diff --git a/controls/personnel/access/PER.ACC.001_mfa_on_critical_services.md b/controls/personnel/access/PER.ACC.001_mfa_on_critical_services.md new file mode 100644 index 000000000..d84b9f28c --- /dev/null +++ b/controls/personnel/access/PER.ACC.001_mfa_on_critical_services.md @@ -0,0 +1,45 @@ +--- +id: "PER.ACC.001" +category: "personnel/access" +revision-version: 1 +revision-date: "2024-01-14" +estimate-time: "1h" +necessity: "mandatory" +frameworks: + - name: "soc2" + sections: ["CC6.1", "CC6.8"] +--- + +# Enable 2FA on critical services + +## Purpose + +In order to minimize the threat of someone getting access to something they +should not, we follow the **secure principle:** nobody can easily get access to +data/systems. + +We need to ensure that if someone has access to your password, they still cannot +log into your account. Multi-Factor Authentication (MFA) adds extra layers of +security by requiring users to provide additional authentication factors beyond +their passwords. The most standard solution is 2FA: your password + something +else. + +## Implementation + +Enable 2FA across all your systems. If you don’t want to activate it everywhere, +prioritize: + +- System containing sensitive data +- System related to your network, infrastructure or production. + +At least, you need it for the following: + +- Cloud provider (GCP, AWS etc.) +- Code hosting (Github, Gitlab etc.) +- Email/SSO (Google, Microsoft etc.) + +## Evidence + +- Screenshot of your 2FA settings in Cloud provider. +- Screenshot of your 2FA settings in Code hosting. +- Screenshot of your 2FA settings in Email/SSO. diff --git a/controls/personnel/access/PER.ACC.002_access_request_process.md b/controls/personnel/access/PER.ACC.002_access_request_process.md new file mode 100644 index 000000000..0f1a538f0 --- /dev/null +++ b/controls/personnel/access/PER.ACC.002_access_request_process.md @@ -0,0 +1,40 @@ +--- +id: "PER.ACC.002" +category: "personnel/access" +revision-version: 1 +revision-date: "2024-01-14" +estimate-time: "15m" +necessity: "mandatory" +frameworks: + - name: "soc2" + sections: ["CC6.2", "CC6.3"] +--- + +# Access Request Process + +## Purpose + +In order to minimize the threat of someone getting access to something they +should not, we follow the continuous update principle: making sure the +privileges are up to date. We need to setup a proper process to define how we +grant and revoke access to different systems. + +## Implementation + +We will formalize your access granting and revocation policy later, for that, we +need you to implement the fitting process for you. + +1. Setup an easy process to update the access outside of onboarding and + offboarding: + 1. Define who in your leadership team should be the person granting access. + It usually would be someone from HR or IT + 2. Go to Slack and create an `access-request` channel + 3. Ensure any access request goes through this slack channel so you can + provide screenshots of those requests. + +> Pro tip: Setup an alias to @access-admin that pings the right person in charge +> to reduce notification noise + +## Evidence + +- Screenshot of the slack channel with some actions on it. diff --git a/controls/personnel/access/PER.ACC.003_password_manager.md b/controls/personnel/access/PER.ACC.003_password_manager.md new file mode 100644 index 000000000..9ecd6e44f --- /dev/null +++ b/controls/personnel/access/PER.ACC.003_password_manager.md @@ -0,0 +1,53 @@ +--- +id: "PER.ACC.003" +category: "personnel/access" +revision-version: 1 +revision-date: "2024-01-14" +estimate-time: "15m" +necessity: "mandatory" +frameworks: + - name: "soc2" + sections: ["CC6.1", "CC6.8"] +--- + +# Setup a password manager + +## Purpose + +In order to minimize the threat of someone getting access to something they +should not, we want to ensure a few things: + +1. The password used in your company are complex enough +2. They are stored encrypted +3. They are shared safely when needed (not openly, on slack or by text) +4. They are not compromised + +The easiest way to implement those is to use a password manager. + +## Implementation + +### Choose your provider + +There are a few options on the market regarding password manager. We will guide +you through [1password](https://1password.com/) setup. + +You can also use [Dashlane](https://www.dashlane.com/) or a free open source +solution such as https://github.com/passbolt/passbolt_api. + +### Confirm