","v":0},{"$f":"'M. Mobile'!E22","v":0},{"$f":"'M. Mobile'!F22","v":0},{"$f":"'M. Mobile'!G22","v":"6.2.1"},{"$f":"'M. Mobile'!H22","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A23","v":3753},{"$f":"'M. Mobile'!I23","v":3},{"$f":"'M. Mobile'!J23","v":0},{"$f":"'M. Mobile'!K23","v":1},{"$f":"'M. Mobile'!B23","v":"M.1.1.17"},{"$f":"'M. Mobile'!C23","v":"Specific actions that may be taken in the event of a lost/stolen or compromised mobile device (e.g., remote disable, remote wipe, confiscation)?"},{"$f":"'M. Mobile'!D23","v":0},{"$f":"'M. Mobile'!E23","v":0},{"$f":"'M. Mobile'!F23","v":0},{"$f":"'M. Mobile'!G23","v":"6.2.1"},{"$f":"'M. Mobile'!H23","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A24","v":3754},{"$f":"'M. Mobile'!I24","v":3},{"$f":"'M. Mobile'!J24","v":0},{"$f":"'M. Mobile'!K24","v":1},{"$f":"'M. Mobile'!B24","v":"M.1.1.18"},{"$f":"'M. Mobile'!C24","v":"Data sanitization of Scoped Data, settings and accounts on the mobile device at end of life?"},{"$f":"'M. Mobile'!D24","v":0},{"$f":"'M. Mobile'!E24","v":0},{"$f":"'M. Mobile'!F24","v":0},{"$f":"'M. Mobile'!G24","v":"6.2.1"},{"$f":"'M. Mobile'!H24","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A25","v":3755},{"$f":"'M. Mobile'!I25","v":3},{"$f":"'M. Mobile'!J25","v":0},{"$f":"'M. Mobile'!K25","v":1},{"$f":"'M. Mobile'!B25","v":"M.1.1.19"},{"$f":"'M. Mobile'!C25","v":"Creation and use of mobile hotspots on the respondent's premise (BYON - Bring Your Own Network)"},{"$f":"'M. Mobile'!D25","v":0},{"$f":"'M. Mobile'!E25","v":0},{"$f":"'M. Mobile'!F25","v":0},{"$f":"'M. Mobile'!G25","v":"6.2.1"},{"$f":"'M. Mobile'!H25","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A26","v":3756},{"$f":"'M. Mobile'!I26","v":3},{"$f":"'M. Mobile'!J26","v":0},{"$f":"'M. Mobile'!K26","v":1},{"$f":"'M. Mobile'!B26","v":"M.1.1.20"},{"$f":"'M. Mobile'!C26","v":"Consequences for non-compliance with mobile device policy?"},{"$f":"'M. Mobile'!D26","v":0},{"$f":"'M. Mobile'!E26","v":0},{"$f":"'M. Mobile'!F26","v":0},{"$f":"'M. Mobile'!G26","v":"6.2.1"},{"$f":"'M. Mobile'!H26","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A27","v":3757},{"$f":"'M. Mobile'!I27","v":3},{"$f":"'M. Mobile'!J27","v":0},{"$f":"'M. Mobile'!K27","v":1},{"$f":"'M. Mobile'!B27","v":"M.1.1.21"},{"$f":"'M. Mobile'!C27","v":"User authentication on the device?"},{"$f":"'M. Mobile'!D27","v":0},{"$f":"'M. Mobile'!E27","v":0},{"$f":"'M. Mobile'!F27","v":0},{"$f":"'M. Mobile'!G27","v":"6.2.1"},{"$f":"'M. Mobile'!H27","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A28","v":3758},{"$f":"'M. Mobile'!I28","v":3},{"$f":"'M. Mobile'!J28","v":0},{"$f":"'M. Mobile'!K28","v":1},{"$f":"'M. Mobile'!B28","v":"M.1.1.22"},{"$f":"'M. Mobile'!C28","v":"Device encryption?"},{"$f":"'M. Mobile'!D28","v":0},{"$f":"'M. Mobile'!E28","v":0},{"$f":"'M. Mobile'!F28","v":0},{"$f":"'M. Mobile'!G28","v":"6.2.1"},{"$f":"'M. Mobile'!H28","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A29","v":3759},{"$f":"'M. Mobile'!I29","v":2},{"$f":"'M. Mobile'!J29","v":0},{"$f":"'M. Mobile'!K29","v":1},{"$f":"'M. Mobile'!B29","v":"M.1.2"},{"$f":"'M. Mobile'!C29","v":"Are mobile devices permitted to connect to the environment? If Yes, what type of connection is permitted:"},{"$f":"'M. Mobile'!D29","v":0},{"$f":"'M. Mobile'!E29","v":0},{"$f":"'M. Mobile'!F29","v":0},{"$f":"'M. Mobile'!G29","v":"6.2.1"},{"$f":"'M. Mobile'!H29","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A30","v":3810},{"$f":"'M. Mobile'!I30","v":3},{"$f":"'M. Mobile'!J30","v":0},{"$f":"'M. Mobile'!K30","v":1},{"$f":"'M. Mobile'!B30","v":"M.1.2.1"},{"$f":"'M. Mobile'!C30","v":"Respondent e-mail - remote access?"},{"$f":"'M. Mobile'!D30","v":0},{"$f":"'M. Mobile'!E30","v":0},{"$f":"'M. Mobile'!F30","v":0},{"$f":"'M. Mobile'!G30","v":"6.2.1"},{"$f":"'M. Mobile'!H30","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A31","v":3811},{"$f":"'M. Mobile'!I31","v":3},{"$f":"'M. Mobile'!J31","v":0},{"$f":"'M. Mobile'!K31","v":1},{"$f":"'M. Mobile'!B31","v":"M.1.2.2"},{"$f":"'M. Mobile'!C31","v":"VPN - remote access?"},{"$f":"'M. Mobile'!D31","v":0},{"$f":"'M. Mobile'!E31","v":0},{"$f":"'M. Mobile'!F31","v":0},{"$f":"'M. Mobile'!G31","v":"6.2.1"},{"$f":"'M. Mobile'!H31","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A32","v":3812},{"$f":"'M. Mobile'!I32","v":3},{"$f":"'M. Mobile'!J32","v":0},{"$f":"'M. Mobile'!K32","v":1},{"$f":"'M. Mobile'!B32","v":"M.1.2.3"},{"$f":"'M. Mobile'!C32","v":"Guest access networks - wireless (local connection)?"},{"$f":"'M. Mobile'!D32","v":0},{"$f":"'M. Mobile'!E32","v":0},{"$f":"'M. Mobile'!F32","v":0},{"$f":"'M. Mobile'!G32","v":"6.2.1"},{"$f":"'M. Mobile'!H32","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A33","v":3813},{"$f":"'M. Mobile'!I33","v":3},{"$f":"'M. Mobile'!J33","v":0},{"$f":"'M. Mobile'!K33","v":1},{"$f":"'M. Mobile'!B33","v":"M.1.2.4"},{"$f":"'M. Mobile'!C33","v":"Corporate networks - wireless (local connection)?"},{"$f":"'M. Mobile'!D33","v":0},{"$f":"'M. Mobile'!E33","v":0},{"$f":"'M. Mobile'!F33","v":0},{"$f":"'M. Mobile'!G33","v":"6.2.1"},{"$f":"'M. Mobile'!H33","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A34","v":3814},{"$f":"'M. Mobile'!I34","v":3},{"$f":"'M. Mobile'!J34","v":0},{"$f":"'M. Mobile'!K34","v":1},{"$f":"'M. Mobile'!B34","v":"M.1.2.5"},{"$f":"'M. Mobile'!C34","v":"Test and development networks - wireless (local connection)?"},{"$f":"'M. Mobile'!D34","v":0},{"$f":"'M. Mobile'!E34","v":0},{"$f":"'M. Mobile'!F34","v":0},{"$f":"'M. Mobile'!G34","v":"6.2.1"},{"$f":"'M. Mobile'!H34","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A35","v":3815},{"$f":"'M. Mobile'!I35","v":3},{"$f":"'M. Mobile'!J35","v":0},{"$f":"'M. Mobile'!K35","v":1},{"$f":"'M. Mobile'!B35","v":"M.1.2.6"},{"$f":"'M. Mobile'!C35","v":"Production networks - wireless (local connection)?"},{"$f":"'M. Mobile'!D35","v":0},{"$f":"'M. Mobile'!E35","v":0},{"$f":"'M. Mobile'!F35","v":0},{"$f":"'M. Mobile'!G35","v":"6.2.1"},{"$f":"'M. Mobile'!H35","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A36","v":3816},{"$f":"'M. Mobile'!I36","v":3},{"$f":"'M. Mobile'!J36","v":0},{"$f":"'M. Mobile'!K36","v":1},{"$f":"'M. Mobile'!B36","v":"M.1.2.7"},{"$f":"'M. Mobile'!C36","v":"Any network containing Scoped Data - wireless (local connection)?"},{"$f":"'M. Mobile'!D36","v":0},{"$f":"'M. Mobile'!E36","v":0},{"$f":"'M. Mobile'!F36","v":0},{"$f":"'M. Mobile'!G36","v":"6.2.1"},{"$f":"'M. Mobile'!H36","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A37","v":3762},{"$f":"'M. Mobile'!I37","v":2},{"$f":"'M. Mobile'!J37","v":0},{"$f":"'M. Mobile'!K37","v":1},{"$f":"'M. Mobile'!B37","v":"M.1.3"},{"$f":"'M. Mobile'!C37","v":"Are all mobile devices evaluated as part of the IT Risk Management program?"},{"$f":"'M. Mobile'!D37","v":0},{"$f":"'M. Mobile'!E37","v":0},{"$f":"'M. Mobile'!F37","v":0},{"$f":"'M. Mobile'!G37","v":"NA"},{"$f":"'M. Mobile'!H37","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A38","v":3763},{"$f":"'M. Mobile'!I38","v":2},{"$f":"'M. Mobile'!J38","v":1},{"$f":"'M. Mobile'!K38","v":1},{"$f":"'M. Mobile'!B38","v":"M.1.4"},{"$f":"'M. Mobile'!C38","v":"Are any of the following mobile device ownership models supported:"},{"$f":"'M. Mobile'!D38","v":0},{"$f":"'M. Mobile'!E38","v":0},{"$f":"'M. Mobile'!F38","v":0},{"$f":"'M. Mobile'!G38","v":"6.2.1"},{"$f":"'M. Mobile'!H38","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A39","v":3764},{"$f":"'M. Mobile'!I39","v":3},{"$f":"'M. Mobile'!J39","v":0},{"$f":"'M. Mobile'!K39","v":1},{"$f":"'M. Mobile'!B39","v":"M.1.4.1"},{"$f":"'M. Mobile'!C39","v":"Respondent owned and managed mobile devices?"},{"$f":"'M. Mobile'!D39","v":0},{"$f":"'M. Mobile'!E39","v":0},{"$f":"'M. Mobile'!F39","v":0},{"$f":"'M. Mobile'!G39","v":"6.2.1"},{"$f":"'M. Mobile'!H39","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A40","v":3765},{"$f":"'M. Mobile'!I40","v":3},{"$f":"'M. Mobile'!J40","v":0},{"$f":"'M. Mobile'!K40","v":1},{"$f":"'M. Mobile'!B40","v":"M.1.4.2"},{"$f":"'M. Mobile'!C40","v":"Constituent owned (BYOD) and respondent un-managed mobile devices?"},{"$f":"'M. Mobile'!D40","v":0},{"$f":"'M. Mobile'!E40","v":0},{"$f":"'M. Mobile'!F40","v":0},{"$f":"'M. Mobile'!G40","v":"6.2.1"},{"$f":"'M. Mobile'!H40","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A41","v":3766},{"$f":"'M. Mobile'!I41","v":3},{"$f":"'M. Mobile'!J41","v":0},{"$f":"'M. Mobile'!K41","v":1},{"$f":"'M. Mobile'!B41","v":"M.1.4.3"},{"$f":"'M. Mobile'!C41","v":"Constituent owned (BYOD) and respondent managed mobile devices?"},{"$f":"'M. Mobile'!D41","v":0},{"$f":"'M. Mobile'!E41","v":0},{"$f":"'M. Mobile'!F41","v":0},{"$f":"'M. Mobile'!G41","v":"6.2.1"},{"$f":"'M. Mobile'!H41","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A42","v":3767},{"$f":"'M. Mobile'!I42","v":2},{"$f":"'M. Mobile'!J42","v":0},{"$f":"'M. Mobile'!K42","v":1},{"$f":"'M. Mobile'!B42","v":"M.1.5"},{"$f":"'M. Mobile'!C42","v":"Are constituents who are authorized to access Scoped Systems and Data required to attend mandatory mobile device Security Awareness Training? If yes, what is the frequency:"},{"$f":"'M. Mobile'!D42","v":0},{"$f":"'M. Mobile'!E42","v":0},{"$f":"'M. Mobile'!F42","v":0},{"$f":"'M. Mobile'!G42","v":"6.2.1"},{"$f":"'M. Mobile'!H42","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A43","v":3768},{"$f":"'M. Mobile'!I43","v":3},{"$f":"'M. Mobile'!J43","v":0},{"$f":"'M. Mobile'!K43","v":1},{"$f":"'M. Mobile'!B43","v":"M.1.5.1"},{"$f":"'M. Mobile'!C43","v":"Prior to connecting the mobile device to respondent resources?"},{"$f":"'M. Mobile'!D43","v":0},{"$f":"'M. Mobile'!E43","v":0},{"$f":"'M. Mobile'!F43","v":0},{"$f":"'M. Mobile'!G43","v":"NA"},{"$f":"'M. Mobile'!H43","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A44","v":3769},{"$f":"'M. Mobile'!I44","v":3},{"$f":"'M. Mobile'!J44","v":0},{"$f":"'M. Mobile'!K44","v":1},{"$f":"'M. Mobile'!B44","v":"M.1.5.2"},{"$f":"'M. Mobile'!C44","v":"Annually?"},{"$f":"'M. Mobile'!D44","v":0},{"$f":"'M. Mobile'!E44","v":0},{"$f":"'M. Mobile'!F44","v":0},{"$f":"'M. Mobile'!G44","v":"NA"},{"$f":"'M. Mobile'!H44","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A45","v":3770},{"$f":"'M. Mobile'!I45","v":2},{"$f":"'M. Mobile'!J45","v":0},{"$f":"'M. Mobile'!K45","v":1},{"$f":"'M. Mobile'!B45","v":"M.1.6"},{"$f":"'M. Mobile'!C45","v":"Is Mobile Device Management (MDM) functionality supported? If yes, is it:"},{"$f":"'M. Mobile'!D45","v":0},{"$f":"'M. Mobile'!E45","v":0},{"$f":"'M. Mobile'!F45","v":0},{"$f":"'M. Mobile'!G45","v":"NA"},{"$f":"'M. Mobile'!H45","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A46","v":3771},{"$f":"'M. Mobile'!I46","v":3},{"$f":"'M. Mobile'!J46","v":0},{"$f":"'M. Mobile'!K46","v":1},{"$f":"'M. Mobile'!B46","v":"M.1.6.1"},{"$f":"'M. Mobile'!C46","v":"Part of existing native software (e.g., Exchange ActiveSync)? If yes, describe."},{"$f":"'M. Mobile'!D46","v":0},{"$f":"'M. Mobile'!E46","v":0},{"$f":"'M. Mobile'!F46","v":0},{"$f":"'M. Mobile'!G46","v":"NA"},{"$f":"'M. Mobile'!H46","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A47","v":3772},{"$f":"'M. Mobile'!I47","v":3},{"$f":"'M. Mobile'!J47","v":0},{"$f":"'M. Mobile'!K47","v":1},{"$f":"'M. Mobile'!B47","v":"M.1.6.2"},{"$f":"'M. Mobile'!C47","v":"Dedicated mobile device Management (MDM) software? If yes, describe."},{"$f":"'M. Mobile'!D47","v":0},{"$f":"'M. Mobile'!E47","v":0},{"$f":"'M. Mobile'!F47","v":0},{"$f":"'M. Mobile'!G47","v":"NA"},{"$f":"'M. Mobile'!H47","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A48","v":3773},{"$f":"'M. Mobile'!I48","v":2},{"$f":"'M. Mobile'!J48","v":0},{"$f":"'M. Mobile'!K48","v":1},{"$f":"'M. Mobile'!B48","v":"M.1.7"},{"$f":"'M. Mobile'!C48","v":"Prior to device on-boarding are constituents required to sign a legal agreement which details the obligations and rights related to mobile devices? If yes, does it include:"},{"$f":"'M. Mobile'!D48","v":0},{"$f":"'M. Mobile'!E48","v":0},{"$f":"'M. Mobile'!F48","v":0},{"$f":"'M. Mobile'!G48","v":"6.2.1.Section 2.b"},{"$f":"'M. Mobile'!H48","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A49","v":3774},{"$f":"'M. Mobile'!I49","v":3},{"$f":"'M. Mobile'!J49","v":0},{"$f":"'M. Mobile'!K49","v":1},{"$f":"'M. Mobile'!B49","v":"M.1.7.1"},{"$f":"'M. Mobile'!C49","v":"Owner of data on the mobile device?"},{"$f":"'M. Mobile'!D49","v":0},{"$f":"'M. Mobile'!E49","v":0},{"$f":"'M. Mobile'!F49","v":0},{"$f":"'M. Mobile'!G49","v":"6.2.1.Section 2.b"},{"$f":"'M. Mobile'!H49","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A50","v":3775},{"$f":"'M. Mobile'!I50","v":3},{"$f":"'M. Mobile'!J50","v":0},{"$f":"'M. Mobile'!K50","v":1},{"$f":"'M. Mobile'!B50","v":"M.1.7.2"},{"$f":"'M. Mobile'!C50","v":"User's responsibility in ensuring the security of the mobile device?"},{"$f":"'M. Mobile'!D50","v":0},{"$f":"'M. Mobile'!E50","v":0},{"$f":"'M. Mobile'!F50","v":0},{"$f":"'M. Mobile'!G50","v":"6.2.1"},{"$f":"'M. Mobile'!H50","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A51","v":3776},{"$f":"'M. Mobile'!I51","v":3},{"$f":"'M. Mobile'!J51","v":0},{"$f":"'M. Mobile'!K51","v":1},{"$f":"'M. Mobile'!B51","v":"M.1.7.3"},{"$f":"'M. Mobile'!C51","v":"Security requirements for Scoped Systems and Data will override user's personal use?"},{"$f":"'M. Mobile'!D51","v":0},{"$f":"'M. Mobile'!E51","v":0},{"$f":"'M. Mobile'!F51","v":0},{"$f":"'M. Mobile'!G51","v":"6.2.1"},{"$f":"'M. Mobile'!H51","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A52","v":3777},{"$f":"'M. Mobile'!I52","v":3},{"$f":"'M. Mobile'!J52","v":0},{"$f":"'M. Mobile'!K52","v":1},{"$f":"'M. Mobile'!B52","v":"M.1.7.4"},{"$f":"'M. Mobile'!C52","v":"Support roles and responsibilities"},{"$f":"'M. Mobile'!D52","v":0},{"$f":"'M. Mobile'!E52","v":0},{"$f":"'M. Mobile'!F52","v":0},{"$f":"'M. Mobile'!G52","v":"NA"},{"$f":"'M. Mobile'!H52","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A53","v":3778},{"$f":"'M. Mobile'!I53","v":2},{"$f":"'M. Mobile'!J53","v":1},{"$f":"'M. Mobile'!K53","v":1},{"$f":"'M. Mobile'!B53","v":"M.1.8"},{"$f":"'M. Mobile'!C53","v":"In the event of a data compromise investigation, is it possible to:"},{"$f":"'M. Mobile'!D53","v":0},{"$f":"'M. Mobile'!E53","v":0},{"$f":"'M. Mobile'!F53","v":0},{"$f":"'M. Mobile'!G53","v":"NA"},{"$f":"'M. Mobile'!H53","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A54","v":3779},{"$f":"'M. Mobile'!I54","v":3},{"$f":"'M. Mobile'!J54","v":0},{"$f":"'M. Mobile'!K54","v":1},{"$f":"'M. Mobile'!B54","v":"M.1.8.1"},{"$f":"'M. Mobile'!C54","v":"Remotely wipe the mobile device?"},{"$f":"'M. Mobile'!D54","v":0},{"$f":"'M. Mobile'!E54","v":0},{"$f":"'M. Mobile'!F54","v":0},{"$f":"'M. Mobile'!G54","v":"NA"},{"$f":"'M. Mobile'!H54","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A55","v":3780},{"$f":"'M. Mobile'!I55","v":3},{"$f":"'M. Mobile'!J55","v":0},{"$f":"'M. Mobile'!K55","v":1},{"$f":"'M. Mobile'!B55","v":"M.1.8.2"},{"$f":"'M. Mobile'!C55","v":"Remotely access Scoped Data on the mobile?"},{"$f":"'M. Mobile'!D55","v":0},{"$f":"'M. Mobile'!E55","v":0},{"$f":"'M. Mobile'!F55","v":0},{"$f":"'M. Mobile'!G55","v":"NA"},{"$f":"'M. Mobile'!H55","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A56","v":3781},{"$f":"'M. Mobile'!I56","v":3},{"$f":"'M. Mobile'!J56","v":0},{"$f":"'M. Mobile'!K56","v":1},{"$f":"'M. Mobile'!B56","v":"M.1.8.3"},{"$f":"'M. Mobile'!C56","v":"Physically access Scoped Data on the mobile device?"},{"$f":"'M. Mobile'!D56","v":0},{"$f":"'M. Mobile'!E56","v":0},{"$f":"'M. Mobile'!F56","v":0},{"$f":"'M. Mobile'!G56","v":"NA"},{"$f":"'M. Mobile'!H56","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A57","v":3782},{"$f":"'M. Mobile'!I57","v":3},{"$f":"'M. Mobile'!J57","v":0},{"$f":"'M. Mobile'!K57","v":1},{"$f":"'M. Mobile'!B57","v":"M.1.8.4"},{"$f":"'M. Mobile'!C57","v":"Perform a forensic analysis on the mobile device?"},{"$f":"'M. Mobile'!D57","v":0},{"$f":"'M. Mobile'!E57","v":0},{"$f":"'M. Mobile'!F57","v":0},{"$f":"'M. Mobile'!G57","v":"NA"},{"$f":"'M. Mobile'!H57","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A58","v":3783},{"$f":"'M. Mobile'!I58","v":2},{"$f":"'M. Mobile'!J58","v":0},{"$f":"'M. Mobile'!K58","v":1},{"$f":"'M. Mobile'!B58","v":"M.1.9"},{"$f":"'M. Mobile'!C58","v":"Is there an approved process to support the mobile device lifecycle? If yes, does it include:"},{"$f":"'M. Mobile'!D58","v":0},{"$f":"'M. Mobile'!E58","v":0},{"$f":"'M. Mobile'!F58","v":0},{"$f":"'M. Mobile'!G58","v":"6.2.1.a"},{"$f":"'M. Mobile'!H58","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A59","v":3784},{"$f":"'M. Mobile'!I59","v":3},{"$f":"'M. Mobile'!J59","v":0},{"$f":"'M. Mobile'!K59","v":1},{"$f":"'M. Mobile'!B59","v":"M.1.9.1"},{"$f":"'M. Mobile'!C59","v":"On-boarding mobile devices?"},{"$f":"'M. Mobile'!D59","v":0},{"$f":"'M. Mobile'!E59","v":0},{"$f":"'M. Mobile'!F59","v":0},{"$f":"'M. Mobile'!G59","v":"6.2.1.a"},{"$f":"'M. Mobile'!H59","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A60","v":3785},{"$f":"'M. Mobile'!I60","v":3},{"$f":"'M. Mobile'!J60","v":0},{"$f":"'M. Mobile'!K60","v":1},{"$f":"'M. Mobile'!B60","v":"M.1.9.2"},{"$f":"'M. Mobile'!C60","v":"Off-boarding mobile devices?"},{"$f":"'M. Mobile'!D60","v":0},{"$f":"'M. Mobile'!E60","v":0},{"$f":"'M. Mobile'!F60","v":0},{"$f":"'M. Mobile'!G60","v":"6.2.1.a"},{"$f":"'M. Mobile'!H60","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A61","v":3786},{"$f":"'M. Mobile'!I61","v":3},{"$f":"'M. Mobile'!J61","v":0},{"$f":"'M. Mobile'!K61","v":1},{"$f":"'M. Mobile'!B61","v":"M.1.9.3"},{"$f":"'M. Mobile'!C61","v":"Asset Tracking against the mobile devices each constituent is permitted to connect with?"},{"$f":"'M. Mobile'!D61","v":0},{"$f":"'M. Mobile'!E61","v":0},{"$f":"'M. Mobile'!F61","v":0},{"$f":"'M. Mobile'!G61","v":"NA"},{"$f":"'M. Mobile'!H61","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A62","v":3787},{"$f":"'M. Mobile'!I62","v":2},{"$f":"'M. Mobile'!J62","v":0},{"$f":"'M. Mobile'!K62","v":1},{"$f":"'M. Mobile'!B62","v":"M.1.10"},{"$f":"'M. Mobile'!C62","v":"Is there an approved process for IT to off-board mobile devices when a constituent terminates, or requests to on-board a new mobile device? If yes, does it:"},{"$f":"'M. Mobile'!D62","v":0},{"$f":"'M. Mobile'!E62","v":0},{"$f":"'M. Mobile'!F62","v":0},{"$f":"'M. Mobile'!G62","v":"NA"},{"$f":"'M. Mobile'!H62","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A63","v":3788},{"$f":"'M. Mobile'!I63","v":3},{"$f":"'M. Mobile'!J63","v":0},{"$f":"'M. Mobile'!K63","v":1},{"$f":"'M. Mobile'!B63","v":"M.1.10.1"},{"$f":"'M. Mobile'!C63","v":"Identify if the constituent has any legacy devices accessing Scoped Systems and Data?"},{"$f":"'M. Mobile'!D63","v":0},{"$f":"'M. Mobile'!E63","v":0},{"$f":"'M. Mobile'!F63","v":0},{"$f":"'M. Mobile'!G63","v":"NA"},{"$f":"'M. Mobile'!H63","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A64","v":3789},{"$f":"'M. Mobile'!I64","v":3},{"$f":"'M. Mobile'!J64","v":0},{"$f":"'M. Mobile'!K64","v":1},{"$f":"'M. Mobile'!B64","v":"M.1.10.2"},{"$f":"'M. Mobile'!C64","v":"Confirm that Scoped Data, respondent settings and accounts have been removed from the legacy mobile device?"},{"$f":"'M. Mobile'!D64","v":0},{"$f":"'M. Mobile'!E64","v":0},{"$f":"'M. Mobile'!F64","v":0},{"$f":"'M. Mobile'!G64","v":"NA"},{"$f":"'M. Mobile'!H64","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A65","v":3790},{"$f":"'M. Mobile'!I65","v":2},{"$f":"'M. Mobile'!J65","v":0},{"$f":"'M. Mobile'!K65","v":1},{"$f":"'M. Mobile'!B65","v":"M.1.11"},{"$f":"'M. Mobile'!C65","v":"Are constituents permitted to simultaneously connect more than two mobile devices to respondent resources?"},{"$f":"'M. Mobile'!D65","v":0},{"$f":"'M. Mobile'!E65","v":0},{"$f":"'M. Mobile'!F65","v":0},{"$f":"'M. Mobile'!G65","v":"NA"},{"$f":"'M. Mobile'!H65","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A66","v":3797},{"$f":"'M. Mobile'!I66","v":2},{"$f":"'M. Mobile'!J66","v":0},{"$f":"'M. Mobile'!K66","v":1},{"$f":"'M. Mobile'!B66","v":"M.1.12"},{"$f":"'M. Mobile'!C66","v":"Are secure disposal service provided?"},{"$f":"'M. Mobile'!D66","v":0},{"$f":"'M. Mobile'!E66","v":0},{"$f":"'M. Mobile'!F66","v":0},{"$f":"'M. Mobile'!G66","v":"6.2.1.i"},{"$f":"'M. Mobile'!H66","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A67","v":3798},{"$f":"'M. Mobile'!I67","v":2},{"$f":"'M. Mobile'!J67","v":0},{"$f":"'M. Mobile'!K67","v":1},{"$f":"'M. Mobile'!B67","v":"M.1.13"},{"$f":"'M. Mobile'!C67","v":"Are management discovery and control capabilities implemented? If yes, do they include:"},{"$f":"'M. Mobile'!D67","v":0},{"$f":"'M. Mobile'!E67","v":0},{"$f":"'M. Mobile'!F67","v":0},{"$f":"'M. Mobile'!G67","v":"NA"},{"$f":"'M. Mobile'!H67","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A68","v":3799},{"$f":"'M. Mobile'!I68","v":3},{"$f":"'M. Mobile'!J68","v":0},{"$f":"'M. Mobile'!K68","v":1},{"$f":"'M. Mobile'!B68","v":"M.1.13.1"},{"$f":"'M. Mobile'!C68","v":"Software distribution controls?"},{"$f":"'M. Mobile'!D68","v":0},{"$f":"'M. Mobile'!E68","v":0},{"$f":"'M. Mobile'!F68","v":0},{"$f":"'M. Mobile'!G68","v":"NA"},{"$f":"'M. Mobile'!H68","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A69","v":3800},{"$f":"'M. Mobile'!I69","v":3},{"$f":"'M. Mobile'!J69","v":0},{"$f":"'M. Mobile'!K69","v":1},{"$f":"'M. Mobile'!B69","v":"M.1.13.2"},{"$f":"'M. Mobile'!C69","v":"Password strength?"},{"$f":"'M. Mobile'!D69","v":0},{"$f":"'M. Mobile'!E69","v":0},{"$f":"'M. Mobile'!F69","v":0},{"$f":"'M. Mobile'!G69","v":"NA"},{"$f":"'M. Mobile'!H69","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A70","v":3801},{"$f":"'M. Mobile'!I70","v":3},{"$f":"'M. Mobile'!J70","v":0},{"$f":"'M. Mobile'!K70","v":1},{"$f":"'M. Mobile'!B70","v":"M.1.13.3"},{"$f":"'M. Mobile'!C70","v":"Remote wipe?"},{"$f":"'M. Mobile'!D70","v":0},{"$f":"'M. Mobile'!E70","v":0},{"$f":"'M. Mobile'!F70","v":0},{"$f":"'M. Mobile'!G70","v":"NA"},{"$f":"'M. Mobile'!H70","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A71","v":3802},{"$f":"'M. Mobile'!I71","v":3},{"$f":"'M. Mobile'!J71","v":0},{"$f":"'M. Mobile'!K71","v":1},{"$f":"'M. Mobile'!B71","v":"M.1.13.4"},{"$f":"'M. Mobile'!C71","v":"Remote lock?"},{"$f":"'M. Mobile'!D71","v":0},{"$f":"'M. Mobile'!E71","v":0},{"$f":"'M. Mobile'!F71","v":0},{"$f":"'M. Mobile'!G71","v":"NA"},{"$f":"'M. Mobile'!H71","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A72","v":3803},{"$f":"'M. Mobile'!I72","v":3},{"$f":"'M. Mobile'!J72","v":0},{"$f":"'M. Mobile'!K72","v":1},{"$f":"'M. Mobile'!B72","v":"M.1.13.5"},{"$f":"'M. Mobile'!C72","v":"Detect jailbreak device?"},{"$f":"'M. Mobile'!D72","v":0},{"$f":"'M. Mobile'!E72","v":0},{"$f":"'M. Mobile'!F72","v":0},{"$f":"'M. Mobile'!G72","v":"NA"},{"$f":"'M. Mobile'!H72","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A73","v":3804},{"$f":"'M. Mobile'!I73","v":3},{"$f":"'M. Mobile'!J73","v":0},{"$f":"'M. Mobile'!K73","v":1},{"$f":"'M. Mobile'!B73","v":"M.1.13.6"},{"$f":"'M. Mobile'!C73","v":"Application Inventory?"},{"$f":"'M. Mobile'!D73","v":0},{"$f":"'M. Mobile'!E73","v":0},{"$f":"'M. Mobile'!F73","v":0},{"$f":"'M. Mobile'!G73","v":"NA"},{"$f":"'M. Mobile'!H73","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A74","v":3805},{"$f":"'M. Mobile'!I74","v":3},{"$f":"'M. Mobile'!J74","v":0},{"$f":"'M. Mobile'!K74","v":1},{"$f":"'M. Mobile'!B74","v":"M.1.13.7"},{"$f":"'M. Mobile'!C74","v":"Encryption verification?"},{"$f":"'M. Mobile'!D74","v":0},{"$f":"'M. Mobile'!E74","v":0},{"$f":"'M. Mobile'!F74","v":0},{"$f":"'M. Mobile'!G74","v":"6.2.1.g"},{"$f":"'M. Mobile'!H74","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A75","v":3806},{"$f":"'M. Mobile'!I75","v":3},{"$f":"'M. Mobile'!J75","v":0},{"$f":"'M. Mobile'!K75","v":1},{"$f":"'M. Mobile'!B75","v":"M.1.13.8"},{"$f":"'M. Mobile'!C75","v":"Verification mobile device operating system?"},{"$f":"'M. Mobile'!D75","v":0},{"$f":"'M. Mobile'!E75","v":0},{"$f":"'M. Mobile'!F75","v":0},{"$f":"'M. Mobile'!G75","v":"NA"},{"$f":"'M. Mobile'!H75","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A76","v":3807},{"$f":"'M. Mobile'!I76","v":3},{"$f":"'M. Mobile'!J76","v":0},{"$f":"'M. Mobile'!K76","v":1},{"$f":"'M. Mobile'!B76","v":"M.1.13.9"},{"$f":"'M. Mobile'!C76","v":"Verification mobile device applications?"},{"$f":"'M. Mobile'!D76","v":0},{"$f":"'M. Mobile'!E76","v":0},{"$f":"'M. Mobile'!F76","v":0},{"$f":"'M. Mobile'!G76","v":"NA"},{"$f":"'M. Mobile'!H76","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A77","v":3808},{"$f":"'M. Mobile'!I77","v":3},{"$f":"'M. Mobile'!J77","v":0},{"$f":"'M. Mobile'!K77","v":1},{"$f":"'M. Mobile'!B77","v":"M.1.13.10"},{"$f":"'M. Mobile'!C77","v":"Detect and unlock applications?"},{"$f":"'M. Mobile'!D77","v":0},{"$f":"'M. Mobile'!E77","v":0},{"$f":"'M. Mobile'!F77","v":0},{"$f":"'M. Mobile'!G77","v":"NA"},{"$f":"'M. Mobile'!H77","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A78","v":3817},{"$f":"'M. Mobile'!I78","v":2},{"$f":"'M. Mobile'!J78","v":0},{"$f":"'M. Mobile'!K78","v":1},{"$f":"'M. Mobile'!B78","v":"M.1.14"},{"$f":"'M. Mobile'!C78","v":"Is interaction permitted to Scoped Data and Systems? If yes, what is permitted:"},{"$f":"'M. Mobile'!D78","v":0},{"$f":"'M. Mobile'!E78","v":0},{"$f":"'M. Mobile'!F78","v":0},{"$f":"'M. Mobile'!G78","v":"6.2.1"},{"$f":"'M. Mobile'!H78","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A79","v":3818},{"$f":"'M. Mobile'!I79","v":3},{"$f":"'M. Mobile'!J79","v":0},{"$f":"'M. Mobile'!K79","v":1},{"$f":"'M. Mobile'!B79","v":"M.1.14.1"},{"$f":"'M. Mobile'!C79","v":"View Scoped Data directly from the mobile device?"},{"$f":"'M. Mobile'!D79","v":0},{"$f":"'M. Mobile'!E79","v":0},{"$f":"'M. Mobile'!F79","v":0},{"$f":"'M. Mobile'!G79","v":"6.2.1"},{"$f":"'M. Mobile'!H79","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A80","v":3819},{"$f":"'M. Mobile'!I80","v":3},{"$f":"'M. Mobile'!J80","v":0},{"$f":"'M. Mobile'!K80","v":1},{"$f":"'M. Mobile'!B80","v":"M.1.14.2"},{"$f":"'M. Mobile'!C80","v":"Access to Scoped Data limited via a clean room? "},{"$f":"'M. Mobile'!D80","v":0},{"$f":"'M. Mobile'!E80","v":0},{"$f":"'M. Mobile'!F80","v":0},{"$f":"'M. Mobile'!G80","v":"6.2.1"},{"$f":"'M. Mobile'!H80","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A81","v":3820},{"$f":"'M. Mobile'!I81","v":3},{"$f":"'M. Mobile'!J81","v":0},{"$f":"'M. Mobile'!K81","v":1},{"$f":"'M. Mobile'!B81","v":"M.1.14.3"},{"$f":"'M. Mobile'!C81","v":"Store Scoped Data locally on the mobile device, only when still logged into the application?"},{"$f":"'M. Mobile'!D81","v":0},{"$f":"'M. Mobile'!E81","v":0},{"$f":"'M. Mobile'!F81","v":0},{"$f":"'M. Mobile'!G81","v":"6.2.1"},{"$f":"'M. Mobile'!H81","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A82","v":3821},{"$f":"'M. Mobile'!I82","v":3},{"$f":"'M. Mobile'!J82","v":0},{"$f":"'M. Mobile'!K82","v":1},{"$f":"'M. Mobile'!B82","v":"M.1.14.4"},{"$f":"'M. Mobile'!C82","v":"Store Scoped Data locally on the mobile device, when logged out of the application?"},{"$f":"'M. Mobile'!D82","v":0},{"$f":"'M. Mobile'!E82","v":0},{"$f":"'M. Mobile'!F82","v":0},{"$f":"'M. Mobile'!G82","v":"6.2.1"},{"$f":"'M. Mobile'!H82","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A83","v":3822},{"$f":"'M. Mobile'!I83","v":2},{"$f":"'M. Mobile'!J83","v":0},{"$f":"'M. Mobile'!K83","v":1},{"$f":"'M. Mobile'!B83","v":"M.1.15"},{"$f":"'M. Mobile'!C83","v":"Is mobile device management part of the audit program? "},{"$f":"'M. Mobile'!D83","v":0},{"$f":"'M. Mobile'!E83","v":0},{"$f":"'M. Mobile'!F83","v":0},{"$f":"'M. Mobile'!G83","v":"NA"},{"$f":"'M. Mobile'!H83","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A84","v":3823},{"$f":"'M. Mobile'!I84","v":2},{"$f":"'M. Mobile'!J84","v":0},{"$f":"'M. Mobile'!K84","v":1},{"$f":"'M. Mobile'!B84","v":"M.1.16"},{"$f":"'M. Mobile'!C84","v":"Are there approved operating system versions permitted to connect to the respondent's environment? If yes, describe."},{"$f":"'M. Mobile'!D84","v":0},{"$f":"'M. Mobile'!E84","v":0},{"$f":"'M. Mobile'!F84","v":0},{"$f":"'M. Mobile'!G84","v":"6.2.1"},{"$f":"'M. Mobile'!H84","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A85","v":3824},{"$f":"'M. Mobile'!I85","v":3},{"$f":"'M. Mobile'!J85","v":0},{"$f":"'M. Mobile'!K85","v":1},{"$f":"'M. Mobile'!B85","v":"M.1.16.1"},{"$f":"'M. Mobile'!C85","v":"Are operating system versions that are deemed end of life permitted to connect to Scoped Systems and Data?"},{"$f":"'M. Mobile'!D85","v":0},{"$f":"'M. Mobile'!E85","v":0},{"$f":"'M. Mobile'!F85","v":0},{"$f":"'M. Mobile'!G85","v":"6.2.1"},{"$f":"'M. Mobile'!H85","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A86","v":3825},{"$f":"'M. Mobile'!I86","v":2},{"$f":"'M. Mobile'!J86","v":0},{"$f":"'M. Mobile'!K86","v":1},{"$f":"'M. Mobile'!B86","v":"M.1.17"},{"$f":"'M. Mobile'!C86","v":"Are constituents permitted to create and activate mobile hotspots Bring Your Own Network (BYON) ?"},{"$f":"'M. Mobile'!D86","v":0},{"$f":"'M. Mobile'!E86","v":0},{"$f":"'M. Mobile'!F86","v":0},{"$f":"'M. Mobile'!G86","v":"6.2.1"},{"$f":"'M. Mobile'!H86","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A87","v":3826},{"$f":"'M. Mobile'!I87","v":2},{"$f":"'M. Mobile'!J87","v":0},{"$f":"'M. Mobile'!K87","v":1},{"$f":"'M. Mobile'!B87","v":"M.1.18"},{"$f":"'M. Mobile'!C87","v":"Are mobile applications that access Scoped Systems and Data developed?"},{"$f":"'M. Mobile'!D87","v":0},{"$f":"'M. Mobile'!E87","v":0},{"$f":"'M. Mobile'!F87","v":0},{"$f":"'M. Mobile'!G87","v":"NA"},{"$f":"'M. Mobile'!H87","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A88","v":3918},{"$f":"'M. Mobile'!I88","v":3},{"$f":"'M. Mobile'!J88","v":1},{"$f":"'M. Mobile'!K88","v":1},{"$f":"'M. Mobile'!B88","v":"M.1.18.1"},{"$f":"'M. Mobile'!C88","v":"Are the applications released:"},{"$f":"'M. Mobile'!D88","v":0},{"$f":"'M. Mobile'!E88","v":0},{"$f":"'M. Mobile'!F88","v":0},{"$f":"'M. Mobile'!G88","v":"NA"},{"$f":"'M. Mobile'!H88","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A89","v":3827},{"$f":"'M. Mobile'!I89","v":4},{"$f":"'M. Mobile'!J89","v":0},{"$f":"'M. Mobile'!K89","v":1},{"$f":"'M. Mobile'!B89","v":"M.1.18.1.1"},{"$f":"'M. Mobile'!C89","v":"In an application store - customer only?"},{"$f":"'M. Mobile'!D89","v":0},{"$f":"'M. Mobile'!E89","v":0},{"$f":"'M. Mobile'!F89","v":0},{"$f":"'M. Mobile'!G89","v":"NA"},{"$f":"'M. Mobile'!H89","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A90","v":3828},{"$f":"'M. Mobile'!I90","v":4},{"$f":"'M. Mobile'!J90","v":0},{"$f":"'M. Mobile'!K90","v":1},{"$f":"'M. Mobile'!B90","v":"M.1.18.1.2"},{"$f":"'M. Mobile'!C90","v":"In an application store - public?"},{"$f":"'M. Mobile'!D90","v":0},{"$f":"'M. Mobile'!E90","v":0},{"$f":"'M. Mobile'!F90","v":0},{"$f":"'M. Mobile'!G90","v":"NA"},{"$f":"'M. Mobile'!H90","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A91","v":3829},{"$f":"'M. Mobile'!I91","v":3},{"$f":"'M. Mobile'!J91","v":0},{"$f":"'M. Mobile'!K91","v":1},{"$f":"'M. Mobile'!B91","v":"M.1.18.2"},{"$f":"'M. Mobile'!C91","v":"Are any actions performed by the application to Scoped Systems or Data? If yes, what are they:"},{"$f":"'M. Mobile'!D91","v":0},{"$f":"'M. Mobile'!E91","v":0},{"$f":"'M. Mobile'!F91","v":0},{"$f":"'M. Mobile'!G91","v":"NA"},{"$f":"'M. Mobile'!H91","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A92","v":3830},{"$f":"'M. Mobile'!I92","v":4},{"$f":"'M. Mobile'!J92","v":0},{"$f":"'M. Mobile'!K92","v":1},{"$f":"'M. Mobile'!B92","v":"M.1.18.2.1"},{"$f":"'M. Mobile'!C92","v":"Access?"},{"$f":"'M. Mobile'!D92","v":0},{"$f":"'M. Mobile'!E92","v":0},{"$f":"'M. Mobile'!F92","v":0},{"$f":"'M. Mobile'!G92","v":"NA"},{"$f":"'M. Mobile'!H92","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A93","v":3831},{"$f":"'M. Mobile'!I93","v":4},{"$f":"'M. Mobile'!J93","v":0},{"$f":"'M. Mobile'!K93","v":1},{"$f":"'M. Mobile'!B93","v":"M.1.18.2.2"},{"$f":"'M. Mobile'!C93","v":"Process?"},{"$f":"'M. Mobile'!D93","v":0},{"$f":"'M. Mobile'!E93","v":0},{"$f":"'M. Mobile'!F93","v":0},{"$f":"'M. Mobile'!G93","v":"NA"},{"$f":"'M. Mobile'!H93","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A94","v":3832},{"$f":"'M. Mobile'!I94","v":4},{"$f":"'M. Mobile'!J94","v":0},{"$f":"'M. Mobile'!K94","v":1},{"$f":"'M. Mobile'!B94","v":"M.1.18.2.3"},{"$f":"'M. Mobile'!C94","v":"Transmit?"},{"$f":"'M. Mobile'!D94","v":0},{"$f":"'M. Mobile'!E94","v":0},{"$f":"'M. Mobile'!F94","v":0},{"$f":"'M. Mobile'!G94","v":"NA"},{"$f":"'M. Mobile'!H94","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A95","v":3833},{"$f":"'M. Mobile'!I95","v":4},{"$f":"'M. Mobile'!J95","v":0},{"$f":"'M. Mobile'!K95","v":1},{"$f":"'M. Mobile'!B95","v":"M.1.18.2.4"},{"$f":"'M. Mobile'!C95","v":"Store locally?"},{"$f":"'M. Mobile'!D95","v":0},{"$f":"'M. Mobile'!E95","v":0},{"$f":"'M. Mobile'!F95","v":0},{"$f":"'M. Mobile'!G95","v":"NA"},{"$f":"'M. Mobile'!H95","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A96","v":3834},{"$f":"'M. Mobile'!I96","v":3},{"$f":"'M. Mobile'!J96","v":0},{"$f":"'M. Mobile'!K96","v":1},{"$f":"'M. Mobile'!B96","v":"M.1.18.3"},{"$f":"'M. Mobile'!C96","v":"Is there a mobile software development lifecycle (SDLC) process? If yes, does it include:"},{"$f":"'M. Mobile'!D96","v":0},{"$f":"'M. Mobile'!E96","v":0},{"$f":"'M. Mobile'!F96","v":0},{"$f":"'M. Mobile'!G96","v":"NA"},{"$f":"'M. Mobile'!H96","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A97","v":3835},{"$f":"'M. Mobile'!I97","v":4},{"$f":"'M. Mobile'!J97","v":0},{"$f":"'M. Mobile'!K97","v":1},{"$f":"'M. Mobile'!B97","v":"M.1.18.3.1"},{"$f":"'M. Mobile'!C97","v":"Application security review?"},{"$f":"'M. Mobile'!D97","v":0},{"$f":"'M. Mobile'!E97","v":0},{"$f":"'M. Mobile'!F97","v":0},{"$f":"'M. Mobile'!G97","v":"NA"},{"$f":"'M. Mobile'!H97","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A98","v":3836},{"$f":"'M. Mobile'!I98","v":4},{"$f":"'M. Mobile'!J98","v":0},{"$f":"'M. Mobile'!K98","v":1},{"$f":"'M. Mobile'!B98","v":"M.1.18.3.2"},{"$f":"'M. Mobile'!C98","v":"Static Code Analysis (SCA)?"},{"$f":"'M. Mobile'!D98","v":0},{"$f":"'M. Mobile'!E98","v":0},{"$f":"'M. Mobile'!F98","v":0},{"$f":"'M. Mobile'!G98","v":"NA"},{"$f":"'M. Mobile'!H98","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A99","v":3837},{"$f":"'M. Mobile'!I99","v":4},{"$f":"'M. Mobile'!J99","v":0},{"$f":"'M. Mobile'!K99","v":1},{"$f":"'M. Mobile'!B99","v":"M.1.18.3.3"},{"$f":"'M. Mobile'!C99","v":"Penetration test?"},{"$f":"'M. Mobile'!D99","v":0},{"$f":"'M. Mobile'!E99","v":0},{"$f":"'M. Mobile'!F99","v":0},{"$f":"'M. Mobile'!G99","v":"NA"},{"$f":"'M. Mobile'!H99","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A100","v":3838},{"$f":"'M. Mobile'!I100","v":4},{"$f":"'M. Mobile'!J100","v":0},{"$f":"'M. Mobile'!K100","v":1},{"$f":"'M. Mobile'!B100","v":"M.1.18.3.4"},{"$f":"'M. Mobile'!C100","v":"Signing by a trusted certificate?"},{"$f":"'M. Mobile'!D100","v":0},{"$f":"'M. Mobile'!E100","v":0},{"$f":"'M. Mobile'!F100","v":0},{"$f":"'M. Mobile'!G100","v":"NA"},{"$f":"'M. Mobile'!H100","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A101","v":3839},{"$f":"'M. Mobile'!I101","v":3},{"$f":"'M. Mobile'!J101","v":0},{"$f":"'M. Mobile'!K101","v":1},{"$f":"'M. Mobile'!B101","v":"M.1.18.4"},{"$f":"'M. Mobile'!C101","v":"Are mobile applications developed for constituent use? If yes, which functions are permitted?"},{"$f":"'M. Mobile'!D101","v":0},{"$f":"'M. Mobile'!E101","v":0},{"$f":"'M. Mobile'!F101","v":0},{"$f":"'M. Mobile'!G101","v":"6.2.1.f"},{"$f":"'M. Mobile'!H101","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A102","v":3840},{"$f":"'M. Mobile'!I102","v":4},{"$f":"'M. Mobile'!J102","v":0},{"$f":"'M. Mobile'!K102","v":1},{"$f":"'M. Mobile'!B102","v":"M.1.18.4.1"},{"$f":"'M. Mobile'!C102","v":"Access email?"},{"$f":"'M. Mobile'!D102","v":0},{"$f":"'M. Mobile'!E102","v":0},{"$f":"'M. Mobile'!F102","v":0},{"$f":"'M. Mobile'!G102","v":"6.2.1.f"},{"$f":"'M. Mobile'!H102","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A103","v":3841},{"$f":"'M. Mobile'!I103","v":4},{"$f":"'M. Mobile'!J103","v":0},{"$f":"'M. Mobile'!K103","v":1},{"$f":"'M. Mobile'!B103","v":"M.1.18.4.2"},{"$f":"'M. Mobile'!C103","v":"Access contacts?"},{"$f":"'M. Mobile'!D103","v":0},{"$f":"'M. Mobile'!E103","v":0},{"$f":"'M. Mobile'!F103","v":0},{"$f":"'M. Mobile'!G103","v":"6.2.1.f"},{"$f":"'M. Mobile'!H103","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A104","v":3842},{"$f":"'M. Mobile'!I104","v":4},{"$f":"'M. Mobile'!J104","v":0},{"$f":"'M. Mobile'!K104","v":1},{"$f":"'M. Mobile'!B104","v":"M.1.18.4.3"},{"$f":"'M. Mobile'!C104","v":"Access calendar?"},{"$f":"'M. Mobile'!D104","v":0},{"$f":"'M. Mobile'!E104","v":0},{"$f":"'M. Mobile'!F104","v":0},{"$f":"'M. Mobile'!G104","v":"6.2.1.f"},{"$f":"'M. Mobile'!H104","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A105","v":3843},{"$f":"'M. Mobile'!I105","v":4},{"$f":"'M. Mobile'!J105","v":0},{"$f":"'M. Mobile'!K105","v":1},{"$f":"'M. Mobile'!B105","v":"M.1.18.4.4"},{"$f":"'M. Mobile'!C105","v":"Access user created content (e.g., photos and videos)?"},{"$f":"'M. Mobile'!D105","v":0},{"$f":"'M. Mobile'!E105","v":0},{"$f":"'M. Mobile'!F105","v":0},{"$f":"'M. Mobile'!G105","v":"6.2.1.f"},{"$f":"'M. Mobile'!H105","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A106","v":3844},{"$f":"'M. Mobile'!I106","v":4},{"$f":"'M. Mobile'!J106","v":0},{"$f":"'M. Mobile'!K106","v":1},{"$f":"'M. Mobile'!B106","v":"M.1.18.4.5"},{"$f":"'M. Mobile'!C106","v":"Access geographic location?"},{"$f":"'M. Mobile'!D106","v":0},{"$f":"'M. Mobile'!E106","v":0},{"$f":"'M. Mobile'!F106","v":0},{"$f":"'M. Mobile'!G106","v":"6.2.1.f"},{"$f":"'M. Mobile'!H106","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A107","v":3845},{"$f":"'M. Mobile'!I107","v":4},{"$f":"'M. Mobile'!J107","v":0},{"$f":"'M. Mobile'!K107","v":1},{"$f":"'M. Mobile'!B107","v":"M.1.18.4.6"},{"$f":"'M. Mobile'!C107","v":"Enable/disable camera?"},{"$f":"'M. Mobile'!D107","v":0},{"$f":"'M. Mobile'!E107","v":0},{"$f":"'M. Mobile'!F107","v":0},{"$f":"'M. Mobile'!G107","v":"6.2.1.f"},{"$f":"'M. Mobile'!H107","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A108","v":3846},{"$f":"'M. Mobile'!I108","v":4},{"$f":"'M. Mobile'!J108","v":0},{"$f":"'M. Mobile'!K108","v":1},{"$f":"'M. Mobile'!B108","v":"M.1.18.4.7"},{"$f":"'M. Mobile'!C108","v":"Enable/disable microphone?"},{"$f":"'M. Mobile'!D108","v":0},{"$f":"'M. Mobile'!E108","v":0},{"$f":"'M. Mobile'!F108","v":0},{"$f":"'M. Mobile'!G108","v":"6.2.1.f"},{"$f":"'M. Mobile'!H108","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A109","v":3847},{"$f":"'M. Mobile'!I109","v":4},{"$f":"'M. Mobile'!J109","v":0},{"$f":"'M. Mobile'!K109","v":1},{"$f":"'M. Mobile'!B109","v":"M.1.18.4.8"},{"$f":"'M. Mobile'!C109","v":"Connect to an external site \"beacon signal\" when the application is not activated by the user?"},{"$f":"'M. Mobile'!D109","v":0},{"$f":"'M. Mobile'!E109","v":0},{"$f":"'M. Mobile'!F109","v":0},{"$f":"'M. Mobile'!G109","v":"6.2.1.k"},{"$f":"'M. Mobile'!H109","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A110","v":3848},{"$f":"'M. Mobile'!I110","v":3},{"$f":"'M. Mobile'!J110","v":0},{"$f":"'M. Mobile'!K110","v":1},{"$f":"'M. Mobile'!B110","v":"M.1.18.5"},{"$f":"'M. Mobile'!C110","v":"Does data remain stored on the device after the application disconnects? If yes, what type of data:"},{"$f":"'M. Mobile'!D110","v":0},{"$f":"'M. Mobile'!E110","v":0},{"$f":"'M. Mobile'!F110","v":0},{"$f":"'M. Mobile'!G110","v":"6.2.1"},{"$f":"'M. Mobile'!H110","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A111","v":3849},{"$f":"'M. Mobile'!I111","v":4},{"$f":"'M. Mobile'!J111","v":0},{"$f":"'M. Mobile'!K111","v":1},{"$f":"'M. Mobile'!B111","v":"M.1.18.5.1"},{"$f":"'M. Mobile'!C111","v":"IP or web address?"},{"$f":"'M. Mobile'!D111","v":0},{"$f":"'M. Mobile'!E111","v":0},{"$f":"'M. Mobile'!F111","v":0},{"$f":"'M. Mobile'!G111","v":"NA"},{"$f":"'M. Mobile'!H111","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A112","v":3850},{"$f":"'M. Mobile'!I112","v":4},{"$f":"'M. Mobile'!J112","v":0},{"$f":"'M. Mobile'!K112","v":1},{"$f":"'M. Mobile'!B112","v":"M.1.18.5.2"},{"$f":"'M. Mobile'!C112","v":"User name?"},{"$f":"'M. Mobile'!D112","v":0},{"$f":"'M. Mobile'!E112","v":0},{"$f":"'M. Mobile'!F112","v":0},{"$f":"'M. Mobile'!G112","v":"NA"},{"$f":"'M. Mobile'!H112","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A113","v":3851},{"$f":"'M. Mobile'!I113","v":4},{"$f":"'M. Mobile'!J113","v":0},{"$f":"'M. Mobile'!K113","v":1},{"$f":"'M. Mobile'!B113","v":"M.1.18.5.3"},{"$f":"'M. Mobile'!C113","v":"Password?"},{"$f":"'M. Mobile'!D113","v":0},{"$f":"'M. Mobile'!E113","v":0},{"$f":"'M. Mobile'!F113","v":0},{"$f":"'M. Mobile'!G113","v":"NA"},{"$f":"'M. Mobile'!H113","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A114","v":3852},{"$f":"'M. Mobile'!I114","v":4},{"$f":"'M. Mobile'!J114","v":0},{"$f":"'M. Mobile'!K114","v":1},{"$f":"'M. Mobile'!B114","v":"M.1.18.5.4"},{"$f":"'M. Mobile'!C114","v":"Session authentication cookie?"},{"$f":"'M. Mobile'!D114","v":0},{"$f":"'M. Mobile'!E114","v":0},{"$f":"'M. Mobile'!F114","v":0},{"$f":"'M. Mobile'!G114","v":"NA"},{"$f":"'M. Mobile'!H114","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A115","v":3853},{"$f":"'M. Mobile'!I115","v":4},{"$f":"'M. Mobile'!J115","v":0},{"$f":"'M. Mobile'!K115","v":1},{"$f":"'M. Mobile'!B115","v":"M.1.18.5.5"},{"$f":"'M. Mobile'!C115","v":"Geographic location data?"},{"$f":"'M. Mobile'!D115","v":0},{"$f":"'M. Mobile'!E115","v":0},{"$f":"'M. Mobile'!F115","v":0},{"$f":"'M. Mobile'!G115","v":"NA"},{"$f":"'M. Mobile'!H115","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A116","v":3854},{"$f":"'M. Mobile'!I116","v":4},{"$f":"'M. Mobile'!J116","v":0},{"$f":"'M. Mobile'!K116","v":1},{"$f":"'M. Mobile'!B116","v":"M.1.18.5.6"},{"$f":"'M. Mobile'!C116","v":"Scoped Data?"},{"$f":"'M. Mobile'!D116","v":0},{"$f":"'M. Mobile'!E116","v":0},{"$f":"'M. Mobile'!F116","v":0},{"$f":"'M. Mobile'!G116","v":"NA"},{"$f":"'M. Mobile'!H116","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A117","v":3855},{"$f":"'M. Mobile'!I117","v":3},{"$f":"'M. Mobile'!J117","v":0},{"$f":"'M. Mobile'!K117","v":1},{"$f":"'M. Mobile'!B117","v":"M.1.18.6"},{"$f":"'M. Mobile'!C117","v":"Are mobile payments enabled? "},{"$f":"'M. Mobile'!D117","v":0},{"$f":"'M. Mobile'!E117","v":0},{"$f":"'M. Mobile'!F117","v":0},{"$f":"'M. Mobile'!G117","v":"NA"},{"$f":"'M. Mobile'!H117","v":0},null,null,"N/A"]
[{"$f":"'M. Mobile'!A118","v":3856},{"$f":"'M. Mobile'!I118","v":4},{"$f":"'M. Mobile'!J118","v":0},{"$f":"'M. Mobile'!K118","v":1},{"$f":"'M. Mobile'!B118","v":"M.1.18.6.1"},{"$f":"'M. Mobile'!C118","v":"Is Scoped Data stored in unencrypted form locally?"},{"$f":"'M. Mobile'!D118","v":0},{"$f":"'M. Mobile'!E118","v":0},{"$f":"'M. Mobile'!F118","v":0},{"$f":"'M. Mobile'!G118","v":"6.2.1.g"},{"$f":"'M. Mobile'!H118","v":"Mobile device policy"},null,null,"N/A"]
[{"$f":"'M. Mobile'!A119","v":0},{"$f":"'M. Mobile'!I119","v":0},{"$f":"'M. Mobile'!J119","v":0},{"$f":"'M. Mobile'!K119","v":0},{"$f":"'M. Mobile'!B119","v":0},{"$f":"'M. Mobile'!C119","v":0},{"$f":"'M. Mobile'!D119","v":0},{"$f":"'M. Mobile'!E119","v":0},{"$f":"'M. Mobile'!F119","v":0},{"$f":"'M. Mobile'!G119","v":0},{"$f":"'M. Mobile'!H119","v":0}]
[]
[{"$f":"'P. Privacy'!B1","v":"P. Privacy"},null,null,null,{"$f":"'P. Privacy'!B1","v":"P. Privacy"}]
[{"$f":"'P. Privacy'!A5","v":3687},{"$f":"'P. Privacy'!I5","v":1},{"$f":"'P. Privacy'!J5","v":0},{"$f":"'P. Privacy'!X5","v":1},{"$f":"'P. Privacy'!B5","v":"P.1"},{"$f":"'P. Privacy'!C5","v":"Is Scoped Data transmitted, processed, or stored that can be classified as non-public information (NPI), personally identifiable information (PII), or sensitive customer financial information? If yes, describe and list types of data."},{"$f":"'P. Privacy'!D5","v":"Yes"},{"$f":"'P. Privacy'!E5","v":"Cloudamize Security Policy - Cloudamize Information Security Policy. Only NPI, no PII or Finacial Information"},{"$f":"'P. Privacy'!F5","v":0},{"$f":"'P. Privacy'!G5","v":"8.2.1"},{"$f":"'P. Privacy'!H5","v":"Classification of Information"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A6","v":3221},{"$f":"'P. Privacy'!I6","v":2},{"$f":"'P. Privacy'!J6","v":0},{"$f":"'P. Privacy'!X6","v":0},{"$f":"'P. Privacy'!B6","v":"P.1.1"},{"$f":"'P. Privacy'!C6","v":"Is there a documented data protection program with administrative, technical, and physical safeguards for the protection of Scoped Data?"},{"$f":"'P. Privacy'!D6","v":"Yes"},{"$f":"'P. Privacy'!E6","v":"Cloudamize Security Policy - Cloudamize Information Security Policy. "},{"$f":"'P. Privacy'!F6","v":"P.6 Management of Client Target Privacy Data"},{"$f":"'P. Privacy'!G6","v":0},{"$f":"'P. Privacy'!H6","v":0},null,null,"N/A"]
[{"$f":"'P. Privacy'!A7","v":3234},{"$f":"'P. Privacy'!I7","v":2},{"$f":"'P. Privacy'!J7","v":0},{"$f":"'P. Privacy'!X7","v":1},{"$f":"'P. Privacy'!B7","v":"P.1.2"},{"$f":"'P. Privacy'!C7","v":"Is a response program maintained that includes policies and procedures to address privacy incidents, unauthorized disclosure, unauthorized access or breach of Scoped Data?"},{"$f":"'P. Privacy'!D7","v":"Yes"},{"$f":"'P. Privacy'!E7","v":"Cloudamize Security Policy - Cloudamize Privacy Policy"},{"$f":"'P. Privacy'!F7","v":"P.8 Privacy Event Notification and Response Management"},{"$f":"'P. Privacy'!G7","v":16.100000000000001},{"$f":"'P. Privacy'!H7","v":"Management of information security incidents and improvements"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A8","v":3690},{"$f":"'P. Privacy'!I8","v":2},{"$f":"'P. Privacy'!J8","v":0},{"$f":"'P. Privacy'!X8","v":0},{"$f":"'P. Privacy'!B8","v":"P.1.3"},{"$f":"'P. Privacy'!C8","v":"Do agreements with third parties who have access to Scoped Data, address confidentiality, audit, security, and privacy, including but not limited to incident response, ongoing monitoring, data sharing and secure disposal of Scoped Data?"},{"$f":"'P. Privacy'!D8","v":"Yes"},{"$f":"'P. Privacy'!E8","v":"Cloudamize Security Policy - Cloudamize Privacy Policy"},{"$f":"'P. Privacy'!F8","v":"P.4 Privacy Third Party Agreements"},{"$f":"'P. Privacy'!G8","v":"15.1.2 "},{"$f":"'P. Privacy'!H8","v":"Addressing security within supplier agreements"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A9","v":3691},{"$f":"'P. Privacy'!I9","v":2},{"$f":"'P. Privacy'!J9","v":0},{"$f":"'P. Privacy'!X9","v":0},{"$f":"'P. Privacy'!B9","v":"P.1.4"},{"$f":"'P. Privacy'!C9","v":"Are processes maintained to ensure the proper disposal of Scoped Data? If yes, describe."},{"$f":"'P. Privacy'!D9","v":"Yes"},{"$f":"'P. Privacy'!E9","v":"Cloudamize Security Policy - Cloudamize Privacy Policy"},{"$f":"'P. Privacy'!F9","v":0},{"$f":"'P. Privacy'!G9","v":"8.3.2 "},{"$f":"'P. Privacy'!H9","v":"Disposal of media"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A10","v":3692},{"$f":"'P. Privacy'!I10","v":2},{"$f":"'P. Privacy'!J10","v":0},{"$f":"'P. Privacy'!X10","v":0},{"$f":"'P. Privacy'!B10","v":"P.1.5"},{"$f":"'P. Privacy'!C10","v":"Is there a process to limit or prevent the sharing of Scoped Data with affiliates unless authorized?"},{"$f":"'P. Privacy'!D10","v":"Yes"},{"$f":"'P. Privacy'!E10","v":"Cloudamize Security Policy - Cloudamize Privacy Policy"},{"$f":"'P. Privacy'!F10","v":"P.6 Management of Client Target Privacy Data"},{"$f":"'P. Privacy'!G10","v":"8.2.3 "},{"$f":"'P. Privacy'!H10","v":"Handling of assets"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A11","v":3284},{"$f":"'P. Privacy'!I11","v":2},{"$f":"'P. Privacy'!J11","v":0},{"$f":"'P. Privacy'!X11","v":0},{"$f":"'P. Privacy'!B11","v":"P.1.6"},{"$f":"'P. Privacy'!C11","v":"Is there a process to provide notification as required by regulatory authorities or law enforcement, to address incidents of unauthorized access or breach of Scoped Data?"},{"$f":"'P. Privacy'!D11","v":"Yes"},{"$f":"'P. Privacy'!E11","v":"Cloudamize Security Policy - Cloudamize Privacy Policy"},{"$f":"'P. Privacy'!F11","v":"P.8 Privacy Event Notification and Response Management"},{"$f":"'P. Privacy'!G11","v":"16.1.2 "},{"$f":"'P. Privacy'!H11","v":"Reporting information security events"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A12","v":3857},{"$f":"'P. Privacy'!I12","v":2},{"$f":"'P. Privacy'!J12","v":0},{"$f":"'P. Privacy'!X12","v":0},{"$f":"'P. Privacy'!B12","v":"P.1.7"},{"$f":"'P. Privacy'!C12","v":"For services provided on behalf of client that include direct interaction with client's customers are processes in place to log and report privacy complaints?"},{"$f":"'P. Privacy'!D12","v":"Yes"},{"$f":"'P. Privacy'!E12","v":"Cloudamize Security Policy - Cloudamize Privacy Policy"},{"$f":"'P. Privacy'!F12","v":"P.4 Privacy Third Party Agreements"},{"$f":"'P. Privacy'!G12","v":"NA"},{"$f":"'P. Privacy'!H12","v":0},null,null,"N/A"]
[{"$f":"'P. Privacy'!A13","v":3694},{"$f":"'P. Privacy'!I13","v":1},{"$f":"'P. Privacy'!J13","v":0},{"$f":"'P. Privacy'!X13","v":1},{"$f":"'P. Privacy'!B13","v":"P.2"},{"$f":"'P. Privacy'!C13","v":"Is Scoped Data transmitted, processed, or stored that can be classified as Protected Health Information (PHI), electronic health records, or personal health records of a covered entity? If yes, identify the classifications."},{"$f":"'P. Privacy'!D13","v":"No"},{"$f":"'P. Privacy'!E13","v":0},{"$f":"'P. Privacy'!F13","v":0},{"$f":"'P. Privacy'!G13","v":"8.2.1"},{"$f":"'P. Privacy'!H13","v":"Classification of Information"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A14","v":3858},{"$f":"'P. Privacy'!I14","v":2},{"$f":"'P. Privacy'!J14","v":0},{"$f":"'P. Privacy'!X14","v":0},{"$f":"'P. Privacy'!B14","v":"P.2.1"},{"$f":"'P. Privacy'!C14","v":" Is PHI accessed, transmitted, processed or stored?"},{"$f":"'P. Privacy'!D14","v":0},{"$f":"'P. Privacy'!E14","v":0},{"$f":"'P. Privacy'!F14","v":0},{"$f":"'P. Privacy'!G14","v":"NA"},{"$f":"'P. Privacy'!H14","v":0},null,null,"N/A"]
[{"$f":"'P. Privacy'!A15","v":3696},{"$f":"'P. Privacy'!I15","v":2},{"$f":"'P. Privacy'!J15","v":0},{"$f":"'P. Privacy'!X15","v":0},{"$f":"'P. Privacy'!B15","v":"P.2.2"},{"$f":"'P. Privacy'!C15","v":"Are there documented policies and procedures to detect and report unauthorized acquisition, use, or disclosure of PHI? If yes, describe."},{"$f":"'P. Privacy'!D15","v":0},{"$f":"'P. Privacy'!E15","v":0},{"$f":"'P. Privacy'!F15","v":"P.8 Privacy Event Notification and Response Management"},{"$f":"'P. Privacy'!G15","v":"16.1.2 "},{"$f":"'P. Privacy'!H15","v":"Reporting information security events"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A16","v":3697},{"$f":"'P. Privacy'!I16","v":2},{"$f":"'P. Privacy'!J16","v":0},{"$f":"'P. Privacy'!X16","v":0},{"$f":"'P. Privacy'!B16","v":"P.2.3"},{"$f":"'P. Privacy'!C16","v":"Are there contractual provisions, and control mechanisms to ensure that privacy and security obligations of the respondent extend to the respondents suppliers, vendors, or subcontractors?"},{"$f":"'P. Privacy'!D16","v":0},{"$f":"'P. Privacy'!E16","v":0},{"$f":"'P. Privacy'!F16","v":"P.4 Privacy Third Party Agreements"},{"$f":"'P. Privacy'!G16","v":"15.1.2 "},{"$f":"'P. Privacy'!H16","v":"Addressing security within supplier agreements"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A17","v":3698},{"$f":"'P. Privacy'!I17","v":2},{"$f":"'P. Privacy'!J17","v":0},{"$f":"'P. Privacy'!X17","v":0},{"$f":"'P. Privacy'!B17","v":"P.2.4"},{"$f":"'P. Privacy'!C17","v":"Are there documented procedures for availability of access to PHI data or designated record set maintained by the respondent?"},{"$f":"'P. Privacy'!D17","v":0},{"$f":"'P. Privacy'!E17","v":0},{"$f":"'P. Privacy'!F17","v":"P.6 Management of Client Target Privacy Data"},{"$f":"'P. Privacy'!G17","v":"8.2.3 "},{"$f":"'P. Privacy'!H17","v":"Handling of assets"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A18","v":3699},{"$f":"'P. Privacy'!I18","v":2},{"$f":"'P. Privacy'!J18","v":0},{"$f":"'P. Privacy'!X18","v":0},{"$f":"'P. Privacy'!B18","v":"P.2.5"},{"$f":"'P. Privacy'!C18","v":"Are there documented procedures to enable the ability to reasonably amend PHI maintained by the respondent upon request?"},{"$f":"'P. Privacy'!D18","v":0},{"$f":"'P. Privacy'!E18","v":0},{"$f":"'P. Privacy'!F18","v":"P.4 Privacy Third Party Agreements"},{"$f":"'P. Privacy'!G18","v":"NA"},{"$f":"'P. Privacy'!H18","v":0},null,null,"N/A"]
