{"text_format":"1","workbook":"xlsx","n_sheets":29,"sheets":["Copyright","Terms of Use","Instructions","Dashboard","Business Information","Documentation","Lite","A. Risk Management","B. Security Policy","C. Organizational Security","D. Asset Management","E. Human Resource Security","F. Physical and Environmental","G. Communications and Ops Mgmt","H. Access Control","I. Info Sys AD&M","J. Incident Event & Comm Mgmt","K. Business Resiliency","L. Compliance","M. Mobile","P. Privacy","Q. Software Security","V. Cloud Security","Z. Additional Questions","Glossary","Formula Notes","Full","Full Lite","Drops"],"not_rendered":{"charts":0,"images":1,"macros":1,"external_links":0,"defined_names":87,"comments":2,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Copyright","index":0,"n_rows":12,"n_cols":2,"rows_kept":12,"cut":false,"hidden":true,"merged":[]}
[]
[null,"Copyright "]
[]
[null,"© 2015 Shared Assessments"]
[]
[null,"Documents created under the Shared Assessments Program may be downloaded from the official Shared Assessments Program website at www.sharedassessments.org."]
[]
[null,"While retaining copyrights, the Shared Assessments Program makes specific documents available to members and purchasers for the purpose of conducting self-assessments and third party security assessments. Licenses for other uses are available from Shared Assessments. Individuals and organizations should review the terms of use prior to downloading, copying, using or modifying Shared Assessment Program documents."]
[]
[null,"This notice must be included on any copy of the Shared Assessments Program documents, excluding assessors or consultants' reports."]
[]
[null,"The Shared Assessments Program is administered by The Santa Fe Group (www.santa-fe-group.com). Questions about this document and the program should be directed to info@sharedassessments.org. "]

{"sheet":"Terms of Use","index":1,"n_rows":16,"n_cols":2,"rows_kept":16,"cut":false,"hidden":true,"merged":[]}
[]
[null,"Terms of Use"]
[null,"2016 SHARED ASSESSMENTS STANDARDIZED INFORMATION GATHERING (SIG) QUESTIONNAIRE (2016 SIG)"]
[null,"The Shared Assessments Program (\"Program\") maintains, promotes and facilitates the use of the Standardized Information Gathering (\"SIG\") questionnaire documents."]
[]
[null,"The Shared Assessments Program attaches the following conditions to individuals and organizations downloading, copying and/or using the Program Documents:"]
[]
[null,"·        No modifications may be made to the Program documents without the express written permission of the Shared Assessments Program and The Santa Fe Group."]
[null,"·        Organizations must notify The Santa Fe Group at sharedassessments@santa-fe-group.com of their reasons for the modifications and make the modifications available to for "]
[null,"review and approval as additions and/or modifications to the current version of the documents.  "]
[null,"·        Copyright and all other intellectual property or proprietary rights in any modifications to the Shared Assessments Program documents shall belong to the Shared Assessments "]
[null,"Program and The Santa Fe Group."]
[null,"·        Persons downloading the Program documents who wish to incorporate the AUP and/or SIG into a software product offered for license or sale must first obtain a separate "]
[null,"license from the Shared Assessments Program."]
[null,"The Program documents have been developed as tools for information security, privacy and business continuity compliance. They are based on general information security and privacy laws, regulation, principles, frameworks, audit programs, seal programs and regulatory guidance from various jurisdictions and do not constitute legal advice or an exhaustive list of questions or procedures covering all the information security or privacy laws in the US, or rest of the world, that may apply to a service provider. Each user should consult counsel on a case-by-case basis to ensure compliance with all applicable information security and privacy laws, regulations, policies and standards."]
[null,"THE SHARED ASSESSMENTS PROGRAM DOCUMENTS ARE PROVIDED \"AS IS\" AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ARE DISCLAIMED. IN NO EVENT SHALL THE SANTA FE GROUP, OR THE SHARED ASSESSMENTS PROGRAM, ITS SPONSORS OR PROGRAM MEMBERS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THE SHARED ASSESSMENTS PROGRAM DOCUMENTS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."]

{"sheet":"Instructions","index":2,"n_rows":46,"n_cols":6,"rows_kept":46,"cut":false,"hidden":true,"merged":[]}
[]
[null,null,null,"Respondent Instructions",null,"Issuer Instructions"]
[]
[]
[]
[]
[]
[]
[null,"2016 SHARED ASSESSMENTS STANDARDIZED INFORMATION",null,null,null,"Detailed instructions on how to use the SIG are contained in the How To Guide"]
[null,"GATHERING (SIG) QUESTIONNAIRE (2016 SIG)",null,null,null,"which also includes a Respondent Guide you may want to provide along with the SIG."]
[null,"Version 2016",null,"Primary or parent questions are followed by numbered sub or child questions."]
[null,"Released: December 2016",null,"The SIG has built in automation. Based on your responses, cells will change color",null,"SIG Management Tool (SMT)"]
[null,null,null,"or if Excel macros are enabled child questions may not be displayed. This will reduce",null,"A macros-enabled spreadsheet is provided to Issuers of the SIG to help with"]
[null,"http://www.sharedassessments.org",null,"the number of questions you are required to complete. When you answer 'No' or 'N/A'",null,"processing service provider responses and managing the transfer of responses"]
[null,"sharedassessments@santa-fe-group.com",null,"to question the cell, and all of its related sub-questions will either be hidden and/or",null,"from previous versions of the SIG. If a master SIG is created, the SMT allows for"]
[null,null,null,"the response field will change color identifying that question has been answered.",null,"comparisons of all responses in the master SIG to the SIG offered by a service"]
[null,"Initiator Information",null,"The issuer will see only the No or N/A response for the parent and all of its child",null,"provider. The SMT will also transfer responses and the \"Additional Information\""]
[null,null,null,"questions. If your client/customer requests a maturity response, for all Yes responses",null,"field from previous versions of the SIG. For a full list of functions, please refer"]
[null,null,null,"you must provide a maturity value for that question in the Maturity column. The maturity levels",null,"to the SMT Functionality tab."]
[null,null,null,"are provided when the cell is selected."]
[null,null,null,null,null,"Note: Detailed instructions for the use of the SMT are included in the How To Guide."]
[null,null,null,"There are two parts to this questionnaire:"]
[null,null,null,"        - SIG Lite"]
[null,null,null,"        - Detail tabs (A through V)"]
[null,null,null,"The instructions below will help you in the completion of the SIG Lite or full SIG. "]
[null,null,null," "]
[null,null,null,"Full SIG"]
[null,null,null,"1) Complete the \"Business Information\" tab."]
[null,null,null,"2) Compile the documentation requested on the \"Documentation\" tab."]
[null,null,null,"3) Use the \"Additional Information\" field to provide any pertinent information."]
[null,null,null,"    (An explanation is required for \"N/A\" responses.)"]
[null,null,null,"4) Answer the questions in the tab(s) as instructed by the Requestor by selecting"]
[null,null,null,"    Yes, No or N/A from the drop-down menu."]
[]
[null,null,null,"SIG Lite Only"]
[null,null,null,"1) Complete the \"Business Information\" tab."]
[null,null,null,"2) Compile the documentation requested on the \"Documentation\" tab."]
[null,null,null,"3) Answer all of the questions on the \"SIG Lite\" tab by selecting Yes, No or N/A"]
[null,null,null,"from the drop-down menu."]
[null,null,null,"4) Use the \"Additional Information\" field to provide any pertinent information."]
[null,null,null," (An explanation is required for \"N/A\" responses.)"]
[null,null,null,"5) Answer questions on the \"Additional Questions\" tab (tab Z) only if additional"]
[null,null,null," questions have been inserted."]
[]
[null,null,null,"Note: Answers provided in the Lite tab are automatically transferred to the "]
[null,null,null,"corresponding tab in the full SIG avoiding the need to answer those questions again."]

{"sheet":"Dashboard","index":3,"n_rows":29,"n_cols":5,"rows_kept":29,"cut":false,"hidden":false,"merged":[[1,0,1,4]]}
["Dashboard",null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""}]
["The Dashboard provides you with a quick and easy reference to determine if the required sections of the SIG have been completed. As questions are answered, either directly or by being pre-filled, the Dashboard will track the completion percentage of each section."]
["Tabs","% Comp",null,"Response Cell Background Color Coding (All tabs)","Resp"]
["Terms Of Use","N/A",null,"Response Required (all cells with a blue background are editable)"]
["Business Information",{"$f":"'Business Information'!C2","v":"0%"},null,"Yes Response","Yes"]
["Documentation Request List","N/A",null,"No Response","No"]
["SIG Lite",{"$f":"Lite!D2","v":"0%"},null,"N/A Response","N/A"]
["A. Risk Management",{"$f":"'A. Risk Management'!D2","v":"0%"},null,"Top of table (no response required)"]
["B. Security Policy",{"$f":"'B. Security Policy'!D2","v":"0%"}]
["C. Organizational Security",{"$f":"'C. Organizational Security'!D2","v":"0%"}]
["D. Asset Management",{"$f":"'D. Asset Management'!D2","v":"0%"},"Response Type"]
["E. Human Resource Security",{"$f":"'E. Human Resource Security'!D2","v":"0%"},"Binary"]
["F. Physical and Environmental",{"$f":"'F. Physical and Environmental'!D2","v":"0%"}]
["G. Communications and Operations Management",{"$f":"'G. Communications and Ops Mgmt'!D2","v":"0%"}]
["H. Access Control",{"$f":"'H. Access Control'!D2","v":"0%"}]
["I. Information Systems Application Development and Maintenance",{"$f":"'I. Info Sys AD&M'!D2","v":"0%"}]
["J. Incident Event and Communications Management",{"$f":"'J. Incident Event & Comm Mgmt'!D2","v":"0%"}]
["K. Business Resiliency",{"$f":"'K. Business Resiliency'!D2","v":"0%"}]
["L. Compliance",{"$f":"'L. Compliance'!D2","v":"0%"}]
["M. Mobile",{"$f":"'M. Mobile'!D2","v":"0%"}]
["P. Privacy",{"$f":"'P. Privacy'!D2","v":"0%"}]
["Q. Software Security",{"$f":"'Q. Software Security'!D2","v":"0%"}]
["V. Cloud Security",{"$f":"'V. Cloud Security'!D2","v":"0%"}]
["Z. Additional Questions","N/A"]
["Glossary","N/A"]
["Formula Notes","N/A"]
["Full","N/A"]
["Full Lite","N/A"]
["SIG Total",{"$f":"IF(COUNTA(INDEX(WorksheetCount,0))>15,Lite!AI21,Lite!D2)","v":"0%"}]

{"sheet":"Business Information","index":4,"n_rows":38,"n_cols":6,"rows_kept":38,"cut":false,"hidden":false,"merged":[]}
[null,"Business Information",null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},"Count","Resp"]
["Serial No",null,{"$f":"IF(E3=0,\"0%\",E3/E2)","v":"0%"},"Percent Complete",{"$f":"COUNTA(E4:E45)","v":32}]
[{"$f":"MAX(A4:A38)","v":4004},"Question/Request",null,"Response",{"$f":"COUNTIF(E4:E45,1)","v":0}]
[2891,"Responder Name",null,null,{"$f":"COUNTA(D4)","v":0},{"$f":"IF(D4=\"Yes\",1,IF(D4=\"No\",2,IF(D4=\"N/A\",3,0)))","v":0}]
[2892,"Responder Job Title",null,null,{"$f":"COUNTA(D5)","v":0},{"$f":"IF(D5=\"Yes\",1,IF(D5=\"No\",2,IF(D5=\"N/A\",3,0)))","v":0}]
[2893,"Responder Contact Information",null,null,{"$f":"COUNTA(D6)","v":0},0]
[3749,"Names and titles/functions of individuals who contributed to this questionnaire",null,null,{"$f":"COUNTA(D7)","v":0},0]
[2894,"Date of Response",null,null,{"$f":"COUNTA(D8)","v":0},0]
[null,"Company Profile",null,null,null,0]
[2896,"Name of the holding or parent company",null,null,{"$f":"COUNTA(D10)","v":0},0]
[2897,"Company/business name",null,null,0,0]
[2898,"Publicly or privately held company",null,null,0,0]
[2899,"If public, what is the name of the Exchange",null,null,{"$f":"IF(D12=\"Privately held\",1,COUNTA(D13))","v":0},0]
[2900,"If public, what is the trading symbol",null,null,{"$f":"IF(D12=\"Privately held\",1,COUNTA(D14))","v":0},0]
[2901,"Type of legal entity and state of incorporation",null,null,0,0]
[2902,"How long has the company been in business",null,null,0,0]
[2903,"Are there any material claims or judgments against the company",null,null,0,0]
[2904,"If yes, describe the impact it may have on the services in scope of this document",null,null,{"$f":"IF(D17=\"No\",1,COUNTA(D18))","v":0},0]
[4000,"Has your company suffered a data loss or security breach within the last 3 years?",null,null,0,0]
[4001,"If yes, please describe the loss or breach.",null,null,{"$f":"IF(D19=\"No\",1,COUNTA(D20))","v":0},0]
[4002,"Has any of your Third Party Vendors suffered a data loss or security breach within the last 3 years?",null,null,0,0]
[4003,"If yes, please describe the loss or breach.",null,null,{"$f":"IF(D21=\"No\",1,COUNTA(D22))","v":0},0]
[null,"Scope\nPlease provide the below responses to establish the scope of the SIG",null,null,null,0]
[2911,"Are the answers in this questionnaire for only one facility or geographic location? If yes, provide description of physical location (address, city, state, country). ",null,null,{"$f":"COUNTA(D24)","v":0},0]
[2912,"Backup site physical address",null,null,{"$f":"COUNTA(D25)","v":0},0]
[2913,"Any additional locations where Scoped Systems and Data is stored",null,null,{"$f":"COUNTA(D26)","v":0},0]
[2914,"If yes, provide each location (address, city, state, country).",null,null,{"$f":"IF(D26=\"No\",1,COUNTA(D27))","v":0},0]
[2973,"Are the answers to this questionnaire for only one specific type of service? If yes, describe the service.",null,null,{"$f":"COUNTA(D28)","v":0},0]
[3919,"Are software applications provided?",null,null,{"$f":"COUNTA(D29)","v":0},0]
[3992,"List the applications provided that are in scope.",null,null,{"$f":"IF($D$29=\"No\",1,COUNTA(D30))","v":0},0]
[3993,"Identify the applications which are covered by the secure software development lifecycle.",null,null,{"$f":"IF($D$29=\"No\",1,COUNTA(D31))","v":0},0]
[3994,"What type of software is being provided, select all that apply?",null,null,null,0]
[3995,"Commercial Off-The-Shelf (COTS)",null,null,{"$f":"IF($D$29=\"No\",1,COUNTA(D33))","v":0},0]
[3996,"Custom Developed",null,null,0,0]
[3997,"Cloud ",null,null,0,0]
[3998,"Mobile",null,null,0,0]
[4004,"Open Source Software",null,null,0,{"$f":"IF(D37=\"Yes\",1,IF(D37=\"No\",2,IF(D37=\"N/A\",3,0)))","v":0}]
[3999,"Other",null,null,0,0]

{"sheet":"Documentation","index":5,"n_rows":32,"n_cols":4,"rows_kept":32,"cut":false,"hidden":false,"merged":[]}
["Serial No","Documentation*\nUse this section to request any specific documentation you want the Respondent to provide along with the SIG",null,{"$f":"Master","v":0}]
[{"$f":"MAX(A3:A32)","v":4006},"Document Request","Question Reference","Name and/or type of information provided (e.g., document, summary, table of contents)"]
[2922,"* Information Security policies and procedures. This should include the following (if not, provide the individual documents as necessary):\na) Hiring policies and practices and employment application\nb) User Account administration policy and procedures for all supported platforms where Scoped Systems and Data are processed and network/LAN access\nc) Supporting documentation to indicate completion of User Entitlement reviews\nd) Employee Non-disclosure agreement document\ne) Information Security Incident Report policy and procedures, including all contract information\nf) Copy of Visitor policy and procedures\ng) Security Log Review policies and procedures\nh) Copy of third party risk management policies and procedures"]
[2923,"* Copy of internal or external information security audit report"]
[2924,"Information technology and security organization charts (including where Respondent information security resides and the composition of any information security steering committees).\nNote: Actual names of employees are not required"]
[2925,"* Physical Security policy and procedures (building and/or restricted access)"]
[2926,"* Third party security reviews/assessments/penetration tests "]
[2927,"Legal clauses and confidentiality templates for third parties"]
[2928,"Topics covered in the security training program"]
[2929,"* Security incident handling and reporting process"]
[2930,"Network configuration diagrams for internal and external networks defined in scope. Note: Sanitized versions of the network diagram are acceptable"]
[2931,"* System and network configuration standards"]
[2932,"* System backup policy and procedures"]
[2933,"* Offsite storage policy and procedures"]
[2934,"* Vulnerability and threat management scan policy and procedures"]
[2935,"* Application security policy"]
[2936,"* Change control policy/procedures"]
[2937,"* Problem management policy/procedures"]
[2938,"* Certification of proprietary encryption algorithms"]
[2939,"* Internal vulnerability assessments of systems, applications, and networks"]
[2940,"* Software development and lifecycle (SDLC) process document"]
[2941,"* Business Resiliency (continuity plan) (BCP) and/or Disaster Recovery Plan"]
[2942,"* Most recent BCP/DR test dates and results"]
[2943,"* Most recent AUP/SSAE16/SOC2 audit report(s)"]
[3301,"* Privacy Policies (internal, external, web)"]
[4005,"* Executive Summary of certificates held. (e.g. PCI, HIPAA, ISO)"]
[4006,"* Performance Reports against contracted SLAs"]
[]
[]
[]
[]
[null,"*If the Respondent policy prohibits the distribution of any of these documents, please provide the document title, the table of contents, the executive summary, revision history, and evidence of approval."]

{"sheet":"Lite","index":6,"n_rows":161,"n_cols":36,"rows_kept":161,"cut":false,"hidden":false,"merged":[[2,1,2,8]]}
[11,"SIG Lite",null,null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,"Binary","Binary",null,null,null,"SL"]
[null,null,null,{"$f":"IF(SUM(AE5:AE20)/SUM(AD5:AD20)=0,\"0%\",SUM(AE5:AE20)/SUM(AD5:AD20))","v":"0%"},"Percent Complete",null,"Tab Automation:","Enable"]
["Detail SN","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory. Use the Additional Information Field in column F to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, select the word \"Disable\" in the Tab Automation field at the top of the page.\n     - Use the Maturity column to identify the maturity of the question. See the How To Guide for instructions on filling out this field.",null,null,null,null,null,null,null,"Q depth","Detail Letter","Q # Calc","Sec Num",null,null,null,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc",null,"Filter","Sec Calc",null,null,"Optional\nScoring","Section","Q per Sec","1 & 2 count","Total Ques","Quest ans","Elements","Max Rows","Maturity N/A"]
[{"$f":"MAX(A5:A161)","v":4154},"Ques Num"," Question/Request","Response","Maturity","Additional Information","AUP Reference","ISO 27002:2013 Relevance"]
[null,null,{"$f":"'A. Risk Management'!B1","v":"A. Risk Assessment and Treatment"},null,null,null,null,null,null,null,1,null,{"$f":"IF(J5=\"\",M4+1,M4)","v":1},null,null,null,{"$f":"IF(ISNA(VLOOKUP(A5,BusInfoArray,6,FALSE)),0,VLOOKUP(A5,BusInfoArray,6,FALSE))","v":0},{"$f":"IF(J5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D5=\"Yes\"),AND($M$1=\"Scaled\",D5>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D5=\"No\"),AND($M$1=\"Scaled\",D5<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":""},{"$f":"IF(J5=\"\",\"\",IF(Q5>0,Q5,IF(R5>0,R5,0)))","v":""},null,{"$f":"IF(J5=\"\",U4,IF(AND(S5>1,OR(U4=\"\",U4=0,U4>=J5)),J5,IF(J5>U4,U4,0)))","v":0},{"$f":"IF(Master=\"Master\",R5,IF(V4=\"\",S5,IF(OR(AND(U5>0,S5<V4),AND(U5=1,S5<=V4)),V4,S5)))","v":""},null,{"$f":"IF(AND(J5=1,S5=1),2,IF(AND(V4=1,M5=M4),2,IF(AND(X4=2,M5=M4),2,IF(OR(J5=1,J5=\"\"),1,\"\"))))","v":1},null,null,null,null,"A",{"$f":"COUNTIF($K$5:$K$161,AC5)","v":1},{"$f":"SUMPRODUCT(($Y$5:$Y$161)*($K$5:$K$161=AC5))","v":0},{"$f":"'A. Risk Management'!T2","v":14},{"$f":"'A. Risk Management'!X2","v":0},{"$f":"'A. Risk Management'!J2","v":14},50]
[3198,{"$f":"IF(A6=\"\",\"\",$Q$1&\".\"&L6)","v":"SL.1"},"Is there a risk assessment program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the program?",null,null,null,"A.1 IT & Infrastructure Risk Governance and Context","5.1                                            6.1.2","Leadership & Commitment,                Information Security Risk Assessment",1,"A",{"$f":"IF(A6=\"\",L5,L5+1)","v":1},{"$f":"IF(J6=\"\",M5+1,M5)","v":1},null,null,null,0,{"$f":"IF(J6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D6=\"Yes\"),AND($M$1=\"Scaled\",D6>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D6=\"No\"),AND($M$1=\"Scaled\",D6<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J6=\"\",\"\",IF(Q6>0,Q6,IF(R6>0,R6,0)))","v":0},null,{"$f":"IF(J6=\"\",U5,IF(AND(S6>1,OR(U5=\"\",U5=0,U5>=J6)),J6,IF(J6>U5,U5,0)))","v":0},0,null,1,{"$f":"IF(V6>0,1,0)","v":0},null,null,null,"B",3,0,{"$f":"'B. Security Policy'!T2","v":59},{"$f":"'B. Security Policy'!X2","v":0},{"$f":"'B. Security Policy'!J2","v":59},75]
[null,"",{"$f":"'B. Security Policy'!B1","v":"B. Security Policy"},null,null,null,null,null,null,null,1,{"$f":"IF(A7=\"\",L6,L6+1)","v":1},{"$f":"IF(J7=\"\",M6+1,M6)","v":2},null,null,null,{"$f":"IF(ISNA(VLOOKUP(A7,BusInfoArray,6,FALSE)),0,VLOOKUP(A7,BusInfoArray,6,FALSE))","v":0},{"$f":"IF(J7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D7=\"Yes\"),AND($M$1=\"Scaled\",D7>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D7=\"No\"),AND($M$1=\"Scaled\",D7<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":""},{"$f":"IF(J7=\"\",\"\",IF(Q7>0,Q7,IF(R7>0,R7,0)))","v":""},null,{"$f":"IF(J7=\"\",U6,IF(AND(S7>1,OR(U6=\"\",U6=0,U6>=J7)),J7,IF(J7>U6,U6,0)))","v":0},{"$f":"IF(Master=\"Master\",R7,IF(V6=\"\",S7,IF(OR(AND(U7>0,S7<V6),AND(U7=1,S7<=V6)),V6,S7)))","v":""},null,{"$f":"IF(AND(J7=1,S7=1),2,IF(AND(V6=1,M7=M6),2,IF(AND(X6=2,M7=M6),2,IF(OR(J7=1,J7=\"\"),1,\"\"))))","v":1},{"$f":"IF(V7>0,1,0)","v":1},null,null,null,"C",2,0,{"$f":"'C. Organizational Security'!T2","v":56},{"$f":"'C. Organizational Security'!X2","v":0},{"$f":"'C. Organizational Security'!J2","v":56},75]
[3199,"SL.2","Is there an information security policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?",null,null,null,"B.1 Information Security Policy Content & Maintenance","5.1.1","Policies for information security",1,"B",2,2,null,null,null,0,{"$f":"IF(J8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D8=\"Yes\"),AND($M$1=\"Scaled\",D8>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D8=\"No\"),AND($M$1=\"Scaled\",D8<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0,null,null,null,"D",2,0,{"$f":"'D. Asset Management'!T2","v":32},{"$f":"'D. Asset Management'!X2","v":0},{"$f":"'D. Asset Management'!J2","v":32},50]
[2471,"SL.3","Have the policies been reviewed in the last 12 months?",null,null,null,"B.1 Procedure: d","5.1.2","Review of the policies for information security",1,"B",3,2,null,null,null,0,{"$f":"IF(J9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D9=\"Yes\"),AND($M$1=\"Scaled\",D9>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D9=\"No\"),AND($M$1=\"Scaled\",D9<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0,null,null,null,"E",6,0,{"$f":"'E. Human Resource Security'!T2","v":46},{"$f":"'E. Human Resource Security'!X2","v":0},{"$f":"'E. Human Resource Security'!J2","v":47},75,1]
[3886,"SL.4","Is there a vendor management program?",null,null,null,null,null,null,1,"B",4,2,null,null,null,0,{"$f":"IF(J10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D10=\"Yes\"),AND($M$1=\"Scaled\",D10>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D10=\"No\"),AND($M$1=\"Scaled\",D10<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0,null,null,null,"F",3,0,{"$f":"'F. Physical and Environmental'!T2","v":119},{"$f":"'F. Physical and Environmental'!X2","v":0},{"$f":"'F. Physical and Environmental'!J2","v":132},150]
[null,"",{"$f":"'C. Organizational Security'!B1","v":"C. Organizational Security"},null,null,null,null,null,null,null,1,4,3,null,null,null,0,{"$f":"IF(J11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D11=\"Yes\"),AND($M$1=\"Scaled\",D11>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D11=\"No\"),AND($M$1=\"Scaled\",D11<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1,null,null,null,"G",12,0,{"$f":"'G. Communications and Ops Mgmt'!T2","v":265},{"$f":"'G. Communications and Ops Mgmt'!X2","v":0},{"$f":"'G. Communications and Ops Mgmt'!J2","v":289},325]
[58,"SL.5","Is there a respondent information security function responsible for security initiatives?",null,null,null,"C.2 Security Organization Roles / Responsibilities","6.1.1","Information Security Roles and Responsibilities",1,"C",5,3,null,null,null,0,{"$f":"IF(J12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D12=\"Yes\"),AND($M$1=\"Scaled\",D12>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D12=\"No\"),AND($M$1=\"Scaled\",D12<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0,null,null,null,"H",4,0,{"$f":"'H. Access Control'!T2","v":52},{"$f":"'H. Access Control'!X2","v":0},{"$f":"'H. Access Control'!J2","v":55},75]
[71,"SL.6","Do external parties have access to Scoped Systems and Data or processing facilities?",null,null,null,null,15,"Supplier relationships",1,"C",6,3,null,null,null,0,{"$f":"IF(J13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D13=\"Yes\"),AND($M$1=\"Scaled\",D13>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D13=\"No\"),AND($M$1=\"Scaled\",D13<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0,null,null,null,"I",7,0,{"$f":"'I. Info Sys AD&M'!T2","v":95},{"$f":"'I. Info Sys AD&M'!X2","v":0},{"$f":"'I. Info Sys AD&M'!J2","v":95},100,1]
[null,"",{"$f":"'D. Asset Management'!B1","v":"D. Asset Management"},null,null,null,null,null,null,null,1,6,4,null,null,null,0,{"$f":"IF(J14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D14=\"Yes\"),AND($M$1=\"Scaled\",D14>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D14=\"No\"),AND($M$1=\"Scaled\",D14<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1,null,null,null,"J",1,0,{"$f":"'J. Incident Event & Comm Mgmt'!T2","v":32},{"$f":"'J. Incident Event & Comm Mgmt'!X2","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!J2","v":41},75]
[3200,"SL.7","Is there an asset management program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?",null,null,null,"D. Assessment Management",8.1,"Responsibility For Assets",1,"D",7,4,null,null,null,0,{"$f":"IF(J15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D15=\"Yes\"),AND($M$1=\"Scaled\",D15>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D15=\"No\"),AND($M$1=\"Scaled\",D15<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0,null,null,null,"K",11,0,{"$f":"'K. Business Resiliency'!T2","v":134},{"$f":"'K. Business Resiliency'!X2","v":0},{"$f":"'K. Business Resiliency'!J2","v":134},75]
[2532,"SL.8","Are information assets classified?",null,null,null,"D.1 Procedure: e.1","8.2.1","Classification of Information",1,"D",8,4,null,null,null,0,{"$f":"IF(J16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D16=\"Yes\"),AND($M$1=\"Scaled\",D16>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D16=\"No\"),AND($M$1=\"Scaled\",D16<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0,null,null,null,"L",10,0,{"$f":"'L. Compliance'!T2","v":40},{"$f":"'L. Compliance'!X2","v":0},{"$f":"'L. Compliance'!J2","v":40},25,1]
[null,"",{"$f":"'E. Human Resource Security'!B1","v":"E. Human Resource Security"},null,null,null,null,null,null,null,1,8,5,null,null,null,0,{"$f":"IF(J17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D17=\"Yes\"),AND($M$1=\"Scaled\",D17>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D17=\"No\"),AND($M$1=\"Scaled\",D17<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1,null,null,null,"M",6,0,{"$f":"'M. Mobile'!T2","v":43},{"$f":"'M. Mobile'!X2","v":0},{"$f":"'M. Mobile'!J2","v":52},25]
[2536,"SL.9","Are security roles and responsibilities of constituents defined and documented in accordance with the respondent’s information security policy?",null,null,null,"C.2 Security Organization Roles/Responsibilities","6.1.1","Information security roles and responsibilities",1,"E",9,5,null,null,null,0,{"$f":"IF(J18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D18=\"Yes\"),AND($M$1=\"Scaled\",D18>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D18=\"No\"),AND($M$1=\"Scaled\",D18<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0,null,null,null,"P",22,0,{"$f":"'P. Privacy'!T2","v":50},{"$f":"'P. Privacy'!X2","v":0},{"$f":"'P. Privacy'!J2","v":50},75]
[2538,"SL.10","Is a background screening performed prior to allowing constituent access to Scoped Systems and Data?",null,null,null,"E.3 Background Investigation Policy Content","7.1.1","Screening",1,"E",10,5,null,null,null,0,{"$f":"IF(J19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D19=\"Yes\"),AND($M$1=\"Scaled\",D19>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D19=\"No\"),AND($M$1=\"Scaled\",D19<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0,null,null,null,"Q",2,0,{"$f":"'Q. Software Security'!T2","v":78},{"$f":"'Q. Software Security'!X2","v":0},{"$f":"'Q. Software Security'!J2","v":78}]
[183,"SL.11","Are new hires required to sign any agreements upon hire?",null,null,null,null,"7.1.2","Terms and conditions of employment",1,"E",11,5,null,null,null,0,{"$f":"IF(J20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D20=\"Yes\"),AND($M$1=\"Scaled\",D20>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D20=\"No\"),AND($M$1=\"Scaled\",D20<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0,null,null,null,"V",49,0,{"$f":"'V. Cloud Security'!V2","v":323},{"$f":"'V. Cloud Security'!Z2","v":0},{"$f":"'V. Cloud Security'!L2","v":378},450,1]
[212,"SL.12","Is there a security awareness training program?",null,null,null,"E.1 Security Awareness Training Program Maintenance","7.2.2","Information security awareness, education, and training",1,"E",12,5,null,null,null,0,{"$f":"IF(J21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D21=\"Yes\"),AND($M$1=\"Scaled\",D21>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D21=\"No\"),AND($M$1=\"Scaled\",D21<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0,null,null,null,null,{"$f":"SUM(AD5:AD20)","v":141},0,{"$f":"SUM(AF5:AF20)","v":1438},{"$f":"SUM(AG5:AG20)","v":0},{"$f":"SUM(AH5:AH20)","v":1552},{"$f":"IF(AG21/AF21=0,\"0%\",AG21/AF21)","v":"0%"}]
[293,"SL.13","Is there a disciplinarily process for non-compliance with information security policies?",null,null,null,null,"7.2.3","Disciplinary process",1,"E",13,5,null,null,null,0,{"$f":"IF(J22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D22=\"Yes\"),AND($M$1=\"Scaled\",D22>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D22=\"No\"),AND($M$1=\"Scaled\",D22<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0,null,null,null,null,null,null,null,null,null,{"$f":"COUNTA(INDEX(WorksheetCount,0))","v":29}]
[2557,"SL.14","Is there a constituent termination or change of status process?",null,null,null,"H.2 Revoke System and Physical Access",7.3,"Termination responsibilities",1,"E",14,5,null,null,null,0,{"$f":"IF(J23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D23=\"Yes\"),AND($M$1=\"Scaled\",D23>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D23=\"No\"),AND($M$1=\"Scaled\",D23<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[null,"",{"$f":"'F. Physical and Environmental'!B1","v":"F. Physical and Environmental Security"},null,null,null,null,null,null,null,1,14,6,null,null,null,0,{"$f":"IF(J24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D24=\"Yes\"),AND($M$1=\"Scaled\",D24>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D24=\"No\"),AND($M$1=\"Scaled\",D24<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1]
[2559,"SL.15","Is there a physical security program?",null,null,null,null,"5.1.1","Policies for information security",1,"F",15,6,null,null,null,0,{"$f":"IF(J25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D25=\"Yes\"),AND($M$1=\"Scaled\",D25>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D25=\"No\"),AND($M$1=\"Scaled\",D25<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[2560,"SL.16","Are reasonable physical security and environmental controls present in the building/data center that contains Scoped Systems and Data?",null,null,null,"F. Physical and Environmental Security",11.1,"Secure areas",1,"F",16,6,null,null,null,0,{"$f":"IF(J26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D26=\"Yes\"),AND($M$1=\"Scaled\",D26>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D26=\"No\"),AND($M$1=\"Scaled\",D26<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[396,"SL.17","Are visitors permitted in the facility?",null,null,null,null,"11.1.2 ","Physical entry controls",1,"F",17,6,null,null,null,0,{"$f":"IF(J27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D27=\"Yes\"),AND($M$1=\"Scaled\",D27>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D27=\"No\"),AND($M$1=\"Scaled\",D27<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[null,"",{"$f":"'G. Communications and Ops Mgmt'!B1","v":"G. Communications and Operations Management"},null,null,null,null,null,null,null,1,17,7,null,null,null,0,{"$f":"IF(J28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D28=\"Yes\"),AND($M$1=\"Scaled\",D28>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D28=\"No\"),AND($M$1=\"Scaled\",D28<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1]
[2582,"SL.18","Are Management approved operating procedures utilized?",null,null,null,"G. Communications and Operations Management","12.1.1","Documented Operating Procedure",1,"G",18,7,null,null,null,0,{"$f":"IF(J29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D29=\"Yes\"),AND($M$1=\"Scaled\",D29>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D29=\"No\"),AND($M$1=\"Scaled\",D29<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[816,"SL.19","Is there an operational change management/change control policy or program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?",null,null,null,"G.21 Change Control","12.1.2","Change Management",1,"G",19,7,null,null,null,0,{"$f":"IF(J30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D30=\"Yes\"),AND($M$1=\"Scaled\",D30>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D30=\"No\"),AND($M$1=\"Scaled\",D30<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[853,"SL.20","Do third party vendors have access to Scoped Systems and Data? (backup vendors, service providers, equipment support maintenance, software maintenance vendors, data recovery vendors, etc.)?",null,null,null,null,15,"Supplier relationships",1,"G",20,7,null,null,null,0,{"$f":"IF(J31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D31=\"Yes\"),AND($M$1=\"Scaled\",D31>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D31=\"No\"),AND($M$1=\"Scaled\",D31<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[895,"SL.21","Is there an anti-virus/malware policy or program (workstations, servers, mobile devices) that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?",null,null,null,"G.7 Virus Protection (Servers), G.8 Virus Protection (Workstations)","12.2.1","Controls Against Malware",1,"G",21,7,null,null,null,0,{"$f":"IF(J32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D32=\"Yes\"),AND($M$1=\"Scaled\",D32>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D32=\"No\"),AND($M$1=\"Scaled\",D32<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[922,"SL.22","Are system backups of Scoped Systems and Data performed?",null,null,null,"G.20 Backup Media Restoration","12.3.1","Information Back-Up",1,"G",22,7,null,null,null,0,{"$f":"IF(J33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D33=\"Yes\"),AND($M$1=\"Scaled\",D33>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D33=\"No\"),AND($M$1=\"Scaled\",D33<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3688,"SL.23","Are firewalls in use for both internal and external connections?",null,null,null,"G.2 Network Security – Firewall(s)","13.1.3","Segregation in networks",1,"G",23,7,null,null,null,0,{"$f":"IF(J34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D34=\"Yes\"),AND($M$1=\"Scaled\",D34>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D34=\"No\"),AND($M$1=\"Scaled\",D34<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3706,"SL.24","Are vulnerability assessments, scans or penetration tests performed on internal or external networks?",null,null,null,"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1","Control of technical vulnerabilities",1,"G",24,7,null,null,null,0,{"$f":"IF(J35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D35=\"Yes\"),AND($M$1=\"Scaled\",D35>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D35=\"No\"),AND($M$1=\"Scaled\",D35<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[975,"SL.25","Are there external network connections (Internet, intranet, extranet, etc.)?",null,null,null,null,"13.1.1","Network Controls",1,"G",25,7,null,null,null,0,{"$f":"IF(J36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D36=\"Yes\"),AND($M$1=\"Scaled\",D36>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D36=\"No\"),AND($M$1=\"Scaled\",D36<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[1095,"SL.26","Is wireless networking technology used?",null,null,null,"G.17 Unapproved Wireless Networks","13.1.1.c","Network Controls",1,"G",26,7,null,null,null,0,{"$f":"IF(J37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D37=\"Yes\"),AND($M$1=\"Scaled\",D37>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D37=\"No\"),AND($M$1=\"Scaled\",D37<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3295,"SL.27","Is there a removable media policy or program (CDs, DVDs, tapes, disk drives) that has been approved by management, communicated to appropriate constituents, and an owner to maintain and review the policy?",null,null,null,"G.15 Physical Media Tracking","8.3.1","Management of Removable Media",1,"G",27,7,null,null,null,0,{"$f":"IF(J38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D38=\"Yes\"),AND($M$1=\"Scaled\",D38>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D38=\"No\"),AND($M$1=\"Scaled\",D38<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[1208,"SL.28","Is Scoped Data sent or received electronically or via physical media?",null,null,null,"G.4 Network Management – Encrypted Authentication Credentials","8.3.3","Physical media in transit",1,"G",28,7,null,null,null,0,{"$f":"IF(J39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D39=\"Yes\"),AND($M$1=\"Scaled\",D39>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D39=\"No\"),AND($M$1=\"Scaled\",D39<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[1770,"SL.29","Are Web services provided?",null,null,null,null,"N/A","",1,"G",29,7,null,null,null,0,{"$f":"IF(J40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D40=\"Yes\"),AND($M$1=\"Scaled\",D40>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D40=\"No\"),AND($M$1=\"Scaled\",D40<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0,null,null,null,null,null,null,null,null,null,null,1]
[null,"",{"$f":"'H. Access Control'!B1","v":"H. Access Control"},null,null,null,null,null,null,null,1,29,8,null,null,null,0,{"$f":"IF(J41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D41=\"Yes\"),AND($M$1=\"Scaled\",D41>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D41=\"No\"),AND($M$1=\"Scaled\",D41<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1]
[1998,"SL.30","Are electronic systems used to transmit, process or store Scoped Systems and Data?",null,null,null,null,"N/A","",1,"H",30,8,null,null,null,0,{"$f":"IF(J42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D42=\"Yes\"),AND($M$1=\"Scaled\",D42>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D42=\"No\"),AND($M$1=\"Scaled\",D42<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[1911,"SL.31","Are unique user IDs used for access?",null,null,null,"H.1 Password Controls","9.2.1.a","User registration and de-registration",1,"H",31,8,null,null,null,0,{"$f":"IF(J43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D43=\"Yes\"),AND($M$1=\"Scaled\",D43>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D43=\"No\"),AND($M$1=\"Scaled\",D43<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[1948,"SL.32","Are passwords required to access systems transmitting, processing or storing Scoped Systems and Data?",null,null,null,"H.1 Password Controls","9.4.3","Password Management System",1,"H",32,8,null,null,null,0,{"$f":"IF(J44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D44=\"Yes\"),AND($M$1=\"Scaled\",D44>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D44=\"No\"),AND($M$1=\"Scaled\",D44<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[2028,"SL.33","Is remote access permitted?",null,null,null,"H.7 Restrictions and Multifactor Authentication for Remote Access",6.2,"Mobile devices and teleworking",1,"H",33,8,null,null,null,0,{"$f":"IF(J45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D45=\"Yes\"),AND($M$1=\"Scaled\",D45>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D45=\"No\"),AND($M$1=\"Scaled\",D45<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[null,"",{"$f":"'I. Info Sys AD&M'!B1","v":"I. Information Systems Acquisition Development & Maintenance"},null,null,null,null,null,null,null,1,33,9,null,null,null,0,{"$f":"IF(J46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D46=\"Yes\"),AND($M$1=\"Scaled\",D46>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D46=\"No\"),AND($M$1=\"Scaled\",D46<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1]
