Browse common SIG review topics and the security practices each question is designed to address.
About these answers. Most entries explain common industry practices, not Klistalabs-test controls. SIG entries marked “Company response” use approved Klistalabs-test wording supplied for this site.
A SIG response describes security governance, accountable roles, reporting lines, policy oversight, and risk oversight. It identifies the organizational, service, or system boundaries to which those practices apply.
A SIG policy and governance response explains the relevant policies, their owners and approval processes, how they are communicated and reviewed, and how compliance is overseen. It states whether each policy applies organization-wide or to specified services, functions, or systems.
A SIG risk management response explains how risks are identified, assessed for likelihood and impact, recorded, assigned to owners, and treated through mitigation, transfer, or acceptance. It also describes how treatment decisions are approved, monitored, and reviewed.
A SIG compliance response identifies the applicable laws, regulations, contractual obligations, and jurisdictions, along with the services and activities in scope. It distinguishes requirements that have been assessed or attested from those outside the stated scope and describes relevant evidence or exceptions.
A SIG personnel security response describes screening where applicable, onboarding, role-based security responsibilities, awareness training, conduct and disciplinary processes, and offboarding. It notes distinctions based on role, location, or employment relationship when they affect the controls.
A SIG physical security response describes how access to relevant facilities and equipment is authorized and monitored, how visitors are handled, and how environmental hazards are addressed. It clarifies the division of responsibility for infrastructure operated by the organization and by service providers.
A SIG asset management response explains how technology and information assets are inventoried, assigned owners, classified, and protected through acquisition, use, maintenance, and secure disposal. It identifies the asset types and systems within scope.
A SIG access control response describes how identities are provisioned, authorized for specific systems and data, and updated or removed when roles change. It covers least privilege, privileged-access safeguards, access reviews, and the approval and tracking of exceptions.
A SIG authentication response explains how the identity of users, devices, or services is verified, which authentication methods protect different types of access, and where multi-factor authentication is used. It also addresses account recovery and safeguards for sensitive access.
A SIG operations security response describes the procedures and controls used to operate systems securely, including job scheduling, capacity management, malware defenses, logging, and operational changes. It identifies the teams and providers responsible for these activities.
A SIG vulnerability management response explains how weaknesses are identified through testing, scanning, and security advisories; assessed and prioritized by risk; assigned to owners; and tracked through remediation. It also describes how exceptions and unresolved vulnerabilities are documented and reviewed.
A SIG change management response describes how proposed changes are documented, assessed for risk, approved, tested, and controlled through release. It explains rollback planning and the approval and review process for urgent changes.
A SIG continuity and recovery response identifies critical services and dependencies, and explains the plans and capabilities for maintaining or restoring them during disruption. It states the scope of continuity and disaster recovery plans, exercise practices, recovery objectives, and known limitations.
A SIG incident management response explains how security events are detected, reported, classified, investigated, escalated, and contained, and identifies response roles and communication processes. It also covers recovery, evidence handling, and post-incident review and corrective actions.
A SIG logging and monitoring response identifies the systems and events recorded, how logs and other signals are monitored, and how alerts are reviewed and escalated. It also describes access controls, retention, and protections for log integrity.
A SIG network security response describes network segmentation, boundary protections, administrative access controls, monitoring, and change controls relevant to the service. It clarifies how network responsibilities and protections map to the service architecture and any infrastructure providers.
A SIG encryption response identifies which data is encrypted at rest and in transit, the systems and services covered, and the cryptographic standards in use. It also explains how encryption keys are generated, stored, accessed, rotated, and retired.
A SIG data protection response describes information classification, access restrictions, permitted handling, retention and deletion, and protections during transfer. It also explains how applicable customer or data subject requests are handled and identifies the data and services in scope.
A SIG third-party risk response explains how relevant vendors and service providers are identified and assessed before engagement, how security and privacy expectations are established contractually, and how provider risks and changes are monitored. It also describes reassessment and termination or transition planning.