[{"$f":"'P. Privacy'!A19","v":3700},{"$f":"'P. Privacy'!I19","v":2},{"$f":"'P. Privacy'!J19","v":0},{"$f":"'P. Privacy'!X19","v":0},{"$f":"'P. Privacy'!B19","v":"P.2.6"},{"$f":"'P. Privacy'!C19","v":"Are there logs or records of disclosures of PHI that can be provided upon request?"},{"$f":"'P. Privacy'!D19","v":0},{"$f":"'P. Privacy'!E19","v":0},{"$f":"'P. Privacy'!F19","v":"P.1 Target Privacy Data Inventory and Flows"},{"$f":"'P. Privacy'!G19","v":"8.2.3.b"},{"$f":"'P. Privacy'!H19","v":"Handling of assets"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A20","v":3701},{"$f":"'P. Privacy'!I20","v":2},{"$f":"'P. Privacy'!J20","v":0},{"$f":"'P. Privacy'!X20","v":1},{"$f":"'P. Privacy'!B20","v":"P.2.7"},{"$f":"'P. Privacy'!C20","v":"Is a business associate contract in place to address obligations for the privacy and security requirements for the services provided?"},{"$f":"'P. Privacy'!D20","v":"Yes"},{"$f":"'P. Privacy'!E20","v":0},{"$f":"'P. Privacy'!F20","v":"P.4 Privacy Third Party Agreements"},{"$f":"'P. Privacy'!G20","v":"15.1.2 "},{"$f":"'P. Privacy'!H20","v":"Addressing security within supplier agreements"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A21","v":3702},{"$f":"'P. Privacy'!I21","v":2},{"$f":"'P. Privacy'!J21","v":0},{"$f":"'P. Privacy'!X21","v":0},{"$f":"'P. Privacy'!B21","v":"P.2.8"},{"$f":"'P. Privacy'!C21","v":"Are there training logs for employees with access to client PHI to meet the privacy and security obligations required by HIPAA? If yes, describe."},{"$f":"'P. Privacy'!D21","v":0},{"$f":"'P. Privacy'!E21","v":0},{"$f":"'P. Privacy'!F21","v":"P.7 Privacy Awareness"},{"$f":"'P. Privacy'!G21","v":"7.2.2 "},{"$f":"'P. Privacy'!H21","v":"Information security awareness, education and training"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A22","v":3703},{"$f":"'P. Privacy'!I22","v":2},{"$f":"'P. Privacy'!J22","v":0},{"$f":"'P. Privacy'!X22","v":0},{"$f":"'P. Privacy'!B22","v":"P.2.9"},{"$f":"'P. Privacy'!C22","v":"Is there a documented process to provide notification as required by regulatory authorities or law enforcement, to address incidents of unauthorized access or breach of protected health information?"},{"$f":"'P. Privacy'!D22","v":0},{"$f":"'P. Privacy'!E22","v":0},{"$f":"'P. Privacy'!F22","v":"P.8 Privacy Event Notification and Response Management"},{"$f":"'P. Privacy'!G22","v":"16.1.1.b.3 "},{"$f":"'P. Privacy'!H22","v":"Responsibilities and procedures"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A23","v":3704},{"$f":"'P. Privacy'!I23","v":1},{"$f":"'P. Privacy'!J23","v":0},{"$f":"'P. Privacy'!X23","v":1},{"$f":"'P. Privacy'!B23","v":"P.3"},{"$f":"'P. Privacy'!C23","v":"For Scoped Data, is personal information about individuals transmitted to or received from countries outside the United States? If yes, list the countries."},{"$f":"'P. Privacy'!D23","v":"No"},{"$f":"'P. Privacy'!E23","v":0},{"$f":"'P. Privacy'!F23","v":0},{"$f":"'P. Privacy'!G23","v":"NA"},{"$f":"'P. Privacy'!H23","v":0},null,null,"N/A"]
[{"$f":"'P. Privacy'!A24","v":3859},{"$f":"'P. Privacy'!I24","v":2},{"$f":"'P. Privacy'!J24","v":0},{"$f":"'P. Privacy'!X24","v":0},{"$f":"'P. Privacy'!B24","v":"P.3.1"},{"$f":"'P. Privacy'!C24","v":"Is information directly collected and used about individuals?"},{"$f":"'P. Privacy'!D24","v":0},{"$f":"'P. Privacy'!E24","v":0},{"$f":"'P. Privacy'!F24","v":0},{"$f":"'P. Privacy'!G24","v":"NA"},{"$f":"'P. Privacy'!H24","v":0},null,null,"N/A"]
[{"$f":"'P. Privacy'!A25","v":3239},{"$f":"'P. Privacy'!I25","v":2},{"$f":"'P. Privacy'!J25","v":0},{"$f":"'P. Privacy'!X25","v":0},{"$f":"'P. Privacy'!B25","v":"P.3.2"},{"$f":"'P. Privacy'!C25","v":"Are notices provided when information is directly collected from an individual? If yes, describe."},{"$f":"'P. Privacy'!D25","v":0},{"$f":"'P. Privacy'!E25","v":0},{"$f":"'P. Privacy'!F25","v":"P.2 Privacy Policy and Privacy Notices"},{"$f":"'P. Privacy'!G25","v":"NA"},{"$f":"'P. Privacy'!H25","v":0},null,null,"N/A"]
[{"$f":"'P. Privacy'!A26","v":3707},{"$f":"'P. Privacy'!I26","v":2},{"$f":"'P. Privacy'!J26","v":0},{"$f":"'P. Privacy'!X26","v":0},{"$f":"'P. Privacy'!B26","v":"P.3.3"},{"$f":"'P. Privacy'!C26","v":"Are there documented operating procedures regarding limiting personal data collection and use?"},{"$f":"'P. Privacy'!D26","v":0},{"$f":"'P. Privacy'!E26","v":0},{"$f":"'P. Privacy'!F26","v":0},{"$f":"'P. Privacy'!G26","v":"8.2.3 "},{"$f":"'P. Privacy'!H26","v":"Handling of assets"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A27","v":3708},{"$f":"'P. Privacy'!I27","v":2},{"$f":"'P. Privacy'!J27","v":0},{"$f":"'P. Privacy'!X27","v":0},{"$f":"'P. Privacy'!B27","v":"P.3.4"},{"$f":"'P. Privacy'!C27","v":"Are there operating procedures for onward transfer of customer information? If yes, describe."},{"$f":"'P. Privacy'!D27","v":0},{"$f":"'P. Privacy'!E27","v":0},{"$f":"'P. Privacy'!F27","v":0},{"$f":"'P. Privacy'!G27","v":"13.2.1"},{"$f":"'P. Privacy'!H27","v":"Information transfer policies and procedures"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A28","v":3709},{"$f":"'P. Privacy'!I28","v":2},{"$f":"'P. Privacy'!J28","v":0},{"$f":"'P. Privacy'!X28","v":0},{"$f":"'P. Privacy'!B28","v":"P.3.5"},{"$f":"'P. Privacy'!C28","v":"Is Safe Harbor status maintained with the Department of Commerce with respect to the data protection applicable to the European Union?"},{"$f":"'P. Privacy'!D28","v":0},{"$f":"'P. Privacy'!E28","v":0},{"$f":"'P. Privacy'!F28","v":"P.5 Legal Authorizations"},{"$f":"'P. Privacy'!G28","v":"NA"},{"$f":"'P. Privacy'!H28","v":0},null,null,"N/A"]
[{"$f":"'P. Privacy'!A29","v":3254},{"$f":"'P. Privacy'!I29","v":2},{"$f":"'P. Privacy'!J29","v":0},{"$f":"'P. Privacy'!X29","v":0},{"$f":"'P. Privacy'!B29","v":"P.3.6"},{"$f":"'P. Privacy'!C29","v":"If customer data is directly collected from individuals, does the customer have the ability to opt out? "},{"$f":"'P. Privacy'!D29","v":0},{"$f":"'P. Privacy'!E29","v":0},{"$f":"'P. Privacy'!F29","v":0},{"$f":"'P. Privacy'!G29","v":"NA"},{"$f":"'P. Privacy'!H29","v":0},null,null,"N/A"]
[{"$f":"'P. Privacy'!A30","v":3263},{"$f":"'P. Privacy'!I30","v":2},{"$f":"'P. Privacy'!J30","v":0},{"$f":"'P. Privacy'!X30","v":0},{"$f":"'P. Privacy'!B30","v":"P.3.7"},{"$f":"'P. Privacy'!C30","v":"If customer data of individuals is retained, are there processes and procedures to enable individuals to access, correct, amend, or delete inaccurate information?"},{"$f":"'P. Privacy'!D30","v":0},{"$f":"'P. Privacy'!E30","v":0},{"$f":"'P. Privacy'!F30","v":0},{"$f":"'P. Privacy'!G30","v":"8.2.3 "},{"$f":"'P. Privacy'!H30","v":"Handling of assets"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A31","v":3228},{"$f":"'P. Privacy'!I31","v":2},{"$f":"'P. Privacy'!J31","v":0},{"$f":"'P. Privacy'!X31","v":1},{"$f":"'P. Privacy'!B31","v":"P.3.8"},{"$f":"'P. Privacy'!C31","v":"Is there privacy awareness training provided to constituents regarding their obligation to data protection."},{"$f":"'P. Privacy'!D31","v":"Yes"},{"$f":"'P. Privacy'!E31","v":"Security Awareness and Training Program and associated procedures ensure all MicroStrategy staff that manage the Secure Cloud complete annual security awareness training on relevant risk management and IT security threats, countermeasures, and trends. The entire MicroStrategy Secure Cloud team attends mandatory training on all key Secure Cloud policies, procedures, and operational controls. All MicroStrategy staff who manages the Secure Cloud is also required to complete privileged user training and acceptable use acknowledgement. "},{"$f":"'P. Privacy'!F31","v":"P.7 Privacy Awareness"},{"$f":"'P. Privacy'!G31","v":"7.2.2 "},{"$f":"'P. Privacy'!H31","v":"Information security awareness, education and training"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A32","v":3713},{"$f":"'P. Privacy'!I32","v":2},{"$f":"'P. Privacy'!J32","v":0},{"$f":"'P. Privacy'!X32","v":0},{"$f":"'P. Privacy'!B32","v":"P.3.9"},{"$f":"'P. Privacy'!C32","v":"Are there documented procedures for cross border data flows of customer data to the US from other countries. If yes, list the countries:"},{"$f":"'P. Privacy'!D32","v":0},{"$f":"'P. Privacy'!E32","v":0},{"$f":"'P. Privacy'!F32","v":"P.2 Privacy Policy and Privacy Notices"},{"$f":"'P. Privacy'!G32","v":"NA"},{"$f":"'P. Privacy'!H32","v":0},null,null,"N/A"]
[{"$f":"'P. Privacy'!A33","v":3714},{"$f":"'P. Privacy'!I33","v":2},{"$f":"'P. Privacy'!J33","v":0},{"$f":"'P. Privacy'!X33","v":0},{"$f":"'P. Privacy'!B33","v":"P.3.10"},{"$f":"'P. Privacy'!C33","v":"Is there a documented response program with policies and procedures to address privacy incidents, unauthorized disclosure, unauthorized access or breach of Scoped Data?"},{"$f":"'P. Privacy'!D33","v":0},{"$f":"'P. Privacy'!E33","v":0},{"$f":"'P. Privacy'!F33","v":"P.8 Privacy Event Notification and Response Management"},{"$f":"'P. Privacy'!G33","v":"16.1.1 "},{"$f":"'P. Privacy'!H33","v":"Responsibilties and procedures"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A34","v":3715},{"$f":"'P. Privacy'!I34","v":1},{"$f":"'P. Privacy'!J34","v":0},{"$f":"'P. Privacy'!X34","v":1},{"$f":"'P. Privacy'!B34","v":"P.4"},{"$f":"'P. Privacy'!C34","v":"Is personal information disclosed to or retained by third parties? If yes, describe."},{"$f":"'P. Privacy'!D34","v":"No"},{"$f":"'P. Privacy'!E34","v":0},{"$f":"'P. Privacy'!F34","v":0},{"$f":"'P. Privacy'!G34","v":15},{"$f":"'P. Privacy'!H34","v":"Supplier Relationships"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A35","v":3270},{"$f":"'P. Privacy'!I35","v":2},{"$f":"'P. Privacy'!J35","v":0},{"$f":"'P. Privacy'!X35","v":1},{"$f":"'P. Privacy'!B35","v":"P.4.1"},{"$f":"'P. Privacy'!C35","v":"Are there contractual controls to ensure that personal information shared with third parties is limited to defined parameters for access, use and disclosure? If yes, describe. If no, explain reason."},{"$f":"'P. Privacy'!D35","v":"Yes"},{"$f":"'P. Privacy'!E35","v":"MicroStrategy does not share customer data stored on the MicroStrategy Secure Cloud with external third-parties, unless requested by the customer or required by law."},{"$f":"'P. Privacy'!F35","v":"P.4 Privacy Third Part Agreements"},{"$f":"'P. Privacy'!G35","v":"15.1.2 "},{"$f":"'P. Privacy'!H35","v":"Addressing security within supplier agreements"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A36","v":3269},{"$f":"'P. Privacy'!I36","v":2},{"$f":"'P. Privacy'!J36","v":0},{"$f":"'P. Privacy'!X36","v":1},{"$f":"'P. Privacy'!B36","v":"P.4.2"},{"$f":"'P. Privacy'!C36","v":"Is personal information accessed, disclosed, processed, transmitted or retained with third parties outside the US? If yes, describe and list the countries."},{"$f":"'P. Privacy'!D36","v":"No"},{"$f":"'P. Privacy'!E36","v":0},{"$f":"'P. Privacy'!F36","v":0},{"$f":"'P. Privacy'!G36","v":15},{"$f":"'P. Privacy'!H36","v":"Supplier Relationships"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A37","v":3718},{"$f":"'P. Privacy'!I37","v":1},{"$f":"'P. Privacy'!J37","v":0},{"$f":"'P. Privacy'!X37","v":1},{"$f":"'P. Privacy'!B37","v":"P.5"},{"$f":"'P. Privacy'!C37","v":"Is there a documented privacy policy or procedures for the protection of information transmitted, processed, or maintained on behalf of the client?"},{"$f":"'P. Privacy'!D37","v":"Yes"},{"$f":"'P. Privacy'!E37","v":"Cloudamize Security Policy - Cloudamize Privacy Policy"},{"$f":"'P. Privacy'!F37","v":"P.2 Privacy Policy and Privacy Notices"},{"$f":"'P. Privacy'!G37","v":"15.1.1"},{"$f":"'P. Privacy'!H37","v":"Information security policy for supplier relationships"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A38","v":3224},{"$f":"'P. Privacy'!I38","v":2},{"$f":"'P. Privacy'!J38","v":0},{"$f":"'P. Privacy'!X38","v":0},{"$f":"'P. Privacy'!B38","v":"P.5.1"},{"$f":"'P. Privacy'!C38","v":"Are privacy policies and procedures reviewed and revised at least annually? "},{"$f":"'P. Privacy'!D38","v":"Yes"},{"$f":"'P. Privacy'!E38","v":"Cloudamize Security Policy - Cloudamize Privacy Policy"},{"$f":"'P. Privacy'!F38","v":"P.3 Privacy Organization and Program Maintenance"},{"$f":"'P. Privacy'!G38","v":"15.1.1.e"},{"$f":"'P. Privacy'!H38","v":"Information security policy for supplier relationships"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A39","v":3225},{"$f":"'P. Privacy'!I39","v":1},{"$f":"'P. Privacy'!J39","v":0},{"$f":"'P. Privacy'!X39","v":1},{"$f":"'P. Privacy'!B39","v":"P.6"},{"$f":"'P. Privacy'!C39","v":"Are there regular privacy risk assessments conducted? If yes, provide frequency and scope. If no, explain reason."},{"$f":"'P. Privacy'!D39","v":"Yes"},{"$f":"'P. Privacy'!E39","v":"Cloudamize Security Policy - Cloudamize Privacy Policy"},{"$f":"'P. Privacy'!F39","v":"P.3 Privacy Organization and Program Maintenance"},{"$f":"'P. Privacy'!G39","v":"15.1.3.i "},{"$f":"'P. Privacy'!H39","v":"Information and communication technology supply chain"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A40","v":3226},{"$f":"'P. Privacy'!I40","v":2},{"$f":"'P. Privacy'!J40","v":0},{"$f":"'P. Privacy'!X40","v":0},{"$f":"'P. Privacy'!B40","v":"P.6.1"},{"$f":"'P. Privacy'!C40","v":"Are identified privacy risks and associated mitigation plans formally documented and reviewed by management?"},{"$f":"'P. Privacy'!D40","v":"Yes"},{"$f":"'P. Privacy'!E40","v":"Cloudamize Security Policy - Cloudamize Privacy Policy"},{"$f":"'P. Privacy'!F40","v":"P.3 Privacy Organization and Program Maintenance"},{"$f":"'P. Privacy'!G40","v":"15.1.1.l"},{"$f":"'P. Privacy'!H40","v":"Information security policy for supplier relationships"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A41","v":3227},{"$f":"'P. Privacy'!I41","v":2},{"$f":"'P. Privacy'!J41","v":0},{"$f":"'P. Privacy'!X41","v":0},{"$f":"'P. Privacy'!B41","v":"P.6.2"},{"$f":"'P. Privacy'!C41","v":"Are reasonable resources (in time and money) allocated to mitigating identified privacy risks?"},{"$f":"'P. Privacy'!D41","v":"Yes"},{"$f":"'P. Privacy'!E41","v":"Cloudamize Security Policy - Cloudamize Privacy Policy"},{"$f":"'P. Privacy'!F41","v":0},{"$f":"'P. Privacy'!G41","v":"NA"},{"$f":"'P. Privacy'!H41","v":0},null,null,"N/A"]
[{"$f":"'P. Privacy'!A42","v":3723},{"$f":"'P. Privacy'!I42","v":1},{"$f":"'P. Privacy'!J42","v":0},{"$f":"'P. Privacy'!X42","v":1},{"$f":"'P. Privacy'!B42","v":"P.7"},{"$f":"'P. Privacy'!C42","v":"Is there a data classification retention program that identifies the data types that require additional management and governance?"},{"$f":"'P. Privacy'!D42","v":"Yes"},{"$f":"'P. Privacy'!E42","v":0},{"$f":"'P. Privacy'!F42","v":"P.1 Target Privacy Data Inventory and Flows"},{"$f":"'P. Privacy'!G42","v":8.1999999999999993},{"$f":"'P. Privacy'!H42","v":"Information Classification"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A43","v":3724},{"$f":"'P. Privacy'!I43","v":2},{"$f":"'P. Privacy'!J43","v":0},{"$f":"'P. Privacy'!X43","v":1},{"$f":"'P. Privacy'!B43","v":"P.7.1"},{"$f":"'P. Privacy'!C43","v":"Are there documented policies, procedures, and controls to limit access based on need to know or minimum necessary for constituents? If yes, describe."},{"$f":"'P. Privacy'!D43","v":"Yes"},{"$f":"'P. Privacy'!E43","v":"Cloudamize Security Policy - Cloudamize Personnel Policy"},{"$f":"'P. Privacy'!F43","v":"P.6 Management of Client Target Privacy Data"},{"$f":"'P. Privacy'!G43","v":"9.1.1.b"},{"$f":"'P. Privacy'!H43","v":"Access control policy"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A44","v":3235},{"$f":"'P. Privacy'!I44","v":1},{"$f":"'P. Privacy'!J44","v":0},{"$f":"'P. Privacy'!X44","v":0},{"$f":"'P. Privacy'!B44","v":"P.8"},{"$f":"'P. Privacy'!C44","v":"Is personal information collected directly from individuals? If yes, describe."},{"$f":"'P. Privacy'!D44","v":"No"},{"$f":"'P. Privacy'!E44","v":0},{"$f":"'P. Privacy'!F44","v":"P.6 Management of Client Target Privacy Data"},{"$f":"'P. Privacy'!G44","v":"NA"},{"$f":"'P. Privacy'!H44","v":0},null,null,"N/A"]
[{"$f":"'P. Privacy'!A45","v":3236},{"$f":"'P. Privacy'!I45","v":1},{"$f":"'P. Privacy'!J45","v":0},{"$f":"'P. Privacy'!X45","v":0},{"$f":"'P. Privacy'!B45","v":"P.9"},{"$f":"'P. Privacy'!C45","v":"Are controls in place to ensure that the collection of personal information is limited?"},{"$f":"'P. Privacy'!D45","v":"N/A"},{"$f":"'P. Privacy'!E46","v":"Cloudamize does not collect personal informaiton"},{"$f":"'P. Privacy'!F45","v":"P.6 Management of Client Target Privacy Data"},{"$f":"'P. Privacy'!G45","v":"8.2.3"},{"$f":"'P. Privacy'!H45","v":"Handling of assets"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A46","v":3237},{"$f":"'P. Privacy'!I46","v":1},{"$f":"'P. Privacy'!J46","v":0},{"$f":"'P. Privacy'!X46","v":0},{"$f":"'P. Privacy'!B46","v":"P.10"},{"$f":"'P. Privacy'!C46","v":"Are controls in place to ensure that the collection and usage of personal information is limited and in compliance with applicable law?"},{"$f":"'P. Privacy'!D46","v":"N/A"},{"$f":"'P. Privacy'!#REF!","v":{"$error":"#REF!"}},{"$f":"'P. Privacy'!F46","v":"P.6 Management of Client Target Privacy Data"},{"$f":"'P. Privacy'!G46","v":"8.2.3"},{"$f":"'P. Privacy'!H46","v":"Handling of assets"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A47","v":3860},{"$f":"'P. Privacy'!I47","v":2},{"$f":"'P. Privacy'!J47","v":0},{"$f":"'P. Privacy'!X47","v":0},{"$f":"'P. Privacy'!B47","v":"P.10.1"},{"$f":"'P. Privacy'!C47","v":"Are there enforcement mechanisms in place to address complaints, disputes, and recourse for violations of privacy compliance?"},{"$f":"'P. Privacy'!D47","v":0},{"$f":"'P. Privacy'!E47","v":0},{"$f":"'P. Privacy'!F47","v":"P.6 Management of Client Target Privacy Data"},{"$f":"'P. Privacy'!G47","v":"NA"},{"$f":"'P. Privacy'!H47","v":0},null,null,"N/A"]
[{"$f":"'P. Privacy'!A48","v":3729},{"$f":"'P. Privacy'!I48","v":1},{"$f":"'P. Privacy'!J48","v":0},{"$f":"'P. Privacy'!X48","v":1},{"$f":"'P. Privacy'!B48","v":"P.11"},{"$f":"'P. Privacy'!C48","v":" Are transactions for covered accounts accessed, modified, or processed, including address changes and discrepancies? If yes, describe."},{"$f":"'P. Privacy'!D48","v":"No"},{"$f":"'P. Privacy'!E48","v":0},{"$f":"'P. Privacy'!F48","v":0},{"$f":"'P. Privacy'!G48","v":"NA"},{"$f":"'P. Privacy'!H48","v":0},null,null,"N/A"]
[{"$f":"'P. Privacy'!A49","v":3730},{"$f":"'P. Privacy'!I49","v":2},{"$f":"'P. Privacy'!J49","v":0},{"$f":"'P. Privacy'!X49","v":0},{"$f":"'P. Privacy'!B49","v":"P.11.1"},{"$f":"'P. Privacy'!C49","v":"Is there a documented identify theft prevention program approved by management in place to detect, prevent, and mitigate identify theft?"},{"$f":"'P. Privacy'!D49","v":0},{"$f":"'P. Privacy'!E49","v":0},{"$f":"'P. Privacy'!F49","v":0},{"$f":"'P. Privacy'!G49","v":"NA"},{"$f":"'P. Privacy'!H49","v":0},null,null,"N/A"]
[{"$f":"'P. Privacy'!A50","v":3731},{"$f":"'P. Privacy'!I50","v":2},{"$f":"'P. Privacy'!J50","v":0},{"$f":"'P. Privacy'!X50","v":0},{"$f":"'P. Privacy'!B50","v":"P.11.2"},{"$f":"'P. Privacy'!C50","v":"Are there documented policies and procedures for identifying and responding to relevant red flags on covered accounts, including address changes and discrepancies?"},{"$f":"'P. Privacy'!D50","v":0},{"$f":"'P. Privacy'!E50","v":0},{"$f":"'P. Privacy'!F50","v":0},{"$f":"'P. Privacy'!G50","v":"NA"},{"$f":"'P. Privacy'!H50","v":0},null,null,"N/A"]
[{"$f":"'P. Privacy'!A51","v":3861},{"$f":"'P. Privacy'!I51","v":2},{"$f":"'P. Privacy'!J51","v":0},{"$f":"'P. Privacy'!X51","v":0},{"$f":"'P. Privacy'!B51","v":"P.11.3"},{"$f":"'P. Privacy'!C51","v":"Is customer data transmitted, processed, or stored that can be classified as consumer report information provided by a consumer reporting agency?"},{"$f":"'P. Privacy'!D51","v":0},{"$f":"'P. Privacy'!E51","v":0},{"$f":"'P. Privacy'!F51","v":0},{"$f":"'P. Privacy'!G51","v":8.1999999999999993},{"$f":"'P. Privacy'!H51","v":"Information Classification"},null,null,"N/A"]
[{"$f":"'P. Privacy'!A52","v":3862},{"$f":"'P. Privacy'!I52","v":1},{"$f":"'P. Privacy'!J52","v":0},{"$f":"'P. Privacy'!X52","v":0},{"$f":"'P. Privacy'!B52","v":"P.12"},{"$f":"'P. Privacy'!C52","v":"Is there a compliance risk management system that addresses the quality and accuracy of reported consumer data?"},{"$f":"'P. Privacy'!D52","v":"No"},{"$f":"'P. Privacy'!E52","v":"Cloudamize does not collect or store reported consumer data"},{"$f":"'P. Privacy'!F52","v":0},{"$f":"'P. Privacy'!G52","v":"NA"},{"$f":"'P. Privacy'!H52","v":0},null,null,"N/A"]
[{"$f":"'P. Privacy'!A53","v":3863},{"$f":"'P. Privacy'!I53","v":2},{"$f":"'P. Privacy'!J53","v":0},{"$f":"'P. Privacy'!X53","v":0},{"$f":"'P. Privacy'!B53","v":"P.12.1"},{"$f":"'P. Privacy'!C53","v":"Is there a compliance risk management system that addresses the quality of assembling and maintaining the data?"},{"$f":"'P. Privacy'!D53","v":0},{"$f":"'P. Privacy'!E53","v":0},{"$f":"'P. Privacy'!F53","v":0},{"$f":"'P. Privacy'!G53","v":"NA"},{"$f":"'P. Privacy'!H53","v":0},null,null,"N/A"]
[{"$f":"'P. Privacy'!A54","v":3864},{"$f":"'P. Privacy'!I54","v":2},{"$f":"'P. Privacy'!J54","v":0},{"$f":"'P. Privacy'!X54","v":0},{"$f":"'P. Privacy'!B54","v":"P.12.2"},{"$f":"'P. Privacy'!C54","v":"Is there a mechanism in place for resolving consumer disputes?"},{"$f":"'P. Privacy'!D54","v":0},{"$f":"'P. Privacy'!E54","v":0},{"$f":"'P. Privacy'!F54","v":0},{"$f":"'P. Privacy'!G54","v":"NA"},{"$f":"'P. Privacy'!H54","v":0},null,null,"N/A"]
[{"$f":"'P. Privacy'!A55","v":0},{"$f":"'P. Privacy'!I55","v":0},{"$f":"'P. Privacy'!J55","v":0},{"$f":"'P. Privacy'!X55","v":0},{"$f":"'P. Privacy'!B55","v":0},{"$f":"'P. Privacy'!C55","v":0},{"$f":"'P. Privacy'!D55","v":0},{"$f":"'P. Privacy'!E55","v":0},{"$f":"'P. Privacy'!F55","v":0},{"$f":"'P. Privacy'!G55","v":0},{"$f":"'P. Privacy'!H55","v":0}]
[]
[{"$f":"'Q. Software Security'!B1","v":"Q. Software Application Security"},null,null,null,{"$f":"'Q. Software Security'!B1","v":"Q. Software Application Security"}]
[{"$f":"'Q. Software Security'!A5","v":3919},{"$f":"'Q. Software Security'!I5","v":1},{"$f":"'Q. Software Security'!J5","v":0},{"$f":"'Q. Software Security'!X5","v":1},{"$f":"'Q. Software Security'!B5","v":"Q.1"},{"$f":"'Q. Software Security'!C5","v":"Is Software provided? "},{"$f":"'Q. Software Security'!D5","v":"Yes"},{"$f":"'Q. Software Security'!E5","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F5","v":"Q. Software Application Security"},{"$f":"'Q. Software Security'!G5","v":0},{"$f":"'Q. Software Security'!H5","v":0},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A6","v":3920},{"$f":"'Q. Software Security'!I6","v":2},{"$f":"'Q. Software Security'!J6","v":0},{"$f":"'Q. Software Security'!X6","v":1},{"$f":"'Q. Software Security'!B6","v":"Q.1.1"},{"$f":"'Q. Software Security'!C6","v":"Is there a secure software development lifecycle policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy? "},{"$f":"'Q. Software Security'!D6","v":"Yes"},{"$f":"'Q. Software Security'!E6","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F6","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!G6","v":"14.2.1 "},{"$f":"'Q. Software Security'!H6","v":"Secure development policy"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A7","v":3921},{"$f":"'Q. Software Security'!I7","v":3},{"$f":"'Q. Software Security'!J7","v":0},{"$f":"'Q. Software Security'!X7","v":0},{"$f":"'Q. Software Security'!B7","v":"Q.1.1.1"},{"$f":"'Q. Software Security'!C7","v":"Has the policy been reviewed in the last 12 months? If yes, did it include:"},{"$f":"'Q. Software Security'!D7","v":"Yes"},{"$f":"'Q. Software Security'!E7","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F7","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!G7","v":"5.1.2"},{"$f":"'Q. Software Security'!H7","v":"Review of policies for information security"},null,null,"12.1.1"]
[{"$f":"'Q. Software Security'!A8","v":3922},{"$f":"'Q. Software Security'!I8","v":4},{"$f":"'Q. Software Security'!J8","v":0},{"$f":"'Q. Software Security'!X8","v":0},{"$f":"'Q. Software Security'!B8","v":"Q.1.1.1.1"},{"$f":"'Q. Software Security'!C8","v":"Feedback from interested parties?"},{"$f":"'Q. Software Security'!D8","v":"Yes"},{"$f":"'Q. Software Security'!E8","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F8","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!G8","v":"5.1.2"},{"$f":"'Q. Software Security'!H8","v":"Review of policies for information security"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A9","v":3923},{"$f":"'Q. Software Security'!I9","v":4},{"$f":"'Q. Software Security'!J9","v":0},{"$f":"'Q. Software Security'!X9","v":0},{"$f":"'Q. Software Security'!B9","v":"Q.1.1.1.2"},{"$f":"'Q. Software Security'!C9","v":"Results of independent reviews?"},{"$f":"'Q. Software Security'!D9","v":"Yes"},{"$f":"'Q. Software Security'!E9","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F9","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!G9","v":"5.1.2"},{"$f":"'Q. Software Security'!H9","v":"Review of policies for information security"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A10","v":3924},{"$f":"'Q. Software Security'!I10","v":4},{"$f":"'Q. Software Security'!J10","v":0},{"$f":"'Q. Software Security'!X10","v":0},{"$f":"'Q. Software Security'!B10","v":"Q.1.1.1.3"},{"$f":"'Q. Software Security'!C10","v":"Policy compliance?"},{"$f":"'Q. Software Security'!D10","v":"Yes"},{"$f":"'Q. Software Security'!E10","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F10","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!G10","v":"5.1.2"},{"$f":"'Q. Software Security'!H10","v":"Review of policies for information security"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A11","v":3925},{"$f":"'Q. Software Security'!I11","v":4},{"$f":"'Q. Software Security'!J11","v":0},{"$f":"'Q. Software Security'!X11","v":0},{"$f":"'Q. Software Security'!B11","v":"Q.1.1.1.4"},{"$f":"'Q. Software Security'!C11","v":"Changes that could affect the approach to managing information security?"},{"$f":"'Q. Software Security'!D11","v":"Yes"},{"$f":"'Q. Software Security'!E11","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F11","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!G11","v":"5.1.2"},{"$f":"'Q. Software Security'!H11","v":"Review of policies for information security"},null,null,6.4]
[{"$f":"'Q. Software Security'!A12","v":3926},{"$f":"'Q. Software Security'!I12","v":4},{"$f":"'Q. Software Security'!J12","v":0},{"$f":"'Q. Software Security'!X12","v":0},{"$f":"'Q. Software Security'!B12","v":"Q.1.1.1.5"},{"$f":"'Q. Software Security'!C12","v":"Reported information security incidents?"},{"$f":"'Q. Software Security'!D12","v":"Yes"},{"$f":"'Q. Software Security'!E12","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F12","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!G12","v":"5.1.2"},{"$f":"'Q. Software Security'!H12","v":"Review of policies for information security"},null,null,"12.10.1"]
[{"$f":"'Q. Software Security'!A13","v":3927},{"$f":"'Q. Software Security'!I13","v":4},{"$f":"'Q. Software Security'!J13","v":0},{"$f":"'Q. Software Security'!X13","v":0},{"$f":"'Q. Software Security'!B13","v":"Q.1.1.1.6"},{"$f":"'Q. Software Security'!C13","v":"Recommendations provided by relevant authorities?"},{"$f":"'Q. Software Security'!D13","v":"Yes"},{"$f":"'Q. Software Security'!E13","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F13","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!G13","v":"5.1.2"},{"$f":"'Q. Software Security'!H13","v":"Review of policies for information security"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A14","v":3928},{"$f":"'Q. Software Security'!I14","v":4},{"$f":"'Q. Software Security'!J14","v":0},{"$f":"'Q. Software Security'!X14","v":0},{"$f":"'Q. Software Security'!B14","v":"Q.1.1.1.7"},{"$f":"'Q. Software Security'!C14","v":"Records management?"},{"$f":"'Q. Software Security'!D14","v":"Yes"},{"$f":"'Q. Software Security'!E14","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F14","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!G14","v":"5.1.2"},{"$f":"'Q. Software Security'!H14","v":"Review of policies for information security"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A15","v":3929},{"$f":"'Q. Software Security'!I15","v":3},{"$f":"'Q. Software Security'!J15","v":0},{"$f":"'Q. Software Security'!X15","v":0},{"$f":"'Q. Software Security'!B15","v":"Q.1.1.2"},{"$f":"'Q. Software Security'!C15","v":"Is there a process to approve exceptions to the policy? "},{"$f":"'Q. Software Security'!D15","v":"Yes"},{"$f":"'Q. Software Security'!E15","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F15","v":0},{"$f":"'Q. Software Security'!G15","v":"5.1.2"},{"$f":"'Q. Software Security'!H15","v":"Review of policies for information security"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A16","v":3930},{"$f":"'Q. Software Security'!I16","v":4},{"$f":"'Q. Software Security'!J16","v":0},{"$f":"'Q. Software Security'!X16","v":0},{"$f":"'Q. Software Security'!B16","v":"Q.1.1.2.1"},{"$f":"'Q. Software Security'!C16","v":"Does security own the approval process?"},{"$f":"'Q. Software Security'!D16","v":"Yes"},{"$f":"'Q. Software Security'!E16","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F16","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!G16","v":"5.1.2"},{"$f":"'Q. Software Security'!H16","v":"Review of policies for information security"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A17","v":3931},{"$f":"'Q. Software Security'!I17","v":3},{"$f":"'Q. Software Security'!J17","v":0},{"$f":"'Q. Software Security'!X17","v":0},{"$f":"'Q. Software Security'!B17","v":"Q.1.1.3"},{"$f":"'Q. Software Security'!C17","v":"Is the SDLC policy communicated? If yes, to:"},{"$f":"'Q. Software Security'!D17","v":"Yes"},{"$f":"'Q. Software Security'!E17","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F17","v":0},{"$f":"'Q. Software Security'!G17","v":"NA"},{"$f":"'Q. Software Security'!H17","v":0},null,null,6.3]
[{"$f":"'Q. Software Security'!A18","v":3932},{"$f":"'Q. Software Security'!I18","v":4},{"$f":"'Q. Software Security'!J18","v":0},{"$f":"'Q. Software Security'!X18","v":0},{"$f":"'Q. Software Security'!B18","v":"Q.1.1.3.1"},{"$f":"'Q. Software Security'!C18","v":"Full time constituents?"},{"$f":"'Q. Software Security'!D18","v":"Yes"},{"$f":"'Q. Software Security'!E18","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F18","v":0},{"$f":"'Q. Software Security'!G18","v":"NA"},{"$f":"'Q. Software Security'!H18","v":0},null,null,6.7]
[{"$f":"'Q. Software Security'!A19","v":3933},{"$f":"'Q. Software Security'!I19","v":4},{"$f":"'Q. Software Security'!J19","v":0},{"$f":"'Q. Software Security'!X19","v":0},{"$f":"'Q. Software Security'!B19","v":"Q.1.1.3.2"},{"$f":"'Q. Software Security'!C19","v":"Part time constituents?"},{"$f":"'Q. Software Security'!D19","v":"Yes"},{"$f":"'Q. Software Security'!E19","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F19","v":0},{"$f":"'Q. Software Security'!G19","v":"NA"},{"$f":"'Q. Software Security'!H19","v":0},null,null,6.7]
[{"$f":"'Q. Software Security'!A20","v":3934},{"$f":"'Q. Software Security'!I20","v":4},{"$f":"'Q. Software Security'!J20","v":0},{"$f":"'Q. Software Security'!X20","v":0},{"$f":"'Q. Software Security'!B20","v":"Q.1.1.3.3"},{"$f":"'Q. Software Security'!C20","v":"Contractors?"},{"$f":"'Q. Software Security'!D20","v":"Yes"},{"$f":"'Q. Software Security'!E20","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F20","v":0},{"$f":"'Q. Software Security'!G20","v":"NA"},{"$f":"'Q. Software Security'!H20","v":0},null,null,6.7]
[{"$f":"'Q. Software Security'!A21","v":3935},{"$f":"'Q. Software Security'!I21","v":4},{"$f":"'Q. Software Security'!J21","v":0},{"$f":"'Q. Software Security'!X21","v":0},{"$f":"'Q. Software Security'!B21","v":"Q.1.1.3.4"},{"$f":"'Q. Software Security'!C21","v":"Temporary workers?"},{"$f":"'Q. Software Security'!D21","v":"Yes"},{"$f":"'Q. Software Security'!E21","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F21","v":0},{"$f":"'Q. Software Security'!G21","v":"NA"},{"$f":"'Q. Software Security'!H21","v":0},null,null,6.7]
[{"$f":"'Q. Software Security'!A22","v":3936},{"$f":"'Q. Software Security'!I22","v":2},{"$f":"'Q. Software Security'!J22","v":0},{"$f":"'Q. Software Security'!X22","v":0},{"$f":"'Q. Software Security'!B22","v":"Q.1.2"},{"$f":"'Q. Software Security'!C22","v":"Is a secure code review performed? If yes, what is the frequency:"},{"$f":"'Q. Software Security'!D22","v":"Yes"},{"$f":"'Q. Software Security'!E22","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F22","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!G22","v":"14.2.1 "},{"$f":"'Q. Software Security'!H22","v":"Secure development policy"},null,null,"6.3.2"]
[{"$f":"'Q. Software Security'!A23","v":3937},{"$f":"'Q. Software Security'!I23","v":3},{"$f":"'Q. Software Security'!J23","v":0},{"$f":"'Q. Software Security'!X23","v":0},{"$f":"'Q. Software Security'!B23","v":"Q.1.2.1"},{"$f":"'Q. Software Security'!C23","v":"As developed?"},{"$f":"'Q. Software Security'!D23","v":"Yes"},{"$f":"'Q. Software Security'!E23","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F23","v":0},{"$f":"'Q. Software Security'!G23","v":"NA"},{"$f":"'Q. Software Security'!H23","v":0},null,null,"6.3.2"]
[{"$f":"'Q. Software Security'!A24","v":3938},{"$f":"'Q. Software Security'!I24","v":3},{"$f":"'Q. Software Security'!J24","v":0},{"$f":"'Q. Software Security'!X24","v":0},{"$f":"'Q. Software Security'!B24","v":"Q.1.2.2"},{"$f":"'Q. Software Security'!C24","v":"Monthly?"},{"$f":"'Q. Software Security'!D24","v":"Yes"},{"$f":"'Q. Software Security'!E24","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F24","v":0},{"$f":"'Q. Software Security'!G24","v":"NA"},{"$f":"'Q. Software Security'!H24","v":0},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A25","v":3939},{"$f":"'Q. Software Security'!I25","v":3},{"$f":"'Q. Software Security'!J25","v":0},{"$f":"'Q. Software Security'!X25","v":0},{"$f":"'Q. Software Security'!B25","v":"Q.1.2.3"},{"$f":"'Q. Software Security'!C25","v":"Quarterly?"},{"$f":"'Q. Software Security'!D25","v":"Yes"},{"$f":"'Q. Software Security'!E25","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F25","v":0},{"$f":"'Q. Software Security'!G25","v":"NA"},{"$f":"'Q. Software Security'!H25","v":0},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A26","v":3940},{"$f":"'Q. Software Security'!I26","v":3},{"$f":"'Q. Software Security'!J26","v":0},{"$f":"'Q. Software Security'!X26","v":0},{"$f":"'Q. Software Security'!B26","v":"Q.1.2.4"},{"$f":"'Q. Software Security'!C26","v":"Annually?"},{"$f":"'Q. Software Security'!D26","v":"Yes"},{"$f":"'Q. Software Security'!E26","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F26","v":0},{"$f":"'Q. Software Security'!G26","v":"NA"},{"$f":"'Q. Software Security'!H26","v":0},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A27","v":3941},{"$f":"'Q. Software Security'!I27","v":3},{"$f":"'Q. Software Security'!J27","v":0},{"$f":"'Q. Software Security'!X27","v":0},{"$f":"'Q. Software Security'!B27","v":"Q.1.2.5"},{"$f":"'Q. Software Security'!C27","v":"Other?"},{"$f":"'Q. Software Security'!D27","v":"Yes"},{"$f":"'Q. Software Security'!E27","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F27","v":0},{"$f":"'Q. Software Security'!G27","v":"NA"},{"$f":"'Q. Software Security'!H27","v":0},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A28","v":3942},{"$f":"'Q. Software Security'!I28","v":3},{"$f":"'Q. Software Security'!J28","v":0},{"$f":"'Q. Software Security'!X28","v":0},{"$f":"'Q. Software Security'!B28","v":"Q.1.2.6"},{"$f":"'Q. Software Security'!C28","v":"Does the secure code review include a third party review?"},{"$f":"'Q. Software Security'!D28","v":"No"},{"$f":"'Q. Software Security'!E28","v":0},{"$f":"'Q. Software Security'!F28","v":0},{"$f":"'Q. Software Security'!G28","v":"NA"},{"$f":"'Q. Software Security'!H28","v":0},null,null,"6.3.2"]
[{"$f":"'Q. Software Security'!A29","v":3943},{"$f":"'Q. Software Security'!I29","v":2},{"$f":"'Q. Software Security'!J29","v":0},{"$f":"'Q. Software Security'!X29","v":0},{"$f":"'Q. Software Security'!B29","v":"Q.1.3"},{"$f":"'Q. Software Security'!C29","v":"Are applications given ratings that reflect the types of data accessed (e.g., high, medium low)?"},{"$f":"'Q. Software Security'!D29","v":"No"},{"$f":"'Q. Software Security'!E29","v":0},{"$f":"'Q. Software Security'!F29","v":"Q. 3 Risk Classification"},{"$f":"'Q. Software Security'!G29","v":"14.1.1 "},{"$f":"'Q. Software Security'!H29","v":"Information security requirements analysis and specification"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A30","v":3944},{"$f":"'Q. Software Security'!I30","v":2},{"$f":"'Q. Software Security'!J30","v":0},{"$f":"'Q. Software Security'!X30","v":0},{"$f":"'Q. Software Security'!B30","v":"Q.1.4"},{"$f":"'Q. Software Security'!C30","v":"Are the risks from internal and external sources clearly understood based on risk exposure?"},{"$f":"'Q. Software Security'!D30","v":"Yes"},{"$f":"'Q. Software Security'!E30","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F30","v":"Q. 3 Risk Classification"},{"$f":"'Q. Software Security'!G30","v":"14.1.1 "},{"$f":"'Q. Software Security'!H30","v":"Information security requirements analysis and specification"},null,null,12.2]
[{"$f":"'Q. Software Security'!A31","v":3945},{"$f":"'Q. Software Security'!I31","v":2},{"$f":"'Q. Software Security'!J31","v":0},{"$f":"'Q. Software Security'!X31","v":0},{"$f":"'Q. Software Security'!B31","v":"Q.1.5"},{"$f":"'Q. Software Security'!C31","v":"Is there a Software Security Group responsible for application security?"},{"$f":"'Q. Software Security'!D31","v":"Yes"},{"$f":"'Q. Software Security'!E31","v":"Cloudamize Security Policy - Cloudamize Security Work Group"},{"$f":"'Q. Software Security'!F31","v":0},{"$f":"'Q. Software Security'!G31","v":"14.2.8"},{"$f":"'Q. Software Security'!H31","v":"Software testing"},null,null,12.5]
[{"$f":"'Q. Software Security'!A32","v":3946},{"$f":"'Q. Software Security'!I32","v":2},{"$f":"'Q. Software Security'!J32","v":0},{"$f":"'Q. Software Security'!X32","v":0},{"$f":"'Q. Software Security'!B32","v":"Q.1.6"},{"$f":"'Q. Software Security'!C32","v":"Is a security architecture risk analysis performed when new platforms are designed? If yes, does it include:"},{"$f":"'Q. Software Security'!D32","v":"Yes"},{"$f":"'Q. Software Security'!E32","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F32","v":"Q.4 Secure Architectual Design Standards"},{"$f":"'Q. Software Security'!G32","v":"14.1.1 "},{"$f":"'Q. Software Security'!H32","v":"Information security requirements analysis and specification"},null,null,6.1]
[{"$f":"'Q. Software Security'!A33","v":3947},{"$f":"'Q. Software Security'!I33","v":3},{"$f":"'Q. Software Security'!J33","v":0},{"$f":"'Q. Software Security'!X33","v":0},{"$f":"'Q. Software Security'!B33","v":"Q.1.6.1"},{"$f":"'Q. Software Security'!C33","v":"Security feature review i.e., authentication, access controls, use of cryptography, etc.?"},{"$f":"'Q. Software Security'!D33","v":"Yes"},{"$f":"'Q. Software Security'!E33","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F33","v":"Q.4 Secure Architectual Design Standards"},{"$f":"'Q. Software Security'!G33","v":"14.1.1 "},{"$f":"'Q. Software Security'!H33","v":"Information security requirements analysis and specification"},null,null,6.1]
[{"$f":"'Q. Software Security'!A34","v":3948},{"$f":"'Q. Software Security'!I34","v":3},{"$f":"'Q. Software Security'!J34","v":0},{"$f":"'Q. Software Security'!X34","v":0},{"$f":"'Q. Software Security'!B34","v":"Q.1.6.2"},{"$f":"'Q. Software Security'!C34","v":"Security architecture design review for high risk applications?"},{"$f":"'Q. Software Security'!D34","v":"Yes"},{"$f":"'Q. Software Security'!E34","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F34","v":"Q.4 Secure Architectual Design Standards"},{"$f":"'Q. Software Security'!G34","v":"14.1.1 "},{"$f":"'Q. Software Security'!H34","v":"Information security requirements analysis and specification"},null,null,6.3]
[{"$f":"'Q. Software Security'!A35","v":3949},{"$f":"'Q. Software Security'!I35","v":3},{"$f":"'Q. Software Security'!J35","v":0},{"$f":"'Q. Software Security'!X35","v":0},{"$f":"'Q. Software Security'!B35","v":"Q.1.6.3"},{"$f":"'Q. Software Security'!C35","v":"Threat modeling into the business requirements/design process of the SDLC?"},{"$f":"'Q. Software Security'!D35","v":"Yes"},{"$f":"'Q. Software Security'!E35","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F35","v":"Q.4 Secure Architectual Design Standards"},{"$f":"'Q. Software Security'!G35","v":"14.2.9"},{"$f":"'Q. Software Security'!H35","v":"System acceptance testing"},null,null,6.1]
[{"$f":"'Q. Software Security'!A36","v":3950},{"$f":"'Q. Software Security'!I36","v":3},{"$f":"'Q. Software Security'!J36","v":0},{"$f":"'Q. Software Security'!X36","v":0},{"$f":"'Q. Software Security'!B36","v":"Q.1.6.4"},{"$f":"'Q. Software Security'!C36","v":"Review when major changes are introduced into applications?"},{"$f":"'Q. Software Security'!D36","v":"Yes"},{"$f":"'Q. Software Security'!E36","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F36","v":0},{"$f":"'Q. Software Security'!G36","v":"14.2.2"},{"$f":"'Q. Software Security'!H36","v":"System change control procedures"},null,null,6.4]
[{"$f":"'Q. Software Security'!A37","v":3951},{"$f":"'Q. Software Security'!I37","v":2},{"$f":"'Q. Software Security'!J37","v":0},{"$f":"'Q. Software Security'!X37","v":0},{"$f":"'Q. Software Security'!B37","v":"Q.1.7"},{"$f":"'Q. Software Security'!C37","v":"Is there a secure application development life cycle process? If yes, does it include:"},{"$f":"'Q. Software Security'!D37","v":"Yes"},{"$f":"'Q. Software Security'!E37","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F37","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!G37","v":"14.2.1"},{"$f":"'Q. Software Security'!H37","v":"Secure development policy"},null,null,6.3]
[{"$f":"'Q. Software Security'!A38","v":3952},{"$f":"'Q. Software Security'!I38","v":3},{"$f":"'Q. Software Security'!J38","v":0},{"$f":"'Q. Software Security'!X38","v":0},{"$f":"'Q. Software Security'!B38","v":"Q.1.7.1"},{"$f":"'Q. Software Security'!C38","v":"Common vulnerabilities/bugs that need to be eliminated?"},{"$f":"'Q. Software Security'!D38","v":"Yes"},{"$f":"'Q. Software Security'!E38","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F38","v":0},{"$f":"'Q. Software Security'!G38","v":"14.2.1"},{"$f":"'Q. Software Security'!H38","v":"Secure development policy"},null,null,"6.1, 6.5"]
[{"$f":"'Q. Software Security'!A39","v":3953},{"$f":"'Q. Software Security'!I39","v":3},{"$f":"'Q. Software Security'!J39","v":0},{"$f":"'Q. Software Security'!X39","v":0},{"$f":"'Q. Software Security'!B39","v":"Q.1.7.2"},{"$f":"'Q. Software Security'!C39","v":"Secure code reviews against the entire code base in the development phase?"},{"$f":"'Q. Software Security'!D39","v":"Yes"},{"$f":"'Q. Software Security'!E39","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F39","v":"Q.5 Secure Code Review"},{"$f":"'Q. Software Security'!G39","v":14.2},{"$f":"'Q. Software Security'!H39","v":"Security in develoment and support processes"},null,null,"6.3.2"]
[{"$f":"'Q. Software Security'!A40","v":3954},{"$f":"'Q. Software Security'!I40","v":3},{"$f":"'Q. Software Security'!J40","v":0},{"$f":"'Q. Software Security'!X40","v":0},{"$f":"'Q. Software Security'!B40","v":"Q.1.7.3"},{"$f":"'Q. Software Security'!C40","v":"Review by qualified individual?"},{"$f":"'Q. Software Security'!D40","v":"Yes"},{"$f":"'Q. Software Security'!E40","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F40","v":"Q.5 Secure Code Review"},{"$f":"'Q. Software Security'!G40","v":"14.2.1.g"},{"$f":"'Q. Software Security'!H40","v":"Secure development policy"},null,null,"6.3.2"]
[{"$f":"'Q. Software Security'!A41","v":3955},{"$f":"'Q. Software Security'!I41","v":3},{"$f":"'Q. Software Security'!J41","v":0},{"$f":"'Q. Software Security'!X41","v":0},{"$f":"'Q. Software Security'!B41","v":"Q.1.7.4"},{"$f":"'Q. Software Security'!C41","v":"Use of automated code review tools?"},{"$f":"'Q. Software Security'!D41","v":"Yes"},{"$f":"'Q. Software Security'!E41","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F41","v":"Q.5 Secure Code Review"},{"$f":"'Q. Software Security'!G41","v":"14.2.9"},{"$f":"'Q. Software Security'!H41","v":"System acceptance testing"},null,null,"6.3.2"]
[{"$f":"'Q. Software Security'!A42","v":3956},{"$f":"'Q. Software Security'!I42","v":3},{"$f":"'Q. Software Security'!J42","v":0},{"$f":"'Q. Software Security'!X42","v":0},{"$f":"'Q. Software Security'!B42","v":"Q.1.7.5"},{"$f":"'Q. Software Security'!C42","v":"Remediation of findings?"},{"$f":"'Q. Software Security'!D42","v":"Yes"},{"$f":"'Q. Software Security'!E42","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F42","v":"Q.5 Secure Code Review"},{"$f":"'Q. Software Security'!G42","v":"14.2.9"},{"$f":"'Q. Software Security'!H42","v":"System acceptance testing"},null,null,"6.3.2"]
[{"$f":"'Q. Software Security'!A43","v":3957},{"$f":"'Q. Software Security'!I43","v":3},{"$f":"'Q. Software Security'!J43","v":0},{"$f":"'Q. Software Security'!X43","v":0},{"$f":"'Q. Software Security'!B43","v":"Q.1.7.6"},{"$f":"'Q. Software Security'!C43","v":"Formal software security training for developers?"},{"$f":"'Q. Software Security'!D43","v":"Yes"},{"$f":"'Q. Software Security'!E43","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F43","v":0},{"$f":"'Q. Software Security'!G43","v":"7.2.2"},{"$f":"'Q. Software Security'!H43","v":" Information security awareness, education and training"},null,null,6.5]
[{"$f":"'Q. Software Security'!A44","v":3958},{"$f":"'Q. Software Security'!I44","v":3},{"$f":"'Q. Software Security'!J44","v":0},{"$f":"'Q. Software Security'!X44","v":0},{"$f":"'Q. Software Security'!B44","v":"Q.1.7.7"},{"$f":"'Q. Software Security'!C44","v":"Security experts that work with developers for every application?"},{"$f":"'Q. Software Security'!D44","v":"No"},{"$f":"'Q. Software Security'!E44","v":0},{"$f":"'Q. Software Security'!F44","v":0},{"$f":"'Q. Software Security'!G44","v":"14.2.5 "},{"$f":"'Q. Software Security'!H44","v":"Secure system engineering principles"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A45","v":3959},{"$f":"'Q. Software Security'!I45","v":3},{"$f":"'Q. Software Security'!J45","v":0},{"$f":"'Q. Software Security'!X45","v":0},{"$f":"'Q. Software Security'!B45","v":"Q.1.7.8"},{"$f":"'Q. Software Security'!C45","v":"Outsourcing development? If yes, describe:"},{"$f":"'Q. Software Security'!D45","v":"No"},{"$f":"'Q. Software Security'!E45","v":0},{"$f":"'Q. Software Security'!F45","v":0},{"$f":"'Q. Software Security'!G45","v":"14.2.7"},{"$f":"'Q. Software Security'!H45","v":"Outsourced development"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A46","v":3960},{"$f":"'Q. Software Security'!I46","v":3},{"$f":"'Q. Software Security'!J46","v":0},{"$f":"'Q. Software Security'!X46","v":0},{"$f":"'Q. Software Security'!B46","v":"Q.1.7.9"},{"$f":"'Q. Software Security'!C46","v":"All developers subject to the SDLC?"},{"$f":"'Q. Software Security'!D46","v":"Yes"},{"$f":"'Q. Software Security'!E46","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F46","v":0},{"$f":"'Q. Software Security'!G46","v":"14.2.7.b"},{"$f":"'Q. Software Security'!H46","v":"Outsourced development"},null,null,"6.3.b"]
[{"$f":"'Q. Software Security'!A47","v":3961},{"$f":"'Q. Software Security'!I47","v":3},{"$f":"'Q. Software Security'!J47","v":0},{"$f":"'Q. Software Security'!X47","v":0},{"$f":"'Q. Software Security'!B47","v":"Q.1.7.10"},{"$f":"'Q. Software Security'!C47","v":"Identification of security defects documented and communicated with development to prevent reoccurrence?"},{"$f":"'Q. Software Security'!D47","v":"Yes"},{"$f":"'Q. Software Security'!E47","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F47","v":"Q.5 Secure Code Review"},{"$f":"'Q. Software Security'!G47","v":"14.2.7.c"},{"$f":"'Q. Software Security'!H47","v":"Outsourced development"},null,null,"12.5.3"]
[{"$f":"'Q. Software Security'!A48","v":3962},{"$f":"'Q. Software Security'!I48","v":2},{"$f":"'Q. Software Security'!J48","v":0},{"$f":"'Q. Software Security'!X48","v":0},{"$f":"'Q. Software Security'!B48","v":"Q.1.8"},{"$f":"'Q. Software Security'!C48","v":"Is there a QA_UAT process? If yes does it include:"},{"$f":"'Q. Software Security'!D48","v":"Yes"},{"$f":"'Q. Software Security'!E48","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F48","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!G48","v":"NA"},{"$f":"'Q. Software Security'!H48","v":0},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A49","v":3963},{"$f":"'Q. Software Security'!I49","v":3},{"$f":"'Q. Software Security'!J49","v":0},{"$f":"'Q. Software Security'!X49","v":0},{"$f":"'Q. Software Security'!B49","v":"Q.1.8.1"},{"$f":"'Q. Software Security'!C49","v":"Edge/boundary value condition testing? "},{"$f":"'Q. Software Security'!D49","v":"Yes"},{"$f":"'Q. Software Security'!E49","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F49","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!G49","v":"NA"},{"$f":"'Q. Software Security'!H49","v":0},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A50","v":3964},{"$f":"'Q. Software Security'!I50","v":3},{"$f":"'Q. Software Security'!J50","v":0},{"$f":"'Q. Software Security'!X50","v":0},{"$f":"'Q. Software Security'!B50","v":"Q.1.8.2"},{"$f":"'Q. Software Security'!C50","v":"Testing procedures to determine whether security features are effective? If yes, are they:"},{"$f":"'Q. Software Security'!D50","v":"Yes"},{"$f":"'Q. Software Security'!E50","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F50","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!G50","v":"14.2.8"},{"$f":"'Q. Software Security'!H50","v":"System security testing"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A51","v":3965},{"$f":"'Q. Software Security'!I51","v":4},{"$f":"'Q. Software Security'!J51","v":0},{"$f":"'Q. Software Security'!X51","v":0},{"$f":"'Q. Software Security'!B51","v":"Q.1.8.2.1"},{"$f":"'Q. Software Security'!C51","v":"Derived by obtaining a list of security features by the architecture group?"},{"$f":"'Q. Software Security'!D51","v":"Yes"},{"$f":"'Q. Software Security'!E51","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F51","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!G51","v":"14.2.5"},{"$f":"'Q. Software Security'!H51","v":"Secure system engineering principles"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A52","v":3966},{"$f":"'Q. Software Security'!I52","v":3},{"$f":"'Q. Software Security'!J52","v":0},{"$f":"'Q. Software Security'!X52","v":0},{"$f":"'Q. Software Security'!B52","v":"Q.1.8.3"},{"$f":"'Q. Software Security'!C52","v":"Dynamic scanning against web based applications while in the Q/A phase? If no, is there a:"},{"$f":"'Q. Software Security'!D52","v":"Yes"},{"$f":"'Q. Software Security'!E52","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F52","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!G52","v":"14.2.9"},{"$f":"'Q. Software Security'!H52","v":"System acceptance testing"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A53","v":3967},{"$f":"'Q. Software Security'!I53","v":4},{"$f":"'Q. Software Security'!J53","v":0},{"$f":"'Q. Software Security'!X53","v":0},{"$f":"'Q. Software Security'!B53","v":"Q.1.8.3.1"},{"$f":"'Q. Software Security'!C53","v":"Form of black box testing or scripts specific to abuse cases that are used? "},{"$f":"'Q. Software Security'!D53","v":"Yes"},{"$f":"'Q. Software Security'!E53","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F53","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!G53","v":"NA"},{"$f":"'Q. Software Security'!H53","v":0},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A54","v":3968},{"$f":"'Q. Software Security'!I54","v":3},{"$f":"'Q. Software Security'!J54","v":0},{"$f":"'Q. Software Security'!X54","v":0},{"$f":"'Q. Software Security'!B54","v":"Q.1.8.4"},{"$f":"'Q. Software Security'!C54","v":"Remediation of security vulnerabilities identified?"},{"$f":"'Q. Software Security'!D54","v":"Yes"},{"$f":"'Q. Software Security'!E54","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F54","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!G54","v":"14.2.9"},{"$f":"'Q. Software Security'!H54","v":"System acceptance testing"},null,null,"12.5.2"]