the policy you want + +The main thing you need to decide on is the complexity of password you require. +Below, you will find a suggestion of something you can implement in 1password. + + + +> If you change from this suggestion, please edit the suggestion - this rule +> will be added to a policy later. diff --git a/controls/personnel/access/PER.ACC.004_role_based_access_control.md b/controls/personnel/access/PER.ACC.004_role_based_access_control.md new file mode 100644 index 000000000..6736d103d --- /dev/null +++ b/controls/personnel/access/PER.ACC.004_role_based_access_control.md @@ -0,0 +1,43 @@ +--- +id: "PER.ACC.004" +category: "personnel/access" +revision-version: 1 +revision-date: "2024-01-14" +estimate-time: "30m" +necessity: "mandatory" +frameworks: + - name: "soc2" + sections: ["CC6.8", "CC7.2"] +--- + +# Setup Role Based Access Control (RBAC) + +## Purpose + +In order to minimize the threat of someone getting access to something they +should not, we follow the least privilege principle: access is limited to what's +necessary for job duties. We need to define which function should have access to +which tool in your company to serve as a reference when providing access to +people (password manager vaults etc.). + +## Implementation + +Define who should have access to what in a role-based matrix in the template +below: + +1. Edit and add columns for the main tool categories you are using +2. Edit and add lines for the different functions / teams in your organization +3. Edit and add ticks `x` in the right box for access +4. In the last line, make sure to fill the right admin team + +| **Role** | **Email** | **Google Workspace** | **Expense Tool** | **CRM** | **App** | **Infrastructure** | **Version Control** | **Build System** | **Vuln Scanner** | +| ------------- | --------- | -------------------- | ---------------- | ---------- | ------------ | ------------------ | ------------------- | ---------------- | ---------------- | +| **Everyone** | x | x | x | | x | | | | | +| **Engineers** | x | x | x | | x | x | x | x | x | +| **Sales** | x | x | x | x | x | | | | | +| | | | | | | | | | | +| **Admin** | HR | HR | Finance | Sales lead | Product lead | Eng lead | Eng lead | Eng lead | Eng lead | + +## Evidence + +- Provide the link to the matrix you implemented on your side diff --git a/controls/personnel/access/PER.ACC.005_enforce_single_sign_on.md b/controls/personnel/access/PER.ACC.005_enforce_single_sign_on.md new file mode 100644 index 000000000..c1911aeb5 --- /dev/null +++ b/controls/personnel/access/PER.ACC.005_enforce_single_sign_on.md @@ -0,0 +1,45 @@ +--- +id: "PER.ACC.005" +category: "personnel/access" +revision-version: 1 +revision-date: "2024-01-14" +estimate-time: "30m" +necessity: "mandatory" +frameworks: + - name: "soc2" + sections: ["CC6.8", "CC7.2"] +--- + +# Enforce SSO when possible + +## Purpose + +To minimize the risk of unauthorized access, it's important to centralize and +secure authentication across your organization. Single Sign-On (SSO) enhances +security by enabling better control over account access, enforcing consistent +security policies (e.g., 2FA), and making it easier to revoke access when +someone leaves the organization. + +## Implementation + +## Google Workspace + +1. Log in to the [Google Admin Console](https://admin.google.com/) with an admin + account. +2. Go to **Apps** > **Web and Mobile Apps** > **Add App** > **Add Custom SAML + App**. +3. Name the app and upload a logo (optional). +4. **Generate SSO details**: + - Google provides the **SSO URL**, **Entity ID**, and **Certificate** for the + app. +5. **Configure the Third-Party App**: + - In the app’s admin console, input the **SSO URL**, **Entity ID**, and + upload the **Certificate**. +6. Return to Google Admin Console and configure attribute mapping (e.g., email, + first name). +7. Test the connection, enable the app, and assign it to users or groups. + +## Evidence + +- Screenshot of SSO activation for Google Workplace + your cloud + provider + code hosting tool diff --git a/controls/personnel/comms/PER.COM.004.email_filtering_and_warning_system.md b/controls/personnel/comms/PER.COM.004.email_filtering_and_warning_system.md index 590d1ee25..072e00d5a 100644 --- a/controls/personnel/comms/PER.COM.004.email_filtering_and_warning_system.md +++ b/controls/personnel/comms/PER.COM.004.email_filtering_and_warning_system.md @@ -10,7 +10,7 @@ frameworks: sections: ["CC6.8", "CC7.2"] --- -# Configure Email Security Filters +# Configure Email Security Filters ## Purpose diff --git a/controls/physical/facilities/PHY.FAC.002_physical_access_control.md b/controls/physical/facilities/PHY.FAC.002_physical_access_control.md index 4214fc687..f995ce418 100644 --- a/controls/physical/facilities/PHY.FAC.002_physical_access_control.md +++ b/controls/physical/facilities/PHY.FAC.002_physical_access_control.md @@ -20,10 +20,9 @@ secured (we will focus on the digital access later). ## Implementation -If you are working from a co-working space or subleasing offices, you -don’t have much do to. Provide a link to their access policy and the -dashboard they probably provide to manage the list of authorized -personnel. +If you are working from a co-working space or subleasing offices, you don’t have +much do to. Provide a link to their access policy and the dashboard they +probably provide to manage the list of authorized personnel. If you have your own office space, you need to provide: diff --git a/controls/physical/facilities/PHY.FAC.003_visitor_access_policy.md b/controls/physical/facilities/PHY.FAC.003_visitor_access_policy.md index 5a75d7cea..0b64a54de 100644 --- a/controls/physical/facilities/PHY.FAC.003_visitor_access_policy.md +++ b/controls/physical/facilities/PHY.FAC.003_visitor_access_policy.md @@ -14,10 +14,9 @@ frameworks: ## Purpose -Even if you do most of your business online, you still have offices, -computers or even printed document: you need to make sure those assets -are physically secured (we will focus on the digital access later) -regarding visitors. +Even if you do most of your business online, you still have offices, computers +or even printed document: you need to make sure those assets are physically +secured (we will focus on the digital access later) regarding visitors. ## Implementation diff --git a/controls/physical/facilities/PHY.FAC.004_virtual_private_network.md b/controls/physical/facilities/PHY.FAC.004_virtual_private_network.md index a5ff0260a..2a515542f 100644 --- a/controls/physical/facilities/PHY.FAC.004_virtual_private_network.md +++ b/controls/physical/facilities/PHY.FAC.004_virtual_private_network.md @@ -15,24 +15,21 @@ frameworks: ## Purpose In short, implementing a VPN will encrypt your data and ensure a safe -transmission between your employees devices and your internal network -(even when using untrusted networks like a public wifi) ⇒ it offers a -layer of security for your data. +transmission between your employees devices and your internal network (even when +using untrusted networks like a public wifi) ⇒ it offers a layer of security for +your data. ## Implementation -> If you have doubt whether you should do it or not, ping us on -> Discord. -
-> If everything is on Google Suite/Notion/Slack with MFA and you don’t -> have your own network => no needed. - -If you think you need one, you should consider deploying one and make -it mandatory when working remote => You can follow the [Wireguard -installation guide there](https://www.wireguard.com/install/). +> If you have doubt whether you should do it or not, ping us on Discord.
+> If everything is on Google Suite/Notion/Slack with MFA and you don’t have your +> own network => no needed. +If you think you need one, you should consider deploying one and make it +mandatory when working remote => You can follow the +[Wireguard installation guide there](https://www.wireguard.com/install/). ## Evidence -- Screenshot of VPN settings page (to show active use) or log of VPN - connection from employees device. +- Screenshot of VPN settings page (to show active use) or log of VPN connection + from employees device. diff --git a/controls/physical/hardware/PHY.HW.003_device_encryption.md b/controls/physical/hardware/PHY.HW.003_device_encryption.md index 02e577ad6..061680465 100644 --- a/controls/physical/hardware/PHY.HW.003_device_encryption.md +++ b/controls/physical/hardware/PHY.HW.003_device_encryption.md @@ -14,9 +14,9 @@ frameworks: ## Purpose -Ensure all employee devices have disk encryption and firewall -protection enabled to secure data at rest and protect network -communications from unauthorized access. +Ensure all employee devices have disk encryption and firewall protection enabled +to secure data at rest and protect network communications from unauthorized +access. ## Implementation