[2665,"SL.34","Are business information systems used to transmit, process or store Scoped Systems and Data?",null,null,null,null,14.1,"Security requirements of information systems",1,"I",34,9,null,null,null,0,{"$f":"IF(J47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D47=\"Yes\"),AND($M$1=\"Scaled\",D47>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D47=\"No\"),AND($M$1=\"Scaled\",D47<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[2058,"SL.35","Is application development performed?",null,null,null,null,"14.2.1","Secure development policy",1,"I",35,9,null,null,null,0,{"$f":"IF(J48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D48=\"Yes\"),AND($M$1=\"Scaled\",D48>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D48=\"No\"),AND($M$1=\"Scaled\",D48<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0,null,null,null,null,null,null,null,null,null,null,1]
[2059,"SL.36","Is there a formal Software Development Life Cycle (SDLC) process?",null,null,null,"I.7 Application Security SDLC Phases","14.2.1 ","Secure development policy",1,"I",36,9,null,null,null,0,{"$f":"IF(J49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D49=\"Yes\"),AND($M$1=\"Scaled\",D49>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D49=\"No\"),AND($M$1=\"Scaled\",D49<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[2213,"SL.37","Are systems and applications patched?",null,null,null,"I.4 System Patching","12.6.1 ","Management of technical vulnerabilities",1,"I",37,9,null,null,null,0,{"$f":"IF(J50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D50=\"Yes\"),AND($M$1=\"Scaled\",D50>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D50=\"No\"),AND($M$1=\"Scaled\",D50<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[2230,"SL.38","Is a web site supported, hosted or maintained that has access to Scoped Systems and Data?",null,null,null,null,"N/A",null,1,"I",38,9,null,null,null,0,{"$f":"IF(J51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D51=\"Yes\"),AND($M$1=\"Scaled\",D51>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D51=\"No\"),AND($M$1=\"Scaled\",D51<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0,null,null,null,null,null,null,null,null,null,null,1]
[2225,"SL.39","Are vulnerability tests (internal/external) performed on all applications at least annually?",null,null,null,"I.1 Application Vulnerability Assessments / Ethical Hacking","18.2.3","Technical compliance review",1,"I",39,9,null,null,null,0,{"$f":"IF(J52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D52=\"Yes\"),AND($M$1=\"Scaled\",D52>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D52=\"No\"),AND($M$1=\"Scaled\",D52<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[1806,"SL.40","Are encryption tools managed and maintained for Scoped Data?",null,null,null,"G.22 Data Security Policy - Encryption",10.1,"Cryptographic controls",1,"I",40,9,null,null,null,0,{"$f":"IF(J53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D53=\"Yes\"),AND($M$1=\"Scaled\",D53>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D53=\"No\"),AND($M$1=\"Scaled\",D53<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[null,"",{"$f":"'J. Incident Event & Comm Mgmt'!B1","v":"J. Incident Event and Communications Management"},null,null,null,null,null,null,null,1,40,10,null,null,null,0,{"$f":"IF(J54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D54=\"Yes\"),AND($M$1=\"Scaled\",D54>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D54=\"No\"),AND($M$1=\"Scaled\",D54<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1]
[2241,"SL.41","Is there an Incident Management program?",null,null,null,"J.1 Information Security Incident Management\nP.8 Privacy Incident and Response Management",16,"Information security incident management",1,"J",41,10,null,null,null,0,{"$f":"IF(J55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D55=\"Yes\"),AND($M$1=\"Scaled\",D55>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D55=\"No\"),AND($M$1=\"Scaled\",D55<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[null,"",{"$f":"'K. Business Resiliency'!B1","v":"K. Business Resiliency"},null,null,null,null,"ISO 22301:2012 Relevance",null,null,1,41,11,null,null,null,0,{"$f":"IF(J56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D56=\"Yes\"),AND($M$1=\"Scaled\",D56>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D56=\"No\"),AND($M$1=\"Scaled\",D56<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1]
[2719,"SL.42","Is there an established Business Resiliency program that has been approved by management and communicated to appropriate constituents?",null,null,null,"K.1 Business Resiliency Governance",5.2,"Management Commitment",1,"K",42,11,null,null,null,0,{"$f":"IF(J57=\"\",\"\",IF(D57=\"\",0,IF(D57=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D57=\"Yes\"),AND($M$1=\"Scaled\",D57>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D57=\"No\"),AND($M$1=\"Scaled\",D57<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[2329,"SL.43","Has a Business Impact Analysis been conducted?",null,null,null,"K.2 Business Impact Analysis","8.2.2","Business impact analysis",1,"K",43,11,null,null,null,0,{"$f":"IF(J58=\"\",\"\",IF(D58=\"\",0,IF(D58=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D58=\"Yes\"),AND($M$1=\"Scaled\",D58>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D58=\"No\"),AND($M$1=\"Scaled\",D58<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[4038,"SL.44","Is there a formal process focused on identifying and addressing risks of disruptive incidents to the organization?",null,null,null,"K.3 Risk Assessment","8.2.3","Risk assessment",1,"K",44,11,null,null,null,0,{"$f":"IF(J59=\"\",\"\",IF(D59=\"\",0,IF(D59=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D59=\"Yes\"),AND($M$1=\"Scaled\",D59>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D59=\"No\"),AND($M$1=\"Scaled\",D59<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[4042,"SL.45","Are specific response and recovery strategies defined for the prioritized activities?",null,null,null,"K.4 Response and Recovery Strategy","8.3.1","Determination and selection",1,"K",45,11,null,null,null,0,{"$f":"IF(J60=\"\",\"\",IF(D60=\"\",0,IF(D60=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D60=\"Yes\"),AND($M$1=\"Scaled\",D60>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D60=\"No\"),AND($M$1=\"Scaled\",D60<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[4049,"SL.46","Are formal business continuity procedures developed and documented?",null,null,null,"K.5 Business Activity Level Recovery Planning",8.4,"Establish and implement business continuity procedures",1,"K",46,11,null,null,null,0,{"$f":"IF(J61=\"\",\"\",IF(D61=\"\",0,IF(D61=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D61=\"Yes\"),AND($M$1=\"Scaled\",D61>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D61=\"No\"),AND($M$1=\"Scaled\",D61<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[4054,"SL.47","Has senior management assigned the responsibility for the overall management of the response and recovery efforts?",null,null,null,"K.1 Business Resiliency Governance","N/A",null,1,"K",47,11,null,null,null,0,{"$f":"IF(J62=\"\",\"\",IF(D62=\"\",0,IF(D62=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D62=\"Yes\"),AND($M$1=\"Scaled\",D62>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D62=\"No\"),AND($M$1=\"Scaled\",D62<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[2286,"SL.48","Is there a periodic (at least annual) review of your Business Resiliency Program?",null,null,null,"K.7 Exercising","8.4.1","Establish and implement business continuity procedures",1,"K",48,11,null,null,null,0,{"$f":"IF(J63=\"\",\"\",IF(D63=\"\",0,IF(D63=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D63=\"Yes\"),AND($M$1=\"Scaled\",D63>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D63=\"No\"),AND($M$1=\"Scaled\",D63<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[2729,"SL.49","Are there any dependencies on critical third party service providers?",null,null,null,"K.2 Business Impact Analysis","8.1\n\n8.3\n8.3.1\n\n8.44","Operational Planning and Control\r\nBusiness continuity strategy\r\nDetermination and selection\r\nBusiness continuity plans",1,"K",49,11,null,null,null,0,{"$f":"IF(J64=\"\",\"\",IF(D64=\"\",0,IF(D64=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D64=\"Yes\"),AND($M$1=\"Scaled\",D64>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D64=\"No\"),AND($M$1=\"Scaled\",D64<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[2343,"SL.50","Is there a formal, documented exercise and testing program in place?",null,null,null,"K.7 Exercising",8.5,"Exercising and testing",1,"K",50,11,null,null,null,0,{"$f":"IF(J65=\"\",\"\",IF(D65=\"\",0,IF(D65=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D65=\"Yes\"),AND($M$1=\"Scaled\",D65>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D65=\"No\"),AND($M$1=\"Scaled\",D65<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[2305,"SL.51","Is there an Influenza Pandemic/Infectious Disease Outbreak Plan?",null,null,null,"K.8 Infectious Disease Planning","N/A",null,1,"K",51,11,null,null,null,0,{"$f":"IF(J66=\"\",\"\",IF(D66=\"\",0,IF(D66=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D66=\"Yes\"),AND($M$1=\"Scaled\",D66>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D66=\"No\"),AND($M$1=\"Scaled\",D66<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[2365,"SL.52","Is there insurance coverage for business interruptions or general services interruption?",null,null,null,"K.9 Business Insurance","N/A",null,1,"K",52,11,null,null,null,0,{"$f":"IF(J67=\"\",\"\",IF(D67=\"\",0,IF(D67=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D67=\"Yes\"),AND($M$1=\"Scaled\",D67>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D67=\"No\"),AND($M$1=\"Scaled\",D67<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[null,"",{"$f":"'L. Compliance'!B1","v":"L. Compliance"},null,null,null,null,null,null,null,1,52,12,null,null,null,0,{"$f":"IF(J68=\"\",\"\",IF(D68=\"\",0,IF(D68=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D68=\"Yes\"),AND($M$1=\"Scaled\",D68>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D68=\"No\"),AND($M$1=\"Scaled\",D68<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1]
[2826,"SL.53","Is there an internal audit, risk management, or compliance department, or other management oversight unit with responsibility for identifying and tracking resolution of outstanding regulatory issues?",null,null,null,"L.3 Monitoring and Reporting - Compliance Reporting\nL.4 Monitoring and Reporting - Compliance","18.1.1 ","Identification of applicable legislation and contractual requirements",1,"L",53,12,null,null,null,0,{"$f":"IF(J69=\"\",\"\",IF(D69=\"\",0,IF(D69=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D69=\"Yes\"),AND($M$1=\"Scaled\",D69>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D69=\"No\"),AND($M$1=\"Scaled\",D69<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[4126,"SL.54","Are there policies and procedures to ensure compliance with applicable legislative, regulatory and contractual requirements to address intellectual property rights on business processes or information technology software products?",null,null,null,"L. Compliance","NA",null,1,"L",54,12,null,null,null,0,{"$f":"IF(J70=\"\",\"\",IF(D70=\"\",0,IF(D70=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D70=\"Yes\"),AND($M$1=\"Scaled\",D70>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D70=\"No\"),AND($M$1=\"Scaled\",D70<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[2837,"SL.55","Is there a records retention policy covering paper & electronic records, including email in support of applicable regulations, standards and contractual requirements?",null,null,null,"D.1 Asset Accounting and Inventory","18.1.3 ","Protection of records",1,"L",{"$f":"IF(A71=\"\",L70,L70+1)","v":55},{"$f":"IF(J71=\"\",M70+1,M70)","v":12},null,null,null,{"$f":"IF(ISNA(VLOOKUP(A71,BusInfoArray,6,FALSE)),0,VLOOKUP(A71,BusInfoArray,6,FALSE))","v":0},{"$f":"IF(J71=\"\",\"\",IF(D71=\"\",0,IF(D71=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D71=\"Yes\"),AND($M$1=\"Scaled\",D71>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D71=\"No\"),AND($M$1=\"Scaled\",D71<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J71=\"\",\"\",IF(Q71>0,Q71,IF(R71>0,R71,0)))","v":0},null,{"$f":"IF(J71=\"\",U70,IF(AND(S71>1,OR(U70=\"\",U70=0,U70>=J71)),J71,IF(J71>U70,U70,0)))","v":0},{"$f":"IF(Master=\"Master\",R71,IF(V70=\"\",S71,IF(OR(AND(U71>0,S71<V70),AND(U71=1,S71<=V70)),V70,S71)))","v":0},null,{"$f":"IF(AND(J71=1,S71=1),2,IF(AND(V70=1,M71=M70),2,IF(AND(X70=2,M71=M70),2,IF(OR(J71=1,J71=\"\"),1,\"\"))))","v":1},{"$f":"IF(V71>0,1,0)","v":0}]
[4127,"SL.56","Is licensing maintained in all jurisdictions where the business is or where licensing is required?",null,null,null,null,"NA",null,1,"L",56,12,null,null,null,0,{"$f":"IF(J72=\"\",\"\",IF(D72=\"\",0,IF(D72=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D72=\"Yes\"),AND($M$1=\"Scaled\",D72>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D72=\"No\"),AND($M$1=\"Scaled\",D72<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3733,"SL.57","Is there an internal compliance and ethics program to ensure professional ethics and business practices are implemented?",null,null,null,"A.4 Professional Ethics and Business Practices","NA",null,1,"L",57,12,null,null,null,0,{"$f":"IF(J73=\"\",\"\",IF(D73=\"\",0,IF(D73=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D73=\"Yes\"),AND($M$1=\"Scaled\",D73>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D73=\"No\"),AND($M$1=\"Scaled\",D73<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[4135,"SL.58","Are marketing or selling activities conducted directly to client's customers?",null,null,null,null,"NA",null,1,"L",58,12,null,null,null,0,{"$f":"IF(J74=\"\",\"\",IF(D74=\"\",0,IF(D74=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D74=\"Yes\"),AND($M$1=\"Scaled\",D74>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D74=\"No\"),AND($M$1=\"Scaled\",D74<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0,null,null,null,null,null,null,null,null,null,null,1]
[4141,"SL.59","Are there direct interactions with your client's customers?",null,null,null,null,"NA",null,1,"L",59,12,null,null,null,0,{"$f":"IF(J75=\"\",\"\",IF(D75=\"\",0,IF(D75=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D75=\"Yes\"),AND($M$1=\"Scaled\",D75>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D75=\"No\"),AND($M$1=\"Scaled\",D75<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0,null,null,null,null,null,null,null,null,null,null,1]
[4147,"SL.60","Are policies and procedures maintained for enabling compliance with applicable legal, regulatory, statutory, or contractual obligations related to any information security requirements? ",null,null,null,"A.3 Legal, Regulatory, and Standards Compliance","NA",null,1,"L",60,12,null,null,null,0,{"$f":"IF(J76=\"\",\"\",IF(D76=\"\",0,IF(D76=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D76=\"Yes\"),AND($M$1=\"Scaled\",D76>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D76=\"No\"),AND($M$1=\"Scaled\",D76<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[4151,"SL.61","Is there a formalized governance process to identify and assess changes that could significantly affect the system of internal controls for security, confidentiality and availability?",null,null,null,"G.21 Change Control\nL.3 Procedure b.3.i","NA",null,1,"L",61,12,null,null,null,0,{"$f":"IF(J77=\"\",\"\",IF(D77=\"\",0,IF(D77=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D77=\"Yes\"),AND($M$1=\"Scaled\",D77>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D77=\"No\"),AND($M$1=\"Scaled\",D77<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[4154,"SL.62","Are accounts opened, transactions initiated or other account initiation activity applying payments, taking payments, transferring funds, etc. through either electronic, telephonic, written or in-person requests made on behalf of your client's?",null,null,null,null,"NA",null,1,"L",62,12,null,null,null,0,{"$f":"IF(J78=\"\",\"\",IF(D78=\"\",0,IF(D78=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D78=\"Yes\"),AND($M$1=\"Scaled\",D78>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D78=\"No\"),AND($M$1=\"Scaled\",D78<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[null,"",{"$f":"'M. Mobile'!B1","v":"M. Mobile"},null,null,null,null,null,null,null,1,62,13,null,null,null,0,{"$f":"IF(J79=\"\",\"\",IF(D79=\"\",0,IF(D79=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D79=\"Yes\"),AND($M$1=\"Scaled\",D79>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D79=\"No\"),AND($M$1=\"Scaled\",D79<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1]
[4090,"SL.63","Are constituents allowed to utilize mobile devices within your environment? If yes, which of the following functions are allowed:",null,null,null,null,6.2,"Mobile devices and teleworking",1,"M",63,13,null,null,null,0,{"$f":"IF(J80=\"\",\"\",IF(D80=\"\",0,IF(D80=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D80=\"Yes\"),AND($M$1=\"Scaled\",D80>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D80=\"No\"),AND($M$1=\"Scaled\",D80<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0,null,null,null,null,null,null,null,null,null,null,1]
[4091,"SL.64","View Scoped Data?",null,null,null,null,null,null,2,"M",64,13,null,null,null,0,{"$f":"IF(J81=\"\",\"\",IF(D81=\"\",0,IF(D81=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D81=\"Yes\"),AND($M$1=\"Scaled\",D81>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D81=\"No\"),AND($M$1=\"Scaled\",D81<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[4092,"SL.65","Process Scoped Data?",null,null,null,null,null,null,2,"M",65,13,null,null,null,0,{"$f":"IF(J82=\"\",\"\",IF(D82=\"\",0,IF(D82=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D82=\"Yes\"),AND($M$1=\"Scaled\",D82>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D82=\"No\"),AND($M$1=\"Scaled\",D82<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[4093,"SL.66","Delete Scoped Data?",null,null,null,null,null,null,2,"M",66,13,null,null,null,0,{"$f":"IF(J83=\"\",\"\",IF(D83=\"\",0,IF(D83=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D83=\"Yes\"),AND($M$1=\"Scaled\",D83>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D83=\"No\"),AND($M$1=\"Scaled\",D83<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[4094,"SL.67","Store Scoped Data?",null,null,null,null,null,null,2,"M",67,13,null,null,null,0,{"$f":"IF(J84=\"\",\"\",IF(D84=\"\",0,IF(D84=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D84=\"Yes\"),AND($M$1=\"Scaled\",D84>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D84=\"No\"),AND($M$1=\"Scaled\",D84<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[4097,"SL.68","Is there a mobile device management program in place that has been approved by management and communicated to appropriate constituents?",null,null,null,null,null,null,1,"M",68,13,null,null,null,0,{"$f":"IF(J85=\"\",\"\",IF(D85=\"\",0,IF(D85=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D85=\"Yes\"),AND($M$1=\"Scaled\",D85>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D85=\"No\"),AND($M$1=\"Scaled\",D85<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[null,"",{"$f":"'P. Privacy'!B1","v":"P. Privacy"},null,null,null,null,null,null,null,1,68,14,null,null,null,0,{"$f":"IF(J86=\"\",\"\",IF(D86=\"\",0,IF(D86=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D86=\"Yes\"),AND($M$1=\"Scaled\",D86>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D86=\"No\"),AND($M$1=\"Scaled\",D86<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1]
[3687,"SL.69","Is Scoped Data transmitted, processed, or stored that can be classified as non-public information (NPI), personally identifiable information (PII), or sensitive customer financial information? If yes, describe and list types of data.",null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","8.2.1","Classification of Information",1,"P",69,14,null,null,null,0,{"$f":"IF(J87=\"\",\"\",IF(D87=\"\",0,IF(D87=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D87=\"Yes\"),AND($M$1=\"Scaled\",D87>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D87=\"No\"),AND($M$1=\"Scaled\",D87<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3694,"SL.70","Is Scoped Data transmitted, processed, or stored that can be classified as protected health information, electronic health records, or personal health records? If yes, identify the classifications.",null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","8.2.2","Classification of Information",1,"P",70,14,null,null,null,0,{"$f":"IF(J88=\"\",\"\",IF(D88=\"\",0,IF(D88=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D88=\"Yes\"),AND($M$1=\"Scaled\",D88>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D88=\"No\"),AND($M$1=\"Scaled\",D88<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3704,"SL.71","For Scoped Data, is personal information about individuals transmitted to or received from countries outside the United States? If yes, identify the countries.",null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","N/A",null,1,"P",71,14,null,null,null,0,{"$f":"IF(J89=\"\",\"\",IF(D89=\"\",0,IF(D89=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D89=\"Yes\"),AND($M$1=\"Scaled\",D89>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D89=\"No\"),AND($M$1=\"Scaled\",D89<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3872,"SL.72","For Scoped Data is there a dedicated person (or group) responsible for privacy compliance. If yes, describe. If no, explain reason.",null,null,null,"P.3 Privacy Organization and Program Maintenance","16.1.1.b.3 ","Responsibilities and procedures",1,"P",72,14,null,null,null,0,{"$f":"IF(J90=\"\",\"\",IF(D90=\"\",0,IF(D90=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D90=\"Yes\"),AND($M$1=\"Scaled\",D90>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D90=\"No\"),AND($M$1=\"Scaled\",D90<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3873,"SL.73","For Scoped Data, is there a documented privacy policy or procedures to protect confidential information?",null,null,null,"P.2 Privacy Policy and Privacy Notices","15.1.1","Information security policy for supplier relationships",1,"P",73,14,null,null,null,0,{"$f":"IF(J91=\"\",\"\",IF(D91=\"\",0,IF(D91=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D91=\"Yes\"),AND($M$1=\"Scaled\",D91>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D91=\"No\"),AND($M$1=\"Scaled\",D91<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3225,{"$f":"IF(A92=\"\",\"\",$Q$1&\".\"&L92)","v":"SL.74"},"For Scoped Data are there regular privacy risk assessments conducted? If yes, provide frequency and scope. If no, explain reason.",null,null,null,"P.3 Privacy Organization and Program Maintenance","15.1.3.i ","Information and communication technology supply chain",1,"P",74,14,null,null,null,0,{"$f":"IF(J92=\"\",\"\",IF(D92=\"\",0,IF(D92=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D92=\"Yes\"),AND($M$1=\"Scaled\",D92>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D92=\"No\"),AND($M$1=\"Scaled\",D92<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3228,"SL.75","Is there formal privacy awareness training for employees, contractors, and third-party users to ensure confidentiality and privacy of Scoped Data?",null,null,null,"P.7 Privacy Awareness","7.2.2 ","Information security awareness, education and training",1,"P",75,14,null,null,null,0,{"$f":"IF(J93=\"\",\"\",IF(D93=\"\",0,IF(D93=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D93=\"Yes\"),AND($M$1=\"Scaled\",D93>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D93=\"No\"),AND($M$1=\"Scaled\",D93<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3874,"SL.76","Is there a formal process for reporting and responding to privacy complaints or privacy incidents for Scoped Data? If yes, describe. If no, explain reason.",null,null,null,"P.8 Privacy Event Notification and Response Management","16.1.1 ","Responsibilities and procedures",1,"P",76,14,null,null,null,0,{"$f":"IF(J94=\"\",\"\",IF(D94=\"\",0,IF(D94=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D94=\"Yes\"),AND($M$1=\"Scaled\",D94>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D94=\"No\"),AND($M$1=\"Scaled\",D94<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3723,"SL.77","Is there a data classification and retention program for Scoped Data that identifies the data types that require additional management and governance?",null,null,null,"P.1 Scoped Privacy Data Inventory and Flows",8.1999999999999993,"Information Classification",1,"P",77,14,null,null,null,0,{"$f":"IF(J95=\"\",\"\",IF(D95=\"\",0,IF(D95=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D95=\"Yes\"),AND($M$1=\"Scaled\",D95>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D95=\"No\"),AND($M$1=\"Scaled\",D95<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3234,"SL.78","Is there a documented response program to address privacy incidents, unauthorized disclosure, unauthorized access or breach of Scoped Data?",null,null,null,"P.8 Privacy Event Notification and Response Management","16.1.1 ","Responsibilities and procedures",1,"P",78,14,null,null,null,0,{"$f":"IF(J96=\"\",\"\",IF(D96=\"\",0,IF(D96=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D96=\"Yes\"),AND($M$1=\"Scaled\",D96>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D96=\"No\"),AND($M$1=\"Scaled\",D96<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3715,"SL.79","Is Scoped Data disclosed to third parties? If yes, describe",null,null,null,null,null,null,1,"P",79,14,null,null,null,0,{"$f":"IF(J97=\"\",\"\",IF(D97=\"\",0,IF(D97=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D97=\"Yes\"),AND($M$1=\"Scaled\",D97>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D97=\"No\"),AND($M$1=\"Scaled\",D97<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3269,"SL.80","Is Scoped Data disclosed to third parties outside of the U.S.? If yes, describe.",null,null,null,null,null,null,1,"P",80,14,null,null,null,0,{"$f":"IF(J98=\"\",\"\",IF(D98=\"\",0,IF(D98=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D98=\"Yes\"),AND($M$1=\"Scaled\",D98>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D98=\"No\"),AND($M$1=\"Scaled\",D98<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3270,"SL.81","Are there contractual controls to ensure that Scoped Data shared with third parties is limited to defined parameters for access, use and disclosure? If yes, describe the controls, If no, explain reason.",null,null,null,"P.4 Privacy Third Party Agreements","15.1.2 ","Addressing security within supplier agreements",1,"P",81,14,null,null,null,0,{"$f":"IF(J99=\"\",\"\",IF(D99=\"\",0,IF(D99=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D99=\"Yes\"),AND($M$1=\"Scaled\",D99>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D99=\"No\"),AND($M$1=\"Scaled\",D99<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3701,"SL.82","Is there a business associate contract in place to address obligations for the privacy and security requirements of the services provided?",null,null,null,"P.4 Privacy Third Party Agreements","15.1.2 ","Addressing security within supplier agreements",1,"P",82,14,null,null,null,0,{"$f":"IF(J100=\"\",\"\",IF(D100=\"\",0,IF(D100=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D100=\"Yes\"),AND($M$1=\"Scaled\",D100>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D100=\"No\"),AND($M$1=\"Scaled\",D100<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3718,"SL.83","Is there a documented privacy program with administrative, technical, and physical safeguards for the protection of Scoped Data?",null,null,null,"P.2 Privacy Policy and Privacy Notices","15.1.1","Information security policy for supplier relationships",1,"P",83,14,null,null,null,0,{"$f":"IF(J101=\"\",\"\",IF(D101=\"\",0,IF(D101=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D101=\"Yes\"),AND($M$1=\"Scaled\",D101>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D101=\"No\"),AND($M$1=\"Scaled\",D101<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3875,"SL.84","Is there a process for ensuring the accuracy of Scoped Data at the direction of the client? If yes, describe. If no, explain reason.",null,null,null,"P.6 Management of Client Scoped Privacy Data","8.2.3","Handling of assets",1,"P",84,14,null,null,null,0,{"$f":"IF(J102=\"\",\"\",IF(D102=\"\",0,IF(D102=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D102=\"Yes\"),AND($M$1=\"Scaled\",D102>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D102=\"No\"),AND($M$1=\"Scaled\",D102<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3876,"SL.85","Is there a process to ensure that the personal information provided by an individual is limited for the purposes described in the respondent's privacy notice? If yes, describe. If no, explain reason.",null,null,null,"P.6 Management of Client Scoped Privacy Data","8.2.4","Handling of assets",1,"P",85,14,null,null,null,0,{"$f":"IF(J103=\"\",\"\",IF(D103=\"\",0,IF(D103=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D103=\"Yes\"),AND($M$1=\"Scaled\",D103>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D103=\"No\"),AND($M$1=\"Scaled\",D103<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3877,"SL.86","Are constituents regularly monitored for privacy compliance? If yes, describe. If no, explain reason.",null,null,null,null,null,null,1,"P",86,14,null,null,null,0,{"$f":"IF(J104=\"\",\"\",IF(D104=\"\",0,IF(D104=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D104=\"Yes\"),AND($M$1=\"Scaled\",D104>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D104=\"No\"),AND($M$1=\"Scaled\",D104<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3724,"SL.87","Are there documented policies, procedures, and controls to limit access based on need to know or minimum necessary for constituents? If yes, describe.",null,null,null,"P.6 Management of Client Scoped Privacy Data","9.1.1.b","Access control policy",1,"P",87,14,null,null,null,0,{"$f":"IF(J105=\"\",\"\",IF(D105=\"\",0,IF(D105=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D105=\"Yes\"),AND($M$1=\"Scaled\",D105>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D105=\"No\"),AND($M$1=\"Scaled\",D105<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3879,"SL.88","Are enforcement mechanisms applied to constituents who violate privacy policies or confidentiality requirements?",null,null,null,null,null,null,1,"P",88,14,null,null,null,0,{"$f":"IF(J106=\"\",\"\",IF(D106=\"\",0,IF(D106=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D106=\"Yes\"),AND($M$1=\"Scaled\",D106>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D106=\"No\"),AND($M$1=\"Scaled\",D106<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3729,"SL.89","Are transactions for covered accounts accessed, modified, or processed, including address changes and discrepancies? If yes, describe.",null,null,null,null,null,null,1,"P",89,14,null,null,null,0,{"$f":"IF(J107=\"\",\"\",IF(D107=\"\",0,IF(D107=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D107=\"Yes\"),AND($M$1=\"Scaled\",D107>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D107=\"No\"),AND($M$1=\"Scaled\",D107<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3739,"SL.90","Is customer data accessed, transmitted, processed, or stored that can be classified as consumer report information provided by a consumer reporting agency?",null,null,null,null,null,null,1,"P",90,14,null,null,null,0,{"$f":"IF(J108=\"\",\"\",IF(D108=\"\",0,IF(D108=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D108=\"Yes\"),AND($M$1=\"Scaled\",D108>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D108=\"No\"),AND($M$1=\"Scaled\",D108<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[null,"",{"$f":"'Q. Software Security'!B1","v":"Q. Software Application Security"},null,null,null,null,null,null,null,1,90,15,null,null,null,0,{"$f":"IF(J109=\"\",\"\",IF(D109=\"\",0,IF(D109=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D109=\"Yes\"),AND($M$1=\"Scaled\",D109>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D109=\"No\"),AND($M$1=\"Scaled\",D109<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1]
[3919,"SL.91","Is software provided?  ",null,null,null,"Q. Software Application Security","N/A",null,1,"Q",91,15,null,null,null,0,{"$f":"IF(J110=\"\",\"\",IF(D110=\"\",0,IF(D110=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D110=\"Yes\"),AND($M$1=\"Scaled\",D110>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D110=\"No\"),AND($M$1=\"Scaled\",D110<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0,null,null,null,null,null,null,null,null,null,null,1]
[3920,"SL.92","Is there a secure software development lifecycle policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy? ",null,null,null,"Q.1 Secure SDLC Policies, Standards and Procedures","14.2.1 ","Secure development policy",2,"Q",92,15,null,null,null,0,{"$f":"IF(J111=\"\",\"\",IF(D111=\"\",0,IF(D111=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D111=\"Yes\"),AND($M$1=\"Scaled\",D111>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D111=\"No\"),AND($M$1=\"Scaled\",D111<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[null,"",{"$f":"'V. Cloud Security'!B1","v":"V. Cloud Security"},null,null,null,null,null,null,null,1,92,16,null,null,null,0,{"$f":"IF(J112=\"\",\"\",IF(D112=\"\",0,IF(D112=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D112=\"Yes\"),AND($M$1=\"Scaled\",D112>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D112=\"No\"),AND($M$1=\"Scaled\",D112<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":""},"",null,0,"",null,1,1]
[3304,"SL.93","Are Cloud Services provided? If yes, what service model and deployment model is provided (select all that apply):",null,null,null,"V.1 Service and Deployment Models",4.3,"Determining the scope of the information management system",1,"V",93,16,null,null,null,0,{"$f":"IF(J113=\"\",\"\",IF(D113=\"\",0,IF(D113=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D113=\"Yes\"),AND($M$1=\"Scaled\",D113>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D113=\"No\"),AND($M$1=\"Scaled\",D113<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,1,0]
[3305,"SL.94","Software as a Service (SaaS)",null,null,null,"V.1 Service and Deployment Models","N/A",null,2,"V",94,16,null,null,null,0,{"$f":"IF(J114=\"\",\"\",IF(D114=\"\",0,IF(D114=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D114=\"Yes\"),AND($M$1=\"Scaled\",D114>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D114=\"No\"),AND($M$1=\"Scaled\",D114<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0,null,null,null,null,null,null,null,null,null,null,1]
[3306,"SL.95","Platform as a Service (PaaS)",null,null,null,"V.1 Service and Deployment Models","N/A",null,2,"V",95,16,null,null,null,0,{"$f":"IF(J115=\"\",\"\",IF(D115=\"\",0,IF(D115=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D115=\"Yes\"),AND($M$1=\"Scaled\",D115>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D115=\"No\"),AND($M$1=\"Scaled\",D115<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0,null,null,null,null,null,null,null,null,null,null,1]
[3307,"SL.96","Infrastructure as a Service (IaaS)",null,null,null,"V.1 Service and Deployment Models","N/A",null,2,"V",96,16,null,null,null,0,{"$f":"IF(J116=\"\",\"\",IF(D116=\"\",0,IF(D116=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D116=\"Yes\"),AND($M$1=\"Scaled\",D116>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D116=\"No\"),AND($M$1=\"Scaled\",D116<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0,null,null,null,null,null,null,null,null,null,null,1]
[3309,"SL.97","Private cloud",null,null,null,"V.1 Service and Deployment Models","N/A",null,2,"V",97,16,null,null,null,0,{"$f":"IF(J117=\"\",\"\",IF(D117=\"\",0,IF(D117=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D117=\"Yes\"),AND($M$1=\"Scaled\",D117>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D117=\"No\"),AND($M$1=\"Scaled\",D117<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0,null,null,null,null,null,null,null,null,null,null,1]
[3310,"SL.98","Public cloud",null,null,null,"V.1 Service and Deployment Models","N/A",null,2,"V",98,16,null,null,null,0,{"$f":"IF(J118=\"\",\"\",IF(D118=\"\",0,IF(D118=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D118=\"Yes\"),AND($M$1=\"Scaled\",D118>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D118=\"No\"),AND($M$1=\"Scaled\",D118<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0,null,null,null,null,null,null,null,null,null,null,1]
[3311,"SL.99","Community cloud",null,null,null,"V.1 Service and Deployment Models","N/A",null,2,"V",99,16,null,null,null,0,{"$f":"IF(J119=\"\",\"\",IF(D119=\"\",0,IF(D119=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D119=\"Yes\"),AND($M$1=\"Scaled\",D119>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D119=\"No\"),AND($M$1=\"Scaled\",D119<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0,null,null,null,null,null,null,null,null,null,null,1]
[3312,"SL.100","Hybrid cloud",null,null,null,"V.1 Service and Deployment Models","N/A",null,2,"V",100,16,null,null,null,0,{"$f":"IF(J120=\"\",\"\",IF(D120=\"\",0,IF(D120=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D120=\"Yes\"),AND($M$1=\"Scaled\",D120>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D120=\"No\"),AND($M$1=\"Scaled\",D120<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0,null,null,null,null,null,null,null,null,null,null,1]
[3330,"SL.101","Can clients define the legal jurisdictions where their data can be transmitted, processed or stored?",null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","15.1.2","Addressing security within supplier agreements",2,"V",101,16,null,null,null,0,{"$f":"IF(J121=\"\",\"\",IF(D121=\"\",0,IF(D121=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D121=\"Yes\"),AND($M$1=\"Scaled\",D121>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D121=\"No\"),AND($M$1=\"Scaled\",D121<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3339,"SL.102","Is data segmentation and separation capability between clients provided? If yes, describe.",null,null,null,"V.1 Service and Deployment Models","11.2.6, 9.1.1","Security of equipment and assets off-premises, Access Control Policy",2,"V",102,16,null,null,null,0,{"$f":"IF(J122=\"\",\"\",IF(D122=\"\",0,IF(D122=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D122=\"Yes\"),AND($M$1=\"Scaled\",D122>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D122=\"No\"),AND($M$1=\"Scaled\",D122<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3346,"SL.103","Is Scoped Data encrypted?",null,null,null,"G.22 Data Security Policy - Encryption",10.1,"Cryptographic Controls",2,"V",103,16,null,null,null,0,{"$f":"IF(J123=\"\",\"\",IF(D123=\"\",0,IF(D123=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D123=\"Yes\"),AND($M$1=\"Scaled\",D123>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D123=\"No\"),AND($M$1=\"Scaled\",D123<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3353,"SL.104","Are clients provided with the ability to generate a unique encryption key?",null,null,null,"G.22 Data Security Policy - Encryption","10.1.2","Key Management",2,"V",104,16,null,null,null,0,{"$f":"IF(J124=\"\",\"\",IF(D124=\"\",0,IF(D124=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D124=\"Yes\"),AND($M$1=\"Scaled\",D124>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D124=\"No\"),AND($M$1=\"Scaled\",D124<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3354,"SL.105","Are clients provided with the ability to rotate their encryption key on a scheduled basis?",null,null,null,"G.22 Data Security Policy - Encryption","10.1.2","Key Management",2,"V",105,16,null,null,null,0,{"$f":"IF(J125=\"\",\"\",IF(D125=\"\",0,IF(D125=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D125=\"Yes\"),AND($M$1=\"Scaled\",D125>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D125=\"No\"),AND($M$1=\"Scaled\",D125<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3355,"SL.106","Is standards based federated ID capability available to clients (e.g., SAML, OpenID)?",null,null,null,"N/A","9.2.4","Management of secret authentication information of users.",2,"V",106,16,null,null,null,0,{"$f":"IF(J126=\"\",\"\",IF(D126=\"\",0,IF(D126=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D126=\"Yes\"),AND($M$1=\"Scaled\",D126>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D126=\"No\"),AND($M$1=\"Scaled\",D126<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3356,"SL.107","Are application self service features or an Internet accessible self-service portal available to clients? If yes, describe.",null,null,null,"N/A","11.2.6, 9.1.1","Security of equipment and assets off-premises, Access Control Policy",2,"V",107,16,null,null,null,0,{"$f":"IF(J127=\"\",\"\",IF(D127=\"\",0,IF(D127=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D127=\"Yes\"),AND($M$1=\"Scaled\",D127>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D127=\"No\"),AND($M$1=\"Scaled\",D127<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3373,"SL.108","Is there a management approved process to ensure that image snapshots containing Scoped Data are authorized prior to being snapped?",null,null,null,"N/A","N/A",null,2,"V",108,16,null,null,null,0,{"$f":"IF(J128=\"\",\"\",IF(D128=\"\",0,IF(D128=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D128=\"Yes\"),AND($M$1=\"Scaled\",D128>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D128=\"No\"),AND($M$1=\"Scaled\",D128<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3379,"SL.109","Is there a cloud audit program to address client audit and assessment requirements? If yes, describe.",null,null,null,"V.3 Cloud Audit Program","N/A",null,2,"V",109,16,null,null,null,0,{"$f":"IF(J129=\"\",\"\",IF(D129=\"\",0,IF(D129=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D129=\"Yes\"),AND($M$1=\"Scaled\",D129>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D129=\"No\"),AND($M$1=\"Scaled\",D129<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3394,"SL.110","Is an agile development methodology in operation?",null,null,null,"I.2 Secure Systems Development Lifecycle Code Reviews\nQ.5 Secure Code Review",12.5,"Control Of Operational Software",2,"V",110,16,null,null,null,0,{"$f":"IF(J130=\"\",\"\",IF(D130=\"\",0,IF(D130=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D130=\"Yes\"),AND($M$1=\"Scaled\",D130>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D130=\"No\"),AND($M$1=\"Scaled\",D130<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3401,"SL.111","Is there a formal process to ensure clients are notified prior to changes being made which may impact their service? If yes, describe.",null,null,null,"G.21 Change Control","12.1.2, 14.2.2","Change Management, System change control procedures",2,"V",111,16,null,null,null,0,{"$f":"IF(J131=\"\",\"\",IF(D131=\"\",0,IF(D131=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D131=\"Yes\"),AND($M$1=\"Scaled\",D131>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D131=\"No\"),AND($M$1=\"Scaled\",D131<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3406,"SL.112","Is there a scheduled maintenance window? If yes, what is the frequency?",null,null,null,"V.4 Security Review of Hypervisor Configuration","12.1.2, 14.2.2","Change Management, System change control procedures",2,"V",112,16,null,null,null,0,{"$f":"IF(J132=\"\",\"\",IF(D132=\"\",0,IF(D132=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D132=\"Yes\"),AND($M$1=\"Scaled\",D132>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D132=\"No\"),AND($M$1=\"Scaled\",D132<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3412,"SL.113","Is there a scheduled maintenance window which results in client downtime, If yes, what is the period of the downtime?",null,null,null,"V.4 Security Review of Hypervisor Configuration","12.1.2, 14.2.2","Change Management, System change control procedures",2,"V",113,16,null,null,null,0,{"$f":"IF(J133=\"\",\"\",IF(D133=\"\",0,IF(D133=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D133=\"Yes\"),AND($M$1=\"Scaled\",D133>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D133=\"No\"),AND($M$1=\"Scaled\",D133<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3418,"SL.114","Is there an online incident response status portal which outlines planned and unplanned outages? If yes, how long after an unplanned outage is this updated?",null,null,null,"J.1 Information Security Incident Management\nP.8 Privacy Incident and Response Management","12.1.2, 14.2.2","Change Management, System change control procedures",2,"V",114,16,null,null,null,0,{"$f":"IF(J134=\"\",\"\",IF(D134=\"\",0,IF(D134=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D134=\"Yes\"),AND($M$1=\"Scaled\",D134>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D134=\"No\"),AND($M$1=\"Scaled\",D134<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3426,"SL.115","Is there a 24x7x365 staffed phone number available to clients to report security incidents?",null,null,null,"J.1 Information Security Incident Management\nP.8 Privacy Incident and Response Management","12.1.2, 14.2.2","Change Management, System change control procedures",2,"V",{"$f":"IF(A135=\"\",L134,L134+1)","v":115},{"$f":"IF(J135=\"\",M134+1,M134)","v":16},null,null,null,{"$f":"IF(ISNA(VLOOKUP(A135,BusInfoArray,6,FALSE)),0,VLOOKUP(A135,BusInfoArray,6,FALSE))","v":0},{"$f":"IF(J135=\"\",\"\",IF(D135=\"\",0,IF(D135=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D135=\"Yes\"),AND($M$1=\"Scaled\",D135>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D135=\"No\"),AND($M$1=\"Scaled\",D135<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J135=\"\",\"\",IF(Q135>0,Q135,IF(R135>0,R135,0)))","v":0},null,{"$f":"IF(J135=\"\",U134,IF(AND(S135>1,OR(U134=\"\",U134=0,U134>=J135)),J135,IF(J135>U134,U134,0)))","v":0},{"$f":"IF(Master=\"Master\",R135,IF(V134=\"\",S135,IF(OR(AND(U135>0,S135<V134),AND(U135=1,S135<=V134)),V134,S135)))","v":0},null,{"$f":"IF(AND(J135=1,S135=1),2,IF(AND(V134=1,M135=M134),2,IF(AND(X134=2,M135=M134),2,IF(OR(J135=1,J135=\"\"),1,\"\"))))","v":""},{"$f":"IF(V135>0,1,0)","v":0}]