[{"$f":"'Q. Software Security'!A55","v":3969},{"$f":"'Q. Software Security'!I55","v":3},{"$f":"'Q. Software Security'!J55","v":0},{"$f":"'Q. Software Security'!X55","v":0},{"$f":"'Q. Software Security'!B55","v":"Q.1.8.5"},{"$f":"'Q. Software Security'!C55","v":"Fuzz testing (e.g., small #'s, large #'s, negative values, binary sequences, command line inputs, random values, etc.}?"},{"$f":"'Q. Software Security'!D55","v":"Yes"},{"$f":"'Q. Software Security'!E55","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F55","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!G55","v":"NA"},{"$f":"'Q. Software Security'!H55","v":0},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A56","v":3970},{"$f":"'Q. Software Security'!I56","v":2},{"$f":"'Q. Software Security'!J56","v":0},{"$f":"'Q. Software Security'!X56","v":0},{"$f":"'Q. Software Security'!B56","v":"Q.1.9"},{"$f":"'Q. Software Security'!C56","v":"Is each release subject to a full secure code review?"},{"$f":"'Q. Software Security'!D56","v":"Yes"},{"$f":"'Q. Software Security'!E56","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F56","v":"Q.5 Secure Code Review"},{"$f":"'Q. Software Security'!G56","v":"14.2.1"},{"$f":"'Q. Software Security'!H56","v":"Secure development policy"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A57","v":3971},{"$f":"'Q. Software Security'!I57","v":2},{"$f":"'Q. Software Security'!J57","v":0},{"$f":"'Q. Software Security'!X57","v":0},{"$f":"'Q. Software Security'!B57","v":"Q.1.10"},{"$f":"'Q. Software Security'!C57","v":"Are penetration tests performed? If yes, are they:"},{"$f":"'Q. Software Security'!D57","v":"Yes"},{"$f":"'Q. Software Security'!E57","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F57","v":0},{"$f":"'Q. Software Security'!G57","v":"14.2.9"},{"$f":"'Q. Software Security'!H57","v":"System acceptance testing"},null,null,11.3]
[{"$f":"'Q. Software Security'!A58","v":3972},{"$f":"'Q. Software Security'!I58","v":3},{"$f":"'Q. Software Security'!J58","v":0},{"$f":"'Q. Software Security'!X58","v":0},{"$f":"'Q. Software Security'!B58","v":"Q.1.10.1"},{"$f":"'Q. Software Security'!C58","v":"Performed by a 3rd party?"},{"$f":"'Q. Software Security'!D58","v":"No"},{"$f":"'Q. Software Security'!E58","v":0},{"$f":"'Q. Software Security'!F58","v":0},{"$f":"'Q. Software Security'!G58","v":"14.2.9"},{"$f":"'Q. Software Security'!H58","v":"System acceptance testing"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A59","v":3973},{"$f":"'Q. Software Security'!I59","v":3},{"$f":"'Q. Software Security'!J59","v":0},{"$f":"'Q. Software Security'!X59","v":0},{"$f":"'Q. Software Security'!B59","v":"Q.1.10.2"},{"$f":"'Q. Software Security'!C59","v":"Internal Penetration Testers? If yes, are they:"},{"$f":"'Q. Software Security'!D59","v":"Yes"},{"$f":"'Q. Software Security'!E59","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F59","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!G59","v":"14.2.9"},{"$f":"'Q. Software Security'!H59","v":"System acceptance testing"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A60","v":3974},{"$f":"'Q. Software Security'!I60","v":4},{"$f":"'Q. Software Security'!J60","v":0},{"$f":"'Q. Software Security'!X60","v":0},{"$f":"'Q. Software Security'!B60","v":"Q.1.10.2.1"},{"$f":"'Q. Software Security'!C60","v":" Part of the development group?"},{"$f":"'Q. Software Security'!D60","v":"Yes"},{"$f":"'Q. Software Security'!E60","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F60","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!G60","v":"14.2.9"},{"$f":"'Q. Software Security'!H60","v":"System acceptance testing"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A61","v":3975},{"$f":"'Q. Software Security'!I61","v":3},{"$f":"'Q. Software Security'!J61","v":0},{"$f":"'Q. Software Security'!X61","v":0},{"$f":"'Q. Software Security'!B61","v":"Q.1.10.3"},{"$f":"'Q. Software Security'!C61","v":"Consistently use the same approach (e.g., tools, methods, time spent, etc.)?"},{"$f":"'Q. Software Security'!D61","v":"Yes"},{"$f":"'Q. Software Security'!E61","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F61","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!G61","v":"14.2.9"},{"$f":"'Q. Software Security'!H61","v":"System acceptance testing"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A62","v":3976},{"$f":"'Q. Software Security'!I62","v":3},{"$f":"'Q. Software Security'!J62","v":0},{"$f":"'Q. Software Security'!X62","v":0},{"$f":"'Q. Software Security'!B62","v":"Q.1.10.4"},{"$f":"'Q. Software Security'!C62","v":"Performed on a set frequently? If yes, describe"},{"$f":"'Q. Software Security'!D62","v":"Yes"},{"$f":"'Q. Software Security'!E62","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F62","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!G62","v":"NA"},{"$f":"'Q. Software Security'!H62","v":0},null,null,11.3]
[{"$f":"'Q. Software Security'!A63","v":3977},{"$f":"'Q. Software Security'!I63","v":3},{"$f":"'Q. Software Security'!J63","v":0},{"$f":"'Q. Software Security'!X63","v":0},{"$f":"'Q. Software Security'!B63","v":"Q.1.10.5"},{"$f":"'Q. Software Security'!C63","v":"Issues remediated?"},{"$f":"'Q. Software Security'!D63","v":"Yes"},{"$f":"'Q. Software Security'!E63","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F63","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!G63","v":"14.2.9"},{"$f":"'Q. Software Security'!H63","v":"System acceptance testing"},null,null,11.3]
[{"$f":"'Q. Software Security'!A64","v":3978},{"$f":"'Q. Software Security'!I64","v":3},{"$f":"'Q. Software Security'!J64","v":0},{"$f":"'Q. Software Security'!X64","v":0},{"$f":"'Q. Software Security'!B64","v":"Q.1.10.6"},{"$f":"'Q. Software Security'!C64","v":"Conducted on the complete production version, not just the components"},{"$f":"'Q. Software Security'!D64","v":"Yes"},{"$f":"'Q. Software Security'!E64","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F64","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!G64","v":"14.2.9"},{"$f":"'Q. Software Security'!H64","v":"System acceptance testing"},null,null,11.3]
[{"$f":"'Q. Software Security'!A65","v":3979},{"$f":"'Q. Software Security'!I65","v":3},{"$f":"'Q. Software Security'!J65","v":0},{"$f":"'Q. Software Security'!X65","v":0},{"$f":"'Q. Software Security'!B65","v":"Q.1.10.7"},{"$f":"'Q. Software Security'!C65","v":"Any un-remediated Penetration Test issues in the application under review?"},{"$f":"'Q. Software Security'!D65","v":"Yes"},{"$f":"'Q. Software Security'!E65","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F65","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!G65","v":"NA"},{"$f":"'Q. Software Security'!H65","v":0},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A66","v":3980},{"$f":"'Q. Software Security'!I66","v":3},{"$f":"'Q. Software Security'!J66","v":0},{"$f":"'Q. Software Security'!X66","v":0},{"$f":"'Q. Software Security'!B66","v":"Q.1.10.8"},{"$f":"'Q. Software Security'!C66","v":"Authenticated when a Penetration Test is performed?"},{"$f":"'Q. Software Security'!D66","v":"Yes"},{"$f":"'Q. Software Security'!E66","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F66","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!G66","v":"NA"},{"$f":"'Q. Software Security'!H66","v":0},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A67","v":3981},{"$f":"'Q. Software Security'!I67","v":3},{"$f":"'Q. Software Security'!J67","v":0},{"$f":"'Q. Software Security'!X67","v":0},{"$f":"'Q. Software Security'!B67","v":"Q.1.10.9"},{"$f":"'Q. Software Security'!C67","v":"Performed in the production environment?"},{"$f":"'Q. Software Security'!D67","v":"Yes"},{"$f":"'Q. Software Security'!E67","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F67","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!G67","v":"14.2.9"},{"$f":"'Q. Software Security'!H67","v":"System acceptance testing"},null,null,"11.3.1"]
[{"$f":"'Q. Software Security'!A68","v":3982},{"$f":"'Q. Software Security'!I68","v":2},{"$f":"'Q. Software Security'!J68","v":0},{"$f":"'Q. Software Security'!X68","v":0},{"$f":"'Q. Software Security'!B68","v":"Q.1.11"},{"$f":"'Q. Software Security'!C68","v":"Are discovered vulnerabilities communicated to developers? If yes, explain"},{"$f":"'Q. Software Security'!D68","v":"Yes"},{"$f":"'Q. Software Security'!E68","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F68","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!G68","v":"14.2.6"},{"$f":"'Q. Software Security'!H68","v":"Secure development environment"},null,null,"12.5.2"]
[{"$f":"'Q. Software Security'!A69","v":3983},{"$f":"'Q. Software Security'!I69","v":2},{"$f":"'Q. Software Security'!J69","v":0},{"$f":"'Q. Software Security'!X69","v":0},{"$f":"'Q. Software Security'!B69","v":"Q.1.12"},{"$f":"'Q. Software Security'!C69","v":"Does the Software Security Group interface with the Incident Response group or function? If yes, are:"},{"$f":"'Q. Software Security'!D69","v":"Yes"},{"$f":"'Q. Software Security'!E69","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F69","v":0},{"$f":"'Q. Software Security'!G69","v":"12.6.1.k"},{"$f":"'Q. Software Security'!H69","v":"Management of Technical vulnerabilities"},null,null,"12.5.3"]
[{"$f":"'Q. Software Security'!A70","v":3984},{"$f":"'Q. Software Security'!I70","v":3},{"$f":"'Q. Software Security'!J70","v":0},{"$f":"'Q. Software Security'!X70","v":0},{"$f":"'Q. Software Security'!B70","v":"Q.1.12.1"},{"$f":"'Q. Software Security'!C70","v":"Vulnerabilities identified by the Incident Response group provided to the Software Security Group?"},{"$f":"'Q. Software Security'!D70","v":"Yes"},{"$f":"'Q. Software Security'!E70","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F70","v":0},{"$f":"'Q. Software Security'!G70","v":"12.6.1.k"},{"$f":"'Q. Software Security'!H70","v":"Management of Technical vulnerabilities"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A71","v":3985},{"$f":"'Q. Software Security'!I71","v":2},{"$f":"'Q. Software Security'!J71","v":0},{"$f":"'Q. Software Security'!X71","v":0},{"$f":"'Q. Software Security'!B71","v":"Q.1.13"},{"$f":"'Q. Software Security'!C71","v":"Does the incident response process include steps to identify root/cause and prevent reoccurrence?"},{"$f":"'Q. Software Security'!D71","v":"Yes"},{"$f":"'Q. Software Security'!E71","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F71","v":0},{"$f":"'Q. Software Security'!G71","v":"16.1.1.a.2"},{"$f":"'Q. Software Security'!H71","v":"Responsibilities and procedures"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A72","v":3986},{"$f":"'Q. Software Security'!I72","v":2},{"$f":"'Q. Software Security'!J72","v":0},{"$f":"'Q. Software Security'!X72","v":0},{"$f":"'Q. Software Security'!B72","v":"Q.1.14"},{"$f":"'Q. Software Security'!C72","v":"Are hosted production applications monitored for vulnerabilities?"},{"$f":"'Q. Software Security'!D72","v":"Yes"},{"$f":"'Q. Software Security'!E72","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F72","v":0},{"$f":"'Q. Software Security'!G72","v":14.1},{"$f":"'Q. Software Security'!H72","v":"Security requirements of information systems"},null,null,"12.8.4"]
[{"$f":"'Q. Software Security'!A73","v":3987},{"$f":"'Q. Software Security'!I73","v":2},{"$f":"'Q. Software Security'!J73","v":0},{"$f":"'Q. Software Security'!X73","v":0},{"$f":"'Q. Software Security'!B73","v":"Q.1.15"},{"$f":"'Q. Software Security'!C73","v":"Are third party code reviews performed prior to release into production?"},{"$f":"'Q. Software Security'!D73","v":"No"},{"$f":"'Q. Software Security'!E73","v":0},{"$f":"'Q. Software Security'!F73","v":0},{"$f":"'Q. Software Security'!G73","v":"NA"},{"$f":"'Q. Software Security'!H73","v":0},null,null,"6.3.2"]
[{"$f":"'Q. Software Security'!A74","v":3988},{"$f":"'Q. Software Security'!I74","v":2},{"$f":"'Q. Software Security'!J74","v":0},{"$f":"'Q. Software Security'!X74","v":0},{"$f":"'Q. Software Security'!B74","v":"Q.1.16"},{"$f":"'Q. Software Security'!C74","v":"Is there a Change or Configuration Management policy or program? If yes, does it include:"},{"$f":"'Q. Software Security'!D74","v":"No"},{"$f":"'Q. Software Security'!E74","v":0},{"$f":"'Q. Software Security'!F74","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!G74","v":"12.1.2"},{"$f":"'Q. Software Security'!H74","v":"Change management"},null,null,6.4]
[{"$f":"'Q. Software Security'!A75","v":3989},{"$f":"'Q. Software Security'!I75","v":3},{"$f":"'Q. Software Security'!J75","v":0},{"$f":"'Q. Software Security'!X75","v":0},{"$f":"'Q. Software Security'!B75","v":"Q.1.16.1"},{"$f":"'Q. Software Security'!C75","v":"Vulnerability Management to ensure code has been properly analyzed?"},{"$f":"'Q. Software Security'!D75","v":"No"},{"$f":"'Q. Software Security'!E75","v":0},{"$f":"'Q. Software Security'!F75","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!G75","v":"12.1.2.c"},{"$f":"'Q. Software Security'!H75","v":"Change management"},null,null,"11.2.1"]
[{"$f":"'Q. Software Security'!A76","v":3990},{"$f":"'Q. Software Security'!I76","v":2},{"$f":"'Q. Software Security'!J76","v":0},{"$f":"'Q. Software Security'!X76","v":0},{"$f":"'Q. Software Security'!B76","v":"Q.1.17"},{"$f":"'Q. Software Security'!C76","v":"Are applications analyzed on a regular basis to determine their vulnerability against recent attacks?"},{"$f":"'Q. Software Security'!D76","v":"Yes"},{"$f":"'Q. Software Security'!E76","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F76","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!G76","v":"12.2.1"},{"$f":"'Q. Software Security'!H76","v":"Controls against malware"},null,null,"11.2.2"]
[{"$f":"'Q. Software Security'!A77","v":3991},{"$f":"'Q. Software Security'!I77","v":2},{"$f":"'Q. Software Security'!J77","v":0},{"$f":"'Q. Software Security'!X77","v":0},{"$f":"'Q. Software Security'!B77","v":"Q.1.18"},{"$f":"'Q. Software Security'!C77","v":"Are any vulnerabilities identified in production fed through the same mechanisms used to track and remediate results from Penetration Tests?"},{"$f":"'Q. Software Security'!D77","v":"Yes"},{"$f":"'Q. Software Security'!E77","v":"Cloudamize Security Policy - Cloudamize Application Change Management and SDLC Policy"},{"$f":"'Q. Software Security'!F77","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!G77","v":"12.2.1"},{"$f":"'Q. Software Security'!H77","v":"Controls against malware"},null,null,"N/A"]
[{"$f":"'Q. Software Security'!A78","v":0},{"$f":"'Q. Software Security'!I78","v":0},{"$f":"'Q. Software Security'!J78","v":0},{"$f":"'Q. Software Security'!X78","v":0},{"$f":"'Q. Software Security'!B78","v":0},{"$f":"'Q. Software Security'!C78","v":0},{"$f":"'Q. Software Security'!D78","v":0},{"$f":"'Q. Software Security'!E78","v":0},{"$f":"'Q. Software Security'!F78","v":0},{"$f":"'Q. Software Security'!G78","v":0},{"$f":"'Q. Software Security'!H78","v":0}]
[]
[{"$f":"'V. Cloud Security'!B1","v":"V. Cloud Security"},null,null,null,{"$f":"'V. Cloud Security'!B1","v":"V. Cloud Security"}]
[{"$f":"'V. Cloud Security'!A5","v":3304},{"$f":"'V. Cloud Security'!K5","v":1},{"$f":"'V. Cloud Security'!L5","v":0},{"$f":"'V. Cloud Security'!Z5","v":1},{"$f":"'V. Cloud Security'!B5","v":"V.1"},{"$f":"'V. Cloud Security'!C5","v":"Are Cloud Services provided? If yes, what service model is provided (select all that apply):"},{"$f":"'V. Cloud Security'!D5","v":"No"},{"$f":"'V. Cloud Security'!E5","v":0},{"$f":"'V. Cloud Security'!H5","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!I5","v":4.3},{"$f":"'V. Cloud Security'!J5","v":"Determining the scope of the information management system"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA5","v":"WP.1.A.1, WP.1.A.2"}]
[{"$f":"'V. Cloud Security'!A6","v":3305},{"$f":"'V. Cloud Security'!K6","v":2},{"$f":"'V. Cloud Security'!L6","v":0},{"$f":"'V. Cloud Security'!Z6","v":1},{"$f":"'V. Cloud Security'!B6","v":"V.1.1"},{"$f":"'V. Cloud Security'!C6","v":"Software as a Service (SaaS)?"},{"$f":"'V. Cloud Security'!D6","v":"No"},{"$f":"'V. Cloud Security'!E6","v":0},{"$f":"'V. Cloud Security'!H6","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!I6","v":"NA"},{"$f":"'V. Cloud Security'!J6","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA6","v":"WP.1.A.1, WP.1.A.2"}]
[{"$f":"'V. Cloud Security'!A7","v":3306},{"$f":"'V. Cloud Security'!K7","v":2},{"$f":"'V. Cloud Security'!L7","v":0},{"$f":"'V. Cloud Security'!Z7","v":1},{"$f":"'V. Cloud Security'!B7","v":"V.1.2"},{"$f":"'V. Cloud Security'!C7","v":"Platform as a Service (PaaS)?"},{"$f":"'V. Cloud Security'!D7","v":"Yes"},{"$f":"'V. Cloud Security'!E7","v":0},{"$f":"'V. Cloud Security'!H7","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!I7","v":"NA"},{"$f":"'V. Cloud Security'!J7","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA7","v":"WP.1.A.1, WP.1.A.2"}]
[{"$f":"'V. Cloud Security'!A8","v":3307},{"$f":"'V. Cloud Security'!K8","v":2},{"$f":"'V. Cloud Security'!L8","v":0},{"$f":"'V. Cloud Security'!Z8","v":1},{"$f":"'V. Cloud Security'!B8","v":"V.1.3"},{"$f":"'V. Cloud Security'!C8","v":"Infrastructure as a Service (IaaS)?"},{"$f":"'V. Cloud Security'!D8","v":0},{"$f":"'V. Cloud Security'!E8","v":0},{"$f":"'V. Cloud Security'!H8","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!I8","v":"NA"},{"$f":"'V. Cloud Security'!J8","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA8","v":"WP.1.A.1, WP.1.A.2"}]
[{"$f":"'V. Cloud Security'!A9","v":3308},{"$f":"'V. Cloud Security'!K9","v":2},{"$f":"'V. Cloud Security'!L9","v":1},{"$f":"'V. Cloud Security'!Z9","v":0},{"$f":"'V. Cloud Security'!B9","v":"V.1.4"},{"$f":"'V. Cloud Security'!C9","v":"What deployment models are provided (select all that apply):"},{"$f":"'V. Cloud Security'!D9","v":0},{"$f":"'V. Cloud Security'!E9","v":0},{"$f":"'V. Cloud Security'!H9","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!I9","v":4.3},{"$f":"'V. Cloud Security'!J9","v":"Determining the scope of the information management system"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA9","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A10","v":3309},{"$f":"'V. Cloud Security'!K10","v":3},{"$f":"'V. Cloud Security'!L10","v":0},{"$f":"'V. Cloud Security'!Z10","v":1},{"$f":"'V. Cloud Security'!B10","v":"V.1.4.1"},{"$f":"'V. Cloud Security'!C10","v":"Private cloud?"},{"$f":"'V. Cloud Security'!D10","v":0},{"$f":"'V. Cloud Security'!E10","v":0},{"$f":"'V. Cloud Security'!H10","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!I10","v":"NA"},{"$f":"'V. Cloud Security'!J10","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA10","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A11","v":3310},{"$f":"'V. Cloud Security'!K11","v":3},{"$f":"'V. Cloud Security'!L11","v":0},{"$f":"'V. Cloud Security'!Z11","v":1},{"$f":"'V. Cloud Security'!B11","v":"V.1.4.2"},{"$f":"'V. Cloud Security'!C11","v":"Public cloud?"},{"$f":"'V. Cloud Security'!D11","v":0},{"$f":"'V. Cloud Security'!E11","v":0},{"$f":"'V. Cloud Security'!H11","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!I11","v":"NA"},{"$f":"'V. Cloud Security'!J11","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA11","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A12","v":3311},{"$f":"'V. Cloud Security'!K12","v":3},{"$f":"'V. Cloud Security'!L12","v":0},{"$f":"'V. Cloud Security'!Z12","v":1},{"$f":"'V. Cloud Security'!B12","v":"V.1.4.3"},{"$f":"'V. Cloud Security'!C12","v":"Community cloud?"},{"$f":"'V. Cloud Security'!D12","v":0},{"$f":"'V. Cloud Security'!E12","v":0},{"$f":"'V. Cloud Security'!H12","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!I12","v":"NA"},{"$f":"'V. Cloud Security'!J12","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA12","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A13","v":3312},{"$f":"'V. Cloud Security'!K13","v":3},{"$f":"'V. Cloud Security'!L13","v":0},{"$f":"'V. Cloud Security'!Z13","v":1},{"$f":"'V. Cloud Security'!B13","v":"V.1.4.4"},{"$f":"'V. Cloud Security'!C13","v":"Hybrid cloud?"},{"$f":"'V. Cloud Security'!D13","v":0},{"$f":"'V. Cloud Security'!E13","v":0},{"$f":"'V. Cloud Security'!H13","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!I13","v":"NA"},{"$f":"'V. Cloud Security'!J13","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA13","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A14","v":3313},{"$f":"'V. Cloud Security'!K14","v":2},{"$f":"'V. Cloud Security'!L14","v":1},{"$f":"'V. Cloud Security'!Z14","v":0},{"$f":"'V. Cloud Security'!B14","v":"V.1.5"},{"$f":"'V. Cloud Security'!C14","v":"Where is the cloud infrastructure hosted:"},{"$f":"'V. Cloud Security'!D14","v":0},{"$f":"'V. Cloud Security'!E14","v":0},{"$f":"'V. Cloud Security'!H14","v":0},{"$f":"'V. Cloud Security'!I14","v":4.3},{"$f":"'V. Cloud Security'!J14","v":"Determining the scope of the information management system"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA14","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A15","v":3314},{"$f":"'V. Cloud Security'!K15","v":3},{"$f":"'V. Cloud Security'!L15","v":0},{"$f":"'V. Cloud Security'!Z15","v":0},{"$f":"'V. Cloud Security'!B15","v":"V.1.5.1"},{"$f":"'V. Cloud Security'!C15","v":"Data center: single tenancy?"},{"$f":"'V. Cloud Security'!D15","v":0},{"$f":"'V. Cloud Security'!E15","v":0},{"$f":"'V. Cloud Security'!H15","v":0},{"$f":"'V. Cloud Security'!I15","v":"NA"},{"$f":"'V. Cloud Security'!J15","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA15","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A16","v":3315},{"$f":"'V. Cloud Security'!K16","v":3},{"$f":"'V. Cloud Security'!L16","v":0},{"$f":"'V. Cloud Security'!Z16","v":0},{"$f":"'V. Cloud Security'!B16","v":"V.1.5.2"},{"$f":"'V. Cloud Security'!C16","v":"Co-location: dedicated server?"},{"$f":"'V. Cloud Security'!D16","v":0},{"$f":"'V. Cloud Security'!E16","v":0},{"$f":"'V. Cloud Security'!H16","v":0},{"$f":"'V. Cloud Security'!I16","v":"NA"},{"$f":"'V. Cloud Security'!J16","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA16","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A17","v":3686},{"$f":"'V. Cloud Security'!K17","v":3},{"$f":"'V. Cloud Security'!L17","v":0},{"$f":"'V. Cloud Security'!Z17","v":0},{"$f":"'V. Cloud Security'!B17","v":"V.1.5.3"},{"$f":"'V. Cloud Security'!C17","v":"Co-location: shared server?"},{"$f":"'V. Cloud Security'!D17","v":0},{"$f":"'V. Cloud Security'!E17","v":0},{"$f":"'V. Cloud Security'!H17","v":0},{"$f":"'V. Cloud Security'!I17","v":"NA"},{"$f":"'V. Cloud Security'!J17","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA17","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A18","v":3316},{"$f":"'V. Cloud Security'!K18","v":3},{"$f":"'V. Cloud Security'!L18","v":0},{"$f":"'V. Cloud Security'!Z18","v":0},{"$f":"'V. Cloud Security'!B18","v":"V.1.5.4"},{"$f":"'V. Cloud Security'!C18","v":"Co-location: dedicated cabinet?"},{"$f":"'V. Cloud Security'!D18","v":0},{"$f":"'V. Cloud Security'!E18","v":0},{"$f":"'V. Cloud Security'!H18","v":0},{"$f":"'V. Cloud Security'!I18","v":"NA"},{"$f":"'V. Cloud Security'!J18","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA18","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A19","v":3317},{"$f":"'V. Cloud Security'!K19","v":3},{"$f":"'V. Cloud Security'!L19","v":0},{"$f":"'V. Cloud Security'!Z19","v":0},{"$f":"'V. Cloud Security'!B19","v":"V.1.5.5"},{"$f":"'V. Cloud Security'!C19","v":"Co-location: shared cabinet?"},{"$f":"'V. Cloud Security'!D19","v":0},{"$f":"'V. Cloud Security'!E19","v":0},{"$f":"'V. Cloud Security'!H19","v":0},{"$f":"'V. Cloud Security'!I19","v":"NA"},{"$f":"'V. Cloud Security'!J19","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA19","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A20","v":3318},{"$f":"'V. Cloud Security'!K20","v":3},{"$f":"'V. Cloud Security'!L20","v":0},{"$f":"'V. Cloud Security'!Z20","v":0},{"$f":"'V. Cloud Security'!B20","v":"V.1.5.6"},{"$f":"'V. Cloud Security'!C20","v":"Co-location: dedicated cage?"},{"$f":"'V. Cloud Security'!D20","v":0},{"$f":"'V. Cloud Security'!E20","v":0},{"$f":"'V. Cloud Security'!H20","v":0},{"$f":"'V. Cloud Security'!I20","v":"NA"},{"$f":"'V. Cloud Security'!J20","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA20","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A21","v":3319},{"$f":"'V. Cloud Security'!K21","v":3},{"$f":"'V. Cloud Security'!L21","v":0},{"$f":"'V. Cloud Security'!Z21","v":0},{"$f":"'V. Cloud Security'!B21","v":"V.1.5.7"},{"$f":"'V. Cloud Security'!C21","v":"Co-location: shared cage?"},{"$f":"'V. Cloud Security'!D21","v":0},{"$f":"'V. Cloud Security'!E21","v":0},{"$f":"'V. Cloud Security'!H21","v":0},{"$f":"'V. Cloud Security'!I21","v":"NA"},{"$f":"'V. Cloud Security'!J21","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA21","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A22","v":3320},{"$f":"'V. Cloud Security'!K22","v":3},{"$f":"'V. Cloud Security'!L22","v":0},{"$f":"'V. Cloud Security'!Z22","v":0},{"$f":"'V. Cloud Security'!B22","v":"V.1.5.8"},{"$f":"'V. Cloud Security'!C22","v":"Cloud provider: (e.g., AWS)?"},{"$f":"'V. Cloud Security'!D22","v":0},{"$f":"'V. Cloud Security'!E22","v":0},{"$f":"'V. Cloud Security'!H22","v":0},{"$f":"'V. Cloud Security'!I22","v":"NA"},{"$f":"'V. Cloud Security'!J22","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA22","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A23","v":3321},{"$f":"'V. Cloud Security'!K23","v":2},{"$f":"'V. Cloud Security'!L23","v":1},{"$f":"'V. Cloud Security'!Z23","v":0},{"$f":"'V. Cloud Security'!B23","v":"V.1.6"},{"$f":"'V. Cloud Security'!C23","v":"What legal jurisdiction does data reside (select all that apply):"},{"$f":"'V. Cloud Security'!D23","v":0},{"$f":"'V. Cloud Security'!E23","v":0},{"$f":"'V. Cloud Security'!H23","v":"P.1 Privacy Target Data Inventory and Flows"},{"$f":"'V. Cloud Security'!I23","v":"18.1.1 "},{"$f":"'V. Cloud Security'!J23","v":"Identification of applicable legislation and contractual requirements"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA23","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A24","v":3322},{"$f":"'V. Cloud Security'!K24","v":3},{"$f":"'V. Cloud Security'!L24","v":0},{"$f":"'V. Cloud Security'!Z24","v":0},{"$f":"'V. Cloud Security'!B24","v":"V.1.6.1"},{"$f":"'V. Cloud Security'!C24","v":"USA?"},{"$f":"'V. Cloud Security'!D24","v":0},{"$f":"'V. Cloud Security'!E24","v":0},{"$f":"'V. Cloud Security'!H24","v":"P.1 Privacy Target Data Inventory and Flows"},{"$f":"'V. Cloud Security'!I24","v":"NA"},{"$f":"'V. Cloud Security'!J24","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA24","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A25","v":3323},{"$f":"'V. Cloud Security'!K25","v":3},{"$f":"'V. Cloud Security'!L25","v":0},{"$f":"'V. Cloud Security'!Z25","v":0},{"$f":"'V. Cloud Security'!B25","v":"V.1.6.2"},{"$f":"'V. Cloud Security'!C25","v":"Canada?"},{"$f":"'V. Cloud Security'!D25","v":0},{"$f":"'V. Cloud Security'!E25","v":0},{"$f":"'V. Cloud Security'!H25","v":"P.1 Privacy Target Data Inventory and Flows"},{"$f":"'V. Cloud Security'!I25","v":"NA"},{"$f":"'V. Cloud Security'!J25","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA25","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A26","v":3324},{"$f":"'V. Cloud Security'!K26","v":3},{"$f":"'V. Cloud Security'!L26","v":0},{"$f":"'V. Cloud Security'!Z26","v":0},{"$f":"'V. Cloud Security'!B26","v":"V.1.6.3"},{"$f":"'V. Cloud Security'!C26","v":"Asia?"},{"$f":"'V. Cloud Security'!D26","v":0},{"$f":"'V. Cloud Security'!E26","v":0},{"$f":"'V. Cloud Security'!H26","v":"P.1 Privacy Target Data Inventory and Flows"},{"$f":"'V. Cloud Security'!I26","v":"NA"},{"$f":"'V. Cloud Security'!J26","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA26","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A27","v":3325},{"$f":"'V. Cloud Security'!K27","v":3},{"$f":"'V. Cloud Security'!L27","v":0},{"$f":"'V. Cloud Security'!Z27","v":0},{"$f":"'V. Cloud Security'!B27","v":"V.1.6.4"},{"$f":"'V. Cloud Security'!C27","v":"South America?"},{"$f":"'V. Cloud Security'!D27","v":0},{"$f":"'V. Cloud Security'!E27","v":0},{"$f":"'V. Cloud Security'!H27","v":"P.1 Privacy Target Data Inventory and Flows"},{"$f":"'V. Cloud Security'!I27","v":"NA"},{"$f":"'V. Cloud Security'!J27","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA27","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A28","v":3326},{"$f":"'V. Cloud Security'!K28","v":3},{"$f":"'V. Cloud Security'!L28","v":0},{"$f":"'V. Cloud Security'!Z28","v":0},{"$f":"'V. Cloud Security'!B28","v":"V.1.6.5"},{"$f":"'V. Cloud Security'!C28","v":"Australia?"},{"$f":"'V. Cloud Security'!D28","v":0},{"$f":"'V. Cloud Security'!E28","v":0},{"$f":"'V. Cloud Security'!H28","v":"P.1 Privacy Target Data Inventory and Flows"},{"$f":"'V. Cloud Security'!I28","v":"NA"},{"$f":"'V. Cloud Security'!J28","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA28","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A29","v":3327},{"$f":"'V. Cloud Security'!K29","v":3},{"$f":"'V. Cloud Security'!L29","v":0},{"$f":"'V. Cloud Security'!Z29","v":0},{"$f":"'V. Cloud Security'!B29","v":"V.1.6.6"},{"$f":"'V. Cloud Security'!C29","v":"Asia-Pacific?"},{"$f":"'V. Cloud Security'!D29","v":0},{"$f":"'V. Cloud Security'!E29","v":0},{"$f":"'V. Cloud Security'!H29","v":"P.1 Privacy Target Data Inventory and Flows"},{"$f":"'V. Cloud Security'!I29","v":"NA"},{"$f":"'V. Cloud Security'!J29","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA29","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A30","v":3328},{"$f":"'V. Cloud Security'!K30","v":3},{"$f":"'V. Cloud Security'!L30","v":0},{"$f":"'V. Cloud Security'!Z30","v":0},{"$f":"'V. Cloud Security'!B30","v":"V.1.6.7"},{"$f":"'V. Cloud Security'!C30","v":"Africa?"},{"$f":"'V. Cloud Security'!D30","v":0},{"$f":"'V. Cloud Security'!E30","v":0},{"$f":"'V. Cloud Security'!H30","v":"P.1 Privacy Target Data Inventory and Flows"},{"$f":"'V. Cloud Security'!I30","v":"NA"},{"$f":"'V. Cloud Security'!J30","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA30","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A31","v":3684},{"$f":"'V. Cloud Security'!K31","v":3},{"$f":"'V. Cloud Security'!L31","v":0},{"$f":"'V. Cloud Security'!Z31","v":0},{"$f":"'V. Cloud Security'!B31","v":"V.1.6.8"},{"$f":"'V. Cloud Security'!C31","v":"Europe (EU)?"},{"$f":"'V. Cloud Security'!D31","v":0},{"$f":"'V. Cloud Security'!E31","v":0},{"$f":"'V. Cloud Security'!H31","v":"P.1 Privacy Target Data Inventory and Flows"},{"$f":"'V. Cloud Security'!I31","v":"NA"},{"$f":"'V. Cloud Security'!J31","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA31","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A32","v":3685},{"$f":"'V. Cloud Security'!K32","v":3},{"$f":"'V. Cloud Security'!L32","v":0},{"$f":"'V. Cloud Security'!Z32","v":0},{"$f":"'V. Cloud Security'!B32","v":"V.1.6.9"},{"$f":"'V. Cloud Security'!C32","v":"Europe (non-EU)?"},{"$f":"'V. Cloud Security'!D32","v":0},{"$f":"'V. Cloud Security'!E32","v":0},{"$f":"'V. Cloud Security'!H32","v":"P.1 Privacy Target Data Inventory and Flows"},{"$f":"'V. Cloud Security'!I32","v":"NA"},{"$f":"'V. Cloud Security'!J32","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA32","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A33","v":3329},{"$f":"'V. Cloud Security'!K33","v":3},{"$f":"'V. Cloud Security'!L33","v":0},{"$f":"'V. Cloud Security'!Z33","v":0},{"$f":"'V. Cloud Security'!B33","v":"V.1.6.10"},{"$f":"'V. Cloud Security'!C33","v":"Other (please specify)?"},{"$f":"'V. Cloud Security'!D33","v":0},{"$f":"'V. Cloud Security'!E33","v":0},{"$f":"'V. Cloud Security'!H33","v":"P.1 Privacy Target Data Inventory and Flows"},{"$f":"'V. Cloud Security'!I33","v":"NA"},{"$f":"'V. Cloud Security'!J33","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA33","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A34","v":3330},{"$f":"'V. Cloud Security'!K34","v":2},{"$f":"'V. Cloud Security'!L34","v":0},{"$f":"'V. Cloud Security'!Z34","v":1},{"$f":"'V. Cloud Security'!B34","v":"V.1.7"},{"$f":"'V. Cloud Security'!C34","v":"Can clients define the legal jurisdictions of their data? If yes, can they define where the data is:"},{"$f":"'V. Cloud Security'!D34","v":0},{"$f":"'V. Cloud Security'!E34","v":0},{"$f":"'V. Cloud Security'!H34","v":"P.1 Privacy Target Data Inventory and Flows"},{"$f":"'V. Cloud Security'!I34","v":"18.1.1 "},{"$f":"'V. Cloud Security'!J34","v":"Identification of applicable legislation and contractual requirements"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA34","v":"WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A35","v":3331},{"$f":"'V. Cloud Security'!K35","v":3},{"$f":"'V. Cloud Security'!L35","v":0},{"$f":"'V. Cloud Security'!Z35","v":0},{"$f":"'V. Cloud Security'!B35","v":"V.1.7.1"},{"$f":"'V. Cloud Security'!C35","v":"Stored?"},{"$f":"'V. Cloud Security'!D35","v":0},{"$f":"'V. Cloud Security'!E35","v":0},{"$f":"'V. Cloud Security'!H35","v":"P.1 Privacy Target Data Inventory and Flows"},{"$f":"'V. Cloud Security'!I35","v":"NA"},{"$f":"'V. Cloud Security'!J35","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA35","v":"WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A36","v":3332},{"$f":"'V. Cloud Security'!K36","v":3},{"$f":"'V. Cloud Security'!L36","v":0},{"$f":"'V. Cloud Security'!Z36","v":0},{"$f":"'V. Cloud Security'!B36","v":"V.1.7.2"},{"$f":"'V. Cloud Security'!C36","v":"Processed?"},{"$f":"'V. Cloud Security'!D36","v":0},{"$f":"'V. Cloud Security'!E36","v":0},{"$f":"'V. Cloud Security'!H36","v":"P.1 Privacy Target Data Inventory and Flows"},{"$f":"'V. Cloud Security'!I36","v":"NA"},{"$f":"'V. Cloud Security'!J36","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA36","v":"WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A37","v":3333},{"$f":"'V. Cloud Security'!K37","v":3},{"$f":"'V. Cloud Security'!L37","v":0},{"$f":"'V. Cloud Security'!Z37","v":0},{"$f":"'V. Cloud Security'!B37","v":"V.1.7.3"},{"$f":"'V. Cloud Security'!C37","v":"Transmitted?"},{"$f":"'V. Cloud Security'!D37","v":0},{"$f":"'V. Cloud Security'!E37","v":0},{"$f":"'V. Cloud Security'!H37","v":"P.1 Privacy Target Data Inventory and Flows"},{"$f":"'V. Cloud Security'!I37","v":"NA"},{"$f":"'V. Cloud Security'!J37","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA37","v":"WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A38","v":3334},{"$f":"'V. Cloud Security'!K38","v":3},{"$f":"'V. Cloud Security'!L38","v":0},{"$f":"'V. Cloud Security'!Z38","v":0},{"$f":"'V. Cloud Security'!B38","v":"V.1.7.4"},{"$f":"'V. Cloud Security'!C38","v":"Accessed?"},{"$f":"'V. Cloud Security'!D38","v":0},{"$f":"'V. Cloud Security'!E38","v":0},{"$f":"'V. Cloud Security'!H38","v":"P.1 Privacy Target Data Inventory and Flows"},{"$f":"'V. Cloud Security'!I38","v":"NA"},{"$f":"'V. Cloud Security'!J38","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA38","v":"WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A39","v":3335},{"$f":"'V. Cloud Security'!K39","v":2},{"$f":"'V. Cloud Security'!L39","v":0},{"$f":"'V. Cloud Security'!Z39","v":0},{"$f":"'V. Cloud Security'!B39","v":"V.1.8"},{"$f":"'V. Cloud Security'!C39","v":"Are application instances part of the services provided?"},{"$f":"'V. Cloud Security'!D39","v":0},{"$f":"'V. Cloud Security'!E39","v":0},{"$f":"'V. Cloud Security'!H39","v":"P.1 Privacy Target Data Inventory and Flows"},{"$f":"'V. Cloud Security'!I39","v":"9.4.1 "},{"$f":"'V. Cloud Security'!J39","v":"Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA39","v":"WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A40","v":3336},{"$f":"'V. Cloud Security'!K40","v":3},{"$f":"'V. Cloud Security'!L40","v":0},{"$f":"'V. Cloud Security'!Z40","v":0},{"$f":"'V. Cloud Security'!B40","v":"V.1.8.1"},{"$f":"'V. Cloud Security'!C40","v":"Are these instances shared with other clients?"},{"$f":"'V. Cloud Security'!D40","v":0},{"$f":"'V. Cloud Security'!E40","v":0},{"$f":"'V. Cloud Security'!H40","v":"P.1 Privacy Target Data Inventory and Flows"},{"$f":"'V. Cloud Security'!I40","v":"NA"},{"$f":"'V. Cloud Security'!J40","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA40","v":"WP.1.A.1, WP.1.A.2, WP.1.A.8"}]
[{"$f":"'V. Cloud Security'!A41","v":3337},{"$f":"'V. Cloud Security'!K41","v":2},{"$f":"'V. Cloud Security'!L41","v":0},{"$f":"'V. Cloud Security'!Z41","v":0},{"$f":"'V. Cloud Security'!B41","v":"V.1.9"},{"$f":"'V. Cloud Security'!C41","v":"Are database instances part of the services provided?"},{"$f":"'V. Cloud Security'!D41","v":0},{"$f":"'V. Cloud Security'!E41","v":0},{"$f":"'V. Cloud Security'!H41","v":"P.1 Privacy Target Data Inventory and Flows"},{"$f":"'V. Cloud Security'!I41","v":"9.4.1"},{"$f":"'V. Cloud Security'!J41","v":"Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA41","v":"WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A42","v":3338},{"$f":"'V. Cloud Security'!K42","v":3},{"$f":"'V. Cloud Security'!L42","v":0},{"$f":"'V. Cloud Security'!Z42","v":0},{"$f":"'V. Cloud Security'!B42","v":"V.1.9.1"},{"$f":"'V. Cloud Security'!C42","v":"Are these instances shared with other clients?"},{"$f":"'V. Cloud Security'!D42","v":0},{"$f":"'V. Cloud Security'!E42","v":0},{"$f":"'V. Cloud Security'!H42","v":"P.1 Privacy Target Data Inventory and Flows"},{"$f":"'V. Cloud Security'!I42","v":"NA"},{"$f":"'V. Cloud Security'!J42","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA42","v":"WP.1.A.1, WP.1.A.2, WP.1.A.8"}]
[{"$f":"'V. Cloud Security'!A43","v":3339},{"$f":"'V. Cloud Security'!K43","v":2},{"$f":"'V. Cloud Security'!L43","v":0},{"$f":"'V. Cloud Security'!Z43","v":1},{"$f":"'V. Cloud Security'!B43","v":"V.1.10"},{"$f":"'V. Cloud Security'!C43","v":"Is data segmentation and separation capability between clients provided? If yes, is it:"},{"$f":"'V. Cloud Security'!D43","v":0},{"$f":"'V. Cloud Security'!E43","v":0},{"$f":"'V. Cloud Security'!H43","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!I43","v":"9.4.1 "},{"$f":"'V. Cloud Security'!J43","v":"Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA43","v":"WP.1.A.1"}]
[{"$f":"'V. Cloud Security'!A44","v":3340},{"$f":"'V. Cloud Security'!K44","v":3},{"$f":"'V. Cloud Security'!L44","v":0},{"$f":"'V. Cloud Security'!Z44","v":0},{"$f":"'V. Cloud Security'!B44","v":"V.1.10.1"},{"$f":"'V. Cloud Security'!C44","v":"Physical segmentation (private cloud)?"},{"$f":"'V. Cloud Security'!D44","v":0},{"$f":"'V. Cloud Security'!E44","v":0},{"$f":"'V. Cloud Security'!H44","v":0},{"$f":"'V. Cloud Security'!I44","v":"9.4.1 "},{"$f":"'V. Cloud Security'!J44","v":"Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA44","v":"WP.1.A.1"}]
[{"$f":"'V. Cloud Security'!A45","v":3341},{"$f":"'V. Cloud Security'!K45","v":3},{"$f":"'V. Cloud Security'!L45","v":0},{"$f":"'V. Cloud Security'!Z45","v":0},{"$f":"'V. Cloud Security'!B45","v":"V.1.10.2"},{"$f":"'V. Cloud Security'!C45","v":"Network segmentation?"},{"$f":"'V. Cloud Security'!D45","v":0},{"$f":"'V. Cloud Security'!E45","v":0},{"$f":"'V. Cloud Security'!H45","v":0},{"$f":"'V. Cloud Security'!I45","v":"9.4.1 "},{"$f":"'V. Cloud Security'!J45","v":"Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA45","v":"WP.1.A.1"}]
[{"$f":"'V. Cloud Security'!A46","v":3342},{"$f":"'V. Cloud Security'!K46","v":3},{"$f":"'V. Cloud Security'!L46","v":0},{"$f":"'V. Cloud Security'!Z46","v":0},{"$f":"'V. Cloud Security'!B46","v":"V.1.10.3"},{"$f":"'V. Cloud Security'!C46","v":"System segmentation (unique system instances (e.g., virtualization)?"},{"$f":"'V. Cloud Security'!D46","v":0},{"$f":"'V. Cloud Security'!E46","v":0},{"$f":"'V. Cloud Security'!H46","v":0},{"$f":"'V. Cloud Security'!I46","v":"9.4.1 "},{"$f":"'V. Cloud Security'!J46","v":"Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA46","v":"WP.1.A.1, WP.1.D.1, WP.1.D.3"}]
[{"$f":"'V. Cloud Security'!A47","v":3343},{"$f":"'V. Cloud Security'!K47","v":3},{"$f":"'V. Cloud Security'!L47","v":0},{"$f":"'V. Cloud Security'!Z47","v":0},{"$f":"'V. Cloud Security'!B47","v":"V.1.10.4"},{"$f":"'V. Cloud Security'!C47","v":"Application segmentation (unique application instances)?"},{"$f":"'V. Cloud Security'!D47","v":0},{"$f":"'V. Cloud Security'!E47","v":0},{"$f":"'V. Cloud Security'!H47","v":0},{"$f":"'V. Cloud Security'!I47","v":"9.4.1 "},{"$f":"'V. Cloud Security'!J47","v":"Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA47","v":"WP.1.A.1"}]
[{"$f":"'V. Cloud Security'!A48","v":3344},{"$f":"'V. Cloud Security'!K48","v":3},{"$f":"'V. Cloud Security'!L48","v":0},{"$f":"'V. Cloud Security'!Z48","v":0},{"$f":"'V. Cloud Security'!B48","v":"V.1.10.5"},{"$f":"'V. Cloud Security'!C48","v":"Application segmentation (e.g., application ID, metadata tagging)?"},{"$f":"'V. Cloud Security'!D48","v":0},{"$f":"'V. Cloud Security'!E48","v":0},{"$f":"'V. Cloud Security'!H48","v":0},{"$f":"'V. Cloud Security'!I48","v":"9.4.1 "},{"$f":"'V. Cloud Security'!J48","v":"Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA48","v":"WP.1.A.1"}]
[{"$f":"'V. Cloud Security'!A49","v":3345},{"$f":"'V. Cloud Security'!K49","v":3},{"$f":"'V. Cloud Security'!L49","v":0},{"$f":"'V. Cloud Security'!Z49","v":0},{"$f":"'V. Cloud Security'!B49","v":"V.1.10.6"},{"$f":"'V. Cloud Security'!C49","v":"Other (please specify)?"},{"$f":"'V. Cloud Security'!D49","v":0},{"$f":"'V. Cloud Security'!E49","v":0},{"$f":"'V. Cloud Security'!H49","v":0},{"$f":"'V. Cloud Security'!I49","v":"9.4.1 "},{"$f":"'V. Cloud Security'!J49","v":"Information access restriction"},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A50","v":3346},{"$f":"'V. Cloud Security'!K50","v":2},{"$f":"'V. Cloud Security'!L50","v":0},{"$f":"'V. Cloud Security'!Z50","v":1},{"$f":"'V. Cloud Security'!B50","v":"V.1.11"},{"$f":"'V. Cloud Security'!C50","v":"Is Scoped Data encrypted? If yes, when:"},{"$f":"'V. Cloud Security'!D50","v":0},{"$f":"'V. Cloud Security'!E50","v":0},{"$f":"'V. Cloud Security'!H50","v":"G.22 Data Security Policy – Encryption "},{"$f":"'V. Cloud Security'!I50","v":"10.1.1                                                     13.1.2                                                14.1.3                                                                 18.1.3"},{"$f":"'V. Cloud Security'!J50","v":"Policy On The Use Of Cryptographic Controls,\nSecurity Of Network Services,\nProtecting application services transactions,\nProtection Of records"},null,null,"3.5, 3.6",null,null,{"$f":"'V. Cloud Security'!AA50","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.A.7, WP.1.G.9"}]
[{"$f":"'V. Cloud Security'!A51","v":3347},{"$f":"'V. Cloud Security'!K51","v":3},{"$f":"'V. Cloud Security'!L51","v":0},{"$f":"'V. Cloud Security'!Z51","v":0},{"$f":"'V. Cloud Security'!B51","v":"V.1.11.1"},{"$f":"'V. Cloud Security'!C51","v":"External: Network?"},{"$f":"'V. Cloud Security'!D51","v":0},{"$f":"'V. Cloud Security'!E51","v":0},{"$f":"'V. Cloud Security'!H51","v":"G.22 Data Security Policy – Encryption, G.13 Website – Client Encryption"},{"$f":"'V. Cloud Security'!I51","v":"NA"},{"$f":"'V. Cloud Security'!J51","v":0},null,null,"3.5, 3.6"]
[{"$f":"'V. Cloud Security'!A52","v":3348},{"$f":"'V. Cloud Security'!K52","v":3},{"$f":"'V. Cloud Security'!L52","v":0},{"$f":"'V. Cloud Security'!Z52","v":0},{"$f":"'V. Cloud Security'!B52","v":"V.1.11.2"},{"$f":"'V. Cloud Security'!C52","v":"Internal: Network?"},{"$f":"'V. Cloud Security'!D52","v":0},{"$f":"'V. Cloud Security'!E52","v":0},{"$f":"'V. Cloud Security'!H52","v":"G.22 Data Security Policy – Encryption, G.13 Website – Client Encryption"},{"$f":"'V. Cloud Security'!I52","v":"NA"},{"$f":"'V. Cloud Security'!J52","v":0},null,null,"3.5, 3.6"]
[{"$f":"'V. Cloud Security'!A53","v":3349},{"$f":"'V. Cloud Security'!K53","v":3},{"$f":"'V. Cloud Security'!L53","v":0},{"$f":"'V. Cloud Security'!Z53","v":0},{"$f":"'V. Cloud Security'!B53","v":"V.1.11.3"},{"$f":"'V. Cloud Security'!C53","v":"Internal: Storage?"},{"$f":"'V. Cloud Security'!D53","v":0},{"$f":"'V. Cloud Security'!E53","v":0},{"$f":"'V. Cloud Security'!H53","v":"G.22 Data Security Policy – Encryption "},{"$f":"'V. Cloud Security'!I53","v":"NA"},{"$f":"'V. Cloud Security'!J53","v":0},null,null,"3.5, 3.6"]
[{"$f":"'V. Cloud Security'!A54","v":3350},{"$f":"'V. Cloud Security'!K54","v":3},{"$f":"'V. Cloud Security'!L54","v":0},{"$f":"'V. Cloud Security'!Z54","v":0},{"$f":"'V. Cloud Security'!B54","v":"V.1.11.4"},{"$f":"'V. Cloud Security'!C54","v":"Vendors: Transit to third party vendors?"},{"$f":"'V. Cloud Security'!D54","v":0},{"$f":"'V. Cloud Security'!E54","v":0},{"$f":"'V. Cloud Security'!H54","v":"G.22 Data Security Policy – Encryption "},{"$f":"'V. Cloud Security'!I54","v":"NA"},{"$f":"'V. Cloud Security'!J54","v":0},null,null,4.0999999999999996]
[{"$f":"'V. Cloud Security'!A55","v":3351},{"$f":"'V. Cloud Security'!K55","v":3},{"$f":"'V. Cloud Security'!L55","v":0},{"$f":"'V. Cloud Security'!Z55","v":0},{"$f":"'V. Cloud Security'!B55","v":"V.1.11.5"},{"$f":"'V. Cloud Security'!C55","v":"Vendors: Stored by third party vendors?"},{"$f":"'V. Cloud Security'!D55","v":0},{"$f":"'V. Cloud Security'!E55","v":0},{"$f":"'V. Cloud Security'!H55","v":"Gap but added under G.22 Data Security Policy – Encryption "},{"$f":"'V. Cloud Security'!I55","v":"NA"},{"$f":"'V. Cloud Security'!J55","v":0},null,null,"3.5, 3.6.3"]
[{"$f":"'V. Cloud Security'!A56","v":3352},{"$f":"'V. Cloud Security'!K56","v":3},{"$f":"'V. Cloud Security'!L56","v":0},{"$f":"'V. Cloud Security'!Z56","v":0},{"$f":"'V. Cloud Security'!B56","v":"V.1.11.6"},{"$f":"'V. Cloud Security'!C56","v":"Other (please specify)?"},{"$f":"'V. Cloud Security'!D56","v":0},{"$f":"'V. Cloud Security'!E56","v":0},{"$f":"'V. Cloud Security'!H56","v":0},{"$f":"'V. Cloud Security'!I56","v":"NA"},{"$f":"'V. Cloud Security'!J56","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A57","v":3353},{"$f":"'V. Cloud Security'!K57","v":2},{"$f":"'V. Cloud Security'!L57","v":0},{"$f":"'V. Cloud Security'!Z57","v":1},{"$f":"'V. Cloud Security'!B57","v":"V.1.12"},{"$f":"'V. Cloud Security'!C57","v":"Are clients provided with the ability to generate a unique encryption key?"},{"$f":"'V. Cloud Security'!D57","v":0},{"$f":"'V. Cloud Security'!E57","v":0},{"$f":"'V. Cloud Security'!H57","v":"G.22 Data Security Policy - Encryption"},{"$f":"'V. Cloud Security'!I57","v":"10.1.2"},{"$f":"'V. Cloud Security'!J57","v":"Key Management"},null,null,"3.6.1",null,null,{"$f":"'V. Cloud Security'!AA57","v":"WP.1.A.6"}]
[{"$f":"'V. Cloud Security'!A58","v":3354},{"$f":"'V. Cloud Security'!K58","v":2},{"$f":"'V. Cloud Security'!L58","v":0},{"$f":"'V. Cloud Security'!Z58","v":1},{"$f":"'V. Cloud Security'!B58","v":"V.1.13"},{"$f":"'V. Cloud Security'!C58","v":"Are clients provided with the ability to rotate their encryption key on a scheduled basis?"},{"$f":"'V. Cloud Security'!D58","v":0},{"$f":"'V. Cloud Security'!E58","v":0},{"$f":"'V. Cloud Security'!H58","v":"G.22 Data Security Policy - Encryption"},{"$f":"'V. Cloud Security'!I58","v":"10.1.2"},{"$f":"'V. Cloud Security'!J58","v":"Key Management"},null,null,"3.6.4",null,null,{"$f":"'V. Cloud Security'!AA58","v":"WP.1.A.6, WP.1.A.7"}]
[{"$f":"'V. Cloud Security'!A59","v":3355},{"$f":"'V. Cloud Security'!K59","v":2},{"$f":"'V. Cloud Security'!L59","v":0},{"$f":"'V. Cloud Security'!Z59","v":1},{"$f":"'V. Cloud Security'!B59","v":"V.1.14"},{"$f":"'V. Cloud Security'!C59","v":"Is standards based federated ID capability available to clients (e.g., SAML, OpenID)?"},{"$f":"'V. Cloud Security'!D59","v":0},{"$f":"'V. Cloud Security'!E59","v":0},{"$f":"'V. Cloud Security'!H59","v":0},{"$f":"'V. Cloud Security'!I59","v":"9.2.1"},{"$f":"'V. Cloud Security'!J59","v":"User registration and de-registration"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA59","v":"WP.1.H.2, WP.1.H.4"}]
[{"$f":"'V. Cloud Security'!A60","v":3356},{"$f":"'V. Cloud Security'!K60","v":2},{"$f":"'V. Cloud Security'!L60","v":0},{"$f":"'V. Cloud Security'!Z60","v":1},{"$f":"'V. Cloud Security'!B60","v":"V.1.15"},{"$f":"'V. Cloud Security'!C60","v":"Are application self service features or an Internet accessible self-service portal available to clients? If yes, are the following functions available:"},{"$f":"'V. Cloud Security'!D60","v":0},{"$f":"'V. Cloud Security'!E60","v":0},{"$f":"'V. Cloud Security'!H60","v":0},{"$f":"'V. Cloud Security'!I60","v":"9.4.1"},{"$f":"'V. Cloud Security'!J60","v":"Information access restriction"},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A61","v":3357},{"$f":"'V. Cloud Security'!K61","v":3},{"$f":"'V. Cloud Security'!L61","v":0},{"$f":"'V. Cloud Security'!Z61","v":0},{"$f":"'V. Cloud Security'!B61","v":"V.1.15.1"},{"$f":"'V. Cloud Security'!C61","v":"Provision users?"},{"$f":"'V. Cloud Security'!D61","v":0},{"$f":"'V. Cloud Security'!E61","v":0},{"$f":"'V. Cloud Security'!H61","v":0},{"$f":"'V. Cloud Security'!I61","v":"9.2.2 "},{"$f":"'V. Cloud Security'!J61","v":"User access provisioning"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA61","v":"WP.1.H.1, WP.1.H.3, WP.1.H.5, WP.1.H.7"}]
[{"$f":"'V. Cloud Security'!A62","v":3358},{"$f":"'V. Cloud Security'!K62","v":3},{"$f":"'V. Cloud Security'!L62","v":0},{"$f":"'V. Cloud Security'!Z62","v":0},{"$f":"'V. Cloud Security'!B62","v":"V.1.15.2"},{"$f":"'V. Cloud Security'!C62","v":"Audit user entitlements?"},{"$f":"'V. Cloud Security'!D62","v":0},{"$f":"'V. Cloud Security'!E62","v":0},{"$f":"'V. Cloud Security'!H62","v":0},{"$f":"'V. Cloud Security'!I62","v":"9.2.5"},{"$f":"'V. Cloud Security'!J62","v":"Review Of User Access Rights"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA62","v":"WP.1.H.9"}]
[{"$f":"'V. Cloud Security'!A63","v":3359},{"$f":"'V. Cloud Security'!K63","v":3},{"$f":"'V. Cloud Security'!L63","v":0},{"$f":"'V. Cloud Security'!Z63","v":0},{"$f":"'V. Cloud Security'!B63","v":"V.1.15.3"},{"$f":"'V. Cloud Security'!C63","v":"View uptime?"},{"$f":"'V. Cloud Security'!D63","v":0},{"$f":"'V. Cloud Security'!E63","v":0},{"$f":"'V. Cloud Security'!H63","v":0},{"$f":"'V. Cloud Security'!I63","v":"12.4.1                                                     15.2.1"},{"$f":"'V. Cloud Security'!J63","v":"Event Logging,\nMonitoring And Review Of Supplier Services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA63","v":"WP.1.K.7, WP.1.K.8, WP.1.K.9, WP.1.K.10"}]
[{"$f":"'V. Cloud Security'!A64","v":3360},{"$f":"'V. Cloud Security'!K64","v":3},{"$f":"'V. Cloud Security'!L64","v":0},{"$f":"'V. Cloud Security'!Z64","v":0},{"$f":"'V. Cloud Security'!B64","v":"V.1.15.4"},{"$f":"'V. Cloud Security'!C64","v":"View real-time service interruptions?"},{"$f":"'V. Cloud Security'!D64","v":0},{"$f":"'V. Cloud Security'!E64","v":0},{"$f":"'V. Cloud Security'!H64","v":0},{"$f":"'V. Cloud Security'!I64","v":"12.4.1                                                     15.2.1"},{"$f":"'V. Cloud Security'!J64","v":"Event Logging,\nMonitoring And Review Of Supplier Services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA64","v":"WP.1.H.9, WP.1.H.10"}]
[{"$f":"'V. Cloud Security'!A65","v":3361},{"$f":"'V. Cloud Security'!K65","v":3},{"$f":"'V. Cloud Security'!L65","v":0},{"$f":"'V. Cloud Security'!Z65","v":0},{"$f":"'V. Cloud Security'!B65","v":"V.1.15.5"},{"$f":"'V. Cloud Security'!C65","v":"View maintenance window information?"},{"$f":"'V. Cloud Security'!D65","v":0},{"$f":"'V. Cloud Security'!E65","v":0},{"$f":"'V. Cloud Security'!H65","v":0},{"$f":"'V. Cloud Security'!I65","v":"12.4.1                                                     15.2.1"},{"$f":"'V. Cloud Security'!J65","v":"Event Logging,\nMonitoring And Review Of Supplier Services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA65","v":"WP.1.H.10"}]
[{"$f":"'V. Cloud Security'!A66","v":3362},{"$f":"'V. Cloud Security'!K66","v":3},{"$f":"'V. Cloud Security'!L66","v":0},{"$f":"'V. Cloud Security'!Z66","v":0},{"$f":"'V. Cloud Security'!B66","v":"V.1.15.6"},{"$f":"'V. Cloud Security'!C66","v":"View access logs?"},{"$f":"'V. Cloud Security'!D66","v":0},{"$f":"'V. Cloud Security'!E66","v":0},{"$f":"'V. Cloud Security'!H66","v":0},{"$f":"'V. Cloud Security'!I66","v":"12.4.1                                                     15.2.1"},{"$f":"'V. Cloud Security'!J66","v":"Event Logging,\nMonitoring And Review Of Supplier Services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA66","v":"WP.1.H.9, WP.1.H.10"}]
[{"$f":"'V. Cloud Security'!A67","v":3363},{"$f":"'V. Cloud Security'!K67","v":3},{"$f":"'V. Cloud Security'!L67","v":0},{"$f":"'V. Cloud Security'!Z67","v":0},{"$f":"'V. Cloud Security'!B67","v":"V.1.15.7"},{"$f":"'V. Cloud Security'!C67","v":"Create or modify a new cloud instance?"},{"$f":"'V. Cloud Security'!D67","v":0},{"$f":"'V. Cloud Security'!E67","v":0},{"$f":"'V. Cloud Security'!H67","v":0},{"$f":"'V. Cloud Security'!I67","v":"9.2.3.b "},{"$f":"'V. Cloud Security'!J67","v":"Management of privileged access rights"},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A68","v":3364},{"$f":"'V. Cloud Security'!K68","v":3},{"$f":"'V. Cloud Security'!L68","v":0},{"$f":"'V. Cloud Security'!Z68","v":0},{"$f":"'V. Cloud Security'!B68","v":"V.1.15.8"},{"$f":"'V. Cloud Security'!C68","v":"View system health and status?"},{"$f":"'V. Cloud Security'!D68","v":0},{"$f":"'V. Cloud Security'!E68","v":0},{"$f":"'V. Cloud Security'!H68","v":0},{"$f":"'V. Cloud Security'!I68","v":"9.2.3"},{"$f":"'V. Cloud Security'!J68","v":"Management of privileged access rights"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA68","v":"WP.1.H.9, WP.1.H.10"}]