A reviewable SIG response answers each control question directly, describes the relevant practice and evidence, and identifies the services, systems, and responsibilities in scope. It distinguishes verified facts from controls that do not apply, notes material exceptions, and avoids claims beyond the available evidence.
Yes. The organization maintains a documented risk management framework that defines requirements for identifying, assessing, treating, monitoring, and reporting enterprise and information security risks. The framework is reviewed periodically and approved by appropriate management.
Yes. Certain IT and security functions may be supported by qualified third-party service providers, including cloud infrastructure, security monitoring, and business applications. Third parties are subject to risk assessment, contractual security requirements, and ongoing oversight.
Yes. Media containing sensitive or customer data is securely sanitized or destroyed using methods appropriate to the media type and aligned with recognized industry practices. Disposal activities are managed to prevent unauthorized recovery of data.
Yes. Encryption keys are generated, stored, accessed, rotated, and retired using industry-standard cryptographic and key-management practices. Access to encryption keys is restricted to authorized systems and personnel.
Yes. Access granted to vendors and other third parties is limited based on business need and least-privilege principles. User and privileged access is periodically reviewed, and access is removed when no longer required.
The organization maintains account protection controls designed to mitigate brute-force and unauthorized login attempts. Depending on the system, controls may include account lockout, rate limiting, progressive delays, MFA, and automated threat detection rather than a fixed five-attempt threshold.
Yes. Responsibility for application security is assigned to designated security and engineering personnel. Application security activities include secure development practices, code review, vulnerability management, dependency monitoring, and security testing.
Yes. The organization maintains documented business continuity and disaster recovery procedures. Recovery capabilities are tested periodically, and identified issues or improvement opportunities are tracked through remediation.
Yes. The organization maintains web-based services used to provide information about and/or deliver its products and services. Production systems are subject to applicable security, privacy, access-control, and monitoring requirements.
Yes. Network and cloud security controls are used to restrict unauthorized communications and enforce logical separation between systems and environments. Controls may include firewalls, security groups, access control policies, network segmentation, and monitoring technologies.
Where applicable, environmental and sustainability responsibilities are overseen by organizational leadership and incorporated into relevant corporate policies and operational practices. Formal board-level oversight depends on the organization's size, regulatory requirements, and environmental risk profile.
No. As a primarily software- and technology-based organization, the company does not conduct industrial or manufacturing activities that result in material direct discharges to air.
The organization considers appropriate experience, qualifications, backgrounds, and perspectives when establishing its leadership and governance structure. Formal board diversity reporting is performed where required by applicable law, regulation, or corporate governance requirements.
Where required to provide the service, limited personal information may be collected or processed on behalf of customers. Such information is handled in accordance with contractual obligations, applicable privacy laws, and the organization's privacy and security policies.
Yes, where applicable. Privacy notices describe how personal information is collected, used, disclosed, and shared. The organization does not sell personal information unless explicitly disclosed and permitted under applicable law.
Yes. Authorized subprocessors and service providers may process customer data where necessary to deliver the service. Such providers are subject to security and privacy due diligence, contractual requirements, and appropriate confidentiality and data-protection obligations.
Remote access is restricted to authorized users and protected through strong authentication and access-control measures, including MFA where supported. Access is granted based on business need and least privilege. The organization does not necessarily restrict remote access to predefined hours or physical locations where equivalent risk-based security controls are in place.
Yes. Asset management processes are designed to identify and track applicable company-managed devices with network connectivity. Where IoT devices are used, they are included within the relevant inventory and security management processes.
Yes, where applicable. The organization's services are delivered using cloud infrastructure provided by established cloud service providers. The organization is responsible for securing its applications, configurations, identities, and data within the applicable shared-responsibility model.
Responsibility depends on the hosting model. For managed cloud services, the cloud provider maintains the underlying infrastructure and managed platform components. Where the organization manages guest operating systems or compute instances, the organization is responsible for applicable operating system patching under the shared-responsibility model.