[3427,"SL.116","Are applications created and released into production? If yes, what is the release frequency?",null,null,null,"Q.1 Secure SDLC Policies, Standards and Procedures",12.5,"Control Of Operational Software",2,"V",116,16,null,null,null,0,{"$f":"IF(J136=\"\",\"\",IF(D136=\"\",0,IF(D136=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D136=\"Yes\"),AND($M$1=\"Scaled\",D136>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D136=\"No\"),AND($M$1=\"Scaled\",D136<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0,null,null,null,null,null,null,null,null,null,null,1]
[3436,"SL.117","Is there an automated secure source code review? If yes, what is the frequency?",null,null,null,"I.2 Secure Systems Development Lifecycle Code Reviews\nQ.5 Secure Code Review",12.5,"Control Of Operational Software",2,"V",117,16,null,null,null,0,{"$f":"IF(J137=\"\",\"\",IF(D137=\"\",0,IF(D137=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D137=\"Yes\"),AND($M$1=\"Scaled\",D137>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D137=\"No\"),AND($M$1=\"Scaled\",D137<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3445,"SL.118","Is source code security reviewed manually? If yes, what is the frequency?",null,null,null,"I.2 Secure Systems Development Lifecycle Code Reviews\nQ.5 Secure Code Review","12.2.1, 12.5","Control against malware, Control Of Operational Software",2,"V",118,16,null,null,null,0,{"$f":"IF(J138=\"\",\"\",IF(D138=\"\",0,IF(D138=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D138=\"Yes\"),AND($M$1=\"Scaled\",D138>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D138=\"No\"),AND($M$1=\"Scaled\",D138<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3454,"SL.119","Are automated penetration tests performed? If yes, what is the frequency?",null,null,null,"I.1 Application Vulnerability Assessments/Ethical Hacking",12.6,"Technical vulnerability management",2,"V",119,16,null,null,null,0,{"$f":"IF(J139=\"\",\"\",IF(D139=\"\",0,IF(D139=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D139=\"Yes\"),AND($M$1=\"Scaled\",D139>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D139=\"No\"),AND($M$1=\"Scaled\",D139<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3472,"SL.120","Are clients provided with the ability to specify where their data will be stored? If yes, describe at what level (e.g., data center, country)?",null,null,null,"P.6 Management of Client Target Privacy Data","8.2.3, 11.1, 15.1.2","Handling of assets,\nSecure areas,\nAddressing security within supplier agreements",2,"V",120,16,null,null,null,0,{"$f":"IF(J140=\"\",\"\",IF(D140=\"\",0,IF(D140=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D140=\"Yes\"),AND($M$1=\"Scaled\",D140>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D140=\"No\"),AND($M$1=\"Scaled\",D140<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3481,"SL.121","Does the ability exist to legally demonstrate sufficient data segmentation, in the event of a client subpoena or a forensics incident, so as not to impact other client's data? If using resource pooling? ",null,null,null,"V.1 Service and Deployment Models",16.100000000000001,"Management of information security incidents and improvements",2,"V",121,16,null,null,null,0,{"$f":"IF(J141=\"\",\"\",IF(D141=\"\",0,IF(D141=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D141=\"Yes\"),AND($M$1=\"Scaled\",D141>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D141=\"No\"),AND($M$1=\"Scaled\",D141<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3489,"SL.122","Is there a self-service portal or API call available to clients which provides the ability to place a \"Legal hold\" on client data which may be subject to a legal action, without impacting other clients data retention or destruction schedules?",null,null,null,"P.6 Management of Client Target Privacy Data","8.2.3, 11.1, 15.1.2, 18.1.2","Handling of assets,\nSecure areas,\nAddressing security within supplier agreements, Intellectual property rights",2,"V",122,16,null,null,null,0,{"$f":"IF(J142=\"\",\"\",IF(D142=\"\",0,IF(D142=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D142=\"Yes\"),AND($M$1=\"Scaled\",D142>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D142=\"No\"),AND($M$1=\"Scaled\",D142<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3490,"SL.123","Is a Cloud API available to clients?",null,null,null,"H.3 Logical Access Authorization","N/A",null,2,"V",123,16,null,null,null,0,{"$f":"IF(J143=\"\",\"\",IF(D143=\"\",0,IF(D143=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D143=\"Yes\"),AND($M$1=\"Scaled\",D143>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D143=\"No\"),AND($M$1=\"Scaled\",D143<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3516,"SL.124","Is there a client management portal which allows distributed business accounts (business units/departments) to be managed under a single central corporate account?",null,null,null,null,"12.1.2, 14.2.2","Change Management, System change control procedures",2,"V",124,16,null,null,null,0,{"$f":"IF(J144=\"\",\"\",IF(D144=\"\",0,IF(D144=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D144=\"Yes\"),AND($M$1=\"Scaled\",D144>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D144=\"No\"),AND($M$1=\"Scaled\",D144<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3538,"SL.125","Are staff required to use two factor authentication to remotely access the production cloud environment containing Scoped Data?",null,null,null,"I.6 Application Security Vulnerability Assessments and Remediation","9.3.1, 9.4.2, 9.4.3","Use of secret authentication information, Secure log-on procedures, Password management system",2,"V",125,16,null,null,null,0,{"$f":"IF(J145=\"\",\"\",IF(D145=\"\",0,IF(D145=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D145=\"Yes\"),AND($M$1=\"Scaled\",D145>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D145=\"No\"),AND($M$1=\"Scaled\",D145<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3548,"SL.126","Are staff able to access client Scoped Data in an unencrypted state?",null,null,null,"H.3 Logical Access Authorization","9.4.1","Information access restriction",2,"V",126,16,null,null,null,0,{"$f":"IF(J146=\"\",\"\",IF(D146=\"\",0,IF(D146=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D146=\"Yes\"),AND($M$1=\"Scaled\",D146>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D146=\"No\"),AND($M$1=\"Scaled\",D146<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3549,"SL.127","Are staff able to access client's encryption key?",null,null,null,"H.3 Logical Access Authorization","9.4.1","Information access restriction",2,"V",127,16,null,null,null,0,{"$f":"IF(J147=\"\",\"\",IF(D147=\"\",0,IF(D147=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D147=\"Yes\"),AND($M$1=\"Scaled\",D147>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D147=\"No\"),AND($M$1=\"Scaled\",D147<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3554,"SL.128","Is there a process which allows the client to specifically list who from the cloud provider, will have access to their Scoped Systems and Data? If yes, describe.",null,null,null,"H.3 Logical Access Authorization","9.1.1, 9.4.1","\tAccess Control Policy\nInformation access restriction",2,"V",128,16,null,null,null,0,{"$f":"IF(J148=\"\",\"\",IF(D148=\"\",0,IF(D148=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D148=\"Yes\"),AND($M$1=\"Scaled\",D148>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D148=\"No\"),AND($M$1=\"Scaled\",D148<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3558,"SL.129","Are staff technically prevented from accessing the cloud environment via non-managed private devices? ",null,null,null,"H.3 Logical Access Authorization","9.1.1, 9.4.1","\tAccess Control Policy\nInformation access restriction",2,"V",129,16,null,null,null,0,{"$f":"IF(J149=\"\",\"\",IF(D149=\"\",0,IF(D149=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D149=\"Yes\"),AND($M$1=\"Scaled\",D149>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D149=\"No\"),AND($M$1=\"Scaled\",D149<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3563,"SL.130","Are there controls to prevent one client attempting to compromise another client in a resource pooled environment? If yes, describe.",null,null,null,"H.3 Logical Access Authorization","9.1.1, 9.4.1","\tAccess Control Policy\nInformation access restriction",2,"V",130,16,null,null,null,0,{"$f":"IF(J150=\"\",\"\",IF(D150=\"\",0,IF(D150=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D150=\"Yes\"),AND($M$1=\"Scaled\",D150>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D150=\"No\"),AND($M$1=\"Scaled\",D150<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3568,"SL.131","Is a default hardened base virtual image available to clients?",null,null,null,"I.3 Secure Systems Hardening Standards","N/A",null,2,"V",131,16,null,null,null,0,{"$f":"IF(J151=\"\",\"\",IF(D151=\"\",0,IF(D151=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D151=\"Yes\"),AND($M$1=\"Scaled\",D151>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D151=\"No\"),AND($M$1=\"Scaled\",D151<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3590,"SL.132","Can clients run their own security services within their own cloud environment? If yes, describe.",null,null,null,"V.3 Cloud Audit Program","8.2.3, 11.1, 15.1.2, 18.1.2","Handling of assets,\nSecure areas,\nAddressing security within supplier agreements, Intellectual property rights",2,"V",132,16,null,null,null,0,{"$f":"IF(J152=\"\",\"\",IF(D152=\"\",0,IF(D152=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D152=\"Yes\"),AND($M$1=\"Scaled\",D152>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D152=\"No\"),AND($M$1=\"Scaled\",D152<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3602,"SL.133","Is there a specific Recovery Time Objective(s) (RTO)? If yes, specify the RTO for the scoped services.",null,null,null,"N/A",17.100000000000001,"Information security continuity",2,"V",133,16,null,null,null,0,{"$f":"IF(J153=\"\",\"\",IF(D153=\"\",0,IF(D153=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D153=\"Yes\"),AND($M$1=\"Scaled\",D153>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D153=\"No\"),AND($M$1=\"Scaled\",D153<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3623,"SL.134","Are the failover sites for the underlying infrastructure running on different vendor physical systems?",null,null,null,"N/A",17.100000000000001,"Information security continuity",2,"V",134,16,null,null,null,0,{"$f":"IF(J154=\"\",\"\",IF(D154=\"\",0,IF(D154=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D154=\"Yes\"),AND($M$1=\"Scaled\",D154>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D154=\"No\"),AND($M$1=\"Scaled\",D154<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3624,"SL.135","Is the critical infrastructure running active/active at two or more sites?",null,null,null,"N/A",17.100000000000001,"Information security continuity",2,"V",135,16,null,null,null,0,{"$f":"IF(J155=\"\",\"\",IF(D155=\"\",0,IF(D155=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D155=\"Yes\"),AND($M$1=\"Scaled\",D155>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D155=\"No\"),AND($M$1=\"Scaled\",D155<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3625,{"$f":"IF(A156=\"\",\"\",$Q$1&\".\"&L156)","v":"SL.136"},"Are sites failed over as part of normal operation or as part of a test? If yes, what is the frequency?",null,null,null,"N/A",17.100000000000001,"Information security continuity",2,"V",136,16,null,null,null,0,{"$f":"IF(J156=\"\",\"\",IF(D156=\"\",0,IF(D156=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D156=\"Yes\"),AND($M$1=\"Scaled\",D156>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D156=\"No\"),AND($M$1=\"Scaled\",D156<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3632,"SL.137","Are all suppliers of critical hardware, network services and facility services involved in annual continuity and recovery tests?",null,null,null,"N/A",17.100000000000001,"Information security continuity",2,"V",137,16,null,null,null,0,{"$f":"IF(J157=\"\",\"\",IF(D157=\"\",0,IF(D157=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D157=\"Yes\"),AND($M$1=\"Scaled\",D157>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D157=\"No\"),AND($M$1=\"Scaled\",D157<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3634,"SL.138","Are all critical technology service providers described on an architecture diagram that includes physical systems and facilities?",null,null,null,"N/A",17.100000000000001,"Information security continuity",2,"V",138,16,null,null,null,0,{"$f":"IF(J158=\"\",\"\",IF(D158=\"\",0,IF(D158=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D158=\"Yes\"),AND($M$1=\"Scaled\",D158>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D158=\"No\"),AND($M$1=\"Scaled\",D158<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3638,"SL.139","Is there sufficient redundancy capacity to ensure services are not impacted in multi-tenancy environments during peak usage and above?",null,null,null,"N/A",17.2,"Redundancies",2,"V",139,16,null,null,null,0,{"$f":"IF(J159=\"\",\"\",IF(D159=\"\",0,IF(D159=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D159=\"Yes\"),AND($M$1=\"Scaled\",D159>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D159=\"No\"),AND($M$1=\"Scaled\",D159<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3639,"SL.140","Do contracts include a penalty or remediation clause for breach of availability and continuity SLAs? ",null,null,null,"N/A","15.1.2, 15.2.1","Addressing security within supplier agreements, Monitoring and review of supplier services",2,"V",140,16,null,null,null,0,{"$f":"IF(J160=\"\",\"\",IF(D160=\"\",0,IF(D160=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D160=\"Yes\"),AND($M$1=\"Scaled\",D160>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D160=\"No\"),AND($M$1=\"Scaled\",D160<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]
[3649,"SL.141","Is a Hypervisor used to manage systems used to transmit, process or store Scoped Data? If yes, describe the controls used to protect the hypervisor and the managed Guest Operating Systems.",null,null,null,"V.4 Security Review of Hypervisor Configuration","N/A",null,2,"V",141,16,null,null,null,0,{"$f":"IF(J161=\"\",\"\",IF(D161=\"\",0,IF(D161=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D161=\"Yes\"),AND($M$1=\"Scaled\",D161>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D161=\"No\"),AND($M$1=\"Scaled\",D161<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,null,0,0,null,"",0]

{"sheet":"A. Risk Management","index":7,"n_rows":18,"n_cols":30,"rows_kept":18,"cut":false,"hidden":false,"merged":[[2,1,2,8]]}
[11,"A. Risk Assessment and Treatment",null,null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,"Binary","Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"A"},null,null,null,null,null,null,{"$f":"IF(OR(COUNTA(F5:F18)>0,X2>0),1,0)","v":0}]
[null,null,null,{"$f":"IF(X2=0,\"0%\",X2/T2)","v":"0%"},"Percent Complete",null,"Tab Automation:","Enable",null,{"$f":"COUNTA(J5:J18)","v":14},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(T5:T18,1)","v":14},null,null,null,{"$f":"COUNTIF(X5:X18,1)","v":0}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column F to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, select the word \"Disable\" in the Tab Automation field at the top of the page.\n     - Use the Maturity column to identify the maturity of the question. See the How To Guide for instructions on filling out this field.",null,null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter","Maturity N/A"]
[{"$f":"MAX(A5:A18)","v":3286},"Ques Num","Question/Request","Response","Maturity","Additional Information","AUP Reference","ISO 27002:2013 Relevance"]
[3198,{"$f":"IF(J5=0,\"\",IF(J5=1,Q$1&\".\"&L5,IF(J5=2,Q$1&\".\"&L5&\".\"&M5,IF(J5=3,Q$1&\".\"&L5&\".\"&M5&\".\"&N5,IF(J5=4,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5,IF(J5=5,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5&\".\"&P5))))))","v":"A.1"},"Is there a risk assessment program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the program? if yes, does it include:",null,null,null,"A.1 IT & Infrastructure Risk Governance and Context","5.1                                            6.1.2","Leadership & Commitment,                Information Security Risk Assessment",1,null,{"$f":"IF(L4=\"\",1,IF(J5=1,L4+1,L4))","v":1},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($J5=2,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($J5=3,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($J5=4,O4+1,O4)))","v":0},{"$f":"IF(P4=\"\",0,IF(O4<>O5,0,IF($J5=5,P4+1,P4)))","v":0},{"$f":"IF(OR(Master=\"Master\",J5=0,K5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,22,FALSE)),0,VLOOKUP(A5,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D5=\"Yes\"),AND($M$1=\"Scaled\",D5>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D5=\"No\"),AND($M$1=\"Scaled\",D5<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J5=\"\",\"\",IF(Q5>0,Q5,IF(R5>0,R5,0)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(J5=1,T4=\"\"),1,IF(OR(AND(K4=1,(J5-J3<>0)),AND(T4=0,J4=J5),AND(K4=1,J5=J3)),0,1)))","v":1},{"$f":"IF(J5=\"\",U4,IF(AND(S5>1,OR(U4=\"\",U4=0,U4>=J5)),J5,IF(J5>U4,U4,0)))","v":0},{"$f":"IF(Master=\"Master\",R5,IF(V4=\"\",S5,IF(OR(AND(U5>0,S5<V4),AND(U5=1,S5<=V4)),V4,S5)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(T4=1,U5=1),S5>0,AND(T6=0,W6=1)),1,0))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(U5>0,T5=1),AND(T5=1,W5=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(J5=1,S5=1),2,IF(AND(V4=1,L5=L4),2,IF(AND(AC4=2,L5=L4),2,IF(J5=1,1,\"\"))))","v":1}]
[2409,"A.1.1","A risk assessment, conducted within the last 12 months?",null,null,null,"A.2 IT & Infrastructure Risk Assessment Life Cycle",8.1999999999999993," Information security risk assessment",2,null,{"$f":"IF(L5=\"\",1,IF(J6=1,L5+1,L5))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($J6=2,M5+1,M5)))","v":1},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($J6=3,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($J6=4,O5+1,O5)))","v":0},{"$f":"IF(P5=\"\",0,IF(O5<>O6,0,IF($J6=5,P5+1,P5)))","v":0},0,{"$f":"IF(J6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D6=\"Yes\"),AND($M$1=\"Scaled\",D6>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D6=\"No\"),AND($M$1=\"Scaled\",D6<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J6=\"\",\"\",IF(Q6>0,Q6,IF(R6>0,R6,0)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(J6=1,T5=\"\"),1,IF(OR(AND(K5=1,(J6-J4<>0)),AND(T5=0,J5=J6),AND(K5=1,J6=J4)),0,1)))","v":1},{"$f":"IF(J6=\"\",U5,IF(AND(S6>1,OR(U5=\"\",U5=0,U5>=J6)),J6,IF(J6>U5,U5,0)))","v":0},0,{"$f":"IF(J6=\"\",\"\",IF(OR(AND(T5=1,U6=1),S6>0,AND(T7=0,W7=1)),1,0))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(U6>0,T6=1),AND(T6=1,W6=1)),1,0))","v":0},0,null,null,null,{"$f":"IF(AND(J6=1,S6=1),2,IF(AND(V5=1,L6=L5),2,IF(AND(AC5=2,L6=L5),2,IF(J6=1,1,\"\"))))","v":""}]
[2325,"A.1.2","Risk Governance?",null,null,null,"A.1 IT & Infrastructure Risk Governance and Context","N/A",null,2,null,1,2,0,0,0,0,{"$f":"IF(J7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D7=\"Yes\"),AND($M$1=\"Scaled\",D7>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D7=\"No\"),AND($M$1=\"Scaled\",D7<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2326,"A.1.3","Range of assets to include: people, processes, data and technology?",null,null,null,"A.1 IT & Infrastructure Risk Governance and Context","N/A",null,2,null,1,3,0,0,0,0,{"$f":"IF(J8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D8=\"Yes\"),AND($M$1=\"Scaled\",D8>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D8=\"No\"),AND($M$1=\"Scaled\",D8<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2420,"A.1.4","Range of threats to include: malicious, natural, accidental, cyber, business changes (transaction volume)?",null,null,null,"A.1 IT & Infrastructure Risk Governance and Context","6.1.2","Information Security Risk Assessment",2,null,1,4,0,0,0,0,{"$f":"IF(J9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D9=\"Yes\"),AND($M$1=\"Scaled\",D9>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D9=\"No\"),AND($M$1=\"Scaled\",D9<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2425,"A.1.5","Risk scoping?",null,null,null,"A.1 IT & Infrastructure Risk Governance and Context","6.1.2","Information Security Risk Assessment",2,null,1,5,0,0,0,0,{"$f":"IF(J10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D10=\"Yes\"),AND($M$1=\"Scaled\",D10>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D10=\"No\"),AND($M$1=\"Scaled\",D10<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2426,"A.1.6","Risk context?",null,null,null,"A.1 IT & Infrastructure Risk Governance and Context","6.1.2","Information Security Risk Assessment",2,null,1,6,0,0,0,0,{"$f":"IF(J11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D11=\"Yes\"),AND($M$1=\"Scaled\",D11>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D11=\"No\"),AND($M$1=\"Scaled\",D11<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2427,"A.1.7","Risk training plan?",null,null,null,"A.1 IT & Infrastructure Risk Governance and Context","6.1.2","Information Security Risk Assessment",2,null,1,7,0,0,0,0,{"$f":"IF(J12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D12=\"Yes\"),AND($M$1=\"Scaled\",D12>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D12=\"No\"),AND($M$1=\"Scaled\",D12<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2431,"A.1.8","Risk evaluation criteria?",null,null,null,"A.1 IT & Infrastructure Risk Governance and Context","6.1.2","Information Security Risk Assessment",2,null,1,8,0,0,0,0,{"$f":"IF(J13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D13=\"Yes\"),AND($M$1=\"Scaled\",D13>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D13=\"No\"),AND($M$1=\"Scaled\",D13<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2429,"A.1.9","Risk scenarios? If yes:",null,null,null,"A.1 IT & Infrastructure Risk Governance and Context","6.1.2","Information Security Risk Assessment",2,null,1,9,0,0,0,0,{"$f":"IF(J14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D14=\"Yes\"),AND($M$1=\"Scaled\",D14>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D14=\"No\"),AND($M$1=\"Scaled\",D14<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2430,"A.1.9.1","Have scenarios been created for a variety of events with a range of possible threats that could impact the range of assets?",null,null,null,"A.1 IT & Infrastructure Risk Governance and Context","6.1.2","Information Security Risk Assessment",3,null,1,9,1,0,0,0,{"$f":"IF(J15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D15=\"Yes\"),AND($M$1=\"Scaled\",D15>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D15=\"No\"),AND($M$1=\"Scaled\",D15<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2428,"A.1.9.2","Do the scenarios include threat types impacting all assets resulting in business impact?",null,null,null,"A.1 IT & Infrastructure Risk Governance and Context","6.1.2","Information Security Risk Assessment",3,null,1,9,2,0,0,0,{"$f":"IF(J16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D16=\"Yes\"),AND($M$1=\"Scaled\",D16>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D16=\"No\"),AND($M$1=\"Scaled\",D16<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3285,"A.1.10","Ownership, action plan, response plan, management update?",null,null,null,"A.2 IT & Infrastructure Risk Assessment Life Cycle","6.1.2","Information Security Risk Assessment",2,null,1,10,0,0,0,0,{"$f":"IF(J17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D17=\"Yes\"),AND($M$1=\"Scaled\",D17>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D17=\"No\"),AND($M$1=\"Scaled\",D17<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3286,"A.2","Are controls identified for each risk classified as: preventive, detective, corrective, predictive (technical or administrative controls)?",null,null,null,"A.2 IT & Infrastructure Risk Assessment Life Cycle","6.1.3","Information Security Risk treatment",1,null,2,0,0,0,0,0,{"$f":"IF(J18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D18=\"Yes\"),AND($M$1=\"Scaled\",D18>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D18=\"No\"),AND($M$1=\"Scaled\",D18<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,1]

{"sheet":"B. Security Policy","index":8,"n_rows":63,"n_cols":30,"rows_kept":63,"cut":false,"hidden":false,"merged":[[2,1,2,8]]}
[11,"B. Security Policy",null,null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,"Binary","Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"B"}]
[null,null,null,{"$f":"IF(X2=0,\"0%\",X2/T2)","v":"0%"},"Percent Complete",null,"Tab Automation:","Enable",null,{"$f":"COUNTA(J5:J63)","v":59},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(T5:T63,1)","v":59},null,null,null,{"$f":"COUNTIF(X5:X63,1)","v":0}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column F to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, select the word \"Disable\" in the Tab Automation field at the top of the page.\n     - Use the Maturity column to identify the maturity of the question. See the How To Guide for instructions on filling out this field.",null,null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter","Maturity N/A"]
[{"$f":"MAX(A5:A63)","v":4112},"Ques Num","Question/Request","Response","Maturity","Additional Information","AUP Reference","ISO 27002:2013 Relevance"]
[3199,{"$f":"IF(J5=0,\"\",IF(J5=1,Q$1&\".\"&L5,IF(J5=2,Q$1&\".\"&L5&\".\"&M5,IF(J5=3,Q$1&\".\"&L5&\".\"&M5&\".\"&N5,IF(J5=4,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5,IF(J5=5,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5&\".\"&P5))))))","v":"B.1"},"Is there an information security policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy? If yes, does the policy contain:",null,null,null,"B.1 Information Security Policy Content & Maintenance","5.1.1","Policies for information security",1,null,{"$f":"IF(L4=\"\",1,IF(J5=1,L4+1,L4))","v":1},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($J5=2,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($J5=3,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($J5=4,O4+1,O4)))","v":0},{"$f":"IF(P4=\"\",0,IF(O4<>O5,0,IF($J5=5,P4+1,P4)))","v":0},{"$f":"IF(OR(Master=\"Master\",J5=0,K5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,22,FALSE)),0,VLOOKUP(A5,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D5=\"Yes\"),AND($M$1=\"Scaled\",D5>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D5=\"No\"),AND($M$1=\"Scaled\",D5<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J5=\"\",\"\",IF(Q5>0,Q5,IF(R5>0,R5,0)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(J5=1,T4=\"\"),1,IF(OR(AND(K4=1,(J5-J3<>0)),AND(T4=0,J4=J5),AND(K4=1,J5=J3)),0,1)))","v":1},{"$f":"IF(J5=\"\",U4,IF(AND(S5>1,OR(U4=\"\",U4=0,U4>=J5)),J5,IF(J5>U4,U4,0)))","v":0},{"$f":"IF(Master=\"Master\",R5,IF(V4=\"\",S5,IF(OR(AND(U5>0,S5<V4),AND(U5=1,S5<=V4)),V4,S5)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(T4=1,U5=1),S5>0,AND(T6=0,W6=1)),1,0))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(U5>0,T5=1),AND(T5=1,W5=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(J5=1,S5=1),2,IF(AND(V4=1,L5=L4),2,IF(AND(AC4=2,L5=L4),2,IF(J5=1,1,\"\"))))","v":1}]
[2467,{"$f":"IF(J6=0,\"\",IF(J6=1,Q$1&\".\"&L6,IF(J6=2,Q$1&\".\"&L6&\".\"&M6,IF(J6=3,Q$1&\".\"&L6&\".\"&M6&\".\"&N6,IF(J6=4,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6,IF(J6=5,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6&\".\"&P6))))))","v":"B.1.1"},"Risk assessment?",null,null,null,"A.1 IT & Infrastructure Risk Governance","N/A",null,2,null,{"$f":"IF(L5=\"\",1,IF(J6=1,L5+1,L5))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($J6=2,M5+1,M5)))","v":1},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($J6=3,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($J6=4,O5+1,O5)))","v":0},{"$f":"IF(P5=\"\",0,IF(O5<>O6,0,IF($J6=5,P5+1,P5)))","v":0},{"$f":"IF(OR(Master=\"Master\",J6=0,K6=1),0,IF(ISNA(VLOOKUP(A6,L2_Array,22,FALSE)),0,VLOOKUP(A6,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D6=\"Yes\"),AND($M$1=\"Scaled\",D6>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D6=\"No\"),AND($M$1=\"Scaled\",D6<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J6=\"\",\"\",IF(Q6>0,Q6,IF(R6>0,R6,0)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(J6=1,T5=\"\"),1,IF(OR(AND(K5=1,(J6-J4<>0)),AND(T5=0,J5=J6),AND(K5=1,J6=J4)),0,1)))","v":1},{"$f":"IF(J6=\"\",U5,IF(AND(S6>1,OR(U5=\"\",U5=0,U5>=J6)),J6,IF(J6>U5,U5,0)))","v":0},0,{"$f":"IF(J6=\"\",\"\",IF(OR(AND(T5=1,U6=1),S6>0,AND(T7=0,W7=1)),1,0))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(U6>0,T6=1),AND(T6=1,W6=1)),1,0))","v":0},0,null,null,null,{"$f":"IF(AND(J6=1,S6=1),2,IF(AND(V5=1,L6=L5),2,IF(AND(AC5=2,L6=L5),2,IF(J6=1,1,\"\"))))","v":""}]
[45,"B.1.2","Risk management?",null,null,null,"A.1 IT & Infrastructure Risk Governance","N/A",null,2,null,1,2,0,0,0,0,{"$f":"IF(J7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D7=\"Yes\"),AND($M$1=\"Scaled\",D7>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D7=\"No\"),AND($M$1=\"Scaled\",D7<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[47,"B.1.3","Security awareness training/education?",null,null,null,null,"N/A",null,2,null,1,3,0,0,0,0,{"$f":"IF(J8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D8=\"Yes\"),AND($M$1=\"Scaled\",D8>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D8=\"No\"),AND($M$1=\"Scaled\",D8<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[24,"B.1.4","Business continuity?",null,null,null,null,"N/A",null,2,null,1,4,0,0,0,0,{"$f":"IF(J9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D9=\"Yes\"),AND($M$1=\"Scaled\",D9>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D9=\"No\"),AND($M$1=\"Scaled\",D9<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[57,"B.1.5","Consequences for non-compliance with corporate policies?",null,null,null,null,"N/A",null,2,null,1,5,0,0,0,0,{"$f":"IF(J10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D10=\"Yes\"),AND($M$1=\"Scaled\",D10>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D10=\"No\"),AND($M$1=\"Scaled\",D10<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2469,"B.1.6","Responsibilities for information security management?",null,null,null,null,"5.1.1","Policies for information security",2,null,1,6,0,0,0,0,{"$f":"IF(J11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D11=\"Yes\"),AND($M$1=\"Scaled\",D11>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D11=\"No\"),AND($M$1=\"Scaled\",D11<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[21,"B.1.7","Acceptable use?",null,null,null,null,"5.1.1","Policies for information security",2,null,1,7,0,0,0,0,{"$f":"IF(J12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D12=\"Yes\"),AND($M$1=\"Scaled\",D12>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D12=\"No\"),AND($M$1=\"Scaled\",D12<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[22,"B.1.8","Access control?",null,null,null,null,"5.1.1","Policies for information security",2,null,1,8,0,0,0,0,{"$f":"IF(J13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D13=\"Yes\"),AND($M$1=\"Scaled\",D13>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D13=\"No\"),AND($M$1=\"Scaled\",D13<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[23,"B.1.9","Application security?",null,null,null,null,"N/A",null,2,null,1,9,0,0,0,0,{"$f":"IF(J14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D14=\"Yes\"),AND($M$1=\"Scaled\",D14>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D14=\"No\"),AND($M$1=\"Scaled\",D14<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[25,"B.1.10","Change control?",null,null,null,null,"N/A",null,2,null,1,10,0,0,0,0,{"$f":"IF(J15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D15=\"Yes\"),AND($M$1=\"Scaled\",D15>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D15=\"No\"),AND($M$1=\"Scaled\",D15<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[26,"B.1.11","Clean desk?",null,null,null,null,"5.1.1","Policies for information security",2,null,1,11,0,0,0,0,{"$f":"IF(J16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D16=\"Yes\"),AND($M$1=\"Scaled\",D16>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D16=\"No\"),AND($M$1=\"Scaled\",D16<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[27,"B.1.12","Computer and communication systems access and use?",null,null,null,null,"5.1.1","Policies for information security",2,null,1,12,0,0,0,0,{"$f":"IF(J17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D17=\"Yes\"),AND($M$1=\"Scaled\",D17>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D17=\"No\"),AND($M$1=\"Scaled\",D17<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[28,"B.1.13","Data handling?",null,null,null,null,"5.1.1","Policies for information security",2,null,1,13,0,0,0,0,{"$f":"IF(J18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D18=\"Yes\"),AND($M$1=\"Scaled\",D18>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D18=\"No\"),AND($M$1=\"Scaled\",D18<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[29,"B.1.14","Desktop computing?",null,null,null,null,"N/A",null,2,null,1,14,0,0,0,0,{"$f":"IF(J19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D19=\"Yes\"),AND($M$1=\"Scaled\",D19>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D19=\"No\"),AND($M$1=\"Scaled\",D19<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[30,"B.1.15","Disaster recovery?",null,null,null,null,"N/A",null,2,null,1,15,0,0,0,0,{"$f":"IF(J20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D20=\"Yes\"),AND($M$1=\"Scaled\",D20>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D20=\"No\"),AND($M$1=\"Scaled\",D20<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[31,"B.1.16","Email?",null,null,null,null,"N/A",null,2,null,1,16,0,0,0,0,{"$f":"IF(J21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D21=\"Yes\"),AND($M$1=\"Scaled\",D21>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D21=\"No\"),AND($M$1=\"Scaled\",D21<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[32,"B.1.17","Constituent accountability?",null,null,null,null,"5.1.1","Policies for information security",2,null,1,17,0,0,0,0,{"$f":"IF(J22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D22=\"Yes\"),AND($M$1=\"Scaled\",D22>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D22=\"No\"),AND($M$1=\"Scaled\",D22<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[33,"B.1.18","Encryption?",null,null,null,null,"N/A",null,2,null,1,18,0,0,0,0,{"$f":"IF(J23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D23=\"Yes\"),AND($M$1=\"Scaled\",D23>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D23=\"No\"),AND($M$1=\"Scaled\",D23<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[34,"B.1.19","Exception process?",null,null,null,null,"5.1.1","Policies for information security",2,null,1,19,0,0,0,0,{"$f":"IF(J24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D24=\"Yes\"),AND($M$1=\"Scaled\",D24>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D24=\"No\"),AND($M$1=\"Scaled\",D24<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[35,"B.1.20","Information classification?",null,null,null,null,"5.1.1","Policies for information security",2,null,1,20,0,0,0,0,{"$f":"IF(J25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D25=\"Yes\"),AND($M$1=\"Scaled\",D25>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D25=\"No\"),AND($M$1=\"Scaled\",D25<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[36,"B.1.21","Internet/Intranet access and use?",null,null,null,null,"N/A",null,2,null,1,21,0,0,0,0,{"$f":"IF(J26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D26=\"Yes\"),AND($M$1=\"Scaled\",D26>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D26=\"No\"),AND($M$1=\"Scaled\",D26<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[37,"B.1.22","Mobile computing?",null,null,null,null,"N/A",null,2,null,1,22,0,0,0,0,{"$f":"IF(J27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D27=\"Yes\"),AND($M$1=\"Scaled\",D27>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D27=\"No\"),AND($M$1=\"Scaled\",D27<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[38,"B.1.23","Network security?",null,null,null,null,"N/A",null,2,null,1,23,0,0,0,0,{"$f":"IF(J28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D28=\"Yes\"),AND($M$1=\"Scaled\",D28>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D28=\"No\"),AND($M$1=\"Scaled\",D28<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[39,"B.1.24","Operating system security?",null,null,null,null,"N/A",null,2,null,1,24,0,0,0,0,{"$f":"IF(J29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D29=\"Yes\"),AND($M$1=\"Scaled\",D29>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D29=\"No\"),AND($M$1=\"Scaled\",D29<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[40,"B.1.25","Personnel security and termination?",null,null,null,null,"5.1.1","Policies for information security",2,null,1,25,0,0,0,0,{"$f":"IF(J30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D30=\"Yes\"),AND($M$1=\"Scaled\",D30>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D30=\"No\"),AND($M$1=\"Scaled\",D30<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[41,"B.1.26","Physical access?",null,null,null,null,"5.1.1","Policies for information security",2,null,1,26,0,0,0,0,{"$f":"IF(J31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D31=\"Yes\"),AND($M$1=\"Scaled\",D31>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D31=\"No\"),AND($M$1=\"Scaled\",D31<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[42,"B.1.27","Policy maintenance?",null,null,null,null,"5.1.1","Policies for information security",2,null,1,27,0,0,0,0,{"$f":"IF(J32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D32=\"Yes\"),AND($M$1=\"Scaled\",D32>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D32=\"No\"),AND($M$1=\"Scaled\",D32<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[44,"B.1.28","Remote access?",null,null,null,null,"N/A",null,2,null,1,28,0,0,0,0,{"$f":"IF(J33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D33=\"Yes\"),AND($M$1=\"Scaled\",D33>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D33=\"No\"),AND($M$1=\"Scaled\",D33<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[48,"B.1.29","Security incident and privacy event management?",null,null,null,null,"5.1.1","Policies for information security",2,null,1,29,0,0,0,0,{"$f":"IF(J34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D34=\"Yes\"),AND($M$1=\"Scaled\",D34>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D34=\"No\"),AND($M$1=\"Scaled\",D34<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[46,"B.1.30","Secure disposal?",null,null,null,null,"N/A",null,2,null,1,30,0,0,0,0,{"$f":"IF(J35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D35=\"Yes\"),AND($M$1=\"Scaled\",D35>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D35=\"No\"),AND($M$1=\"Scaled\",D35<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3287,"B.1.31","Social media, social networking?",null,null,null,null,"N/A",null,2,null,1,31,0,0,0,0,{"$f":"IF(J36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D36=\"Yes\"),AND($M$1=\"Scaled\",D36>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D36=\"No\"),AND($M$1=\"Scaled\",D36<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[50,"B.1.32","Vulnerability management?",null,null,null,null,"5.1.1","Policies for information security",2,null,1,32,0,0,0,0,{"$f":"IF(J37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D37=\"Yes\"),AND($M$1=\"Scaled\",D37>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D37=\"No\"),AND($M$1=\"Scaled\",D37<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,{"$f":"IF(Master=\"Master\",R37,IF(V36=\"\",S37,IF(OR(AND(U37>0,S37<V36),AND(U37=1,S37<=V36)),V36,S37)))","v":0},0,0,{"$f":"IF(ISNA(VLOOKUP(A37,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,""]