[{"$f":"'V. Cloud Security'!A69","v":3365},{"$f":"'V. Cloud Security'!K69","v":3},{"$f":"'V. Cloud Security'!L69","v":0},{"$f":"'V. Cloud Security'!Z69","v":0},{"$f":"'V. Cloud Security'!B69","v":"V.1.15.9"},{"$f":"'V. Cloud Security'!C69","v":"Create IP access lists?"},{"$f":"'V. Cloud Security'!D69","v":0},{"$f":"'V. Cloud Security'!E69","v":0},{"$f":"'V. Cloud Security'!H69","v":0},{"$f":"'V. Cloud Security'!I69","v":"9.2.3"},{"$f":"'V. Cloud Security'!J69","v":"Management of privileged access rights"},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A70","v":3366},{"$f":"'V. Cloud Security'!K70","v":3},{"$f":"'V. Cloud Security'!L70","v":0},{"$f":"'V. Cloud Security'!Z70","v":0},{"$f":"'V. Cloud Security'!B70","v":"V.1.15.10"},{"$f":"'V. Cloud Security'!C70","v":"View security events and alerts?"},{"$f":"'V. Cloud Security'!D70","v":0},{"$f":"'V. Cloud Security'!E70","v":0},{"$f":"'V. Cloud Security'!H70","v":0},{"$f":"'V. Cloud Security'!I70","v":"9.2.3"},{"$f":"'V. Cloud Security'!J70","v":"Management of privileged access rights"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA70","v":"WP.1.H.9, WP.1.H.10"}]
[{"$f":"'V. Cloud Security'!A71","v":3367},{"$f":"'V. Cloud Security'!K71","v":3},{"$f":"'V. Cloud Security'!L71","v":0},{"$f":"'V. Cloud Security'!Z71","v":0},{"$f":"'V. Cloud Security'!B71","v":"V.1.15.11"},{"$f":"'V. Cloud Security'!C71","v":"Remote administrative access to the systems?"},{"$f":"'V. Cloud Security'!D71","v":0},{"$f":"'V. Cloud Security'!E71","v":0},{"$f":"'V. Cloud Security'!H71","v":0},{"$f":"'V. Cloud Security'!I71","v":"9.2.3"},{"$f":"'V. Cloud Security'!J71","v":"Management of privileged access rights"},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A72","v":3368},{"$f":"'V. Cloud Security'!K72","v":3},{"$f":"'V. Cloud Security'!L72","v":0},{"$f":"'V. Cloud Security'!Z72","v":0},{"$f":"'V. Cloud Security'!B72","v":"V.1.15.12"},{"$f":"'V. Cloud Security'!C72","v":"View raw system and application logs?"},{"$f":"'V. Cloud Security'!D72","v":0},{"$f":"'V. Cloud Security'!E72","v":0},{"$f":"'V. Cloud Security'!H72","v":0},{"$f":"'V. Cloud Security'!I72","v":"9.2.3"},{"$f":"'V. Cloud Security'!J72","v":"Management of privileged access rights"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA72","v":"WP.1.H.9, WP.1.H.10"}]
[{"$f":"'V. Cloud Security'!A73","v":3369},{"$f":"'V. Cloud Security'!K73","v":3},{"$f":"'V. Cloud Security'!L73","v":0},{"$f":"'V. Cloud Security'!Z73","v":0},{"$f":"'V. Cloud Security'!B73","v":"V.1.15.13"},{"$f":"'V. Cloud Security'!C73","v":"Specify data retention periods?"},{"$f":"'V. Cloud Security'!D73","v":0},{"$f":"'V. Cloud Security'!E73","v":0},{"$f":"'V. Cloud Security'!H73","v":0},{"$f":"'V. Cloud Security'!I73","v":"9.2.3"},{"$f":"'V. Cloud Security'!J73","v":"Management of privileged access rights"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA73","v":"WP.1.K.2, WP.1.K.4"}]
[{"$f":"'V. Cloud Security'!A74","v":3370},{"$f":"'V. Cloud Security'!K74","v":3},{"$f":"'V. Cloud Security'!L74","v":0},{"$f":"'V. Cloud Security'!Z74","v":0},{"$f":"'V. Cloud Security'!B74","v":"V.1.15.14"},{"$f":"'V. Cloud Security'!C74","v":"Delete data on request?"},{"$f":"'V. Cloud Security'!D74","v":0},{"$f":"'V. Cloud Security'!E74","v":0},{"$f":"'V. Cloud Security'!H74","v":0},{"$f":"'V. Cloud Security'!I74","v":"9.2.3"},{"$f":"'V. Cloud Security'!J74","v":"Management of privileged access rights"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA74","v":"WP.1.K.2, WP.1.K.3"}]
[{"$f":"'V. Cloud Security'!A75","v":3371},{"$f":"'V. Cloud Security'!K75","v":3},{"$f":"'V. Cloud Security'!L75","v":0},{"$f":"'V. Cloud Security'!Z75","v":0},{"$f":"'V. Cloud Security'!B75","v":"V.1.15.15"},{"$f":"'V. Cloud Security'!C75","v":"Data extraction tool or process to allow retrieval of data?"},{"$f":"'V. Cloud Security'!D75","v":0},{"$f":"'V. Cloud Security'!E75","v":0},{"$f":"'V. Cloud Security'!H75","v":0},{"$f":"'V. Cloud Security'!I75","v":"9.2.3"},{"$f":"'V. Cloud Security'!J75","v":"Management of privileged access rights"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA75","v":"WP.1.K.5"}]
[{"$f":"'V. Cloud Security'!A76","v":3372},{"$f":"'V. Cloud Security'!K76","v":3},{"$f":"'V. Cloud Security'!L76","v":0},{"$f":"'V. Cloud Security'!Z76","v":0},{"$f":"'V. Cloud Security'!B76","v":"V.1.15.16"},{"$f":"'V. Cloud Security'!C76","v":"Create image snapshots?"},{"$f":"'V. Cloud Security'!D76","v":0},{"$f":"'V. Cloud Security'!E76","v":0},{"$f":"'V. Cloud Security'!H76","v":0},{"$f":"'V. Cloud Security'!I76","v":"9.2.3"},{"$f":"'V. Cloud Security'!J76","v":"Management of privileged access rights"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA76","v":"WP.1.D.1, WP.1.D.2"}]
[{"$f":"'V. Cloud Security'!A77","v":3373},{"$f":"'V. Cloud Security'!K77","v":2},{"$f":"'V. Cloud Security'!L77","v":0},{"$f":"'V. Cloud Security'!Z77","v":1},{"$f":"'V. Cloud Security'!B77","v":"V.1.16"},{"$f":"'V. Cloud Security'!C77","v":"Is there a management approved process to ensure that image snapshots containing Scoped Data are authorized prior to being snapped?"},{"$f":"'V. Cloud Security'!D77","v":0},{"$f":"'V. Cloud Security'!E77","v":0},{"$f":"'V. Cloud Security'!H77","v":0},{"$f":"'V. Cloud Security'!I77","v":"9.2.3"},{"$f":"'V. Cloud Security'!J77","v":"Management of privileged access rights"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA77","v":"WP.1.D.2"}]
[{"$f":"'V. Cloud Security'!A78","v":3374},{"$f":"'V. Cloud Security'!K78","v":3},{"$f":"'V. Cloud Security'!L78","v":0},{"$f":"'V. Cloud Security'!Z78","v":0},{"$f":"'V. Cloud Security'!B78","v":"V.1.16.1"},{"$f":"'V. Cloud Security'!C78","v":"Are image snapshots containing Scoped Data stored in an environment where the security controls protecting them are commensurate with the production environment?"},{"$f":"'V. Cloud Security'!D78","v":0},{"$f":"'V. Cloud Security'!E78","v":0},{"$f":"'V. Cloud Security'!H78","v":0},{"$f":"'V. Cloud Security'!I78","v":"9.2.3"},{"$f":"'V. Cloud Security'!J78","v":"Management of privileged access rights"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA78","v":"WP.1.D.2"}]
[{"$f":"'V. Cloud Security'!A79","v":3375},{"$f":"'V. Cloud Security'!K79","v":2},{"$f":"'V. Cloud Security'!L79","v":1},{"$f":"'V. Cloud Security'!Z79","v":0},{"$f":"'V. Cloud Security'!B79","v":"V.1.17"},{"$f":"'V. Cloud Security'!C79","v":"Are clients provided the ability to:"},{"$f":"'V. Cloud Security'!D79","v":0},{"$f":"'V. Cloud Security'!E79","v":0},{"$f":"'V. Cloud Security'!H79","v":0},{"$f":"'V. Cloud Security'!I79","v":"NA"},{"$f":"'V. Cloud Security'!J79","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA79","v":"WP.1.A.10"}]
[{"$f":"'V. Cloud Security'!A80","v":3376},{"$f":"'V. Cloud Security'!K80","v":3},{"$f":"'V. Cloud Security'!L80","v":0},{"$f":"'V. Cloud Security'!Z80","v":0},{"$f":"'V. Cloud Security'!B80","v":"V.1.17.1"},{"$f":"'V. Cloud Security'!C80","v":"Execute a vulnerability scan of the external environment?"},{"$f":"'V. Cloud Security'!D80","v":0},{"$f":"'V. Cloud Security'!E80","v":0},{"$f":"'V. Cloud Security'!H80","v":"I.1 Application Vulnerability Assessments/Ethical Hacking"},{"$f":"'V. Cloud Security'!I80","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!J80","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A81","v":3377},{"$f":"'V. Cloud Security'!K81","v":3},{"$f":"'V. Cloud Security'!L81","v":0},{"$f":"'V. Cloud Security'!Z81","v":0},{"$f":"'V. Cloud Security'!B81","v":"V.1.17.2"},{"$f":"'V. Cloud Security'!C81","v":"Execute a penetration test of the external environment?"},{"$f":"'V. Cloud Security'!D81","v":0},{"$f":"'V. Cloud Security'!E81","v":0},{"$f":"'V. Cloud Security'!H81","v":"I.1 Application Vulnerability Assessments/Ethical Hacking"},{"$f":"'V. Cloud Security'!I81","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!J81","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA81","v":"WP.1.A.10, WP.1.I.7.d"}]
[{"$f":"'V. Cloud Security'!A82","v":3378},{"$f":"'V. Cloud Security'!K82","v":3},{"$f":"'V. Cloud Security'!L82","v":0},{"$f":"'V. Cloud Security'!Z82","v":0},{"$f":"'V. Cloud Security'!B82","v":"V.1.17.3"},{"$f":"'V. Cloud Security'!C82","v":"Execute a secure code review?"},{"$f":"'V. Cloud Security'!D82","v":0},{"$f":"'V. Cloud Security'!E82","v":0},{"$f":"'V. Cloud Security'!H82","v":"I.2 Secure Systems Development Life Cycle Code Reviews"},{"$f":"'V. Cloud Security'!I82","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!J82","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A83","v":3379},{"$f":"'V. Cloud Security'!K83","v":2},{"$f":"'V. Cloud Security'!L83","v":0},{"$f":"'V. Cloud Security'!Z83","v":1},{"$f":"'V. Cloud Security'!B83","v":"V.1.18"},{"$f":"'V. Cloud Security'!C83","v":"Is there a cloud audit program to address client audit and assessment requirements? If yes, does this program permit:"},{"$f":"'V. Cloud Security'!D83","v":0},{"$f":"'V. Cloud Security'!E83","v":0},{"$f":"'V. Cloud Security'!H83","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!I83","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!J83","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,10.8]
[{"$f":"'V. Cloud Security'!A84","v":3380},{"$f":"'V. Cloud Security'!K84","v":3},{"$f":"'V. Cloud Security'!L84","v":0},{"$f":"'V. Cloud Security'!Z84","v":0},{"$f":"'V. Cloud Security'!B84","v":"V.1.18.1"},{"$f":"'V. Cloud Security'!C84","v":"Onsite assessments by clients?"},{"$f":"'V. Cloud Security'!D84","v":0},{"$f":"'V. Cloud Security'!E84","v":0},{"$f":"'V. Cloud Security'!H84","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!I84","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!J84","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA84","v":"WP.1.F.5"}]
[{"$f":"'V. Cloud Security'!A85","v":3381},{"$f":"'V. Cloud Security'!K85","v":3},{"$f":"'V. Cloud Security'!L85","v":0},{"$f":"'V. Cloud Security'!Z85","v":0},{"$f":"'V. Cloud Security'!B85","v":"V.1.18.2"},{"$f":"'V. Cloud Security'!C85","v":"Program documentation describing audit capabilities, roles and responsibilities?"},{"$f":"'V. Cloud Security'!D85","v":0},{"$f":"'V. Cloud Security'!E85","v":0},{"$f":"'V. Cloud Security'!H85","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!I85","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!J85","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA85","v":"WP.1.F.4, WP.1.F.5 "}]
[{"$f":"'V. Cloud Security'!A86","v":3382},{"$f":"'V. Cloud Security'!K86","v":3},{"$f":"'V. Cloud Security'!L86","v":0},{"$f":"'V. Cloud Security'!Z86","v":0},{"$f":"'V. Cloud Security'!B86","v":"V.1.18.3"},{"$f":"'V. Cloud Security'!C86","v":"Scheduled internal audits?"},{"$f":"'V. Cloud Security'!D86","v":0},{"$f":"'V. Cloud Security'!E86","v":0},{"$f":"'V. Cloud Security'!H86","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!I86","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!J86","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA86","v":"WP.1.J.6"}]
[{"$f":"'V. Cloud Security'!A87","v":3383},{"$f":"'V. Cloud Security'!K87","v":3},{"$f":"'V. Cloud Security'!L87","v":0},{"$f":"'V. Cloud Security'!Z87","v":0},{"$f":"'V. Cloud Security'!B87","v":"V.1.18.4"},{"$f":"'V. Cloud Security'!C87","v":"Controls verification and validation performed by independent, third party information security professionals?"},{"$f":"'V. Cloud Security'!D87","v":0},{"$f":"'V. Cloud Security'!E87","v":0},{"$f":"'V. Cloud Security'!H87","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!I87","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!J87","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA87","v":"WP.1.F.4, WP.1.F.5 "}]
[{"$f":"'V. Cloud Security'!A88","v":3384},{"$f":"'V. Cloud Security'!K88","v":2},{"$f":"'V. Cloud Security'!L88","v":0},{"$f":"'V. Cloud Security'!Z88","v":0},{"$f":"'V. Cloud Security'!B88","v":"V.1.19"},{"$f":"'V. Cloud Security'!C88","v":"Is there a full time internal security team assigned to protecting the cloud infrastructure?"},{"$f":"'V. Cloud Security'!D88","v":0},{"$f":"'V. Cloud Security'!E88","v":0},{"$f":"'V. Cloud Security'!H88","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!I88","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!J88","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A89","v":3385},{"$f":"'V. Cloud Security'!K89","v":2},{"$f":"'V. Cloud Security'!L89","v":1},{"$f":"'V. Cloud Security'!Z89","v":0},{"$f":"'V. Cloud Security'!B89","v":"V.1.20"},{"$f":"'V. Cloud Security'!C89","v":"Are the following artifacts available during a client audit:"},{"$f":"'V. Cloud Security'!D89","v":0},{"$f":"'V. Cloud Security'!E89","v":0},{"$f":"'V. Cloud Security'!H89","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!I89","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!J89","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA89","v":"WP.1.A.1, WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A90","v":3386},{"$f":"'V. Cloud Security'!K90","v":3},{"$f":"'V. Cloud Security'!L90","v":0},{"$f":"'V. Cloud Security'!Z90","v":0},{"$f":"'V. Cloud Security'!B90","v":"V.1.20.1"},{"$f":"'V. Cloud Security'!C90","v":"Cloud topology and architecture diagrams?"},{"$f":"'V. Cloud Security'!D90","v":0},{"$f":"'V. Cloud Security'!E90","v":0},{"$f":"'V. Cloud Security'!H90","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!I90","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!J90","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA90","v":"WP.1.A.1, WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A91","v":3387},{"$f":"'V. Cloud Security'!K91","v":3},{"$f":"'V. Cloud Security'!L91","v":0},{"$f":"'V. Cloud Security'!Z91","v":0},{"$f":"'V. Cloud Security'!B91","v":"V.1.20.2"},{"$f":"'V. Cloud Security'!C91","v":"Connectivity diagrams?"},{"$f":"'V. Cloud Security'!D91","v":0},{"$f":"'V. Cloud Security'!E91","v":0},{"$f":"'V. Cloud Security'!H91","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!I91","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!J91","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA91","v":"WP.1.A.1, WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A92","v":3388},{"$f":"'V. Cloud Security'!K92","v":3},{"$f":"'V. Cloud Security'!L92","v":0},{"$f":"'V. Cloud Security'!Z92","v":0},{"$f":"'V. Cloud Security'!B92","v":"V.1.20.3"},{"$f":"'V. Cloud Security'!C92","v":"List of ports that are open externally?"},{"$f":"'V. Cloud Security'!D92","v":0},{"$f":"'V. Cloud Security'!E92","v":0},{"$f":"'V. Cloud Security'!H92","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!I92","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!J92","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA92","v":"WP.1.A.1, WP.1.E.1, WP.1.H.6, WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A93","v":3389},{"$f":"'V. Cloud Security'!K93","v":3},{"$f":"'V. Cloud Security'!L93","v":0},{"$f":"'V. Cloud Security'!Z93","v":0},{"$f":"'V. Cloud Security'!B93","v":"V.1.20.4"},{"$f":"'V. Cloud Security'!C93","v":"Component and system configuration standards?"},{"$f":"'V. Cloud Security'!D93","v":0},{"$f":"'V. Cloud Security'!E93","v":0},{"$f":"'V. Cloud Security'!H93","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!I93","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!J93","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA93","v":"WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A94","v":3390},{"$f":"'V. Cloud Security'!K94","v":3},{"$f":"'V. Cloud Security'!L94","v":0},{"$f":"'V. Cloud Security'!Z94","v":0},{"$f":"'V. Cloud Security'!B94","v":"V.1.20.5"},{"$f":"'V. Cloud Security'!C94","v":"Standard operating procedures?"},{"$f":"'V. Cloud Security'!D94","v":0},{"$f":"'V. Cloud Security'!E94","v":0},{"$f":"'V. Cloud Security'!H94","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!I94","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!J94","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA94","v":"WP.1.K.6"}]
[{"$f":"'V. Cloud Security'!A95","v":3391},{"$f":"'V. Cloud Security'!K95","v":2},{"$f":"'V. Cloud Security'!L95","v":1},{"$f":"'V. Cloud Security'!Z95","v":0},{"$f":"'V. Cloud Security'!B95","v":"V.1.21"},{"$f":"'V. Cloud Security'!C95","v":"Who is responsible for user entitlement audits:"},{"$f":"'V. Cloud Security'!D95","v":0},{"$f":"'V. Cloud Security'!E95","v":0},{"$f":"'V. Cloud Security'!H95","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!I95","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!J95","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA95","v":"WP.1.H.9, WP.1.F.4, WP.1.F.5"}]
[{"$f":"'V. Cloud Security'!A96","v":3392},{"$f":"'V. Cloud Security'!K96","v":3},{"$f":"'V. Cloud Security'!L96","v":0},{"$f":"'V. Cloud Security'!Z96","v":0},{"$f":"'V. Cloud Security'!B96","v":"V.1.21.1"},{"$f":"'V. Cloud Security'!C96","v":"Cloud provider?"},{"$f":"'V. Cloud Security'!D96","v":0},{"$f":"'V. Cloud Security'!E96","v":0},{"$f":"'V. Cloud Security'!H96","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!I96","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!J96","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA96","v":"WP.1.H.9, WP.1.F.4, WP.1.F.5"}]
[{"$f":"'V. Cloud Security'!A97","v":3393},{"$f":"'V. Cloud Security'!K97","v":3},{"$f":"'V. Cloud Security'!L97","v":0},{"$f":"'V. Cloud Security'!Z97","v":0},{"$f":"'V. Cloud Security'!B97","v":"V.1.21.2"},{"$f":"'V. Cloud Security'!C97","v":"Client?"},{"$f":"'V. Cloud Security'!D97","v":0},{"$f":"'V. Cloud Security'!E97","v":0},{"$f":"'V. Cloud Security'!H97","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!I97","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!J97","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA97","v":"WP.1.H.9, WP.1.F.4, WP.1.F.5"}]
[{"$f":"'V. Cloud Security'!A98","v":3394},{"$f":"'V. Cloud Security'!K98","v":2},{"$f":"'V. Cloud Security'!L98","v":0},{"$f":"'V. Cloud Security'!Z98","v":1},{"$f":"'V. Cloud Security'!B98","v":"V.1.22"},{"$f":"'V. Cloud Security'!C98","v":"Is there a formal development methodology in operation? If yes, does this include:"},{"$f":"'V. Cloud Security'!D98","v":0},{"$f":"'V. Cloud Security'!E98","v":0},{"$f":"'V. Cloud Security'!H98","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!I98","v":"12.5.1"},{"$f":"'V. Cloud Security'!J98","v":"Control Of Operational Software"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA98","v":"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3"}]
[{"$f":"'V. Cloud Security'!A99","v":3395},{"$f":"'V. Cloud Security'!K99","v":3},{"$f":"'V. Cloud Security'!L99","v":0},{"$f":"'V. Cloud Security'!Z99","v":0},{"$f":"'V. Cloud Security'!B99","v":"V.1.22.1"},{"$f":"'V. Cloud Security'!C99","v":"Waterfall"},{"$f":"'V. Cloud Security'!D99","v":0},{"$f":"'V. Cloud Security'!E99","v":0},{"$f":"'V. Cloud Security'!H99","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!I99","v":"NA"},{"$f":"'V. Cloud Security'!J99","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA99","v":"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3"}]
[{"$f":"'V. Cloud Security'!A100","v":3396},{"$f":"'V. Cloud Security'!K100","v":3},{"$f":"'V. Cloud Security'!L100","v":0},{"$f":"'V. Cloud Security'!Z100","v":0},{"$f":"'V. Cloud Security'!B100","v":"V.1.22.2"},{"$f":"'V. Cloud Security'!C100","v":"Agile? If yes, what groups:"},{"$f":"'V. Cloud Security'!D100","v":0},{"$f":"'V. Cloud Security'!E100","v":0},{"$f":"'V. Cloud Security'!H100","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!I100","v":"NA"},{"$f":"'V. Cloud Security'!J100","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA100","v":"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3"}]
[{"$f":"'V. Cloud Security'!A101","v":3397},{"$f":"'V. Cloud Security'!K101","v":4},{"$f":"'V. Cloud Security'!L101","v":0},{"$f":"'V. Cloud Security'!Z101","v":0},{"$f":"'V. Cloud Security'!B101","v":"V.1.22.2.1"},{"$f":"'V. Cloud Security'!C101","v":"Development?"},{"$f":"'V. Cloud Security'!D101","v":0},{"$f":"'V. Cloud Security'!E101","v":0},{"$f":"'V. Cloud Security'!H101","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!I101","v":"NA"},{"$f":"'V. Cloud Security'!J101","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA101","v":"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3"}]
[{"$f":"'V. Cloud Security'!A102","v":3398},{"$f":"'V. Cloud Security'!K102","v":4},{"$f":"'V. Cloud Security'!L102","v":0},{"$f":"'V. Cloud Security'!Z102","v":0},{"$f":"'V. Cloud Security'!B102","v":"V.1.22.2.2"},{"$f":"'V. Cloud Security'!C102","v":"QA?"},{"$f":"'V. Cloud Security'!D102","v":0},{"$f":"'V. Cloud Security'!E102","v":0},{"$f":"'V. Cloud Security'!H102","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!I102","v":"NA"},{"$f":"'V. Cloud Security'!J102","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA102","v":"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3"}]
[{"$f":"'V. Cloud Security'!A103","v":3399},{"$f":"'V. Cloud Security'!K103","v":4},{"$f":"'V. Cloud Security'!L103","v":0},{"$f":"'V. Cloud Security'!Z103","v":0},{"$f":"'V. Cloud Security'!B103","v":"V.1.22.2.3"},{"$f":"'V. Cloud Security'!C103","v":"Security?"},{"$f":"'V. Cloud Security'!D103","v":0},{"$f":"'V. Cloud Security'!E103","v":0},{"$f":"'V. Cloud Security'!H103","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!I103","v":"NA"},{"$f":"'V. Cloud Security'!J103","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA103","v":"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3"}]
[{"$f":"'V. Cloud Security'!A104","v":3400},{"$f":"'V. Cloud Security'!K104","v":3},{"$f":"'V. Cloud Security'!L104","v":0},{"$f":"'V. Cloud Security'!Z104","v":0},{"$f":"'V. Cloud Security'!B104","v":"V.1.22.3"},{"$f":"'V. Cloud Security'!C104","v":"Other?"},{"$f":"'V. Cloud Security'!D104","v":0},{"$f":"'V. Cloud Security'!E104","v":0},{"$f":"'V. Cloud Security'!H104","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!I104","v":"NA"},{"$f":"'V. Cloud Security'!J104","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A105","v":3401},{"$f":"'V. Cloud Security'!K105","v":2},{"$f":"'V. Cloud Security'!L105","v":0},{"$f":"'V. Cloud Security'!Z105","v":1},{"$f":"'V. Cloud Security'!B105","v":"V.1.23"},{"$f":"'V. Cloud Security'!C105","v":"Is there a formal process to ensure clients are notified prior to changes being made which may impact their service? If yes, what is the communication method:"},{"$f":"'V. Cloud Security'!D105","v":0},{"$f":"'V. Cloud Security'!E105","v":0},{"$f":"'V. Cloud Security'!H105","v":"G.21 Change Control"},{"$f":"'V. Cloud Security'!I105","v":"12.1.2"},{"$f":"'V. Cloud Security'!J105","v":"Change management"},null,null,6.4,null,null,{"$f":"'V. Cloud Security'!AA105","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A106","v":3402},{"$f":"'V. Cloud Security'!K106","v":3},{"$f":"'V. Cloud Security'!L106","v":0},{"$f":"'V. Cloud Security'!Z106","v":0},{"$f":"'V. Cloud Security'!B106","v":"V.1.23.1"},{"$f":"'V. Cloud Security'!C106","v":"Post to website or portal?"},{"$f":"'V. Cloud Security'!D106","v":0},{"$f":"'V. Cloud Security'!E106","v":0},{"$f":"'V. Cloud Security'!H106","v":"G.21 Change Control"},{"$f":"'V. Cloud Security'!I106","v":"NA"},{"$f":"'V. Cloud Security'!J106","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA106","v":"WP.1.F.6, WP.1.E.3, WP.1.H.10"}]
[{"$f":"'V. Cloud Security'!A107","v":3403},{"$f":"'V. Cloud Security'!K107","v":3},{"$f":"'V. Cloud Security'!L107","v":0},{"$f":"'V. Cloud Security'!Z107","v":0},{"$f":"'V. Cloud Security'!B107","v":"V.1.23.2"},{"$f":"'V. Cloud Security'!C107","v":"Email?"},{"$f":"'V. Cloud Security'!D107","v":0},{"$f":"'V. Cloud Security'!E107","v":0},{"$f":"'V. Cloud Security'!H107","v":"G.21 Change Control"},{"$f":"'V. Cloud Security'!I107","v":"NA"},{"$f":"'V. Cloud Security'!J107","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA107","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A108","v":3404},{"$f":"'V. Cloud Security'!K108","v":3},{"$f":"'V. Cloud Security'!L108","v":0},{"$f":"'V. Cloud Security'!Z108","v":0},{"$f":"'V. Cloud Security'!B108","v":"V.1.23.3"},{"$f":"'V. Cloud Security'!C108","v":"Verbal?"},{"$f":"'V. Cloud Security'!D108","v":0},{"$f":"'V. Cloud Security'!E108","v":0},{"$f":"'V. Cloud Security'!H108","v":"G.21 Change Control"},{"$f":"'V. Cloud Security'!I108","v":"NA"},{"$f":"'V. Cloud Security'!J108","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA108","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A109","v":3405},{"$f":"'V. Cloud Security'!K109","v":3},{"$f":"'V. Cloud Security'!L109","v":0},{"$f":"'V. Cloud Security'!Z109","v":0},{"$f":"'V. Cloud Security'!B109","v":"V.1.23.4"},{"$f":"'V. Cloud Security'!C109","v":"Other?"},{"$f":"'V. Cloud Security'!D109","v":0},{"$f":"'V. Cloud Security'!E109","v":0},{"$f":"'V. Cloud Security'!H109","v":"G.21 Change Control"},{"$f":"'V. Cloud Security'!I109","v":"NA"},{"$f":"'V. Cloud Security'!J109","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA109","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A110","v":3406},{"$f":"'V. Cloud Security'!K110","v":2},{"$f":"'V. Cloud Security'!L110","v":0},{"$f":"'V. Cloud Security'!Z110","v":1},{"$f":"'V. Cloud Security'!B110","v":"V.1.24"},{"$f":"'V. Cloud Security'!C110","v":"Is there a scheduled maintenance window? If yes, what is the frequency:"},{"$f":"'V. Cloud Security'!D110","v":0},{"$f":"'V. Cloud Security'!E110","v":0},{"$f":"'V. Cloud Security'!H110","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I110","v":"12.6.1 "},{"$f":"'V. Cloud Security'!J110","v":"Management of technical vulnerabilities"},null,null,"11.3.1, 11.3.2",null,null,{"$f":"'V. Cloud Security'!AA110","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A111","v":3407},{"$f":"'V. Cloud Security'!K111","v":3},{"$f":"'V. Cloud Security'!L111","v":0},{"$f":"'V. Cloud Security'!Z111","v":0},{"$f":"'V. Cloud Security'!B111","v":"V.1.24.1"},{"$f":"'V. Cloud Security'!C111","v":"Daily?"},{"$f":"'V. Cloud Security'!D111","v":0},{"$f":"'V. Cloud Security'!E111","v":0},{"$f":"'V. Cloud Security'!H111","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I111","v":"NA"},{"$f":"'V. Cloud Security'!J111","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA111","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A112","v":3408},{"$f":"'V. Cloud Security'!K112","v":3},{"$f":"'V. Cloud Security'!L112","v":0},{"$f":"'V. Cloud Security'!Z112","v":0},{"$f":"'V. Cloud Security'!B112","v":"V.1.24.2"},{"$f":"'V. Cloud Security'!C112","v":"Weekly?"},{"$f":"'V. Cloud Security'!D112","v":0},{"$f":"'V. Cloud Security'!E112","v":0},{"$f":"'V. Cloud Security'!H112","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I112","v":"NA"},{"$f":"'V. Cloud Security'!J112","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA112","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A113","v":3409},{"$f":"'V. Cloud Security'!K113","v":3},{"$f":"'V. Cloud Security'!L113","v":0},{"$f":"'V. Cloud Security'!Z113","v":0},{"$f":"'V. Cloud Security'!B113","v":"V.1.24.3"},{"$f":"'V. Cloud Security'!C113","v":"Biweekly?"},{"$f":"'V. Cloud Security'!D113","v":0},{"$f":"'V. Cloud Security'!E113","v":0},{"$f":"'V. Cloud Security'!H113","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I113","v":"NA"},{"$f":"'V. Cloud Security'!J113","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA113","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A114","v":3410},{"$f":"'V. Cloud Security'!K114","v":3},{"$f":"'V. Cloud Security'!L114","v":0},{"$f":"'V. Cloud Security'!Z114","v":0},{"$f":"'V. Cloud Security'!B114","v":"V.1.24.4"},{"$f":"'V. Cloud Security'!C114","v":"Monthly?"},{"$f":"'V. Cloud Security'!D114","v":0},{"$f":"'V. Cloud Security'!E114","v":0},{"$f":"'V. Cloud Security'!H114","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I114","v":"NA"},{"$f":"'V. Cloud Security'!J114","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA114","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A115","v":3411},{"$f":"'V. Cloud Security'!K115","v":3},{"$f":"'V. Cloud Security'!L115","v":0},{"$f":"'V. Cloud Security'!Z115","v":0},{"$f":"'V. Cloud Security'!B115","v":"V.1.24.5"},{"$f":"'V. Cloud Security'!C115","v":"Other?"},{"$f":"'V. Cloud Security'!D115","v":0},{"$f":"'V. Cloud Security'!E115","v":0},{"$f":"'V. Cloud Security'!H115","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I115","v":"NA"},{"$f":"'V. Cloud Security'!J115","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA115","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A116","v":3412},{"$f":"'V. Cloud Security'!K116","v":2},{"$f":"'V. Cloud Security'!L116","v":0},{"$f":"'V. Cloud Security'!Z116","v":1},{"$f":"'V. Cloud Security'!B116","v":"V.1.25"},{"$f":"'V. Cloud Security'!C116","v":"Is there a scheduled maintenance window which results in client downtime? If yes, what is the downtime:"},{"$f":"'V. Cloud Security'!D116","v":0},{"$f":"'V. Cloud Security'!E116","v":0},{"$f":"'V. Cloud Security'!H116","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I116","v":"14.2.2.l"},{"$f":"'V. Cloud Security'!J116","v":"System change control procedures"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA116","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A117","v":3413},{"$f":"'V. Cloud Security'!K117","v":3},{"$f":"'V. Cloud Security'!L117","v":0},{"$f":"'V. Cloud Security'!Z117","v":0},{"$f":"'V. Cloud Security'!B117","v":"V.1.25.1"},{"$f":"'V. Cloud Security'!C117","v":"< 30 min?"},{"$f":"'V. Cloud Security'!D117","v":0},{"$f":"'V. Cloud Security'!E117","v":0},{"$f":"'V. Cloud Security'!H117","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I117","v":"NA"},{"$f":"'V. Cloud Security'!J117","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA117","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A118","v":3414},{"$f":"'V. Cloud Security'!K118","v":3},{"$f":"'V. Cloud Security'!L118","v":0},{"$f":"'V. Cloud Security'!Z118","v":0},{"$f":"'V. Cloud Security'!B118","v":"V.1.25.2"},{"$f":"'V. Cloud Security'!C118","v":">30 min < 60 min?"},{"$f":"'V. Cloud Security'!D118","v":0},{"$f":"'V. Cloud Security'!E118","v":0},{"$f":"'V. Cloud Security'!H118","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I118","v":"NA"},{"$f":"'V. Cloud Security'!J118","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA118","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A119","v":3415},{"$f":"'V. Cloud Security'!K119","v":3},{"$f":"'V. Cloud Security'!L119","v":0},{"$f":"'V. Cloud Security'!Z119","v":0},{"$f":"'V. Cloud Security'!B119","v":"V.1.25.3"},{"$f":"'V. Cloud Security'!C119","v":">60 min < 120 min?"},{"$f":"'V. Cloud Security'!D119","v":0},{"$f":"'V. Cloud Security'!E119","v":0},{"$f":"'V. Cloud Security'!H119","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I119","v":"NA"},{"$f":"'V. Cloud Security'!J119","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA119","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A120","v":3416},{"$f":"'V. Cloud Security'!K120","v":3},{"$f":"'V. Cloud Security'!L120","v":0},{"$f":"'V. Cloud Security'!Z120","v":0},{"$f":"'V. Cloud Security'!B120","v":"V.1.25.4"},{"$f":"'V. Cloud Security'!C120","v":">120 min < 180 min?"},{"$f":"'V. Cloud Security'!D120","v":0},{"$f":"'V. Cloud Security'!E120","v":0},{"$f":"'V. Cloud Security'!H120","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I120","v":"NA"},{"$f":"'V. Cloud Security'!J120","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA120","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A121","v":3417},{"$f":"'V. Cloud Security'!K121","v":3},{"$f":"'V. Cloud Security'!L121","v":0},{"$f":"'V. Cloud Security'!Z121","v":0},{"$f":"'V. Cloud Security'!B121","v":"V.1.25.5"},{"$f":"'V. Cloud Security'!C121","v":"Other?"},{"$f":"'V. Cloud Security'!D121","v":0},{"$f":"'V. Cloud Security'!E121","v":0},{"$f":"'V. Cloud Security'!H121","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I121","v":"NA"},{"$f":"'V. Cloud Security'!J121","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA121","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A122","v":3418},{"$f":"'V. Cloud Security'!K122","v":2},{"$f":"'V. Cloud Security'!L122","v":0},{"$f":"'V. Cloud Security'!Z122","v":1},{"$f":"'V. Cloud Security'!B122","v":"V.1.26"},{"$f":"'V. Cloud Security'!C122","v":"Is there an online incident response status portal, which outlines planned and unplanned outages? If yes, how long after an unplanned outage is this updated:"},{"$f":"'V. Cloud Security'!D122","v":0},{"$f":"'V. Cloud Security'!E122","v":0},{"$f":"'V. Cloud Security'!H122","v":"J. Information Security Incident Management, P.8 Privacy Incident and Response Management"},{"$f":"'V. Cloud Security'!I122","v":"14.2.2"},{"$f":"'V. Cloud Security'!J122","v":"System change control procedures"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA122","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A123","v":3419},{"$f":"'V. Cloud Security'!K123","v":3},{"$f":"'V. Cloud Security'!L123","v":0},{"$f":"'V. Cloud Security'!Z123","v":0},{"$f":"'V. Cloud Security'!B123","v":"V.1.26.1"},{"$f":"'V. Cloud Security'!C123","v":"Real-time?"},{"$f":"'V. Cloud Security'!D123","v":0},{"$f":"'V. Cloud Security'!E123","v":0},{"$f":"'V. Cloud Security'!H123","v":0},{"$f":"'V. Cloud Security'!I123","v":"NA"},{"$f":"'V. Cloud Security'!J123","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA123","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A124","v":3420},{"$f":"'V. Cloud Security'!K124","v":3},{"$f":"'V. Cloud Security'!L124","v":0},{"$f":"'V. Cloud Security'!Z124","v":0},{"$f":"'V. Cloud Security'!B124","v":"V.1.26.2"},{"$f":"'V. Cloud Security'!C124","v":"< 30 min?"},{"$f":"'V. Cloud Security'!D124","v":0},{"$f":"'V. Cloud Security'!E124","v":0},{"$f":"'V. Cloud Security'!H124","v":0},{"$f":"'V. Cloud Security'!I124","v":"NA"},{"$f":"'V. Cloud Security'!J124","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA124","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A125","v":3421},{"$f":"'V. Cloud Security'!K125","v":3},{"$f":"'V. Cloud Security'!L125","v":0},{"$f":"'V. Cloud Security'!Z125","v":0},{"$f":"'V. Cloud Security'!B125","v":"V.1.26.3"},{"$f":"'V. Cloud Security'!C125","v":">30 min < 60 min?"},{"$f":"'V. Cloud Security'!D125","v":0},{"$f":"'V. Cloud Security'!E125","v":0},{"$f":"'V. Cloud Security'!H125","v":0},{"$f":"'V. Cloud Security'!I125","v":"NA"},{"$f":"'V. Cloud Security'!J125","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA125","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A126","v":3422},{"$f":"'V. Cloud Security'!K126","v":3},{"$f":"'V. Cloud Security'!L126","v":0},{"$f":"'V. Cloud Security'!Z126","v":0},{"$f":"'V. Cloud Security'!B126","v":"V.1.26.4"},{"$f":"'V. Cloud Security'!C126","v":">60 min < 120 min?"},{"$f":"'V. Cloud Security'!D126","v":0},{"$f":"'V. Cloud Security'!E126","v":0},{"$f":"'V. Cloud Security'!H126","v":0},{"$f":"'V. Cloud Security'!I126","v":"NA"},{"$f":"'V. Cloud Security'!J126","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA126","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A127","v":3423},{"$f":"'V. Cloud Security'!K127","v":3},{"$f":"'V. Cloud Security'!L127","v":0},{"$f":"'V. Cloud Security'!Z127","v":0},{"$f":"'V. Cloud Security'!B127","v":"V.1.26.5"},{"$f":"'V. Cloud Security'!C127","v":">120 min < 180 min?"},{"$f":"'V. Cloud Security'!D127","v":0},{"$f":"'V. Cloud Security'!E127","v":0},{"$f":"'V. Cloud Security'!H127","v":0},{"$f":"'V. Cloud Security'!I127","v":"NA"},{"$f":"'V. Cloud Security'!J127","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA127","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A128","v":3424},{"$f":"'V. Cloud Security'!K128","v":3},{"$f":"'V. Cloud Security'!L128","v":0},{"$f":"'V. Cloud Security'!Z128","v":0},{"$f":"'V. Cloud Security'!B128","v":"V.1.26.6"},{"$f":"'V. Cloud Security'!C128","v":"Other?"},{"$f":"'V. Cloud Security'!D128","v":0},{"$f":"'V. Cloud Security'!E128","v":0},{"$f":"'V. Cloud Security'!H128","v":0},{"$f":"'V. Cloud Security'!I128","v":"NA"},{"$f":"'V. Cloud Security'!J128","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA128","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A129","v":3425},{"$f":"'V. Cloud Security'!K129","v":2},{"$f":"'V. Cloud Security'!L129","v":0},{"$f":"'V. Cloud Security'!Z129","v":0},{"$f":"'V. Cloud Security'!B129","v":"V.1.27"},{"$f":"'V. Cloud Security'!C129","v":"Is there the option for clients to opt-in or opt-out of specific features in releases?"},{"$f":"'V. Cloud Security'!D129","v":0},{"$f":"'V. Cloud Security'!E129","v":0},{"$f":"'V. Cloud Security'!H129","v":0},{"$f":"'V. Cloud Security'!I129","v":"14.2.2"},{"$f":"'V. Cloud Security'!J129","v":"System change control procedures"},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A130","v":3426},{"$f":"'V. Cloud Security'!K130","v":2},{"$f":"'V. Cloud Security'!L130","v":0},{"$f":"'V. Cloud Security'!Z130","v":1},{"$f":"'V. Cloud Security'!B130","v":"V.1.28"},{"$f":"'V. Cloud Security'!C130","v":"Is there a 24x7x365 staffed phone number available to clients to report security incidents?"},{"$f":"'V. Cloud Security'!D130","v":0},{"$f":"'V. Cloud Security'!E130","v":0},{"$f":"'V. Cloud Security'!H130","v":"J. Information Security Incident Management, P.8 Privacy Incident and Response Management"},{"$f":"'V. Cloud Security'!I130","v":"15.1.1.h "},{"$f":"'V. Cloud Security'!J130","v":"Information security policy for supplier relationships"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA130","v":"WP.1.E.3, WP.1.G.10"}]
[{"$f":"'V. Cloud Security'!A131","v":3427},{"$f":"'V. Cloud Security'!K131","v":2},{"$f":"'V. Cloud Security'!L131","v":0},{"$f":"'V. Cloud Security'!Z131","v":1},{"$f":"'V. Cloud Security'!B131","v":"V.1.29"},{"$f":"'V. Cloud Security'!C131","v":"Are applications created and released into production? If yes, what is the release frequency:"},{"$f":"'V. Cloud Security'!D131","v":0},{"$f":"'V. Cloud Security'!E131","v":0},{"$f":"'V. Cloud Security'!H131","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'V. Cloud Security'!I131","v":"12.5.1"},{"$f":"'V. Cloud Security'!J131","v":"Control Of Operational Software"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA131","v":"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A132","v":3428},{"$f":"'V. Cloud Security'!K132","v":3},{"$f":"'V. Cloud Security'!L132","v":0},{"$f":"'V. Cloud Security'!Z132","v":0},{"$f":"'V. Cloud Security'!B132","v":"V.1.29.1"},{"$f":"'V. Cloud Security'!C132","v":"Ad hoc?"},{"$f":"'V. Cloud Security'!D132","v":0},{"$f":"'V. Cloud Security'!E132","v":0},{"$f":"'V. Cloud Security'!H132","v":0},{"$f":"'V. Cloud Security'!I132","v":"NA"},{"$f":"'V. Cloud Security'!J132","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A133","v":3429},{"$f":"'V. Cloud Security'!K133","v":3},{"$f":"'V. Cloud Security'!L133","v":0},{"$f":"'V. Cloud Security'!Z133","v":0},{"$f":"'V. Cloud Security'!B133","v":"V.1.29.2"},{"$f":"'V. Cloud Security'!C133","v":"Daily?"},{"$f":"'V. Cloud Security'!D133","v":0},{"$f":"'V. Cloud Security'!E133","v":0},{"$f":"'V. Cloud Security'!H133","v":0},{"$f":"'V. Cloud Security'!I133","v":"NA"},{"$f":"'V. Cloud Security'!J133","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A134","v":3430},{"$f":"'V. Cloud Security'!K134","v":3},{"$f":"'V. Cloud Security'!L134","v":0},{"$f":"'V. Cloud Security'!Z134","v":0},{"$f":"'V. Cloud Security'!B134","v":"V.1.29.3"},{"$f":"'V. Cloud Security'!C134","v":"Weekly?"},{"$f":"'V. Cloud Security'!D134","v":0},{"$f":"'V. Cloud Security'!E134","v":0},{"$f":"'V. Cloud Security'!H134","v":0},{"$f":"'V. Cloud Security'!I134","v":"NA"},{"$f":"'V. Cloud Security'!J134","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A135","v":3431},{"$f":"'V. Cloud Security'!K135","v":3},{"$f":"'V. Cloud Security'!L135","v":0},{"$f":"'V. Cloud Security'!Z135","v":0},{"$f":"'V. Cloud Security'!B135","v":"V.1.29.4"},{"$f":"'V. Cloud Security'!C135","v":"Biweekly?"},{"$f":"'V. Cloud Security'!D135","v":0},{"$f":"'V. Cloud Security'!E135","v":0},{"$f":"'V. Cloud Security'!H135","v":0},{"$f":"'V. Cloud Security'!I135","v":"NA"},{"$f":"'V. Cloud Security'!J135","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A136","v":3432},{"$f":"'V. Cloud Security'!K136","v":3},{"$f":"'V. Cloud Security'!L136","v":0},{"$f":"'V. Cloud Security'!Z136","v":0},{"$f":"'V. Cloud Security'!B136","v":"V.1.29.5"},{"$f":"'V. Cloud Security'!C136","v":"Monthly?"},{"$f":"'V. Cloud Security'!D136","v":0},{"$f":"'V. Cloud Security'!E136","v":0},{"$f":"'V. Cloud Security'!H136","v":0},{"$f":"'V. Cloud Security'!I136","v":"NA"},{"$f":"'V. Cloud Security'!J136","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A137","v":3433},{"$f":"'V. Cloud Security'!K137","v":3},{"$f":"'V. Cloud Security'!L137","v":0},{"$f":"'V. Cloud Security'!Z137","v":0},{"$f":"'V. Cloud Security'!B137","v":"V.1.29.6"},{"$f":"'V. Cloud Security'!C137","v":"> 3 months?"},{"$f":"'V. Cloud Security'!D137","v":0},{"$f":"'V. Cloud Security'!E137","v":0},{"$f":"'V. Cloud Security'!H137","v":0},{"$f":"'V. Cloud Security'!I137","v":"NA"},{"$f":"'V. Cloud Security'!J137","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A138","v":3434},{"$f":"'V. Cloud Security'!K138","v":3},{"$f":"'V. Cloud Security'!L138","v":0},{"$f":"'V. Cloud Security'!Z138","v":0},{"$f":"'V. Cloud Security'!B138","v":"V.1.29.7"},{"$f":"'V. Cloud Security'!C138","v":"> 6 months?"},{"$f":"'V. Cloud Security'!D138","v":0},{"$f":"'V. Cloud Security'!E138","v":0},{"$f":"'V. Cloud Security'!H138","v":0},{"$f":"'V. Cloud Security'!I138","v":"NA"},{"$f":"'V. Cloud Security'!J138","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A139","v":3435},{"$f":"'V. Cloud Security'!K139","v":3},{"$f":"'V. Cloud Security'!L139","v":0},{"$f":"'V. Cloud Security'!Z139","v":0},{"$f":"'V. Cloud Security'!B139","v":"V.1.29.8"},{"$f":"'V. Cloud Security'!C139","v":"Other?"},{"$f":"'V. Cloud Security'!D139","v":0},{"$f":"'V. Cloud Security'!E139","v":0},{"$f":"'V. Cloud Security'!H139","v":0},{"$f":"'V. Cloud Security'!I139","v":"NA"},{"$f":"'V. Cloud Security'!J139","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A140","v":3436},{"$f":"'V. Cloud Security'!K140","v":2},{"$f":"'V. Cloud Security'!L140","v":0},{"$f":"'V. Cloud Security'!Z140","v":1},{"$f":"'V. Cloud Security'!B140","v":"V.1.30"},{"$f":"'V. Cloud Security'!C140","v":"Is there an automated secure source code review? If yes, what is the frequency:"},{"$f":"'V. Cloud Security'!D140","v":0},{"$f":"'V. Cloud Security'!E140","v":0},{"$f":"'V. Cloud Security'!H140","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!I140","v":"12.5.1"},{"$f":"'V. Cloud Security'!J140","v":"Control Of Operational Software"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA140","v":"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A141","v":3437},{"$f":"'V. Cloud Security'!K141","v":3},{"$f":"'V. Cloud Security'!L141","v":0},{"$f":"'V. Cloud Security'!Z141","v":0},{"$f":"'V. Cloud Security'!B141","v":"V.1.30.1"},{"$f":"'V. Cloud Security'!C141","v":"Ad hoc?"},{"$f":"'V. Cloud Security'!D141","v":0},{"$f":"'V. Cloud Security'!E141","v":0},{"$f":"'V. Cloud Security'!H141","v":0},{"$f":"'V. Cloud Security'!I141","v":"NA"},{"$f":"'V. Cloud Security'!J141","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A142","v":3438},{"$f":"'V. Cloud Security'!K142","v":3},{"$f":"'V. Cloud Security'!L142","v":0},{"$f":"'V. Cloud Security'!Z142","v":0},{"$f":"'V. Cloud Security'!B142","v":"V.1.30.2"},{"$f":"'V. Cloud Security'!C142","v":"Daily?"},{"$f":"'V. Cloud Security'!D142","v":0},{"$f":"'V. Cloud Security'!E142","v":0},{"$f":"'V. Cloud Security'!H142","v":0},{"$f":"'V. Cloud Security'!I142","v":"NA"},{"$f":"'V. Cloud Security'!J142","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A143","v":3439},{"$f":"'V. Cloud Security'!K143","v":3},{"$f":"'V. Cloud Security'!L143","v":0},{"$f":"'V. Cloud Security'!Z143","v":0},{"$f":"'V. Cloud Security'!B143","v":"V.1.30.3"},{"$f":"'V. Cloud Security'!C143","v":"Weekly?"},{"$f":"'V. Cloud Security'!D143","v":0},{"$f":"'V. Cloud Security'!E143","v":0},{"$f":"'V. Cloud Security'!H143","v":0},{"$f":"'V. Cloud Security'!I143","v":"NA"},{"$f":"'V. Cloud Security'!J143","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A144","v":3440},{"$f":"'V. Cloud Security'!K144","v":3},{"$f":"'V. Cloud Security'!L144","v":0},{"$f":"'V. Cloud Security'!Z144","v":0},{"$f":"'V. Cloud Security'!B144","v":"V.1.30.4"},{"$f":"'V. Cloud Security'!C144","v":"Biweekly?"},{"$f":"'V. Cloud Security'!D144","v":0},{"$f":"'V. Cloud Security'!E144","v":0},{"$f":"'V. Cloud Security'!H144","v":0},{"$f":"'V. Cloud Security'!I144","v":"NA"},{"$f":"'V. Cloud Security'!J144","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A145","v":3441},{"$f":"'V. Cloud Security'!K145","v":3},{"$f":"'V. Cloud Security'!L145","v":0},{"$f":"'V. Cloud Security'!Z145","v":0},{"$f":"'V. Cloud Security'!B145","v":"V.1.30.5"},{"$f":"'V. Cloud Security'!C145","v":"Monthly?"},{"$f":"'V. Cloud Security'!D145","v":0},{"$f":"'V. Cloud Security'!E145","v":0},{"$f":"'V. Cloud Security'!H145","v":0},{"$f":"'V. Cloud Security'!I145","v":"NA"},{"$f":"'V. Cloud Security'!J145","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A146","v":3442},{"$f":"'V. Cloud Security'!K146","v":3},{"$f":"'V. Cloud Security'!L146","v":0},{"$f":"'V. Cloud Security'!Z146","v":0},{"$f":"'V. Cloud Security'!B146","v":"V.1.30.6"},{"$f":"'V. Cloud Security'!C146","v":"> 3 months?"},{"$f":"'V. Cloud Security'!D146","v":0},{"$f":"'V. Cloud Security'!E146","v":0},{"$f":"'V. Cloud Security'!H146","v":0},{"$f":"'V. Cloud Security'!I146","v":"NA"},{"$f":"'V. Cloud Security'!J146","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A147","v":3443},{"$f":"'V. Cloud Security'!K147","v":3},{"$f":"'V. Cloud Security'!L147","v":0},{"$f":"'V. Cloud Security'!Z147","v":0},{"$f":"'V. Cloud Security'!B147","v":"V.1.30.7"},{"$f":"'V. Cloud Security'!C147","v":"> 6 months?"},{"$f":"'V. Cloud Security'!D147","v":0},{"$f":"'V. Cloud Security'!E147","v":0},{"$f":"'V. Cloud Security'!H147","v":0},{"$f":"'V. Cloud Security'!I147","v":"NA"},{"$f":"'V. Cloud Security'!J147","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A148","v":3444},{"$f":"'V. Cloud Security'!K148","v":3},{"$f":"'V. Cloud Security'!L148","v":0},{"$f":"'V. Cloud Security'!Z148","v":0},{"$f":"'V. Cloud Security'!B148","v":"V.1.30.8"},{"$f":"'V. Cloud Security'!C148","v":"Other?"},{"$f":"'V. Cloud Security'!D148","v":0},{"$f":"'V. Cloud Security'!E148","v":0},{"$f":"'V. Cloud Security'!H148","v":0},{"$f":"'V. Cloud Security'!I148","v":"NA"},{"$f":"'V. Cloud Security'!J148","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A149","v":3445},{"$f":"'V. Cloud Security'!K149","v":2},{"$f":"'V. Cloud Security'!L149","v":0},{"$f":"'V. Cloud Security'!Z149","v":1},{"$f":"'V. Cloud Security'!B149","v":"V.1.31"},{"$f":"'V. Cloud Security'!C149","v":"Is source code security reviewed manually? If yes, what is the frequency:"},{"$f":"'V. Cloud Security'!D149","v":0},{"$f":"'V. Cloud Security'!E149","v":0},{"$f":"'V. Cloud Security'!H149","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!I149","v":"12.2.1                                                      12.5.1"},{"$f":"'V. Cloud Security'!J149","v":"Controls against malware,\nControl of Operational Software"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA149","v":"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A150","v":3446},{"$f":"'V. Cloud Security'!K150","v":3},{"$f":"'V. Cloud Security'!L150","v":0},{"$f":"'V. Cloud Security'!Z150","v":0},{"$f":"'V. Cloud Security'!B150","v":"V.1.31.1"},{"$f":"'V. Cloud Security'!C150","v":"Ad hoc?"},{"$f":"'V. Cloud Security'!D150","v":0},{"$f":"'V. Cloud Security'!E150","v":0},{"$f":"'V. Cloud Security'!H150","v":0},{"$f":"'V. Cloud Security'!I150","v":"NA"},{"$f":"'V. Cloud Security'!J150","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A151","v":3447},{"$f":"'V. Cloud Security'!K151","v":3},{"$f":"'V. Cloud Security'!L151","v":0},{"$f":"'V. Cloud Security'!Z151","v":0},{"$f":"'V. Cloud Security'!B151","v":"V.1.31.2"},{"$f":"'V. Cloud Security'!C151","v":"Daily?"},{"$f":"'V. Cloud Security'!D151","v":0},{"$f":"'V. Cloud Security'!E151","v":0},{"$f":"'V. Cloud Security'!H151","v":0},{"$f":"'V. Cloud Security'!I151","v":"NA"},{"$f":"'V. Cloud Security'!J151","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A152","v":3448},{"$f":"'V. Cloud Security'!K152","v":3},{"$f":"'V. Cloud Security'!L152","v":0},{"$f":"'V. Cloud Security'!Z152","v":0},{"$f":"'V. Cloud Security'!B152","v":"V.1.31.3"},{"$f":"'V. Cloud Security'!C152","v":"Weekly?"},{"$f":"'V. Cloud Security'!D152","v":0},{"$f":"'V. Cloud Security'!E152","v":0},{"$f":"'V. Cloud Security'!H152","v":0},{"$f":"'V. Cloud Security'!I152","v":"NA"},{"$f":"'V. Cloud Security'!J152","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A153","v":3449},{"$f":"'V. Cloud Security'!K153","v":3},{"$f":"'V. Cloud Security'!L153","v":0},{"$f":"'V. Cloud Security'!Z153","v":0},{"$f":"'V. Cloud Security'!B153","v":"V.1.31.4"},{"$f":"'V. Cloud Security'!C153","v":"Biweekly?"},{"$f":"'V. Cloud Security'!D153","v":0},{"$f":"'V. Cloud Security'!E153","v":0},{"$f":"'V. Cloud Security'!H153","v":0},{"$f":"'V. Cloud Security'!I153","v":"NA"},{"$f":"'V. Cloud Security'!J153","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A154","v":3450},{"$f":"'V. Cloud Security'!K154","v":3},{"$f":"'V. Cloud Security'!L154","v":0},{"$f":"'V. Cloud Security'!Z154","v":0},{"$f":"'V. Cloud Security'!B154","v":"V.1.31.5"},{"$f":"'V. Cloud Security'!C154","v":"Monthly?"},{"$f":"'V. Cloud Security'!D154","v":0},{"$f":"'V. Cloud Security'!E154","v":0},{"$f":"'V. Cloud Security'!H154","v":0},{"$f":"'V. Cloud Security'!I154","v":"NA"},{"$f":"'V. Cloud Security'!J154","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A155","v":3451},{"$f":"'V. Cloud Security'!K155","v":3},{"$f":"'V. Cloud Security'!L155","v":0},{"$f":"'V. Cloud Security'!Z155","v":0},{"$f":"'V. Cloud Security'!B155","v":"V.1.31.6"},{"$f":"'V. Cloud Security'!C155","v":"> 3 months?"},{"$f":"'V. Cloud Security'!D155","v":0},{"$f":"'V. Cloud Security'!E155","v":0},{"$f":"'V. Cloud Security'!H155","v":0},{"$f":"'V. Cloud Security'!I155","v":"NA"},{"$f":"'V. Cloud Security'!J155","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A156","v":3452},{"$f":"'V. Cloud Security'!K156","v":3},{"$f":"'V. Cloud Security'!L156","v":0},{"$f":"'V. Cloud Security'!Z156","v":0},{"$f":"'V. Cloud Security'!B156","v":"V.1.31.7"},{"$f":"'V. Cloud Security'!C156","v":"> 6 months?"},{"$f":"'V. Cloud Security'!D156","v":0},{"$f":"'V. Cloud Security'!E156","v":0},{"$f":"'V. Cloud Security'!H156","v":0},{"$f":"'V. Cloud Security'!I156","v":"NA"},{"$f":"'V. Cloud Security'!J156","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A157","v":3453},{"$f":"'V. Cloud Security'!K157","v":3},{"$f":"'V. Cloud Security'!L157","v":0},{"$f":"'V. Cloud Security'!Z157","v":0},{"$f":"'V. Cloud Security'!B157","v":"V.1.31.8"},{"$f":"'V. Cloud Security'!C157","v":"Other?"},{"$f":"'V. Cloud Security'!D157","v":0},{"$f":"'V. Cloud Security'!E157","v":0},{"$f":"'V. Cloud Security'!H157","v":0},{"$f":"'V. Cloud Security'!I157","v":"NA"},{"$f":"'V. Cloud Security'!J157","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A158","v":3454},{"$f":"'V. Cloud Security'!K158","v":2},{"$f":"'V. Cloud Security'!L158","v":0},{"$f":"'V. Cloud Security'!Z158","v":1},{"$f":"'V. Cloud Security'!B158","v":"V.1.32"},{"$f":"'V. Cloud Security'!C158","v":"Are automated penetration tests performed? If yes, what is the frequency:"},{"$f":"'V. Cloud Security'!D158","v":0},{"$f":"'V. Cloud Security'!E158","v":0},{"$f":"'V. Cloud Security'!H158","v":"I.1 Application Vulnerability Assessments/Ethical Hacking"},{"$f":"'V. Cloud Security'!I158","v":"12.2.1                                                      12.5.1                                              12.6.1"},{"$f":"'V. Cloud Security'!J158","v":"Controls against malware,\nControl of Operational Software                                    Management of technical vulnerabilities"},null,null,11.3,null,null,{"$f":"'V. Cloud Security'!AA158","v":"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7, WP.1.A.10"}]
