Do you have a formal information security policy?

Is there a documented process for the evaluation and maintenance of all security-related policies?

Do internal auditors audit your security and privacy program at least annually?

Do external auditors audit your security and privacy program at least annually?

Do you have a formal information security awareness training program?

Are the policies communicated in a way that requires employees to certify their understanding and compliance before access is granted and at least annually?

Are procedures employed to ensure compliance with privacy laws/regulation requirements related to maintaining security, confidentiality, and protection of customer data?

Do you have a formal Systems Development Lifecycle (SDLC)?

Do you identify security requirements in your SDLC?

Do you perform code reviews as part of your SDLC?

Are system build and baseline standards formally documented?

Are proprietary encryption algorithms used for the encryption of data?

Are controls in place to protect cryptographic keys against unauthorized disclosure, modification, loss, and destruction?

Is there a process for generating, securing, and destroying master keys?

Are public key certificates used by the organization issued from a recognized and trusted certificate authority (CA)?

Are development, test, and operational facilities logically or physically separated?

Do programmers have access to production, allowing bypass of change control procedures?

If internally developed applications (including web or mobile applications) are used for client services, are there processes in place to control, monitor, and log developers’ access and changes to the production environment?

Are all changes authorized and tested as part of a formal change management process?

Is access to source code for applications used to support client services restricted to authorized personnel?

Does the application display an appropriate warning message regarding acceptable use upon user logon?

If penetration tests are completed annually, do you remediate all issues with a CVSS Score>=7.0 or equivalent within 90 days of discovery?

If internally developed applications are used for client services, does each phase of the system development life cycle include security requirements?

If internally developed applications are used for client services, are secure coding practices and secure coding training (e.g., OWASP, CERT) for all developers in place and applied as part of the systems development lifecycle process?

If internally developed applications (including web or mobile applications) are used for client services, are application vulnerability assessments performed as part of the documented system development lifecycle?

Are authentication credentials or sensitive data stored within code?

Is sensitive data masked when viewing through the user interface?

If cookies are used with web applications, do they contain sensitive data and an expiration period?

Is logging enabled on the database?

Does your organization prohibit the use of production data in development and test environments?

Do you maintain a list of sensitive data types that the application is expected to process?

D you maintain an up-to-date diagram that indicates how sensitive data reaches your systems and where the sensitive data is stored?

Do you have policies and procedures documented to control, prevent, detect, and remove malicious code?

Do you use frameworks, template languages, or libraries that systemically address implementation weaknesses by escaping the outputs and sanitizing the inputs. Examples include ORM for database access and UI framework for rendering DOM.

Are service accounts prohibited for end users to utilize?

Are passwords masked when entered?

Is there a formal change or project management program used for application architecture changes or enhancements?

Is logging enabled on the application?

Are Strict-Transport-Security header with the include Subdomains directive required on all web pages?

Do you set a minimally-permissive Content Security Policy that uses mechanisms such as nonces or hashes?

Do you have access control policies documented?

Have procedures been defined to ensure that all areas of the organization have implemented an adequate level of segregation of duties?

Are privileged use activities monitored on a regular basis?

Are user rights reviewed quarterly?

Is there an adequate separation of duties between those who review access rights and those who grant access to systems?

Does your organization perform background checks/screening on employees that include criminal, credit, professional/academic, and references on all full-time applicants and contractors prior to hiring?

Are all systems and applications able to enforce password construction requirements?

Are default accounts renamed, disabled or deleted?

Do you verify a users identity for password resets?

Do you have a documented password policy?

Is single sign-on implemented for your internal applications?

Do you require two factor authentication for remote access connections?

Are users assigned unique credentials?

Do you have a policy and procedure documented for the review of user access rights?

Do enhanced access controls for application account administrators exist?

Is access to business systems granted on a need-to-know basis?

Are unused login IDs deactivated or deleted?

Do you have policies and procedures for new user registration documented?

Are temporary passwords communicated to users in a secure manner?

Do you have mobile computing policies and procedures documented?

Do you have a formal and documented mobile device policy and utilize a Mobile Device Management (MDM) solution?

Do you have documented remote access policies and procedures?

Do you have a formal security incident reporting process?

Do you have policies and procedures for reporting security events to clients within 24 hours?

Do you have a formal asset management policy and procedure?

Do you have a formal process for the removal of property such as production hardware, software, backup tapes, etc. that includes removal of sensitive data?

Do you have documented procedures for termination including procedures for the return of assets and access removal?

Are physical and logical security policies and procedures formally documented?

Do you address security requirements in 3rd party agreements?

Is a formal property pass system in place?

Is access to password storage files secured and controlled?

Are secure channels used for remote management of the application and supporting systems? (i.e. HTTPS, SSH)

If any applications are designed to run on top of unencrypted connections, such as OCSP, do you redirect traffic from the HTTP protocol (port 80) to HTTPS (port 443)?

Are 3rd party couriers bonded?

Are perimeter security controls are implemented?

Is traffic restricted between the various security Zones?

Do you have specific policies and procedures for wireless communications and wireless networks?

Do you have policies that define, document, and implement security measures covering privacy and protection of Personally Identifiable Information (“PII”) to comply with the relevant legislation and regulation.

Do you maintain logs for all access to APR data?

Do you utilize industry standard best practices for email communications, including the following controls: SPF, DKIM, DMARC, and TLS 1.0 or later with cipher suites supporting forward secrecy, such as ECDHE?