[4112,"B.1.33","Terms of Use for Mobile Devices?",null,null,null,null,"N/A",null,2,null,1,33,0,0,0,0,{"$f":"IF(J38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D38=\"Yes\"),AND($M$1=\"Scaled\",D38>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D38=\"No\"),AND($M$1=\"Scaled\",D38<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2471,"B.1.34","Have the policies been reviewed in the last 12 months? If yes, did the review include:",null,null,null,"B.1 Procedure: b.2","5.1.2","Review of the policies for information security",2,null,1,34,0,0,0,0,{"$f":"IF(J39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D39=\"Yes\"),AND($M$1=\"Scaled\",D39>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D39=\"No\"),AND($M$1=\"Scaled\",D39<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,"",1]
[2473,"B.1.34.1","Feedback from interested parties?",null,null,null,null,"5.1.2","Review of the policies for information security",3,null,1,34,1,0,0,0,{"$f":"IF(J40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D40=\"Yes\"),AND($M$1=\"Scaled\",D40>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D40=\"No\"),AND($M$1=\"Scaled\",D40<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2474,"B.1.34.2","Results of independent reviews?",null,null,null,null,"5.1.2","Review of the policies for information security",3,null,1,34,2,0,0,0,{"$f":"IF(J41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D41=\"Yes\"),AND($M$1=\"Scaled\",D41>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D41=\"No\"),AND($M$1=\"Scaled\",D41<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2478,"B.1.34.3","Policy compliance?",null,null,null,null,"5.1.2","Review of the policies for information security",3,null,1,34,3,0,0,0,{"$f":"IF(J42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D42=\"Yes\"),AND($M$1=\"Scaled\",D42>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D42=\"No\"),AND($M$1=\"Scaled\",D42<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2479,"B.1.34.4","Changes that could affect the approach to managing information security?",null,null,null,null,"5.1.2","Review of the policies for information security",3,null,1,34,4,0,0,0,{"$f":"IF(J43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D43=\"Yes\"),AND($M$1=\"Scaled\",D43>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D43=\"No\"),AND($M$1=\"Scaled\",D43<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2481,"B.1.34.5","Reported information security incidents?",null,null,null,null,"5.1.2","Review of the policies for information security",3,null,1,34,5,0,0,0,{"$f":"IF(J44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D44=\"Yes\"),AND($M$1=\"Scaled\",D44>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D44=\"No\"),AND($M$1=\"Scaled\",D44<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2482,"B.1.34.6","Recommendations provided by relevant authorities?",null,null,null,null,"5.1.2","Review of the policies for information security",3,null,1,34,6,0,0,0,{"$f":"IF(J45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D45=\"Yes\"),AND($M$1=\"Scaled\",D45>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D45=\"No\"),AND($M$1=\"Scaled\",D45<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2483,"B.1.34.7","Records management?",null,null,null,null,"5.1.2","Review of the policies for information security",3,null,1,34,7,0,0,0,{"$f":"IF(J46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D46=\"Yes\"),AND($M$1=\"Scaled\",D46>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D46=\"No\"),AND($M$1=\"Scaled\",D46<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[53,"B.1.35","Is there a process to approve exceptions to the policy? ",null,null,null,null,"5.1.2","Review of the policies for information security",2,null,1,35,0,0,0,0,{"$f":"IF(J47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D47=\"Yes\"),AND($M$1=\"Scaled\",D47>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D47=\"No\"),AND($M$1=\"Scaled\",D47<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[54,"B.1.35.1","Does security own the approval process?",null,null,null,null,"N/A",null,3,null,1,35,1,0,0,0,{"$f":"IF(J48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D48=\"Yes\"),AND($M$1=\"Scaled\",D48>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D48=\"No\"),AND($M$1=\"Scaled\",D48<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[19,"B.1.36","Is the information security policy communicated? If yes, is it communicated to:",null,null,null,null,"5.1.1","Policies for information security",2,null,1,36,0,0,0,0,{"$f":"IF(J49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D49=\"Yes\"),AND($M$1=\"Scaled\",D49>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D49=\"No\"),AND($M$1=\"Scaled\",D49<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[223,"B.1.36.1","Full time constituents?",null,null,null,null,"5.1.1","Policies for information security",3,null,1,36,1,0,0,0,{"$f":"IF(J50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D50=\"Yes\"),AND($M$1=\"Scaled\",D50>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D50=\"No\"),AND($M$1=\"Scaled\",D50<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[224,"B.1.36.2","Part time constituents?",null,null,null,null,"5.1.1","Policies for information security",3,null,1,36,2,0,0,0,{"$f":"IF(J51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D51=\"Yes\"),AND($M$1=\"Scaled\",D51>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D51=\"No\"),AND($M$1=\"Scaled\",D51<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[225,"B.1.36.3","Contractors?",null,null,null,null,"5.1.1","Policies for information security",3,null,1,36,3,0,0,0,{"$f":"IF(J52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D52=\"Yes\"),AND($M$1=\"Scaled\",D52>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D52=\"No\"),AND($M$1=\"Scaled\",D52<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3886,"B.2","Is there a vendor management program?",null,null,null,"B.3 Vendor Management Program","N/A",null,1,null,2,0,0,0,0,0,{"$f":"IF(J53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D53=\"Yes\"),AND($M$1=\"Scaled\",D53>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D53=\"No\"),AND($M$1=\"Scaled\",D53<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[3887,"B.2.1","Does the vendor management program include an individual or group responsible for capturing, maintaining and tracking subcontractor information security issues? If yes, is there:",null,null,null,null,"N/A",null,2,null,2,1,0,0,0,0,{"$f":"IF(J54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D54=\"Yes\"),AND($M$1=\"Scaled\",D54>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D54=\"No\"),AND($M$1=\"Scaled\",D54<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3888,"B.2.1.1","Risk rating of the issue (e.g., H/M/L, 1-5, etc.)?",null,null,null,"B.3 Procedure: b.1","N/A",null,3,null,2,1,1,0,0,0,{"$f":"IF(J55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D55=\"Yes\"),AND($M$1=\"Scaled\",D55>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D55=\"No\"),AND($M$1=\"Scaled\",D55<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3889,"B.2.1.2","Documented corrective action or remediation plan?",null,null,null,"B.3 Procedure: b.2","N/A",null,3,null,2,1,2,0,0,0,{"$f":"IF(J56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D56=\"Yes\"),AND($M$1=\"Scaled\",D56>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D56=\"No\"),AND($M$1=\"Scaled\",D56<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3890,"B.2.1.3","Target remediation date?",null,null,null,"B.3 Procedure: b.3","N/A",null,3,null,2,1,3,0,0,0,{"$f":"IF(J57=\"\",\"\",IF(D57=\"\",0,IF(D57=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D57=\"Yes\"),AND($M$1=\"Scaled\",D57>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D57=\"No\"),AND($M$1=\"Scaled\",D57<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3891,"B.2.1.4","On-going communication with subcontractor to discuss status of remediation? ",null,null,null,"B.3 Procedure: b.4","N/A",null,3,null,2,1,4,0,0,0,{"$f":"IF(J58=\"\",\"\",IF(D58=\"\",0,IF(D58=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D58=\"Yes\"),AND($M$1=\"Scaled\",D58>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D58=\"No\"),AND($M$1=\"Scaled\",D58<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3892,"B.2.1.5","Escalation procedure if the remediation date is not met?",null,null,null,"B.3 Procedure: b.5","N/A",null,3,null,2,1,5,0,0,0,{"$f":"IF(J59=\"\",\"\",IF(D59=\"\",0,IF(D59=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D59=\"Yes\"),AND($M$1=\"Scaled\",D59>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D59=\"No\"),AND($M$1=\"Scaled\",D59<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3893,"B.2.1.6","Sign-off when remediation is fully implemented?",null,null,null,"B.3 Procedure: b.6","N/A",null,3,null,2,1,6,0,0,0,{"$f":"IF(J60=\"\",\"\",IF(D60=\"\",0,IF(D60=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D60=\"Yes\"),AND($M$1=\"Scaled\",D60>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D60=\"No\"),AND($M$1=\"Scaled\",D60<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3894,"B.2.1.7","Reporting on remediation? If yes, does it include:",null,null,null,"B.3 Procedure: b.7","N/A",null,3,null,2,1,7,0,0,0,{"$f":"IF(J61=\"\",\"\",IF(D61=\"\",0,IF(D61=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D61=\"Yes\"),AND($M$1=\"Scaled\",D61>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D61=\"No\"),AND($M$1=\"Scaled\",D61<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3895,"B.2.1.7.1","Identification of stakeholders?",null,null,null,null,"N/A",null,4,null,2,1,7,1,0,0,{"$f":"IF(J62=\"\",\"\",IF(D62=\"\",0,IF(D62=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D62=\"Yes\"),AND($M$1=\"Scaled\",D62>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D62=\"No\"),AND($M$1=\"Scaled\",D62<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3896,"B.2.1.7.2","Reporting frequency?",null,null,null,null,"N/A",null,4,null,2,1,7,2,0,0,{"$f":"IF(J63=\"\",\"\",IF(D63=\"\",0,IF(D63=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D63=\"Yes\"),AND($M$1=\"Scaled\",D63>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D63=\"No\"),AND($M$1=\"Scaled\",D63<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]

{"sheet":"C. Organizational Security","index":9,"n_rows":60,"n_cols":30,"rows_kept":60,"cut":false,"hidden":false,"merged":[[2,1,2,8]]}
[11,"C. Organizational Security",null,null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,"Binary","Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"C"}]
[null,null,null,{"$f":"IF(X2=0,\"0%\",X2/T2)","v":"0%"},"Percent Complete",null,"Tab Automation:","Enable",null,{"$f":"COUNTA(J5:J60)","v":56},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(T5:T60,1)","v":56},null,null,null,{"$f":"COUNTIF(X5:X60,1)","v":0}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column F to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, select the word \"Disable\" in the Tab Automation field at the top of the page.\n     - Use the Maturity column to identify the maturity of the question. See the How To Guide for instructions on filling out this field.",null,null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter","Maturity N/A"]
[{"$f":"MAX(A5:A60)","v":2889},"Ques Num","Question/Request","Response","Maturity","Additional Information","AUP Reference","ISO 27002:2013 Relevance"]
[58,{"$f":"IF(J5=0,\"\",IF(J5=1,Q$1&\".\"&L5,IF(J5=2,Q$1&\".\"&L5&\".\"&M5,IF(J5=3,Q$1&\".\"&L5&\".\"&M5&\".\"&N5,IF(J5=4,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5,IF(J5=5,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5&\".\"&P5))))))","v":"C.1"},"Is there a respondent information security function responsible for security initiatives? If yes, does it include:",null,null,null,"C.2 Security Organization Roles/Responsibilities","6.1.1","Information Security Roles and Responsibilities",1,null,{"$f":"IF(L4=\"\",1,IF(J5=1,L4+1,L4))","v":1},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($J5=2,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($J5=3,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($J5=4,O4+1,O4)))","v":0},{"$f":"IF(P4=\"\",0,IF(O4<>O5,0,IF($J5=5,P4+1,P4)))","v":0},{"$f":"IF(OR(Master=\"Master\",J5=0,K5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,22,FALSE)),0,VLOOKUP(A5,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D5=\"Yes\"),AND($M$1=\"Scaled\",D5>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D5=\"No\"),AND($M$1=\"Scaled\",D5<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J5=\"\",\"\",IF(Q5>0,Q5,IF(R5>0,R5,0)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(J5=1,T4=\"\"),1,IF(OR(AND(K4=1,(J5-J3<>0)),AND(T4=0,J4=J5),AND(K4=1,J5=J3)),0,1)))","v":1},{"$f":"IF(J5=\"\",U4,IF(AND(S5>1,OR(U4=\"\",U4=0,U4>=J5)),J5,IF(J5>U4,U4,0)))","v":0},{"$f":"IF(Master=\"Master\",R5,IF(V4=\"\",S5,IF(OR(AND(U5>0,S5<V4),AND(U5=1,S5<=V4)),V4,S5)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(T4=1,U5=1),S5>0,AND(T6=0,W6=1)),1,0))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(U5>0,T5=1),AND(T5=1,W5=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(J5=1,S5=1),2,IF(AND(V4=1,L5=L4),2,IF(AND(AC4=2,L5=L4),2,IF(J5=1,1,\"\"))))","v":1}]
[61,{"$f":"IF(J6=0,\"\",IF(J6=1,Q$1&\".\"&L6,IF(J6=2,Q$1&\".\"&L6&\".\"&M6,IF(J6=3,Q$1&\".\"&L6&\".\"&M6&\".\"&N6,IF(J6=4,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6,IF(J6=5,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6&\".\"&P6))))))","v":"C.1.1"},"Creation, review and approve of information security policies?",null,null,null,null,"5.1.2","Review of the policies for information security",2,null,{"$f":"IF(L5=\"\",1,IF(J6=1,L5+1,L5))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($J6=2,M5+1,M5)))","v":1},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($J6=3,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($J6=4,O5+1,O5)))","v":0},{"$f":"IF(P5=\"\",0,IF(O5<>O6,0,IF($J6=5,P5+1,P5)))","v":0},0,{"$f":"IF(J6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D6=\"Yes\"),AND($M$1=\"Scaled\",D6>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D6=\"No\"),AND($M$1=\"Scaled\",D6<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J6=\"\",\"\",IF(Q6>0,Q6,IF(R6>0,R6,0)))","v":0},1,{"$f":"IF(J6=\"\",U5,IF(AND(S6>1,OR(U5=\"\",U5=0,U5>=J6)),J6,IF(J6>U5,U5,0)))","v":0},0,{"$f":"IF(J6=\"\",\"\",IF(OR(AND(T5=1,U6=1),S6>0,AND(T7=0,W7=1)),1,0))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(U6>0,T6=1),AND(T6=1,W6=1)),1,0))","v":0},0,null,null,null,{"$f":"IF(AND(J6=1,S6=1),2,IF(AND(V5=1,L6=L5),2,IF(AND(AC5=2,L6=L5),2,IF(J6=1,1,\"\"))))","v":""}]
[2488,"C.1.2","Review the effectiveness of information security policy implementation?",null,null,null,null,"5.1.2","Management commitment to information security",2,null,1,2,0,0,0,0,{"$f":"IF(J7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D7=\"Yes\"),AND($M$1=\"Scaled\",D7>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D7=\"No\"),AND($M$1=\"Scaled\",D7<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2490,"C.1.3","Manage assignment of specific roles and responsibilities for information security?",null,null,null,null,"6.1.1.c","Management commitment to information security",2,null,1,3,0,0,0,0,{"$f":"IF(J8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D8=\"Yes\"),AND($M$1=\"Scaled\",D8>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D8=\"No\"),AND($M$1=\"Scaled\",D8<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[65,"C.1.4","Develop and maintain an overall strategic security plan?",null,null,null,null,6.1,"Internal Organization",2,null,1,4,0,0,0,0,{"$f":"IF(J9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D9=\"Yes\"),AND($M$1=\"Scaled\",D9>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D9=\"No\"),AND($M$1=\"Scaled\",D9<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2494,"C.1.5","Consistent implementation of information security across different parts of the respondent's organization?",null,null,null,null,"5.1.1","Policies for Information security",2,null,1,5,0,0,0,0,{"$f":"IF(J10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D10=\"Yes\"),AND($M$1=\"Scaled\",D10>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D10=\"No\"),AND($M$1=\"Scaled\",D10<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[63,"C.1.6","Review and monitor information security / privacy incidents or events?",null,null,null,null,"18.2.1","Independent review of information security",2,null,1,6,0,0,0,0,{"$f":"IF(J11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D11=\"Yes\"),AND($M$1=\"Scaled\",D11>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D11=\"No\"),AND($M$1=\"Scaled\",D11<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[62,"C.1.7","Monitor significant changes in the exposure of information assets?",null,null,null,null,"6.1.1","Information Security Roles and Responsibilities",2,null,1,7,0,0,0,0,{"$f":"IF(J12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D12=\"Yes\"),AND($M$1=\"Scaled\",D12>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D12=\"No\"),AND($M$1=\"Scaled\",D12<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2500,"C.1.8","Contacts with information security special interest groups, specialist security forums, or professional associations?",null,null,null,null,"6.1.4","Contact with special interest groups",2,null,1,8,0,0,0,0,{"$f":"IF(J13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D13=\"Yes\"),AND($M$1=\"Scaled\",D13>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D13=\"No\"),AND($M$1=\"Scaled\",D13<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[67,"C.1.9","Identify and document instances of non-compliance with security policies?",null,null,null,null,"18.2.2","Compliance with security policies and standards",2,null,1,9,0,0,0,0,{"$f":"IF(J14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D14=\"Yes\"),AND($M$1=\"Scaled\",D14>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D14=\"No\"),AND($M$1=\"Scaled\",D14<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2889,"C.1.10","Identify key Information Technology roles?",null,null,null,null,"6.1.1","Information Security Roles and Responsibilities",2,null,1,10,0,0,0,0,{"$f":"IF(J15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D15=\"Yes\"),AND($M$1=\"Scaled\",D15>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D15=\"No\"),AND($M$1=\"Scaled\",D15<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[71,"C.2","Do external parties have access to Scoped Systems and Data or processing facilities? If yes, is:",null,null,null,null,15,"Supplier relationships",1,null,2,0,0,0,0,0,{"$f":"IF(J16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D16=\"Yes\"),AND($M$1=\"Scaled\",D16>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D16=\"No\"),AND($M$1=\"Scaled\",D16<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1,1]
[2512,"C.2.1","Access prohibited prior to a risk assessment being conducted?",null,null,null,null,"15.1.1","Information security policy for supplier relationships",2,null,2,1,0,0,0,0,{"$f":"IF(J17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D17=\"Yes\"),AND($M$1=\"Scaled\",D17>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D17=\"No\"),AND($M$1=\"Scaled\",D17<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2514,"C.2.2","A risk assessment performed on third parties?",null,null,null,null,"15.1.1","Information security policy for supplier relationships",2,null,2,2,0,0,0,0,{"$f":"IF(J18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D18=\"Yes\"),AND($M$1=\"Scaled\",D18>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D18=\"No\"),AND($M$1=\"Scaled\",D18<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[101,"C.2.3","A controls assessment performed on third parties?",null,null,null,null,"15.1.1","Information security policy for supplier relationships",2,null,2,3,0,0,0,0,{"$f":"IF(J19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D19=\"Yes\"),AND($M$1=\"Scaled\",D19>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D19=\"No\"),AND($M$1=\"Scaled\",D19<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2516,"C.2.4","Agreements in place when customers access Scoped Systems and Data?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",2,null,2,4,0,0,0,0,{"$f":"IF(J20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D20=\"Yes\"),AND($M$1=\"Scaled\",D20>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D20=\"No\"),AND($M$1=\"Scaled\",D20<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2501,"C.2.5","Does management require the use of confidentiality or non-disclosure agreements for all third parties? If yes, do they contain:",null,null,null,null,"7.1.2.a","Terms and conditions of employment",2,null,2,5,0,0,0,0,{"$f":"IF(J21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D21=\"Yes\"),AND($M$1=\"Scaled\",D21>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D21=\"No\"),AND($M$1=\"Scaled\",D21<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2506,"C.2.5.1","Ownership of information, trade secrets and intellectual property?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,5,1,0,0,0,{"$f":"IF(J22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D22=\"Yes\"),AND($M$1=\"Scaled\",D22>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D22=\"No\"),AND($M$1=\"Scaled\",D22<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2507,"C.2.5.2","Permitted use of confidential information, and granting of rights to the signatory to use information?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,5,2,0,0,0,{"$f":"IF(J23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D23=\"Yes\"),AND($M$1=\"Scaled\",D23>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D23=\"No\"),AND($M$1=\"Scaled\",D23<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2509,"C.2.5.3","Process for notification and reporting of unauthorized disclosure or confidential information breaches?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,5,3,0,0,0,{"$f":"IF(J24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D24=\"Yes\"),AND($M$1=\"Scaled\",D24>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D24=\"No\"),AND($M$1=\"Scaled\",D24<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2511,"C.2.5.4","Expected actions to be taken in case of a breach of this agreement?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,5,4,0,0,0,{"$f":"IF(J25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D25=\"Yes\"),AND($M$1=\"Scaled\",D25>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D25=\"No\"),AND($M$1=\"Scaled\",D25<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[72,"C.2.6","Are there contracts with third party service providers who have access to Scoped Systems and Data ? If yes, do they include: ",null,null,null,"C.1 Service Provider Agreements","15.1.2","Addressing security within supplier agreements",2,null,2,6,0,0,0,0,{"$f":"IF(J26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D26=\"Yes\"),AND($M$1=\"Scaled\",D26>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D26=\"No\"),AND($M$1=\"Scaled\",D26<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[74,"C.2.6.1","Non-Disclosure Agreement?",null,null,null,"C.1 Procedure: d.2",null,null,3,null,2,6,1,0,0,0,{"$f":"IF(J27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D27=\"Yes\"),AND($M$1=\"Scaled\",D27>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D27=\"No\"),AND($M$1=\"Scaled\",D27<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[73,"C.2.6.2","Confidentiality Agreement?",null,null,null,"C.1 Procedure: d.2",null,null,3,null,2,6,2,0,0,0,{"$f":"IF(J28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D28=\"Yes\"),AND($M$1=\"Scaled\",D28>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D28=\"No\"),AND($M$1=\"Scaled\",D28<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[88,"C.2.6.3","Media handling?",null,null,null,null,null,null,3,null,2,6,3,0,0,0,{"$f":"IF(J29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D29=\"Yes\"),AND($M$1=\"Scaled\",D29>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D29=\"No\"),AND($M$1=\"Scaled\",D29<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[100,"C.2.6.4","Requirement of an awareness program to communicate security standards and expectations?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,4,0,0,0,{"$f":"IF(J30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D30=\"Yes\"),AND($M$1=\"Scaled\",D30>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D30=\"No\"),AND($M$1=\"Scaled\",D30<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2517,"C.2.6.5","Responsibilities regarding hardware and software installation and maintenance?",null,null,null,null,null,null,3,null,2,6,5,0,0,0,{"$f":"IF(J31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D31=\"Yes\"),AND($M$1=\"Scaled\",D31>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D31=\"No\"),AND($M$1=\"Scaled\",D31<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2518,"C.2.6.6","Clear reporting structure and agreed reporting formats?",null,null,null,null,"15.2.1","Monitoring and review of supplier services",3,null,2,6,6,0,0,0,{"$f":"IF(J32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D32=\"Yes\"),AND($M$1=\"Scaled\",D32>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D32=\"No\"),AND($M$1=\"Scaled\",D32<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2519,"C.2.6.7","Clear and specified process of change management?",null,null,null,null,null,null,3,null,2,6,7,0,0,0,{"$f":"IF(J33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D33=\"Yes\"),AND($M$1=\"Scaled\",D33>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D33=\"No\"),AND($M$1=\"Scaled\",D33<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[80,"C.2.6.8","Notification of change?",null,null,null,null,null,null,3,null,2,6,8,0,0,0,{"$f":"IF(J34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D34=\"Yes\"),AND($M$1=\"Scaled\",D34>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D34=\"No\"),AND($M$1=\"Scaled\",D34<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[99,"C.2.6.9","Process to address any identified issues?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,9,0,0,0,{"$f":"IF(J35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D35=\"Yes\"),AND($M$1=\"Scaled\",D35>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D35=\"No\"),AND($M$1=\"Scaled\",D35<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2520,"C.2.6.10","Access control policy?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,10,0,0,0,{"$f":"IF(J36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D36=\"Yes\"),AND($M$1=\"Scaled\",D36>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D36=\"No\"),AND($M$1=\"Scaled\",D36<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[81,"C.2.6.11","Breach notification?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,11,0,0,{"$f":"IF(OR(Master=\"Master\",J37=0,K37=1),0,IF(ISNA(VLOOKUP(A37,L2_Array,22,FALSE)),0,VLOOKUP(A37,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D37=\"Yes\"),AND($M$1=\"Scaled\",D37>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D37=\"No\"),AND($M$1=\"Scaled\",D37<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,{"$f":"IF(Master=\"Master\",R37,IF(V36=\"\",S37,IF(OR(AND(U37>0,S37<V36),AND(U37=1,S37<=V36)),V36,S37)))","v":0},0,0,{"$f":"IF(ISNA(VLOOKUP(A37,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,""]
[2521,"C.2.6.12","Description of the product or service to be provided?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,12,0,0,0,{"$f":"IF(J38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D38=\"Yes\"),AND($M$1=\"Scaled\",D38>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D38=\"No\"),AND($M$1=\"Scaled\",D38<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2522,"C.2.6.13","Description of the information to be made available along with its security classification?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,13,0,0,0,{"$f":"IF(J39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D39=\"Yes\"),AND($M$1=\"Scaled\",D39>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D39=\"No\"),AND($M$1=\"Scaled\",D39<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[82,"C.2.6.14","SLAs?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,14,0,0,0,{"$f":"IF(J40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D40=\"Yes\"),AND($M$1=\"Scaled\",D40>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D40=\"No\"),AND($M$1=\"Scaled\",D40<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[76,"C.2.6.15","Audit reporting?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,15,0,0,0,{"$f":"IF(J41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D41=\"Yes\"),AND($M$1=\"Scaled\",D41>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D41=\"No\"),AND($M$1=\"Scaled\",D41<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[92,"C.2.6.16","Ongoing monitoring?",null,null,null,null,"15.1.3","Information and Communication technology supply chain",3,null,2,6,16,0,0,0,{"$f":"IF(J42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D42=\"Yes\"),AND($M$1=\"Scaled\",D42>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D42=\"No\"),AND($M$1=\"Scaled\",D42<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[98,"C.2.6.17","A process to regularly monitor to ensure compliance with security standards?",null,null,null,null,"15.1.3","Information and Communication technology supply chain",3,null,2,6,17,0,0,0,{"$f":"IF(J43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D43=\"Yes\"),AND($M$1=\"Scaled\",D43>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D43=\"No\"),AND($M$1=\"Scaled\",D43<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[77,"C.2.6.18","Onsite review?",null,null,null,null,"15.1.3","Information and Communication technology supply chain",3,null,2,6,18,0,0,0,{"$f":"IF(J44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D44=\"Yes\"),AND($M$1=\"Scaled\",D44>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D44=\"No\"),AND($M$1=\"Scaled\",D44<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[78,"C.2.6.19","Right to audit?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,19,0,0,0,{"$f":"IF(J45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D45=\"Yes\"),AND($M$1=\"Scaled\",D45>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D45=\"No\"),AND($M$1=\"Scaled\",D45<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[79,"C.2.6.20","Right to inspect?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,20,0,0,0,{"$f":"IF(J46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D46=\"Yes\"),AND($M$1=\"Scaled\",D46>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D46=\"No\"),AND($M$1=\"Scaled\",D46<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[91,"C.2.6.21","Problem reporting and escalation procedures?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,21,0,0,0,{"$f":"IF(J47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D47=\"Yes\"),AND($M$1=\"Scaled\",D47>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D47=\"No\"),AND($M$1=\"Scaled\",D47<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[96,"C.2.6.22","Business resumption responsibilities?",null,null,null,null,null,null,3,null,2,6,22,0,0,0,{"$f":"IF(J48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D48=\"Yes\"),AND($M$1=\"Scaled\",D48>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D48=\"No\"),AND($M$1=\"Scaled\",D48<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[85,"C.2.6.23","Indemnification/liability?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,23,0,0,0,{"$f":"IF(J49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D49=\"Yes\"),AND($M$1=\"Scaled\",D49>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D49=\"No\"),AND($M$1=\"Scaled\",D49<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[87,"C.2.6.24","Privacy requirements?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,24,0,0,0,{"$f":"IF(J50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D50=\"Yes\"),AND($M$1=\"Scaled\",D50>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D50=\"No\"),AND($M$1=\"Scaled\",D50<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[90,"C.2.6.25","Dispute resolution?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,25,0,0,0,{"$f":"IF(J51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D51=\"Yes\"),AND($M$1=\"Scaled\",D51>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D51=\"No\"),AND($M$1=\"Scaled\",D51<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[94,"C.2.6.26","Choice of venue?",null,null,null,null,null,null,3,null,2,6,26,0,0,0,{"$f":"IF(J52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D52=\"Yes\"),AND($M$1=\"Scaled\",D52>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D52=\"No\"),AND($M$1=\"Scaled\",D52<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[83,"C.2.6.27","Data ownership?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,27,0,0,0,{"$f":"IF(J53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D53=\"Yes\"),AND($M$1=\"Scaled\",D53>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D53=\"No\"),AND($M$1=\"Scaled\",D53<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[95,"C.2.6.28","Ownership of intellectual property?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,28,0,0,0,{"$f":"IF(J54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D54=\"Yes\"),AND($M$1=\"Scaled\",D54>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D54=\"No\"),AND($M$1=\"Scaled\",D54<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2523,"C.2.6.29","Involvement of the third party with subcontractors?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,29,0,0,0,{"$f":"IF(J55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D55=\"Yes\"),AND($M$1=\"Scaled\",D55>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D55=\"No\"),AND($M$1=\"Scaled\",D55<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2524,"C.2.6.30","Security controls these subcontractors need to implement?",null,null,null,null,"15.1.2","Addressing security within supplier agreements",3,null,2,6,30,0,0,0,{"$f":"IF(J56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D56=\"Yes\"),AND($M$1=\"Scaled\",D56>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D56=\"No\"),AND($M$1=\"Scaled\",D56<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[86,"C.2.6.31","Termination/exit clause?",null,null,null,null,null,null,3,null,2,6,31,0,0,0,{"$f":"IF(J57=\"\",\"\",IF(D57=\"\",0,IF(D57=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D57=\"Yes\"),AND($M$1=\"Scaled\",D57>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D57=\"No\"),AND($M$1=\"Scaled\",D57<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2525,"C.2.6.32","Contingency plan in case either party wishes to terminate the relationship before the end of the agreements?",null,null,null,null,null,null,3,null,2,6,32,0,0,0,{"$f":"IF(J58=\"\",\"\",IF(D58=\"\",0,IF(D58=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D58=\"Yes\"),AND($M$1=\"Scaled\",D58>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D58=\"No\"),AND($M$1=\"Scaled\",D58<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2526,"C.2.6.33","Renegotiation of agreements if the security requirements of the respondent change?",null,null,null,null,null,null,3,null,2,6,33,0,0,0,{"$f":"IF(J59=\"\",\"\",IF(D59=\"\",0,IF(D59=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D59=\"Yes\"),AND($M$1=\"Scaled\",D59>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D59=\"No\"),AND($M$1=\"Scaled\",D59<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2527,"C.2.6.34","Current documentation of asset lists, licenses, agreements or rights relating to them?",null,null,null,null,"15.2.2","Managing changes to supplier services",3,null,2,6,34,0,0,0,{"$f":"IF(J60=\"\",\"\",IF(D60=\"\",0,IF(D60=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D60=\"Yes\"),AND($M$1=\"Scaled\",D60>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D60=\"No\"),AND($M$1=\"Scaled\",D60<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]

{"sheet":"D. Asset Management","index":10,"n_rows":36,"n_cols":30,"rows_kept":36,"cut":false,"hidden":false,"merged":[[2,1,2,8]]}
[11,"D. Asset Management",null,null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,"Binary","Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"D"}]
[null,null,null,{"$f":"IF(X2=0,\"0%\",X2/T2)","v":"0%"},"Percent Complete",null,"Tab Automation:","Enable",null,{"$f":"COUNTA(J5:J36)","v":32},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(T5:T36,1)","v":32},null,null,null,{"$f":"COUNTIF(X5:X36,1)","v":0}]
["Serial N/A","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column F to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, select the word \"Disable\" in the Tab Automation field at the top of the page.\n     - Use the Maturity column to identify the maturity of the question. See the How To Guide for instructions on filling out this field.",null,null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter","Maturity N/A"]
[{"$f":"MAX(A5:A36)","v":3201},"Ques Num","Question/Request","Response","Maturity","Additional Information","AUP Reference","ISO 27002:2013 Relevance"]
[3200,{"$f":"IF(J5=0,\"\",IF(J5=1,Q$1&\".\"&L5,IF(J5=2,Q$1&\".\"&L5&\".\"&M5,IF(J5=3,Q$1&\".\"&L5&\".\"&M5&\".\"&N5,IF(J5=4,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5,IF(J5=5,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5&\".\"&P5))))))","v":"D.1"},"Is there an asset management program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?",null,null,null,"D. Assessment Management",8.1,"Responsibility for Assets",1,null,{"$f":"IF(L4=\"\",1,IF(J5=1,L4+1,L4))","v":1},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($J5=2,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($J5=3,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($J5=4,O4+1,O4)))","v":0},{"$f":"IF(P4=\"\",0,IF(O4<>O5,0,IF($J5=5,P4+1,P4)))","v":0},{"$f":"IF(OR(Master=\"Master\",J5=0,K5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,22,FALSE)),0,VLOOKUP(A5,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D5=\"Yes\"),AND($M$1=\"Scaled\",D5>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D5=\"No\"),AND($M$1=\"Scaled\",D5<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J5=\"\",\"\",IF(Q5>0,Q5,IF(R5>0,R5,0)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(J5=1,T4=\"\"),1,IF(OR(AND(K4=1,(J5-J3<>0)),AND(T4=0,J4=J5),AND(K4=1,J5=J3)),0,1)))","v":1},{"$f":"IF(J5=\"\",U4,IF(AND(S5>1,OR(U4=\"\",U4=0,U4>=J5)),J5,IF(J5>U4,U4,0)))","v":0},{"$f":"IF(Master=\"Master\",R5,IF(V4=\"\",S5,IF(OR(AND(U5>0,S5<V4),AND(U5=1,S5<=V4)),V4,S5)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(T4=1,U5=1),S5>0,AND(T6=0,W6=1)),1,0))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(U5>0,T5=1),AND(T5=1,W5=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(J5=1,S5=1),2,IF(AND(V4=1,L5=L4),2,IF(AND(AC4=2,L5=L4),2,IF(J5=1,1,\"\"))))","v":1}]
[106,{"$f":"IF(J6=0,\"\",IF(J6=1,Q$1&\".\"&L6,IF(J6=2,Q$1&\".\"&L6&\".\"&M6,IF(J6=3,Q$1&\".\"&L6&\".\"&M6&\".\"&N6,IF(J6=4,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6,IF(J6=5,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6&\".\"&P6))))))","v":"D.1.1"},"Is there an inventory system for hardware and software assets? If yes, does it include:",null,null,null,"D.1 Asset Accounting and Inventory","8.1.1","Inventory of Assets",2,null,{"$f":"IF(L5=\"\",1,IF(J6=1,L5+1,L5))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($J6=2,M5+1,M5)))","v":1},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($J6=3,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($J6=4,O5+1,O5)))","v":0},{"$f":"IF(P5=\"\",0,IF(O5<>O6,0,IF($J6=5,P5+1,P5)))","v":0},0,{"$f":"IF(J6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D6=\"Yes\"),AND($M$1=\"Scaled\",D6>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D6=\"No\"),AND($M$1=\"Scaled\",D6<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J6=\"\",\"\",IF(Q6>0,Q6,IF(R6>0,R6,0)))","v":0},1,{"$f":"IF(J6=\"\",U5,IF(AND(S6>1,OR(U5=\"\",U5=0,U5>=J6)),J6,IF(J6>U5,U5,0)))","v":0},0,{"$f":"IF(J6=\"\",\"\",IF(OR(AND(T5=1,U6=1),S6>0,AND(T7=0,W7=1)),1,0))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(U6>0,T6=1),AND(T6=1,W6=1)),1,0))","v":0},0,null,null,null,{"$f":"IF(AND(J6=1,S6=1),2,IF(AND(V5=1,L6=L5),2,IF(AND(AC5=2,L6=L5),2,IF(J6=1,1,\"\"))))","v":""}]