[{"$f":"'V. Cloud Security'!A159","v":3455},{"$f":"'V. Cloud Security'!K159","v":3},{"$f":"'V. Cloud Security'!L159","v":0},{"$f":"'V. Cloud Security'!Z159","v":0},{"$f":"'V. Cloud Security'!B159","v":"V.1.32.1"},{"$f":"'V. Cloud Security'!C159","v":"Ad hoc?"},{"$f":"'V. Cloud Security'!D159","v":0},{"$f":"'V. Cloud Security'!E159","v":0},{"$f":"'V. Cloud Security'!H159","v":0},{"$f":"'V. Cloud Security'!I159","v":"NA"},{"$f":"'V. Cloud Security'!J159","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A160","v":3456},{"$f":"'V. Cloud Security'!K160","v":3},{"$f":"'V. Cloud Security'!L160","v":0},{"$f":"'V. Cloud Security'!Z160","v":0},{"$f":"'V. Cloud Security'!B160","v":"V.1.32.2"},{"$f":"'V. Cloud Security'!C160","v":"Daily?"},{"$f":"'V. Cloud Security'!D160","v":0},{"$f":"'V. Cloud Security'!E160","v":0},{"$f":"'V. Cloud Security'!H160","v":0},{"$f":"'V. Cloud Security'!I160","v":"NA"},{"$f":"'V. Cloud Security'!J160","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A161","v":3457},{"$f":"'V. Cloud Security'!K161","v":3},{"$f":"'V. Cloud Security'!L161","v":0},{"$f":"'V. Cloud Security'!Z161","v":0},{"$f":"'V. Cloud Security'!B161","v":"V.1.32.3"},{"$f":"'V. Cloud Security'!C161","v":"Weekly?"},{"$f":"'V. Cloud Security'!D161","v":0},{"$f":"'V. Cloud Security'!E161","v":0},{"$f":"'V. Cloud Security'!H161","v":0},{"$f":"'V. Cloud Security'!I161","v":"NA"},{"$f":"'V. Cloud Security'!J161","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A162","v":3458},{"$f":"'V. Cloud Security'!K162","v":3},{"$f":"'V. Cloud Security'!L162","v":0},{"$f":"'V. Cloud Security'!Z162","v":0},{"$f":"'V. Cloud Security'!B162","v":"V.1.32.4"},{"$f":"'V. Cloud Security'!C162","v":"Biweekly?"},{"$f":"'V. Cloud Security'!D162","v":0},{"$f":"'V. Cloud Security'!E162","v":0},{"$f":"'V. Cloud Security'!H162","v":0},{"$f":"'V. Cloud Security'!I162","v":"NA"},{"$f":"'V. Cloud Security'!J162","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A163","v":3459},{"$f":"'V. Cloud Security'!K163","v":3},{"$f":"'V. Cloud Security'!L163","v":0},{"$f":"'V. Cloud Security'!Z163","v":0},{"$f":"'V. Cloud Security'!B163","v":"V.1.32.5"},{"$f":"'V. Cloud Security'!C163","v":"Monthly?"},{"$f":"'V. Cloud Security'!D163","v":0},{"$f":"'V. Cloud Security'!E163","v":0},{"$f":"'V. Cloud Security'!H163","v":0},{"$f":"'V. Cloud Security'!I163","v":"NA"},{"$f":"'V. Cloud Security'!J163","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A164","v":3460},{"$f":"'V. Cloud Security'!K164","v":3},{"$f":"'V. Cloud Security'!L164","v":0},{"$f":"'V. Cloud Security'!Z164","v":0},{"$f":"'V. Cloud Security'!B164","v":"V.1.32.6"},{"$f":"'V. Cloud Security'!C164","v":"> 3 months?"},{"$f":"'V. Cloud Security'!D164","v":0},{"$f":"'V. Cloud Security'!E164","v":0},{"$f":"'V. Cloud Security'!H164","v":0},{"$f":"'V. Cloud Security'!I164","v":"NA"},{"$f":"'V. Cloud Security'!J164","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A165","v":3461},{"$f":"'V. Cloud Security'!K165","v":3},{"$f":"'V. Cloud Security'!L165","v":0},{"$f":"'V. Cloud Security'!Z165","v":0},{"$f":"'V. Cloud Security'!B165","v":"V.1.32.7"},{"$f":"'V. Cloud Security'!C165","v":"> 6 months?"},{"$f":"'V. Cloud Security'!D165","v":0},{"$f":"'V. Cloud Security'!E165","v":0},{"$f":"'V. Cloud Security'!H165","v":0},{"$f":"'V. Cloud Security'!I165","v":"NA"},{"$f":"'V. Cloud Security'!J165","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A166","v":3462},{"$f":"'V. Cloud Security'!K166","v":3},{"$f":"'V. Cloud Security'!L166","v":0},{"$f":"'V. Cloud Security'!Z166","v":0},{"$f":"'V. Cloud Security'!B166","v":"V.1.32.8"},{"$f":"'V. Cloud Security'!C166","v":"Other?"},{"$f":"'V. Cloud Security'!D166","v":0},{"$f":"'V. Cloud Security'!E166","v":0},{"$f":"'V. Cloud Security'!H166","v":0},{"$f":"'V. Cloud Security'!I166","v":"NA"},{"$f":"'V. Cloud Security'!J166","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A167","v":3463},{"$f":"'V. Cloud Security'!K167","v":2},{"$f":"'V. Cloud Security'!L167","v":0},{"$f":"'V. Cloud Security'!Z167","v":0},{"$f":"'V. Cloud Security'!B167","v":"V.1.33"},{"$f":"'V. Cloud Security'!C167","v":"Are manual penetration tests performed? If yes, what is the frequency:"},{"$f":"'V. Cloud Security'!D167","v":0},{"$f":"'V. Cloud Security'!E167","v":0},{"$f":"'V. Cloud Security'!H167","v":"I.1 Application Vulnerability Assessments/Ethical Hacking"},{"$f":"'V. Cloud Security'!I167","v":"12.2.1                                                      12.5.1                                              12.6.1"},{"$f":"'V. Cloud Security'!J167","v":"Controls against malware,\nControl of Operational Software                                    Management of technical vulnerabilities"},null,null,11.3,null,null,{"$f":"'V. Cloud Security'!AA167","v":"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7, WP.1.A.10"}]
[{"$f":"'V. Cloud Security'!A168","v":3464},{"$f":"'V. Cloud Security'!K168","v":3},{"$f":"'V. Cloud Security'!L168","v":0},{"$f":"'V. Cloud Security'!Z168","v":0},{"$f":"'V. Cloud Security'!B168","v":"V.1.33.1"},{"$f":"'V. Cloud Security'!C168","v":"Ad hoc?"},{"$f":"'V. Cloud Security'!D168","v":0},{"$f":"'V. Cloud Security'!E168","v":0},{"$f":"'V. Cloud Security'!H168","v":0},{"$f":"'V. Cloud Security'!I168","v":"NA"},{"$f":"'V. Cloud Security'!J168","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A169","v":3465},{"$f":"'V. Cloud Security'!K169","v":3},{"$f":"'V. Cloud Security'!L169","v":0},{"$f":"'V. Cloud Security'!Z169","v":0},{"$f":"'V. Cloud Security'!B169","v":"V.1.33.2"},{"$f":"'V. Cloud Security'!C169","v":"Daily?"},{"$f":"'V. Cloud Security'!D169","v":0},{"$f":"'V. Cloud Security'!E169","v":0},{"$f":"'V. Cloud Security'!H169","v":0},{"$f":"'V. Cloud Security'!I169","v":"NA"},{"$f":"'V. Cloud Security'!J169","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A170","v":3466},{"$f":"'V. Cloud Security'!K170","v":3},{"$f":"'V. Cloud Security'!L170","v":0},{"$f":"'V. Cloud Security'!Z170","v":0},{"$f":"'V. Cloud Security'!B170","v":"V.1.33.3"},{"$f":"'V. Cloud Security'!C170","v":"Weekly?"},{"$f":"'V. Cloud Security'!D170","v":0},{"$f":"'V. Cloud Security'!E170","v":0},{"$f":"'V. Cloud Security'!H170","v":0},{"$f":"'V. Cloud Security'!I170","v":"NA"},{"$f":"'V. Cloud Security'!J170","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A171","v":3467},{"$f":"'V. Cloud Security'!K171","v":3},{"$f":"'V. Cloud Security'!L171","v":0},{"$f":"'V. Cloud Security'!Z171","v":0},{"$f":"'V. Cloud Security'!B171","v":"V.1.33.4"},{"$f":"'V. Cloud Security'!C171","v":"Biweekly?"},{"$f":"'V. Cloud Security'!D171","v":0},{"$f":"'V. Cloud Security'!E171","v":0},{"$f":"'V. Cloud Security'!H171","v":0},{"$f":"'V. Cloud Security'!I171","v":"NA"},{"$f":"'V. Cloud Security'!J171","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A172","v":3468},{"$f":"'V. Cloud Security'!K172","v":3},{"$f":"'V. Cloud Security'!L172","v":0},{"$f":"'V. Cloud Security'!Z172","v":0},{"$f":"'V. Cloud Security'!B172","v":"V.1.33.5"},{"$f":"'V. Cloud Security'!C172","v":"Monthly?"},{"$f":"'V. Cloud Security'!D172","v":0},{"$f":"'V. Cloud Security'!E172","v":0},{"$f":"'V. Cloud Security'!H172","v":0},{"$f":"'V. Cloud Security'!I172","v":"NA"},{"$f":"'V. Cloud Security'!J172","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A173","v":3469},{"$f":"'V. Cloud Security'!K173","v":3},{"$f":"'V. Cloud Security'!L173","v":0},{"$f":"'V. Cloud Security'!Z173","v":0},{"$f":"'V. Cloud Security'!B173","v":"V.1.33.6"},{"$f":"'V. Cloud Security'!C173","v":"> 3 months?"},{"$f":"'V. Cloud Security'!D173","v":0},{"$f":"'V. Cloud Security'!E173","v":0},{"$f":"'V. Cloud Security'!H173","v":0},{"$f":"'V. Cloud Security'!I173","v":"NA"},{"$f":"'V. Cloud Security'!J173","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A174","v":3470},{"$f":"'V. Cloud Security'!K174","v":3},{"$f":"'V. Cloud Security'!L174","v":0},{"$f":"'V. Cloud Security'!Z174","v":0},{"$f":"'V. Cloud Security'!B174","v":"V.1.33.7"},{"$f":"'V. Cloud Security'!C174","v":"> 6 months?"},{"$f":"'V. Cloud Security'!D174","v":0},{"$f":"'V. Cloud Security'!E174","v":0},{"$f":"'V. Cloud Security'!H174","v":0},{"$f":"'V. Cloud Security'!I174","v":"NA"},{"$f":"'V. Cloud Security'!J174","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A175","v":3471},{"$f":"'V. Cloud Security'!K175","v":3},{"$f":"'V. Cloud Security'!L175","v":0},{"$f":"'V. Cloud Security'!Z175","v":0},{"$f":"'V. Cloud Security'!B175","v":"V.1.33.8"},{"$f":"'V. Cloud Security'!C175","v":"Other?"},{"$f":"'V. Cloud Security'!D175","v":0},{"$f":"'V. Cloud Security'!E175","v":0},{"$f":"'V. Cloud Security'!H175","v":0},{"$f":"'V. Cloud Security'!I175","v":"NA"},{"$f":"'V. Cloud Security'!J175","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A176","v":3472},{"$f":"'V. Cloud Security'!K176","v":2},{"$f":"'V. Cloud Security'!L176","v":0},{"$f":"'V. Cloud Security'!Z176","v":1},{"$f":"'V. Cloud Security'!B176","v":"V.1.34"},{"$f":"'V. Cloud Security'!C176","v":"Are clients provided with the ability to specify where their data will be stored? If yes, what level:"},{"$f":"'V. Cloud Security'!D176","v":0},{"$f":"'V. Cloud Security'!E176","v":0},{"$f":"'V. Cloud Security'!H176","v":"P.6 Management of Client Target Privacy Data"},{"$f":"'V. Cloud Security'!I176","v":"8.1.1                                                        15.1.1                                                         18.1.1"},{"$f":"'V. Cloud Security'!J176","v":"Inventory Of Assets,                   Information security policy for supplier relationships,\nIdentification Of Applicable Legislation"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA176","v":"WP.1.E.4, WP.1.G.2, WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A177","v":3473},{"$f":"'V. Cloud Security'!K177","v":3},{"$f":"'V. Cloud Security'!L177","v":0},{"$f":"'V. Cloud Security'!Z177","v":0},{"$f":"'V. Cloud Security'!B177","v":"V.1.34.1"},{"$f":"'V. Cloud Security'!C177","v":"Data classification zone: based on security classification level (e.g., production networks, PCI networks)"},{"$f":"'V. Cloud Security'!D177","v":0},{"$f":"'V. Cloud Security'!E177","v":0},{"$f":"'V. Cloud Security'!H177","v":"P.6 Management of Client Target Privacy Data"},{"$f":"'V. Cloud Security'!I177","v":"NA"},{"$f":"'V. Cloud Security'!J177","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA177","v":"WP.1.E.4, WP.1.G.2, WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A178","v":3474},{"$f":"'V. Cloud Security'!K178","v":3},{"$f":"'V. Cloud Security'!L178","v":0},{"$f":"'V. Cloud Security'!Z178","v":0},{"$f":"'V. Cloud Security'!B178","v":"V.1.34.2"},{"$f":"'V. Cloud Security'!C178","v":"Data center?"},{"$f":"'V. Cloud Security'!D178","v":0},{"$f":"'V. Cloud Security'!E178","v":0},{"$f":"'V. Cloud Security'!H178","v":"P.6 Management of Client Target Privacy Data"},{"$f":"'V. Cloud Security'!I178","v":"NA"},{"$f":"'V. Cloud Security'!J178","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA178","v":"WP.1.E.4, WP.1.G.2, WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A179","v":3475},{"$f":"'V. Cloud Security'!K179","v":3},{"$f":"'V. Cloud Security'!L179","v":0},{"$f":"'V. Cloud Security'!Z179","v":0},{"$f":"'V. Cloud Security'!B179","v":"V.1.34.3"},{"$f":"'V. Cloud Security'!C179","v":"Country?"},{"$f":"'V. Cloud Security'!D179","v":0},{"$f":"'V. Cloud Security'!E179","v":0},{"$f":"'V. Cloud Security'!H179","v":"P.6 Management of Client Target Privacy Data"},{"$f":"'V. Cloud Security'!I179","v":"NA"},{"$f":"'V. Cloud Security'!J179","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA179","v":"WP.1.E.4, WP.1.G.2, WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A180","v":3476},{"$f":"'V. Cloud Security'!K180","v":3},{"$f":"'V. Cloud Security'!L180","v":0},{"$f":"'V. Cloud Security'!Z180","v":0},{"$f":"'V. Cloud Security'!B180","v":"V.1.34.4"},{"$f":"'V. Cloud Security'!C180","v":"Location based on legal jurisdiction?"},{"$f":"'V. Cloud Security'!D180","v":0},{"$f":"'V. Cloud Security'!E180","v":0},{"$f":"'V. Cloud Security'!H180","v":"P.6 Management of Client Target Privacy Data"},{"$f":"'V. Cloud Security'!I180","v":"NA"},{"$f":"'V. Cloud Security'!J180","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA180","v":"WP.1.E.4, WP.1.G.2, WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A181","v":3477},{"$f":"'V. Cloud Security'!K181","v":2},{"$f":"'V. Cloud Security'!L181","v":0},{"$f":"'V. Cloud Security'!Z181","v":0},{"$f":"'V. Cloud Security'!B181","v":"V.1.35"},{"$f":"'V. Cloud Security'!C181","v":"Are there legal data ownership agreements with clients? If yes, do they include:"},{"$f":"'V. Cloud Security'!D181","v":0},{"$f":"'V. Cloud Security'!E181","v":0},{"$f":"'V. Cloud Security'!H181","v":"P.6 Management of Client Target Privacy Data"},{"$f":"'V. Cloud Security'!I181","v":"18.1.2                                                      18.2.3"},{"$f":"'V. Cloud Security'!J181","v":"Intellectual Property Rights,\nProtection Of  Records"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA181","v":"WP.1.G.1"}]
[{"$f":"'V. Cloud Security'!A182","v":3478},{"$f":"'V. Cloud Security'!K182","v":3},{"$f":"'V. Cloud Security'!L182","v":0},{"$f":"'V. Cloud Security'!Z182","v":0},{"$f":"'V. Cloud Security'!B182","v":"V.1.35.1"},{"$f":"'V. Cloud Security'!C182","v":"Who owns the data?"},{"$f":"'V. Cloud Security'!D182","v":0},{"$f":"'V. Cloud Security'!E182","v":0},{"$f":"'V. Cloud Security'!H182","v":"P.6 Management of Client Target Privacy Data"},{"$f":"'V. Cloud Security'!I182","v":"18.1.2                                                      18.2.3"},{"$f":"'V. Cloud Security'!J182","v":"Intellectual Property Rights,\nProtection Of  Records"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA182","v":"WP.1.G.1"}]
[{"$f":"'V. Cloud Security'!A183","v":3479},{"$f":"'V. Cloud Security'!K183","v":3},{"$f":"'V. Cloud Security'!L183","v":0},{"$f":"'V. Cloud Security'!Z183","v":0},{"$f":"'V. Cloud Security'!B183","v":"V.1.35.2"},{"$f":"'V. Cloud Security'!C183","v":"What rights (if any) the cloud provider has to the client's complete data?"},{"$f":"'V. Cloud Security'!D183","v":0},{"$f":"'V. Cloud Security'!E183","v":0},{"$f":"'V. Cloud Security'!H183","v":"P.6 Management of Client Target Privacy Data"},{"$f":"'V. Cloud Security'!I183","v":"18.1.2                                                      18.2.3"},{"$f":"'V. Cloud Security'!J183","v":"Intellectual Property Rights,\nProtection Of  Records"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA183","v":"WP.1.G.1"}]
[{"$f":"'V. Cloud Security'!A184","v":3480},{"$f":"'V. Cloud Security'!K184","v":3},{"$f":"'V. Cloud Security'!L184","v":0},{"$f":"'V. Cloud Security'!Z184","v":0},{"$f":"'V. Cloud Security'!B184","v":"V.1.35.3"},{"$f":"'V. Cloud Security'!C184","v":"What rights (if any) the cloud provider has to the client's aggregate/sanitized data?"},{"$f":"'V. Cloud Security'!D184","v":0},{"$f":"'V. Cloud Security'!E184","v":0},{"$f":"'V. Cloud Security'!H184","v":"P.6 Management of Client Target Privacy Data"},{"$f":"'V. Cloud Security'!I184","v":"18.1.2                                                      18.2.3"},{"$f":"'V. Cloud Security'!J184","v":"Intellectual Property Rights,\nProtection Of  Records"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA184","v":"WP.1.G.1"}]
[{"$f":"'V. Cloud Security'!A185","v":3481},{"$f":"'V. Cloud Security'!K185","v":2},{"$f":"'V. Cloud Security'!L185","v":0},{"$f":"'V. Cloud Security'!Z185","v":1},{"$f":"'V. Cloud Security'!B185","v":"V.1.36"},{"$f":"'V. Cloud Security'!C185","v":"Does the ability exist to legally demonstrate sufficient data segmentation, in the event of a client subpoena or a forensics incident, so as not to impact other clients data if using resource pooling? If yes, is there a:"},{"$f":"'V. Cloud Security'!D185","v":0},{"$f":"'V. Cloud Security'!E185","v":0},{"$f":"'V. Cloud Security'!H185","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!I185","v":"16.1.1                                                     16.1.7"},{"$f":"'V. Cloud Security'!J185","v":"Responsibilities And Procedures,\nCollection Of Evidence."},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA185","v":"WP.1.L.2, WP.1.G.5"}]
[{"$f":"'V. Cloud Security'!A186","v":3482},{"$f":"'V. Cloud Security'!K186","v":3},{"$f":"'V. Cloud Security'!L186","v":0},{"$f":"'V. Cloud Security'!Z186","v":0},{"$f":"'V. Cloud Security'!B186","v":"V.1.36.1"},{"$f":"'V. Cloud Security'!C186","v":"Legal strategy document that can be shared with the client?"},{"$f":"'V. Cloud Security'!D186","v":0},{"$f":"'V. Cloud Security'!E186","v":0},{"$f":"'V. Cloud Security'!H186","v":0},{"$f":"'V. Cloud Security'!I186","v":"NA"},{"$f":"'V. Cloud Security'!J186","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA186","v":"WP.1.L.2, WP.1.G.5"}]
[{"$f":"'V. Cloud Security'!A187","v":3483},{"$f":"'V. Cloud Security'!K187","v":3},{"$f":"'V. Cloud Security'!L187","v":0},{"$f":"'V. Cloud Security'!Z187","v":0},{"$f":"'V. Cloud Security'!B187","v":"V.1.36.2"},{"$f":"'V. Cloud Security'!C187","v":"Legal counsel (in-house or external) approval?"},{"$f":"'V. Cloud Security'!D187","v":0},{"$f":"'V. Cloud Security'!E187","v":0},{"$f":"'V. Cloud Security'!H187","v":0},{"$f":"'V. Cloud Security'!I187","v":"NA"},{"$f":"'V. Cloud Security'!J187","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA187","v":"WP.1.L.2, WP.1.G.5"}]
[{"$f":"'V. Cloud Security'!A188","v":3484},{"$f":"'V. Cloud Security'!K188","v":2},{"$f":"'V. Cloud Security'!L188","v":0},{"$f":"'V. Cloud Security'!Z188","v":0},{"$f":"'V. Cloud Security'!B188","v":"V.1.37"},{"$f":"'V. Cloud Security'!C188","v":"Is there a data retention/destruction schedule? If yes, is it:"},{"$f":"'V. Cloud Security'!D188","v":0},{"$f":"'V. Cloud Security'!E188","v":0},{"$f":"'V. Cloud Security'!H188","v":0},{"$f":"'V. Cloud Security'!I188","v":8.3000000000000007},{"$f":"'V. Cloud Security'!J188","v":"Media Handling"},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A189","v":3485},{"$f":"'V. Cloud Security'!K189","v":3},{"$f":"'V. Cloud Security'!L189","v":0},{"$f":"'V. Cloud Security'!Z189","v":0},{"$f":"'V. Cloud Security'!B189","v":"V.1.37.1"},{"$f":"'V. Cloud Security'!C189","v":"Online: disk?"},{"$f":"'V. Cloud Security'!D189","v":0},{"$f":"'V. Cloud Security'!E189","v":0},{"$f":"'V. Cloud Security'!H189","v":0},{"$f":"'V. Cloud Security'!I189","v":"NA"},{"$f":"'V. Cloud Security'!J189","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA189","v":"WP.1.K.2, WP.1.K.3, WP.1.K.5"}]
[{"$f":"'V. Cloud Security'!A190","v":3486},{"$f":"'V. Cloud Security'!K190","v":3},{"$f":"'V. Cloud Security'!L190","v":0},{"$f":"'V. Cloud Security'!Z190","v":0},{"$f":"'V. Cloud Security'!B190","v":"V.1.37.2"},{"$f":"'V. Cloud Security'!C190","v":"Offline: media: (e.g., DLT, DVD)?"},{"$f":"'V. Cloud Security'!D190","v":0},{"$f":"'V. Cloud Security'!E190","v":0},{"$f":"'V. Cloud Security'!H190","v":0},{"$f":"'V. Cloud Security'!I190","v":"NA"},{"$f":"'V. Cloud Security'!J190","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA190","v":"WP.1.K.2, WP.1.K.3, WP.1.K.5"}]
[{"$f":"'V. Cloud Security'!A191","v":3487},{"$f":"'V. Cloud Security'!K191","v":3},{"$f":"'V. Cloud Security'!L191","v":0},{"$f":"'V. Cloud Security'!Z191","v":0},{"$f":"'V. Cloud Security'!B191","v":"V.1.37.3"},{"$f":"'V. Cloud Security'!C191","v":"Online: data managed by third party vendors?"},{"$f":"'V. Cloud Security'!D191","v":0},{"$f":"'V. Cloud Security'!E191","v":0},{"$f":"'V. Cloud Security'!H191","v":0},{"$f":"'V. Cloud Security'!I191","v":"NA"},{"$f":"'V. Cloud Security'!J191","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA191","v":"WP.1.K.2, WP.1.K.3, WP.1.K.5"}]
[{"$f":"'V. Cloud Security'!A192","v":3488},{"$f":"'V. Cloud Security'!K192","v":3},{"$f":"'V. Cloud Security'!L192","v":0},{"$f":"'V. Cloud Security'!Z192","v":0},{"$f":"'V. Cloud Security'!B192","v":"V.1.37.4"},{"$f":"'V. Cloud Security'!C192","v":"Offline: data managed by third party vendors?"},{"$f":"'V. Cloud Security'!D192","v":0},{"$f":"'V. Cloud Security'!E192","v":0},{"$f":"'V. Cloud Security'!H192","v":0},{"$f":"'V. Cloud Security'!I192","v":"NA"},{"$f":"'V. Cloud Security'!J192","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA192","v":"WP.1.K.2, WP.1.K.3, WP.1.K.5"}]
[{"$f":"'V. Cloud Security'!A193","v":3489},{"$f":"'V. Cloud Security'!K193","v":2},{"$f":"'V. Cloud Security'!L193","v":0},{"$f":"'V. Cloud Security'!Z193","v":1},{"$f":"'V. Cloud Security'!B193","v":"V.1.38"},{"$f":"'V. Cloud Security'!C193","v":"Is there a self-service portal or API call available to clients which provides the ability to place a \"Legal hold\" on client data which may be subject to a legal action, without impacting other clients data retention or destruction schedules?"},{"$f":"'V. Cloud Security'!D193","v":0},{"$f":"'V. Cloud Security'!E193","v":0},{"$f":"'V. Cloud Security'!H193","v":"P.6 Management of Client Target Privacy Data"},{"$f":"'V. Cloud Security'!I193","v":"16.1.1                                                      16.1.7                                                          18.1.2                                             18.1.3"},{"$f":"'V. Cloud Security'!J193","v":"Responsibilities And Procedures,\nCollection Of Evidence,\nIntellectual Property Rights,\nProtection Of records"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA193","v":"WP.1.K.4"}]
[{"$f":"'V. Cloud Security'!A194","v":3490},{"$f":"'V. Cloud Security'!K194","v":2},{"$f":"'V. Cloud Security'!L194","v":0},{"$f":"'V. Cloud Security'!Z194","v":1},{"$f":"'V. Cloud Security'!B194","v":"V.1.39"},{"$f":"'V. Cloud Security'!C194","v":"Is a Cloud API available to clients?"},{"$f":"'V. Cloud Security'!D194","v":0},{"$f":"'V. Cloud Security'!E194","v":0},{"$f":"'V. Cloud Security'!H194","v":"H.3 Logical Access Authorization"},{"$f":"'V. Cloud Security'!I194","v":"NA"},{"$f":"'V. Cloud Security'!J194","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A195","v":3491},{"$f":"'V. Cloud Security'!K195","v":3},{"$f":"'V. Cloud Security'!L195","v":0},{"$f":"'V. Cloud Security'!Z195","v":0},{"$f":"'V. Cloud Security'!B195","v":"V.1.39.1"},{"$f":"'V. Cloud Security'!C195","v":"Is there a formal security program established to include API security reviews? If yes, does this include:"},{"$f":"'V. Cloud Security'!D195","v":0},{"$f":"'V. Cloud Security'!E195","v":0},{"$f":"'V. Cloud Security'!H195","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!I195","v":"12.5.1"},{"$f":"'V. Cloud Security'!J195","v":"Control Of Operational Software"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA195","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A196","v":3492},{"$f":"'V. Cloud Security'!K196","v":4},{"$f":"'V. Cloud Security'!L196","v":0},{"$f":"'V. Cloud Security'!Z196","v":0},{"$f":"'V. Cloud Security'!B196","v":"V.1.39.1.1"},{"$f":"'V. Cloud Security'!C196","v":"API security evaluated at the requirements phase?"},{"$f":"'V. Cloud Security'!D196","v":0},{"$f":"'V. Cloud Security'!E196","v":0},{"$f":"'V. Cloud Security'!H196","v":0},{"$f":"'V. Cloud Security'!I196","v":"12.5.1"},{"$f":"'V. Cloud Security'!J196","v":"Control Of Operational Software"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA196","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A197","v":3493},{"$f":"'V. Cloud Security'!K197","v":4},{"$f":"'V. Cloud Security'!L197","v":0},{"$f":"'V. Cloud Security'!Z197","v":0},{"$f":"'V. Cloud Security'!B197","v":"V.1.39.1.2"},{"$f":"'V. Cloud Security'!C197","v":"Security review of API design?"},{"$f":"'V. Cloud Security'!D197","v":0},{"$f":"'V. Cloud Security'!E197","v":0},{"$f":"'V. Cloud Security'!H197","v":0},{"$f":"'V. Cloud Security'!I197","v":"12.5.1"},{"$f":"'V. Cloud Security'!J197","v":"Control Of Operational Software"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA197","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A198","v":3494},{"$f":"'V. Cloud Security'!K198","v":4},{"$f":"'V. Cloud Security'!L198","v":0},{"$f":"'V. Cloud Security'!Z198","v":0},{"$f":"'V. Cloud Security'!B198","v":"V.1.39.1.3"},{"$f":"'V. Cloud Security'!C198","v":"API permission model review?"},{"$f":"'V. Cloud Security'!D198","v":0},{"$f":"'V. Cloud Security'!E198","v":0},{"$f":"'V. Cloud Security'!H198","v":0},{"$f":"'V. Cloud Security'!I198","v":"12.5.1"},{"$f":"'V. Cloud Security'!J198","v":"Control Of Operational Software"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA198","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A199","v":3495},{"$f":"'V. Cloud Security'!K199","v":3},{"$f":"'V. Cloud Security'!L199","v":0},{"$f":"'V. Cloud Security'!Z199","v":0},{"$f":"'V. Cloud Security'!B199","v":"V.1.39.2"},{"$f":"'V. Cloud Security'!C199","v":"Is the API code security tested against OWASP top 10 security issues? If yes, does this include:"},{"$f":"'V. Cloud Security'!D199","v":0},{"$f":"'V. Cloud Security'!E199","v":0},{"$f":"'V. Cloud Security'!H199","v":0},{"$f":"'V. Cloud Security'!I199","v":"12.6.1"},{"$f":"'V. Cloud Security'!J199","v":"Management of technical vulnerabilities"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA199","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A200","v":3496},{"$f":"'V. Cloud Security'!K200","v":4},{"$f":"'V. Cloud Security'!L200","v":0},{"$f":"'V. Cloud Security'!Z200","v":0},{"$f":"'V. Cloud Security'!B200","v":"V.1.39.2.1"},{"$f":"'V. Cloud Security'!C200","v":"Data scoping?"},{"$f":"'V. Cloud Security'!D200","v":0},{"$f":"'V. Cloud Security'!E200","v":0},{"$f":"'V. Cloud Security'!H200","v":0},{"$f":"'V. Cloud Security'!I200","v":"NA"},{"$f":"'V. Cloud Security'!J200","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA200","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A201","v":3497},{"$f":"'V. Cloud Security'!K201","v":4},{"$f":"'V. Cloud Security'!L201","v":0},{"$f":"'V. Cloud Security'!Z201","v":0},{"$f":"'V. Cloud Security'!B201","v":"V.1.39.2.2"},{"$f":"'V. Cloud Security'!C201","v":"XSS?"},{"$f":"'V. Cloud Security'!D201","v":0},{"$f":"'V. Cloud Security'!E201","v":0},{"$f":"'V. Cloud Security'!H201","v":0},{"$f":"'V. Cloud Security'!I201","v":"NA"},{"$f":"'V. Cloud Security'!J201","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA201","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A202","v":3498},{"$f":"'V. Cloud Security'!K202","v":4},{"$f":"'V. Cloud Security'!L202","v":0},{"$f":"'V. Cloud Security'!Z202","v":0},{"$f":"'V. Cloud Security'!B202","v":"V.1.39.2.3"},{"$f":"'V. Cloud Security'!C202","v":"SQL injection?"},{"$f":"'V. Cloud Security'!D202","v":0},{"$f":"'V. Cloud Security'!E202","v":0},{"$f":"'V. Cloud Security'!H202","v":0},{"$f":"'V. Cloud Security'!I202","v":"NA"},{"$f":"'V. Cloud Security'!J202","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA202","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A203","v":3499},{"$f":"'V. Cloud Security'!K203","v":4},{"$f":"'V. Cloud Security'!L203","v":0},{"$f":"'V. Cloud Security'!Z203","v":0},{"$f":"'V. Cloud Security'!B203","v":"V.1.39.2.4"},{"$f":"'V. Cloud Security'!C203","v":"Session abuse?"},{"$f":"'V. Cloud Security'!D203","v":0},{"$f":"'V. Cloud Security'!E203","v":0},{"$f":"'V. Cloud Security'!H203","v":0},{"$f":"'V. Cloud Security'!I203","v":"NA"},{"$f":"'V. Cloud Security'!J203","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA203","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A204","v":3500},{"$f":"'V. Cloud Security'!K204","v":4},{"$f":"'V. Cloud Security'!L204","v":0},{"$f":"'V. Cloud Security'!Z204","v":0},{"$f":"'V. Cloud Security'!B204","v":"V.1.39.2.5"},{"$f":"'V. Cloud Security'!C204","v":"Replay attack?"},{"$f":"'V. Cloud Security'!D204","v":0},{"$f":"'V. Cloud Security'!E204","v":0},{"$f":"'V. Cloud Security'!H204","v":0},{"$f":"'V. Cloud Security'!I204","v":"NA"},{"$f":"'V. Cloud Security'!J204","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA204","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A205","v":3501},{"$f":"'V. Cloud Security'!K205","v":4},{"$f":"'V. Cloud Security'!L205","v":0},{"$f":"'V. Cloud Security'!Z205","v":0},{"$f":"'V. Cloud Security'!B205","v":"V.1.39.2.6"},{"$f":"'V. Cloud Security'!C205","v":"DoS?"},{"$f":"'V. Cloud Security'!D205","v":0},{"$f":"'V. Cloud Security'!E205","v":0},{"$f":"'V. Cloud Security'!H205","v":0},{"$f":"'V. Cloud Security'!I205","v":"NA"},{"$f":"'V. Cloud Security'!J205","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA205","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A206","v":3502},{"$f":"'V. Cloud Security'!K206","v":4},{"$f":"'V. Cloud Security'!L206","v":0},{"$f":"'V. Cloud Security'!Z206","v":0},{"$f":"'V. Cloud Security'!B206","v":"V.1.39.2.7"},{"$f":"'V. Cloud Security'!C206","v":"Data Leakage"},{"$f":"'V. Cloud Security'!D206","v":0},{"$f":"'V. Cloud Security'!E206","v":0},{"$f":"'V. Cloud Security'!H206","v":0},{"$f":"'V. Cloud Security'!I206","v":"NA"},{"$f":"'V. Cloud Security'!J206","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA206","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A207","v":3503},{"$f":"'V. Cloud Security'!K207","v":3},{"$f":"'V. Cloud Security'!L207","v":0},{"$f":"'V. Cloud Security'!Z207","v":0},{"$f":"'V. Cloud Security'!B207","v":"V.1.39.3"},{"$f":"'V. Cloud Security'!C207","v":"Is there the self-service ability to control access to APIs? If yes, does it include:"},{"$f":"'V. Cloud Security'!D207","v":0},{"$f":"'V. Cloud Security'!E207","v":0},{"$f":"'V. Cloud Security'!H207","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!I207","v":"9.1.2 "},{"$f":"'V. Cloud Security'!J207","v":"Access to networks and network services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA207","v":"WP.1.H.10, WP.1.A.1"}]
[{"$f":"'V. Cloud Security'!A208","v":3504},{"$f":"'V. Cloud Security'!K208","v":4},{"$f":"'V. Cloud Security'!L208","v":0},{"$f":"'V. Cloud Security'!Z208","v":0},{"$f":"'V. Cloud Security'!B208","v":"V.1.39.3.1"},{"$f":"'V. Cloud Security'!C208","v":"Network: Network access control (e.g., firewall ACL)?"},{"$f":"'V. Cloud Security'!D208","v":0},{"$f":"'V. Cloud Security'!E208","v":0},{"$f":"'V. Cloud Security'!H208","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!I208","v":"9.1.2 "},{"$f":"'V. Cloud Security'!J208","v":"Access to networks and network services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA208","v":"WP.1.A.1, WP.1.A.2, WP.1.A.3"}]
[{"$f":"'V. Cloud Security'!A209","v":3505},{"$f":"'V. Cloud Security'!K209","v":4},{"$f":"'V. Cloud Security'!L209","v":0},{"$f":"'V. Cloud Security'!Z209","v":0},{"$f":"'V. Cloud Security'!B209","v":"V.1.39.3.2"},{"$f":"'V. Cloud Security'!C209","v":"Network: VPN?"},{"$f":"'V. Cloud Security'!D209","v":0},{"$f":"'V. Cloud Security'!E209","v":0},{"$f":"'V. Cloud Security'!H209","v":0},{"$f":"'V. Cloud Security'!I209","v":"9.1.2 "},{"$f":"'V. Cloud Security'!J209","v":"Access to networks and network services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA209","v":"WP.1.A.1, WP.1.A.2, WP.1.A.3"}]
[{"$f":"'V. Cloud Security'!A210","v":3506},{"$f":"'V. Cloud Security'!K210","v":4},{"$f":"'V. Cloud Security'!L210","v":0},{"$f":"'V. Cloud Security'!Z210","v":0},{"$f":"'V. Cloud Security'!B210","v":"V.1.39.3.3"},{"$f":"'V. Cloud Security'!C210","v":"Application: Application access control (e.g., application ACL)?"},{"$f":"'V. Cloud Security'!D210","v":0},{"$f":"'V. Cloud Security'!E210","v":0},{"$f":"'V. Cloud Security'!H210","v":"I.5 Application Security Program Governance"},{"$f":"'V. Cloud Security'!I210","v":"9.4.1"},{"$f":"'V. Cloud Security'!J210","v":"Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA210","v":"WP.1.I.2, WP.1.A.1, WP.1.A.2, WP.1.A.3"}]
[{"$f":"'V. Cloud Security'!A211","v":3507},{"$f":"'V. Cloud Security'!K211","v":4},{"$f":"'V. Cloud Security'!L211","v":0},{"$f":"'V. Cloud Security'!Z211","v":0},{"$f":"'V. Cloud Security'!B211","v":"V.1.39.3.4"},{"$f":"'V. Cloud Security'!C211","v":"Credential: username/password?"},{"$f":"'V. Cloud Security'!D211","v":0},{"$f":"'V. Cloud Security'!E211","v":0},{"$f":"'V. Cloud Security'!H211","v":0},{"$f":"'V. Cloud Security'!I211","v":"9.4.2"},{"$f":"'V. Cloud Security'!J211","v":"Secure log-on procedures"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA211","v":"WP.1.I.2, WP.1.A.1, WP.1.A.2, WP.1.A.3"}]
[{"$f":"'V. Cloud Security'!A212","v":3508},{"$f":"'V. Cloud Security'!K212","v":4},{"$f":"'V. Cloud Security'!L212","v":0},{"$f":"'V. Cloud Security'!Z212","v":0},{"$f":"'V. Cloud Security'!B212","v":"V.1.39.3.5"},{"$f":"'V. Cloud Security'!C212","v":"Credential: client side certificate?"},{"$f":"'V. Cloud Security'!D212","v":0},{"$f":"'V. Cloud Security'!E212","v":0},{"$f":"'V. Cloud Security'!H212","v":0},{"$f":"'V. Cloud Security'!I212","v":"9.4.1"},{"$f":"'V. Cloud Security'!J212","v":"Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA212","v":"WP.1.I.2, WP.1.A.1, WP.1.A.2, WP.1.A.3"}]
[{"$f":"'V. Cloud Security'!A213","v":3509},{"$f":"'V. Cloud Security'!K213","v":4},{"$f":"'V. Cloud Security'!L213","v":0},{"$f":"'V. Cloud Security'!Z213","v":0},{"$f":"'V. Cloud Security'!B213","v":"V.1.39.3.6"},{"$f":"'V. Cloud Security'!C213","v":"Credential: multi factor authentication?"},{"$f":"'V. Cloud Security'!D213","v":0},{"$f":"'V. Cloud Security'!E213","v":0},{"$f":"'V. Cloud Security'!H213","v":0},{"$f":"'V. Cloud Security'!I213","v":"9.4.2"},{"$f":"'V. Cloud Security'!J213","v":"Secure log-on procedures"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA213","v":"WP.1.I.2, WP.1.A.1, WP.1.A.2, WP.1.A.3"}]
[{"$f":"'V. Cloud Security'!A214","v":3510},{"$f":"'V. Cloud Security'!K214","v":3},{"$f":"'V. Cloud Security'!L214","v":0},{"$f":"'V. Cloud Security'!Z214","v":0},{"$f":"'V. Cloud Security'!B214","v":"V.1.39.4"},{"$f":"'V. Cloud Security'!C214","v":"Is there a self-service kill switch available to clients to disable an API in the event of a security incident (e.g., DoS)?"},{"$f":"'V. Cloud Security'!D214","v":0},{"$f":"'V. Cloud Security'!E214","v":0},{"$f":"'V. Cloud Security'!H214","v":0},{"$f":"'V. Cloud Security'!I214","v":"9.4.1"},{"$f":"'V. Cloud Security'!J214","v":"Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA214","v":"WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A215","v":3511},{"$f":"'V. Cloud Security'!K215","v":3},{"$f":"'V. Cloud Security'!L215","v":0},{"$f":"'V. Cloud Security'!Z215","v":0},{"$f":"'V. Cloud Security'!B215","v":"V.1.39.5"},{"$f":"'V. Cloud Security'!C215","v":"Does the API have the ability to alert, block or lock based on rate limit?"},{"$f":"'V. Cloud Security'!D215","v":0},{"$f":"'V. Cloud Security'!E215","v":0},{"$f":"'V. Cloud Security'!H215","v":0},{"$f":"'V. Cloud Security'!I215","v":"9.4.2"},{"$f":"'V. Cloud Security'!J215","v":"Secure log-on procedures"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA215","v":"WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A216","v":3512},{"$f":"'V. Cloud Security'!K216","v":3},{"$f":"'V. Cloud Security'!L216","v":0},{"$f":"'V. Cloud Security'!Z216","v":0},{"$f":"'V. Cloud Security'!B216","v":"V.1.39.6"},{"$f":"'V. Cloud Security'!C216","v":"Is Scoped Data encrypted in the API response? "},{"$f":"'V. Cloud Security'!D216","v":0},{"$f":"'V. Cloud Security'!E216","v":0},{"$f":"'V. Cloud Security'!H216","v":0},{"$f":"'V. Cloud Security'!I216","v":"10.1.1                                                     13.1.2"},{"$f":"'V. Cloud Security'!J216","v":"Policy On The Use Of Cryptographic Controls  Security of network services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA216","v":"WP.1.A.5, WP.1.A.6, WP.1.G.9, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A217","v":3513},{"$f":"'V. Cloud Security'!K217","v":3},{"$f":"'V. Cloud Security'!L217","v":0},{"$f":"'V. Cloud Security'!Z217","v":0},{"$f":"'V. Cloud Security'!B217","v":"V.1.39.7"},{"$f":"'V. Cloud Security'!C217","v":"Is Scoped Data encrypted in the API request?"},{"$f":"'V. Cloud Security'!D217","v":0},{"$f":"'V. Cloud Security'!E217","v":0},{"$f":"'V. Cloud Security'!H217","v":0},{"$f":"'V. Cloud Security'!I217","v":"10.1.1                                                     13.1.2"},{"$f":"'V. Cloud Security'!J217","v":"Policy On The Use Of Cryptographic Controls  Security of network services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA217","v":"WP.1.A.5, WP.1.A.6, WP.1.G.9, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A218","v":3514},{"$f":"'V. Cloud Security'!K218","v":3},{"$f":"'V. Cloud Security'!L218","v":0},{"$f":"'V. Cloud Security'!Z218","v":0},{"$f":"'V. Cloud Security'!B218","v":"V.1.39.8"},{"$f":"'V. Cloud Security'!C218","v":"Is there an option for the API request calls to be digitally signed?"},{"$f":"'V. Cloud Security'!D218","v":0},{"$f":"'V. Cloud Security'!E218","v":0},{"$f":"'V. Cloud Security'!H218","v":0},{"$f":"'V. Cloud Security'!I218","v":"10.1.1                                                     13.1.2"},{"$f":"'V. Cloud Security'!J218","v":"Policy On The Use Of Cryptographic Controls  Security of network services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA218","v":"WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A219","v":3515},{"$f":"'V. Cloud Security'!K219","v":3},{"$f":"'V. Cloud Security'!L219","v":0},{"$f":"'V. Cloud Security'!Z219","v":0},{"$f":"'V. Cloud Security'!B219","v":"V.1.39.9"},{"$f":"'V. Cloud Security'!C219","v":"Is there an option for the API response calls to be digitally signed?"},{"$f":"'V. Cloud Security'!D219","v":0},{"$f":"'V. Cloud Security'!E219","v":0},{"$f":"'V. Cloud Security'!H219","v":0},{"$f":"'V. Cloud Security'!I219","v":"10.1.1                                                     13.1.2"},{"$f":"'V. Cloud Security'!J219","v":"Policy On The Use Of Cryptographic Controls  Security of network services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA219","v":"WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A220","v":3516},{"$f":"'V. Cloud Security'!K220","v":2},{"$f":"'V. Cloud Security'!L220","v":0},{"$f":"'V. Cloud Security'!Z220","v":1},{"$f":"'V. Cloud Security'!B220","v":"V.1.40"},{"$f":"'V. Cloud Security'!C220","v":"Is there a client management portal which allows distributed business accounts (business units/departments) to be managed under a single central corporate account?"},{"$f":"'V. Cloud Security'!D220","v":0},{"$f":"'V. Cloud Security'!E220","v":0},{"$f":"'V. Cloud Security'!H220","v":0},{"$f":"'V. Cloud Security'!I220","v":"15.2.1"},{"$f":"'V. Cloud Security'!J220","v":"Monitoring and review of supplier services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA220","v":"WP.1.J.1, WP.1.J.7, WP.1.A.3, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.H.6, WP.1.H.10"}]
[{"$f":"'V. Cloud Security'!A221","v":3517},{"$f":"'V. Cloud Security'!K221","v":2},{"$f":"'V. Cloud Security'!L221","v":0},{"$f":"'V. Cloud Security'!Z221","v":0},{"$f":"'V. Cloud Security'!B221","v":"V.1.41"},{"$f":"'V. Cloud Security'!C221","v":"Are background checks performed? If yes, are they for:"},{"$f":"'V. Cloud Security'!D221","v":0},{"$f":"'V. Cloud Security'!E221","v":0},{"$f":"'V. Cloud Security'!H221","v":"E.3 Background Investigation Policy Content"},{"$f":"'V. Cloud Security'!I221","v":"7.1.1                                                        7.2.1"},{"$f":"'V. Cloud Security'!J221","v":"Screening                         Management responsibilities"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA221","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A222","v":3518},{"$f":"'V. Cloud Security'!K222","v":3},{"$f":"'V. Cloud Security'!L222","v":0},{"$f":"'V. Cloud Security'!Z222","v":0},{"$f":"'V. Cloud Security'!B222","v":"V.1.41.1"},{"$f":"'V. Cloud Security'!C222","v":"Cloud provider staff?"},{"$f":"'V. Cloud Security'!D222","v":0},{"$f":"'V. Cloud Security'!E222","v":0},{"$f":"'V. Cloud Security'!H222","v":0},{"$f":"'V. Cloud Security'!I222","v":"7.1.1                                                        7.2.1"},{"$f":"'V. Cloud Security'!J222","v":"Screening                         Management responsibilities"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA222","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A223","v":3519},{"$f":"'V. Cloud Security'!K223","v":3},{"$f":"'V. Cloud Security'!L223","v":0},{"$f":"'V. Cloud Security'!Z223","v":0},{"$f":"'V. Cloud Security'!B223","v":"V.1.41.2"},{"$f":"'V. Cloud Security'!C223","v":"Cloud provider contractors?"},{"$f":"'V. Cloud Security'!D223","v":0},{"$f":"'V. Cloud Security'!E223","v":0},{"$f":"'V. Cloud Security'!H223","v":0},{"$f":"'V. Cloud Security'!I223","v":"7.1.1                                                        7.2.1"},{"$f":"'V. Cloud Security'!J223","v":"Screening                         Management responsibilities"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA223","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A224","v":3520},{"$f":"'V. Cloud Security'!K224","v":3},{"$f":"'V. Cloud Security'!L224","v":0},{"$f":"'V. Cloud Security'!Z224","v":0},{"$f":"'V. Cloud Security'!B224","v":"V.1.41.3"},{"$f":"'V. Cloud Security'!C224","v":"Cloud provider subcontractor?"},{"$f":"'V. Cloud Security'!D224","v":0},{"$f":"'V. Cloud Security'!E224","v":0},{"$f":"'V. Cloud Security'!H224","v":0},{"$f":"'V. Cloud Security'!I224","v":"7.1.1                                                        7.2.1"},{"$f":"'V. Cloud Security'!J224","v":"Screening                         Management responsibilities"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA224","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A225","v":3521},{"$f":"'V. Cloud Security'!K225","v":3},{"$f":"'V. Cloud Security'!L225","v":1},{"$f":"'V. Cloud Security'!Z225","v":0},{"$f":"'V. Cloud Security'!B225","v":"V.1.41.4"},{"$f":"'V. Cloud Security'!C225","v":"What is the default frequency of the background checks:"},{"$f":"'V. Cloud Security'!D225","v":0},{"$f":"'V. Cloud Security'!E225","v":0},{"$f":"'V. Cloud Security'!H225","v":0},{"$f":"'V. Cloud Security'!I225","v":"7.1.1                                                        7.2.1"},{"$f":"'V. Cloud Security'!J225","v":"Screening                         Management responsibilities"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA225","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A226","v":3522},{"$f":"'V. Cloud Security'!K226","v":4},{"$f":"'V. Cloud Security'!L226","v":0},{"$f":"'V. Cloud Security'!Z226","v":0},{"$f":"'V. Cloud Security'!B226","v":"V.1.41.4.1"},{"$f":"'V. Cloud Security'!C226","v":"At time of hire?"},{"$f":"'V. Cloud Security'!D226","v":0},{"$f":"'V. Cloud Security'!E226","v":0},{"$f":"'V. Cloud Security'!H226","v":0},{"$f":"'V. Cloud Security'!I226","v":"NA"},{"$f":"'V. Cloud Security'!J226","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA226","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A227","v":3523},{"$f":"'V. Cloud Security'!K227","v":4},{"$f":"'V. Cloud Security'!L227","v":0},{"$f":"'V. Cloud Security'!Z227","v":0},{"$f":"'V. Cloud Security'!B227","v":"V.1.41.4.2"},{"$f":"'V. Cloud Security'!C227","v":"Quarterly?"},{"$f":"'V. Cloud Security'!D227","v":0},{"$f":"'V. Cloud Security'!E227","v":0},{"$f":"'V. Cloud Security'!H227","v":0},{"$f":"'V. Cloud Security'!I227","v":"NA"},{"$f":"'V. Cloud Security'!J227","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA227","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A228","v":3524},{"$f":"'V. Cloud Security'!K228","v":4},{"$f":"'V. Cloud Security'!L228","v":0},{"$f":"'V. Cloud Security'!Z228","v":0},{"$f":"'V. Cloud Security'!B228","v":"V.1.41.4.3"},{"$f":"'V. Cloud Security'!C228","v":"Semiannually?"},{"$f":"'V. Cloud Security'!D228","v":0},{"$f":"'V. Cloud Security'!E228","v":0},{"$f":"'V. Cloud Security'!H228","v":0},{"$f":"'V. Cloud Security'!I228","v":"NA"},{"$f":"'V. Cloud Security'!J228","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA228","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A229","v":3525},{"$f":"'V. Cloud Security'!K229","v":4},{"$f":"'V. Cloud Security'!L229","v":0},{"$f":"'V. Cloud Security'!Z229","v":0},{"$f":"'V. Cloud Security'!B229","v":"V.1.41.4.4"},{"$f":"'V. Cloud Security'!C229","v":"Annually?"},{"$f":"'V. Cloud Security'!D229","v":0},{"$f":"'V. Cloud Security'!E229","v":0},{"$f":"'V. Cloud Security'!H229","v":0},{"$f":"'V. Cloud Security'!I229","v":"NA"},{"$f":"'V. Cloud Security'!J229","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA229","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A230","v":3526},{"$f":"'V. Cloud Security'!K230","v":4},{"$f":"'V. Cloud Security'!L230","v":0},{"$f":"'V. Cloud Security'!Z230","v":0},{"$f":"'V. Cloud Security'!B230","v":"V.1.41.4.5"},{"$f":"'V. Cloud Security'!C230","v":"Other?"},{"$f":"'V. Cloud Security'!D230","v":0},{"$f":"'V. Cloud Security'!E230","v":0},{"$f":"'V. Cloud Security'!H230","v":0},{"$f":"'V. Cloud Security'!I230","v":"NA"},{"$f":"'V. Cloud Security'!J230","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA230","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A231","v":3532},{"$f":"'V. Cloud Security'!K231","v":3},{"$f":"'V. Cloud Security'!L231","v":1},{"$f":"'V. Cloud Security'!Z231","v":0},{"$f":"'V. Cloud Security'!B231","v":"V.1.41.5"},{"$f":"'V. Cloud Security'!C231","v":"Who performs background checks on direct contractors"},{"$f":"'V. Cloud Security'!D231","v":0},{"$f":"'V. Cloud Security'!E231","v":0},{"$f":"'V. Cloud Security'!H231","v":0},{"$f":"'V. Cloud Security'!I231","v":"7.1.1                                                        7.2.1"},{"$f":"'V. Cloud Security'!J231","v":"Screening                         Management responsibilities"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA231","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A232","v":3533},{"$f":"'V. Cloud Security'!K232","v":4},{"$f":"'V. Cloud Security'!L232","v":0},{"$f":"'V. Cloud Security'!Z232","v":0},{"$f":"'V. Cloud Security'!B232","v":"V.1.41.5.1"},{"$f":"'V. Cloud Security'!C232","v":"Direct contracting firm?"},{"$f":"'V. Cloud Security'!D232","v":0},{"$f":"'V. Cloud Security'!E232","v":0},{"$f":"'V. Cloud Security'!H232","v":0},{"$f":"'V. Cloud Security'!I232","v":"NA"},{"$f":"'V. Cloud Security'!J232","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA232","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A233","v":3534},{"$f":"'V. Cloud Security'!K233","v":4},{"$f":"'V. Cloud Security'!L233","v":0},{"$f":"'V. Cloud Security'!Z233","v":0},{"$f":"'V. Cloud Security'!B233","v":"V.1.41.5.2"},{"$f":"'V. Cloud Security'!C233","v":"Subcontracting firm?"},{"$f":"'V. Cloud Security'!D233","v":0},{"$f":"'V. Cloud Security'!E233","v":0},{"$f":"'V. Cloud Security'!H233","v":0},{"$f":"'V. Cloud Security'!I233","v":"NA"},{"$f":"'V. Cloud Security'!J233","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A234","v":3535},{"$f":"'V. Cloud Security'!K234","v":4},{"$f":"'V. Cloud Security'!L234","v":0},{"$f":"'V. Cloud Security'!Z234","v":0},{"$f":"'V. Cloud Security'!B234","v":"V.1.41.5.3"},{"$f":"'V. Cloud Security'!C234","v":"Cloud provider?"},{"$f":"'V. Cloud Security'!D234","v":0},{"$f":"'V. Cloud Security'!E234","v":0},{"$f":"'V. Cloud Security'!H234","v":0},{"$f":"'V. Cloud Security'!I234","v":"NA"},{"$f":"'V. Cloud Security'!J234","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA234","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A235","v":3536},{"$f":"'V. Cloud Security'!K235","v":4},{"$f":"'V. Cloud Security'!L235","v":0},{"$f":"'V. Cloud Security'!Z235","v":0},{"$f":"'V. Cloud Security'!B235","v":"V.1.41.5.4"},{"$f":"'V. Cloud Security'!C235","v":"Client?"},{"$f":"'V. Cloud Security'!D235","v":0},{"$f":"'V. Cloud Security'!E235","v":0},{"$f":"'V. Cloud Security'!H235","v":0},{"$f":"'V. Cloud Security'!I235","v":"NA"},{"$f":"'V. Cloud Security'!J235","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA235","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A236","v":3537},{"$f":"'V. Cloud Security'!K236","v":4},{"$f":"'V. Cloud Security'!L236","v":0},{"$f":"'V. Cloud Security'!Z236","v":0},{"$f":"'V. Cloud Security'!B236","v":"V.1.41.5.5"},{"$f":"'V. Cloud Security'!C236","v":"Other?"},{"$f":"'V. Cloud Security'!D236","v":0},{"$f":"'V. Cloud Security'!E236","v":0},{"$f":"'V. Cloud Security'!H236","v":0},{"$f":"'V. Cloud Security'!I236","v":"NA"},{"$f":"'V. Cloud Security'!J236","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA236","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A237","v":3538},{"$f":"'V. Cloud Security'!K237","v":2},{"$f":"'V. Cloud Security'!L237","v":0},{"$f":"'V. Cloud Security'!Z237","v":1},{"$f":"'V. Cloud Security'!B237","v":"V.1.42"},{"$f":"'V. Cloud Security'!C237","v":"Is two factor authentication required to access the production cloud environment containing Scoped Data?  If yes, does it include:"},{"$f":"'V. Cloud Security'!D237","v":0},{"$f":"'V. Cloud Security'!E237","v":0},{"$f":"'V. Cloud Security'!H237","v":"I.6 Application Security Vulnerability Assessment and Remediation"},{"$f":"'V. Cloud Security'!I237","v":"9.3.1"},{"$f":"'V. Cloud Security'!J237","v":"Use of secret authentication information"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA237","v":"WP.1.H.6, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A238","v":3539},{"$f":"'V. Cloud Security'!K238","v":3},{"$f":"'V. Cloud Security'!L238","v":0},{"$f":"'V. Cloud Security'!Z238","v":0},{"$f":"'V. Cloud Security'!B238","v":"V.1.42.1"},{"$f":"'V. Cloud Security'!C238","v":"Admin access (shell or UI): Internally from within cloud provider network?"},{"$f":"'V. Cloud Security'!D238","v":0},{"$f":"'V. Cloud Security'!E238","v":0},{"$f":"'V. Cloud Security'!H238","v":0},{"$f":"'V. Cloud Security'!I238","v":"9.4.1"},{"$f":"'V. Cloud Security'!J238","v":"Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA238","v":"WP.1.H.6, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A239","v":3540},{"$f":"'V. Cloud Security'!K239","v":3},{"$f":"'V. Cloud Security'!L239","v":0},{"$f":"'V. Cloud Security'!Z239","v":0},{"$f":"'V. Cloud Security'!B239","v":"V.1.42.2"},{"$f":"'V. Cloud Security'!C239","v":"Non-admin access (shell or UI): Internally from within cloud provider network?"},{"$f":"'V. Cloud Security'!D239","v":0},{"$f":"'V. Cloud Security'!E239","v":0},{"$f":"'V. Cloud Security'!H239","v":0},{"$f":"'V. Cloud Security'!I239","v":"9.4.1"},{"$f":"'V. Cloud Security'!J239","v":"Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA239","v":"WP.1.H.6, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A240","v":3541},{"$f":"'V. Cloud Security'!K240","v":3},{"$f":"'V. Cloud Security'!L240","v":0},{"$f":"'V. Cloud Security'!Z240","v":0},{"$f":"'V. Cloud Security'!B240","v":"V.1.42.3"},{"$f":"'V. Cloud Security'!C240","v":"Admin access (shell or UI): remote access?"},{"$f":"'V. Cloud Security'!D240","v":0},{"$f":"'V. Cloud Security'!E240","v":0},{"$f":"'V. Cloud Security'!H240","v":0},{"$f":"'V. Cloud Security'!I240","v":"9.4.1"},{"$f":"'V. Cloud Security'!J240","v":"Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA240","v":"WP.1.H.6, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A241","v":3542},{"$f":"'V. Cloud Security'!K241","v":3},{"$f":"'V. Cloud Security'!L241","v":0},{"$f":"'V. Cloud Security'!Z241","v":0},{"$f":"'V. Cloud Security'!B241","v":"V.1.42.4"},{"$f":"'V. Cloud Security'!C241","v":"Non-admin access (shell or UI): remote access?"},{"$f":"'V. Cloud Security'!D241","v":0},{"$f":"'V. Cloud Security'!E241","v":0},{"$f":"'V. Cloud Security'!H241","v":0},{"$f":"'V. Cloud Security'!I241","v":"9.4.1"},{"$f":"'V. Cloud Security'!J241","v":"Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA241","v":"WP.1.H.6, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A242","v":3543},{"$f":"'V. Cloud Security'!K242","v":2},{"$f":"'V. Cloud Security'!L242","v":0},{"$f":"'V. Cloud Security'!Z242","v":0},{"$f":"'V. Cloud Security'!B242","v":"V.1.43"},{"$f":"'V. Cloud Security'!C242","v":"Are staff able to access client Scoped Data? If not, which of the following controls are used to prevent this:"},{"$f":"'V. Cloud Security'!D242","v":0},{"$f":"'V. Cloud Security'!E242","v":0},{"$f":"'V. Cloud Security'!H242","v":"H.3 Logical Access Authorization"},{"$f":"'V. Cloud Security'!I242","v":"9.2.3\n9.4.1"},{"$f":"'V. Cloud Security'!J242","v":"Management of privileged access rights                                Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA242","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A243","v":3544},{"$f":"'V. Cloud Security'!K243","v":3},{"$f":"'V. Cloud Security'!L243","v":0},{"$f":"'V. Cloud Security'!Z243","v":0},{"$f":"'V. Cloud Security'!B243","v":"V.1.43.1"},{"$f":"'V. Cloud Security'!C243","v":"Preventative controls (e.g., technical)?"},{"$f":"'V. Cloud Security'!D243","v":0},{"$f":"'V. Cloud Security'!E243","v":0},{"$f":"'V. Cloud Security'!H243","v":0},{"$f":"'V. Cloud Security'!I243","v":"9.2.3\n9.4.2"},{"$f":"'V. Cloud Security'!J243","v":"Management of privileged access rights                                Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA243","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A244","v":3545},{"$f":"'V. Cloud Security'!K244","v":3},{"$f":"'V. Cloud Security'!L244","v":0},{"$f":"'V. Cloud Security'!Z244","v":0},{"$f":"'V. Cloud Security'!B244","v":"V.1.43.2"},{"$f":"'V. Cloud Security'!C244","v":"Detective controls?"