Are the controls in place to protect critical, Internet-facing applications (and related infrastructure) against Denial of Service (DoS) or Distributed Denial of Service (DDoS) attacks tested annually?

Are management, Intrusion Detection System (IDS), and other out-of-band networks segregated and secured from other critical network segments?

Are intrusion detection system devices deployed to monitor critical network segments?

Do you configure servers in accordance with an established security standard?

If wireless technologies are used, are strong industry standard encryption controls in place?

Are audit logs archived for at least one year?

Are system and network logs reviewed on a regular basis?

Have network intrusion detection systems (NIDS) been deployed to monitor critical subnets?

Has host-based intrusion detection system (HIDS) software been deployed on all critical systems?

Is logging enabled on the OS, Event Viewer, etc.?

Do event logs capture key operational events?

Do you have policies and procedures for the monitoring of system event and audit logging documented?

Do you have technical controls in place to address anti-virus, malicious code, spyware, etc.?

Has application software been maintained at current release levels and patched in a timely manner?

Do you have a process for determining Non-Permitted Technology (software and hardware, based on End-of-Life technologies that are unsupported by the original provider, with known unpatched vulnerabilities) and a clear migration path to remove those technologies?

Do policies cover: key generation, key distribution, key storage, updating keys, revoking keys, recovering keys, destroying keys, and archiving keys?

Does your application allow concurrent user sessions?

Is encryption leveraged to protect sensitive data at rest in: databases, hard disks, and removable media?

Are all authentication credentials encrypted during transmission and protected in a one-way hash in storage?

Is multi-factor authentication required to access restricted information?

Are there any instances where an employee would share an account?

Are desktops and laptops required to be encrypted (please indicate what technology or software is used)

Do you have a comprehensive and documented vulnerability scanning program covering all relevant implementation layers, such as client machines, platform, infrastructure including networking devices, OS, and application server. And perform authenticated vulnerability scans at least every 90 days?

Do you define, document, implement and maintain mechanisms to protect equipment when unattended, e.g. through using device locks and password protected screen locks?

Does your organization have policies and procedures for systems patch management documented?

Are routine self-assessments performed to ensure compliance with the physical and logical hosting controls in this schedule?

Are physical security controls are implemented to prevent unauthorized access to restricted areas? (i.e. key locks, biometrics, key pad, unique electronic badges, sign in-sign out, escorts, etc.)

Is access to the data center, computer room/server rooms secured via multi-factor authentication?

Are restricted areas monitored?

Can sensitive information be viewed from non-restricted areas?

Are security guards available 7x24x365 to your hosting facility?

Is the list of persons with access to sensitive areas where client data is stored, transmitted, or processed, reviewed regularly or when there are changes to personnel?

Are logs from the physical access control process periodically reviewed for unusual activity (e.g., multiple unsuccessful access attempts)?

Are malware containment and resolution procedures defined and do they include the isolation of infected systems where deemed appropriate?

Are all applications, host and network-based events collected into a Security Information and Event Management System and monitored by a Security Operations Center in real time 24X7X365?

Are security alerts sent to a centralized location?

Do you conduct third-party security reviews at least annually using a common industry standard, such as ISO 27001?

Are only inbound ports that have a business need configured on perimeter firewalls?

Are firewalls and firewall rule sets been configured to enforce a "default deny" policy?

Are rules on firewalls validated at least semi-annually?

Do you have a process for maintaining network device firmware and software are maintained at a level supported by the supplier (e.g., old version, un-patched, etc.)?

Have routers, switches, and other network devices been hardened by removing or disabling any unnecessary services?

Are available operating system security patches installed within required time frames (software patches are applied in a timely fashion to help remove or reduce security weaknesses)?

Are malicious code protection mechanisms in place and up-to-date?

Are webservers isolated or segregated on the network?

Are webservers in dedicated DMZs?

Do you have configuration monitoring on all critical systems?

Has file level security been enabled on critical / production systems?

Are any additional ports besides TCP port 80 and TCP port 443 (SSL) opened for internet-facing servers?

Is data encrypted between all internal and external servers?

Does the application session terminate securely upon logoff and after a predetermined period of inactivity?

Are there trained staff with knowledge, processes, and tools to handle a forensic digital investigation available (internally or from a 3rd party as needed)?

Do you have a formal information system audit process or policy?

Do you have a documented acceptable use policy?

Are users provided documented rules that describe responsibilities, acceptable use, and expected behavior prior to receiving access to information and information systems?

Do you have a documented policy regarding the use of unauthorized software?

Has a comprehensive set of written information security policies, approved by management, published, and communicated to all employees, contractors and relevant external parties been put in place?

Are default vendor passwords changed following installation of systems or software?

Does your organization have a formal information classification scheme defined and documented?

Are information labeling and handling policies defined?

Do you have a BCP or DR plan formally documented?

Does the business continuity program encompass all activities related to products, services, and locations used to service the Customer relationship?

Are backups taken of all systems and data that are used for the services supplied to APR?

Is the Business Continuity Plan (BCP) for the application tested at least annually to validate its effectiveness?

Have you had a successful data restoration within the last year?

Are encrypted backups stored offsite or with a 3rd party vendor?

Does your organization’s formal risk assessment program identify internal and external risks to the confidentiality, integrity and availability of customer data processed or stored by your organization, regardless of the media?