[108,"D.1.1.1","Asset control tag?",null,null,null,"D.1 Procedure: c","N/A","",3,null,1,1,1,0,0,0,{"$f":"IF(J7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D7=\"Yes\"),AND($M$1=\"Scaled\",D7>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D7=\"No\"),AND($M$1=\"Scaled\",D7<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[113,"D.1.1.2","Operating system?",null,null,null,"D.1 Procedure: c","N/A","",3,null,1,1,2,0,0,0,{"$f":"IF(J8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D8=\"Yes\"),AND($M$1=\"Scaled\",D8>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D8=\"No\"),AND($M$1=\"Scaled\",D8<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[114,"D.1.1.3","Physical location?",null,null,null,"D.1 Procedure: c","N/A","",3,null,1,1,3,0,0,0,{"$f":"IF(J9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D9=\"Yes\"),AND($M$1=\"Scaled\",D9>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D9=\"No\"),AND($M$1=\"Scaled\",D9<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[115,"D.1.1.4","Serial number?",null,null,null,null,"N/A","",3,null,1,1,4,0,0,0,{"$f":"IF(J10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D10=\"Yes\"),AND($M$1=\"Scaled\",D10>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D10=\"No\"),AND($M$1=\"Scaled\",D10<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[109,"D.1.1.5","Business function supported?",null,null,null,null,"N/A","",3,null,1,1,5,0,0,0,{"$f":"IF(J11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D11=\"Yes\"),AND($M$1=\"Scaled\",D11>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D11=\"No\"),AND($M$1=\"Scaled\",D11<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[110,"D.1.1.6","Environment (dev, test, etc.)?",null,null,null,"D.1 Procedure: c","N/A","",3,null,1,1,6,0,0,0,{"$f":"IF(J12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D12=\"Yes\"),AND($M$1=\"Scaled\",D12>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D12=\"No\"),AND($M$1=\"Scaled\",D12<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[112,"D.1.1.7","IP address?",null,null,null,null,"N/A","",3,null,1,1,7,0,0,0,{"$f":"IF(J13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D13=\"Yes\"),AND($M$1=\"Scaled\",D13>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D13=\"No\"),AND($M$1=\"Scaled\",D13<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[119,"D.1.2","Is there a detailed description of software licenses (number of seats, concurrent users, etc.) ?",null,null,null,"D.1 Asset Accounting and Inventory","N/A","",2,null,1,2,0,0,0,0,{"$f":"IF(J14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D14=\"Yes\"),AND($M$1=\"Scaled\",D14>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D14=\"No\"),AND($M$1=\"Scaled\",D14<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[120,"D.1.3","Is ownership assigned for information and assets? If yes, is the owner responsible to:",null,null,null,null,"8.1.2","Ownership of Assets",2,null,1,3,0,0,0,0,{"$f":"IF(J15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D15=\"Yes\"),AND($M$1=\"Scaled\",D15>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D15=\"No\"),AND($M$1=\"Scaled\",D15<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2530,"D.1.3.1","Appropriately classify information and assets?",null,null,null,null,"8.2.1","Classification of Information",3,null,1,3,1,0,0,0,{"$f":"IF(J16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D16=\"Yes\"),AND($M$1=\"Scaled\",D16>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D16=\"No\"),AND($M$1=\"Scaled\",D16<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[121,"D.1.3.2","Review and approve access to those information and assets?",null,null,null,null,"8.1.2","Ownership of Assets",3,null,1,3,2,0,0,0,{"$f":"IF(J17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D17=\"Yes\"),AND($M$1=\"Scaled\",D17>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D17=\"No\"),AND($M$1=\"Scaled\",D17<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2531,"D.1.3.3","Establish, document and implement rules for the acceptable use of information and assets?",null,null,null,null,"8.1.3","Acceptable Use of Assets",3,null,1,3,3,0,0,0,{"$f":"IF(J18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D18=\"Yes\"),AND($M$1=\"Scaled\",D18>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D18=\"No\"),AND($M$1=\"Scaled\",D18<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2532,"D.2","Are information and assets classified?",null,null,null,"D.1 Procedure: e.1","8.2.1","Classification of Information",1,null,2,0,0,0,0,0,{"$f":"IF(J19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D19=\"Yes\"),AND($M$1=\"Scaled\",D19>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D19=\"No\"),AND($M$1=\"Scaled\",D19<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1,1]
[3201,"D.2.1","Is there an information asset classification policy or program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?",null,null,null,"D.1 Procedure: e.1","8.2.1","Classification of Information",2,null,2,1,0,0,0,0,{"$f":"IF(J20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D20=\"Yes\"),AND($M$1=\"Scaled\",D20>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D20=\"No\"),AND($M$1=\"Scaled\",D20<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2533,"D.2.2","Is there a procedure for handling of information and assets? If yes, does it include:",null,null,null,"G.15 Physical Media Tracking","8.2.3","Handling of Assets",2,null,2,2,0,0,0,0,{"$f":"IF(J21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D21=\"Yes\"),AND($M$1=\"Scaled\",D21>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D21=\"No\"),AND($M$1=\"Scaled\",D21<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[136,"D.2.2.1","Data ownership?",null,null,null,null,"8.1.2","Ownership of Assets",3,null,2,2,1,0,0,0,{"$f":"IF(J22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D22=\"Yes\"),AND($M$1=\"Scaled\",D22>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D22=\"No\"),AND($M$1=\"Scaled\",D22<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[128,"D.2.2.2","Data access controls including authorization?",null,null,null,null,"8.2.3","Handling of Assets",3,null,2,2,2,0,0,0,{"$f":"IF(J23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D23=\"Yes\"),AND($M$1=\"Scaled\",D23>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D23=\"No\"),AND($M$1=\"Scaled\",D23<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[134,"D.2.2.3","Data labeling?",null,null,null,null,"8.2.2","Labeling of information",3,null,2,2,3,0,0,0,{"$f":"IF(J24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D24=\"Yes\"),AND($M$1=\"Scaled\",D24>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D24=\"No\"),AND($M$1=\"Scaled\",D24<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[135,"D.2.2.4","Data on removable media?",null,null,null,null,"8.3.1","Management of Removable Media",3,null,2,2,4,0,0,0,{"$f":"IF(J25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D25=\"Yes\"),AND($M$1=\"Scaled\",D25>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D25=\"No\"),AND($M$1=\"Scaled\",D25<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[133,"D.2.2.5","Data in transit?",null,null,null,"G.16 Security of Media in Transit","8.3.3","Physical media transfer",3,null,2,2,5,0,0,0,{"$f":"IF(J26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D26=\"Yes\"),AND($M$1=\"Scaled\",D26>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D26=\"No\"),AND($M$1=\"Scaled\",D26<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[131,"D.2.2.6","Data encryption?",null,null,null,"G.22 Data Security Policy - Encryption","10.1.1","Policy on the use of cryptographic controls",3,null,2,2,6,0,0,0,{"$f":"IF(J27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D27=\"Yes\"),AND($M$1=\"Scaled\",D27>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D27=\"No\"),AND($M$1=\"Scaled\",D27<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[132,"D.2.2.7","Data in storage?",null,null,null,null,"11.2.6","Security of equipment and assets off-premise",3,null,2,2,7,0,0,0,{"$f":"IF(J28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D28=\"Yes\"),AND($M$1=\"Scaled\",D28>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D28=\"No\"),AND($M$1=\"Scaled\",D28<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[137,"D.2.2.8","Data reclassification?",null,null,null,null,"8.1.2","Ownership of Assets",3,null,2,2,8,0,0,0,{"$f":"IF(J29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D29=\"Yes\"),AND($M$1=\"Scaled\",D29>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D29=\"No\"),AND($M$1=\"Scaled\",D29<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[138,"D.2.2.9","Data retention?",null,null,null,null,null,"",3,null,2,2,9,0,0,0,{"$f":"IF(J30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D30=\"Yes\"),AND($M$1=\"Scaled\",D30>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D30=\"No\"),AND($M$1=\"Scaled\",D30<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[129,"D.2.2.10","Data destruction?",null,null,null,"D.2 Asset Destruction","8.1.2","Ownership of Assets",3,null,2,2,10,0,0,0,{"$f":"IF(J31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D31=\"Yes\"),AND($M$1=\"Scaled\",D31>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D31=\"No\"),AND($M$1=\"Scaled\",D31<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[130,"D.2.2.11","Data disposal?",null,null,null,"D.2 Asset Destruction","8.3.2","Disposal of Media",3,null,2,2,11,0,0,0,{"$f":"IF(J32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D32=\"Yes\"),AND($M$1=\"Scaled\",D32>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D32=\"No\"),AND($M$1=\"Scaled\",D32<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2534,"D.2.2.12","Reviewed at least annually?",null,null,null,null,"8.1.2","Ownership of Assets",3,null,2,2,12,0,0,0,{"$f":"IF(J33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D33=\"Yes\"),AND($M$1=\"Scaled\",D33>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D33=\"No\"),AND($M$1=\"Scaled\",D33<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2535,"D.2.2.13","Data handling based on classification?",null,null,null,"G.15 Physical Media Tracking","8.2.3","Handling of Assets",3,null,2,2,13,0,0,0,{"$f":"IF(J34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D34=\"Yes\"),AND($M$1=\"Scaled\",D34>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D34=\"No\"),AND($M$1=\"Scaled\",D34<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[139,"D.2.2.14","Physical media destruction?",null,null,null,"D.2 Asset Destruction","8.3.2","Disposal of Media",3,null,2,2,14,0,0,0,{"$f":"IF(J35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D35=\"Yes\"),AND($M$1=\"Scaled\",D35>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D35=\"No\"),AND($M$1=\"Scaled\",D35<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[140,"D.2.2.15","Reuse of physical media (tapes, disk drives, etc.)?",null,null,null,null,"11.2.7","Secure Disposal or Re-Use of Equipment",3,null,2,2,15,0,0,0,{"$f":"IF(J36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D36=\"Yes\"),AND($M$1=\"Scaled\",D36>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D36=\"No\"),AND($M$1=\"Scaled\",D36<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]

{"sheet":"E. Human Resource Security","index":11,"n_rows":51,"n_cols":30,"rows_kept":51,"cut":false,"hidden":false,"merged":[[2,1,2,8]]}
[11,"E. Human Resource Security",null,null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,"Binary","Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"E"}]
[null,null,null,{"$f":"IF(X2=0,\"0%\",X2/T2)","v":"0%"},"Percent Complete",null,"Tab Automation:","Enable",null,{"$f":"COUNTA(J5:J51)","v":47},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(T5:T51,1)","v":46},null,null,null,{"$f":"COUNTIF(X5:X51,1)","v":0}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column F to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, select the word \"Disable\" in the Tab Automation field at the top of the page.\n     - Use the Maturity column to identify the maturity of the question. See the How To Guide for instructions on filling out this field.",null,null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter","Maturity N/A"]
[{"$f":"MAX(A5:A51)","v":4114},"Ques Num","Question/Request","Response","Maturity","Additional Information","AUP Reference","ISO 27002:2013 Relevance"]
[2536,{"$f":"IF(J5=0,\"\",IF(J5=1,Q$1&\".\"&L5,IF(J5=2,Q$1&\".\"&L5&\".\"&M5,IF(J5=3,Q$1&\".\"&L5&\".\"&M5&\".\"&N5,IF(J5=4,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5,IF(J5=5,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5&\".\"&P5))))))","v":"E.1"},"Are security roles and responsibilities of constituents defined and documented in accordance with the respondent’s information security policy?",null,null,null,"C.2 Security Organization Roles/Responsibilities","6.1.1","Information security roles and responsibilities",1,null,{"$f":"IF(L4=\"\",1,IF(J5=1,L4+1,L4))","v":1},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($J5=2,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($J5=3,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($J5=4,O4+1,O4)))","v":0},{"$f":"IF(P4=\"\",0,IF(O4<>O5,0,IF($J5=5,P4+1,P4)))","v":0},{"$f":"IF(OR(Master=\"Master\",J5=0,K5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,22,FALSE)),0,VLOOKUP(A5,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D5=\"Yes\"),AND($M$1=\"Scaled\",D5>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D5=\"No\"),AND($M$1=\"Scaled\",D5<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J5=\"\",\"\",IF(Q5>0,Q5,IF(R5>0,R5,0)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(J5=1,T4=\"\"),1,IF(OR(AND(K4=1,(J5-J3<>0)),AND(T4=0,J4=J5),AND(K4=1,J5=J3)),0,1)))","v":1},{"$f":"IF(J5=\"\",U4,IF(AND(S5>1,OR(U4=\"\",U4=0,U4>=J5)),J5,IF(J5>U4,U4,0)))","v":0},{"$f":"IF(Master=\"Master\",R5,IF(V4=\"\",S5,IF(OR(AND(U5>0,S5<V4),AND(U5=1,S5<=V4)),V4,S5)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(T4=1,U5=1),S5>0,AND(T6=0,W6=1)),1,0))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(U5>0,T5=1),AND(T5=1,W5=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(J5=1,S5=1),2,IF(AND(V4=1,L5=L4),2,IF(AND(AC4=2,L5=L4),2,IF(J5=1,1,\"\"))))","v":1}]
[2538,{"$f":"IF(J6=0,\"\",IF(J6=1,Q$1&\".\"&L6,IF(J6=2,Q$1&\".\"&L6&\".\"&M6,IF(J6=3,Q$1&\".\"&L6&\".\"&M6&\".\"&N6,IF(J6=4,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6,IF(J6=5,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6&\".\"&P6))))))","v":"E.2"},"Is a background screening performed prior to allowing constituent access to Scoped Systems and Data? If yes, does it include:",null,null,null,"E.3 Background Investigation Policy Content","7.1.1","Screening",1,null,{"$f":"IF(L5=\"\",1,IF(J6=1,L5+1,L5))","v":2},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($J6=2,M5+1,M5)))","v":0},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($J6=3,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($J6=4,O5+1,O5)))","v":0},{"$f":"IF(P5=\"\",0,IF(O5<>O6,0,IF($J6=5,P5+1,P5)))","v":0},{"$f":"IF(OR(Master=\"Master\",J6=0,K6=1),0,IF(ISNA(VLOOKUP(A6,L2_Array,22,FALSE)),0,VLOOKUP(A6,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D6=\"Yes\"),AND($M$1=\"Scaled\",D6>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D6=\"No\"),AND($M$1=\"Scaled\",D6<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J6=\"\",\"\",IF(Q6>0,Q6,IF(R6>0,R6,0)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(J6=1,T5=\"\"),1,IF(OR(AND(K5=1,(J6-J4<>0)),AND(T5=0,J5=J6),AND(K5=1,J6=J4)),0,1)))","v":1},{"$f":"IF(J6=\"\",U5,IF(AND(S6>1,OR(U5=\"\",U5=0,U5>=J6)),J6,IF(J6>U5,U5,0)))","v":0},{"$f":"IF(Master=\"Master\",R6,IF(V5=\"\",S6,IF(OR(AND(U6>0,S6<V5),AND(U6=1,S6<=V5)),V5,S6)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(T5=1,U6=1),S6>0,AND(T7=0,W7=1)),1,0))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(U6>0,T6=1),AND(T6=1,W6=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A6,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(J6=1,S6=1),2,IF(AND(V5=1,L6=L5),2,IF(AND(AC5=2,L6=L5),2,IF(J6=1,1,\"\"))))","v":1}]
[148,"E.2.1","Criminal?",null,null,null,"E.3 Procedure: b.7","7.1.1.e ","Screening",2,null,2,1,0,0,0,0,{"$f":"IF(J7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D7=\"Yes\"),AND($M$1=\"Scaled\",D7>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D7=\"No\"),AND($M$1=\"Scaled\",D7<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[155,"E.2.2","Credit?",null,null,null,"E.3 Procedure: b.6","7.1.1.e ","Screening",2,null,2,2,0,0,0,0,{"$f":"IF(J8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D8=\"Yes\"),AND($M$1=\"Scaled\",D8>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D8=\"No\"),AND($M$1=\"Scaled\",D8<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[162,"E.2.3","Academic?",null,null,null,"E.3 Procedure: b.5","7.1.1.e ","Screening",2,null,2,3,0,0,0,0,{"$f":"IF(J9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D9=\"Yes\"),AND($M$1=\"Scaled\",D9>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D9=\"No\"),AND($M$1=\"Scaled\",D9<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[169,"E.2.4","Reference?",null,null,null,"E.3 Procedure: b.8","7.1.1.e ","Screening",2,null,2,4,0,0,0,0,{"$f":"IF(J10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D10=\"Yes\"),AND($M$1=\"Scaled\",D10>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D10=\"No\"),AND($M$1=\"Scaled\",D10<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2539,"E.2.5","Resume or curriculum vitae?",null,null,null,"E.3 Procedure: b.4","7.1.1.e ","Screening",2,null,2,5,0,0,0,0,{"$f":"IF(J11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D11=\"Yes\"),AND($M$1=\"Scaled\",D11>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D11=\"No\"),AND($M$1=\"Scaled\",D11<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[176,"E.2.6","Drug Screening?",null,null,null,"E.3 Procedure: b.10","NA",null,2,null,2,6,0,0,0,0,{"$f":"IF(J12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D12=\"Yes\"),AND($M$1=\"Scaled\",D12>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D12=\"No\"),AND($M$1=\"Scaled\",D12<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4007,"E.3","Are periodic background checks conducted? If yes, do they include the following individuals:",null,null,null,null,"NA",null,1,null,3,0,0,0,0,0,{"$f":"IF(J13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D13=\"Yes\"),AND($M$1=\"Scaled\",D13>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D13=\"No\"),AND($M$1=\"Scaled\",D13<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,1]
[4008,"E.3.1","Senior Management?",null,null,null,null,"NA",null,2,null,3,1,0,0,0,0,{"$f":"IF(J14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D14=\"Yes\"),AND($M$1=\"Scaled\",D14>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D14=\"No\"),AND($M$1=\"Scaled\",D14<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4009,"E.3.2","Subcontractors?",null,null,null,null,"NA",null,2,null,3,2,0,0,0,0,{"$f":"IF(J15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D15=\"Yes\"),AND($M$1=\"Scaled\",D15>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D15=\"No\"),AND($M$1=\"Scaled\",D15<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4010,"E.3.3","All other employees?",null,null,null,null,"NA",null,2,null,3,3,0,0,0,0,{"$f":"IF(J16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D16=\"Yes\"),AND($M$1=\"Scaled\",D16>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D16=\"No\"),AND($M$1=\"Scaled\",D16<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[183,"E.4","Are new hires required to sign any agreements upon hire? If yes, does it include:",null,null,null,"E.5 Agreements for Employees","7.1.2","Terms and conditions of employment",1,null,4,0,0,0,0,0,{"$f":"IF(J17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D17=\"Yes\"),AND($M$1=\"Scaled\",D17>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D17=\"No\"),AND($M$1=\"Scaled\",D17<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1,1]
[184,"E.4.1","Acceptable Use?",null,null,null,"E.5 Agreements for Employees","8.1.3","Acceptable use of assets",2,null,4,1,0,0,0,0,{"$f":"IF(J18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D18=\"Yes\"),AND($M$1=\"Scaled\",D18>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D18=\"No\"),AND($M$1=\"Scaled\",D18<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[191,"E.4.2","Code of Conduct / Ethics?",null,null,null,"E.5 Agreements for Employees","7.1.2","Terms and conditions of employment",2,null,4,2,0,0,0,0,{"$f":"IF(J19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D19=\"Yes\"),AND($M$1=\"Scaled\",D19>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D19=\"No\"),AND($M$1=\"Scaled\",D19<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[198,"E.4.3","Non-Disclosure Agreement?",null,null,null,"E.5 Agreements for Employees","7.1.2","Terms and conditions of employment",2,null,4,3,0,0,0,0,{"$f":"IF(J20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D20=\"Yes\"),AND($M$1=\"Scaled\",D20>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D20=\"No\"),AND($M$1=\"Scaled\",D20<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[205,"E.4.4","Confidentiality Agreement?",null,null,null,"E.5 Agreements for Employees","7.1.2","Terms and conditions of employment",2,null,4,4,0,0,0,0,{"$f":"IF(J21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D21=\"Yes\"),AND($M$1=\"Scaled\",D21>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D21=\"No\"),AND($M$1=\"Scaled\",D21<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4113,"E.4.5","Terms of Use for Mobile Devices?",null,null,null,null,"NA",null,2,null,4,5,0,0,0,0,{"$f":"IF(J22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D22=\"Yes\"),AND($M$1=\"Scaled\",D22>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D22=\"No\"),AND($M$1=\"Scaled\",D22<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2555,"E.4.6","Are constituents required to sign annual acknowledgements? If yes, do they include:",null,null,null,"E.5 Agreements for Employees","NA",null,2,null,4,6,0,0,0,0,{"$f":"IF(J23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D23=\"Yes\"),AND($M$1=\"Scaled\",D23>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D23=\"No\"),AND($M$1=\"Scaled\",D23<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[265,"E.4.6.1","Acceptable Use?",null,null,null,"E.5 Agreements for Employees","NA",null,3,null,4,6,1,0,0,0,{"$f":"IF(J24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D24=\"Yes\"),AND($M$1=\"Scaled\",D24>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D24=\"No\"),AND($M$1=\"Scaled\",D24<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[272,"E.4.6.2","Code of Conduct / Ethics?",null,null,null,"E.5 Agreements for Employees","NA",null,3,null,4,6,2,0,0,0,{"$f":"IF(J25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D25=\"Yes\"),AND($M$1=\"Scaled\",D25>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D25=\"No\"),AND($M$1=\"Scaled\",D25<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[279,"E.4.6.3","Non-Disclosure Agreement?",null,null,null,"E.5 Agreements for Employees","NA",null,3,null,4,6,3,0,0,0,{"$f":"IF(J26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D26=\"Yes\"),AND($M$1=\"Scaled\",D26>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D26=\"No\"),AND($M$1=\"Scaled\",D26<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[286,"E.4.6.4","Confidentiality Agreement?",null,null,null,"E.5 Agreements for Employees","NA",null,3,null,4,6,4,0,0,0,{"$f":"IF(J27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D27=\"Yes\"),AND($M$1=\"Scaled\",D27>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D27=\"No\"),AND($M$1=\"Scaled\",D27<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[212,"E.5","Is there a security awareness training program? If yes, does it include:",null,null,null,"E.1 Security Awareness Training Program Maintenance","7.2.2","Information security awareness, education, and training",1,null,5,0,0,0,0,0,{"$f":"IF(J28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D28=\"Yes\"),AND($M$1=\"Scaled\",D28>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D28=\"No\"),AND($M$1=\"Scaled\",D28<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[214,"E.5.1","Security policies, procedures and processes?",null,null,null,"E.1 Security Awareness Training Program Maintenance","7.2.2","Information security awareness, education, and training",2,null,5,1,0,0,0,0,{"$f":"IF(J29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D29=\"Yes\"),AND($M$1=\"Scaled\",D29>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D29=\"No\"),AND($M$1=\"Scaled\",D29<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[215,"E.5.2","Scored test to evaluate successful completion?",null,null,null,"E.1 Security Awareness Training Program Maintenance","NA",null,2,null,5,2,0,0,0,0,{"$f":"IF(J30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D30=\"Yes\"),AND($M$1=\"Scaled\",D30>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D30=\"No\"),AND($M$1=\"Scaled\",D30<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3302,"E.5.3","New Hire and annual participation?",null,null,null,"E.2 Security Awareness Training Attendance","7.2.2","Information security awareness, education, and training",2,null,5,3,0,0,0,0,{"$f":"IF(J31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D31=\"Yes\"),AND($M$1=\"Scaled\",D31>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D31=\"No\"),AND($M$1=\"Scaled\",D31<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[218,"E.5.4","Training commensurate with levels of responsibilities and access?",null,null,null,"E.2 Security Awareness Training Attendance","7.2.2","Information security awareness, education, and training",2,null,5,4,0,0,0,0,{"$f":"IF(J32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D32=\"Yes\"),AND($M$1=\"Scaled\",D32>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D32=\"No\"),AND($M$1=\"Scaled\",D32<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[219,"E.5.5","Additional training for those responsible for information security?",null,null,null,null,"7.2.2","Information security awareness, education, and training",2,null,5,5,0,0,0,0,{"$f":"IF(J33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D33=\"Yes\"),AND($M$1=\"Scaled\",D33>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D33=\"No\"),AND($M$1=\"Scaled\",D33<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4114,"E.5.6","Mobile Device security awareness?",null,null,null,null,"NA",null,2,null,5,6,0,0,0,0,{"$f":"IF(J34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D34=\"Yes\"),AND($M$1=\"Scaled\",D34>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D34=\"No\"),AND($M$1=\"Scaled\",D34<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[220,"E.6","Do information security personnel have professional security certifications?",null,null,null,null,"6.1.4","Contact with special interest groups",1,null,6,0,0,0,0,0,{"$f":"IF(J35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D35=\"Yes\"),AND($M$1=\"Scaled\",D35>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D35=\"No\"),AND($M$1=\"Scaled\",D35<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,1]
[293,"E.7","Is there a disciplinary process for non-compliance with information security policies?",null,null,null,null,"7.2.3","Disciplinary process",1,null,7,0,0,0,0,0,{"$f":"IF(J36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D36=\"Yes\"),AND($M$1=\"Scaled\",D36>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D36=\"No\"),AND($M$1=\"Scaled\",D36<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[2557,"E.8","Is there a constituent termination or change of status process?",null,null,null,"E.6 Separation Procedures",7.3,"Termination responsibilities",1,null,8,0,0,0,0,0,{"$f":"IF(J37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D37=\"Yes\"),AND($M$1=\"Scaled\",D37>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D37=\"No\"),AND($M$1=\"Scaled\",D37<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[294,"E.8.1","Is there a documented termination or change of status policy or process that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?",null,null,null,null,7.3,"Termination responsibilities",2,null,8,1,0,0,0,0,{"$f":"IF(J38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D38=\"Yes\"),AND($M$1=\"Scaled\",D38>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D38=\"No\"),AND($M$1=\"Scaled\",D38<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[299,"E.8.2","Does HR notify security / access administration of constituent termination for access rights removal? If yes, is notification provided:",null,null,null,"E.6 Separation Procedures\nH.2 Revoke System and Physical Access","7.3.1","Termination or change of employment responsibilities",2,null,8,2,0,0,0,0,{"$f":"IF(J39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D39=\"Yes\"),AND($M$1=\"Scaled\",D39>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D39=\"No\"),AND($M$1=\"Scaled\",D39<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[301,"E.8.2.1","On the actual date?",null,null,null,null,"NA",null,3,null,8,2,1,0,0,0,{"$f":"IF(J40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D40=\"Yes\"),AND($M$1=\"Scaled\",D40>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D40=\"No\"),AND($M$1=\"Scaled\",D40<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[302,"E.8.2.2","Two to seven days after termination?",null,null,null,null,"NA",null,3,null,8,2,2,0,0,0,{"$f":"IF(J41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D41=\"Yes\"),AND($M$1=\"Scaled\",D41>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D41=\"No\"),AND($M$1=\"Scaled\",D41<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[303,"E.8.2.3","Greater than seven days after termination?",null,null,null,null,"NA",null,3,null,8,2,3,0,0,0,{"$f":"IF(J42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D42=\"Yes\"),AND($M$1=\"Scaled\",D42>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D42=\"No\"),AND($M$1=\"Scaled\",D42<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[304,"E.8.3","Does HR notify security / access administration of a constituent change of status for access rights removal? If yes, is notification provided:",null,null,null,"E.6 Separation Procedures\nH.2 Revoke System and Physical Access","7.3.1","Termination or change of employment responsibilities",2,null,8,3,0,0,0,0,{"$f":"IF(J43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D43=\"Yes\"),AND($M$1=\"Scaled\",D43>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D43=\"No\"),AND($M$1=\"Scaled\",D43<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[306,"E.8.3.1","On the actual date of the change of status?",null,null,null,null,"NA",null,3,null,8,3,1,0,0,0,{"$f":"IF(J44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D44=\"Yes\"),AND($M$1=\"Scaled\",D44>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D44=\"No\"),AND($M$1=\"Scaled\",D44<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[307,"E.8.3.2","Two to seven days after the change of status?",null,null,null,null,"NA",null,3,null,8,3,2,0,0,0,{"$f":"IF(J45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D45=\"Yes\"),AND($M$1=\"Scaled\",D45>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D45=\"No\"),AND($M$1=\"Scaled\",D45<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[308,"E.8.3.3","Greater than seven days after the change of status?",null,null,null,null,"NA",null,3,null,8,3,3,0,0,0,{"$f":"IF(J46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D46=\"Yes\"),AND($M$1=\"Scaled\",D46>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D46=\"No\"),AND($M$1=\"Scaled\",D46<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2558,"E.8.4","Are constituents required to return assets (laptop, desktop, PDA, cell phones, access cards, tokens, smart cards, keys, proprietary documentation) upon:",null,null,null,"H.2 Revoke System and Physical Access","8.1.4","Return of assets",2,1,8,4,0,0,0,0,{"$f":"IF(J47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D47=\"Yes\"),AND($M$1=\"Scaled\",D47>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D47=\"No\"),AND($M$1=\"Scaled\",D47<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[310,"E.8.4.1","Termination?",null,null,null,null,"8.1.4","Return of assets",3,null,8,4,1,0,0,0,{"$f":"IF(J48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D48=\"Yes\"),AND($M$1=\"Scaled\",D48>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D48=\"No\"),AND($M$1=\"Scaled\",D48<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[4011,"E.9","Is there a succession and redundancy planning for key management and support personnel? If yes, does it include:",null,null,null,null,"NA",null,1,null,9,0,0,0,0,0,{"$f":"IF(J49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D49=\"Yes\"),AND($M$1=\"Scaled\",D49>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D49=\"No\"),AND($M$1=\"Scaled\",D49<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,1]
[4012,"E.9.1","Senior Management?",null,null,null,null,"NA",null,2,null,9,1,0,0,0,0,{"$f":"IF(J50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D50=\"Yes\"),AND($M$1=\"Scaled\",D50>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D50=\"No\"),AND($M$1=\"Scaled\",D50<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4013,"E.9.2","Key support, operations and development areas?",null,null,null,null,"NA",null,2,null,9,2,0,0,0,0,{"$f":"IF(J51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D51=\"Yes\"),AND($M$1=\"Scaled\",D51>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D51=\"No\"),AND($M$1=\"Scaled\",D51<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]

{"sheet":"F. Physical and Environmental","index":12,"n_rows":136,"n_cols":30,"rows_kept":136,"cut":false,"hidden":false,"merged":[[2,1,2,8]]}
[11,"F. Physical and Environmental Security",null,null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,"Binary","Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"F"}]
[null,null,null,{"$f":"IF(X2=0,\"0%\",X2/T2)","v":"0%"},"Percent Complete",null,"Tab Automation:","Enable",null,{"$f":"COUNTA(J5:J136)","v":132},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(T5:T136,1)","v":119},null,null,null,{"$f":"COUNTIF(X5:X136,1)","v":0}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column F to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, select the word \"Disable\" in the Tab Automation field at the top of the page.\n     - Use the Maturity column to identify the maturity of the question. See the How To Guide for instructions on filling out this field.",null,null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter","Maturity N/A"]
[{"$f":"MAX(A5:A136)","v":3303},"Ques Num","Question/Request","Response","Maturity","Additional Information","AUP Reference","ISO 27002:2013 Relevance"]
[2559,{"$f":"IF(J5=0,\"\",IF(J5=1,Q$1&\".\"&L5,IF(J5=2,Q$1&\".\"&L5&\".\"&M5,IF(J5=3,Q$1&\".\"&L5&\".\"&M5&\".\"&N5,IF(J5=4,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5,IF(J5=5,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5&\".\"&P5))))))","v":"F.1"},"Is there a physical security program?",null,null,null,null,"5.1.1","Policies for information security",1,null,{"$f":"IF(L4=\"\",1,IF(J5=1,L4+1,L4))","v":1},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($J5=2,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($J5=3,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($J5=4,O4+1,O4)))","v":0},{"$f":"IF(P4=\"\",0,IF(O4<>O5,0,IF($J5=5,P4+1,P4)))","v":0},{"$f":"IF(OR(Master=\"Master\",J5=0,K5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,22,FALSE)),0,VLOOKUP(A5,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D5=\"Yes\"),AND($M$1=\"Scaled\",D5>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D5=\"No\"),AND($M$1=\"Scaled\",D5<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J5=\"\",\"\",IF(Q5>0,Q5,IF(R5>0,R5,0)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(J5=1,T4=\"\"),1,IF(OR(AND(K4=1,(J5-J3<>0)),AND(T4=0,J4=J5),AND(K4=1,J5=J3)),0,1)))","v":1},{"$f":"IF(J5=\"\",U4,IF(AND(S5>1,OR(U4=\"\",U4=0,U4>=J5)),J5,IF(J5>U4,U4,0)))","v":0},{"$f":"IF(Master=\"Master\",R5,IF(V4=\"\",S5,IF(OR(AND(U5>0,S5<V4),AND(U5=1,S5<=V4)),V4,S5)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(T4=1,U5=1),S5>0,AND(T6=0,W6=1)),1,0))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(U5>0,T5=1),AND(T5=1,W5=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(J5=1,S5=1),2,IF(AND(V4=1,L5=L4),2,IF(AND(AC4=2,L5=L4),2,IF(J5=1,1,\"\"))))","v":1}]
[312,{"$f":"IF(J6=0,\"\",IF(J6=1,Q$1&\".\"&L6,IF(J6=2,Q$1&\".\"&L6&\".\"&M6,IF(J6=3,Q$1&\".\"&L6&\".\"&M6&\".\"&N6,IF(J6=4,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6,IF(J6=5,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6&\".\"&P6))))))","v":"F.1.1"},"Is there a documented physical security policy approved by management, communicated to constituents and an owner assigned to maintain and review the policy?",null,null,null,"B.1 Information Security Policy Content and Maintenance","5.1.1","Policies for information security",2,null,{"$f":"IF(L5=\"\",1,IF(J6=1,L5+1,L5))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($J6=2,M5+1,M5)))","v":1},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($J6=3,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($J6=4,O5+1,O5)))","v":0},{"$f":"IF(P5=\"\",0,IF(O5<>O6,0,IF($J6=5,P5+1,P5)))","v":0},0,{"$f":"IF(J6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D6=\"Yes\"),AND($M$1=\"Scaled\",D6>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D6=\"No\"),AND($M$1=\"Scaled\",D6<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J6=\"\",\"\",IF(Q6>0,Q6,IF(R6>0,R6,0)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(J6=1,T5=\"\"),1,IF(OR(AND(K5=1,(J6-J4<>0)),AND(T5=0,J5=J6),AND(K5=1,J6=J4)),0,1)))","v":1},{"$f":"IF(J6=\"\",U5,IF(AND(S6>1,OR(U5=\"\",U5=0,U5>=J6)),J6,IF(J6>U5,U5,0)))","v":0},{"$f":"IF(Master=\"Master\",R6,IF(V5=\"\",S6,IF(OR(AND(U6>0,S6<V5),AND(U6=1,S6<=V5)),V5,S6)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(T5=1,U6=1),S6>0,AND(T7=0,W7=1)),1,0))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(U6>0,T6=1),AND(T6=1,W6=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A6,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(J6=1,S6=1),2,IF(AND(V5=1,L6=L5),2,IF(AND(AC5=2,L6=L5),2,IF(J6=1,1,\"\"))))","v":""}]
[2560,"F.1.2","Are reasonable physical security and environmental controls present in the building/data center that contains Scoped Systems and Data? If yes, does it include:",null,null,null,"F. Physical and Environmental Security",11.1,"Secure areas",2,null,1,2,0,0,0,0,{"$f":"IF(J7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D7=\"Yes\"),AND($M$1=\"Scaled\",D7>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D7=\"No\"),AND($M$1=\"Scaled\",D7<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,"",1]