},{"$f":"'V. Cloud Security'!D244","v":0},{"$f":"'V. Cloud Security'!E244","v":0},{"$f":"'V. Cloud Security'!H244","v":0},{"$f":"'V. Cloud Security'!I244","v":"9.2.3\n9.4.3"},{"$f":"'V. Cloud Security'!J244","v":"Management of privileged access rights                                Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA244","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A245","v":3546},{"$f":"'V. Cloud Security'!K245","v":3},{"$f":"'V. Cloud Security'!L245","v":0},{"$f":"'V. Cloud Security'!Z245","v":0},{"$f":"'V. Cloud Security'!B245","v":"V.1.43.3"},{"$f":"'V. Cloud Security'!C245","v":"Corrective controls?"},{"$f":"'V. Cloud Security'!D245","v":0},{"$f":"'V. Cloud Security'!E245","v":0},{"$f":"'V. Cloud Security'!H245","v":0},{"$f":"'V. Cloud Security'!I245","v":"9.2.3\n9.4.4"},{"$f":"'V. Cloud Security'!J245","v":"Management of privileged access rights                                Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA245","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A246","v":3547},{"$f":"'V. Cloud Security'!K246","v":3},{"$f":"'V. Cloud Security'!L246","v":0},{"$f":"'V. Cloud Security'!Z246","v":0},{"$f":"'V. Cloud Security'!B246","v":"V.1.43.4"},{"$f":"'V. Cloud Security'!C246","v":"Policy controls?"},{"$f":"'V. Cloud Security'!D246","v":0},{"$f":"'V. Cloud Security'!E246","v":0},{"$f":"'V. Cloud Security'!H246","v":0},{"$f":"'V. Cloud Security'!I246","v":"9.2.3\n9.4.5"},{"$f":"'V. Cloud Security'!J246","v":"Management of privileged access rights                                Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA246","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A247","v":3548},{"$f":"'V. Cloud Security'!K247","v":2},{"$f":"'V. Cloud Security'!L247","v":0},{"$f":"'V. Cloud Security'!Z247","v":1},{"$f":"'V. Cloud Security'!B247","v":"V.1.44"},{"$f":"'V. Cloud Security'!C247","v":"Are staff able to access client Scoped Data in an unencrypted state?"},{"$f":"'V. Cloud Security'!D247","v":0},{"$f":"'V. Cloud Security'!E247","v":0},{"$f":"'V. Cloud Security'!H247","v":"H.3 Logical Access Authorization"},{"$f":"'V. Cloud Security'!I247","v":"9.2.3\n9.4.6"},{"$f":"'V. Cloud Security'!J247","v":"Management of privileged access rights                                Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA247","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A248","v":3549},{"$f":"'V. Cloud Security'!K248","v":2},{"$f":"'V. Cloud Security'!L248","v":0},{"$f":"'V. Cloud Security'!Z248","v":1},{"$f":"'V. Cloud Security'!B248","v":"V.1.45"},{"$f":"'V. Cloud Security'!C248","v":"Are staff able to access client's encryption key? If not, which of the following controls are used to prevent this:"},{"$f":"'V. Cloud Security'!D248","v":0},{"$f":"'V. Cloud Security'!E248","v":0},{"$f":"'V. Cloud Security'!H248","v":"H.3 Logical Access Authorization"},{"$f":"'V. Cloud Security'!I248","v":"9.2.3\n9.4.7"},{"$f":"'V. Cloud Security'!J248","v":"Management of privileged access rights                                Information access restriction"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA248","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A249","v":3550},{"$f":"'V. Cloud Security'!K249","v":3},{"$f":"'V. Cloud Security'!L249","v":0},{"$f":"'V. Cloud Security'!Z249","v":0},{"$f":"'V. Cloud Security'!B249","v":"V.1.45.1"},{"$f":"'V. Cloud Security'!C249","v":"Preventative controls (e.g., technical)?"},{"$f":"'V. Cloud Security'!D249","v":0},{"$f":"'V. Cloud Security'!E249","v":0},{"$f":"'V. Cloud Security'!H249","v":0},{"$f":"'V. Cloud Security'!I249","v":"NA"},{"$f":"'V. Cloud Security'!J249","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA249","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A250","v":3551},{"$f":"'V. Cloud Security'!K250","v":3},{"$f":"'V. Cloud Security'!L250","v":0},{"$f":"'V. Cloud Security'!Z250","v":0},{"$f":"'V. Cloud Security'!B250","v":"V.1.45.2"},{"$f":"'V. Cloud Security'!C250","v":"Detective controls?"},{"$f":"'V. Cloud Security'!D250","v":0},{"$f":"'V. Cloud Security'!E250","v":0},{"$f":"'V. Cloud Security'!H250","v":0},{"$f":"'V. Cloud Security'!I250","v":"NA"},{"$f":"'V. Cloud Security'!J250","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA250","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A251","v":3552},{"$f":"'V. Cloud Security'!K251","v":3},{"$f":"'V. Cloud Security'!L251","v":0},{"$f":"'V. Cloud Security'!Z251","v":0},{"$f":"'V. Cloud Security'!B251","v":"V.1.45.3"},{"$f":"'V. Cloud Security'!C251","v":"Corrective controls?"},{"$f":"'V. Cloud Security'!D251","v":0},{"$f":"'V. Cloud Security'!E251","v":0},{"$f":"'V. Cloud Security'!H251","v":0},{"$f":"'V. Cloud Security'!I251","v":"NA"},{"$f":"'V. Cloud Security'!J251","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA251","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A252","v":3553},{"$f":"'V. Cloud Security'!K252","v":3},{"$f":"'V. Cloud Security'!L252","v":0},{"$f":"'V. Cloud Security'!Z252","v":0},{"$f":"'V. Cloud Security'!B252","v":"V.1.45.4"},{"$f":"'V. Cloud Security'!C252","v":"Policy controls?"},{"$f":"'V. Cloud Security'!D252","v":0},{"$f":"'V. Cloud Security'!E252","v":0},{"$f":"'V. Cloud Security'!H252","v":0},{"$f":"'V. Cloud Security'!I252","v":"NA"},{"$f":"'V. Cloud Security'!J252","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA252","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A253","v":3554},{"$f":"'V. Cloud Security'!K253","v":2},{"$f":"'V. Cloud Security'!L253","v":0},{"$f":"'V. Cloud Security'!Z253","v":1},{"$f":"'V. Cloud Security'!B253","v":"V.1.46"},{"$f":"'V. Cloud Security'!C253","v":"Is there a process which allows the client to specifically list who from the cloud provider will have access to their Scoped Systems and Data? If yes, does this include:"},{"$f":"'V. Cloud Security'!D253","v":0},{"$f":"'V. Cloud Security'!E253","v":0},{"$f":"'V. Cloud Security'!H253","v":"H.3 Logical Access Authorization"},{"$f":"'V. Cloud Security'!I253","v":"9.1.1                                                        9.2.3"},{"$f":"'V. Cloud Security'!J253","v":"\tAccess Control Policy\nManagement of privileged access rights"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA253","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A254","v":3555},{"$f":"'V. Cloud Security'!K254","v":3},{"$f":"'V. Cloud Security'!L254","v":0},{"$f":"'V. Cloud Security'!Z254","v":0},{"$f":"'V. Cloud Security'!B254","v":"V.1.46.1"},{"$f":"'V. Cloud Security'!C254","v":"Role based access groups?"},{"$f":"'V. Cloud Security'!D254","v":0},{"$f":"'V. Cloud Security'!E254","v":0},{"$f":"'V. Cloud Security'!H254","v":0},{"$f":"'V. Cloud Security'!I254","v":"NA"},{"$f":"'V. Cloud Security'!J254","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA254","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A255","v":3556},{"$f":"'V. Cloud Security'!K255","v":3},{"$f":"'V. Cloud Security'!L255","v":0},{"$f":"'V. Cloud Security'!Z255","v":0},{"$f":"'V. Cloud Security'!B255","v":"V.1.46.2"},{"$f":"'V. Cloud Security'!C255","v":"Written approval from client?"},{"$f":"'V. Cloud Security'!D255","v":0},{"$f":"'V. Cloud Security'!E255","v":0},{"$f":"'V. Cloud Security'!H255","v":0},{"$f":"'V. Cloud Security'!I255","v":"NA"},{"$f":"'V. Cloud Security'!J255","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA255","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A256","v":3557},{"$f":"'V. Cloud Security'!K256","v":3},{"$f":"'V. Cloud Security'!L256","v":0},{"$f":"'V. Cloud Security'!Z256","v":0},{"$f":"'V. Cloud Security'!B256","v":"V.1.46.3"},{"$f":"'V. Cloud Security'!C256","v":"Other?"},{"$f":"'V. Cloud Security'!D256","v":0},{"$f":"'V. Cloud Security'!E256","v":0},{"$f":"'V. Cloud Security'!H256","v":0},{"$f":"'V. Cloud Security'!I256","v":"NA"},{"$f":"'V. Cloud Security'!J256","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA256","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A257","v":3558},{"$f":"'V. Cloud Security'!K257","v":2},{"$f":"'V. Cloud Security'!L257","v":0},{"$f":"'V. Cloud Security'!Z257","v":1},{"$f":"'V. Cloud Security'!B257","v":"V.1.47"},{"$f":"'V. Cloud Security'!C257","v":"Are staff technically prevented from accessing the cloud environment via non-managed private devices? If yes, is it from:"},{"$f":"'V. Cloud Security'!D257","v":0},{"$f":"'V. Cloud Security'!E257","v":0},{"$f":"'V. Cloud Security'!H257","v":"H.3 Logical Access Authorization"},{"$f":"'V. Cloud Security'!I257","v":"9.1.1                                                        9.1.2                                                                               9.2.1                                                  9.2.3 "},{"$f":"'V. Cloud Security'!J257","v":"Access control policy,                            Access to networks and network services,                          User registration and de-registration,                           Management of privileged access rights"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA257","v":"WP.1.E.2, WP.1.H.6"}]
[{"$f":"'V. Cloud Security'!A258","v":3559},{"$f":"'V. Cloud Security'!K258","v":3},{"$f":"'V. Cloud Security'!L258","v":0},{"$f":"'V. Cloud Security'!Z258","v":0},{"$f":"'V. Cloud Security'!B258","v":"V.1.47.1"},{"$f":"'V. Cloud Security'!C258","v":"Admin access (shell or UI): Internally from within cloud provider network?"},{"$f":"'V. Cloud Security'!D258","v":0},{"$f":"'V. Cloud Security'!E258","v":0},{"$f":"'V. Cloud Security'!H258","v":0},{"$f":"'V. Cloud Security'!I258","v":"NA"},{"$f":"'V. Cloud Security'!J258","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA258","v":"WP.1.E.2, WP.1.H.6"}]
[{"$f":"'V. Cloud Security'!A259","v":3560},{"$f":"'V. Cloud Security'!K259","v":3},{"$f":"'V. Cloud Security'!L259","v":0},{"$f":"'V. Cloud Security'!Z259","v":0},{"$f":"'V. Cloud Security'!B259","v":"V.1.47.2"},{"$f":"'V. Cloud Security'!C259","v":"Non-Admin access (shell or UI): Internally from within cloud provider network?"},{"$f":"'V. Cloud Security'!D259","v":0},{"$f":"'V. Cloud Security'!E259","v":0},{"$f":"'V. Cloud Security'!H259","v":0},{"$f":"'V. Cloud Security'!I259","v":"NA"},{"$f":"'V. Cloud Security'!J259","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA259","v":"WP.1.E.2, WP.1.H.6"}]
[{"$f":"'V. Cloud Security'!A260","v":3561},{"$f":"'V. Cloud Security'!K260","v":3},{"$f":"'V. Cloud Security'!L260","v":0},{"$f":"'V. Cloud Security'!Z260","v":0},{"$f":"'V. Cloud Security'!B260","v":"V.1.47.3"},{"$f":"'V. Cloud Security'!C260","v":"Admin access (shell or UI): Remote access?"},{"$f":"'V. Cloud Security'!D260","v":0},{"$f":"'V. Cloud Security'!E260","v":0},{"$f":"'V. Cloud Security'!H260","v":0},{"$f":"'V. Cloud Security'!I260","v":"NA"},{"$f":"'V. Cloud Security'!J260","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA260","v":"WP.1.E.2, WP.1.H.6"}]
[{"$f":"'V. Cloud Security'!A261","v":3562},{"$f":"'V. Cloud Security'!K261","v":3},{"$f":"'V. Cloud Security'!L261","v":0},{"$f":"'V. Cloud Security'!Z261","v":0},{"$f":"'V. Cloud Security'!B261","v":"V.1.47.4"},{"$f":"'V. Cloud Security'!C261","v":"Non-admin access (shell or UI): remote access?"},{"$f":"'V. Cloud Security'!D261","v":0},{"$f":"'V. Cloud Security'!E261","v":0},{"$f":"'V. Cloud Security'!H261","v":0},{"$f":"'V. Cloud Security'!I261","v":"NA"},{"$f":"'V. Cloud Security'!J261","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA261","v":"WP.1.E.2, WP.1.H.6"}]
[{"$f":"'V. Cloud Security'!A262","v":3563},{"$f":"'V. Cloud Security'!K262","v":2},{"$f":"'V. Cloud Security'!L262","v":0},{"$f":"'V. Cloud Security'!Z262","v":1},{"$f":"'V. Cloud Security'!B262","v":"V.1.48"},{"$f":"'V. Cloud Security'!C262","v":"Are there controls to prevent one client attempting to compromise another client in a resource pooled environment? If yes, does that include:"},{"$f":"'V. Cloud Security'!D262","v":0},{"$f":"'V. Cloud Security'!E262","v":0},{"$f":"'V. Cloud Security'!H262","v":"H.3 Logical Access Authorization"},{"$f":"'V. Cloud Security'!I262","v":"12.4.1                                                      15.2.1"},{"$f":"'V. Cloud Security'!J262","v":"Event Logging,\nMonitoring and review of supplier services"},null,null,7.1,null,null,{"$f":"'V. Cloud Security'!AA262","v":"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A263","v":3564},{"$f":"'V. Cloud Security'!K263","v":3},{"$f":"'V. Cloud Security'!L263","v":0},{"$f":"'V. Cloud Security'!Z263","v":0},{"$f":"'V. Cloud Security'!B263","v":"V.1.48.1"},{"$f":"'V. Cloud Security'!C263","v":"Inbound/Outbound firewall?"},{"$f":"'V. Cloud Security'!D263","v":0},{"$f":"'V. Cloud Security'!E263","v":0},{"$f":"'V. Cloud Security'!H263","v":0},{"$f":"'V. Cloud Security'!I263","v":"12.4.1                                                      15.2.1"},{"$f":"'V. Cloud Security'!J263","v":"Event Logging,\nMonitoring and review of supplier services"},null,null,1.1000000000000001,null,null,{"$f":"'V. Cloud Security'!AA263","v":"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A264","v":3565},{"$f":"'V. Cloud Security'!K264","v":3},{"$f":"'V. Cloud Security'!L264","v":0},{"$f":"'V. Cloud Security'!Z264","v":0},{"$f":"'V. Cloud Security'!B264","v":"V.1.48.2"},{"$f":"'V. Cloud Security'!C264","v":"IPS?"},{"$f":"'V. Cloud Security'!D264","v":0},{"$f":"'V. Cloud Security'!E264","v":0},{"$f":"'V. Cloud Security'!H264","v":0},{"$f":"'V. Cloud Security'!I264","v":"12.4.1                                                      15.2.1"},{"$f":"'V. Cloud Security'!J264","v":"Event Logging,\nMonitoring and review of supplier services"},null,null,"1.2.1",null,null,{"$f":"'V. Cloud Security'!AA264","v":"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A265","v":3566},{"$f":"'V. Cloud Security'!K265","v":3},{"$f":"'V. Cloud Security'!L265","v":0},{"$f":"'V. Cloud Security'!Z265","v":0},{"$f":"'V. Cloud Security'!B265","v":"V.1.48.3"},{"$f":"'V. Cloud Security'!C265","v":"Real-time alerting?"},{"$f":"'V. Cloud Security'!D265","v":0},{"$f":"'V. Cloud Security'!E265","v":0},{"$f":"'V. Cloud Security'!H265","v":0},{"$f":"'V. Cloud Security'!I265","v":"12.4.1                                                      15.2.1"},{"$f":"'V. Cloud Security'!J265","v":"Event Logging,\nMonitoring and review of supplier services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA265","v":"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A266","v":3567},{"$f":"'V. Cloud Security'!K266","v":3},{"$f":"'V. Cloud Security'!L266","v":0},{"$f":"'V. Cloud Security'!Z266","v":0},{"$f":"'V. Cloud Security'!B266","v":"V.1.48.4"},{"$f":"'V. Cloud Security'!C266","v":"Real-time monitoring by cloud provider?"},{"$f":"'V. Cloud Security'!D266","v":0},{"$f":"'V. Cloud Security'!E266","v":0},{"$f":"'V. Cloud Security'!H266","v":0},{"$f":"'V. Cloud Security'!I266","v":"12.4.1                                                      15.2.1"},{"$f":"'V. Cloud Security'!J266","v":"Event Logging,\nMonitoring and review of supplier services"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA266","v":"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A267","v":3568},{"$f":"'V. Cloud Security'!K267","v":2},{"$f":"'V. Cloud Security'!L267","v":0},{"$f":"'V. Cloud Security'!Z267","v":1},{"$f":"'V. Cloud Security'!B267","v":"V.1.49"},{"$f":"'V. Cloud Security'!C267","v":"Is a default hardened base virtual image available to clients? If yes, does it include:"},{"$f":"'V. Cloud Security'!D267","v":0},{"$f":"'V. Cloud Security'!E267","v":0},{"$f":"'V. Cloud Security'!H267","v":"I.3 Secure System Hardening Standards"},{"$f":"'V. Cloud Security'!I267","v":"NA"},{"$f":"'V. Cloud Security'!J267","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA267","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A268","v":3569},{"$f":"'V. Cloud Security'!K268","v":3},{"$f":"'V. Cloud Security'!L268","v":0},{"$f":"'V. Cloud Security'!Z268","v":0},{"$f":"'V. Cloud Security'!B268","v":"V.1.49.1"},{"$f":"'V. Cloud Security'!C268","v":"Cloud providers default hardened Image?"},{"$f":"'V. Cloud Security'!D268","v":0},{"$f":"'V. Cloud Security'!E268","v":0},{"$f":"'V. Cloud Security'!H268","v":0},{"$f":"'V. Cloud Security'!I268","v":"NA"},{"$f":"'V. Cloud Security'!J268","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA268","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A269","v":3570},{"$f":"'V. Cloud Security'!K269","v":3},{"$f":"'V. Cloud Security'!L269","v":0},{"$f":"'V. Cloud Security'!Z269","v":0},{"$f":"'V. Cloud Security'!B269","v":"V.1.49.2"},{"$f":"'V. Cloud Security'!C269","v":"Client supplied default hardening Image?"},{"$f":"'V. Cloud Security'!D269","v":0},{"$f":"'V. Cloud Security'!E269","v":0},{"$f":"'V. Cloud Security'!H269","v":0},{"$f":"'V. Cloud Security'!I269","v":"NA"},{"$f":"'V. Cloud Security'!J269","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA269","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A270","v":3571},{"$f":"'V. Cloud Security'!K270","v":3},{"$f":"'V. Cloud Security'!L270","v":0},{"$f":"'V. Cloud Security'!Z270","v":0},{"$f":"'V. Cloud Security'!B270","v":"V.1.49.3"},{"$f":"'V. Cloud Security'!C270","v":"Center for Internet Security (CIS) hardening standard?"},{"$f":"'V. Cloud Security'!D270","v":0},{"$f":"'V. Cloud Security'!E270","v":0},{"$f":"'V. Cloud Security'!H270","v":0},{"$f":"'V. Cloud Security'!I270","v":"NA"},{"$f":"'V. Cloud Security'!J270","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA270","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A271","v":3572},{"$f":"'V. Cloud Security'!K271","v":3},{"$f":"'V. Cloud Security'!L271","v":0},{"$f":"'V. Cloud Security'!Z271","v":0},{"$f":"'V. Cloud Security'!B271","v":"V.1.49.4"},{"$f":"'V. Cloud Security'!C271","v":"National Institute of Standards and Technology (NIST) hardening standard?"},{"$f":"'V. Cloud Security'!D271","v":0},{"$f":"'V. Cloud Security'!E271","v":0},{"$f":"'V. Cloud Security'!H271","v":0},{"$f":"'V. Cloud Security'!I271","v":"NA"},{"$f":"'V. Cloud Security'!J271","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA271","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A272","v":3573},{"$f":"'V. Cloud Security'!K272","v":3},{"$f":"'V. Cloud Security'!L272","v":0},{"$f":"'V. Cloud Security'!Z272","v":0},{"$f":"'V. Cloud Security'!B272","v":"V.1.49.5"},{"$f":"'V. Cloud Security'!C272","v":"SANS hardening standard?"},{"$f":"'V. Cloud Security'!D272","v":0},{"$f":"'V. Cloud Security'!E272","v":0},{"$f":"'V. Cloud Security'!H272","v":0},{"$f":"'V. Cloud Security'!I272","v":"NA"},{"$f":"'V. Cloud Security'!J272","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA272","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A273","v":3574},{"$f":"'V. Cloud Security'!K273","v":3},{"$f":"'V. Cloud Security'!L273","v":0},{"$f":"'V. Cloud Security'!Z273","v":0},{"$f":"'V. Cloud Security'!B273","v":"V.1.49.6"},{"$f":"'V. Cloud Security'!C273","v":"Vendor hardening standard?"},{"$f":"'V. Cloud Security'!D273","v":0},{"$f":"'V. Cloud Security'!E273","v":0},{"$f":"'V. Cloud Security'!H273","v":0},{"$f":"'V. Cloud Security'!I273","v":"NA"},{"$f":"'V. Cloud Security'!J273","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA273","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A274","v":3575},{"$f":"'V. Cloud Security'!K274","v":3},{"$f":"'V. Cloud Security'!L274","v":0},{"$f":"'V. Cloud Security'!Z274","v":0},{"$f":"'V. Cloud Security'!B274","v":"V.1.49.7"},{"$f":"'V. Cloud Security'!C274","v":"Other?"},{"$f":"'V. Cloud Security'!D274","v":0},{"$f":"'V. Cloud Security'!E274","v":0},{"$f":"'V. Cloud Security'!H274","v":0},{"$f":"'V. Cloud Security'!I274","v":"NA"},{"$f":"'V. Cloud Security'!J274","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA274","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A275","v":3576},{"$f":"'V. Cloud Security'!K275","v":2},{"$f":"'V. Cloud Security'!L275","v":0},{"$f":"'V. Cloud Security'!Z275","v":0},{"$f":"'V. Cloud Security'!B275","v":"V.1.50"},{"$f":"'V. Cloud Security'!C275","v":"Are systems and applications patched? If yes, how:"},{"$f":"'V. Cloud Security'!D275","v":0},{"$f":"'V. Cloud Security'!E275","v":0},{"$f":"'V. Cloud Security'!H275","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I275","v":"12.6.1 "},{"$f":"'V. Cloud Security'!J275","v":"Management of technical vulnerabilities"},null,null,6.2]
[{"$f":"'V. Cloud Security'!A276","v":3577},{"$f":"'V. Cloud Security'!K276","v":3},{"$f":"'V. Cloud Security'!L276","v":0},{"$f":"'V. Cloud Security'!Z276","v":0},{"$f":"'V. Cloud Security'!B276","v":"V.1.50.1"},{"$f":"'V. Cloud Security'!C276","v":"Cloud provider: deploy to the live server?"},{"$f":"'V. Cloud Security'!D276","v":0},{"$f":"'V. Cloud Security'!E276","v":0},{"$f":"'V. Cloud Security'!H276","v":0},{"$f":"'V. Cloud Security'!I276","v":"NA"},{"$f":"'V. Cloud Security'!J276","v":0},null,null,6.2,null,null,{"$f":"'V. Cloud Security'!AA276","v":"WP.1.C.2, WP.1.C.3, WP.1.C.4, WP.1.F.4, WP.1.I.4, WP.1.I.6, WP.1.J.5"}]
[{"$f":"'V. Cloud Security'!A277","v":3578},{"$f":"'V. Cloud Security'!K277","v":3},{"$f":"'V. Cloud Security'!L277","v":0},{"$f":"'V. Cloud Security'!Z277","v":0},{"$f":"'V. Cloud Security'!B277","v":"V.1.50.2"},{"$f":"'V. Cloud Security'!C277","v":"Client: deploy to the live server?"},{"$f":"'V. Cloud Security'!D277","v":0},{"$f":"'V. Cloud Security'!E277","v":0},{"$f":"'V. Cloud Security'!H277","v":0},{"$f":"'V. Cloud Security'!I277","v":"NA"},{"$f":"'V. Cloud Security'!J277","v":0},null,null,6.2,null,null,{"$f":"'V. Cloud Security'!AA277","v":"WP.1.C.2, WP.1.C.3, WP.1.C.4, WP.1.F.4, WP.1.I.4, WP.1.I.6, WP.1.J.5"}]
[{"$f":"'V. Cloud Security'!A278","v":3579},{"$f":"'V. Cloud Security'!K278","v":3},{"$f":"'V. Cloud Security'!L278","v":0},{"$f":"'V. Cloud Security'!Z278","v":0},{"$f":"'V. Cloud Security'!B278","v":"V.1.50.3"},{"$f":"'V. Cloud Security'!C278","v":"Cloud provider: deploy to the base image?"},{"$f":"'V. Cloud Security'!D278","v":0},{"$f":"'V. Cloud Security'!E278","v":0},{"$f":"'V. Cloud Security'!H278","v":0},{"$f":"'V. Cloud Security'!I278","v":"NA"},{"$f":"'V. Cloud Security'!J278","v":0},null,null,6.2,null,null,{"$f":"'V. Cloud Security'!AA278","v":"WP.1.C.2, WP.1.C.3, WP.1.C.4, WP.1.F.4, WP.1.I.4, WP.1.I.6, WP.1.J.5"}]
[{"$f":"'V. Cloud Security'!A279","v":3580},{"$f":"'V. Cloud Security'!K279","v":3},{"$f":"'V. Cloud Security'!L279","v":0},{"$f":"'V. Cloud Security'!Z279","v":0},{"$f":"'V. Cloud Security'!B279","v":"V.1.50.4"},{"$f":"'V. Cloud Security'!C279","v":"Client: deploy to the base image?"},{"$f":"'V. Cloud Security'!D279","v":0},{"$f":"'V. Cloud Security'!E279","v":0},{"$f":"'V. Cloud Security'!H279","v":0},{"$f":"'V. Cloud Security'!I279","v":"NA"},{"$f":"'V. Cloud Security'!J279","v":0},null,null,6.2,null,null,{"$f":"'V. Cloud Security'!AA279","v":"WP.1.C.2, WP.1.C.3, WP.1.C.4, WP.1.F.4, WP.1.I.4, WP.1.I.6, WP.1.J.5"}]
[{"$f":"'V. Cloud Security'!A280","v":3581},{"$f":"'V. Cloud Security'!K280","v":3},{"$f":"'V. Cloud Security'!L280","v":0},{"$f":"'V. Cloud Security'!Z280","v":0},{"$f":"'V. Cloud Security'!B280","v":"V.1.50.5"},{"$f":"'V. Cloud Security'!C280","v":"Other?"},{"$f":"'V. Cloud Security'!D280","v":0},{"$f":"'V. Cloud Security'!E280","v":0},{"$f":"'V. Cloud Security'!H280","v":0},{"$f":"'V. Cloud Security'!I280","v":"NA"},{"$f":"'V. Cloud Security'!J280","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA280","v":"WP.1.C.2, WP.1.C.3, WP.1.C.4, WP.1.F.4, WP.1.I.4, WP.1.I.6, WP.1.J.5"}]
[{"$f":"'V. Cloud Security'!A281","v":3582},{"$f":"'V. Cloud Security'!K281","v":2},{"$f":"'V. Cloud Security'!L281","v":1},{"$f":"'V. Cloud Security'!Z281","v":0},{"$f":"'V. Cloud Security'!B281","v":"V.1.51"},{"$f":"'V. Cloud Security'!C281","v":"Which of the following are responsible for the base image and patching:"},{"$f":"'V. Cloud Security'!D281","v":0},{"$f":"'V. Cloud Security'!E281","v":0},{"$f":"'V. Cloud Security'!H281","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I281","v":"12.6.1 "},{"$f":"'V. Cloud Security'!J281","v":"Management of technical vulnerabilities"},null,null,6.2,null,null,{"$f":"'V. Cloud Security'!AA281","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A282","v":3583},{"$f":"'V. Cloud Security'!K282","v":3},{"$f":"'V. Cloud Security'!L282","v":0},{"$f":"'V. Cloud Security'!Z282","v":0},{"$f":"'V. Cloud Security'!B282","v":"V.1.51.1"},{"$f":"'V. Cloud Security'!C282","v":"Cloud provider: initial base image hardening and patching?"},{"$f":"'V. Cloud Security'!D282","v":0},{"$f":"'V. Cloud Security'!E282","v":0},{"$f":"'V. Cloud Security'!H282","v":0},{"$f":"'V. Cloud Security'!I282","v":"NA"},{"$f":"'V. Cloud Security'!J282","v":0},null,null,6.2,null,null,{"$f":"'V. Cloud Security'!AA282","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A283","v":3584},{"$f":"'V. Cloud Security'!K283","v":3},{"$f":"'V. Cloud Security'!L283","v":0},{"$f":"'V. Cloud Security'!Z283","v":0},{"$f":"'V. Cloud Security'!B283","v":"V.1.51.2"},{"$f":"'V. Cloud Security'!C283","v":"Client: Initial base image hardening and patching?"},{"$f":"'V. Cloud Security'!D283","v":0},{"$f":"'V. Cloud Security'!E283","v":0},{"$f":"'V. Cloud Security'!H283","v":0},{"$f":"'V. Cloud Security'!I283","v":"NA"},{"$f":"'V. Cloud Security'!J283","v":0},null,null,6.2,null,null,{"$f":"'V. Cloud Security'!AA283","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A284","v":3585},{"$f":"'V. Cloud Security'!K284","v":3},{"$f":"'V. Cloud Security'!L284","v":0},{"$f":"'V. Cloud Security'!Z284","v":0},{"$f":"'V. Cloud Security'!B284","v":"V.1.51.3"},{"$f":"'V. Cloud Security'!C284","v":"Cloud provider: ongoing hardening and patching?"},{"$f":"'V. Cloud Security'!D284","v":0},{"$f":"'V. Cloud Security'!E284","v":0},{"$f":"'V. Cloud Security'!H284","v":0},{"$f":"'V. Cloud Security'!I284","v":"NA"},{"$f":"'V. Cloud Security'!J284","v":0},null,null,6.2,null,null,{"$f":"'V. Cloud Security'!AA284","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A285","v":3586},{"$f":"'V. Cloud Security'!K285","v":3},{"$f":"'V. Cloud Security'!L285","v":0},{"$f":"'V. Cloud Security'!Z285","v":0},{"$f":"'V. Cloud Security'!B285","v":"V.1.51.4"},{"$f":"'V. Cloud Security'!C285","v":"Client: ongoing hardening and patching?"},{"$f":"'V. Cloud Security'!D285","v":0},{"$f":"'V. Cloud Security'!E285","v":0},{"$f":"'V. Cloud Security'!H285","v":0},{"$f":"'V. Cloud Security'!I285","v":"NA"},{"$f":"'V. Cloud Security'!J285","v":0},null,null,6.2,null,null,{"$f":"'V. Cloud Security'!AA285","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A286","v":3587},{"$f":"'V. Cloud Security'!K286","v":2},{"$f":"'V. Cloud Security'!L286","v":0},{"$f":"'V. Cloud Security'!Z286","v":0},{"$f":"'V. Cloud Security'!B286","v":"V.1.52"},{"$f":"'V. Cloud Security'!C286","v":"Can image versions be electronically signed to insure integrity? If yes, who would perform:"},{"$f":"'V. Cloud Security'!D286","v":0},{"$f":"'V. Cloud Security'!E286","v":0},{"$f":"'V. Cloud Security'!H286","v":0},{"$f":"'V. Cloud Security'!I286","v":"14.2.2                                                     14.2.4"},{"$f":"'V. Cloud Security'!J286","v":"System change control procedures,                                Restrictions on changes to software packages"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA286","v":"WP.1.D.1, WP.1.D.2, WP.1.D.3, WP.1.J.4, WP.1.J.5, WP.1.F4"}]
[{"$f":"'V. Cloud Security'!A287","v":3588},{"$f":"'V. Cloud Security'!K287","v":3},{"$f":"'V. Cloud Security'!L287","v":0},{"$f":"'V. Cloud Security'!Z287","v":0},{"$f":"'V. Cloud Security'!B287","v":"V.1.52.1"},{"$f":"'V. Cloud Security'!C287","v":"Cloud provider?"},{"$f":"'V. Cloud Security'!D287","v":0},{"$f":"'V. Cloud Security'!E287","v":0},{"$f":"'V. Cloud Security'!H287","v":0},{"$f":"'V. Cloud Security'!I287","v":"NA"},{"$f":"'V. Cloud Security'!J287","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA287","v":"WP.1.D.1, WP.1.D.2, WP.1.D.3, WP.1.J.4, WP.1.J.5, WP.1.F4"}]
[{"$f":"'V. Cloud Security'!A288","v":3589},{"$f":"'V. Cloud Security'!K288","v":3},{"$f":"'V. Cloud Security'!L288","v":0},{"$f":"'V. Cloud Security'!Z288","v":0},{"$f":"'V. Cloud Security'!B288","v":"V.1.52.2"},{"$f":"'V. Cloud Security'!C288","v":"Client?"},{"$f":"'V. Cloud Security'!D288","v":0},{"$f":"'V. Cloud Security'!E288","v":0},{"$f":"'V. Cloud Security'!H288","v":0},{"$f":"'V. Cloud Security'!I288","v":"NA"},{"$f":"'V. Cloud Security'!J288","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA288","v":"WP.1.D.1, WP.1.D.2, WP.1.D.3, WP.1.J.4, WP.1.J.5, WP.1.F4"}]
[{"$f":"'V. Cloud Security'!A289","v":3590},{"$f":"'V. Cloud Security'!K289","v":2},{"$f":"'V. Cloud Security'!L289","v":0},{"$f":"'V. Cloud Security'!Z289","v":1},{"$f":"'V. Cloud Security'!B289","v":"V.1.53"},{"$f":"'V. Cloud Security'!C289","v":"Can clients run their own security services within their own cloud environment? If yes, can it include:"},{"$f":"'V. Cloud Security'!D289","v":0},{"$f":"'V. Cloud Security'!E289","v":0},{"$f":"'V. Cloud Security'!H289","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!I289","v":"12.4.1                                                     12.4.3                                                 12.5                                                12.6.1 "},{"$f":"'V. Cloud Security'!J289","v":"Event logging,                           Administrator and operator logs,                                     Control of operational software,                   Management of technical vulnerabilities"},null,null,"5.1, 5.2",null,null,{"$f":"'V. Cloud Security'!AA289","v":"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6"}]
[{"$f":"'V. Cloud Security'!A290","v":3591},{"$f":"'V. Cloud Security'!K290","v":3},{"$f":"'V. Cloud Security'!L290","v":0},{"$f":"'V. Cloud Security'!Z290","v":0},{"$f":"'V. Cloud Security'!B290","v":"V.1.53.1"},{"$f":"'V. Cloud Security'!C290","v":"Firewall?"},{"$f":"'V. Cloud Security'!D290","v":0},{"$f":"'V. Cloud Security'!E290","v":0},{"$f":"'V. Cloud Security'!H290","v":0},{"$f":"'V. Cloud Security'!I290","v":"NA"},{"$f":"'V. Cloud Security'!J290","v":0},null,null,"5.1, 5.2",null,null,{"$f":"'V. Cloud Security'!AA290","v":"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6"}]
[{"$f":"'V. Cloud Security'!A291","v":3592},{"$f":"'V. Cloud Security'!K291","v":3},{"$f":"'V. Cloud Security'!L291","v":0},{"$f":"'V. Cloud Security'!Z291","v":0},{"$f":"'V. Cloud Security'!B291","v":"V.1.53.2"},{"$f":"'V. Cloud Security'!C291","v":"IDS/IPS?"},{"$f":"'V. Cloud Security'!D291","v":0},{"$f":"'V. Cloud Security'!E291","v":0},{"$f":"'V. Cloud Security'!H291","v":0},{"$f":"'V. Cloud Security'!I291","v":"NA"},{"$f":"'V. Cloud Security'!J291","v":0},null,null,"5.1, 5.2",null,null,{"$f":"'V. Cloud Security'!AA291","v":"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6"}]
[{"$f":"'V. Cloud Security'!A292","v":3593},{"$f":"'V. Cloud Security'!K292","v":3},{"$f":"'V. Cloud Security'!L292","v":0},{"$f":"'V. Cloud Security'!Z292","v":0},{"$f":"'V. Cloud Security'!B292","v":"V.1.53.3"},{"$f":"'V. Cloud Security'!C292","v":"Data integrity monitoring (host based Integrity)?"},{"$f":"'V. Cloud Security'!D292","v":0},{"$f":"'V. Cloud Security'!E292","v":0},{"$f":"'V. Cloud Security'!H292","v":0},{"$f":"'V. Cloud Security'!I292","v":"NA"},{"$f":"'V. Cloud Security'!J292","v":0},null,null,3.7,null,null,{"$f":"'V. Cloud Security'!AA292","v":"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6"}]
[{"$f":"'V. Cloud Security'!A293","v":3594},{"$f":"'V. Cloud Security'!K293","v":3},{"$f":"'V. Cloud Security'!L293","v":0},{"$f":"'V. Cloud Security'!Z293","v":0},{"$f":"'V. Cloud Security'!B293","v":"V.1.53.4"},{"$f":"'V. Cloud Security'!C293","v":"Anti virus?"},{"$f":"'V. Cloud Security'!D293","v":0},{"$f":"'V. Cloud Security'!E293","v":0},{"$f":"'V. Cloud Security'!H293","v":0},{"$f":"'V. Cloud Security'!I293","v":"NA"},{"$f":"'V. Cloud Security'!J293","v":0},null,null,"5.1, 5.2",null,null,{"$f":"'V. Cloud Security'!AA293","v":"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6"}]
[{"$f":"'V. Cloud Security'!A294","v":3595},{"$f":"'V. Cloud Security'!K294","v":3},{"$f":"'V. Cloud Security'!L294","v":0},{"$f":"'V. Cloud Security'!Z294","v":0},{"$f":"'V. Cloud Security'!B294","v":"V.1.53.5"},{"$f":"'V. Cloud Security'!C294","v":"Other (please specify)?"},{"$f":"'V. Cloud Security'!D294","v":0},{"$f":"'V. Cloud Security'!E294","v":0},{"$f":"'V. Cloud Security'!H294","v":0},{"$f":"'V. Cloud Security'!I294","v":"NA"},{"$f":"'V. Cloud Security'!J294","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA294","v":"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6"}]
[{"$f":"'V. Cloud Security'!A295","v":3596},{"$f":"'V. Cloud Security'!K295","v":2},{"$f":"'V. Cloud Security'!L295","v":0},{"$f":"'V. Cloud Security'!Z295","v":0},{"$f":"'V. Cloud Security'!B295","v":"V.1.54"},{"$f":"'V. Cloud Security'!C295","v":"Is 24x7x365 security monitoring performed? If yes, does it include:"},{"$f":"'V. Cloud Security'!D295","v":0},{"$f":"'V. Cloud Security'!E295","v":0},{"$f":"'V. Cloud Security'!H295","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I295","v":"12.4.1                                                     12.4.3                                                 12.5                                                12.6.1 "},{"$f":"'V. Cloud Security'!J295","v":"Event logging,                           Administrator and operator logs,                                     Control of operational software,                   Management of technical vulnerabilities"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA295","v":"WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A296","v":3597},{"$f":"'V. Cloud Security'!K296","v":3},{"$f":"'V. Cloud Security'!L296","v":0},{"$f":"'V. Cloud Security'!Z296","v":0},{"$f":"'V. Cloud Security'!B296","v":"V.1.54.1"},{"$f":"'V. Cloud Security'!C296","v":"Inbound: Internet to cloud platform (client)?"},{"$f":"'V. Cloud Security'!D296","v":0},{"$f":"'V. Cloud Security'!E296","v":0},{"$f":"'V. Cloud Security'!H296","v":0},{"$f":"'V. Cloud Security'!I296","v":"NA"},{"$f":"'V. Cloud Security'!J296","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA296","v":"WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A297","v":3598},{"$f":"'V. Cloud Security'!K297","v":3},{"$f":"'V. Cloud Security'!L297","v":0},{"$f":"'V. Cloud Security'!Z297","v":0},{"$f":"'V. Cloud Security'!B297","v":"V.1.54.2"},{"$f":"'V. Cloud Security'!C297","v":"Outbound: Cloud platform (client) to internet?"},{"$f":"'V. Cloud Security'!D297","v":0},{"$f":"'V. Cloud Security'!E297","v":0},{"$f":"'V. Cloud Security'!H297","v":0},{"$f":"'V. Cloud Security'!I297","v":"NA"},{"$f":"'V. Cloud Security'!J297","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA297","v":"WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A298","v":3599},{"$f":"'V. Cloud Security'!K298","v":3},{"$f":"'V. Cloud Security'!L298","v":0},{"$f":"'V. Cloud Security'!Z298","v":0},{"$f":"'V. Cloud Security'!B298","v":"V.1.54.3"},{"$f":"'V. Cloud Security'!C298","v":"Internal: Cloud staff environment to cloud platform (client)?"},{"$f":"'V. Cloud Security'!D298","v":0},{"$f":"'V. Cloud Security'!E298","v":0},{"$f":"'V. Cloud Security'!H298","v":0},{"$f":"'V. Cloud Security'!I298","v":"NA"},{"$f":"'V. Cloud Security'!J298","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA298","v":"WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A299","v":3600},{"$f":"'V. Cloud Security'!K299","v":3},{"$f":"'V. Cloud Security'!L299","v":0},{"$f":"'V. Cloud Security'!Z299","v":0},{"$f":"'V. Cloud Security'!B299","v":"V.1.54.4"},{"$f":"'V. Cloud Security'!C299","v":"Internal: Cloud platform (client) to cloud staff environment?"},{"$f":"'V. Cloud Security'!D299","v":0},{"$f":"'V. Cloud Security'!E299","v":0},{"$f":"'V. Cloud Security'!H299","v":0},{"$f":"'V. Cloud Security'!I299","v":"NA"},{"$f":"'V. Cloud Security'!J299","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA299","v":"WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A300","v":3601},{"$f":"'V. Cloud Security'!K300","v":3},{"$f":"'V. Cloud Security'!L300","v":0},{"$f":"'V. Cloud Security'!Z300","v":0},{"$f":"'V. Cloud Security'!B300","v":"V.1.54.5"},{"$f":"'V. Cloud Security'!C300","v":"Internal: Cloud platform (client) to cloud platform (client)?"},{"$f":"'V. Cloud Security'!D300","v":0},{"$f":"'V. Cloud Security'!E300","v":0},{"$f":"'V. Cloud Security'!H300","v":0},{"$f":"'V. Cloud Security'!I300","v":"NA"},{"$f":"'V. Cloud Security'!J300","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA300","v":"WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A301","v":3602},{"$f":"'V. Cloud Security'!K301","v":2},{"$f":"'V. Cloud Security'!L301","v":0},{"$f":"'V. Cloud Security'!Z301","v":1},{"$f":"'V. Cloud Security'!B301","v":"V.1.55"},{"$f":"'V. Cloud Security'!C301","v":"Is there a specific Recovery Time Objective (RTO)? If yes, specify."},{"$f":"'V. Cloud Security'!D301","v":0},{"$f":"'V. Cloud Security'!E301","v":0},{"$f":"'V. Cloud Security'!H301","v":0},{"$f":"'V. Cloud Security'!I301","v":"17.1.2"},{"$f":"'V. Cloud Security'!J301","v":"Implementing information security continuity"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA301","v":"WP.1.K.10"}]
[{"$f":"'V. Cloud Security'!A302","v":3603},{"$f":"'V. Cloud Security'!K302","v":2},{"$f":"'V. Cloud Security'!L302","v":0},{"$f":"'V. Cloud Security'!Z302","v":0},{"$f":"'V. Cloud Security'!B302","v":"V.1.56"},{"$f":"'V. Cloud Security'!C302","v":"Is there a specific Recovery Point Objective (RPO)? If yes, specify."},{"$f":"'V. Cloud Security'!D302","v":0},{"$f":"'V. Cloud Security'!E302","v":0},{"$f":"'V. Cloud Security'!H302","v":0},{"$f":"'V. Cloud Security'!I302","v":"17.1.2"},{"$f":"'V. Cloud Security'!J302","v":"Implementing information security continuity"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA302","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A303","v":3604},{"$f":"'V. Cloud Security'!K303","v":2},{"$f":"'V. Cloud Security'!L303","v":0},{"$f":"'V. Cloud Security'!Z303","v":0},{"$f":"'V. Cloud Security'!B303","v":"V.1.57"},{"$f":"'V. Cloud Security'!C303","v":"Are any critical vendors necessary to provide the scoped services to clients?"},{"$f":"'V. Cloud Security'!D303","v":0},{"$f":"'V. Cloud Security'!E303","v":0},{"$f":"'V. Cloud Security'!H303","v":"V.2 Nested Service Provider Relationships"},{"$f":"'V. Cloud Security'!I303","v":"17.1.2                                                     17.2.1"},{"$f":"'V. Cloud Security'!J303","v":"Implementing information security continuity,             Availability of information processing facilities"},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A304","v":3605},{"$f":"'V. Cloud Security'!K304","v":3},{"$f":"'V. Cloud Security'!L304","v":0},{"$f":"'V. Cloud Security'!Z304","v":0},{"$f":"'V. Cloud Security'!B304","v":"V.1.57.1"},{"$f":"'V. Cloud Security'!C304","v":"Is a critical vendor dependency chart made available to clients?"},{"$f":"'V. Cloud Security'!D304","v":0},{"$f":"'V. Cloud Security'!E304","v":0},{"$f":"'V. Cloud Security'!H304","v":"V.2 Nested Service Provider Relationships"},{"$f":"'V. Cloud Security'!I304","v":"17.1.2                                                     17.2.1"},{"$f":"'V. Cloud Security'!J304","v":"Implementing information security continuity,             Availability of information processing facilities"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA304","v":"WP.1.K.7"}]
[{"$f":"'V. Cloud Security'!A305","v":3606},{"$f":"'V. Cloud Security'!K305","v":3},{"$f":"'V. Cloud Security'!L305","v":0},{"$f":"'V. Cloud Security'!Z305","v":0},{"$f":"'V. Cloud Security'!B305","v":"V.1.57.2"},{"$f":"'V. Cloud Security'!C305","v":"Are each of the vendors identified in the vendor dependency chart subjected to at least an annual disaster recovery test for service provided? If yes, is the test:"},{"$f":"'V. Cloud Security'!D305","v":0},{"$f":"'V. Cloud Security'!E305","v":0},{"$f":"'V. Cloud Security'!H305","v":"V.2 Nested Service Provider Relationships"},{"$f":"'V. Cloud Security'!I305","v":"17.1.2                                                     17.2.1"},{"$f":"'V. Cloud Security'!J305","v":"Implementing information security continuity,             Availability of information processing facilities"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA305","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A306","v":3607},{"$f":"'V. Cloud Security'!K306","v":4},{"$f":"'V. Cloud Security'!L306","v":0},{"$f":"'V. Cloud Security'!Z306","v":0},{"$f":"'V. Cloud Security'!B306","v":"V.1.57.2.1"},{"$f":"'V. Cloud Security'!C306","v":"Table top?"},{"$f":"'V. Cloud Security'!D306","v":0},{"$f":"'V. Cloud Security'!E306","v":0},{"$f":"'V. Cloud Security'!H306","v":0},{"$f":"'V. Cloud Security'!I306","v":"NA"},{"$f":"'V. Cloud Security'!J306","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA306","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A307","v":3608},{"$f":"'V. Cloud Security'!K307","v":4},{"$f":"'V. Cloud Security'!L307","v":0},{"$f":"'V. Cloud Security'!Z307","v":0},{"$f":"'V. Cloud Security'!B307","v":"V.1.57.2.2"},{"$f":"'V. Cloud Security'!C307","v":"Simulated test?"},{"$f":"'V. Cloud Security'!D307","v":0},{"$f":"'V. Cloud Security'!E307","v":0},{"$f":"'V. Cloud Security'!H307","v":0},{"$f":"'V. Cloud Security'!I307","v":"NA"},{"$f":"'V. Cloud Security'!J307","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA307","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A308","v":3609},{"$f":"'V. Cloud Security'!K308","v":4},{"$f":"'V. Cloud Security'!L308","v":0},{"$f":"'V. Cloud Security'!Z308","v":0},{"$f":"'V. Cloud Security'!B308","v":"V.1.57.2.3"},{"$f":"'V. Cloud Security'!C308","v":"Functional test?"},{"$f":"'V. Cloud Security'!D308","v":0},{"$f":"'V. Cloud Security'!E308","v":0},{"$f":"'V. Cloud Security'!H308","v":0},{"$f":"'V. Cloud Security'!I308","v":"NA"},{"$f":"'V. Cloud Security'!J308","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA308","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A309","v":3610},{"$f":"'V. Cloud Security'!K309","v":4},{"$f":"'V. Cloud Security'!L309","v":0},{"$f":"'V. Cloud Security'!Z309","v":0},{"$f":"'V. Cloud Security'!B309","v":"V.1.57.2.4"},{"$f":"'V. Cloud Security'!C309","v":"Full scale failover?"},{"$f":"'V. Cloud Security'!D309","v":0},{"$f":"'V. Cloud Security'!E309","v":0},{"$f":"'V. Cloud Security'!H309","v":0},{"$f":"'V. Cloud Security'!I309","v":"NA"},{"$f":"'V. Cloud Security'!J309","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA309","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A310","v":3611},{"$f":"'V. Cloud Security'!K310","v":2},{"$f":"'V. Cloud Security'!L310","v":1},{"$f":"'V. Cloud Security'!Z310","v":0},{"$f":"'V. Cloud Security'!B310","v":"V.1.58"},{"$f":"'V. Cloud Security'!C310","v":"How many different critical vendors is the live cloud platform running on at any given time:"},{"$f":"'V. Cloud Security'!D310","v":0},{"$f":"'V. Cloud Security'!E310","v":0},{"$f":"'V. Cloud Security'!H310","v":"V.2 Nested Service Provider Relationships"},{"$f":"'V. Cloud Security'!I310","v":"17.1.3"},{"$f":"'V. Cloud Security'!J310","v":"Verify, review and evaluate information security continuity"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA310","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A311","v":3612},{"$f":"'V. Cloud Security'!K311","v":3},{"$f":"'V. Cloud Security'!L311","v":0},{"$f":"'V. Cloud Security'!Z311","v":0},{"$f":"'V. Cloud Security'!B311","v":"V.1.58.1"},{"$f":"'V. Cloud Security'!C311","v":"1?"},{"$f":"'V. Cloud Security'!D311","v":0},{"$f":"'V. Cloud Security'!E311","v":0},{"$f":"'V. Cloud Security'!H311","v":0},{"$f":"'V. Cloud Security'!I311","v":"NA"},{"$f":"'V. Cloud Security'!J311","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA311","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A312","v":3613},{"$f":"'V. Cloud Security'!K312","v":3},{"$f":"'V. Cloud Security'!L312","v":0},{"$f":"'V. Cloud Security'!Z312","v":0},{"$f":"'V. Cloud Security'!B312","v":"V.1.58.2"},{"$f":"'V. Cloud Security'!C312","v":">1 <2?"},{"$f":"'V. Cloud Security'!D312","v":0},{"$f":"'V. Cloud Security'!E312","v":0},{"$f":"'V. Cloud Security'!H312","v":0},{"$f":"'V. Cloud Security'!I312","v":"NA"},{"$f":"'V. Cloud Security'!J312","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA312","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A313","v":3614},{"$f":"'V. Cloud Security'!K313","v":3},{"$f":"'V. Cloud Security'!L313","v":0},{"$f":"'V. Cloud Security'!Z313","v":0},{"$f":"'V. Cloud Security'!B313","v":"V.1.58.3"},{"$f":"'V. Cloud Security'!C313","v":"> 2?"},{"$f":"'V. Cloud Security'!D313","v":0},{"$f":"'V. Cloud Security'!E313","v":0},{"$f":"'V. Cloud Security'!H313","v":0},{"$f":"'V. Cloud Security'!I313","v":"NA"},{"$f":"'V. Cloud Security'!J313","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA313","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A314","v":3615},{"$f":"'V. Cloud Security'!K314","v":2},{"$f":"'V. Cloud Security'!L314","v":1},{"$f":"'V. Cloud Security'!Z314","v":0},{"$f":"'V. Cloud Security'!B314","v":"V.1.59"},{"$f":"'V. Cloud Security'!C314","v":"How many separate data center(s) is the live cloud platform running in at any one time:"},{"$f":"'V. Cloud Security'!D314","v":0},{"$f":"'V. Cloud Security'!E314","v":0},{"$f":"'V. Cloud Security'!H314","v":0},{"$f":"'V. Cloud Security'!I314","v":"17.1.3"},{"$f":"'V. Cloud Security'!J314","v":"Verify, review and evaluate information security continuity"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA314","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A315","v":3616},{"$f":"'V. Cloud Security'!K315","v":3},{"$f":"'V. Cloud Security'!L315","v":0},{"$f":"'V. Cloud Security'!Z315","v":0},{"$f":"'V. Cloud Security'!B315","v":"V.1.59.1"},{"$f":"'V. Cloud Security'!C315","v":"1?"},{"$f":"'V. Cloud Security'!D315","v":0},{"$f":"'V. Cloud Security'!E315","v":0},{"$f":"'V. Cloud Security'!H315","v":0},{"$f":"'V. Cloud Security'!I315","v":"NA"},{"$f":"'V. Cloud Security'!J315","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA315","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A316","v":3617},{"$f":"'V. Cloud Security'!K316","v":3},{"$f":"'V. Cloud Security'!L316","v":0},{"$f":"'V. Cloud Security'!Z316","v":0},{"$f":"'V. Cloud Security'!B316","v":"V.1.59.2"},{"$f":"'V. Cloud Security'!C316","v":">1 <2?"},{"$f":"'V. Cloud Security'!D316","v":0},{"$f":"'V. Cloud Security'!E316","v":0},{"$f":"'V. Cloud Security'!H316","v":0},{"$f":"'V. Cloud Security'!I316","v":"NA"},{"$f":"'V. Cloud Security'!J316","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA316","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A317","v":3618},{"$f":"'V. Cloud Security'!K317","v":3},{"$f":"'V. Cloud Security'!L317","v":0},{"$f":"'V. Cloud Security'!Z317","v":0},{"$f":"'V. Cloud Security'!B317","v":"V.1.59.3"},{"$f":"'V. Cloud Security'!C317","v":"> 2?"},{"$f":"'V. Cloud Security'!D317","v":0},{"$f":"'V. Cloud Security'!E317","v":0},{"$f":"'V. Cloud Security'!H317","v":0},{"$f":"'V. Cloud Security'!I317","v":"NA"},{"$f":"'V. Cloud Security'!J317","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA317","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A318","v":3619},{"$f":"'V. Cloud Security'!K318","v":2},{"$f":"'V. Cloud Security'!L318","v":1},{"$f":"'V. Cloud Security'!Z318","v":0},{"$f":"'V. Cloud Security'!B318","v":"V.1.60"},{"$f":"'V. Cloud Security'!C318","v":"Which availability mode is the critical cloud infrastructure running:"},{"$f":"'V. Cloud Security'!D318","v":0},{"$f":"'V. Cloud Security'!E318","v":0},{"$f":"'V. Cloud Security'!H318","v":0},{"$f":"'V. Cloud Security'!I318","v":"17.1.3"},{"$f":"'V. Cloud Security'!J318","v":"Verify, review and evaluate information security continuity"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA318","v":"WP.1.K.7"}]
[{"$f":"'V. Cloud Security'!A319","v":3620},{"$f":"'V. Cloud Security'!K319","v":3},{"$f":"'V. Cloud Security'!L319","v":0},{"$f":"'V. Cloud Security'!Z319","v":0},{"$f":"'V. Cloud Security'!B319","v":"V.1.60.1"},{"$f":"'V. Cloud Security'!C319","v":"Cold standby?"},{"$f":"'V. Cloud Security'!D319","v":0},{"$f":"'V. Cloud Security'!E319","v":0},{"$f":"'V. Cloud Security'!H319","v":0},{"$f":"'V. Cloud Security'!I319","v":"NA"},{"$f":"'V. Cloud Security'!J319","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA319","v":"WP.1.K.7"}]
[{"$f":"'V. Cloud Security'!A320","v":3621},{"$f":"'V. Cloud Security'!K320","v":3},{"$f":"'V. Cloud Security'!L320","v":0},{"$f":"'V. Cloud Security'!Z320","v":0},{"$f":"'V. Cloud Security'!B320","v":"V.1.60.2"},{"$f":"'V. Cloud Security'!C320","v":"Warm standby?"},{"$f":"'V. Cloud Security'!D320","v":0},{"$f":"'V. Cloud Security'!E320","v":0},{"$f":"'V. Cloud Security'!H320","v":0},{"$f":"'V. Cloud Security'!I320","v":"NA"},{"$f":"'V. Cloud Security'!J320","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA320","v":"WP.1.K.7"}]
[{"$f":"'V. Cloud Security'!A321","v":3622},{"$f":"'V. Cloud Security'!K321","v":3},{"$f":"'V. Cloud Security'!L321","v":0},{"$f":"'V. Cloud Security'!Z321","v":0},{"$f":"'V. Cloud Security'!B321","v":"V.1.60.3"},{"$f":"'V. Cloud Security'!C321","v":"Active, Active?"},{"$f":"'V. Cloud Security'!D321","v":0},{"$f":"'V. Cloud Security'!E321","v":0},{"$f":"'V. Cloud Security'!H321","v":0},{"$f":"'V. Cloud Security'!I321","v":"NA"},{"$f":"'V. Cloud Security'!J321","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA321","v":"WP.1.K.7"}]
[{"$f":"'V. Cloud Security'!A322","v":3623},{"$f":"'V. Cloud Security'!K322","v":2},{"$f":"'V. Cloud Security'!L322","v":0},{"$f":"'V. Cloud Security'!Z322","v":1},{"$f":"'V. Cloud Security'!B322","v":"V.1.61"},{"$f":"'V. Cloud Security'!C322","v":"Are the failover sites for the underlying infrastructure running on the same vendor physical systems?"},{"$f":"'V. Cloud Security'!D322","v":0},{"$f":"'V. Cloud Security'!E322","v":0},{"$f":"'V. Cloud Security'!H322","v":0},{"$f":"'V. Cloud Security'!I322","v":"17.1.3"},{"$f":"'V. Cloud Security'!J322","v":"Verify, review and evaluate information security continuity"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA322","v":"WP.1.K.12"}]
[{"$f":"'V. Cloud Security'!A323","v":3734},{"$f":"'V. Cloud Security'!K323","v":2},{"$f":"'V. Cloud Security'!L323","v":0},{"$f":"'V. Cloud Security'!Z323","v":0},{"$f":"'V. Cloud Security'!B323","v":"V.1.62"},{"$f":"'V. Cloud Security'!C323","v":"Are the failover sites for the underlying infrastructure running on different vendor physical systems?"},{"$f":"'V. Cloud Security'!D323","v":0},{"$f":"'V. Cloud Security'!E323","v":0},{"$f":"'V. Cloud Security'!H323","v":0},{"$f":"'V. Cloud Security'!I323","v":"17.1.3"},{"$f":"'V. Cloud Security'!J323","v":"Verify, review and evaluate information security continuity"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA323","v":"WP.1.K.12"}]
[{"$f":"'V. Cloud Security'!A324","v":3624},{"$f":"'V. Cloud Security'!K324","v":2},{"$f":"'V. Cloud Security'!L324","v":0},{"$f":"'V. Cloud Security'!Z324","v":1},{"$f":"'V. Cloud Security'!B324","v":"V.1.63"},{"$f":"'V. Cloud Security'!C324","v":"Is the critical infrastructure running active/active at two or more sites?"},{"$f":"'V. Cloud Security'!D324","v":0},{"$f":"'V. Cloud Security'!E324","v":0},{"$f":"'V. Cloud Security'!H324","v":0},{"$f":"'V. Cloud Security'!I324","v":"17.1.3"},{"$f":"'V. Cloud Security'!J324","v":"Verify, review and evaluate information security continuity"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA324","v":"WP.1.K.12"}]