[2561,"F.1.2.1","Signage to identify the operations of the facility (data center)?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.3","Securing offices, rooms, and facilities",3,null,1,2,1,0,0,0,{"$f":"IF(J8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D8=\"Yes\"),AND($M$1=\"Scaled\",D8>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D8=\"No\"),AND($M$1=\"Scaled\",D8<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[351,"F.1.2.2","Other tenants using the building?",null,null,null,null,"NA",null,3,null,1,2,2,0,0,0,{"$f":"IF(J9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D9=\"Yes\"),AND($M$1=\"Scaled\",D9>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D9=\"No\"),AND($M$1=\"Scaled\",D9<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[381,"F.1.2.3","Access restricted and logs kept of all access?",null,null,null,"F.5 Secure Workspace Access Reporting","11.1.2","Physical entry controls",3,null,1,2,3,0,0,0,{"$f":"IF(J10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D10=\"Yes\"),AND($M$1=\"Scaled\",D10>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D10=\"No\"),AND($M$1=\"Scaled\",D10<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[387,"F.1.2.4","Electronic system (key card, token, fob, biometric reader etc.) to control access?",null,null,null,"F.4 Secure Workspace Perimeter","11.1.2","Physical entry controls",3,null,1,2,4,0,0,0,{"$f":"IF(J11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D11=\"Yes\"),AND($M$1=\"Scaled\",D11>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D11=\"No\"),AND($M$1=\"Scaled\",D11<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[391,"F.1.2.5","Cipher locks (electronic or mechanical) to control access within or to the facility? If yes, is there a process to:",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.2","Physical entry controls",3,null,1,2,5,0,0,0,{"$f":"IF(J12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D12=\"Yes\"),AND($M$1=\"Scaled\",D12>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D12=\"No\"),AND($M$1=\"Scaled\",D12<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[392,"F.1.2.5.1","Change the code(s) at least every 90 days?",null,null,null,null,"NA",null,4,null,1,2,5,1,0,0,{"$f":"IF(J13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D13=\"Yes\"),AND($M$1=\"Scaled\",D13>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D13=\"No\"),AND($M$1=\"Scaled\",D13<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[394,"F.1.2.5.2","Change the code(s) when an authorized individual is terminated or transferred to another role?",null,null,null,null,"9.2.1","User registration and de-registration",4,null,1,2,5,2,0,0,{"$f":"IF(J14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D14=\"Yes\"),AND($M$1=\"Scaled\",D14>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D14=\"No\"),AND($M$1=\"Scaled\",D14<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[374,"F.1.2.6","Security guards that provide onsite security services?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.1.c ","Physical security perimeter",3,null,1,2,6,0,0,0,{"$f":"IF(J15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D15=\"Yes\"),AND($M$1=\"Scaled\",D15>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D15=\"No\"),AND($M$1=\"Scaled\",D15<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3288,"F.1.2.7","Perimeter physical barrier (such as fence or walls)?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.1.d ","Physical security perimeter",3,null,1,2,7,0,0,0,{"$f":"IF(J16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D16=\"Yes\"),AND($M$1=\"Scaled\",D16>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D16=\"No\"),AND($M$1=\"Scaled\",D16<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[371,"F.1.2.8","Entry and exit doors alarmed (forced entry, propped open) and/or monitored by security guards?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.1.e ","Physical security perimeter",3,null,1,2,8,0,0,0,{"$f":"IF(J17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D17=\"Yes\"),AND($M$1=\"Scaled\",D17>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D17=\"No\"),AND($M$1=\"Scaled\",D17<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[395,"F.1.2.9","A mechanism to prevent tailgating / piggybacking?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.1.c ","Physical entry controls",3,null,1,2,9,0,0,0,{"$f":"IF(J18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D18=\"Yes\"),AND($M$1=\"Scaled\",D18>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D18=\"No\"),AND($M$1=\"Scaled\",D18<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[360,"F.1.2.10","External lighting?",null,null,null,"F.2 Physical Security Controls – Target Data",null,null,3,null,1,2,10,0,0,0,{"$f":"IF(J19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D19=\"Yes\"),AND($M$1=\"Scaled\",D19>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D19=\"No\"),AND($M$1=\"Scaled\",D19<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[364,"F.1.2.11","Lighting on all doors?",null,null,null,null,null,null,3,null,1,2,11,0,0,0,{"$f":"IF(J20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D20=\"Yes\"),AND($M$1=\"Scaled\",D20>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D20=\"No\"),AND($M$1=\"Scaled\",D20<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[365,"F.1.2.12","Exterior doors with external hinge pins?",null,null,null,null,"11.1.1.b ","Physical security perimeter",3,null,1,2,12,0,0,0,{"$f":"IF(J21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D21=\"Yes\"),AND($M$1=\"Scaled\",D21>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D21=\"No\"),AND($M$1=\"Scaled\",D21<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[358,"F.1.2.13","Windows with contact or break alarms on all windows?",null,null,null,null,"11.1.1.b ","Physical security perimeter",3,null,1,2,13,0,0,0,{"$f":"IF(J22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D22=\"Yes\"),AND($M$1=\"Scaled\",D22>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D22=\"No\"),AND($M$1=\"Scaled\",D22<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[366,"F.1.2.14","CCTV with video stored at least 90 days?",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,3,null,1,2,14,0,0,0,{"$f":"IF(J23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D23=\"Yes\"),AND($M$1=\"Scaled\",D23>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D23=\"No\"),AND($M$1=\"Scaled\",D23<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[566,"F.1.2.15","Fluid or water sensor?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.4","Protecting against external and environmental threats",3,null,1,2,15,0,0,0,{"$f":"IF(J24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D24=\"Yes\"),AND($M$1=\"Scaled\",D24>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D24=\"No\"),AND($M$1=\"Scaled\",D24<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3297,"F.1.2.16","Air conditioning and humidity controls?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.4","Protecting against external and environmental threats",3,null,1,2,16,0,0,0,{"$f":"IF(J25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D25=\"Yes\"),AND($M$1=\"Scaled\",D25>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D25=\"No\"),AND($M$1=\"Scaled\",D25<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3298,"F.1.2.17","Heat detection?",null,null,null,null,"11.1.4","Protecting against external and environmental threats",3,null,1,2,17,0,0,0,{"$f":"IF(J26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D26=\"Yes\"),AND($M$1=\"Scaled\",D26>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D26=\"No\"),AND($M$1=\"Scaled\",D26<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[569,"F.1.2.18","Smoke detection?",null,null,null,null,"11.1.4","Protecting against external and environmental threats",3,null,1,2,18,0,0,0,{"$f":"IF(J27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D27=\"Yes\"),AND($M$1=\"Scaled\",D27>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D27=\"No\"),AND($M$1=\"Scaled\",D27<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3303,"F.1.2.19","Fire suppression?",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.1.4","Protecting against external and environmental threats",3,null,1,2,19,0,0,0,{"$f":"IF(J28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D28=\"Yes\"),AND($M$1=\"Scaled\",D28>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D28=\"No\"),AND($M$1=\"Scaled\",D28<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3289,"F.1.2.20","Multiple power feeds?",null,null,null,null,"11.2.2","Supporting utilities",3,null,1,2,20,0,0,0,{"$f":"IF(J29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D29=\"Yes\"),AND($M$1=\"Scaled\",D29>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D29=\"No\"),AND($M$1=\"Scaled\",D29<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3290,"F.1.2.21","Multiple communication feeds?",null,null,null,null,"11.2.2","Supporting utilities",3,null,1,2,21,0,0,0,{"$f":"IF(J30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D30=\"Yes\"),AND($M$1=\"Scaled\",D30>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D30=\"No\"),AND($M$1=\"Scaled\",D30<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[382,"F.1.2.22","Physical access control procedures? If yes, is there:",null,null,null,null,"11.1.1.a ","Physical security perimeter",3,null,1,2,22,0,0,0,{"$f":"IF(J31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D31=\"Yes\"),AND($M$1=\"Scaled\",D31>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D31=\"No\"),AND($M$1=\"Scaled\",D31<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[383,"F.1.2.22.1","Segregation of duties for issuing and approving access to the facility (keys, badge, etc.)?",null,null,null,null,"9.1.1.f ","Access control policy",4,null,1,2,22,1,0,0,{"$f":"IF(J32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D32=\"Yes\"),AND($M$1=\"Scaled\",D32>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D32=\"No\"),AND($M$1=\"Scaled\",D32<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[384,"F.1.2.22.2","Access reviews at least every six months?",null,null,null,null,"9.1.1.h                                       9.2.5","Access control policy,         Review of user access rights",4,null,1,2,22,2,0,0,{"$f":"IF(J33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D33=\"Yes\"),AND($M$1=\"Scaled\",D33>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D33=\"No\"),AND($M$1=\"Scaled\",D33<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[389,"F.1.2.22.3","Collection of access equipment (badges, keys, change pin numbers, etc.) when a constituent is terminated or changes status and no longer require access?",null,null,null,null,"9.1.1.i ","Access control policy",4,null,1,2,22,3,0,0,{"$f":"IF(J34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D34=\"Yes\"),AND($M$1=\"Scaled\",D34>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D34=\"No\"),AND($M$1=\"Scaled\",D34<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[390,"F.1.2.22.4","A process to report lost or stolen access cards / keys?",null,null,null,null,"11.1.2.d ","Physical entry controls",4,null,1,2,22,4,0,0,{"$f":"IF(J35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D35=\"Yes\"),AND($M$1=\"Scaled\",D35>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D35=\"No\"),AND($M$1=\"Scaled\",D35<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[396,"F.1.3","Are visitors permitted in the facility? If yes, are they required to:",null,null,null,"F.10 Visitor Management","11.1.2 ","Physical entry controls",2,null,1,3,0,0,0,0,{"$f":"IF(J36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D36=\"Yes\"),AND($M$1=\"Scaled\",D36>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D36=\"No\"),AND($M$1=\"Scaled\",D36<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,"",1]
[397,"F.1.3.1","Sign in and out?",null,null,null,"F.10 Procedure: b.1","11.1.2.a ","Physical entry controls",3,null,1,3,1,0,0,{"$f":"IF(OR(Master=\"Master\",J37=0,K37=1),0,IF(ISNA(VLOOKUP(A37,L2_Array,22,FALSE)),0,VLOOKUP(A37,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D37=\"Yes\"),AND($M$1=\"Scaled\",D37>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D37=\"No\"),AND($M$1=\"Scaled\",D37<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[398,"F.1.3.2","Provide a government issued ID?",null,null,null,"F.10 Procedure: c","11.1.2.a ","Physical entry controls",3,null,1,3,2,0,0,0,{"$f":"IF(J38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D38=\"Yes\"),AND($M$1=\"Scaled\",D38>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D38=\"No\"),AND($M$1=\"Scaled\",D38<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[399,"F.1.3.3","Be escorted through secure areas?",null,null,null,"F.10 Procedure: c",null,null,3,null,1,3,3,0,0,0,{"$f":"IF(J39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D39=\"Yes\"),AND($M$1=\"Scaled\",D39>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D39=\"No\"),AND($M$1=\"Scaled\",D39<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2944,"F.1.3.4","Wear badge distinguishing them from employees?",null,null,null,"F.10 Procedure: c","11.1.2.a ","Physical entry controls",3,null,1,3,4,0,0,0,{"$f":"IF(J40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D40=\"Yes\"),AND($M$1=\"Scaled\",D40>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D40=\"No\"),AND($M$1=\"Scaled\",D40<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[400,"F.1.3.5","Are visitor logs maintained for at least 90 days?",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,3,null,1,3,5,0,0,0,{"$f":"IF(J41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D41=\"Yes\"),AND($M$1=\"Scaled\",D41>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D41=\"No\"),AND($M$1=\"Scaled\",D41<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[492,"F.1.4","Is there a loading dock at the facility? If yes, is there:",null,null,null,null,"11.1.6","Delivery and loading areas",2,null,1,4,0,0,0,0,{"$f":"IF(J42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D42=\"Yes\"),AND($M$1=\"Scaled\",D42>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D42=\"No\"),AND($M$1=\"Scaled\",D42<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[493,"F.1.4.1","Any other tenants using the loading dock?",null,null,null,null,"NA",null,3,null,1,4,1,0,0,0,{"$f":"IF(J43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D43=\"Yes\"),AND($M$1=\"Scaled\",D43>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D43=\"No\"),AND($M$1=\"Scaled\",D43<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[495,"F.1.4.2","A security guards at each point of entry?",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,3,null,1,4,2,0,0,0,{"$f":"IF(J44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D44=\"Yes\"),AND($M$1=\"Scaled\",D44>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D44=\"No\"),AND($M$1=\"Scaled\",D44<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[513,"F.1.4.3","Smoke detector?",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.1.4","Protecting against external and environmental threats",3,null,1,4,3,0,0,0,{"$f":"IF(J45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D45=\"Yes\"),AND($M$1=\"Scaled\",D45>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D45=\"No\"),AND($M$1=\"Scaled\",D45<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[514,"F.1.4.4","Fire alarm?",null,null,null,null,"11.1.4","Protecting against external and environmental threats",3,null,1,4,4,0,0,0,{"$f":"IF(J46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D46=\"Yes\"),AND($M$1=\"Scaled\",D46>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D46=\"No\"),AND($M$1=\"Scaled\",D46<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[516,"F.1.4.5","Fire suppression?",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.1.4","Protecting against external and environmental threats",3,null,1,4,5,0,0,0,{"$f":"IF(J47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D47=\"Yes\"),AND($M$1=\"Scaled\",D47>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D47=\"No\"),AND($M$1=\"Scaled\",D47<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[508,"F.1.4.6","CCTV and the video stored for at least 90 days?",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,3,null,1,4,6,0,0,0,{"$f":"IF(J48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D48=\"Yes\"),AND($M$1=\"Scaled\",D48>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D48=\"No\"),AND($M$1=\"Scaled\",D48<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3203,"F.1.4.7","Restricted access and logs kept of all access?",null,null,null,null,"11.1.2.c ","Physical entry controls",3,null,1,4,7,0,0,0,{"$f":"IF(J49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D49=\"Yes\"),AND($M$1=\"Scaled\",D49>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D49=\"No\"),AND($M$1=\"Scaled\",D49<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[541,"F.1.5","Is there a battery/UPS room? If yes, does it contain:",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.2.2 ","Supporting utilities",2,null,1,5,0,0,0,0,{"$f":"IF(J50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D50=\"Yes\"),AND($M$1=\"Scaled\",D50>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D50=\"No\"),AND($M$1=\"Scaled\",D50<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[543,"F.1.5.1","Hydrogen sensors?",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.1.4","Protecting against external and environmental threats",3,null,1,5,1,0,0,0,{"$f":"IF(J51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D51=\"Yes\"),AND($M$1=\"Scaled\",D51>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D51=\"No\"),AND($M$1=\"Scaled\",D51<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[570,"F.1.5.2","Monitored fire alarm?",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.1.4","Protecting against external and environmental threats",3,null,1,5,2,0,0,0,{"$f":"IF(J52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D52=\"Yes\"),AND($M$1=\"Scaled\",D52>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D52=\"No\"),AND($M$1=\"Scaled\",D52<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3204,"F.1.5.3","Fire suppression system?",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.1.4","Protecting against external and environmental threats",3,null,1,5,3,0,0,0,{"$f":"IF(J53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D53=\"Yes\"),AND($M$1=\"Scaled\",D53>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D53=\"No\"),AND($M$1=\"Scaled\",D53<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[560,"F.1.5.4","CCTV and the video stored for at least 90 days?",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,3,null,1,5,4,0,0,0,{"$f":"IF(J54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D54=\"Yes\"),AND($M$1=\"Scaled\",D54>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D54=\"No\"),AND($M$1=\"Scaled\",D54<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[546,"F.1.5.5","Restricted access and logs kept of all access?",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.1.2.c","Physical entry controls",3,null,1,5,5,0,0,0,{"$f":"IF(J55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D55=\"Yes\"),AND($M$1=\"Scaled\",D55>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D55=\"No\"),AND($M$1=\"Scaled\",D55<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[454,"F.1.5.6","Does UPS support N+1?",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.2.2 ","Supporting utilities",3,null,1,5,6,0,0,0,{"$f":"IF(J56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D56=\"Yes\"),AND($M$1=\"Scaled\",D56>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D56=\"No\"),AND($M$1=\"Scaled\",D56<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[621,"F.1.6","Is there a generator or generator area? If yes, is there:",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.2.2 ","Supporting utilities",2,null,1,6,0,0,0,0,{"$f":"IF(J57=\"\",\"\",IF(D57=\"\",0,IF(D57=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D57=\"Yes\"),AND($M$1=\"Scaled\",D57>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D57=\"No\"),AND($M$1=\"Scaled\",D57<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[627,"F.1.6.1","A fuel supply readily available to ensure uninterrupted service?",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.2.2 ","Supporting utilities",3,null,1,6,1,0,0,0,{"$f":"IF(J58=\"\",\"\",IF(D58=\"\",0,IF(D58=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D58=\"Yes\"),AND($M$1=\"Scaled\",D58>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D58=\"No\"),AND($M$1=\"Scaled\",D58<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[628,"F.1.6.2","Adequate capacity to supply power for at least 48 hours?",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.2.2 ","Supporting utilities",3,null,1,6,2,0,0,0,{"$f":"IF(J59=\"\",\"\",IF(D59=\"\",0,IF(D59=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D59=\"Yes\"),AND($M$1=\"Scaled\",D59>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D59=\"No\"),AND($M$1=\"Scaled\",D59<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[629,"F.1.6.3","Restricted access and logs kept of all access?",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.1.2.c","Physical Entry Controls",3,null,1,6,3,0,0,0,{"$f":"IF(J60=\"\",\"\",IF(D60=\"\",0,IF(D60=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D60=\"Yes\"),AND($M$1=\"Scaled\",D60>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D60=\"No\"),AND($M$1=\"Scaled\",D60<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[640,"F.1.6.4","CCTV and the video stored for at least 90 days?",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,3,null,1,6,4,0,0,0,{"$f":"IF(J61=\"\",\"\",IF(D61=\"\",0,IF(D61=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D61=\"Yes\"),AND($M$1=\"Scaled\",D61>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D61=\"No\"),AND($M$1=\"Scaled\",D61<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[656,"F.1.7","Is there a mailroom that handles Scoped Data? If yes, is access:",null,null,null,null,"12.1.1","Documented operating procedures",2,null,1,7,0,0,0,0,{"$f":"IF(J62=\"\",\"\",IF(D62=\"\",0,IF(D62=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D62=\"Yes\"),AND($M$1=\"Scaled\",D62>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D62=\"No\"),AND($M$1=\"Scaled\",D62<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[660,"F.1.7.1","Restricted access and logs kept of all access?",null,null,null,null,"11.1.2.c","Physical entry controls",3,null,1,7,1,0,0,0,{"$f":"IF(J63=\"\",\"\",IF(D63=\"\",0,IF(D63=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D63=\"Yes\"),AND($M$1=\"Scaled\",D63>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D63=\"No\"),AND($M$1=\"Scaled\",D63<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3291,"F.1.7.2","CCTV and the video stored for at least 90 days?",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,3,null,1,7,2,0,0,0,{"$f":"IF(J64=\"\",\"\",IF(D64=\"\",0,IF(D64=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D64=\"Yes\"),AND($M$1=\"Scaled\",D64>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D64=\"No\"),AND($M$1=\"Scaled\",D64<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[685,"F.1.8","Is there a media library to store Scoped Data? If yes, is access:",null,null,null,null,"12.1.1","Documented operating procedures",2,null,1,8,0,0,0,0,{"$f":"IF(J65=\"\",\"\",IF(D65=\"\",0,IF(D65=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D65=\"Yes\"),AND($M$1=\"Scaled\",D65>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D65=\"No\"),AND($M$1=\"Scaled\",D65<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[694,"F.1.8.1","Restricted and logs kept of all access?",null,null,null,null,"11.1.2.c","Physical entry controls",3,null,1,8,1,0,0,0,{"$f":"IF(J66=\"\",\"\",IF(D66=\"\",0,IF(D66=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D66=\"Yes\"),AND($M$1=\"Scaled\",D66>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D66=\"No\"),AND($M$1=\"Scaled\",D66<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3292,"F.1.8.2","CCTV and the video stored for at least 90 days?",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,3,null,1,8,2,0,0,0,{"$f":"IF(J67=\"\",\"\",IF(D67=\"\",0,IF(D67=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D67=\"Yes\"),AND($M$1=\"Scaled\",D67>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D67=\"No\"),AND($M$1=\"Scaled\",D67<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[778,"F.1.9","Is there a separate room for telecom equipment? If yes, is access:",null,null,null,null,"12.1.1","Documented operating procedures",2,null,1,9,0,0,0,0,{"$f":"IF(J68=\"\",\"\",IF(D68=\"\",0,IF(D68=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D68=\"Yes\"),AND($M$1=\"Scaled\",D68>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D68=\"No\"),AND($M$1=\"Scaled\",D68<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[781,"F.1.9.1","Monitored with CCTV and the video stored for 90 days?",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,3,null,1,9,1,0,0,{"$f":"IF(OR(Master=\"Master\",J69=0,K69=1),0,IF(ISNA(VLOOKUP(A69,L2_Array,22,FALSE)),0,VLOOKUP(A69,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J69=\"\",\"\",IF(D69=\"\",0,IF(D69=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D69=\"Yes\"),AND($M$1=\"Scaled\",D69>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D69=\"No\"),AND($M$1=\"Scaled\",D69<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[786,{"$f":"IF(J70=0,\"\",IF(J70=1,Q$1&\".\"&L70,IF(J70=2,Q$1&\".\"&L70&\".\"&M70,IF(J70=3,Q$1&\".\"&L70&\".\"&M70&\".\"&N70,IF(J70=4,Q$1&\".\"&L70&\".\"&M70&\".\"&N70&\".\"&O70,IF(J70=5,Q$1&\".\"&L70&\".\"&M70&\".\"&N70&\".\"&O70&\".\"&P70))))))","v":"F.1.9.2"},"Restricted and logs kept of all access?",null,null,null,null,"11.1.2.c","Physical entry controls",3,null,{"$f":"IF(L69=\"\",1,IF(J70=1,L69+1,L69))","v":1},{"$f":"IF(M69=\"\",0,IF(L69<>L70,0,IF($J70=2,M69+1,M69)))","v":9},{"$f":"IF(N69=\"\",0,IF(M69<>M70,0,IF($J70=3,N69+1,N69)))","v":2},{"$f":"IF(O69=\"\",0,IF(N69<>N70,0,IF($J70=4,O69+1,O69)))","v":0},{"$f":"IF(P69=\"\",0,IF(O69<>O70,0,IF($J70=5,P69+1,P69)))","v":0},0,{"$f":"IF(J70=\"\",\"\",IF(D70=\"\",0,IF(D70=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D70=\"Yes\"),AND($M$1=\"Scaled\",D70>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D70=\"No\"),AND($M$1=\"Scaled\",D70<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J70=\"\",\"\",IF(Q70>0,Q70,IF(R70>0,R70,0)))","v":0},{"$f":"IF(J70=\"\",\"\",IF(OR(J70=1,T69=\"\"),1,IF(OR(AND(K69=1,(J70-J68<>0)),AND(T69=0,J69=J70),AND(K69=1,J70=J68)),0,1)))","v":1},{"$f":"IF(J70=\"\",U69,IF(AND(S70>1,OR(U69=\"\",U69=0,U69>=J70)),J70,IF(J70>U69,U69,0)))","v":0},{"$f":"IF(Master=\"Master\",R70,IF(V69=\"\",S70,IF(OR(AND(U70>0,S70<V69),AND(U70=1,S70<=V69)),V69,S70)))","v":0},{"$f":"IF(J70=\"\",\"\",IF(OR(AND(T69=1,U70=1),S70>0,AND(T71=0,W71=1)),1,0))","v":0},{"$f":"IF(J70=\"\",\"\",IF(OR(AND(U70>0,T70=1),AND(T70=1,W70=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A70,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(J70=1,S70=1),2,IF(AND(V69=1,L70=L69),2,IF(AND(AC69=2,L70=L69),2,IF(J70=1,1,\"\"))))","v":""}]
[401,"F.2","Do the Scoped Systems and Data reside in a data center? If yes, is there:",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.2.1.b","Equipment siting and protection",1,null,2,0,0,0,0,0,{"$f":"IF(J71=\"\",\"\",IF(D71=\"\",0,IF(D71=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D71=\"Yes\"),AND($M$1=\"Scaled\",D71>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D71=\"No\"),AND($M$1=\"Scaled\",D71<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,1,1]
[435,"F.2.1","Fluid or water sensor?",null,null,null,"F.1 Environmental Controls – Computing Hardware",null,null,2,null,2,1,0,0,0,0,{"$f":"IF(J72=\"\",\"\",IF(D72=\"\",0,IF(D72=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D72=\"Yes\"),AND($M$1=\"Scaled\",D72>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D72=\"No\"),AND($M$1=\"Scaled\",D72<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[434,"F.2.2","Air conditioning?",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.2.1.e","Equipment siting and protection",2,null,2,2,0,0,0,0,{"$f":"IF(J73=\"\",\"\",IF(D73=\"\",0,IF(D73=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D73=\"Yes\"),AND($M$1=\"Scaled\",D73>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D73=\"No\"),AND($M$1=\"Scaled\",D73<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[436,"F.2.3","Heat detection?",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.2.1.e","Equipment siting and protection",2,null,2,3,0,0,0,0,{"$f":"IF(J74=\"\",\"\",IF(D74=\"\",0,IF(D74=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D74=\"Yes\"),AND($M$1=\"Scaled\",D74>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D74=\"No\"),AND($M$1=\"Scaled\",D74<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[439,"F.2.4","Smoke detection?",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.2.1.e","Equipment siting and protection",2,null,2,4,0,0,0,0,{"$f":"IF(J75=\"\",\"\",IF(D75=\"\",0,IF(D75=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D75=\"Yes\"),AND($M$1=\"Scaled\",D75>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D75=\"No\"),AND($M$1=\"Scaled\",D75<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[441,"F.2.5","Vibration alarm / sensor?",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.2.1.e","Equipment siting and protection",2,null,2,5,0,0,0,0,{"$f":"IF(J76=\"\",\"\",IF(D76=\"\",0,IF(D76=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D76=\"Yes\"),AND($M$1=\"Scaled\",D76>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D76=\"No\"),AND($M$1=\"Scaled\",D76<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[442,"F.2.6","Monitored fire alarm?",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.2.1.e","Equipment siting and protection",2,null,2,6,0,0,0,0,{"$f":"IF(J77=\"\",\"\",IF(D77=\"\",0,IF(D77=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D77=\"Yes\"),AND($M$1=\"Scaled\",D77>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D77=\"No\"),AND($M$1=\"Scaled\",D77<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[443,"F.2.7","Fire suppression (e.g., dry, chemical, wet pipe)?",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.2.1.e","Equipment siting and protection",2,null,2,7,0,0,0,0,{"$f":"IF(J78=\"\",\"\",IF(D78=\"\",0,IF(D78=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D78=\"Yes\"),AND($M$1=\"Scaled\",D78>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D78=\"No\"),AND($M$1=\"Scaled\",D78<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[447,"F.2.8","Multiple power feeds?",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.2.2","Supporting utilities",2,null,2,8,0,0,0,0,{"$f":"IF(J79=\"\",\"\",IF(D79=\"\",0,IF(D79=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D79=\"Yes\"),AND($M$1=\"Scaled\",D79>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D79=\"No\"),AND($M$1=\"Scaled\",D79<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[448,"F.2.9","Multiple communication feeds?",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.2.2","Supporting utilities",2,null,2,9,0,0,0,0,{"$f":"IF(J80=\"\",\"\",IF(D80=\"\",0,IF(D80=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D80=\"Yes\"),AND($M$1=\"Scaled\",D80>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D80=\"No\"),AND($M$1=\"Scaled\",D80<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[455,"F.2.10","Are there generator(s)?",null,null,null,"F.1 Environmental Controls – Computing Hardware","11.2.2","Supporting utilities",2,null,2,10,0,0,0,0,{"$f":"IF(J81=\"\",\"\",IF(D81=\"\",0,IF(D81=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D81=\"Yes\"),AND($M$1=\"Scaled\",D81>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D81=\"No\"),AND($M$1=\"Scaled\",D81<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[403,"F.2.11","Is access to the data center restricted and logs kept of all access?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.2.c","Physical entry controls",2,null,2,11,0,0,0,0,{"$f":"IF(J82=\"\",\"\",IF(D82=\"\",0,IF(D82=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D82=\"Yes\"),AND($M$1=\"Scaled\",D82>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D82=\"No\"),AND($M$1=\"Scaled\",D82<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[411,"F.2.11.1","Badge readers at points of entry?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.2","Physical entry controls",3,null,2,11,1,0,0,0,{"$f":"IF(J83=\"\",\"\",IF(D83=\"\",0,IF(D83=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D83=\"Yes\"),AND($M$1=\"Scaled\",D83>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D83=\"No\"),AND($M$1=\"Scaled\",D83<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[413,"F.2.11.2","Locked doors requiring a key or PIN at points of entry?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.2","Physical entry controls",3,null,2,11,2,0,0,0,{"$f":"IF(J84=\"\",\"\",IF(D84=\"\",0,IF(D84=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D84=\"Yes\"),AND($M$1=\"Scaled\",D84>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D84=\"No\"),AND($M$1=\"Scaled\",D84<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[404,"F.2.11.3","Access request procedures?",null,null,null,"H.7 Physical Access Controls","9.1.1.g","Access control policy",3,null,2,11,3,0,0,0,{"$f":"IF(J85=\"\",\"\",IF(D85=\"\",0,IF(D85=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D85=\"Yes\"),AND($M$1=\"Scaled\",D85>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D85=\"No\"),AND($M$1=\"Scaled\",D85<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[406,"F.2.11.3.1","Segregation of duties for issuing and approving access?",null,null,null,"H.7 Physical Access Controls","9.1.1.f","Access control policy",4,null,2,11,3,1,0,0,{"$f":"IF(J86=\"\",\"\",IF(D86=\"\",0,IF(D86=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D86=\"Yes\"),AND($M$1=\"Scaled\",D86>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D86=\"No\"),AND($M$1=\"Scaled\",D86<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[407,"F.2.11.3.2","Access reviews conducted at least every six months?",null,null,null,"F.2 Physical Security Controls – Scoped Systems and Data","9.1.1.h                                       9.2.5","Access control policy,         Review of user access rights",4,null,2,11,3,2,0,0,{"$f":"IF(J87=\"\",\"\",IF(D87=\"\",0,IF(D87=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D87=\"Yes\"),AND($M$1=\"Scaled\",D87>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D87=\"No\"),AND($M$1=\"Scaled\",D87<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[420,"F.2.11.4","Is there a mechanism to thwart tailgating / piggybacking into the data center?",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,3,null,2,11,4,0,0,0,{"$f":"IF(J88=\"\",\"\",IF(D88=\"\",0,IF(D88=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D88=\"Yes\"),AND($M$1=\"Scaled\",D88>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D88=\"No\"),AND($M$1=\"Scaled\",D88<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[414,"F.2.12","Are there security guards at points of entry?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.1.c","Physical security perimeter",2,null,2,12,0,0,0,0,{"$f":"IF(J89=\"\",\"\",IF(D89=\"\",0,IF(D89=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D89=\"Yes\"),AND($M$1=\"Scaled\",D89>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D89=\"No\"),AND($M$1=\"Scaled\",D89<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[415,"F.2.12.1","Do the security guards monitor security systems and alarms?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.1.c","Physical security perimeter",3,null,2,12,1,0,0,0,{"$f":"IF(J90=\"\",\"\",IF(D90=\"\",0,IF(D90=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D90=\"Yes\"),AND($M$1=\"Scaled\",D90>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D90=\"No\"),AND($M$1=\"Scaled\",D90<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[417,"F.2.13","Are visitors permitted in the data center?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.2","Physical entry controls",2,null,2,13,0,0,0,0,{"$f":"IF(J91=\"\",\"\",IF(D91=\"\",0,IF(D91=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D91=\"Yes\"),AND($M$1=\"Scaled\",D91>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D91=\"No\"),AND($M$1=\"Scaled\",D91<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[418,"F.2.13.1","Are they required to sign in and out of the data center?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.2.a","Physical entry controls",3,null,2,13,1,0,0,0,{"$f":"IF(J92=\"\",\"\",IF(D92=\"\",0,IF(D92=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D92=\"Yes\"),AND($M$1=\"Scaled\",D92>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D92=\"No\"),AND($M$1=\"Scaled\",D92<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[419,"F.2.13.2","Are they escorted within the data center?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.2.a","Physical entry controls",3,null,2,13,2,0,0,0,{"$f":"IF(J93=\"\",\"\",IF(D93=\"\",0,IF(D93=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D93=\"Yes\"),AND($M$1=\"Scaled\",D93>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D93=\"No\"),AND($M$1=\"Scaled\",D93<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[421,"F.2.14","Are all entry and exit points to the data center alarmed?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.1.f","Physical security perimeter",2,null,2,14,0,0,0,0,{"$f":"IF(J94=\"\",\"\",IF(D94=\"\",0,IF(D94=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D94=\"Yes\"),AND($M$1=\"Scaled\",D94>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D94=\"No\"),AND($M$1=\"Scaled\",D94<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[422,"F.2.14.1","Are there alarm motion sensors monitoring the data center?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.1.f","Physical security perimeter",3,null,2,14,1,0,0,0,{"$f":"IF(J95=\"\",\"\",IF(D95=\"\",0,IF(D95=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D95=\"Yes\"),AND($M$1=\"Scaled\",D95>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D95=\"No\"),AND($M$1=\"Scaled\",D95<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2578,"F.2.15","Is access to the Data center monitored with CCTV and the video stored for at least 90 days?",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,2,null,2,15,0,0,0,0,{"$f":"IF(J96=\"\",\"\",IF(D96=\"\",0,IF(D96=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D96=\"Yes\"),AND($M$1=\"Scaled\",D96>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D96=\"No\"),AND($M$1=\"Scaled\",D96<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[430,"F.2.16","Walls extending from true floor to true ceiling?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.1.b","Physical security perimeter",2,null,2,16,0,0,0,0,{"$f":"IF(J97=\"\",\"\",IF(D97=\"\",0,IF(D97=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D97=\"Yes\"),AND($M$1=\"Scaled\",D97>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D97=\"No\"),AND($M$1=\"Scaled\",D97<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[432,"F.2.17","Windows or glass walls along the perimeter?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.1.b","Physical security perimeter",2,null,2,17,0,0,0,0,{"$f":"IF(J98=\"\",\"\",IF(D98=\"\",0,IF(D98=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D98=\"Yes\"),AND($M$1=\"Scaled\",D98>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D98=\"No\"),AND($M$1=\"Scaled\",D98<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[457,"F.2.18","Do the Scoped Systems and Data reside in a caged environment within a data center? If yes, is there a:",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,2,null,2,18,0,0,0,0,{"$f":"IF(J99=\"\",\"\",IF(D99=\"\",0,IF(D99=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D99=\"Yes\"),AND($M$1=\"Scaled\",D99>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D99=\"No\"),AND($M$1=\"Scaled\",D99<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[461,"F.2.18.1","Lock requiring a key or PIN used at points of entry?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.2","Physical entry controls",3,null,2,18,1,0,0,0,{"$f":"IF(J100=\"\",\"\",IF(D100=\"\",0,IF(D100=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D100=\"Yes\"),AND($M$1=\"Scaled\",D100>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D100=\"No\"),AND($M$1=\"Scaled\",D100<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[462,"F.2.18.2","Process for requesting access?",null,null,null,"F.2 Physical Security Controls – Target Data","9.1.1.g","Access control policy",3,null,2,18,2,0,0,{"$f":"IF(OR(Master=\"Master\",J101=0,K101=1),0,IF(ISNA(VLOOKUP(A101,L2_Array,22,FALSE)),0,VLOOKUP(A101,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J101=\"\",\"\",IF(D101=\"\",0,IF(D101=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D101=\"Yes\"),AND($M$1=\"Scaled\",D101>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D101=\"No\"),AND($M$1=\"Scaled\",D101<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[463,"F.2.18.2.1","Segregation of duties for granting and storage of access devices (badges, keys, etc.)?",null,null,null,"F.2 Physical Security Controls – Target Data","9.1.1.f","Access control policy",4,null,2,18,2,1,0,0,{"$f":"IF(J102=\"\",\"\",IF(D102=\"\",0,IF(D102=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D102=\"Yes\"),AND($M$1=\"Scaled\",D102>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D102=\"No\"),AND($M$1=\"Scaled\",D102<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[465,"F.2.18.3","List maintained of personnel with cards / keys to the caged environment?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.1.c","Physical security perimeter",3,null,2,18,3,0,0,0,{"$f":"IF(J103=\"\",\"\",IF(D103=\"\",0,IF(D103=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D103=\"Yes\"),AND($M$1=\"Scaled\",D103>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D103=\"No\"),AND($M$1=\"Scaled\",D103<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[466,"F.2.18.4","Process to report lost access cards / keys?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.2.d","Physical entry controls",3,null,2,18,4,0,0,0,{"$f":"IF(J104=\"\",\"\",IF(D104=\"\",0,IF(D104=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D104=\"Yes\"),AND($M$1=\"Scaled\",D104>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D104=\"No\"),AND($M$1=\"Scaled\",D104<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[467,"F.2.18.5","Process to review access to the cage at least every six months?",null,null,null,"F.2 Physical Security Controls – Target Data","9.1.1.h                                       9.2.5","Access control policy,         Review of user access rights",3,null,2,18,5,0,0,0,{"$f":"IF(J105=\"\",\"\",IF(D105=\"\",0,IF(D105=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D105=\"Yes\"),AND($M$1=\"Scaled\",D105>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D105=\"No\"),AND($M$1=\"Scaled\",D105<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[469,"F.2.18.6","Process to collect access equipment (badges, keys, change pin numbers, etc.) when a constituent is terminated or changes status and no longer requires access?",null,null,null,"H.2 Revoke System and Physical Access","9.1.1.i","Access control policy",3,null,2,18,6,0,0,0,{"$f":"IF(J106=\"\",\"\",IF(D106=\"\",0,IF(D106=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D106=\"Yes\"),AND($M$1=\"Scaled\",D106>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D106=\"No\"),AND($M$1=\"Scaled\",D106<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[471,"F.2.18.7","Are visitors permitted in the caged environment? If yes, are they:",null,null,null,"F.2 Physical Security Controls – Scoped Systems and Data","11.1.2","Physical entry controls",3,null,2,18,7,0,0,0,{"$f":"IF(J107=\"\",\"\",IF(D107=\"\",0,IF(D107=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D107=\"Yes\"),AND($M$1=\"Scaled\",D107>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D107=\"No\"),AND($M$1=\"Scaled\",D107<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[472,"F.2.18.7.1","Required to sign in and out?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.2.a","Physical entry controls",4,null,2,18,7,1,0,0,{"$f":"IF(J108=\"\",\"\",IF(D108=\"\",0,IF(D108=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D108=\"Yes\"),AND($M$1=\"Scaled\",D108>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D108=\"No\"),AND($M$1=\"Scaled\",D108<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[473,"F.2.18.7.2","Escorted?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.2.a ","Physical entry controls",4,null,2,18,7,2,0,0,{"$f":"IF(J109=\"\",\"\",IF(D109=\"\",0,IF(D109=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D109=\"Yes\"),AND($M$1=\"Scaled\",D109>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D109=\"No\"),AND($M$1=\"Scaled\",D109<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[474,"F.2.18.8","Monitored with CCTV and the video stored for at least 90 days?",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,3,null,2,18,8,0,0,0,{"$f":"IF(J110=\"\",\"\",IF(D110=\"\",0,IF(D110=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D110=\"Yes\"),AND($M$1=\"Scaled\",D110>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D110=\"No\"),AND($M$1=\"Scaled\",D110<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[477,"F.2.19","Do the Scoped Systems and Data reside in a locked cabinet? If yes, is there:",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,2,null,2,19,0,0,0,0,{"$f":"IF(J111=\"\",\"\",IF(D111=\"\",0,IF(D111=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D111=\"Yes\"),AND($M$1=\"Scaled\",D111>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D111=\"No\"),AND($M$1=\"Scaled\",D111<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[478,"F.2.19.1","Shared cabinets?",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,3,null,2,19,1,0,0,0,{"$f":"IF(J112=\"\",\"\",IF(D112=\"\",0,IF(D112=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D112=\"Yes\"),AND($M$1=\"Scaled\",D112>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D112=\"No\"),AND($M$1=\"Scaled\",D112<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[479,"F.2.19.2","Restricted access and logs kept of all access?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.2.c","Physical entry controls",3,null,2,19,2,0,0,0,{"$f":"IF(J113=\"\",\"\",IF(D113=\"\",0,IF(D113=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D113=\"Yes\"),AND($M$1=\"Scaled\",D113>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D113=\"No\"),AND($M$1=\"Scaled\",D113<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[480,"F.2.19.3","Access request procedures?",null,null,null,"F.2 Physical Security Controls – Target Data","9.1.1.g","Access control policy",3,null,2,19,3,0,0,0,{"$f":"IF(J114=\"\",\"\",IF(D114=\"\",0,IF(D114=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D114=\"Yes\"),AND($M$1=\"Scaled\",D114>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D114=\"No\"),AND($M$1=\"Scaled\",D114<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[481,"F.2.19.4","Segregation of duties for issuing, approving access and storing devices (badges, keys, etc.)?",null,null,null,"F.2 Physical Security Controls – Target Data","9.1.1.f","Access control policy",3,null,2,19,4,0,0,0,{"$f":"IF(J115=\"\",\"\",IF(D115=\"\",0,IF(D115=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D115=\"Yes\"),AND($M$1=\"Scaled\",D115>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D115=\"No\"),AND($M$1=\"Scaled\",D115<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[483,"F.2.19.5","A list of personnel with cards / keys to the cabinet?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.1.c","Physical security perimeter",3,null,2,19,5,0,0,0,{"$f":"IF(J116=\"\",\"\",IF(D116=\"\",0,IF(D116=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D116=\"Yes\"),AND($M$1=\"Scaled\",D116>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D116=\"No\"),AND($M$1=\"Scaled\",D116<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[484,"F.2.19.6","A process to report lost access cards / keys?",null,null,null,"F.2 Physical Security Controls – Target Data","11.1.2.d","Physical entry controls",3,null,2,19,6,0,0,0,{"$f":"IF(J117=\"\",\"\",IF(D117=\"\",0,IF(D117=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D117=\"Yes\"),AND($M$1=\"Scaled\",D117>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D117=\"No\"),AND($M$1=\"Scaled\",D117<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[485,"F.2.19.7","Collection access equipment (badges, keys, change pin numbers, etc.) when a constituent is terminated or changes status and no longer requires access?",null,null,null,"H.2 Revoke System and Physical Access","9.1.1.i","Access control policy",3,null,2,19,7,0,0,0,{"$f":"IF(J118=\"\",\"\",IF(D118=\"\",0,IF(D118=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D118=\"Yes\"),AND($M$1=\"Scaled\",D118>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D118=\"No\"),AND($M$1=\"Scaled\",D118<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[487,"F.2.19.8","Cabinets monitored with CCTV and the video stored for at least 90 days?",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,3,null,2,19,8,0,0,0,{"$f":"IF(J119=\"\",\"\",IF(D119=\"\",0,IF(D119=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D119=\"Yes\"),AND($M$1=\"Scaled\",D119>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D119=\"No\"),AND($M$1=\"Scaled\",D119<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[490,"F.2.20","Is there a policy on using locking screensavers on unattended system displays or locks on consoles within the data center?",null,null,null,"F.2 Physical Security Controls – Target Data","11.2.8                                       11.2.9","Unattended user equipment, Clear desk and clear screen policy",2,null,2,20,0,0,0,0,{"$f":"IF(J120=\"\",\"\",IF(D120=\"\",0,IF(D120=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D120=\"Yes\"),AND($M$1=\"Scaled\",D120>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D120=\"No\"),AND($M$1=\"Scaled\",D120<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[491,"F.2.21","Is there a procedure for equipment removal from the data center?",null,null,null,"F.2 Physical Security Controls – Target Data","11.2.6","Security of equipment and assets off-premises",2,null,2,21,0,0,0,0,{"$f":"IF(J121=\"\",\"\",IF(D121=\"\",0,IF(D121=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D121=\"Yes\"),AND($M$1=\"Scaled\",D121>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D121=\"No\"),AND($M$1=\"Scaled\",D121<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[526,"F.2.22","Is there a preventive maintenance or current maintenance contracts for:",null,null,null,"F.2 Physical Security Controls – Target Data","11.2.4","Equipment maintenance",2,1,2,22,0,0,0,0,{"$f":"IF(J122=\"\",\"\",IF(D122=\"\",0,IF(D122=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D122=\"Yes\"),AND($M$1=\"Scaled\",D122>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D122=\"No\"),AND($M$1=\"Scaled\",D122<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[527,"F.2.22.1","UPS system?",null,null,null,"F.2 Physical Security Controls – Target Data","11.2.4","Equipment maintenance",3,null,2,22,1,0,0,0,{"$f":"IF(J123=\"\",\"\",IF(D123=\"\",0,IF(D123=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D123=\"Yes\"),AND($M$1=\"Scaled\",D123>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D123=\"No\"),AND($M$1=\"Scaled\",D123<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[528,"F.2.22.2","Security system?",null,null,null,"F.2 Physical Security Controls – Target Data","11.2.4","Equipment maintenance",3,null,2,22,2,0,0,0,{"$f":"IF(J124=\"\",\"\",IF(D124=\"\",0,IF(D124=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D124=\"Yes\"),AND($M$1=\"Scaled\",D124>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D124=\"No\"),AND($M$1=\"Scaled\",D124<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[529,"F.2.22.3","Generator?",null,null,null,"F.2 Physical Security Controls – Target Data","11.2.4","Equipment maintenance",3,null,2,22,3,0,0,0,{"$f":"IF(J125=\"\",\"\",IF(D125=\"\",0,IF(D125=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D125=\"Yes\"),AND($M$1=\"Scaled\",D125>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D125=\"No\"),AND($M$1=\"Scaled\",D125<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[530,"F.2.22.4","Batteries?",null,null,null,"F.2 Physical Security Controls – Target Data","11.2.4","Equipment maintenance",3,null,2,22,4,0,0,0,{"$f":"IF(J126=\"\",\"\",IF(D126=\"\",0,IF(D126=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D126=\"Yes\"),AND($M$1=\"Scaled\",D126>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D126=\"No\"),AND($M$1=\"Scaled\",D126<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[531,"F.2.22.5","Monitored fire alarm?",null,null,null,"F.2 Physical Security Controls – Target Data","11.2.4","Equipment maintenance",3,null,2,22,5,0,0,0,{"$f":"IF(J127=\"\",\"\",IF(D127=\"\",0,IF(D127=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D127=\"Yes\"),AND($M$1=\"Scaled\",D127>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D127=\"No\"),AND($M$1=\"Scaled\",D127<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[532,"F.2.22.6","Fire suppression systems?",null,null,null,"F.2 Physical Security Controls – Target Data","11.2.4","Equipment maintenance",3,null,2,22,6,0,0,0,{"$f":"IF(J128=\"\",\"\",IF(D128=\"\",0,IF(D128=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D128=\"Yes\"),AND($M$1=\"Scaled\",D128>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D128=\"No\"),AND($M$1=\"Scaled\",D128<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[533,"F.2.22.7","HVAC?",null,null,null,"F.2 Physical Security Controls – Target Data","11.2.4","Equipment maintenance",3,null,2,22,7,0,0,0,{"$f":"IF(J129=\"\",\"\",IF(D129=\"\",0,IF(D129=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D129=\"Yes\"),AND($M$1=\"Scaled\",D129>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D129=\"No\"),AND($M$1=\"Scaled\",D129<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[534,"F.2.23","Are the following tested:",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,2,1,2,23,0,0,0,0,{"$f":"IF(J130=\"\",\"\",IF(D130=\"\",0,IF(D130=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D130=\"Yes\"),AND($M$1=\"Scaled\",D130>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D130=\"No\"),AND($M$1=\"Scaled\",D130<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[535,"F.2.23.1","UPS system - annually?",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,3,null,2,23,1,0,0,0,{"$f":"IF(J131=\"\",\"\",IF(D131=\"\",0,IF(D131=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D131=\"Yes\"),AND($M$1=\"Scaled\",D131>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D131=\"No\"),AND($M$1=\"Scaled\",D131<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[536,"F.2.23.2","Security alarm system - annually?",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,3,null,2,23,2,0,0,0,{"$f":"IF(J132=\"\",\"\",IF(D132=\"\",0,IF(D132=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D132=\"Yes\"),AND($M$1=\"Scaled\",D132>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D132=\"No\"),AND($M$1=\"Scaled\",D132<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[537,"F.2.23.3","Fire alarms - annually?",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,3,null,2,23,3,0,0,0,{"$f":"IF(J133=\"\",\"\",IF(D133=\"\",0,IF(D133=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D133=\"Yes\"),AND($M$1=\"Scaled\",D133>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D133=\"No\"),AND($M$1=\"Scaled\",D133<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[538,{"$f":"IF(J134=0,\"\",IF(J134=1,Q$1&\".\"&L134,IF(J134=2,Q$1&\".\"&L134&\".\"&M134,IF(J134=3,Q$1&\".\"&L134&\".\"&M134&\".\"&N134,IF(J134=4,Q$1&\".\"&L134&\".\"&M134&\".\"&N134&\".\"&O134,IF(J134=5,Q$1&\".\"&L134&\".\"&M134&\".\"&N134&\".\"&O134&\".\"&P134))))))","v":"F.2.23.4"},"Fire suppression system - annually?",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,3,null,{"$f":"IF(L133=\"\",1,IF(J134=1,L133+1,L133))","v":2},{"$f":"IF(M133=\"\",0,IF(L133<>L134,0,IF($J134=2,M133+1,M133)))","v":23},{"$f":"IF(N133=\"\",0,IF(M133<>M134,0,IF($J134=3,N133+1,N133)))","v":4},{"$f":"IF(O133=\"\",0,IF(N133<>N134,0,IF($J134=4,O133+1,O133)))","v":0},{"$f":"IF(P133=\"\",0,IF(O133<>O134,0,IF($J134=5,P133+1,P133)))","v":0},0,{"$f":"IF(J134=\"\",\"\",IF(D134=\"\",0,IF(D134=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D134=\"Yes\"),AND($M$1=\"Scaled\",D134>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D134=\"No\"),AND($M$1=\"Scaled\",D134<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J134=\"\",\"\",IF(Q134>0,Q134,IF(R134>0,R134,0)))","v":0},{"$f":"IF(J134=\"\",\"\",IF(OR(J134=1,T133=\"\"),1,IF(OR(AND(K133=1,(J134-J132<>0)),AND(T133=0,J133=J134),AND(K133=1,J134=J132)),0,1)))","v":0},{"$f":"IF(J134=\"\",U133,IF(AND(S134>1,OR(U133=\"\",U133=0,U133>=J134)),J134,IF(J134>U133,U133,0)))","v":0},{"$f":"IF(Master=\"Master\",R134,IF(V133=\"\",S134,IF(OR(AND(U134>0,S134<V133),AND(U134=1,S134<=V133)),V133,S134)))","v":0},{"$f":"IF(J134=\"\",\"\",IF(OR(AND(T133=1,U134=1),S134>0,AND(T135=0,W135=1)),1,0))","v":0},{"$f":"IF(J134=\"\",\"\",IF(OR(AND(U134>0,T134=1),AND(T134=1,W134=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A134,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(J134=1,S134=1),2,IF(AND(V133=1,L134=L133),2,IF(AND(AC133=2,L134=L133),2,IF(J134=1,1,\"\"))))","v":""}]
[539,"F.2.23.5","Generators - monthly?",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,3,null,2,23,5,0,0,0,{"$f":"IF(J135=\"\",\"\",IF(D135=\"\",0,IF(D135=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D135=\"Yes\"),AND($M$1=\"Scaled\",D135>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D135=\"No\"),AND($M$1=\"Scaled\",D135<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[540,"F.2.23.6","Generators full load tested - monthly?",null,null,null,"F.2 Physical Security Controls – Target Data","NA",null,3,null,2,23,6,0,0,0,{"$f":"IF(J136=\"\",\"\",IF(D136=\"\",0,IF(D136=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D136=\"Yes\"),AND($M$1=\"Scaled\",D136>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D136=\"No\"),AND($M$1=\"Scaled\",D136<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]

{"sheet":"G. Communications and Ops Mgmt","index":13,"n_rows":293,"n_cols":30,"rows_kept":293,"cut":false,"hidden":false,"merged":[[2,1,2,8]]}
[11,"G. Communications and Operations Management",null,null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,"Binary","Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"G"}]
[null,null,null,{"$f":"IF(X2=0,\"0%\",X2/T2)","v":"0%"},"Percent Complete",null,"Tab Automation:","Enable",null,{"$f":"COUNTA(J5:J293)","v":289},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(T5:T293,1)","v":265},null,null,null,{"$f":"COUNTIF(X5:X293,1)","v":0}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column F to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, select the word \"Disable\" in the Tab Automation field at the top of the page.\n     - Use the Maturity column to identify the maturity of the question. See the How To Guide for instructions on filling out this field.",null,null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter","Maturity N/A"]
[{"$f":"MAX(A5:A293)","v":4116},"Ques Num","Question/Request","Response","Maturity","Additional Information","AUP Reference","ISO 27002:2013 Relevance"]
[2582,{"$f":"IF(J5=0,\"\",IF(J5=1,Q$1&\".\"&L5,IF(J5=2,Q$1&\".\"&L5&\".\"&M5,IF(J5=3,Q$1&\".\"&L5&\".\"&M5&\".\"&N5,IF(J5=4,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5,IF(J5=5,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5&\".\"&P5))))))","v":"G.1"},"Are management approved operating procedures utilized? If yes, are they:",null,null,null,"G. Communications and Operations Management","12.1.1","Documented Operating Procedure",1,null,{"$f":"IF(L4=\"\",1,IF(J5=1,L4+1,L4))","v":1},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($J5=2,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($J5=3,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($J5=4,O4+1,O4)))","v":0},{"$f":"IF(P4=\"\",0,IF(O4<>O5,0,IF($J5=5,P4+1,P4)))","v":0},{"$f":"IF(OR(Master=\"Master\",J5=0,K5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,22,FALSE)),0,VLOOKUP(A5,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D5=\"Yes\"),AND($M$1=\"Scaled\",D5>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D5=\"No\"),AND($M$1=\"Scaled\",D5<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J5=\"\",\"\",IF(Q5>0,Q5,IF(R5>0,R5,0)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(J5=1,T4=\"\"),1,IF(OR(AND(K4=1,(J5-J3<>0)),AND(T4=0,J4=J5),AND(K4=1,J5=J3)),0,1)))","v":1},{"$f":"IF(J5=\"\",U4,IF(AND(S5>1,OR(U4=\"\",U4=0,U4>=J5)),J5,IF(J5>U4,U4,0)))","v":0},{"$f":"IF(Master=\"Master\",R5,IF(V4=\"\",S5,IF(OR(AND(U5>0,S5<V4),AND(U5=1,S5<=V4)),V4,S5)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(T4=1,U5=1),S5>0,AND(T6=0,W6=1)),1,0))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(U5>0,T5=1),AND(T5=1,W5=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(J5=1,S5=1),2,IF(AND(V4=1,L5=L4),2,IF(AND(AC4=2,L5=L4),2,IF(J5=1,1,\"\"))))","v":1}]
[2583,{"$f":"IF(J6=0,\"\",IF(J6=1,Q$1&\".\"&L6,IF(J6=2,Q$1&\".\"&L6&\".\"&M6,IF(J6=3,Q$1&\".\"&L6&\".\"&M6&\".\"&N6,IF(J6=4,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6,IF(J6=5,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6&\".\"&P6))))))","v":"G.1.1"},"Documented, maintained, and made available to all users?",null,null,null,"G. Communications and Operations Management","12.1.1","Documented Operating Procedure",2,null,{"$f":"IF(L5=\"\",1,IF(J6=1,L5+1,L5))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($J6=2,M5+1,M5)))","v":1},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($J6=3,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($J6=4,O5+1,O5)))","v":0},{"$f":"IF(P5=\"\",0,IF(O5<>O6,0,IF($J6=5,P5+1,P5)))","v":0},{"$f":"IF(OR(Master=\"Master\",J6=0,K6=1),0,IF(ISNA(VLOOKUP(A6,L2_Array,22,FALSE)),0,VLOOKUP(A6,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D6=\"Yes\"),AND($M$1=\"Scaled\",D6>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D6=\"No\"),AND($M$1=\"Scaled\",D6<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J6=\"\",\"\",IF(Q6>0,Q6,IF(R6>0,R6,0)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(J6=1,T5=\"\"),1,IF(OR(AND(K5=1,(J6-J4<>0)),AND(T5=0,J5=J6),AND(K5=1,J6=J4)),0,1)))","v":1},{"$f":"IF(J6=\"\",U5,IF(AND(S6>1,OR(U5=\"\",U5=0,U5>=J6)),J6,IF(J6>U5,U5,0)))","v":0},{"$f":"IF(Master=\"Master\",R6,IF(V5=\"\",S6,IF(OR(AND(U6>0,S6<V5),AND(U6=1,S6<=V5)),V5,S6)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(T5=1,U6=1),S6>0,AND(T7=0,W7=1)),1,0))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(U6>0,T6=1),AND(T6=1,W6=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A6,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(J6=1,S6=1),2,IF(AND(V5=1,L6=L5),2,IF(AND(AC5=2,L6=L5),2,IF(J6=1,1,\"\"))))","v":""}]
[816,"G.2","Is there an operational change management/change control policy or program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy? If yes, does it include:",null,null,null,"G.21 Change Control","12.1.2","Change Management",1,null,2,0,0,0,0,0,{"$f":"IF(J7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D7=\"Yes\"),AND($M$1=\"Scaled\",D7>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D7=\"No\"),AND($M$1=\"Scaled\",D7<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[828,"G.2.1","Documentation of changes?",null,null,null,"G.21 Change Control","12.1.2.a","Change Management",2,null,2,1,0,0,0,0,{"$f":"IF(J8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D8=\"Yes\"),AND($M$1=\"Scaled\",D8>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D8=\"No\"),AND($M$1=\"Scaled\",D8<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[823,"G.2.2","Request, review and approval of proposed changes?",null,null,null,"G.21 Change Control","12.1.2.d","Change Management",2,null,2,2,0,0,0,0,{"$f":"IF(J9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D9=\"Yes\"),AND($M$1=\"Scaled\",D9>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D9=\"No\"),AND($M$1=\"Scaled\",D9<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[829,"G.2.3","Pre-implementation testing?",null,null,null,"G.21 Change Control","12.1.2.b","Change Management",2,null,2,3,0,0,0,0,{"$f":"IF(J10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D10=\"Yes\"),AND($M$1=\"Scaled\",D10>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D10=\"No\"),AND($M$1=\"Scaled\",D10<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[830,"G.2.4","Post-implementation testing?",null,null,null,"G.21 Change Control","12.1.2.b","Change Management",2,null,2,4,0,0,0,0,{"$f":"IF(J11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D11=\"Yes\"),AND($M$1=\"Scaled\",D11>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D11=\"No\"),AND($M$1=\"Scaled\",D11<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[824,"G.2.5","Review for potential security impact?",null,null,null,"G.21 Change Control","12.1.2.c","Change Management",2,null,2,5,0,0,0,0,{"$f":"IF(J12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D12=\"Yes\"),AND($M$1=\"Scaled\",D12>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D12=\"No\"),AND($M$1=\"Scaled\",D12<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[826,"G.2.6","Review for potential operational impact?",null,null,null,"G.21 Change Control","12.1.2.c","Change Management",2,null,2,6,0,0,0,0,{"$f":"IF(J13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D13=\"Yes\"),AND($M$1=\"Scaled\",D13>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D13=\"No\"),AND($M$1=\"Scaled\",D13<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2593,"G.2.7","Communication of changes to all relevant constituents?",null,null,null,"G.21 Change Control","12.1.2.f","Change Management",2,null,2,7,0,0,0,0,{"$f":"IF(J14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D14=\"Yes\"),AND($M$1=\"Scaled\",D14>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D14=\"No\"),AND($M$1=\"Scaled\",D14<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[831,"G.2.8","Rollback procedures?",null,null,null,"G.21 Change Control","12.1.2.g","Change Management",2,null,2,8,0,0,0,0,{"$f":"IF(J15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D15=\"Yes\"),AND($M$1=\"Scaled\",D15>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D15=\"No\"),AND($M$1=\"Scaled\",D15<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[841,"G.2.9","Maintenance of change control logs?",null,null,null,"G.21 Change Control","14.2.2.j","System change control procedures",2,null,2,9,0,0,0,0,{"$f":"IF(J16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D16=\"Yes\"),AND($M$1=\"Scaled\",D16>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D16=\"No\"),AND($M$1=\"Scaled\",D16<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[837,"G.2.10","Code reviewed by information security prior to the implementation of internally developed applications and / or application updates?",null,null,null,"G.21 Change Control","14.2.2.e","System change control procedures",2,null,2,10,0,0,0,0,{"$f":"IF(J17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D17=\"Yes\"),AND($M$1=\"Scaled\",D17>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D17=\"No\"),AND($M$1=\"Scaled\",D17<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[839,"G.2.11","Is Information security's approval required prior to implementation changes?",null,null,null,"G.21 Change Control","14.2.2.f","System change control procedures",2,null,2,11,0,0,0,0,{"$f":"IF(J18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D18=\"Yes\"),AND($M$1=\"Scaled\",D18>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D18=\"No\"),AND($M$1=\"Scaled\",D18<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[832,"G.2.12","Are the following changes to the production environment subject to the change control process:",null,null,null,"G.21 Change Control","12.1.2                                      14.2.2","Change Management System change control procedures",2,1,2,12,0,0,0,0,{"$f":"IF(J19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D19=\"Yes\"),AND($M$1=\"Scaled\",D19>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D19=\"No\"),AND($M$1=\"Scaled\",D19<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[833,"G.2.12.1","Network?",null,null,null,"G.21 Change Control","14.2.2","System change control procedures",3,null,2,12,1,0,0,0,{"$f":"IF(J20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D20=\"Yes\"),AND($M$1=\"Scaled\",D20>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D20=\"No\"),AND($M$1=\"Scaled\",D20<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[834,"G.2.12.2","Systems?",null,null,null,"G.21 Change Control","14.2.2","System change control procedures",3,null,2,12,2,0,0,0,{"$f":"IF(J21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D21=\"Yes\"),AND($M$1=\"Scaled\",D21>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D21=\"No\"),AND($M$1=\"Scaled\",D21<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[835,"G.2.12.3","Application updates?",null,null,null,"G.21 Change Control","14.2.2","System change control procedures",3,null,2,12,3,0,0,0,{"$f":"IF(J22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D22=\"Yes\"),AND($M$1=\"Scaled\",D22>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D22=\"No\"),AND($M$1=\"Scaled\",D22<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[836,"G.2.12.4","Code changes?",null,null,null,"G.21 Change Control","14.2.2","System change control procedures",3,null,2,12,4,0,0,0,{"$f":"IF(J23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D23=\"Yes\"),AND($M$1=\"Scaled\",D23>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D23=\"No\"),AND($M$1=\"Scaled\",D23<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[838,"G.2.13","Is there a segregation of duties between those requesting, approving and implementing a change?",null,null,null,"G.21 Change Control","6.1.2","Segregation of Duties",2,null,2,13,0,0,0,0,{"$f":"IF(J24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D24=\"Yes\"),AND($M$1=\"Scaled\",D24>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D24=\"No\"),AND($M$1=\"Scaled\",D24<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[853,"G.3","Do Subcontractors have access to Scoped Systems and Data? (backup vendors, service providers, equipment support maintenance, software maintenance vendors, data recovery vendors, etc.)? If yes, is there:",null,null,null,null,15,"Supplier relationships",1,null,3,0,0,0,0,0,{"$f":"IF(J25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D25=\"Yes\"),AND($M$1=\"Scaled\",D25>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D25=\"No\"),AND($M$1=\"Scaled\",D25<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1,1]
[3897,"G.3.1","Is there a documented subcontractor management process in place for the selection and oversight of third party vendors? If yes, does it include:",null,null,null,"T.1 Subcontractor Selection and Management Process","15.1.1","Information security policy for supplier relationships",2,null,3,1,0,0,0,0,{"$f":"IF(J26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D26=\"Yes\"),AND($M$1=\"Scaled\",D26>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D26=\"No\"),AND($M$1=\"Scaled\",D26<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3898,"G.3.1.1","Approval by management?",null,null,null,"T.1 Subcontractor Selection and Management Process","5.1.1","Policies on information security",3,null,3,1,1,0,0,0,{"$f":"IF(J27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D27=\"Yes\"),AND($M$1=\"Scaled\",D27>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D27=\"No\"),AND($M$1=\"Scaled\",D27<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3899,"G.3.1.2","Annual review?",null,null,null,"T.1 Subcontractor Selection and Management Process","5.1.2","Review of the policies for information security",3,null,3,1,2,0,0,0,{"$f":"IF(J28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D28=\"Yes\"),AND($M$1=\"Scaled\",D28>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D28=\"No\"),AND($M$1=\"Scaled\",D28<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3900,"G.3.1.3","Review of the subcontractor's vendor management policy and procedures?",null,null,null,"T.3 Documenting Information Security Assessments for Subcontractors","15.2.1.g","Monitoring and review of supplier services",3,null,3,1,3,0,0,0,{"$f":"IF(J29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D29=\"Yes\"),AND($M$1=\"Scaled\",D29>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D29=\"No\"),AND($M$1=\"Scaled\",D29<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3901,"G.3.2","Is there a process to identify and log subcontractor information security, privacy and/or data breach issues?",null,null,null,"T.3 Documenting Information Security Assessments for Subcontractors","15.2.1.e","Monitoring and review of supplier services",2,null,3,2,0,0,0,0,{"$f":"IF(J30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D30=\"Yes\"),AND($M$1=\"Scaled\",D30>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D30=\"No\"),AND($M$1=\"Scaled\",D30<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3902,"G.3.3","Do subcontractor's, as part of their vendor risk management program, include the following:",null,null,null,null,"NA",null,2,1,3,3,0,0,0,0,{"$f":"IF(J31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D31=\"Yes\"),AND($M$1=\"Scaled\",D31>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D31=\"No\"),AND($M$1=\"Scaled\",D31<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3903,"G.3.3.1","Comprehensive financial analysis?",null,null,null,"T.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,1,0,0,0,{"$f":"IF(J32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D32=\"Yes\"),AND($M$1=\"Scaled\",D32>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D32=\"No\"),AND($M$1=\"Scaled\",D32<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[3904,"G.3.3.2","Vendor reputational review?",null,null,null,"T.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,2,0,0,0,{"$f":"IF(J33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D33=\"Yes\"),AND($M$1=\"Scaled\",D33>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D33=\"No\"),AND($M$1=\"Scaled\",D33<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[3905,"G.3.3.3","Compliance checks (e.g., Office of Foreign Assets Controls (OFAC), etc.)?",null,null,null,"T.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,3,0,0,0,{"$f":"IF(J34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D34=\"Yes\"),AND($M$1=\"Scaled\",D34>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D34=\"No\"),AND($M$1=\"Scaled\",D34<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[3906,"G.3.3.4","Defined risk assessment and classification method for vendors?",null,null,null,"T.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,4,0,0,0,{"$f":"IF(J35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D35=\"Yes\"),AND($M$1=\"Scaled\",D35>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D35=\"No\"),AND($M$1=\"Scaled\",D35<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[3907,"G.3.3.5","Management of subcontractor risk, compliance and performance?",null,null,null,"T.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,5,0,0,0,{"$f":"IF(J36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D36=\"Yes\"),AND($M$1=\"Scaled\",D36>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D36=\"No\"),AND($M$1=\"Scaled\",D36<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[3908,"G.3.3.6","Ability and right to audit controls? ",null,null,null,"T.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,6,0,0,0,{"$f":"IF(J37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D37=\"Yes\"),AND($M$1=\"Scaled\",D37>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D37=\"No\"),AND($M$1=\"Scaled\",D37<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[3909,"G.3.3.7","Notification of new or change in subcontractors?",null,null,null,"T.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,7,0,0,0,{"$f":"IF(J38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D38=\"Yes\"),AND($M$1=\"Scaled\",D38>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D38=\"No\"),AND($M$1=\"Scaled\",D38<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[3910,"G.3.3.8","Defined procedures for subcontractor management?",null,null,null,"T.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,8,0,0,0,{"$f":"IF(J39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D39=\"Yes\"),AND($M$1=\"Scaled\",D39>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D39=\"No\"),AND($M$1=\"Scaled\",D39<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[3911,"G.3.3.9","Oversight and Governance of program adherence?",null,null,null,"T.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,9,0,0,0,{"$f":"IF(J40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D40=\"Yes\"),AND($M$1=\"Scaled\",D40>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D40=\"No\"),AND($M$1=\"Scaled\",D40<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[873,"G.3.3.10","Security review prior to engaging their services (logical, physical, other controls)?",null,null,null,"T.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,10,0,0,0,{"$f":"IF(J41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D41=\"Yes\"),AND($M$1=\"Scaled\",D41>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D41=\"No\"),AND($M$1=\"Scaled\",D41<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[874,"G.3.3.11","Security review at least annually?",null,null,null,"T.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,11,0,0,0,{"$f":"IF(J42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D42=\"Yes\"),AND($M$1=\"Scaled\",D42>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D42=\"No\"),AND($M$1=\"Scaled\",D42<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[875,"G.3.3.12","Risk assessments or review?",null,null,null,"T.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,12,0,0,0,{"$f":"IF(J43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D43=\"Yes\"),AND($M$1=\"Scaled\",D43>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D43=\"No\"),AND($M$1=\"Scaled\",D43<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[878,"G.3.3.13","Confidentiality and/or Non Disclosure Agreement requirements?",null,null,null,"T.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,13,0,0,0,{"$f":"IF(J44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D44=\"Yes\"),AND($M$1=\"Scaled\",D44>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D44=\"No\"),AND($M$1=\"Scaled\",D44<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[879,"G.3.3.14","Notification of changes affecting services rendered?",null,null,null,"T.3 Documenting Information Security Assessments for Subcontractors","NA",null,3,null,3,3,14,0,0,0,{"$f":"IF(J45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D45=\"Yes\"),AND($M$1=\"Scaled\",D45>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D45=\"No\"),AND($M$1=\"Scaled\",D45<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[895,"G.4","Is there an anti-virus/malware policy or program (workstations, servers, mobile devices) that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?",null,null,null,"G.7 Virus Protection (Servers)\nG.8 Virus Protection (Workstations)","12.2.1","Controls Against Malware",1,null,4,0,0,0,0,0,{"$f":"IF(J46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D46=\"Yes\"),AND($M$1=\"Scaled\",D46>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D46=\"No\"),AND($M$1=\"Scaled\",D46<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[912,"G.4.1","What is the interval between the availability of a new signature update and its deployment:",null,null,null,"G.1 Network Security – IDS / IPS Signature Updates","12.6.1","Management of technical vulnerabilities",2,1,4,1,0,0,0,0,{"$f":"IF(J47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D47=\"Yes\"),AND($M$1=\"Scaled\",D47>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D47=\"No\"),AND($M$1=\"Scaled\",D47<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[913,"G.4.1.1","Hourly?",null,null,null,"G.1 Network Security – IDS / IPS Signature Updates","NA","",3,null,4,1,1,0,0,0,{"$f":"IF(J48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D48=\"Yes\"),AND($M$1=\"Scaled\",D48>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D48=\"No\"),AND($M$1=\"Scaled\",D48<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[914,"G.4.1.2","Daily?",null,null,null,"G.1 Network Security – IDS / IPS Signature Updates","NA","",3,null,4,1,2,0,0,0,{"$f":"IF(J49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D49=\"Yes\"),AND($M$1=\"Scaled\",D49>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D49=\"No\"),AND($M$1=\"Scaled\",D49<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[915,"G.4.1.3","Weekly?",null,null,null,"G.1 Network Security – IDS / IPS Signature Updates","NA","",3,null,4,1,3,0,0,0,{"$f":"IF(J50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D50=\"Yes\"),AND($M$1=\"Scaled\",D50>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D50=\"No\"),AND($M$1=\"Scaled\",D50<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[916,"G.4.1.4","Monthly?",null,null,null,"G.1 Network Security – IDS / IPS Signature Updates","NA","",3,null,4,1,4,0,0,0,{"$f":"IF(J51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D51=\"Yes\"),AND($M$1=\"Scaled\",D51>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D51=\"No\"),AND($M$1=\"Scaled\",D51<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[922,"G.5","Are system backups of Scoped Systems and Data performed?",null,null,null,"G.20 Backup Media Restoration","12.3.1","Information Back-Up",1,null,5,0,0,0,0,0,{"$f":"IF(J52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D52=\"Yes\"),AND($M$1=\"Scaled\",D52>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D52=\"No\"),AND($M$1=\"Scaled\",D52<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1,1]
[923,"G.5.1","Is there a policy or process for the backup of production data? If yes, does it include a requirement to:",null,null,null,"G.20 Backup Media Restoration","12.3.1","Information Back-Up",2,null,5,1,0,0,0,0,{"$f":"IF(J53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D53=\"Yes\"),AND($M$1=\"Scaled\",D53>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D53=\"No\"),AND($M$1=\"Scaled\",D53<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2601,"G.5.1.1","Store backups to avoid any damage from a disaster at the main site?",null,null,null,"G.20 Backup Media Restoration","12.3.1.c","Information Back-Up",3,null,5,1,1,0,0,0,{"$f":"IF(J54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D54=\"Yes\"),AND($M$1=\"Scaled\",D54>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D54=\"No\"),AND($M$1=\"Scaled\",D54<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2602,"G.5.1.2","Test backup media and restoration procedures at least annually?",null,null,null,"G.20 Backup Media Restoration","12.3.1.e","Information Back-Up",3,null,5,1,2,0,0,0,{"$f":"IF(J55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D55=\"Yes\"),AND($M$1=\"Scaled\",D55>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D55=\"No\"),AND($M$1=\"Scaled\",D55<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[951,"G.5.2","Is backup media stored offsite? If yes, is there:",null,null,null,"G.20 Backup Media Restoration","12.3.1.c","Information Back-Up",2,null,5,2,0,0,0,0,{"$f":"IF(J56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D56=\"Yes\"),AND($M$1=\"Scaled\",D56>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D56=\"No\"),AND($M$1=\"Scaled\",D56<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[953,"G.5.2.1","Secure transport?",null,null,null,"G.20 Backup Media Restoration","8.3.3","Physical media transfer",3,null,5,2,1,0,0,0,{"$f":"IF(J57=\"\",\"\",IF(D57=\"\",0,IF(D57=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D57=\"Yes\"),AND($M$1=\"Scaled\",D57>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D57=\"No\"),AND($M$1=\"Scaled\",D57<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[954,"G.5.2.2","Tracking shipments?",null,null,null,"G.20 Backup Media Restoration","8.3.3.e","Exchange Agreements",3,null,5,2,2,0,0,0,{"$f":"IF(J58=\"\",\"\",IF(D58=\"\",0,IF(D58=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D58=\"Yes\"),AND($M$1=\"Scaled\",D58>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D58=\"No\"),AND($M$1=\"Scaled\",D58<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[955,"G.5.2.3","Verification of receipt?",null,null,null,"G.20 Backup Media Restoration","8.3.3.e","Exchange Agreements",3,null,5,2,3,0,0,0,{"$f":"IF(J59=\"\",\"\",IF(D59=\"\",0,IF(D59=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D59=\"Yes\"),AND($M$1=\"Scaled\",D59>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D59=\"No\"),AND($M$1=\"Scaled\",D59<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3688,"G.6","Are firewalls in use for both internal and external network connections?",null,null,null,"G.2 Network Security – Firewall(s)","13.1.3","Segregation in networks",1,null,6,0,0,0,0,0,{"$f":"IF(J60=\"\",\"\",IF(D60=\"\",0,IF(D60=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D60=\"Yes\"),AND($M$1=\"Scaled\",D60>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D60=\"No\"),AND($M$1=\"Scaled\",D60<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1,1]