[{"$f":"'V. Cloud Security'!A325","v":3625},{"$f":"'V. Cloud Security'!K325","v":2},{"$f":"'V. Cloud Security'!L325","v":0},{"$f":"'V. Cloud Security'!Z325","v":1},{"$f":"'V. Cloud Security'!B325","v":"V.1.64"},{"$f":"'V. Cloud Security'!C325","v":"Are sites failed over as part of normal operation or as part of a test? If yes, what is the frequency:"},{"$f":"'V. Cloud Security'!D325","v":0},{"$f":"'V. Cloud Security'!E325","v":0},{"$f":"'V. Cloud Security'!H325","v":0},{"$f":"'V. Cloud Security'!I325","v":"17.1.3"},{"$f":"'V. Cloud Security'!J325","v":"Verify, review and evaluate information security continuity"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA325","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A326","v":3626},{"$f":"'V. Cloud Security'!K326","v":3},{"$f":"'V. Cloud Security'!L326","v":0},{"$f":"'V. Cloud Security'!Z326","v":0},{"$f":"'V. Cloud Security'!B326","v":"V.1.64.1"},{"$f":"'V. Cloud Security'!C326","v":"Never?"},{"$f":"'V. Cloud Security'!D326","v":0},{"$f":"'V. Cloud Security'!E326","v":0},{"$f":"'V. Cloud Security'!H326","v":0},{"$f":"'V. Cloud Security'!I326","v":"NA"},{"$f":"'V. Cloud Security'!J326","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA326","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A327","v":3627},{"$f":"'V. Cloud Security'!K327","v":3},{"$f":"'V. Cloud Security'!L327","v":0},{"$f":"'V. Cloud Security'!Z327","v":0},{"$f":"'V. Cloud Security'!B327","v":"V.1.64.2"},{"$f":"'V. Cloud Security'!C327","v":"Weekly?"},{"$f":"'V. Cloud Security'!D327","v":0},{"$f":"'V. Cloud Security'!E327","v":0},{"$f":"'V. Cloud Security'!H327","v":0},{"$f":"'V. Cloud Security'!I327","v":"NA"},{"$f":"'V. Cloud Security'!J327","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA327","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A328","v":3628},{"$f":"'V. Cloud Security'!K328","v":3},{"$f":"'V. Cloud Security'!L328","v":0},{"$f":"'V. Cloud Security'!Z328","v":0},{"$f":"'V. Cloud Security'!B328","v":"V.1.64.3"},{"$f":"'V. Cloud Security'!C328","v":"Monthly?"},{"$f":"'V. Cloud Security'!D328","v":0},{"$f":"'V. Cloud Security'!E328","v":0},{"$f":"'V. Cloud Security'!H328","v":0},{"$f":"'V. Cloud Security'!I328","v":"NA"},{"$f":"'V. Cloud Security'!J328","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA328","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A329","v":3629},{"$f":"'V. Cloud Security'!K329","v":3},{"$f":"'V. Cloud Security'!L329","v":0},{"$f":"'V. Cloud Security'!Z329","v":0},{"$f":"'V. Cloud Security'!B329","v":"V.1.64.4"},{"$f":"'V. Cloud Security'!C329","v":"Annually?"},{"$f":"'V. Cloud Security'!D329","v":0},{"$f":"'V. Cloud Security'!E329","v":0},{"$f":"'V. Cloud Security'!H329","v":0},{"$f":"'V. Cloud Security'!I329","v":"NA"},{"$f":"'V. Cloud Security'!J329","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA329","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A330","v":3630},{"$f":"'V. Cloud Security'!K330","v":3},{"$f":"'V. Cloud Security'!L330","v":0},{"$f":"'V. Cloud Security'!Z330","v":0},{"$f":"'V. Cloud Security'!B330","v":"V.1.64.5"},{"$f":"'V. Cloud Security'!C330","v":"Dependent on change?"},{"$f":"'V. Cloud Security'!D330","v":0},{"$f":"'V. Cloud Security'!E330","v":0},{"$f":"'V. Cloud Security'!H330","v":0},{"$f":"'V. Cloud Security'!I330","v":"NA"},{"$f":"'V. Cloud Security'!J330","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA330","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A331","v":3631},{"$f":"'V. Cloud Security'!K331","v":3},{"$f":"'V. Cloud Security'!L331","v":0},{"$f":"'V. Cloud Security'!Z331","v":0},{"$f":"'V. Cloud Security'!B331","v":"V.1.64.6"},{"$f":"'V. Cloud Security'!C331","v":"Continuous?"},{"$f":"'V. Cloud Security'!D331","v":0},{"$f":"'V. Cloud Security'!E331","v":0},{"$f":"'V. Cloud Security'!H331","v":0},{"$f":"'V. Cloud Security'!I331","v":"NA"},{"$f":"'V. Cloud Security'!J331","v":0},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA331","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A332","v":3632},{"$f":"'V. Cloud Security'!K332","v":2},{"$f":"'V. Cloud Security'!L332","v":0},{"$f":"'V. Cloud Security'!Z332","v":1},{"$f":"'V. Cloud Security'!B332","v":"V.1.65"},{"$f":"'V. Cloud Security'!C332","v":"Are all suppliers of critical hardware, network services and facility services involved in annual continuity and recovery tests?"},{"$f":"'V. Cloud Security'!D332","v":0},{"$f":"'V. Cloud Security'!E332","v":0},{"$f":"'V. Cloud Security'!H332","v":0},{"$f":"'V. Cloud Security'!I332","v":"17.1.3"},{"$f":"'V. Cloud Security'!J332","v":"Verify, review and evaluate information security continuity"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA332","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A333","v":3633},{"$f":"'V. Cloud Security'!K333","v":2},{"$f":"'V. Cloud Security'!L333","v":0},{"$f":"'V. Cloud Security'!Z333","v":0},{"$f":"'V. Cloud Security'!B333","v":"V.1.66"},{"$f":"'V. Cloud Security'!C333","v":"Is the maturity of IT management processes formally evaluated at least annually using an established benchmark (e.g., COBIT maturity models)?"},{"$f":"'V. Cloud Security'!D333","v":0},{"$f":"'V. Cloud Security'!E333","v":0},{"$f":"'V. Cloud Security'!H333","v":0},{"$f":"'V. Cloud Security'!I333","v":"17.1.3"},{"$f":"'V. Cloud Security'!J333","v":"Verify, review and evaluate information security continuity"},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A334","v":3634},{"$f":"'V. Cloud Security'!K334","v":2},{"$f":"'V. Cloud Security'!L334","v":0},{"$f":"'V. Cloud Security'!Z334","v":1},{"$f":"'V. Cloud Security'!B334","v":"V.1.67"},{"$f":"'V. Cloud Security'!C334","v":"Are all critical technology service providers described on an architecture diagram that includes physical systems and facilities?"},{"$f":"'V. Cloud Security'!D334","v":0},{"$f":"'V. Cloud Security'!E334","v":0},{"$f":"'V. Cloud Security'!H334","v":0},{"$f":"'V. Cloud Security'!I334","v":"17.1.3"},{"$f":"'V. Cloud Security'!J334","v":"Verify, review and evaluate information security continuity"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA334","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A335","v":3635},{"$f":"'V. Cloud Security'!K335","v":3},{"$f":"'V. Cloud Security'!L335","v":0},{"$f":"'V. Cloud Security'!Z335","v":0},{"$f":"'V. Cloud Security'!B335","v":"V.1.67.1"},{"$f":"'V. Cloud Security'!C335","v":"Do the BCP failover test scenarios contain fail-over across critical vendors?"},{"$f":"'V. Cloud Security'!D335","v":0},{"$f":"'V. Cloud Security'!E335","v":0},{"$f":"'V. Cloud Security'!H335","v":0},{"$f":"'V. Cloud Security'!I335","v":"17.1.3"},{"$f":"'V. Cloud Security'!J335","v":"Verify, review and evaluate information security continuity"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA335","v":"WP.1.I.6"}]
[{"$f":"'V. Cloud Security'!A336","v":3636},{"$f":"'V. Cloud Security'!K336","v":3},{"$f":"'V. Cloud Security'!L336","v":0},{"$f":"'V. Cloud Security'!Z336","v":0},{"$f":"'V. Cloud Security'!B336","v":"V.1.67.2"},{"$f":"'V. Cloud Security'!C336","v":"Are there requirements to review and update the BCP for each significant business change to the critical supporting vendors?"},{"$f":"'V. Cloud Security'!D336","v":0},{"$f":"'V. Cloud Security'!E336","v":0},{"$f":"'V. Cloud Security'!H336","v":0},{"$f":"'V. Cloud Security'!I336","v":"17.1.3"},{"$f":"'V. Cloud Security'!J336","v":"Verify, review and evaluate information security continuity"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA336","v":"WP.1.K.12"}]
[{"$f":"'V. Cloud Security'!A337","v":3637},{"$f":"'V. Cloud Security'!K337","v":2},{"$f":"'V. Cloud Security'!L337","v":0},{"$f":"'V. Cloud Security'!Z337","v":0},{"$f":"'V. Cloud Security'!B337","v":"V.1.68"},{"$f":"'V. Cloud Security'!C337","v":"Are \"Red and Blue\" fully redundant networks run at the physical level?"},{"$f":"'V. Cloud Security'!D337","v":0},{"$f":"'V. Cloud Security'!E337","v":0},{"$f":"'V. Cloud Security'!H337","v":0},{"$f":"'V. Cloud Security'!I337","v":"17.1.3"},{"$f":"'V. Cloud Security'!J337","v":"Verify, review and evaluate information security continuity"},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A338","v":3638},{"$f":"'V. Cloud Security'!K338","v":2},{"$f":"'V. Cloud Security'!L338","v":0},{"$f":"'V. Cloud Security'!Z338","v":1},{"$f":"'V. Cloud Security'!B338","v":"V.1.69"},{"$f":"'V. Cloud Security'!C338","v":"Is there sufficient redundancy capacity to ensure services are not impacted in multi-tenancy environments during peak usage and above?"},{"$f":"'V. Cloud Security'!D338","v":0},{"$f":"'V. Cloud Security'!E338","v":0},{"$f":"'V. Cloud Security'!H338","v":0},{"$f":"'V. Cloud Security'!I338","v":"17.1.3"},{"$f":"'V. Cloud Security'!J338","v":"Verify, review and evaluate information security continuity"},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A339","v":3639},{"$f":"'V. Cloud Security'!K339","v":2},{"$f":"'V. Cloud Security'!L339","v":0},{"$f":"'V. Cloud Security'!Z339","v":1},{"$f":"'V. Cloud Security'!B339","v":"V.1.70"},{"$f":"'V. Cloud Security'!C339","v":"Do contracts include a penalty or remediation clause for breach of availability and continuity SLAs? If yes, is the penalty based on:"},{"$f":"'V. Cloud Security'!D339","v":0},{"$f":"'V. Cloud Security'!E339","v":0},{"$f":"'V. Cloud Security'!H339","v":0},{"$f":"'V. Cloud Security'!I339","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!J339","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A340","v":3640},{"$f":"'V. Cloud Security'!K340","v":3},{"$f":"'V. Cloud Security'!L340","v":0},{"$f":"'V. Cloud Security'!Z340","v":0},{"$f":"'V. Cloud Security'!B340","v":"V.1.70.1"},{"$f":"'V. Cloud Security'!C340","v":"Direct damages arising from breach of warranty or contract?"},{"$f":"'V. Cloud Security'!D340","v":0},{"$f":"'V. Cloud Security'!E340","v":0},{"$f":"'V. Cloud Security'!H340","v":0},{"$f":"'V. Cloud Security'!I340","v":"NA"},{"$f":"'V. Cloud Security'!J340","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A341","v":3641},{"$f":"'V. Cloud Security'!K341","v":3},{"$f":"'V. Cloud Security'!L341","v":0},{"$f":"'V. Cloud Security'!Z341","v":0},{"$f":"'V. Cloud Security'!B341","v":"V.1.70.2"},{"$f":"'V. Cloud Security'!C341","v":"Indirect damages arising from breach of warranty or contract?"},{"$f":"'V. Cloud Security'!D341","v":0},{"$f":"'V. Cloud Security'!E341","v":0},{"$f":"'V. Cloud Security'!H341","v":0},{"$f":"'V. Cloud Security'!I341","v":"NA"},{"$f":"'V. Cloud Security'!J341","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A342","v":3642},{"$f":"'V. Cloud Security'!K342","v":3},{"$f":"'V. Cloud Security'!L342","v":0},{"$f":"'V. Cloud Security'!Z342","v":0},{"$f":"'V. Cloud Security'!B342","v":"V.1.70.3"},{"$f":"'V. Cloud Security'!C342","v":"Indemnification for damages from breach of service obligations (or claims against customer for breach of service obligations)?"},{"$f":"'V. Cloud Security'!D342","v":0},{"$f":"'V. Cloud Security'!E342","v":0},{"$f":"'V. Cloud Security'!H342","v":0},{"$f":"'V. Cloud Security'!I342","v":"NA"},{"$f":"'V. Cloud Security'!J342","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A343","v":3643},{"$f":"'V. Cloud Security'!K343","v":3},{"$f":"'V. Cloud Security'!L343","v":0},{"$f":"'V. Cloud Security'!Z343","v":0},{"$f":"'V. Cloud Security'!B343","v":"V.1.70.4"},{"$f":"'V. Cloud Security'!C343","v":"Service credits for downtime?"},{"$f":"'V. Cloud Security'!D343","v":0},{"$f":"'V. Cloud Security'!E343","v":0},{"$f":"'V. Cloud Security'!H343","v":0},{"$f":"'V. Cloud Security'!I343","v":"NA"},{"$f":"'V. Cloud Security'!J343","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A344","v":3644},{"$f":"'V. Cloud Security'!K344","v":3},{"$f":"'V. Cloud Security'!L344","v":0},{"$f":"'V. Cloud Security'!Z344","v":0},{"$f":"'V. Cloud Security'!B344","v":"V.1.70.5"},{"$f":"'V. Cloud Security'!C344","v":"Grant customer a termination and/or refund right?"},{"$f":"'V. Cloud Security'!D344","v":0},{"$f":"'V. Cloud Security'!E344","v":0},{"$f":"'V. Cloud Security'!H344","v":0},{"$f":"'V. Cloud Security'!I344","v":"NA"},{"$f":"'V. Cloud Security'!J344","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A345","v":3645},{"$f":"'V. Cloud Security'!K345","v":3},{"$f":"'V. Cloud Security'!L345","v":0},{"$f":"'V. Cloud Security'!Z345","v":0},{"$f":"'V. Cloud Security'!B345","v":"V.1.70.6"},{"$f":"'V. Cloud Security'!C345","v":"Continued obligation to apply effort to resolve a problem?"},{"$f":"'V. Cloud Security'!D345","v":0},{"$f":"'V. Cloud Security'!E345","v":0},{"$f":"'V. Cloud Security'!H345","v":0},{"$f":"'V. Cloud Security'!I345","v":"NA"},{"$f":"'V. Cloud Security'!J345","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A346","v":3646},{"$f":"'V. Cloud Security'!K346","v":3},{"$f":"'V. Cloud Security'!L346","v":0},{"$f":"'V. Cloud Security'!Z346","v":0},{"$f":"'V. Cloud Security'!B346","v":"V.1.70.7"},{"$f":"'V. Cloud Security'!C346","v":"Calculation of business loss based on actual damages?"},{"$f":"'V. Cloud Security'!D346","v":0},{"$f":"'V. Cloud Security'!E346","v":0},{"$f":"'V. Cloud Security'!H346","v":0},{"$f":"'V. Cloud Security'!I346","v":"NA"},{"$f":"'V. Cloud Security'!J346","v":0},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A347","v":3647},{"$f":"'V. Cloud Security'!K347","v":2},{"$f":"'V. Cloud Security'!L347","v":0},{"$f":"'V. Cloud Security'!Z347","v":0},{"$f":"'V. Cloud Security'!B347","v":"V.1.71"},{"$f":"'V. Cloud Security'!C347","v":"Is priority access to resources from suppliers contractually ensured in the event of an adverse situation, affecting multiple customers of suppliers (e.g., fuel oil, recovery center space)?"},{"$f":"'V. Cloud Security'!D347","v":0},{"$f":"'V. Cloud Security'!E347","v":0},{"$f":"'V. Cloud Security'!H347","v":0},{"$f":"'V. Cloud Security'!I347","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!J347","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A348","v":3649},{"$f":"'V. Cloud Security'!K348","v":2},{"$f":"'V. Cloud Security'!L348","v":0},{"$f":"'V. Cloud Security'!Z348","v":1},{"$f":"'V. Cloud Security'!B348","v":"V.1.72"},{"$f":"'V. Cloud Security'!C348","v":"Are Hypervisors used to manage systems used to transmit, process or store Scoped Data? If yes, are there:"},{"$f":"'V. Cloud Security'!D348","v":"No"},{"$f":"'V. Cloud Security'!E348","v":0},{"$f":"'V. Cloud Security'!H348","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I348","v":"14.1.2"},{"$f":"'V. Cloud Security'!J348","v":"Securing application services on public networks"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA348","v":"WP.1.D.1"}]
[{"$f":"'V. Cloud Security'!A349","v":3650},{"$f":"'V. Cloud Security'!K349","v":3},{"$f":"'V. Cloud Security'!L349","v":0},{"$f":"'V. Cloud Security'!Z349","v":0},{"$f":"'V. Cloud Security'!B349","v":"V.1.72.1"},{"$f":"'V. Cloud Security'!C349","v":"Hypervisor hardening standards applied?"},{"$f":"'V. Cloud Security'!D349","v":0},{"$f":"'V. Cloud Security'!E349","v":0},{"$f":"'V. Cloud Security'!H349","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I349","v":"12.6.1 "},{"$f":"'V. Cloud Security'!J349","v":"Management of technical vulnerabilities"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA349","v":"WP.1.I.3"}]
[{"$f":"'V. Cloud Security'!A350","v":3651},{"$f":"'V. Cloud Security'!K350","v":3},{"$f":"'V. Cloud Security'!L350","v":0},{"$f":"'V. Cloud Security'!Z350","v":0},{"$f":"'V. Cloud Security'!B350","v":"V.1.72.2"},{"$f":"'V. Cloud Security'!C350","v":"Standard builds/security compliance checks?"},{"$f":"'V. Cloud Security'!D350","v":0},{"$f":"'V. Cloud Security'!E350","v":0},{"$f":"'V. Cloud Security'!H350","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I350","v":"12.6.1 "},{"$f":"'V. Cloud Security'!J350","v":"Management of technical vulnerabilities"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA350","v":"WP.1.D.1"}]
[{"$f":"'V. Cloud Security'!A351","v":3652},{"$f":"'V. Cloud Security'!K351","v":3},{"$f":"'V. Cloud Security'!L351","v":0},{"$f":"'V. Cloud Security'!Z351","v":0},{"$f":"'V. Cloud Security'!B351","v":"V.1.72.3"},{"$f":"'V. Cloud Security'!C351","v":"Current patches?"},{"$f":"'V. Cloud Security'!D351","v":0},{"$f":"'V. Cloud Security'!E351","v":0},{"$f":"'V. Cloud Security'!H351","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I351","v":"12.6.1 "},{"$f":"'V. Cloud Security'!J351","v":"Management of technical vulnerabilities"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA351","v":"WP.1.I.6"}]
[{"$f":"'V. Cloud Security'!A352","v":3653},{"$f":"'V. Cloud Security'!K352","v":3},{"$f":"'V. Cloud Security'!L352","v":0},{"$f":"'V. Cloud Security'!Z352","v":0},{"$f":"'V. Cloud Security'!B352","v":"V.1.72.4"},{"$f":"'V. Cloud Security'!C352","v":"Unnecessary/unused services turned off?"},{"$f":"'V. Cloud Security'!D352","v":0},{"$f":"'V. Cloud Security'!E352","v":0},{"$f":"'V. Cloud Security'!H352","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I352","v":"12.6.1 "},{"$f":"'V. Cloud Security'!J352","v":"Management of technical vulnerabilities"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA352","v":"WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A353","v":3654},{"$f":"'V. Cloud Security'!K353","v":3},{"$f":"'V. Cloud Security'!L353","v":0},{"$f":"'V. Cloud Security'!Z353","v":0},{"$f":"'V. Cloud Security'!B353","v":"V.1.72.5"},{"$f":"'V. Cloud Security'!C353","v":"Regular log reviews using a specific methodology to uncover potential incidents?"},{"$f":"'V. Cloud Security'!D353","v":0},{"$f":"'V. Cloud Security'!E353","v":0},{"$f":"'V. Cloud Security'!H353","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I353","v":"12.4.1"},{"$f":"'V. Cloud Security'!J353","v":"Event logging"},null,null,10.1,null,null,{"$f":"'V. Cloud Security'!AA353","v":"WP.1.H.9"}]
[{"$f":"'V. Cloud Security'!A354","v":3655},{"$f":"'V. Cloud Security'!K354","v":3},{"$f":"'V. Cloud Security'!L354","v":0},{"$f":"'V. Cloud Security'!Z354","v":0},{"$f":"'V. Cloud Security'!B354","v":"V.1.72.6"},{"$f":"'V. Cloud Security'!C354","v":"Sufficient information in the logs to evaluate incidents?"},{"$f":"'V. Cloud Security'!D354","v":0},{"$f":"'V. Cloud Security'!E354","v":0},{"$f":"'V. Cloud Security'!H354","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I354","v":"12.4.1"},{"$f":"'V. Cloud Security'!J354","v":"Event logging"},null,null,10.6,null,null,{"$f":"'V. Cloud Security'!AA354","v":"WP.1.H.9"}]
[{"$f":"'V. Cloud Security'!A355","v":3656},{"$f":"'V. Cloud Security'!K355","v":3},{"$f":"'V. Cloud Security'!L355","v":0},{"$f":"'V. Cloud Security'!Z355","v":0},{"$f":"'V. Cloud Security'!B355","v":"V.1.72.7"},{"$f":"'V. Cloud Security'!C355","v":"Logs retained for a minimum of one year?"},{"$f":"'V. Cloud Security'!D355","v":0},{"$f":"'V. Cloud Security'!E355","v":0},{"$f":"'V. Cloud Security'!H355","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I355","v":"12.4.1"},{"$f":"'V. Cloud Security'!J355","v":"Event logging"},null,null,10.7,null,null,{"$f":"'V. Cloud Security'!AA355","v":"WP.1.H.9"}]
[{"$f":"'V. Cloud Security'!A356","v":3657},{"$f":"'V. Cloud Security'!K356","v":3},{"$f":"'V. Cloud Security'!L356","v":0},{"$f":"'V. Cloud Security'!Z356","v":0},{"$f":"'V. Cloud Security'!B356","v":"V.1.72.8"},{"$f":"'V. Cloud Security'!C356","v":"System generated alerts in the event of an audit log failure?"},{"$f":"'V. Cloud Security'!D356","v":0},{"$f":"'V. Cloud Security'!E356","v":0},{"$f":"'V. Cloud Security'!H356","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I356","v":"12.4.1"},{"$f":"'V. Cloud Security'!J356","v":"Event logging"},null,null,"10.2.4",null,null,{"$f":"'V. Cloud Security'!AA356","v":"WP.1.H.9, WP.1.H.10"}]
[{"$f":"'V. Cloud Security'!A357","v":3658},{"$f":"'V. Cloud Security'!K357","v":3},{"$f":"'V. Cloud Security'!L357","v":0},{"$f":"'V. Cloud Security'!Z357","v":0},{"$f":"'V. Cloud Security'!B357","v":"V.1.72.9"},{"$f":"'V. Cloud Security'!C357","v":"Audit logs stored on alternate systems?"},{"$f":"'V. Cloud Security'!D357","v":0},{"$f":"'V. Cloud Security'!E357","v":0},{"$f":"'V. Cloud Security'!H357","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I357","v":"12.4.1"},{"$f":"'V. Cloud Security'!J357","v":"Event logging"},null,null,"10.5.4",null,null,{"$f":"'V. Cloud Security'!AA357","v":"WP.1.H.9"}]
[{"$f":"'V. Cloud Security'!A358","v":3659},{"$f":"'V. Cloud Security'!K358","v":3},{"$f":"'V. Cloud Security'!L358","v":0},{"$f":"'V. Cloud Security'!Z358","v":0},{"$f":"'V. Cloud Security'!B358","v":"V.1.72.10"},{"$f":"'V. Cloud Security'!C358","v":"Audit logs protected against modification, deletion, and/or inappropriate access?"},{"$f":"'V. Cloud Security'!D358","v":0},{"$f":"'V. Cloud Security'!E358","v":0},{"$f":"'V. Cloud Security'!H358","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I358","v":"12.4.1"},{"$f":"'V. Cloud Security'!J358","v":"Event logging"},null,null,"10.5.2",null,null,{"$f":"'V. Cloud Security'!AA358","v":"WP.1.H.9"}]
[{"$f":"'V. Cloud Security'!A359","v":3660},{"$f":"'V. Cloud Security'!K359","v":3},{"$f":"'V. Cloud Security'!L359","v":0},{"$f":"'V. Cloud Security'!Z359","v":0},{"$f":"'V. Cloud Security'!B359","v":"V.1.72.11"},{"$f":"'V. Cloud Security'!C359","v":"Minimum password length at least eight characters?"},{"$f":"'V. Cloud Security'!D359","v":0},{"$f":"'V. Cloud Security'!E359","v":0},{"$f":"'V. Cloud Security'!H359","v":"H.1 Password Controls"},{"$f":"'V. Cloud Security'!I359","v":"9.3.1"},{"$f":"'V. Cloud Security'!J359","v":"Use of secret authentication information"},null,null,"8.2.3",null,null,{"$f":"'V. Cloud Security'!AA359","v":"WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A360","v":3661},{"$f":"'V. Cloud Security'!K360","v":3},{"$f":"'V. Cloud Security'!L360","v":0},{"$f":"'V. Cloud Security'!Z360","v":0},{"$f":"'V. Cloud Security'!B360","v":"V.1.72.12"},{"$f":"'V. Cloud Security'!C360","v":"Complex passwords required?"},{"$f":"'V. Cloud Security'!D360","v":0},{"$f":"'V. Cloud Security'!E360","v":0},{"$f":"'V. Cloud Security'!H360","v":"H.1 Password Controls"},{"$f":"'V. Cloud Security'!I360","v":"9.3.1"},{"$f":"'V. Cloud Security'!J360","v":"Use of secret authentication information"},null,null,"8.2.3",null,null,{"$f":"'V. Cloud Security'!AA360","v":"WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A361","v":3662},{"$f":"'V. Cloud Security'!K361","v":3},{"$f":"'V. Cloud Security'!L361","v":0},{"$f":"'V. Cloud Security'!Z361","v":0},{"$f":"'V. Cloud Security'!B361","v":"V.1.72.13"},{"$f":"'V. Cloud Security'!C361","v":"Minimum password expiration at least every 90 days?"},{"$f":"'V. Cloud Security'!D361","v":0},{"$f":"'V. Cloud Security'!E361","v":0},{"$f":"'V. Cloud Security'!H361","v":"H.1 Password Controls"},{"$f":"'V. Cloud Security'!I361","v":"9.3.1"},{"$f":"'V. Cloud Security'!J361","v":"Use of secret authentication information"},null,null,"8.2.4",null,null,{"$f":"'V. Cloud Security'!AA361","v":"WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A362","v":3663},{"$f":"'V. Cloud Security'!K362","v":3},{"$f":"'V. Cloud Security'!L362","v":0},{"$f":"'V. Cloud Security'!Z362","v":0},{"$f":"'V. Cloud Security'!B362","v":"V.1.72.14"},{"$f":"'V. Cloud Security'!C362","v":"Password history of 12 before reuse?"},{"$f":"'V. Cloud Security'!D362","v":0},{"$f":"'V. Cloud Security'!E362","v":0},{"$f":"'V. Cloud Security'!H362","v":"H.1 Password Controls"},{"$f":"'V. Cloud Security'!I362","v":"9.3.1"},{"$f":"'V. Cloud Security'!J362","v":"Use of secret authentication information"},null,null,"8.2.5",null,null,{"$f":"'V. Cloud Security'!AA362","v":"WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A363","v":3664},{"$f":"'V. Cloud Security'!K363","v":3},{"$f":"'V. Cloud Security'!L363","v":0},{"$f":"'V. Cloud Security'!Z363","v":0},{"$f":"'V. Cloud Security'!B363","v":"V.1.72.15"},{"$f":"'V. Cloud Security'!C363","v":"Password change requirements at first logon?"},{"$f":"'V. Cloud Security'!D363","v":0},{"$f":"'V. Cloud Security'!E363","v":0},{"$f":"'V. Cloud Security'!H363","v":"H.1 Password Controls"},{"$f":"'V. Cloud Security'!I363","v":"9.3.1"},{"$f":"'V. Cloud Security'!J363","v":"Use of secret authentication information"},null,null,"8.2.6",null,null,{"$f":"'V. Cloud Security'!AA363","v":"WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A364","v":3665},{"$f":"'V. Cloud Security'!K364","v":3},{"$f":"'V. Cloud Security'!L364","v":0},{"$f":"'V. Cloud Security'!Z364","v":0},{"$f":"'V. Cloud Security'!B364","v":"V.1.72.16"},{"$f":"'V. Cloud Security'!C364","v":"Stand alone authentication requirements such as a PIN or secret question?"},{"$f":"'V. Cloud Security'!D364","v":0},{"$f":"'V. Cloud Security'!E364","v":0},{"$f":"'V. Cloud Security'!H364","v":"H.1 Password Controls"},{"$f":"'V. Cloud Security'!I364","v":"9.3.1"},{"$f":"'V. Cloud Security'!J364","v":"Use of secret authentication information"},null,null,8.1999999999999993,null,null,{"$f":"'V. Cloud Security'!AA364","v":"WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A365","v":3666},{"$f":"'V. Cloud Security'!K365","v":3},{"$f":"'V. Cloud Security'!L365","v":0},{"$f":"'V. Cloud Security'!Z365","v":0},{"$f":"'V. Cloud Security'!B365","v":"V.1.72.17"},{"$f":"'V. Cloud Security'!C365","v":"Passwords encrypted in transit?"},{"$f":"'V. Cloud Security'!D365","v":0},{"$f":"'V. Cloud Security'!E365","v":0},{"$f":"'V. Cloud Security'!H365","v":"H.1 Password Controls"},{"$f":"'V. Cloud Security'!I365","v":"9.3.1                                                        10.1.1"},{"$f":"'V. Cloud Security'!J365","v":"Use of secret authentication information,                                        Policy on the use of cryptographic controls"},null,null,"8.2.1"]
[{"$f":"'V. Cloud Security'!A366","v":3667},{"$f":"'V. Cloud Security'!K366","v":3},{"$f":"'V. Cloud Security'!L366","v":0},{"$f":"'V. Cloud Security'!Z366","v":0},{"$f":"'V. Cloud Security'!B366","v":"V.1.72.18"},{"$f":"'V. Cloud Security'!C366","v":"Passwords encrypted or hashed in storage?"},{"$f":"'V. Cloud Security'!D366","v":0},{"$f":"'V. Cloud Security'!E366","v":0},{"$f":"'V. Cloud Security'!H366","v":"H.1 Password Controls"},{"$f":"'V. Cloud Security'!I366","v":"9.3.1"},{"$f":"'V. Cloud Security'!J366","v":"Use of secret authentication information"},null,null,"8.2.1"]
[{"$f":"'V. Cloud Security'!A367","v":3668},{"$f":"'V. Cloud Security'!K367","v":3},{"$f":"'V. Cloud Security'!L367","v":0},{"$f":"'V. Cloud Security'!Z367","v":0},{"$f":"'V. Cloud Security'!B367","v":"V.1.72.19"},{"$f":"'V. Cloud Security'!C367","v":"Passwords displayed when entered into a system?"},{"$f":"'V. Cloud Security'!D367","v":0},{"$f":"'V. Cloud Security'!E367","v":0},{"$f":"'V. Cloud Security'!H367","v":"H.1 Password Controls"},{"$f":"'V. Cloud Security'!I367","v":"9.3.1"},{"$f":"'V. Cloud Security'!J367","v":"Use of secret authentication information"},null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AA367","v":"WP.1.A.7"}]
[{"$f":"'V. Cloud Security'!A368","v":3669},{"$f":"'V. Cloud Security'!K368","v":3},{"$f":"'V. Cloud Security'!L368","v":0},{"$f":"'V. Cloud Security'!Z368","v":0},{"$f":"'V. Cloud Security'!B368","v":"V.1.72.20"},{"$f":"'V. Cloud Security'!C368","v":"User accounts associated to a unique individual?"},{"$f":"'V. Cloud Security'!D368","v":0},{"$f":"'V. Cloud Security'!E368","v":0},{"$f":"'V. Cloud Security'!H368","v":"H.1 Password Controls"},{"$f":"'V. Cloud Security'!I368","v":"9.2.1 "},{"$f":"'V. Cloud Security'!J368","v":"User registration and de-registration"},null,null,"8.1.1",null,null,{"$f":"'V. Cloud Security'!AA368","v":"WP.1.A.6"}]
[{"$f":"'V. Cloud Security'!A369","v":3670},{"$f":"'V. Cloud Security'!K369","v":3},{"$f":"'V. Cloud Security'!L369","v":0},{"$f":"'V. Cloud Security'!Z369","v":0},{"$f":"'V. Cloud Security'!B369","v":"V.1.72.21"},{"$f":"'V. Cloud Security'!C369","v":"System lock requirements after 3-5 invalid login attempts?"},{"$f":"'V. Cloud Security'!D369","v":0},{"$f":"'V. Cloud Security'!E369","v":0},{"$f":"'V. Cloud Security'!H369","v":0},{"$f":"'V. Cloud Security'!I369","v":"9.2.4 "},{"$f":"'V. Cloud Security'!J369","v":"Management of secret authentication information of users"},null,null,"8.1.6",null,null,{"$f":"'V. Cloud Security'!AA369","v":"WP.1.A.7"}]
[{"$f":"'V. Cloud Security'!A370","v":3671},{"$f":"'V. Cloud Security'!K370","v":3},{"$f":"'V. Cloud Security'!L370","v":0},{"$f":"'V. Cloud Security'!Z370","v":0},{"$f":"'V. Cloud Security'!B370","v":"V.1.72.22"},{"$f":"'V. Cloud Security'!C370","v":"Restricted administrative access to the management interfaces?"},{"$f":"'V. Cloud Security'!D370","v":0},{"$f":"'V. Cloud Security'!E370","v":0},{"$f":"'V. Cloud Security'!H370","v":"H.3 Logical Access Authorization"},{"$f":"'V. Cloud Security'!I370","v":"9.1.1                                                  9.2.3"},{"$f":"'V. Cloud Security'!J370","v":"Access control policy,               Management of privileged access rights"},null,null,7.1,null,null,{"$f":"'V. Cloud Security'!AA370","v":"WP.1.A.7"}]
[{"$f":"'V. Cloud Security'!A371","v":3672},{"$f":"'V. Cloud Security'!K371","v":3},{"$f":"'V. Cloud Security'!L371","v":0},{"$f":"'V. Cloud Security'!Z371","v":0},{"$f":"'V. Cloud Security'!B371","v":"V.1.72.23"},{"$f":"'V. Cloud Security'!C371","v":"Disabling unneeded hypervisor services (e.g., file-sharing between the guest and the host operating system)?"},{"$f":"'V. Cloud Security'!D371","v":0},{"$f":"'V. Cloud Security'!E371","v":0},{"$f":"'V. Cloud Security'!H371","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I371","v":"9.4.1"},{"$f":"'V. Cloud Security'!J371","v":"Information access restriction"},null,null,"7.2.3",null,null,{"$f":"'V. Cloud Security'!AA371","v":"WP.1.A.7"}]
[{"$f":"'V. Cloud Security'!A372","v":3673},{"$f":"'V. Cloud Security'!K372","v":3},{"$f":"'V. Cloud Security'!L372","v":0},{"$f":"'V. Cloud Security'!Z372","v":0},{"$f":"'V. Cloud Security'!B372","v":"V.1.72.24"},{"$f":"'V. Cloud Security'!C372","v":"Introspection capabilities to monitor the security of each guest operating system?"},{"$f":"'V. Cloud Security'!D372","v":0},{"$f":"'V. Cloud Security'!E372","v":0},{"$f":"'V. Cloud Security'!H372","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I372","v":"12.4.1"},{"$f":"'V. Cloud Security'!J372","v":"Event logging"},null,null,"10.6.2",null,null,{"$f":"'V. Cloud Security'!AA372","v":"WP.1.A.7"}]
[{"$f":"'V. Cloud Security'!A373","v":3674},{"$f":"'V. Cloud Security'!K373","v":3},{"$f":"'V. Cloud Security'!L373","v":0},{"$f":"'V. Cloud Security'!Z373","v":0},{"$f":"'V. Cloud Security'!B373","v":"V.1.72.25"},{"$f":"'V. Cloud Security'!C373","v":"Introspection capabilities to monitor the security of activity taking place between each guest operating system?"},{"$f":"'V. Cloud Security'!D373","v":0},{"$f":"'V. Cloud Security'!E373","v":0},{"$f":"'V. Cloud Security'!H373","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I373","v":"12.4.1"},{"$f":"'V. Cloud Security'!J373","v":"Event logging"},null,null,"10.6.2",null,null,{"$f":"'V. Cloud Security'!AA373","v":"WP.1.A.7"}]
[{"$f":"'V. Cloud Security'!A374","v":3675},{"$f":"'V. Cloud Security'!K374","v":3},{"$f":"'V. Cloud Security'!L374","v":0},{"$f":"'V. Cloud Security'!Z374","v":0},{"$f":"'V. Cloud Security'!B374","v":"V.1.72.26"},{"$f":"'V. Cloud Security'!C374","v":" Separate network VLANs for host operating system communication with guest operating systems?"},{"$f":"'V. Cloud Security'!D374","v":0},{"$f":"'V. Cloud Security'!E374","v":0},{"$f":"'V. Cloud Security'!H374","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I374","v":"13.1.3"},{"$f":"'V. Cloud Security'!J374","v":"Segregation in networks"},null,null,"1.2; 1.2.3",null,null,{"$f":"'V. Cloud Security'!AA374","v":"WP.1.A.2, WP.1.A.3, WP.1.A.8"}]
[{"$f":"'V. Cloud Security'!A375","v":3676},{"$f":"'V. Cloud Security'!K375","v":3},{"$f":"'V. Cloud Security'!L375","v":0},{"$f":"'V. Cloud Security'!Z375","v":0},{"$f":"'V. Cloud Security'!B375","v":"V.1.72.27"},{"$f":"'V. Cloud Security'!C375","v":"Guest operating systems communicate on separate VLAN's from other Guest operating systems that they do not need to communicate with?"},{"$f":"'V. Cloud Security'!D375","v":0},{"$f":"'V. Cloud Security'!E375","v":0},{"$f":"'V. Cloud Security'!H375","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I375","v":"13.1.3"},{"$f":"'V. Cloud Security'!J375","v":"Segregation in networks"},null,null,"1.2; 1.2.3",null,null,{"$f":"'V. Cloud Security'!AA375","v":"WP.1.A.2, WP.1.A.3, WP.1.A.8"}]
[{"$f":"'V. Cloud Security'!A376","v":3677},{"$f":"'V. Cloud Security'!K376","v":3},{"$f":"'V. Cloud Security'!L376","v":0},{"$f":"'V. Cloud Security'!Z376","v":0},{"$f":"'V. Cloud Security'!B376","v":"V.1.72.28"},{"$f":"'V. Cloud Security'!C376","v":"Host operating system management interface on a separate network than those used by guest operating systems?"},{"$f":"'V. Cloud Security'!D376","v":0},{"$f":"'V. Cloud Security'!E376","v":0},{"$f":"'V. Cloud Security'!H376","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I376","v":"13.1.3"},{"$f":"'V. Cloud Security'!J376","v":"Segregation in networks"},null,null,"1.2; 1.2.3",null,null,{"$f":"'V. Cloud Security'!AA376","v":"WP.1.A.2, WP.1.A.3, WP.1.A.8"}]
[{"$f":"'V. Cloud Security'!A377","v":3678},{"$f":"'V. Cloud Security'!K377","v":3},{"$f":"'V. Cloud Security'!L377","v":0},{"$f":"'V. Cloud Security'!Z377","v":0},{"$f":"'V. Cloud Security'!B377","v":"V.1.72.29"},{"$f":"'V. Cloud Security'!C377","v":"Two factor authentication for access to the administrative interfaces?"},{"$f":"'V. Cloud Security'!D377","v":0},{"$f":"'V. Cloud Security'!E377","v":0},{"$f":"'V. Cloud Security'!H377","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I377","v":"9.1.1"},{"$f":"'V. Cloud Security'!J377","v":"Access control policy"},null,null,8.3000000000000007]
[{"$f":"'V. Cloud Security'!A378","v":3679},{"$f":"'V. Cloud Security'!K378","v":3},{"$f":"'V. Cloud Security'!L378","v":0},{"$f":"'V. Cloud Security'!Z378","v":0},{"$f":"'V. Cloud Security'!B378","v":"V.1.72.30"},{"$f":"'V. Cloud Security'!C378","v":"Volume or disk partitioning to prevent inadvertent resource bottlenecks from guest operating systems?"},{"$f":"'V. Cloud Security'!D378","v":0},{"$f":"'V. Cloud Security'!E378","v":0},{"$f":"'V. Cloud Security'!H378","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I378","v":"12.1.3"},{"$f":"'V. Cloud Security'!J378","v":"Capacity Management"},null,null,1.2,null,null,{"$f":"'V. Cloud Security'!AA378","v":"WP.1.A.2, WP.1.A.3, WP.1.A.8"}]
[{"$f":"'V. Cloud Security'!A379","v":3680},{"$f":"'V. Cloud Security'!K379","v":3},{"$f":"'V. Cloud Security'!L379","v":0},{"$f":"'V. Cloud Security'!Z379","v":0},{"$f":"'V. Cloud Security'!B379","v":"V.1.72.31"},{"$f":"'V. Cloud Security'!C379","v":"Approval process before VMs can be created to avoid VM sprawl?"},{"$f":"'V. Cloud Security'!D379","v":0},{"$f":"'V. Cloud Security'!E379","v":0},{"$f":"'V. Cloud Security'!H379","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I379","v":"12.1.2"},{"$f":"'V. Cloud Security'!J379","v":"Change Management"},null,null,"12.3.1"]
[{"$f":"'V. Cloud Security'!A380","v":3681},{"$f":"'V. Cloud Security'!K380","v":3},{"$f":"'V. Cloud Security'!L380","v":0},{"$f":"'V. Cloud Security'!Z380","v":0},{"$f":"'V. Cloud Security'!B380","v":"V.1.72.32"},{"$f":"'V. Cloud Security'!C380","v":"Migration of VMs logged including source and target systems, time, user?"},{"$f":"'V. Cloud Security'!D380","v":0},{"$f":"'V. Cloud Security'!E380","v":0},{"$f":"'V. Cloud Security'!H380","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I380","v":"12.4.1"},{"$f":"'V. Cloud Security'!J380","v":"Event logging"},null,null,"10.1, 10.2"]
[{"$f":"'V. Cloud Security'!A381","v":3682},{"$f":"'V. Cloud Security'!K381","v":3},{"$f":"'V. Cloud Security'!L381","v":0},{"$f":"'V. Cloud Security'!Z381","v":0},{"$f":"'V. Cloud Security'!B381","v":"V.1.72.33"},{"$f":"'V. Cloud Security'!C381","v":"VM's in the same host sharing the risk and data classification?"},{"$f":"'V. Cloud Security'!D381","v":0},{"$f":"'V. Cloud Security'!E381","v":0},{"$f":"'V. Cloud Security'!H381","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I381","v":"12.1.4"},{"$f":"'V. Cloud Security'!J381","v":"Separation Of Development, Test, And Operational Facilities"},null,null,2.6,null,null,{"$f":"'V. Cloud Security'!AA381","v":"WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A382","v":3683},{"$f":"'V. Cloud Security'!K382","v":3},{"$f":"'V. Cloud Security'!L382","v":0},{"$f":"'V. Cloud Security'!Z382","v":0},{"$f":"'V. Cloud Security'!B382","v":"V.1.72.34"},{"$f":"'V. Cloud Security'!C382","v":"VM's in the same host sharing system sensitivity level grouping (development and production not present on the same host)?"},{"$f":"'V. Cloud Security'!D382","v":0},{"$f":"'V. Cloud Security'!E382","v":0},{"$f":"'V. Cloud Security'!H382","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!I382","v":"12.1.4"},{"$f":"'V. Cloud Security'!J382","v":"Separation Of Development, Test, And Operational Facilities"},null,null,"2.6, 1.1"]
[{"$f":"'V. Cloud Security'!A383","v":0},{"$f":"'V. Cloud Security'!K383","v":0},{"$f":"'V. Cloud Security'!L383","v":0},{"$f":"'V. Cloud Security'!Z383","v":0},{"$f":"'V. Cloud Security'!B383","v":0},{"$f":"'V. Cloud Security'!C383","v":0},{"$f":"'V. Cloud Security'!D383","v":0},{"$f":"'V. Cloud Security'!E383","v":0},{"$f":"'V. Cloud Security'!F383","v":0},{"$f":"'V. Cloud Security'!I383","v":0},{"$f":"'V. Cloud Security'!J383","v":0}]
[]
[{"$f":"Lite!B1","v":"SIG Lite"},null,null,null,{"$f":"Lite!B1","v":"SIG Lite"}]
[{"$f":"Lite!A5","v":0},{"$f":"Lite!L5","v":1},{"$f":"Lite!J5","v":1},{"$f":"Lite!X5","v":0},{"$f":"Lite!B5","v":0},{"$f":"Lite!C5","v":"A. Risk Assessment and Treatment"},{"$f":"Lite!D5","v":0},{"$f":"Lite!E5","v":0},{"$f":"Lite!F5","v":0},{"$f":"Lite!G5","v":0},{"$f":"Lite!H5","v":0}]
["Lite!A6",{"$f":"Lite!L6","v":1},{"$f":"Lite!J6","v":"A"},{"$f":"Lite!X6","v":1},{"$f":"Lite!B6","v":"SL.1"},{"$f":"Lite!C6","v":"Is there a risk assessment program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the program?"},{"$f":"Lite!D6","v":"Yes"},{"$f":"Lite!E6","v":"Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"Lite!F6","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"Lite!G6","v":"5.1                                            6.1.2"},{"$f":"Lite!H6","v":"Leadership & Commitment,                Information Security Risk Assessment"},null,null,12.2,"IS.1.3.1 BCP.1.2.1 BCP.1.3.5 MGMT.1.6.1.1 OPS.1.3","PO9.4"]
[null,{"$f":"Lite!L7","v":2},{"$f":"Lite!J7","v":1},{"$f":"Lite!X7","v":1},{"$f":"Lite!B7","v":""},{"$f":"Lite!C7","v":"B. Security Policy"},{"$f":"Lite!D7","v":0},{"$f":"Lite!E7","v":0},{"$f":"Lite!F7","v":0},{"$f":"Lite!G7","v":0},{"$f":"Lite!H7","v":0}]
[null,{"$f":"Lite!L8","v":2},{"$f":"Lite!J8","v":"B"},{"$f":"Lite!X8","v":1},{"$f":"Lite!B8","v":"SL.2"},{"$f":"Lite!C8","v":"Is there an information security policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"Lite!D8","v":"Yes"},{"$f":"Lite!E8","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"Lite!F8","v":"B.1 Information Security Policy Content & Maintenance"},{"$f":"Lite!G8","v":"5.1.1"},{"$f":"Lite!H8","v":"Policies for information security"},"PO6.1","IT policy and control environment","5.4, 12.1","IS.1.4.1","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[null,{"$f":"Lite!L9","v":2},{"$f":"Lite!J9","v":"B"},{"$f":"Lite!X9","v":1},{"$f":"Lite!B9","v":"SL.3"},{"$f":"Lite!C9","v":"Have the policies been reviewed in the last 12 months?"},{"$f":"Lite!D9","v":"Yes"},{"$f":"Lite!E9","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"Lite!F9","v":"B.1 Procedure: d"},{"$f":"Lite!G9","v":"5.1.2"},{"$f":"Lite!H9","v":"Review of the policies for information security"},"PO3.1","Technological direction planning","12.2.b","IS.1.4.2.7","PO3.1, PO5.3, PO5.4, PO6.3, PO9.4, DS5.2, DS5.3, ME2.2, ME2.5, ME2.7, ME4.7"]
[null,{"$f":"Lite!L10","v":2},{"$f":"Lite!J10","v":"B"},{"$f":"Lite!X10","v":1},{"$f":"Lite!B10","v":"SL.4"},{"$f":"Lite!C10","v":"Is there a vendor management program?"},{"$f":"Lite!D10","v":"No"},{"$f":"Lite!E10","v":0},{"$f":"Lite!F10","v":0},{"$f":"Lite!G10","v":0},{"$f":"Lite!H10","v":0},null,null,12.8,"N/A","N/A"]
[null,{"$f":"Lite!L11","v":3},{"$f":"Lite!J11","v":1},{"$f":"Lite!X11","v":1},{"$f":"Lite!B11","v":""},{"$f":"Lite!C11","v":"C. Organizational Security"},{"$f":"Lite!D11","v":0},{"$f":"Lite!E11","v":0},{"$f":"Lite!F11","v":0},{"$f":"Lite!G11","v":0},{"$f":"Lite!H11","v":0}]
[null,{"$f":"Lite!L12","v":3},{"$f":"Lite!J12","v":"C"},{"$f":"Lite!X12","v":1},{"$f":"Lite!B12","v":"SL.5"},{"$f":"Lite!C12","v":"Is there a respondent information security function responsible for security initiatives?"},{"$f":"Lite!D12","v":"Yes"},{"$f":"Lite!E12","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"Lite!F12","v":"C.3 Security Organization Roles/Responsibilities"},{"$f":"Lite!G12","v":"6.1.1"},{"$f":"Lite!H12","v":"Information Security Roles and Responsibilities"},"PO3.3","Monitoring of future trends and regulations",12.5,"IS.1.7.4 MGMT.1.6.1.6","PO3.3, PO3.5, PO4.3, PO4.4, PO4.5, PO4.8, PO6.3, PO6.4, PO6.5, DS5.1"]
[null,{"$f":"Lite!L13","v":3},{"$f":"Lite!J13","v":"C"},{"$f":"Lite!X13","v":1},{"$f":"Lite!B13","v":"SL.6"},{"$f":"Lite!C13","v":"Do external parties have access to Scoped Systems and Data or processing facilities?"},{"$f":"Lite!D13","v":"Yes"},{"$f":"Lite!E13","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"Lite!F13","v":0},{"$f":"Lite!G13","v":15},{"$f":"Lite!H13","v":"Supplier relationships"},null,null,12.8,"N/A","PO6.4, DS5.5, ME2.2, ME2.5, ME4.7"]
[null,{"$f":"Lite!L14","v":4},{"$f":"Lite!J14","v":1},{"$f":"Lite!X14","v":1},{"$f":"Lite!B14","v":""},{"$f":"Lite!C14","v":"D. Asset Management"},{"$f":"Lite!D14","v":0},{"$f":"Lite!E14","v":0},{"$f":"Lite!F14","v":0},{"$f":"Lite!G14","v":0},{"$f":"Lite!H14","v":0}]
[null,{"$f":"Lite!L15","v":4},{"$f":"Lite!J15","v":"D"},{"$f":"Lite!X15","v":1},{"$f":"Lite!B15","v":"SL.7"},{"$f":"Lite!C15","v":"Is there an asset management policy or program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"Lite!D15","v":"Yes"},{"$f":"Lite!E15","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"Lite!F15","v":"D. Assessment Management"},{"$f":"Lite!G15","v":8.1},{"$f":"Lite!H15","v":"Responsibility For Assets"},null,null,"N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[null,{"$f":"Lite!L16","v":4},{"$f":"Lite!J16","v":"D"},{"$f":"Lite!X16","v":1},{"$f":"Lite!B16","v":"SL.8"},{"$f":"Lite!C16","v":"Are information assets classified?"},{"$f":"Lite!D16","v":"Yes"},{"$f":"Lite!E16","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"Lite!F16","v":"D.1.c.6"},{"$f":"Lite!G16","v":"8.2.1"},{"$f":"Lite!H16","v":"Classification of Information"},"PO2.3","Data classification scheme","9.6.1","N/A","PO2, AI2, DS9"]
[null,{"$f":"Lite!L17","v":5},{"$f":"Lite!J17","v":1},{"$f":"Lite!X17","v":1},{"$f":"Lite!B17","v":""},{"$f":"Lite!C17","v":"E. Human Resource Security"},{"$f":"Lite!D17","v":0},{"$f":"Lite!E17","v":0},{"$f":"Lite!F17","v":0},{"$f":"Lite!G17","v":0},{"$f":"Lite!H17","v":0}]
[null,{"$f":"Lite!L18","v":5},{"$f":"Lite!J18","v":"E"},{"$f":"Lite!X18","v":1},{"$f":"Lite!B18","v":"SL.9"},{"$f":"Lite!C18","v":"Are security roles and responsibilities of constituents defined and documented in accordance with the respondent’s information security policy?"},{"$f":"Lite!D18","v":"Yes"},{"$f":"Lite!E18","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"Lite!F18","v":"C.3 Security Organization Roles/Responsibilities"},{"$f":"Lite!G18","v":"6.1.1"},{"$f":"Lite!H18","v":"Information security roles and responsibilities"},"PO4.6","Roles and responsibilities",12.1,"IS.2.M.15.1 MGMT.1.6.1.2 WPS.2.2.1.3.1","PO4.6, PO4.8, PO6.3, PO7.1, PO7.2, PO7.3, DS5.4"]
[null,{"$f":"Lite!L19","v":5},{"$f":"Lite!J19","v":"E"},{"$f":"Lite!X19","v":1},{"$f":"Lite!B19","v":"SL.10"},{"$f":"Lite!C19","v":"Is a background screening performed prior to allowing constituent access to Scoped Systems and Data?"},{"$f":"Lite!D19","v":"No"},{"$f":"Lite!E19","v":0},{"$f":"Lite!F19","v":"E.3 Background Investigation Policy Content"},{"$f":"Lite!G19","v":"7.1.1"},{"$f":"Lite!H19","v":"Screening"},null,null,12.7,"IS.2.F.1","N/A"]
[null,{"$f":"Lite!L20","v":5},{"$f":"Lite!J20","v":"E"},{"$f":"Lite!X20","v":1},{"$f":"Lite!B20","v":"SL.11"},{"$f":"Lite!C20","v":"Are new hires required to sign any agreements upon hire?"},{"$f":"Lite!D20","v":"Yes"},{"$f":"Lite!E20","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"Lite!F20","v":0},{"$f":"Lite!G20","v":"7.1.2"},{"$f":"Lite!H20","v":"Terms and conditions of employment"},"PO4.6","Roles and responsibilities","12.6.2","IS.2.A.8.1 IS.2.F.4 IS.2.F.2","PO4.6, PO7.1, PO7.3, DS2.3"]
[null,{"$f":"Lite!L21","v":5},{"$f":"Lite!J21","v":"E"},{"$f":"Lite!X21","v":1},{"$f":"Lite!B21","v":"SL.12"},{"$f":"Lite!C21","v":"Is there a security awareness training program?"},{"$f":"Lite!D21","v":"Yes"},{"$f":"Lite!E21","v":"Cloudamize Security Policy - Cloudamize Security Training & Maintenance Policy"},{"$f":"Lite!F21","v":"E.1 Security Awareness Training Attendance"},{"$f":"Lite!G21","v":"7.2.2"},{"$f":"Lite!H21","v":"Information security awareness, education, and training"},"PO4.6","Roles and responsibilities",12.6,"IS.1.7.2 E-BANK.1.4.2.11 E-BANK.1.4.2.12","PO4.6, PO6.2, PO6.4, PO7.2, PO7.4, PO7.7, AI1.1, AI7.1, DS5.1, DS5.2, DS5.3, DS7.1, DS7.2"]
[null,{"$f":"Lite!L22","v":5},{"$f":"Lite!J22","v":"E"},{"$f":"Lite!X22","v":1},{"$f":"Lite!B22","v":"SL.13"},{"$f":"Lite!C22","v":"Is there a disciplinarily process for non-compliance with information security policies?"},{"$f":"Lite!D22","v":"Yes"},{"$f":"Lite!E22","v":"Cloudamize Security Policy - Cloudamize Information Secuirty Policy - Non-Compliance"},{"$f":"Lite!F22","v":0},{"$f":"Lite!G22","v":"7.2.3"},{"$f":"Lite!H22","v":"Disciplinary process"},"PO4.8","Responsibility for risk, security and compliance","N/A","IS.1.7.6","PO4.8, PO7.8, DS5.6"]
[null,{"$f":"Lite!L23","v":5},{"$f":"Lite!J23","v":"E"},{"$f":"Lite!X23","v":1},{"$f":"Lite!B23","v":"SL.14"},{"$f":"Lite!C23","v":"Is there a constituent termination or change of status process?"},{"$f":"Lite!D23","v":"Yes"},{"$f":"Lite!E23","v":"Cloudamize Security Policy - Cloudamize Information Secuirty Policy - Non-Compliance"},{"$f":"Lite!F23","v":"H.2 Revoke System Access"},{"$f":"Lite!G23","v":7.3},{"$f":"Lite!H23","v":"Termination responsibilities"},"PO7.8","Job change and termination","N/A","OPS.1.5.3.5","PO4.8, PO7.8, DS5.6"]
[null,{"$f":"Lite!L24","v":6},{"$f":"Lite!J24","v":1},{"$f":"Lite!X24","v":1},{"$f":"Lite!B24","v":""},{"$f":"Lite!C24","v":"F. Physical and Environmental Security"},{"$f":"Lite!D24","v":0},{"$f":"Lite!E24","v":0},{"$f":"Lite!F24","v":0},{"$f":"Lite!G24","v":0},{"$f":"Lite!H24","v":0}]
[null,{"$f":"Lite!L25","v":6},{"$f":"Lite!J25","v":"F"},{"$f":"Lite!X25","v":1},{"$f":"Lite!B25","v":"SL.15"},{"$f":"Lite!C25","v":"Is there a physical security program?"},{"$f":"Lite!D25","v":"Yes"},{"$f":"Lite!E25","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy"},{"$f":"Lite!F25","v":0},{"$f":"Lite!G25","v":"5.1.1"},{"$f":"Lite!H25","v":"Policies for information security"},"PO6.1","IT policy and control environment",12.1,"IS.2.E.1 OPS.1.5.1.6 OPS.1.5.1.8 WPS.2.2.1.3.5 AUDIT.2.D.1.10 E-BANK.1.4.2.8 E-BANK.1.5.4 RPS.1.2.2.2","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[null,{"$f":"Lite!L26","v":6},{"$f":"Lite!J26","v":"F"},{"$f":"Lite!X26","v":1},{"$f":"Lite!B26","v":"SL.16"},{"$f":"Lite!C26","v":"Are reasonable physical security and environmental controls present in the building/data center that contains Scoped Systems and Data?"},{"$f":"Lite!D26","v":"Yes"},{"$f":"Lite!E26","v":"Cloudamize Security Policy - Cloudamize Physical Security Policy / 1735 Market St Building Security Plan"},{"$f":"Lite!F26","v":"F. Physical and Environmental Security"},{"$f":"Lite!G26","v":11.1},{"$f":"Lite!H26","v":"Secure areas"},null,null,9.3000000000000007,"N/A","N/A"]
[null,{"$f":"Lite!L27","v":6},{"$f":"Lite!J27","v":"F"},{"$f":"Lite!X27","v":1},{"$f":"Lite!B27","v":"SL.17"},{"$f":"Lite!C27","v":"Are visitors permitted in the facility?"},{"$f":"Lite!D27","v":"Yes"},{"$f":"Lite!E27","v":"1735 Market St Building Security Plan"},{"$f":"Lite!F27","v":0},{"$f":"Lite!G27","v":"11.1.2 "},{"$f":"Lite!H27","v":"Physical entry controls"},"DS12.2","Physical security measures",9.4,"OPS.2.12.E.9 WPS.2.9.1.2","DS12.2, DS12.3"]
[null,{"$f":"Lite!L28","v":7},{"$f":"Lite!J28","v":1},{"$f":"Lite!X28","v":1},{"$f":"Lite!B28","v":""},{"$f":"Lite!C28","v":"G. Communications and Operations Management"},{"$f":"Lite!D28","v":0},{"$f":"Lite!E28","v":0},{"$f":"Lite!F28","v":0},{"$f":"Lite!G28","v":0},{"$f":"Lite!H28","v":0}]
[null,{"$f":"Lite!L29","v":7},{"$f":"Lite!J29","v":"G"},{"$f":"Lite!X29","v":1},{"$f":"Lite!B29","v":"SL.18"},{"$f":"Lite!C29","v":"Are Management approved operating procedures utilized?"},{"$f":"Lite!D29","v":"Yes"},{"$f":"Lite!E29","v":"Cloudamize Security Policy"},{"$f":"Lite!F29","v":"G. Communications and Operations Management"},{"$f":"Lite!G29","v":"12.1.1"},{"$f":"Lite!H29","v":"Documented Operating Procedure"},"AI1.1","Definition and maintenance of business functional and technical requirements","N/A","MGMT.1.6.1.4 OPS.1.5 WPS.2.2.1.3.2 AUDIT.2.D.1.11","AI1.1, AI4.4, DS13.1"]
[null,{"$f":"Lite!L30","v":7},{"$f":"Lite!J30","v":"G"},{"$f":"Lite!X30","v":1},{"$f":"Lite!B30","v":"SL.19"},{"$f":"Lite!C30","v":"Is there an operational change management / change control policy or program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"Lite!D30","v":"Yes"},{"$f":"Lite!E30","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"Lite!F30","v":"G.21 Change Control"},{"$f":"Lite!G30","v":"12.1.2"},{"$f":"Lite!H30","v":"Change Management"},"AI6.1","Change standards and procedures",6.4,"IS.1.7.8 OPS.1.5.1.3","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[null,{"$f":"Lite!L31","v":7},{"$f":"Lite!J31","v":"G"},{"$f":"Lite!X31","v":1},{"$f":"Lite!B31","v":"SL.20"},{"$f":"Lite!C31","v":"Do third party vendors have access to Scoped Systems and Data? (backup vendors, service providers, equipment support maintenance, software maintenance vendors, data recovery vendors, etc.)?"},{"$f":"Lite!D31","v":"Yes"},{"$f":"Lite!E31","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"Lite!F31","v":0},{"$f":"Lite!G31","v":15},{"$f":"Lite!H31","v":"Supplier relationships"},"DS1.1","Service level management framework",12.8,"IS.1.4.1.11 IS.1.5.1 O.1.3.1.1 O.1.3.3","DS1.1, DS1.2, DS1.3, DS2.4"]
[null,{"$f":"Lite!L32","v":7},{"$f":"Lite!J32","v":"G"},{"$f":"Lite!X32","v":1},{"$f":"Lite!B32","v":"SL.21"},{"$f":"Lite!C32","v":"Is there an anti-virus / malware policy or program (workstations, servers, mobile devices) that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"Lite!D32","v":"Yes"},{"$f":"Lite!E32","v":"Cloudamize Security Policy - Cloudamize Personnel Acceptable Use Policy"},{"$f":"Lite!F32","v":"G.7 Virus Protection (Servers), G.8 Virus Protection (Workstations)"},{"$f":"Lite!G32","v":"12.2.1"},{"$f":"Lite!H32","v":"Controls Against Malware"},"PO4.11","Segregation of duties","N/A","IS.2.B.9.4 IS.2.M.5","PO4.1, DS5.9, DS5.11"]
[null,{"$f":"Lite!L33","v":7},{"$f":"Lite!J33","v":"G"},{"$f":"Lite!X33","v":1},{"$f":"Lite!B33","v":"SL.22"},{"$f":"Lite!C33","v":"Are system backups of Scoped Systems and Data performed?"},{"$f":"Lite!D33","v":"Yes"},{"$f":"Lite!E33","v":0},{"$f":"Lite!F33","v":"G.20 Backup Media Restoration"},{"$f":"Lite!G33","v":"12.3.1"},{"$f":"Lite!H33","v":"Information Back-Up"},"AI6.1","Change standards and procedures","9.6.2","IS.2.B.9.6","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[null,{"$f":"Lite!L34","v":7},{"$f":"Lite!J34","v":"G"},{"$f":"Lite!X34","v":1},{"$f":"Lite!B34","v":"SL.23"},{"$f":"Lite!C34","v":"Are firewalls in use for both internal and external connections?"},{"$f":"Lite!D34","v":"Yes"},{"$f":"Lite!E34","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"Lite!F34","v":"G.2 Network Security – Firewall(s)"},{"$f":"Lite!G34","v":"13.1.3"},{"$f":"Lite!H34","v":"Segregation in networks"},"PO6.2","Enterprise IT risk and internal control framework",6.1,"N/A","PO6.2, DS5.2, DS5.3, DS5.7"]
[null,{"$f":"Lite!L35","v":7},{"$f":"Lite!J35","v":"G"},{"$f":"Lite!X35","v":1},{"$f":"Lite!B35","v":"SL.24"},{"$f":"Lite!C35","v":"Are vulnerability assessments, scans or penetration tests performed on internal or external networks?"},{"$f":"Lite!D35","v":"Yes"},{"$f":"Lite!E35","v":"Cloudamize Security Policy - Cloudamize Risk Assessment Plan"},{"$f":"Lite!F35","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"Lite!G35","v":"12.6.1"},{"$f":"Lite!H35","v":"Control of technical vulnerabilities"},"DS5.10","Network security",11.3,"N/A","DS5.9, DS5.11"]
[null,{"$f":"Lite!L36","v":7},{"$f":"Lite!J36","v":"G"},{"$f":"Lite!X36","v":1},{"$f":"Lite!B36","v":"SL.25"},{"$f":"Lite!C36","v":"Are there external network connections (Internet, intranet, extranet, etc.)?"},{"$f":"Lite!D36","v":"Yes"},{"$f":"Lite!E36","v":"Cloudamize Security Policy - Cloudamize Network Security Policy"},{"$f":"Lite!F36","v":0},{"$f":"Lite!G36","v":"13.1.1"},{"$f":"Lite!H36","v":"Network Controls"},null,null,"10.5.4","N/A","DS5.7, DS5.9, DS5.11"]
[null,{"$f":"Lite!L37","v":7},{"$f":"Lite!J37","v":"G"},{"$f":"Lite!X37","v":1},{"$f":"Lite!B37","v":"SL.26"},{"$f":"Lite!C37","v":"Is wireless networking technology used?"},{"$f":"Lite!D37","v":"Yes"},{"$f":"Lite!E37","v":"Cloudamize Security Policy - Cloudamize Network Security Policy - Securing the Cloudamize Local Office"},{"$f":"Lite!F37","v":"G.17 Unapproved Wireless Networks"},{"$f":"Lite!G37","v":"13.1.1.c"},{"$f":"Lite!H37","v":"Network Controls"},null,null,"N/A","IS.2.M.6","DS5.5, DS5.7"]
[null,{"$f":"Lite!L38","v":7},{"$f":"Lite!J38","v":"G"},{"$f":"Lite!X38","v":1},{"$f":"Lite!B38","v":"SL.27"},{"$f":"Lite!C38","v":"Is there a removable media policy or program (CDs, DVDs, tapes, disk drives) that has been approved by management, communicated to appropriate constituents, and an owner to maintain and review the policy?"},{"$f":"Lite!D38","v":"Yes"},{"$f":"Lite!E38","v":"Cloudamize Security Policy - Cloudamize Removable Media Policy"},{"$f":"Lite!F38","v":"G.15 Physical Media Tracking"},{"$f":"Lite!G38","v":"8.3.1"},{"$f":"Lite!H38","v":"Management Of Removable Media"},"DS5.3","Identity management","9.7.1","N/A","DS5.4, DS5.7"]
[null,{"$f":"Lite!L39","v":7},{"$f":"Lite!J39","v":"G"},{"$f":"Lite!X39","v":1},{"$f":"Lite!B39","v":"SL.28"},{"$f":"Lite!C39","v":"Is Scoped Data sent or received electronically or via physical media?"},{"$f":"Lite!D39","v":"Yes"},{"$f":"Lite!E39","v":"Cloudamize Security Policy"},{"$f":"Lite!F39","v":"G.4 Network Management – Encrypted Authentication Credentials"},{"$f":"Lite!G39","v":"8.3.3"},{"$f":"Lite!H39","v":"Physical media in transit"},"DS5.5","Security testing, surveillance and monitoring","N/A","IS.2.C.2","AI6.3, DS5.7"]
[null,{"$f":"Lite!L40","v":7},{"$f":"Lite!J40","v":"G"},{"$f":"Lite!X40","v":1},{"$f":"Lite!B40","v":"SL.29"},{"$f":"Lite!C40","v":"Are Web services provided?"},{"$f":"Lite!D40","v":"Yes"},{"$f":"Lite!E40","v":"Cloudamize Security Policy - Cloudamize Privacy Policy (Website Only)"},{"$f":"Lite!F40","v":0},{"$f":"Lite!G40","v":"N/A"},{"$f":"Lite!H40","v":""},null,null,"N/A"]
[null,{"$f":"Lite!L41","v":8},{"$f":"Lite!J41","v":1},{"$f":"Lite!X41","v":1},{"$f":"Lite!B41","v":""},{"$f":"Lite!C41","v":"H. Access Control"},{"$f":"Lite!D41","v":0},{"$f":"Lite!E41","v":0},{"$f":"Lite!F41","v":0},{"$f":"Lite!G41","v":0},{"$f":"Lite!H41","v":0}]
[null,{"$f":"Lite!L42","v":8},{"$f":"Lite!J42","v":"H"},{"$f":"Lite!X42","v":1},{"$f":"Lite!B42","v":"SL.30"},{"$f":"Lite!C42","v":"Are electronic systems used to transmit, process or store Scoped Systems and Data?"},{"$f":"Lite!D42","v":"Yes"},{"$f":"Lite!E42","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"Lite!F42","v":0},{"$f":"Lite!G42","v":"N/A"},{"$f":"Lite!H42","v":""},null,null,"N/A","N/A","N/A"]
[null,{"$f":"Lite!L43","v":8},{"$f":"Lite!J43","v":"H"},{"$f":"Lite!X43","v":1},{"$f":"Lite!B43","v":"SL.31"},{"$f":"Lite!C43","v":"Are unique user IDs used for access?"},{"$f":"Lite!D43","v":"Yes"},{"$f":"Lite!E43","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"Lite!F43","v":0},{"$f":"Lite!G43","v":"9.2.1.a"},{"$f":"Lite!H43","v":"User registration and de-registration"},"DS5.4","User account management","8.1.1","IS.2.A.2.1 IS.2.A.2.3 IS.2.A.4.7&\" \"&","DS5.4"]
[null,{"$f":"Lite!L44","v":8},{"$f":"Lite!J44","v":"H"},{"$f":"Lite!X44","v":1},{"$f":"Lite!B44","v":"SL.32"},{"$f":"Lite!C44","v":"Are passwords required to access systems transmitting, processing or storing Scoped Systems and Data?"},{"$f":"Lite!D44","v":"Yes"},{"$f":"Lite!E44","v":"Cloudamize Security Policy - Cloudamize Information Security Policy"},{"$f":"Lite!F44","v":"H.1 Access Controls"},{"$f":"Lite!G44","v":"9.4.3"},{"$f":"Lite!H44","v":"Password Management System"},"DS5.3","Identity management",8.1,"N/A","DS5.3"]
[null,{"$f":"Lite!L45","v":8},{"$f":"Lite!J45","v":"H"},{"$f":"Lite!X45","v":1},{"$f":"Lite!B45","v":"SL.33"},{"$f":"Lite!C45","v":"Is remote access permitted?"},{"$f":"Lite!D45","v":"No"},{"$f":"Lite!E45","v":"All scoped data is only accessed utilizing Cloudamize issues equipment. No VPN applications are utilized. "},{"$f":"Lite!F45","v":0},{"$f":"Lite!G45","v":6.2},{"$f":"Lite!H45","v":"Mobile devices and teleworking"},null,null,"N/A","N/A","AI1.2, AI2.4, DS5.7, DS5.10, DS5.11"]
[null,{"$f":"Lite!L46","v":9},{"$f":"Lite!J46","v":1},{"$f":"Lite!X46","v":1},{"$f":"Lite!B46","v":""},{"$f":"Lite!C46","v":"I. Information Systems Acquisition Development & Maintenance"},{"$f":"Lite!D46","v":0},{"$f":"Lite!E46","v":0},{"$f":"Lite!F46","v":0},{"$f":"Lite!G46","v":0},{"$f":"Lite!H46","v":0}]
[null,{"$f":"Lite!L47","v":9},{"$f":"Lite!J47","v":"I"},{"$f":"Lite!X47","v":1},{"$f":"Lite!B47","v":"SL.34"},{"$f":"Lite!C47","v":"Are business information systems used to transmit, process or store Scoped Systems and Data?"},{"$f":"Lite!D47","v":"Yes"},{"$f":"Lite!E47","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"Lite!F47","v":0},{"$f":"Lite!G47","v":14.1},{"$f":"Lite!H47","v":"Security requirements of information systems"},"AI1.2","Risk analysis report","N/A","N/A","AI1.2, AI2.4, AI3.2"]
[null,{"$f":"Lite!L48","v":9},{"$f":"Lite!J48","v":"I"},{"$f":"Lite!X48","v":1},{"$f":"Lite!B48","v":"SL.35"},{"$f":"Lite!C48","v":"Is application development performed?"},{"$f":"Lite!D48","v":"Yes"},{"$f":"Lite!E48","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"Lite!F48","v":0},{"$f":"Lite!G48","v":"14.2.1"},{"$f":"Lite!H48","v":"Secure development policy"},"N/A",0,"N/A","N/A","AI2.4, AI7.4, AI7.6, DS11.3, DS11.6"]
[null,{"$f":"Lite!L49","v":9},{"$f":"Lite!J49","v":"I"},{"$f":"Lite!X49","v":1},{"$f":"Lite!B49","v":"SL.36"},{"$f":"Lite!C49","v":"Is there a formal Software Development Life Cycle (SDLC) process?"},{"$f":"Lite!D49","v":"Yes"},{"$f":"Lite!E49","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"Lite!F49","v":"I.7 Application Security SDLC Phases"},{"$f":"Lite!G49","v":"14.2.1 "},{"$f":"Lite!H49","v":"Secure development policy"},"N/A",0,"N/A","IS.1.4.1.8 MGMT.1.6.1.3","AI2.4, AI7.4, AI7.6, DS11.3, DS11.6"]
[null,{"$f":"Lite!L50","v":9},{"$f":"Lite!J50","v":"I"},{"$f":"Lite!X50","v":1},{"$f":"Lite!B50","v":"SL.37"},{"$f":"Lite!C50","v":"Are systems and applications patched?"},{"$f":"Lite!D50","v":"Yes"},{"$f":"Lite!E50","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"Lite!F50","v":"I.4 System Patching"},{"$f":"Lite!G50","v":"12.6.1 "},{"$f":"Lite!H50","v":"Management of technical vulnerabilities"},"AI3.3","Infrastructure maintenance",6.2,"D&A.1.11","AI3.3, AI6.2, AI6.3, DS5.5, DS5.7, DS9.2"]
[null,{"$f":"Lite!L51","v":9},{"$f":"Lite!J51","v":"I"},{"$f":"Lite!X51","v":1},{"$f":"Lite!B51","v":"SL.38"},{"$f":"Lite!C51","v":"Is a web site supported, hosted or maintained that has access to Scoped Systems and Data?"},{"$f":"Lite!D51","v":"Yes"},{"$f":"Lite!E51","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"Lite!F51","v":0},{"$f":"Lite!G51","v":"N/A"},{"$f":"Lite!H51","v":0},"N/A",0,"N/A","N/A","N/A"]
[null,{"$f":"Lite!L52","v":9},{"$f":"Lite!J52","v":"I"},{"$f":"Lite!X52","v":1},{"$f":"Lite!B52","v":"SL.39"},{"$f":"Lite!C52","v":"Are vulnerability tests (internal/external) performed on all applications at least annually?"},{"$f":"Lite!D52","v":"Yes"},{"$f":"Lite!E52","v":"Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)"},{"$f":"Lite!F52","v":"I.1 Application Vulnerability Assessments/Ethical Hacking"},{"$f":"Lite!G52","v":"18.2.3"},{"$f":"Lite!H52","v":"Technical compliance review"},"DS5.5","Security testing, surveillance and monitoring",11.2,"IS.2.M.10.3 E-BANK.1.2.5.2 E-BANK.1.1.1.8.3","DS5.5, DS5.7, ME2.5"]
[null,{"$f":"Lite!L53","v":9},{"$f":"Lite!J53","v":"I"},{"$f":"Lite!X53","v":1},{"$f":"Lite!B53","v":"SL.40"},{"$f":"Lite!C53","v":"Are encryption tools managed and maintained for Scoped Data?"},{"$f":"Lite!D53","v":"Yes"},{"$f":"Lite!E53","v":"Cloudamize Security Policy - Cloudamize Privacey Policy (SaaS Application)"},{"$f":"Lite!F53","v":"G.22 Data Security Policy - Encryption"},{"$f":"Lite!G53","v":10.1},{"$f":"Lite!H53","v":"Cytographic controls"},"N/A",0,3.6,"WPS.2.5","N/A"]
[null,{"$f":"Lite!L54","v":10},{"$f":"Lite!J54","v":1},{"$f":"Lite!X54","v":1},{"$f":"Lite!B54","v":""},{"$f":"Lite!C54","v":"J. Incident Event and Communications Management"},{"$f":"Lite!D54","v":0},{"$f":"Lite!E54","v":0},{"$f":"Lite!F54","v":0},{"$f":"Lite!G54","v":0},{"$f":"Lite!H54","v":0}]
[null,{"$f":"Lite!L55","v":10},{"$f":"Lite!J55","v":"J"},{"$f":"Lite!X55","v":1},{"$f":"Lite!B55","v":"SL.41"},{"$f":"Lite!C55","v":"Is there an Incident Management program?"},{"$f":"Lite!D55","v":"Yes"},{"$f":"Lite!E55","v":"Cloudamize Security Policy - Cloudamize Incident Management Policy"},{"$f":"Lite!F55","v":0},{"$f":"Lite!G55","v":16},{"$f":"Lite!H55","v":" Information security incident management"},null,null,"N/A","IS.2.M.13 OPS.1.5.1.9 OPS.1.10","N/A"]
[null,{"$f":"Lite!L56","v":11},{"$f":"Lite!J56","v":1},{"$f":"Lite!X56","v":1},{"$f":"Lite!B56","v":""},{"$f":"Lite!C56","v":"K. Business Continuity and Disaster Recovery"},{"$f":"Lite!D56","v":0},{"$f":"Lite!E56","v":0},{"$f":"Lite!F56","v":0},{"$f":"Lite!G56","v":0},{"$f":"Lite!H56","v":0}]
[null,{"$f":"Lite!L57","v":11},{"$f":"Lite!J57","v":"K"},{"$f":"Lite!X57","v":1},{"$f":"Lite!B57","v":"SL.42"},{"$f":"Lite!C57","v":"Is there a documented policy for business continuity and disaster recovery that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"Lite!D57","v":"Yes"},{"$f":"Lite!E57","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"Lite!F57","v":"B.1 Information Security Policy Content"},{"$f":"Lite!G57","v":17.100000000000001},{"$f":"Lite!H57","v":"Information security continuity"},null,null,"N/A","AUDIT.2.F.2.3","N/A"]
[null,{"$f":"Lite!L58","v":11},{"$f":"Lite!J58","v":"K"},{"$f":"Lite!X58","v":1},{"$f":"Lite!B58","v":"SL.43"},{"$f":"Lite!C58","v":"Is there an annual schedule of required tests?"},{"$f":"Lite!D58","v":"Yes"},{"$f":"Lite!E58","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"Lite!F58","v":0},{"$f":"Lite!G58","v":"17.1.3"},{"$f":"Lite!H58","v":"Verify, review and evaluate information security continuity"},"PO3.1","Technological direction planning","N/A","BCP.1.10.3 BCP.1.10.2 BCP.2.2.1 BCP.2.2.1.7 WPS.2.10.1.2 RPS.2.E.1.6 RPS.2.L.1","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[null,{"$f":"Lite!L59","v":11},{"$f":"Lite!J59","v":"K"},{"$f":"Lite!X59","v":1},{"$f":"Lite!B59","v":"SL.44"},{"$f":"Lite!C59","v":"Are BC/DR tests conducted at least annually?"},{"$f":"Lite!D59","v":"Yes"},{"$f":"Lite!E59","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"Lite!F59","v":0},{"$f":"Lite!G59","v":"17.1.3"},{"$f":"Lite!H59","v":"Verify, review and evaluate information security continuity"},"PO3.1","Technological direction planning","N/A","N/A","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[null,{"$f":"Lite!L60","v":11},{"$f":"Lite!J60","v":"K"},{"$f":"Lite!X60","v":1},{"$f":"Lite!B60","v":"SL.45"},{"$f":"Lite!C60","v":"Is there a Pandemic Plan?"},{"$f":"Lite!D60","v":"No"},{"$f":"Lite!E60","v":0},{"$f":"Lite!F60","v":0},{"$f":"Lite!G60","v":"N/A"},{"$f":"Lite!H60","v":0},"PO9.1","IT and business risk management alignment management process","N/A","BCP.1.8.1","PO9.1, PO9.2, PO9.4, DS4.1, DS4.3"]
[null,{"$f":"Lite!L61","v":11},{"$f":"Lite!J61","v":"K"},{"$f":"Lite!X61","v":1},{"$f":"Lite!B61","v":"SL.46"},{"$f":"Lite!C61","v":"Is a Business Impact Analysis conducted at least annually?"},{"$f":"Lite!D61","v":"Yes"},{"$f":"Lite!E61","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"Lite!F61","v":"K.1 Business Impact Analysis"},{"$f":"Lite!G61","v":"17.1.1 "},{"$f":"Lite!H61","v":"Planning information security continuity"},"PO9.1","IT and business risk management alignment management process","N/A","BCP.1.3","PO9.1, PO9.2, PO9.4, DS4.1, DS4.3"]
[null,{"$f":"Lite!L62","v":11},{"$f":"Lite!J62","v":"K"},{"$f":"Lite!X62","v":1},{"$f":"Lite!B62","v":"SL.47"},{"$f":"Lite!C62","v":"Is there insurance coverage for business interruptions or general services interruption?"},{"$f":"Lite!D62","v":"Yes"},{"$f":"Lite!E62","v":"Cloudamize Security Policy - Cloudamize Disaster Recovery Plan & Business Continuity Plan"},{"$f":"Lite!F62","v":"K.4 Business Insurance"},{"$f":"Lite!G62","v":"14.1.1.d"},{"$f":"Lite!H62","v":"Including Information Security In The Business Continuity Management Process"},"PO3.1","Technological direction planning","N/A","BCP.1.4.3.10 MGMT.1.3.8","PO3.1, PO9.1, PO9.2, DS4.1, DS4.3, DS4.8, DS8.3"]
[null,{"$f":"Lite!L63","v":12},{"$f":"Lite!J63","v":1},{"$f":"Lite!X63","v":1},{"$f":"Lite!B63","v":""},{"$f":"Lite!C63","v":"L. Compliance"},{"$f":"Lite!D63","v":0},{"$f":"Lite!E63","v":0},{"$f":"Lite!F63","v":0},{"$f":"Lite!G63","v":0},{"$f":"Lite!H63","v":0}]
[null,{"$f":"Lite!L64","v":12},{"$f":"Lite!J64","v":"L"},{"$f":"Lite!X64","v":1},{"$f":"Lite!B64","v":"SL.48"},{"$f":"Lite!C64","v":"Is there an internal audit, risk management or compliance department with responsibility for identifying and tracking resolution of outstanding regulatory issues?"},{"$f":"Lite!D64","v":"Yes"},{"$f":"Lite!E64","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"Lite!F64","v":0},{"$f":"Lite!G64","v":"18.1.1 "},{"$f":"Lite!H64","v":"Identification of applicable legislation and contractual requirements"},"PO4.4","Organisational placement of the IT function","N/A","MGMT.1.2.1.15.2 RPS.1.4.3","PO4.4, PO4.5, PO4.6, PO4.8, PO4.10, PO6.5, DS5.1, DS5.2, DS5.3"]
[null,{"$f":"Lite!L65","v":12},{"$f":"Lite!J65","v":"L"},{"$f":"Lite!X65","v":1},{"$f":"Lite!B65","v":"SL.49"},{"$f":"Lite!C65","v":"Is there an internal compliance and ethics reporting mechanism and training program for employees to report compliance issues?"},{"$f":"Lite!D65","v":"Yes"},{"$f":"Lite!E65","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"Lite!F65","v":0},{"$f":"Lite!G65","v":"N/A"},{"$f":"Lite!H65","v":0},null,null,"N/A"]
[null,{"$f":"Lite!L66","v":13},{"$f":"Lite!J66","v":1},{"$f":"Lite!X66","v":1},{"$f":"Lite!B66","v":""},{"$f":"Lite!C66","v":"M. Mobile"},{"$f":"Lite!D66","v":0},{"$f":"Lite!E66","v":0},{"$f":"Lite!F66","v":0},{"$f":"Lite!G66","v":0},{"$f":"Lite!H66","v":0}]
[null,{"$f":"Lite!L67","v":13},{"$f":"Lite!J67","v":"M"},{"$f":"Lite!X67","v":1},{"$f":"Lite!B67","v":"SL.50"},{"$f":"Lite!C67","v":"Are mobile devices used to access Scoped Systems and Data?"},{"$f":"Lite!D67","v":"No"},{"$f":"Lite!E67","v":0},{"$f":"Lite!F67","v":0},{"$f":"Lite!G67","v":6.2},{"$f":"Lite!H67","v":"Mobile devices and teleworking"},null,null,"N/A"]
[null,{"$f":"Lite!L68","v":14},{"$f":"Lite!J68","v":1},{"$f":"Lite!X68","v":1},{"$f":"Lite!B68","v":""},{"$f":"Lite!C68","v":"P. Privacy"},{"$f":"Lite!D68","v":0},{"$f":"Lite!E68","v":0},{"$f":"Lite!F68","v":0},{"$f":"Lite!G68","v":0},{"$f":"Lite!H68","v":0}]
[null,{"$f":"Lite!L69","v":14},{"$f":"Lite!J69","v":"P"},{"$f":"Lite!X69","v":1},{"$f":"Lite!B69","v":"SL.51"},{"$f":"Lite!C69","v":"Is Scoped Data transmitted, processed, or stored that can be classified as non-public information (NPI), personally identifiable information (PII), or sensitive customer financial information? If yes, describe and list types of data."},{"$f":"Lite!D69","v":"Yes"},{"$f":"Lite!E69","v":"Cloudamize Security Policy - Cloudamize Information Security Policy. Only NPI, no PII or Finacial Information is collected"},{"$f":"Lite!F69","v":"P.1 Target Privacy Data Inventory and Flows"},{"$f":"Lite!G69","v":"8.2.1"},{"$f":"Lite!H69","v":"Classification of Information"},null,null,"N/A"]
[null,{"$f":"Lite!L70","v":14},{"$f":"Lite!J70","v":"P"},{"$f":"Lite!X70","v":1},{"$f":"Lite!B70","v":"SL.52"},{"$f":"Lite!C70","v":"Is Scoped Data transmitted, processed, or stored that can be classified as protected health information, electronic health records, or personal health records? If yes, identify the classifications."},{"$f":"Lite!D70","v":"N/A"},{"$f":"Lite!E70","v":"Cloudamize Security Policy - Cloudamize Information Security Policy. Only NPI, no PII or Finacial Information is collected"},{"$f":"Lite!F70","v":"P.1 Target Privacy Data Inventory and Flows"},{"$f":"Lite!G70","v":"8.2.2"},{"$f":"Lite!H70","v":"Classification of Information"},null,null,"N/A"]
[null,{"$f":"Lite!L71","v":14},{"$f":"Lite!J71","v":"P"},{"$f":"Lite!X71","v":1},{"$f":"Lite!B71","v":"SL.53"},{"$f":"Lite!C71","v":"For Scoped Data, is personal information about individuals transmitted to or received from countries outside the United States? If yes, identify the countries."},{"$f":"Lite!D71","v":"N/A"},{"$f":"Lite!E71","v":"Cloudamize Security Policy - Cloudamize Information Security Policy. Only NPI, no PII or Finacial Information is collected"},{"$f":"Lite!F71","v":"P.1 Target Privacy Data Inventory and Flows"},{"$f":"Lite!G71","v":"N/A"},{"$f":"Lite!H71","v":0},null,null,"N/A"]
[null,{"$f":"Lite!L72","v":14},{"$f":"Lite!J72","v":"P"},{"$f":"Lite!X72","v":1},{"$f":"Lite!B72","v":"SL.54"},{"$f":"Lite!C72","v":"For Scoped Data is there a dedicated person (or group) responsible for privacy compliance. If yes, describe. If no, explain reason"},{"$f":"Lite!D72","v":"Yes"},{"$f":"Lite!E72","v":"Cloudamize Security Policy - Cloudamize Security Working Group"},{"$f":"Lite!F72","v":"P.3 Privacy Organization and Program Maintenance"},{"$f":"Lite!G72","v":"16.1.1.b.3 "},{"$f":"Lite!H72","v":"Responsibilities and procedures"}]
[null,{"$f":"Lite!L73","v":14},{"$f":"Lite!J73","v":"P"},{"$f":"Lite!X73","v":1},{"$f":"Lite!B73","v":"SL.55"},{"$f":"Lite!C73","v":"For Scoped Data, is there a documented privacy policy or procedures to protect confidential information?"},{"$f":"Lite!D73","v":"Yes"},{"$f":"Lite!E73","v":"Cloudamize Security Policy - Cloudamize Privacy Policy"},{"$f":"Lite!F73","v":"P.2 Privacy Policy and Privacy Notices"},{"$f":"Lite!G73","v":"15.1.1"},{"$f":"Lite!H73","v":"Information security policy for supplier relationships"}]
[null,{"$f":"Lite!L74","v":14},{"$f":"Lite!J74","v":"P"},{"$f":"Lite!X74","v":1},{"$f":"Lite!B74","v":"SL.56"},{"$f":"Lite!C74","v":"For Scoped Data are there regular privacy risk assessments conducted? If yes, provide frequency and scope. If no, explain reason."},{"$f":"Lite!D74","v":"Yes"},{"$f":"Lite!E74","v":"Cloudamize Security Policy - Cloudamize Privacy Policy Cloudamize Secuirty Working Group. Annually and system wide checks of all Customer Data"},{"$f":"Lite!F74","v":"P.3 Privacy Organization and Program Maintenance"},{"$f":"Lite!G74","v":"15.1.3.i "},{"$f":"Lite!H74","v":"Information and communication technology supply chain"},null,null,"N/A"]
[null,{"$f":"Lite!L75","v":14},{"$f":"Lite!J75","v":"P"},{"$f":"Lite!X75","v":1},{"$f":"Lite!B75","v":"SL.57"},{"$f":"Lite!C75","v":"Is there formal privacy awareness training for employees, contractors, and third-party users to ensure confidentiality and privacy of Scoped Data?"},{"$f":"Lite!D75","v":"Yes"},{"$f":"Lite!E75","v":"Cloudamize Security Policy - Cloudamize Security Personnel Training"},{"$f":"Lite!F75","v":"P.7 Privacy Awareness"},{"$f":"Lite!G75","v":"7.2.2 "},{"$f":"Lite!H75","v":"Information security awareness, education and training"},null,null,"N/A"]
[null,{"$f":"Lite!L76","v":14},{"$f":"Lite!J76","v":"P"},{"$f":"Lite!X76","v":1},{"$f":"Lite!B76","v":"SL.58"},{"$f":"Lite!C76","v":"Is there a formal process for reporting and responding to privacy complaints or privacy incidents for Scoped Data? If yes, describe. If no, explain reason."},{"$f":"Lite!D76","v":"Yes"},{"$f":"Lite!E76","v":"Cloudamize Security Policy - Cloudamize Privacy Policy"},{"$f":"Lite!F76","v":"P.8 Privacy Event Notification and Response Management"},{"$f":"Lite!G76","v":"16.1.1 "},{"$f":"Lite!H76","v":"Responsibilties and procedures"}]
[null,{"$f":"Lite!L77","v":14},{"$f":"Lite!J77","v":"P"},{"$f":"Lite!X77","v":1},{"$f":"Lite!B77","v":"SL.59"},{"$f":"Lite!C77","v":"Is there a data classification and retention program for Scoped Data that identifies the data types that require additional management and governance?"},{"$f":"Lite!D77","v":"Yes"},{"$f":"Lite!E77","v":"Cloudamize Security Policy - Information Classification  Policy"},{"$f":"Lite!F77","v":"P.1 Target Privacy Data Inventory and Flows"},{"$f":"Lite!G77","v":8.1999999999999993},{"$f":"Lite!H77","v":"Information Classification"},null,null,"N/A"]
[null,{"$f":"Lite!L78","v":14},{"$f":"Lite!J78","v":"P"},{"$f":"Lite!X78","v":1},{"$f":"Lite!B78","v":"SL.60"},{"$f":"Lite!C78","v":"Is there a documented response program to address privacy incidents, unauthorized disclosure, unauthorized access or breach of Scoped Data?"},{"$f":"Lite!D78","v":"Yes"},{"$f":"Lite!E78","v":"Cloudamize Security Policy - Cloudamize Security Incident Response Policy"},{"$f":"Lite!F78","v":"P.8 Privacy Event Notification and Response Management"},{"$f":"Lite!G78","v":"16.1.1 "},{"$f":"Lite!H78","v":"Responsibilties and procedures"},null,null,"N/A"]
[null,{"$f":"Lite!L79","v":14},{"$f":"Lite!J79","v":"P"},{"$f":"Lite!X79","v":1},{"$f":"Lite!B79","v":"SL.61"},{"$f":"Lite!C79","v":"Is Scoped Data disclosed to third parties? If yes, describe"},{"$f":"Lite!D79","v":"No"},{"$f":"Lite!E79","v":0},{"$f":"Lite!F79","v":0},{"$f":"Lite!G79","v":0},{"$f":"Lite!H79","v":0},null,null,"N/A"]
[null,{"$f":"Lite!L80","v":14},{"$f":"Lite!J80","v":"P"},{"$f":"Lite!X80","v":1},{"$f":"Lite!B80","v":"SL.62"},{"$f":"Lite!C80","v":"Is Scoped Data disclosed to third parties outside of the U.S.? If yes, describe."},{"$f":"Lite!D80","v":"No"},{"$f":"Lite!E80","v":0},{"$f":"Lite!F80","v":0},{"$f":"Lite!G80","v":0},{"$f":"Lite!H80","v":0},null,null,"N/A"]
[null,{"$f":"Lite!L81","v":14},{"$f":"Lite!J81","v":"P"},{"$f":"Lite!X81","v":1},{"$f":"Lite!B81","v":"SL.63"},{"$f":"Lite!C81","v":"Are there contractual controls to ensure that Scoped Data shared with third parties is limited to defined parameters for access, use and disclosure? If yes, describe the controls, If no, explain reason."},{"$f":"Lite!D81","v":"Yes"},{"$f":"Lite!E81","v":"Cloudamize Security Policy -  Cloudamize Network Security Policy - Securing the Cloudamize Application Hosting Cloud"},{"$f":"Lite!F81","v":"P.4 Privacy Third Part Agreements"},{"$f":"Lite!G81","v":"15.1.2 "},{"$f":"Lite!H81","v":"Addressing security within supplier agreements"},null,null,"N/A"]
[null,{"$f":"Lite!L82","v":14},{"$f":"Lite!J82","v":"P"},{"$f":"Lite!X82","v":1},{"$f":"Lite!B82","v":"SL.64"},{"$f":"Lite!C82","v":"Is there a business associate contract in place to address obligations for the privacy and security requirements of the services provided?"},{"$f":"Lite!D82","v":"Yes"},{"$f":"Lite!E82","v":"Cloudamize Terms & Conditions can be found at cloudamize.com/terms"},{"$f":"Lite!F82","v":"P.4 Privacy Third Party Agreements"},{"$f":"Lite!G82","v":"15.1.2 "},{"$f":"Lite!H82","v":"Addressing security within supplier agreements"},null,null,"N/A"]
[null,{"$f":"Lite!L83","v":14},{"$f":"Lite!J83","v":"P"},{"$f":"Lite!X83","v":1},{"$f":"Lite!B83","v":"SL.65"},{"$f":"Lite!C83","v":"Is there a documented privacy program with administrative, technical, and physical safeguards for the protection of Scoped Data?"},{"$f":"Lite!D83","v":"Yes"},{"$f":"Lite!E83","v":"Cloudamize Security Policy - Cloudamize Privacy Policy"},{"$f":"Lite!F83","v":"P.2 Privacy Policy and Privacy Notices"},{"$f":"Lite!G83","v":"15.1.1"},{"$f":"Lite!H83","v":"Information security policy for supplier relationships"},null,null,"N/A"]
[null,{"$f":"Lite!L84","v":14},{"$f":"Lite!J84","v":"P"},{"$f":"Lite!X84","v":1},{"$f":"Lite!B84","v":"SL.66"},{"$f":"Lite!C84","v":"Is there a process for ensuring the accuracy of Scoped Data at the direction of the client? If yes, describe. If no, explain reason."},{"$f":"Lite!D84","v":"Yes"},{"$f":"Lite!E84","v":"Customers can request to review the accuracy of Customer Data by contacting Cloudamize and providing the criteria for the data they would like to review.  "},{"$f":"Lite!F84","v":"P.6 Management of Client Target Privacy Data"},{"$f":"Lite!G84","v":"8.2.3"},{"$f":"Lite!H84","v":"Handling of assets"}]
[null,{"$f":"Lite!L85","v":14},{"$f":"Lite!J85","v":"P"},{"$f":"Lite!X85","v":1},{"$f":"Lite!B85","v":"SL.67"},{"$f":"Lite!C85","v":"Is there a process to ensure that the personal information provided by an individual is limited for the purposes described in the respondent's privacy notice? If yes, describe. If no, explain reason."},{"$f":"Lite!D85","v":"Yes"},{"$f":"Lite!E85","v":"Cloudamize Security Policy - Cloudamize Information Secuirty Policy"},{"$f":"Lite!F85","v":"P.6 Management of Client Target Privacy Data"},{"$f":"Lite!G85","v":"8.2.4"},{"$f":"Lite!H85","v":"Handling of assets"}]
[null,{"$f":"Lite!L86","v":14},{"$f":"Lite!J86","v":"P"},{"$f":"Lite!X86","v":1},{"$f":"Lite!B86","v":"SL.68"},{"$f":"Lite!C86","v":"Are constituents regularly monitored for privacy compliance? If yes, describe. If no, explain reason."},{"$f":"Lite!D86","v":"No"},{"$f":"Lite!E86","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy / Cloudamize Security Working Group"},{"$f":"Lite!F86","v":0},{"$f":"Lite!G86","v":0},{"$f":"Lite!H86","v":0}]
[null,{"$f":"Lite!L87","v":14},{"$f":"Lite!J87","v":"P"},{"$f":"Lite!X87","v":1},{"$f":"Lite!B87","v":"SL.69"},{"$f":"Lite!C87","v":"Are there documented policies, procedures, and controls to limit access based on need to know or minimum necessary for constituents? If yes, describe."},{"$f":"Lite!D87","v":"Yes"},{"$f":"Lite!E87","v":"Cloudamize Security Policy - Cloudamize Personnel Access Policy"},{"$f":"Lite!F87","v":"P.6 Management of Client Target Privacy Data"},{"$f":"Lite!G87","v":"9.1.1.b"},{"$f":"Lite!H87","v":"Access control policy"},null,null,"N/A"]
[null,{"$f":"Lite!L88","v":14},{"$f":"Lite!J88","v":"P"},{"$f":"Lite!X88","v":1},{"$f":"Lite!B88","v":"SL.70"},{"$f":"Lite!C88","v":"Are enforcement mechanisms applied to constituents who violate privacy policies or confidentiality requirements?"},{"$f":"Lite!D88","v":"Yes"},{"$f":"Lite!E88","v":"Cloudamize Security Policy - Cloudamize Information Secuirty Policy - Non-Compliance"},{"$f":"Lite!F88","v":0},{"$f":"Lite!G88","v":0},{"$f":"Lite!H88","v":0}]
[null,{"$f":"Lite!L89","v":14},{"$f":"Lite!J89","v":"P"},{"$f":"Lite!X89","v":1},{"$f":"Lite!B89","v":"SL.71"},{"$f":"Lite!C89","v":"Are transactions for covered accounts accessed, modified, or processed, including address changes and discrepancies? If yes, describe."},{"$f":"Lite!D89","v":"No"},{"$f":"Lite!E89","v":0},{"$f":"Lite!F89","v":0},{"$f":"Lite!G89","v":0},{"$f":"Lite!H89","v":0},null,null,"N/A"]
[null,{"$f":"Lite!L90","v":14},{"$f":"Lite!J90","v":"P"},{"$f":"Lite!X90","v":1},{"$f":"Lite!B90","v":"SL.72"},{"$f":"Lite!C90","v":"Is customer data accessed, transmitted, processed, or stored that can be classified as consumer report information provided by a consumer reporting agency?"},{"$f":"Lite!D90","v":"No"},{"$f":"Lite!E90","v":0},{"$f":"Lite!F90","v":0},{"$f":"Lite!G90","v":0},{"$f":"Lite!H90","v":0}]
[null,{"$f":"Lite!L91","v":15},{"$f":"Lite!J91","v":1},{"$f":"Lite!X91","v":1},{"$f":"Lite!B91","v":""},{"$f":"Lite!C91","v":"Q. Software Application Security"},{"$f":"Lite!D91","v":0},{"$f":"Lite!E91","v":0},{"$f":"Lite!F91","v":0},{"$f":"Lite!G91","v":0},{"$f":"Lite!H91","v":0}]
[null,{"$f":"Lite!L92","v":15},{"$f":"Lite!J92","v":"Q"},{"$f":"Lite!X92","v":1},{"$f":"Lite!B92","v":"SL.73"},{"$f":"Lite!C92","v":"Is software provided?  "},{"$f":"Lite!D92","v":"Yes"},{"$f":"Lite!E92","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"Lite!F92","v":"Q. Software Application Security"},{"$f":"Lite!G92","v":"N/A"},{"$f":"Lite!H92","v":0},null,null,"N/A"]
[null,{"$f":"Lite!L93","v":15},{"$f":"Lite!J93","v":"Q"},{"$f":"Lite!X93","v":1},{"$f":"Lite!B93","v":"SL.74"},{"$f":"Lite!C93","v":"Is there a secure software development lifecycle policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy? "},{"$f":"Lite!D93","v":"Yes"},{"$f":"Lite!E93","v":"Cloudamize Security Policy - Cloudamize Application Change Management & SDLC Policy"},{"$f":"Lite!F93","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"Lite!G93","v":"14.2.1 "},{"$f":"Lite!H93","v":"Secure development policy"},null,null,"N/A"]
[null,{"$f":"Lite!L94","v":16},{"$f":"Lite!J94","v":1},{"$f":"Lite!X94","v":1},{"$f":"Lite!B94","v":""},{"$f":"Lite!C94","v":"V. Cloud Security"},{"$f":"Lite!D94","v":0},{"$f":"Lite!E94","v":0},{"$f":"Lite!F94","v":0},{"$f":"Lite!G94","v":0},{"$f":"Lite!H94","v":0}]
[null,{"$f":"Lite!L95","v":16},{"$f":"Lite!J95","v":"V"},{"$f":"Lite!X95","v":1},{"$f":"Lite!B95","v":"SL.75"},{"$f":"Lite!C95","v":"Are Cloud Services provided? If yes, what service model and deployment model is provided (select all that apply):"},{"$f":"Lite!D95","v":"No"},{"$f":"Lite!E95","v":0},{"$f":"Lite!F95","v":"V.1 Service and Deployment Models"},{"$f":"Lite!G95","v":4.3},{"$f":"Lite!H95","v":"Determining the scope of the information management system"},null,null,"N/A",null,null,"WP.1.A.1, WP.1.A.2"]
[null,{"$f":"Lite!L96","v":16},{"$f":"Lite!J96","v":"V"},{"$f":"Lite!X96","v":1},{"$f":"Lite!B96","v":"SL.76"},{"$f":"Lite!C96","v":"Software as a Service (SaaS)"},{"$f":"Lite!D96","v":0},{"$f":"Lite!E96","v":0},{"$f":"Lite!F96","v":"V.1 Service and Deployment Models"},{"$f":"Lite!G96","v":"N/A"},{"$f":"Lite!H96","v":0},null,null,"N/A",null,null,"WP.1.A.1, WP.1.A.2"]
[null,{"$f":"Lite!L97","v":16},{"$f":"Lite!J97","v":"V"},{"$f":"Lite!X97","v":1},{"$f":"Lite!B97","v":"SL.77"},{"$f":"Lite!C97","v":"Platform as a Service (PaaS)"},{"$f":"Lite!D97","v":0},{"$f":"Lite!E97","v":0},{"$f":"Lite!F97","v":"V.1 Service and Deployment Models"},{"$f":"Lite!G97","v":"N/A"},{"$f":"Lite!H97","v":0},null,null,"N/A",null,null,"WP.1.A.1, WP.1.A.2"]
[null,{"$f":"Lite!L98","v":16},{"$f":"Lite!J98","v":"V"},{"$f":"Lite!X98","v":1},{"$f":"Lite!B98","v":"SL.78"},{"$f":"Lite!C98","v":"Infrastructure as a Service (IaaS)"},{"$f":"Lite!D98","v":0},{"$f":"Lite!E98","v":0},{"$f":"Lite!F98","v":"V.1 Service and Deployment Models"},{"$f":"Lite!G98","v":"N/A"},{"$f":"Lite!H98","v":0},null,null,"N/A",null,null,"WP.1.A.1, WP.1.A.2"]
[null,{"$f":"Lite!L99","v":16},{"$f":"Lite!J99","v":"V"},{"$f":"Lite!X99","v":1},{"$f":"Lite!B99","v":"SL.79"},{"$f":"Lite!C99","v":"Private cloud"},{"$f":"Lite!D99","v":0},{"$f":"Lite!E99","v":0},{"$f":"Lite!F99","v":"V.1 Service and Deployment Models"},{"$f":"Lite!G99","v":"N/A"},{"$f":"Lite!H99","v":0},null,null,"N/A",null,null,"WP.1.E.1"]
[null,{"$f":"Lite!L100","v":16},{"$f":"Lite!J100","v":"V"},{"$f":"Lite!X100","v":1},{"$f":"Lite!B100","v":"SL.80"},{"$f":"Lite!C100","v":"Public cloud"},{"$f":"Lite!D100","v":0},{"$f":"Lite!E100","v":0},{"$f":"Lite!F100","v":"V.1 Service and Deployment Models"},{"$f":"Lite!G100","v":"N/A"},{"$f":"Lite!H100","v":0},null,null,"N/A",null,null,"WP.1.E.1"]
[null,{"$f":"Lite!L101","v":16},{"$f":"Lite!J101","v":"V"},{"$f":"Lite!X101","v":1},{"$f":"Lite!B101","v":"SL.81"},{"$f":"Lite!C101","v":"Community cloud"},{"$f":"Lite!D101","v":0},{"$f":"Lite!E101","v":0},{"$f":"Lite!F101","v":"V.1 Service and Deployment Models"},{"$f":"Lite!G101","v":"N/A"},{"$f":"Lite!H101","v":0},null,null,"N/A",null,null,"WP.1.E.1"]
[null,{"$f":"Lite!L102","v":16},{"$f":"Lite!J102","v":"V"},{"$f":"Lite!X102","v":1},{"$f":"Lite!B102","v":"SL.82"},{"$f":"Lite!C102","v":"Hybrid cloud"},{"$f":"Lite!D102","v":0},{"$f":"Lite!E102","v":0},{"$f":"Lite!F102","v":"V.1 Service and Deployment Models"},{"$f":"Lite!G102","v":"N/A"},{"$f":"Lite!H102","v":0},null,null,"N/A",null,null,"WP.1.E.1"]
[null,{"$f":"Lite!L103","v":16},{"$f":"Lite!J103","v":"V"},{"$f":"Lite!X103","v":1},{"$f":"Lite!B103","v":"SL.83"},{"$f":"Lite!C103","v":"Can clients define the legal jurisdictions where their data can be transmitted, processed or stored?"},{"$f":"Lite!D103","v":0},{"$f":"Lite!E103","v":0},{"$f":"Lite!F103","v":"P.1 Target Privacy Data Inventory and Flows"},{"$f":"Lite!G103","v":"15.1.2"},{"$f":"Lite!H103","v":"Addressing security within supplier agreements"},null,null,"N/A",null,null,"WP.1.G.3"]
[null,{"$f":"Lite!L104","v":16},{"$f":"Lite!J104","v":"V"},{"$f":"Lite!X104","v":1},{"$f":"Lite!B104","v":"SL.84"},{"$f":"Lite!C104","v":"Is data segmentation and separation capability between clients provided? If yes, describe."},{"$f":"Lite!D104","v":0},{"$f":"Lite!E104","v":0},{"$f":"Lite!F104","v":"V.1 Service and Deployment Models"},{"$f":"Lite!G104","v":"11.2.6, 9.1.1"},{"$f":"Lite!H104","v":"Security of equipment and assets off-premises, Access Control Policy"},null,null,"N/A",null,null,"WP.1.A.1"]
[null,{"$f":"Lite!L105","v":16},{"$f":"Lite!J105","v":"V"},{"$f":"Lite!X105","v":1},{"$f":"Lite!B105","v":"SL.85"},{"$f":"Lite!C105","v":"Is Scoped Data encrypted?"},{"$f":"Lite!D105","v":0},{"$f":"Lite!E105","v":0},{"$f":"Lite!F105","v":"G.22 Data Security Policy - Encryption"},{"$f":"Lite!G105","v":10.1},{"$f":"Lite!H105","v":"Cryptographic Controls"},null,null,"3.5, 3.6",null,null,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.A.7, WP.1.G.9"]
[null,{"$f":"Lite!L106","v":16},{"$f":"Lite!J106","v":"V"},{"$f":"Lite!X106","v":1},{"$f":"Lite!B106","v":"SL.86"},{"$f":"Lite!C106","v":"Are clients provided with the ability to generate a unique encryption key?"},{"$f":"Lite!D106","v":0},{"$f":"Lite!E106","v":0},{"$f":"Lite!F106","v":"G.22 Data Security Policy - Encryption"},{"$f":"Lite!G106","v":"10.1.2"},{"$f":"Lite!H106","v":"Key Management"},null,null,"3.6.1",null,null,"WP.1.A.6"]
[null,{"$f":"Lite!L107","v":16},{"$f":"Lite!J107","v":"V"},{"$f":"Lite!X107","v":1},{"$f":"Lite!B107","v":"SL.87"},{"$f":"Lite!C107","v":"Are clients provided with the ability to rotate their encryption key on a scheduled basis?"},{"$f":"Lite!D107","v":0},{"$f":"Lite!E107","v":0},{"$f":"Lite!F107","v":"G.22 Data Security Policy - Encryption"},{"$f":"Lite!G107","v":"10.1.2"},{"$f":"Lite!H107","v":"Key Management"},null,null,"3.6.4",null,null,"WP.1.A.6, WP.1.A.7"]
[null,{"$f":"Lite!L108","v":16},{"$f":"Lite!J108","v":"V"},{"$f":"Lite!X108","v":1},{"$f":"Lite!B108","v":"SL.88"},{"$f":"Lite!C108","v":"Is standards based federated ID capability available to clients (e.g., SAML, OpenID)?"},{"$f":"Lite!D108","v":0},{"$f":"Lite!E108","v":0},{"$f":"Lite!F108","v":"N/A"},{"$f":"Lite!G108","v":"9.2.4"},{"$f":"Lite!H108","v":"Management of secret authentication information of users."},null,null,"N/A",null,null,"WP.1.H.2, WP.1.H.4"]
[null,{"$f":"Lite!L109","v":16},{"$f":"Lite!J109","v":"V"},{"$f":"Lite!X109","v":1},{"$f":"Lite!B109","v":"SL.89"},{"$f":"Lite!C109","v":"Are application self service features or an Internet accessible self-service portal available to clients? If yes, describe."},{"$f":"Lite!D109","v":0},{"$f":"Lite!E109","v":0},{"$f":"Lite!F109","v":"N/A"},{"$f":"Lite!G109","v":"11.2.6, 9.1.1"},{"$f":"Lite!H109","v":"Security of equipment and assets off-premises, Access Control Policy"},null,null,"N/A"]
[null,{"$f":"Lite!L110","v":16},{"$f":"Lite!J110","v":"V"},{"$f":"Lite!X110","v":1},{"$f":"Lite!B110","v":"SL.90"},{"$f":"Lite!C110","v":"Is there a management approved process to ensure that image snapshots containing Scoped Data are authorized prior to being snapped?"},{"$f":"Lite!D110","v":0},{"$f":"Lite!E110","v":0},{"$f":"Lite!F110","v":"N/A"},{"$f":"Lite!G110","v":"N/A"},{"$f":"Lite!H110","v":0},null,null,"N/A",null,null,"WP.1.D.2"]
[null,{"$f":"Lite!L111","v":16},{"$f":"Lite!J111","v":"V"},{"$f":"Lite!X111","v":1},{"$f":"Lite!B111","v":"SL.91"},{"$f":"Lite!C111","v":"Is there a cloud audit program to address client audit and assessment requirements? If yes, describe."},{"$f":"Lite!D111","v":0},{"$f":"Lite!E111","v":0},{"$f":"Lite!F111","v":"V.3 Cloud Audit Program"},{"$f":"Lite!G111","v":"N/A"},{"$f":"Lite!H111","v":0},null,null,10.8]
[null,{"$f":"Lite!L112","v":16},{"$f":"Lite!J112","v":"V"},{"$f":"Lite!X112","v":1},{"$f":"Lite!B112","v":"SL.92"},{"$f":"Lite!C112","v":"Is an agile development methodology in operation?"},{"$f":"Lite!D112","v":0},{"$f":"Lite!E112","v":0},{"$f":"Lite!F112","v":"I.2 Secure Systems Development Lifecycle Code Reviews\nQ.5 Secure Code Review"},{"$f":"Lite!G112","v":12.5},{"$f":"Lite!H112","v":"Control Of Operational Software"},null,null,"N/A",null,null,"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3"]
[null,{"$f":"Lite!L113","v":16},{"$f":"Lite!J113","v":"V"},{"$f":"Lite!X113","v":1},{"$f":"Lite!B113","v":"SL.93"},{"$f":"Lite!C113","v":"Is there a formal process to ensure clients are notified prior to changes being made which may impact their service? If yes, describe."},{"$f":"Lite!D113","v":0},{"$f":"Lite!E113","v":0},{"$f":"Lite!F113","v":"G.21 Change Control"},{"$f":"Lite!G113","v":"12.1.2, 14.2.2"},{"$f":"Lite!H113","v":"Change Management, System change control procedures"},null,null,6.4,null,null,"WP.1.F.6, WP.1.E.3"]
[null,{"$f":"Lite!L114","v":16},{"$f":"Lite!J114","v":"V"},{"$f":"Lite!X114","v":1},{"$f":"Lite!B114","v":"SL.94"},{"$f":"Lite!C114","v":"Is there a scheduled maintenance window? If yes, what is the frequency?"},{"$f":"Lite!D114","v":0},{"$f":"Lite!E114","v":0},{"$f":"Lite!F114","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"Lite!G114","v":"12.1.2, 14.2.2"},{"$f":"Lite!H114","v":"Change Management, System change control procedures"},null,null,"11.3.1, 11.3.2",null,null,"WP.1.K.6, WP.1.K.7, WP.1.K.8"]
[null,{"$f":"Lite!L115","v":16},{"$f":"Lite!J115","v":"V"},{"$f":"Lite!X115","v":1},{"$f":"Lite!B115","v":"SL.95"},{"$f":"Lite!C115","v":"Is there a scheduled maintenance window which results in client downtime, If yes, what is the period of the downtime?"},{"$f":"Lite!D115","v":0},{"$f":"Lite!E115","v":0},{"$f":"Lite!F115","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"Lite!G115","v":"12.1.2, 14.2.2"},{"$f":"Lite!H115","v":"Change Management, System change control procedures"},null,null,"N/A",null,null,"WP.1.K.6, WP.1.K.7, WP.1.K.8"]
[null,{"$f":"Lite!L116","v":16},{"$f":"Lite!J116","v":"V"},{"$f":"Lite!X116","v":1},{"$f":"Lite!B116","v":"SL.96"},{"$f":"Lite!C116","v":"Is there an online incident response status portal which outlines planned and unplanned outages? If yes, how long after an unplanned outage is this updated?"},{"$f":"Lite!D116","v":0},{"$f":"Lite!E116","v":0},{"$f":"Lite!F116","v":"J.1 Information Security Incident Management\nP.8 Privacy Incident and Response Management"},{"$f":"Lite!G116","v":"12.1.2, 14.2.2"},{"$f":"Lite!H116","v":"Change Management, System change control procedures"},null,null,"N/A",null,null,"WP.1.F.6, WP.1.E.3"]
[null,{"$f":"Lite!L117","v":16},{"$f":"Lite!J117","v":"V"},{"$f":"Lite!X117","v":1},{"$f":"Lite!B117","v":"SL.97"},{"$f":"Lite!C117","v":"Is there a 24x7x365 staffed phone number available to clients to report security incidents?"},{"$f":"Lite!D117","v":0},{"$f":"Lite!E117","v":0},{"$f":"Lite!F117","v":"J.1 Information Security Incident Management\nP.8 Privacy Incident and Response Management"},{"$f":"Lite!G117","v":"12.1.2, 14.2.2"},{"$f":"Lite!H117","v":"Change Management, System change control procedures"},null,null,"N/A",null,null,"WP.1.E.3, WP.1.G.10"]
[null,{"$f":"Lite!L118","v":16},{"$f":"Lite!J118","v":"V"},{"$f":"Lite!X118","v":1},{"$f":"Lite!B118","v":"SL.98"},{"$f":"Lite!C118","v":"Are applications created and released into production? If yes, what is the release frequency?"},{"$f":"Lite!D118","v":0},{"$f":"Lite!E118","v":0},{"$f":"Lite!F118","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"Lite!G118","v":12.5},{"$f":"Lite!H118","v":"Control Of Operational Software"},null,null,"N/A",null,null,"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7"]
[null,{"$f":"Lite!L119","v":16},{"$f":"Lite!J119","v":"V"},{"$f":"Lite!X119","v":1},{"$f":"Lite!B119","v":"SL.99"},{"$f":"Lite!C119","v":"Is there an automated secure source code review? If yes, what is the frequency?"},{"$f":"Lite!D119","v":0},{"$f":"Lite!E119","v":0},{"$f":"Lite!F119","v":"I.2 Secure Systems Development Lifecycle Code Reviews\nQ.5 Secure Code Review"},{"$f":"Lite!G119","v":12.5},{"$f":"Lite!H119","v":"Control Of Operational Software"},null,null,"N/A",null,null,"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7"]
[null,{"$f":"Lite!L120","v":16},{"$f":"Lite!J120","v":"V"},{"$f":"Lite!X120","v":1},{"$f":"Lite!B120","v":"SL.100"},{"$f":"Lite!C120","v":"Is source code security reviewed manually? If yes, what is the frequency?"},{"$f":"Lite!D120","v":0},{"$f":"Lite!E120","v":0},{"$f":"Lite!F120","v":"I.2 Secure Systems Development Lifecycle Code Reviews\nQ.5 Secure Code Review"},{"$f":"Lite!G120","v":"12.2.1, 12.5"},{"$f":"Lite!H120","v":"Control against malware, Control Of Operational Software"},null,null,"N/A",null,null,"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7"]
[null,{"$f":"Lite!L121","v":16},{"$f":"Lite!J121","v":"V"},{"$f":"Lite!X121","v":1},{"$f":"Lite!B121","v":"SL.101"},{"$f":"Lite!C121","v":"Are automated penetration tests performed? If yes, what is the frequency?"},{"$f":"Lite!D121","v":0},{"$f":"Lite!E121","v":0},{"$f":"Lite!F121","v":"I.1 Application Vulnerability Assessments/Ethical Hacking"},{"$f":"Lite!G121","v":12.6},{"$f":"Lite!H121","v":"Technical vulnerability management"},null,null,11.3,null,null,"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7, WP.1.A.10"]
[null,{"$f":"Lite!L122","v":16},{"$f":"Lite!J122","v":"V"},{"$f":"Lite!X122","v":1},{"$f":"Lite!B122","v":"SL.102"},{"$f":"Lite!C122","v":"Are clients provided with the ability to specify where their data will be stored? If yes, describe at what level (e.g., data center, country)?"},{"$f":"Lite!D122","v":0},{"$f":"Lite!E122","v":0},{"$f":"Lite!F122","v":"P.6 Management of Client Target Privacy Data"},{"$f":"Lite!G122","v":"8.2.3, 11.1, 15.1.2"},{"$f":"Lite!H122","v":"Handling of assets,\nSecure areas,\nAddressing secuirty within supplier agreements"},null,null,"N/A",null,null,"WP.1.E.4, WP.1.G.2, WP.1.G.3"]
[null,{"$f":"Lite!L123","v":16},{"$f":"Lite!J123","v":"V"},{"$f":"Lite!X123","v":1},{"$f":"Lite!B123","v":"SL.103"},{"$f":"Lite!C123","v":"Does the ability exist to legally demonstrate sufficient data segmentation, in the event of a client subpoena or a forensics incident, so as not to impact other client's data? If using resource pooling? "},{"$f":"Lite!D123","v":0},{"$f":"Lite!E123","v":0},{"$f":"Lite!F123","v":"V.1 Service and Deployment Models"},{"$f":"Lite!G123","v":16.100000000000001},{"$f":"Lite!H123","v":"Management of information security incidents and improvements"},null,null,"N/A",null,null,"WP.1.L.2, WP.1.G.5"]
[null,{"$f":"Lite!L124","v":16},{"$f":"Lite!J124","v":"V"},{"$f":"Lite!X124","v":1},{"$f":"Lite!B124","v":"SL.104"},{"$f":"Lite!C124","v":"Is there a self-service portal or API call available to clients which provides the ability to place a \"Legal hold\" on client data which may be subject to a legal action, without impacting other clients data retention or destruction schedules?"},{"$f":"Lite!D124","v":0},{"$f":"Lite!E124","v":0},{"$f":"Lite!F124","v":"P.6 Management of Client Target Privacy Data"},{"$f":"Lite!G124","v":"8.2.3, 11.1, 15.1.2, 18.1.2"},{"$f":"Lite!H124","v":"Handling of assets,\nSecure areas,\nAddressing secuirty within supplier agreements, Intellectual property rights"},null,null,"N/A",null,null,"WP.1.K.4"]
[null,{"$f":"Lite!L125","v":16},{"$f":"Lite!J125","v":"V"},{"$f":"Lite!X125","v":1},{"$f":"Lite!B125","v":"SL.105"},{"$f":"Lite!C125","v":"Is a Cloud API available to clients?"},{"$f":"Lite!D125","v":0},{"$f":"Lite!E125","v":0},{"$f":"Lite!F125","v":"H.3 Logical Access Authorization"},{"$f":"Lite!G125","v":"N/A"},{"$f":"Lite!H125","v":0},null,null,"N/A"]
[null,{"$f":"Lite!L126","v":16},{"$f":"Lite!J126","v":"V"},{"$f":"Lite!X126","v":1},{"$f":"Lite!B126","v":"SL.106"},{"$f":"Lite!C126","v":"Is there a client management portal which allows distributed business accounts (business units/departments) to be managed under a single central corporate account?"},{"$f":"Lite!D126","v":0},{"$f":"Lite!E126","v":0},{"$f":"Lite!F126","v":0},{"$f":"Lite!G126","v":"12.1.2, 14.2.2"},{"$f":"Lite!H126","v":"Change Management, System change control procedures"},null,null,"N/A",null,null,"WP.1.J.1, WP.1.J.7, WP.1.A.3, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.H.6, WP.1.H.10"]
[null,{"$f":"Lite!L127","v":16},{"$f":"Lite!J127","v":"V"},{"$f":"Lite!X127","v":1},{"$f":"Lite!B127","v":"SL.107"},{"$f":"Lite!C127","v":"Are staff required to use two factor authentication to remotely access the production cloud environment containing Scoped Data?"},{"$f":"Lite!D127","v":0},{"$f":"Lite!E127","v":0},{"$f":"Lite!F127","v":"I.6 Application Security Vulnerability Assessments and Remediation"},{"$f":"Lite!G127","v":"9.3.1, 9.4.2, 9.4.3"},{"$f":"Lite!H127","v":"Use of secret authentication information, Secure log-on procedures, Password management system"},null,null,"N/A",null,null,"WP.1.H.6, WP.1.I.4, WP.1.I.7"]
[null,{"$f":"Lite!L128","v":16},{"$f":"Lite!J128","v":"V"},{"$f":"Lite!X128","v":1},{"$f":"Lite!B128","v":"SL.108"},{"$f":"Lite!C128","v":"Are staff able to access client Scoped Data in an unencrypted state?"},{"$f":"Lite!D128","v":0},{"$f":"Lite!E128","v":0},{"$f":"Lite!F128","v":"H.3 Logical Access Authorization"},{"$f":"Lite!G128","v":"9.4.1"},{"$f":"Lite!H128","v":"Information access restriction"},null,null,"N/A",null,null,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"]
[null,{"$f":"Lite!L129","v":16},{"$f":"Lite!J129","v":"V"},{"$f":"Lite!X129","v":1},{"$f":"Lite!B129","v":"SL.109"},{"$f":"Lite!C129","v":"Are staff able to access client's encryption key?"},{"$f":"Lite!D129","v":0},{"$f":"Lite!E129","v":0},{"$f":"Lite!F129","v":"H.3 Logical Access Authorization"},{"$f":"Lite!G129","v":"9.4.1"},{"$f":"Lite!H129","v":"Information access restriction"},null,null,"N/A",null,null,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"]
[null,{"$f":"Lite!L130","v":16},{"$f":"Lite!J130","v":"V"},{"$f":"Lite!X130","v":1},{"$f":"Lite!B130","v":"SL.110"},{"$f":"Lite!C130","v":"Is there a process which allows the client to specifically list who from the cloud provider, will have access to their Scoped Systems and Data? If yes, describe."},{"$f":"Lite!D130","v":0},{"$f":"Lite!E130","v":0},{"$f":"Lite!F130","v":"H.3 Logical Access Authorization"},{"$f":"Lite!G130","v":"9.1.1, 9.4.1"},{"$f":"Lite!H130","v":"\tAccess Control Policy\nInformation access restriction"},null,null,"N/A",null,null,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"]
[null,{"$f":"Lite!L131","v":16},{"$f":"Lite!J131","v":"V"},{"$f":"Lite!X131","v":1},{"$f":"Lite!B131","v":"SL.111"},{"$f":"Lite!C131","v":"Are staff technically prevented from accessing the cloud environment via non-managed private devices? "},{"$f":"Lite!D131","v":0},{"$f":"Lite!E131","v":0},{"$f":"Lite!F131","v":"H.3 Logical Access Authorization"},{"$f":"Lite!G131","v":"9.1.1, 9.4.1"},{"$f":"Lite!H131","v":"\tAccess Control Policy\nInformation access restriction"},null,null,"N/A",null,null,"WP.1.E.2, WP.1.H.6"]
[null,{"$f":"Lite!L132","v":16},{"$f":"Lite!J132","v":"V"},{"$f":"Lite!X132","v":1},{"$f":"Lite!B132","v":"SL.112"},{"$f":"Lite!C132","v":"Are there controls to prevent one client attempting to compromise another client in a resource pooled environment? If yes, describe."},{"$f":"Lite!D132","v":0},{"$f":"Lite!E132","v":0},{"$f":"Lite!F132","v":"H.3 Logical Access Authorization"},{"$f":"Lite!G132","v":"9.1.1, 9.4.1"},{"$f":"Lite!H132","v":"\tAccess Control Policy\nInformation access restriction"},null,null,7.1,null,null,"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2"]
[null,{"$f":"Lite!L133","v":16},{"$f":"Lite!J133","v":"V"},{"$f":"Lite!X133","v":1},{"$f":"Lite!B133","v":"SL.113"},{"$f":"Lite!C133","v":"Is a default hardened base virtual image available to clients?"},{"$f":"Lite!D133","v":0},{"$f":"Lite!E133","v":0},{"$f":"Lite!F133","v":"I.3 Secure Systems Hardening Standards"},{"$f":"Lite!G133","v":"N/A"},{"$f":"Lite!H133","v":0},null,null,"N/A",null,null,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"]
[null,{"$f":"Lite!L134","v":16},{"$f":"Lite!J134","v":"V"},{"$f":"Lite!X134","v":1},{"$f":"Lite!B134","v":"SL.114"},{"$f":"Lite!C134","v":"Can clients run their own security services within their own cloud environment? If yes, describe."},{"$f":"Lite!D134","v":0},{"$f":"Lite!E134","v":0},{"$f":"Lite!F134","v":"V.3 Cloud Audit Program"},{"$f":"Lite!G134","v":"8.2.3, 11.1, 15.1.2, 18.1.2"},{"$f":"Lite!H134","v":"Handling of assets,\nSecure areas,\nAddressing secuirty within supplier agreements, Intellectual property rights"},null,null,"5.1, 5.2",null,null,"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6"]
[null,{"$f":"Lite!L135","v":16},{"$f":"Lite!J135","v":"V"},{"$f":"Lite!X135","v":1},{"$f":"Lite!B135","v":"SL.115"},{"$f":"Lite!C135","v":"Is there a specific Recovery Time Objective(s) (RTO)? If yes, specify the RTO for the scoped services."},{"$f":"Lite!D135","v":0},{"$f":"Lite!E135","v":0},{"$f":"Lite!F135","v":"N/A"},{"$f":"Lite!G135","v":17.100000000000001},{"$f":"Lite!H135","v":"Information security continuity"},null,null,"N/A",null,null,"WP.1.K.10"]
[null,{"$f":"Lite!L136","v":16},{"$f":"Lite!J136","v":"V"},{"$f":"Lite!X136","v":1},{"$f":"Lite!B136","v":"SL.116"},{"$f":"Lite!C136","v":"Are the failover sites for the underlying infrastructure running on different vendor physical systems?"},{"$f":"Lite!D136","v":0},{"$f":"Lite!E136","v":0},{"$f":"Lite!F136","v":"N/A"},{"$f":"Lite!G136","v":17.100000000000001},{"$f":"Lite!H136","v":"Information security continuity"},null,null,"N/A",null,null,"WP.1.K.12"]
[null,{"$f":"Lite!L137","v":16},{"$f":"Lite!J137","v":"V"},{"$f":"Lite!X137","v":1},{"$f":"Lite!B137","v":"SL.117"},{"$f":"Lite!C137","v":"Is the critical infrastructure running active/active at two or more sites?"},{"$f":"Lite!D137","v":0},{"$f":"Lite!E137","v":0},{"$f":"Lite!F137","v":"N/A"},{"$f":"Lite!G137","v":17.100000000000001},{"$f":"Lite!H137","v":"Information security continuity"},null,null,"N/A",null,null,"WP.1.K.12"]
[null,{"$f":"Lite!L138","v":16},{"$f":"Lite!J138","v":"V"},{"$f":"Lite!X138","v":1},{"$f":"Lite!B138","v":"SL.118"},{"$f":"Lite!C138","v":"Are sites failed over as part of normal operation or as part of a test? If yes, what is the frequency?"},{"$f":"Lite!D138","v":0},{"$f":"Lite!E138","v":0},{"$f":"Lite!F138","v":"N/A"},{"$f":"Lite!G138","v":17.100000000000001},{"$f":"Lite!H138","v":"Information security continuity"},null,null,"N/A",null,null,"WP.1.K.11"]
[null,{"$f":"Lite!L139","v":16},{"$f":"Lite!J139","v":"V"},{"$f":"Lite!X139","v":1},{"$f":"Lite!B139","v":"SL.119"},{"$f":"Lite!C139","v":"Are all suppliers of critical hardware, network services and facility services involved in annual continuity and recovery tests?"},{"$f":"Lite!D139","v":0},{"$f":"Lite!E139","v":0},{"$f":"Lite!F139","v":"N/A"},{"$f":"Lite!G139","v":17.100000000000001},{"$f":"Lite!H139","v":"Information security continuity"},null,null,"N/A",null,null,"WP.1.K.11"]
[null,{"$f":"Lite!L140","v":16},{"$f":"Lite!J140","v":"V"},{"$f":"Lite!X140","v":1},{"$f":"Lite!B140","v":"SL.120"},{"$f":"Lite!C140","v":"Are all critical technology service providers described on an architecture diagram that includes physical systems and facilities?"},{"$f":"Lite!D140","v":0},{"$f":"Lite!E140","v":0},{"$f":"Lite!F140","v":"N/A"},{"$f":"Lite!G140","v":17.100000000000001},{"$f":"Lite!H140","v":"Information security continuity"},null,null,"N/A",null,null,"WP.1.E.1"]
[null,{"$f":"Lite!L141","v":16},{"$f":"Lite!J141","v":"V"},{"$f":"Lite!X141","v":1},{"$f":"Lite!B141","v":"SL.121"},{"$f":"Lite!C141","v":"Is there sufficient redundancy capacity to ensure services are not impacted in multi-tenancy environments during peak usage and above?"},{"$f":"Lite!D141","v":0},{"$f":"Lite!E141","v":0},{"$f":"Lite!F141","v":"N/A"},{"$f":"Lite!G141","v":17.2},{"$f":"Lite!H141","v":"Redundancies"},null,null,"N/A"]
[null,{"$f":"Lite!L142","v":16},{"$f":"Lite!J142","v":"V"},{"$f":"Lite!X142","v":1},{"$f":"Lite!B142","v":"SL.122"},{"$f":"Lite!C142","v":"Do contracts include a penalty or remediation clause for breach of availability and continuity SLAs? "},{"$f":"Lite!D142","v":0},{"$f":"Lite!E142","v":0},{"$f":"Lite!F142","v":"N/A"},{"$f":"Lite!G142","v":"15.1.2, 15.2.1"},{"$f":"Lite!H142","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,"N/A"]
[null,{"$f":"Lite!L143","v":16},{"$f":"Lite!J143","v":"V"},{"$f":"Lite!X143","v":1},{"$f":"Lite!B143","v":"SL.123"},{"$f":"Lite!C143","v":"Is a Hypervisor used to manage systems used to transmit, process or store Scoped Data? If yes, describe the controls used to protect the hypervisor and the managed Guest Operating Systems."},{"$f":"Lite!D143","v":"No"},{"$f":"Lite!E143","v":0},{"$f":"Lite!F143","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"Lite!G143","v":"N/A"},{"$f":"Lite!H143","v":0},null,null,"N/A",null,null,"WP.1.D.1"]
[null,{"$f":"Lite!L144","v":0},{"$f":"Lite!J144","v":0},{"$f":"Lite!X144","v":0},{"$f":"Lite!B144","v":0},{"$f":"Lite!C144","v":0},{"$f":"Lite!D144","v":0},{"$f":"Lite!E144","v":0},{"$f":"Lite!F144","v":0},{"$f":"Lite!G144","v":0},{"$f":"Lite!H144","v":0}]

{"sheet":"Drops","index":27,"n_rows":8,"n_cols":3,"rows_kept":8,"cut":false,"hidden":true,"merged":[]}
["Binary","Scaled","RespType"]
["Yes","N/A","Binary"]
["No",0,"Scaled"]
["N/A",1]
[null,2]
[null,3]
[null,4]
[null,5]