[976,"G.6.1","Is every connection to an external network terminated at a firewall?",null,null,null,"G.2 Network Security – Firewall(s)","13.1.3","Segregation In Networks",2,null,6,1,0,0,0,0,{"$f":"IF(J61=\"\",\"\",IF(D61=\"\",0,IF(D61=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D61=\"Yes\"),AND($M$1=\"Scaled\",D61>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D61=\"No\"),AND($M$1=\"Scaled\",D61<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3689,"G.6.2","Are firewalls used to segment internal networks?",null,null,null,"G.2 Network Security – Firewall(s)","13.1.3","Segregation In Networks",2,null,6,2,0,0,0,0,{"$f":"IF(J62=\"\",\"\",IF(D62=\"\",0,IF(D62=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D62=\"Yes\"),AND($M$1=\"Scaled\",D62>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D62=\"No\"),AND($M$1=\"Scaled\",D62<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3693,"G.6.3","Do the firewalls have any rules that permit 'any' network, sub network, host, protocol or port on any of the firewalls (internal or external)?",null,null,null,"G.2 Network Security – Firewall(s)","9.1.1.f","Access control policy",2,null,6,3,0,0,0,0,{"$f":"IF(J63=\"\",\"\",IF(D63=\"\",0,IF(D63=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D63=\"Yes\"),AND($M$1=\"Scaled\",D63>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D63=\"No\"),AND($M$1=\"Scaled\",D63<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3705,"G.6.4","Are all firewall rules reviewed and updated at least quarterly to identify and remove any networks, sub networks, hosts, protocols or ports no longer in use?",null,null,null,"G.2 Network Security – Firewall(s)","18.2.2","Compliance with security policies and standards",2,null,6,4,0,0,0,0,{"$f":"IF(J64=\"\",\"\",IF(D64=\"\",0,IF(D64=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D64=\"Yes\"),AND($M$1=\"Scaled\",D64>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D64=\"No\"),AND($M$1=\"Scaled\",D64<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3706,"G.7","Are vulnerability assessments, scans or penetration tests on internal or external network connections performed at least annually? If yes, are they:",null,null,null,"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1","Control of technical vulnerabilities",1,null,7,0,0,0,0,0,{"$f":"IF(J65=\"\",\"\",IF(D65=\"\",0,IF(D65=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D65=\"Yes\"),AND($M$1=\"Scaled\",D65>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D65=\"No\"),AND($M$1=\"Scaled\",D65<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1,1]
[3710,"G.7.1","Performed by trained and experienced personnel?",null,null,null,"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","18.2.3","Technical compliance review",2,null,7,1,0,0,0,0,{"$f":"IF(J66=\"\",\"\",IF(D66=\"\",0,IF(D66=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D66=\"Yes\"),AND($M$1=\"Scaled\",D66>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D66=\"No\"),AND($M$1=\"Scaled\",D66<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3912,"G.7.2","For internal network connections:",null,null,null,null,"NA",null,2,1,7,2,0,0,0,0,{"$f":"IF(J67=\"\",\"\",IF(D67=\"\",0,IF(D67=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D67=\"Yes\"),AND($M$1=\"Scaled\",D67>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D67=\"No\"),AND($M$1=\"Scaled\",D67<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3711,"G.7.2.1","Are vulnerability assessments or scans performed? If yes, are issues:",null,null,null,"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1","Control of technical vulnerabilities",3,null,7,2,1,0,0,0,{"$f":"IF(J68=\"\",\"\",IF(D68=\"\",0,IF(D68=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D68=\"Yes\"),AND($M$1=\"Scaled\",D68>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D68=\"No\"),AND($M$1=\"Scaled\",D68<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[3913,"G.7.2.1.1","Risk ranked for importance to the system and the vulnerability identified?",null,null,null,"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1.d","Control of technical vulnerabilities",4,null,7,2,1,1,0,0,{"$f":"IF(J69=\"\",\"\",IF(D69=\"\",0,IF(D69=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D69=\"Yes\"),AND($M$1=\"Scaled\",D69>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D69=\"No\"),AND($M$1=\"Scaled\",D69<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3716,{"$f":"IF(J70=0,\"\",IF(J70=1,Q$1&\".\"&L70,IF(J70=2,Q$1&\".\"&L70&\".\"&M70,IF(J70=3,Q$1&\".\"&L70&\".\"&M70&\".\"&N70,IF(J70=4,Q$1&\".\"&L70&\".\"&M70&\".\"&N70&\".\"&O70,IF(J70=5,Q$1&\".\"&L70&\".\"&M70&\".\"&N70&\".\"&O70&\".\"&P70))))))","v":"G.7.2.1.2"},"Documented and tracked to remediation?",null,null,null,"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1.h","Control of technical vulnerabilities",4,null,{"$f":"IF(L69=\"\",1,IF(J70=1,L69+1,L69))","v":7},{"$f":"IF(M69=\"\",0,IF(L69<>L70,0,IF($J70=2,M69+1,M69)))","v":2},{"$f":"IF(N69=\"\",0,IF(M69<>M70,0,IF($J70=3,N69+1,N69)))","v":1},{"$f":"IF(O69=\"\",0,IF(N69<>N70,0,IF($J70=4,O69+1,O69)))","v":2},{"$f":"IF(P69=\"\",0,IF(O69<>O70,0,IF($J70=5,P69+1,P69)))","v":0},{"$f":"IF(OR(Master=\"Master\",J70=0,K70=1),0,IF(ISNA(VLOOKUP(A70,L2_Array,22,FALSE)),0,VLOOKUP(A70,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J70=\"\",\"\",IF(D70=\"\",0,IF(D70=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D70=\"Yes\"),AND($M$1=\"Scaled\",D70>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D70=\"No\"),AND($M$1=\"Scaled\",D70<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J70=\"\",\"\",IF(Q70>0,Q70,IF(R70>0,R70,0)))","v":0},{"$f":"IF(J70=\"\",\"\",IF(OR(J70=1,T69=\"\"),1,IF(OR(AND(K69=1,(J70-J68<>0)),AND(T69=0,J69=J70),AND(K69=1,J70=J68)),0,1)))","v":1},{"$f":"IF(J70=\"\",U69,IF(AND(S70>1,OR(U69=\"\",U69=0,U69>=J70)),J70,IF(J70>U69,U69,0)))","v":0},{"$f":"IF(Master=\"Master\",R70,IF(V69=\"\",S70,IF(OR(AND(U70>0,S70<V69),AND(U70=1,S70<=V69)),V69,S70)))","v":0},{"$f":"IF(J70=\"\",\"\",IF(OR(AND(T69=1,U70=1),S70>0,AND(T71=0,W71=1)),1,0))","v":0},{"$f":"IF(J70=\"\",\"\",IF(OR(AND(U70>0,T70=1),AND(T70=1,W70=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A70,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(J70=1,S70=1),2,IF(AND(V69=1,L70=L69),2,IF(AND(AC69=2,L70=L69),2,IF(J70=1,1,\"\"))))","v":""}]
[3721,"G.7.2.2","Are penetration tests performed? If yes, are issues:",null,null,null,"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1","Control of technical vulnerabilities",3,null,7,2,2,0,0,0,{"$f":"IF(J71=\"\",\"\",IF(D71=\"\",0,IF(D71=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D71=\"Yes\"),AND($M$1=\"Scaled\",D71>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D71=\"No\"),AND($M$1=\"Scaled\",D71<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3914,"G.7.2.2.1","Risk ranked for importance to the system and the vulnerability identified?",null,null,null,"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1.d","Control of technical vulnerabilities",4,null,7,2,2,1,0,0,{"$f":"IF(J72=\"\",\"\",IF(D72=\"\",0,IF(D72=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D72=\"Yes\"),AND($M$1=\"Scaled\",D72>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D72=\"No\"),AND($M$1=\"Scaled\",D72<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3725,"G.7.2.2.2","Documented and tracked to remediation?",null,null,null,"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1.h","Control of technical vulnerabilities",4,null,7,2,2,2,0,0,{"$f":"IF(J73=\"\",\"\",IF(D73=\"\",0,IF(D73=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D73=\"Yes\"),AND($M$1=\"Scaled\",D73>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D73=\"No\"),AND($M$1=\"Scaled\",D73<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3915,"G.7.3","For external network connections:",null,null,null,null,"NA",null,2,1,7,3,0,0,0,0,{"$f":"IF(J74=\"\",\"\",IF(D74=\"\",0,IF(D74=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D74=\"Yes\"),AND($M$1=\"Scaled\",D74>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D74=\"No\"),AND($M$1=\"Scaled\",D74<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3717,"G.7.3.1","Are vulnerability assessments or scans performed? If yes, are issues:",null,null,null,"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1","Control of technical vulnerabilities",3,null,7,3,1,0,0,0,{"$f":"IF(J75=\"\",\"\",IF(D75=\"\",0,IF(D75=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D75=\"Yes\"),AND($M$1=\"Scaled\",D75>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D75=\"No\"),AND($M$1=\"Scaled\",D75<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[3916,"G.7.3.1.1","Risk ranked for importance to the system and the vulnerability identified?",null,null,null,"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1.d","Control of technical vulnerabilities",4,null,7,3,1,1,0,0,{"$f":"IF(J76=\"\",\"\",IF(D76=\"\",0,IF(D76=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D76=\"Yes\"),AND($M$1=\"Scaled\",D76>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D76=\"No\"),AND($M$1=\"Scaled\",D76<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3720,"G.7.3.1.2","Documented and tracked to remediation?",null,null,null,"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1.h","Control of technical vulnerabilities",4,null,7,3,1,2,0,0,{"$f":"IF(J77=\"\",\"\",IF(D77=\"\",0,IF(D77=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D77=\"Yes\"),AND($M$1=\"Scaled\",D77>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D77=\"No\"),AND($M$1=\"Scaled\",D77<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3726,"G.7.3.2","Are penetration tests performed on external networks? If yes, are issues:",null,null,null,"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1","Control of technical vulnerabilities",3,null,7,3,2,0,0,0,{"$f":"IF(J78=\"\",\"\",IF(D78=\"\",0,IF(D78=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D78=\"Yes\"),AND($M$1=\"Scaled\",D78>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D78=\"No\"),AND($M$1=\"Scaled\",D78<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3917,"G.7.3.2.1","Risk ranked for importance to the system and the vulnerability identified?",null,null,null,"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1.d","Control of technical vulnerabilities",4,null,7,3,2,1,0,0,{"$f":"IF(J79=\"\",\"\",IF(D79=\"\",0,IF(D79=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D79=\"Yes\"),AND($M$1=\"Scaled\",D79>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D79=\"No\"),AND($M$1=\"Scaled\",D79<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3728,"G.7.3.2.2","Documented and tracked to remediation?",null,null,null,"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation","12.6.1.h","Control of technical vulnerabilities",4,null,7,3,2,2,0,0,{"$f":"IF(J80=\"\",\"\",IF(D80=\"\",0,IF(D80=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D80=\"Yes\"),AND($M$1=\"Scaled\",D80>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D80=\"No\"),AND($M$1=\"Scaled\",D80<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[975,"G.8","Are there external network connections (Internet, extranet, etc.)? If yes, is there:",null,null,null,null,"13.1.1","Network Controls",1,null,8,0,0,0,0,0,{"$f":"IF(J81=\"\",\"\",IF(D81=\"\",0,IF(D81=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D81=\"Yes\"),AND($M$1=\"Scaled\",D81>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D81=\"No\"),AND($M$1=\"Scaled\",D81<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1,1]
[998,"G.8.1","Security and hardening standards for network devices (baseline configuration, patching, passwords, access control)?",null,null,null,null,"13.1.1.c","Network Controls",2,null,8,1,0,0,0,0,{"$f":"IF(J82=\"\",\"\",IF(D82=\"\",0,IF(D82=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D82=\"Yes\"),AND($M$1=\"Scaled\",D82>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D82=\"No\"),AND($M$1=\"Scaled\",D82<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1008,"G.8.1.1","Regular review and/or monitoring of network devices for continued compliance to security requirements?",null,null,null,null,"13.1.1.d                                  18.2.3","Network controls,                   Technical compliance review",3,null,8,1,1,0,0,0,{"$f":"IF(J83=\"\",\"\",IF(D83=\"\",0,IF(D83=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D83=\"Yes\"),AND($M$1=\"Scaled\",D83>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D83=\"No\"),AND($M$1=\"Scaled\",D83<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[977,"G.8.2","Are network devices configured to prevent communications from unapproved networks?",null,null,null,"G.2 Network Security – Firewall(s)","13.1.3","Segregation In Networks",2,null,8,2,0,0,0,0,{"$f":"IF(J84=\"\",\"\",IF(D84=\"\",0,IF(D84=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D84=\"Yes\"),AND($M$1=\"Scaled\",D84>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D84=\"No\"),AND($M$1=\"Scaled\",D84<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[979,"G.8.3","Do network devices deny all access by default?",null,null,null,null,"9.1.1","Access Control Policy",2,null,8,3,0,0,0,0,{"$f":"IF(J85=\"\",\"\",IF(D85=\"\",0,IF(D85=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D85=\"Yes\"),AND($M$1=\"Scaled\",D85>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D85=\"No\"),AND($M$1=\"Scaled\",D85<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[980,"G.8.4","A process to request, approve, log, and review access to networks across network devices?",null,null,null,null,"9.1.1.h","Policy on Use of Network Services",2,null,8,4,0,0,0,0,{"$f":"IF(J86=\"\",\"\",IF(D86=\"\",0,IF(D86=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D86=\"Yes\"),AND($M$1=\"Scaled\",D86>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D86=\"No\"),AND($M$1=\"Scaled\",D86<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[981,"G.8.5","Network traffic logged to support forensics? If yes, do logs contain:",null,null,null,"G.6 Network Logging","13.1.1.d","Network Controls",2,null,8,5,0,0,0,0,{"$f":"IF(J87=\"\",\"\",IF(D87=\"\",0,IF(D87=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D87=\"Yes\"),AND($M$1=\"Scaled\",D87>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D87=\"No\"),AND($M$1=\"Scaled\",D87<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3865,"G.8.5.1","Failed login attempts?",null,null,null,"G.6 Network Logging","13.1.1.d","Network Controls",3,null,8,5,1,0,0,0,{"$f":"IF(J88=\"\",\"\",IF(D88=\"\",0,IF(D88=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D88=\"Yes\"),AND($M$1=\"Scaled\",D88>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D88=\"No\"),AND($M$1=\"Scaled\",D88<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3866,"G.8.5.2","Disabling of audit logs?",null,null,null,"G.6 Network Logging","13.1.1.d","Network Controls",3,null,8,5,2,0,0,0,{"$f":"IF(J89=\"\",\"\",IF(D89=\"\",0,IF(D89=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D89=\"Yes\"),AND($M$1=\"Scaled\",D89>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D89=\"No\"),AND($M$1=\"Scaled\",D89<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3869,"G.8.5.3","Changes?",null,null,null,"G.6 Network Logging","13.1.1.d","Network Controls",3,null,8,5,3,0,0,0,{"$f":"IF(J90=\"\",\"\",IF(D90=\"\",0,IF(D90=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D90=\"Yes\"),AND($M$1=\"Scaled\",D90>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D90=\"No\"),AND($M$1=\"Scaled\",D90<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3870,"G.8.5.4","Timestamps?",null,null,null,"G.6 Network Logging","13.1.1.d","Network Controls",3,null,8,5,4,0,0,0,{"$f":"IF(J91=\"\",\"\",IF(D91=\"\",0,IF(D91=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D91=\"Yes\"),AND($M$1=\"Scaled\",D91>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D91=\"No\"),AND($M$1=\"Scaled\",D91<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3871,"G.8.5.5","IP info?",null,null,null,"G.6 Network Logging","13.1.1.d","Network Controls",3,null,8,5,5,0,0,0,{"$f":"IF(J92=\"\",\"\",IF(D92=\"\",0,IF(D92=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D92=\"Yes\"),AND($M$1=\"Scaled\",D92>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D92=\"No\"),AND($M$1=\"Scaled\",D92<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3294,"G.8.5.6","In the event of a network device audit log failure, does the network device generate an alert and prevent further connections?",null,null,null,null,"12.4.1","Event logging",3,null,8,5,6,0,0,0,{"$f":"IF(J93=\"\",\"\",IF(D93=\"\",0,IF(D93=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D93=\"Yes\"),AND($M$1=\"Scaled\",D93>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D93=\"No\"),AND($M$1=\"Scaled\",D93<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1093,"G.8.5.7","Is the overwriting of audit logs disabled?",null,null,null,null,"12.4.2.b","Protection of Log Information",3,null,8,5,7,0,0,0,{"$f":"IF(J94=\"\",\"\",IF(D94=\"\",0,IF(D94=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D94=\"Yes\"),AND($M$1=\"Scaled\",D94>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D94=\"No\"),AND($M$1=\"Scaled\",D94<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[993,"G.8.5.8","Are the logs from network devices aggregated to a central server?",null,null,null,null,"12.4.2","Protection of Log Information",3,null,8,5,8,0,0,0,{"$f":"IF(J95=\"\",\"\",IF(D95=\"\",0,IF(D95=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D95=\"Yes\"),AND($M$1=\"Scaled\",D95>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D95=\"No\"),AND($M$1=\"Scaled\",D95<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[994,"G.8.6","Are security patches reviewed and applied to network devices?",null,null,null,null,"12.6.1.g","Management of technical vulnerabilities",2,null,8,6,0,0,0,0,{"$f":"IF(J96=\"\",\"\",IF(D96=\"\",0,IF(D96=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D96=\"Yes\"),AND($M$1=\"Scaled\",D96>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D96=\"No\"),AND($M$1=\"Scaled\",D96<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[995,"G.8.7","Is there an approval process prior to installing a network device?",null,null,null,null,"12.1.2.d","Change Management",2,null,8,7,0,0,0,0,{"$f":"IF(J97=\"\",\"\",IF(D97=\"\",0,IF(D97=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D97=\"Yes\"),AND($M$1=\"Scaled\",D97>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D97=\"No\"),AND($M$1=\"Scaled\",D97<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[997,"G.8.8","Is there an approval process for the ports allowed through the network devices?",null,null,null,"G.19 Network Security – Authorized Network Traffic","13.1.2.c","Security of Network Services",2,null,8,8,0,0,0,0,{"$f":"IF(J98=\"\",\"\",IF(D98=\"\",0,IF(D98=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D98=\"Yes\"),AND($M$1=\"Scaled\",D98>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D98=\"No\"),AND($M$1=\"Scaled\",D98<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1010,"G.8.9","Are critical network segments isolated?",null,null,null,"G.2 Network Security – Firewall(s)","13.1.3","Segregation In Networks",2,null,8,9,0,0,0,0,{"$f":"IF(J99=\"\",\"\",IF(D99=\"\",0,IF(D99=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D99=\"Yes\"),AND($M$1=\"Scaled\",D99>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D99=\"No\"),AND($M$1=\"Scaled\",D99<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1011,"G.8.10","Is there a process to prevent unauthorized devices from physically connecting to the internal network?",null,null,null,null,"13.1.2","Security of Network Services",2,null,8,10,0,0,0,0,{"$f":"IF(J100=\"\",\"\",IF(D100=\"\",0,IF(D100=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D100=\"Yes\"),AND($M$1=\"Scaled\",D100>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D100=\"No\"),AND($M$1=\"Scaled\",D100<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1014,"G.8.11","Are internal systems required to pass through a content filtering proxy prior to accessing the Internet?",null,null,null,null,"13.1.2","Security of Network Services",2,null,8,11,0,0,0,0,{"$f":"IF(J101=\"\",\"\",IF(D101=\"\",0,IF(D101=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D101=\"Yes\"),AND($M$1=\"Scaled\",D101>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D101=\"No\"),AND($M$1=\"Scaled\",D101<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1015,"G.8.12","Is there an approval process to allow extranet connections?",null,null,null,null,"9.1.2.b","Access to networks and network services",2,null,8,12,0,0,0,0,{"$f":"IF(J102=\"\",\"\",IF(D102=\"\",0,IF(D102=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D102=\"Yes\"),AND($M$1=\"Scaled\",D102>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D102=\"No\"),AND($M$1=\"Scaled\",D102<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1016,"G.8.13","Are insecure protocols used to access network devices e.g., telnet?",null,null,null,"G.4 Network Management – Encrypted Authentication Credentials","9.1.2.d","Access to networks and network services",2,null,8,13,0,0,0,0,{"$f":"IF(J103=\"\",\"\",IF(D103=\"\",0,IF(D103=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D103=\"Yes\"),AND($M$1=\"Scaled\",D103>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D103=\"No\"),AND($M$1=\"Scaled\",D103<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2612,"G.8.14","Is access to diagnostic or maintenance ports on network devices restricted?",null,null,null,"G.5 Externally Facing Open Administrative Ports","9.1.2.a","Access to networks and network services",2,null,8,14,0,0,0,0,{"$f":"IF(J104=\"\",\"\",IF(D104=\"\",0,IF(D104=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D104=\"Yes\"),AND($M$1=\"Scaled\",D104>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D104=\"No\"),AND($M$1=\"Scaled\",D104<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1065,"G.8.15","Is there a separate network segment or endpoints for remote access?",null,null,null,null,"13.1.3","Segregation in networks",2,null,8,15,0,0,0,0,{"$f":"IF(J105=\"\",\"\",IF(D105=\"\",0,IF(D105=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D105=\"Yes\"),AND($M$1=\"Scaled\",D105>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D105=\"No\"),AND($M$1=\"Scaled\",D105<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2947,"G.8.16","Are firewall rules and network access control lists regularly reviewed?",null,null,null,null,"18.2.3","Technical Compliance review",2,null,8,16,0,0,0,0,{"$f":"IF(J106=\"\",\"\",IF(D106=\"\",0,IF(D106=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D106=\"Yes\"),AND($M$1=\"Scaled\",D106>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D106=\"No\"),AND($M$1=\"Scaled\",D106<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2614,"G.8.17","Is there a DMZ environment within the network that transmits, processes or stores Scoped Systems and Data? If yes, is it:",null,null,null,null,"NA","",2,null,8,17,0,0,0,0,{"$f":"IF(J107=\"\",\"\",IF(D107=\"\",0,IF(D107=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D107=\"Yes\"),AND($M$1=\"Scaled\",D107>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D107=\"No\"),AND($M$1=\"Scaled\",D107<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1049,"G.8.17.1","Limited to only those servers that require access from the Internet?",null,null,null,null,"13.1.3","Segregation In Networks",3,null,8,17,1,0,0,0,{"$f":"IF(J108=\"\",\"\",IF(D108=\"\",0,IF(D108=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D108=\"Yes\"),AND($M$1=\"Scaled\",D108>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D108=\"No\"),AND($M$1=\"Scaled\",D108<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1056,"G.8.17.2","Separated with DMZ segments for devices that initiate outbound traffic to the Internet?",null,null,null,null,"13.1.3","Segregation In Networks",3,null,8,17,2,0,0,0,{"$f":"IF(J109=\"\",\"\",IF(D109=\"\",0,IF(D109=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D109=\"Yes\"),AND($M$1=\"Scaled\",D109>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D109=\"No\"),AND($M$1=\"Scaled\",D109<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1068,"G.8.18","Is Intrusion Detection/Prevention System employed in all network zones? If yes, does it include:",null,null,null,"G.3 Network Security – IDS / IPS Attributes","13.1.2","Security of Network Services",2,null,8,18,0,0,0,0,{"$f":"IF(J110=\"\",\"\",IF(D110=\"\",0,IF(D110=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D110=\"Yes\"),AND($M$1=\"Scaled\",D110>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D110=\"No\"),AND($M$1=\"Scaled\",D110<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1075,"G.8.18.1","Configuration to generate alerts when incidents and values exceed predetermined thresholds?",null,null,null,null,"12.4.1","Event logging",3,null,8,18,1,0,0,0,{"$f":"IF(J111=\"\",\"\",IF(D111=\"\",0,IF(D111=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D111=\"Yes\"),AND($M$1=\"Scaled\",D111>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D111=\"No\"),AND($M$1=\"Scaled\",D111<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1076,"G.8.18.2","Regularly updated signatures based on new threats?",null,null,null,"G.3 Network Security – IDS / IPS Attributes","13.6.1","Management of technical vulnerabilities",3,null,8,18,2,0,0,0,{"$f":"IF(J112=\"\",\"\",IF(D112=\"\",0,IF(D112=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D112=\"Yes\"),AND($M$1=\"Scaled\",D112>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D112=\"No\"),AND($M$1=\"Scaled\",D112<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1077,"G.8.18.3","System monitoring 24x7x365?",null,null,null,null,"13.1.1.d","Network Controls",3,null,8,18,3,0,0,0,{"$f":"IF(J113=\"\",\"\",IF(D113=\"\",0,IF(D113=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D113=\"Yes\"),AND($M$1=\"Scaled\",D113>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D113=\"No\"),AND($M$1=\"Scaled\",D113<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1080,"G.8.18.4","Event feeds into the Incident Management process?",null,null,null,null,"12.2.1.i","Controls against malware",3,null,8,18,4,0,0,0,{"$f":"IF(J114=\"\",\"\",IF(D114=\"\",0,IF(D114=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D114=\"Yes\"),AND($M$1=\"Scaled\",D114>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D114=\"No\"),AND($M$1=\"Scaled\",D114<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1121,"G.8.19","Is approval required prior to connecting any outbound or inbound modem lines, cable modem lines, DSL phone lines or wireless access points to a desktop or other access point directly connected to the company-managed network?",null,null,null,null,"9.1.2.b","Access to networks and network services",2,null,8,19,0,0,0,0,{"$f":"IF(J115=\"\",\"\",IF(D115=\"\",0,IF(D115=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D115=\"Yes\"),AND($M$1=\"Scaled\",D115>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D115=\"No\"),AND($M$1=\"Scaled\",D115<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1095,"G.9","Is wireless networking technology used? Is yes, is there:",null,null,null,"G.17 Unapproved Wireless Networks","13.1.1.c","Network Controls",1,null,9,0,0,0,0,0,{"$f":"IF(J116=\"\",\"\",IF(D116=\"\",0,IF(D116=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D116=\"Yes\"),AND($M$1=\"Scaled\",D116>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D116=\"No\"),AND($M$1=\"Scaled\",D116<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1,1]
[1096,"G.9.1","Approved and fully implemented wireless networking policy?",null,null,null,"G.17 Unapproved Wireless Networks","13.1.1.a","Network Controls",2,null,9,1,0,0,0,0,{"$f":"IF(J117=\"\",\"\",IF(D117=\"\",0,IF(D117=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D117=\"Yes\"),AND($M$1=\"Scaled\",D117>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D117=\"No\"),AND($M$1=\"Scaled\",D117<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1107,"G.9.2","Two active network connections allowed at the same time (split-tunneling)?",null,null,null,"G.17 Unapproved Wireless Networks","NA","",2,null,9,2,0,0,0,0,{"$f":"IF(J118=\"\",\"\",IF(D118=\"\",0,IF(D118=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D118=\"Yes\"),AND($M$1=\"Scaled\",D118>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D118=\"No\"),AND($M$1=\"Scaled\",D118<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1108,"G.9.3","Wireless connections authenticated using multi-factor authentication?",null,null,null,"G.17 Unapproved Wireless Networks","13.1.3","Segregation In Networks",2,null,9,3,0,0,0,0,{"$f":"IF(J119=\"\",\"\",IF(D119=\"\",0,IF(D119=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D119=\"Yes\"),AND($M$1=\"Scaled\",D119>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D119=\"No\"),AND($M$1=\"Scaled\",D119<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1111,"G.9.4","Encrypted using strong encryption (WPA2 or higher)?",null,null,null,"G.18 Wireless Networks Encryption ","13.1.3","Segregation In Networks",2,null,9,4,0,0,0,0,{"$f":"IF(J120=\"\",\"\",IF(D120=\"\",0,IF(D120=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D120=\"Yes\"),AND($M$1=\"Scaled\",D120>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D120=\"No\"),AND($M$1=\"Scaled\",D120<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1117,"G.9.5","Wireless access points SNMP community strings changed?",null,null,null,null,"NA",null,2,null,9,5,0,0,0,0,{"$f":"IF(J121=\"\",\"\",IF(D121=\"\",0,IF(D121=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D121=\"Yes\"),AND($M$1=\"Scaled\",D121>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D121=\"No\"),AND($M$1=\"Scaled\",D121<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1118,"G.9.6","Quarterly scans for rogue wireless access points?",null,null,null,null,"NA","",2,null,9,6,0,0,0,0,{"$f":"IF(J122=\"\",\"\",IF(D122=\"\",0,IF(D122=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D122=\"Yes\"),AND($M$1=\"Scaled\",D122>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D122=\"No\"),AND($M$1=\"Scaled\",D122<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3295,"G.10","Is there a removable media policy or program (CDs, DVDs, tapes, disk drives) that has been approved by management, communicated to appropriate constituents, and an owner to maintain and review the policy? If yes, is:",null,null,null,"G.15 Physical Media Tracking","8.3.1","Management of Removable Media",1,null,10,0,0,0,0,0,{"$f":"IF(J123=\"\",\"\",IF(D123=\"\",0,IF(D123=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D123=\"Yes\"),AND($M$1=\"Scaled\",D123>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D123=\"No\"),AND($M$1=\"Scaled\",D123<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[1872,"G.10.1","Data encrypted while stored?",null,null,null,"G. 22 Data Security Policy - Encryption","10.1.1.c","Policy On The Use of Cryptographic Controls",2,null,10,1,0,0,0,0,{"$f":"IF(J124=\"\",\"\",IF(D124=\"\",0,IF(D124=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D124=\"Yes\"),AND($M$1=\"Scaled\",D124>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D124=\"No\"),AND($M$1=\"Scaled\",D124<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1137,"G.10.2","Sensitive data encrypted?",null,null,null,"G. 22 Data Security Policy - Encryption","8.3.1.d                                    10.1.1.Section2a ","Management of removable media,                                         Policy on The Use of Cryptographic Controls",2,null,10,2,0,0,0,0,{"$f":"IF(J125=\"\",\"\",IF(D125=\"\",0,IF(D125=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D125=\"Yes\"),AND($M$1=\"Scaled\",D125>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D125=\"No\"),AND($M$1=\"Scaled\",D125<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1138,"G.10.3","Is all media containing Scoped Systems and Data disposed of securely to prevent recovery? If yes, is it:",null,null,null,"D.2 Asset Destruction","8.3.2","Disposal of Media",2,null,10,3,0,0,0,0,{"$f":"IF(J126=\"\",\"\",IF(D126=\"\",0,IF(D126=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D126=\"Yes\"),AND($M$1=\"Scaled\",D126>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D126=\"No\"),AND($M$1=\"Scaled\",D126<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1153,"G.10.3.1","Logged to maintain an audit trail?",null,null,null,"D.2 Asset Destruction","8.3.2.e","Disposal of Media",3,null,10,3,1,0,0,0,{"$f":"IF(J127=\"\",\"\",IF(D127=\"\",0,IF(D127=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D127=\"Yes\"),AND($M$1=\"Scaled\",D127>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D127=\"No\"),AND($M$1=\"Scaled\",D127<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2624,"G.10.3.2","Made unrecoverable (wiped or overwritten) prior to asset reuse?",null,null,null,null,"8.3.1.a                                     11.2.7 ","Disposal of media,                   Secure disposal or re-use of equipment",3,null,10,3,2,0,0,0,{"$f":"IF(J128=\"\",\"\",IF(D128=\"\",0,IF(D128=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D128=\"Yes\"),AND($M$1=\"Scaled\",D128>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D128=\"No\"),AND($M$1=\"Scaled\",D128<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2950,"G.10.3.3","Inventoried at least quarterly?",null,null,null,"D.1 Asset Accounting and Inventory","8.1.1 ","Inventory of Assets",3,null,10,3,3,0,0,0,{"$f":"IF(J129=\"\",\"\",IF(D129=\"\",0,IF(D129=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D129=\"Yes\"),AND($M$1=\"Scaled\",D129>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D129=\"No\"),AND($M$1=\"Scaled\",D129<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1208,"G.11","Is Scoped Data sent or received electronically or via physical media? If yes, is there:",null,null,null,"G.4 Network Management – Encrypted Authentication Credentials","8.3.3","Physical Media in Transit",1,null,11,0,0,0,0,0,{"$f":"IF(J130=\"\",\"\",IF(D130=\"\",0,IF(D130=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D130=\"Yes\"),AND($M$1=\"Scaled\",D130>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D130=\"No\"),AND($M$1=\"Scaled\",D130<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1,1]
[1871,"G.11.1","Encryption in transit while outside the network?",null,null,null,"G.4 Network Management – Encrypted Authentication Credentials","13.2.1.f","Information Transfer Policies and Procedures",2,null,11,1,0,0,0,0,{"$f":"IF(J131=\"\",\"\",IF(D131=\"\",0,IF(D131=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D131=\"Yes\"),AND($M$1=\"Scaled\",D131>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D131=\"No\"),AND($M$1=\"Scaled\",D131<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1193,"G.11.2","Encryption in transit within the network?",null,null,null,"G.4 Network Management – Encrypted Authentication Credentials","13.2.1.f","Information Transfer Policies and Procedures",2,null,11,2,0,0,0,0,{"$f":"IF(J132=\"\",\"\",IF(D132=\"\",0,IF(D132=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D132=\"Yes\"),AND($M$1=\"Scaled\",D132>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D132=\"No\"),AND($M$1=\"Scaled\",D132<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2629,"G.11.3","Protection against malicious code?",null,null,null,null,"13.2.1.b","Information Transfer Policies and Procedures",2,null,11,3,0,0,0,0,{"$f":"IF(J133=\"\",\"\",IF(D133=\"\",0,IF(D133=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D133=\"Yes\"),AND($M$1=\"Scaled\",D133>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D133=\"No\"),AND($M$1=\"Scaled\",D133<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1177,{"$f":"IF(J134=0,\"\",IF(J134=1,Q$1&\".\"&L134,IF(J134=2,Q$1&\".\"&L134&\".\"&M134,IF(J134=3,Q$1&\".\"&L134&\".\"&M134&\".\"&N134,IF(J134=4,Q$1&\".\"&L134&\".\"&M134&\".\"&N134&\".\"&O134,IF(J134=5,Q$1&\".\"&L134&\".\"&M134&\".\"&N134&\".\"&O134&\".\"&P134))))))","v":"G.11.4"},"Confidentiality / integrity of data following any transmissions?",null,null,null,"G.16 Security of Media in Transit","13.2.4","Confidentiality or Non-disclosure Agreements",2,null,{"$f":"IF(L133=\"\",1,IF(J134=1,L133+1,L133))","v":11},{"$f":"IF(M133=\"\",0,IF(L133<>L134,0,IF($J134=2,M133+1,M133)))","v":4},{"$f":"IF(N133=\"\",0,IF(M133<>M134,0,IF($J134=3,N133+1,N133)))","v":0},{"$f":"IF(O133=\"\",0,IF(N133<>N134,0,IF($J134=4,O133+1,O133)))","v":0},{"$f":"IF(P133=\"\",0,IF(O133<>O134,0,IF($J134=5,P133+1,P133)))","v":0},{"$f":"IF(OR(Master=\"Master\",J134=0,K134=1),0,IF(ISNA(VLOOKUP(A134,L2_Array,22,FALSE)),0,VLOOKUP(A134,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J134=\"\",\"\",IF(D134=\"\",0,IF(D134=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D134=\"Yes\"),AND($M$1=\"Scaled\",D134>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D134=\"No\"),AND($M$1=\"Scaled\",D134<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J134=\"\",\"\",IF(Q134>0,Q134,IF(R134>0,R134,0)))","v":0},{"$f":"IF(J134=\"\",\"\",IF(OR(J134=1,T133=\"\"),1,IF(OR(AND(K133=1,(J134-J132<>0)),AND(T133=0,J133=J134),AND(K133=1,J134=J132)),0,1)))","v":1},{"$f":"IF(J134=\"\",U133,IF(AND(S134>1,OR(U133=\"\",U133=0,U133>=J134)),J134,IF(J134>U133,U133,0)))","v":0},{"$f":"IF(Master=\"Master\",R134,IF(V133=\"\",S134,IF(OR(AND(U134>0,S134<V133),AND(U134=1,S134<=V133)),V133,S134)))","v":0},{"$f":"IF(J134=\"\",\"\",IF(OR(AND(T133=1,U134=1),S134>0,AND(T135=0,W135=1)),1,0))","v":0},{"$f":"IF(J134=\"\",\"\",IF(OR(AND(U134>0,T134=1),AND(T134=1,W134=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A134,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(J134=1,S134=1),2,IF(AND(V133=1,L134=L133),2,IF(AND(AC133=2,L134=L133),2,IF(J134=1,1,\"\"))))","v":""}]
[1186,"G.11.5","Review and approval process for transmissions?",null,null,null,"G.16 Security of Media in Transit","13.2.1","Information Transfer Policies and Procedures",2,null,11,5,0,0,0,0,{"$f":"IF(J135=\"\",\"\",IF(D135=\"\",0,IF(D135=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D135=\"Yes\"),AND($M$1=\"Scaled\",D135>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D135=\"No\"),AND($M$1=\"Scaled\",D135<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2634,"G.11.6","Transport containers to protect against physical damage?",null,null,null,"G.16 Security of Media in Transit","8.3.3.d","Physical Media in Transit",2,null,11,6,0,0,0,0,{"$f":"IF(J136=\"\",\"\",IF(D136=\"\",0,IF(D136=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D136=\"Yes\"),AND($M$1=\"Scaled\",D136>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D136=\"No\"),AND($M$1=\"Scaled\",D136<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2635,"G.11.7","Locked or tamper evident transport containers?",null,null,null,"G.16 Security of Media in Transit","8.3.3.d","Physical Media in Transit",2,null,11,7,0,0,0,0,{"$f":"IF(J137=\"\",\"\",IF(D137=\"\",0,IF(D137=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D137=\"Yes\"),AND($M$1=\"Scaled\",D137>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D137=\"No\"),AND($M$1=\"Scaled\",D137<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1209,"G.11.8","Physical media tracking?",null,null,null,"G.15 Physical Media Tracking","8.3.3.e","Physical Media in Transit",2,null,11,8,0,0,0,0,{"$f":"IF(J138=\"\",\"\",IF(D138=\"\",0,IF(D138=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D138=\"Yes\"),AND($M$1=\"Scaled\",D138>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D138=\"No\"),AND($M$1=\"Scaled\",D138<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1243,"G.11.9","Protection when transmitted through email?",null,null,null,"G. 22 Data Security Policy - Encryption","13.2.3","Electronic Messaging",2,null,11,9,0,0,0,0,{"$f":"IF(J139=\"\",\"\",IF(D139=\"\",0,IF(D139=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D139=\"Yes\"),AND($M$1=\"Scaled\",D139>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D139=\"No\"),AND($M$1=\"Scaled\",D139<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1245,"G.11.10","Encryption when sent through email?",null,null,null,"G. 22 Data Security Policy - Encryption","13.2.1.f","Information Transfer Policies and Procedures",2,null,11,10,0,0,0,0,{"$f":"IF(J140=\"\",\"\",IF(D140=\"\",0,IF(D140=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D140=\"Yes\"),AND($M$1=\"Scaled\",D140>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D140=\"No\"),AND($M$1=\"Scaled\",D140<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1247,"G.11.11","Content filtering scans performed on incoming/outgoing email to enforce email policy?",null,null,null,"G. 22 Data Security Policy - Encryption","12.2.1.d","Controls against malware",2,null,11,11,0,0,0,0,{"$f":"IF(J141=\"\",\"\",IF(D141=\"\",0,IF(D141=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D141=\"Yes\"),AND($M$1=\"Scaled\",D141>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D141=\"No\"),AND($M$1=\"Scaled\",D141<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1272,"G.12","Do systems and network devices utilize a common time synchronization service?",null,null,null,null,"12.4.4","Clock Synchronization",1,null,12,0,0,0,0,0,{"$f":"IF(J142=\"\",\"\",IF(D142=\"\",0,IF(D142=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D142=\"Yes\"),AND($M$1=\"Scaled\",D142>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D142=\"No\"),AND($M$1=\"Scaled\",D142<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,1]
[1281,"G.13","Are UNIX or Linux operating systems used for transmitting, processing or storing Scoped Data? If yes, is there:",null,null,null,null,"NA","",1,null,13,0,0,0,0,0,{"$f":"IF(J143=\"\",\"\",IF(D143=\"\",0,IF(D143=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D143=\"Yes\"),AND($M$1=\"Scaled\",D143>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D143=\"No\"),AND($M$1=\"Scaled\",D143<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,1,1]
[1282,"G.13.1"," UNIX hardening standards?",null,null,null,"I.3 Secure System Hardening Standards","13.1.1.e","Network Controls",2,null,13,1,0,0,0,0,{"$f":"IF(J144=\"\",\"\",IF(D144=\"\",0,IF(D144=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D144=\"Yes\"),AND($M$1=\"Scaled\",D144>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D144=\"No\"),AND($M$1=\"Scaled\",D144<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4115,"G.13.1.1","Are the standards reviewed and/or updated at least monthly to ensure any security vulnerabilities are addressed?",null,null,null,null,"NA",null,3,null,13,1,1,0,0,0,{"$f":"IF(J145=\"\",\"\",IF(D145=\"\",0,IF(D145=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D145=\"Yes\"),AND($M$1=\"Scaled\",D145>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D145=\"No\"),AND($M$1=\"Scaled\",D145<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1304,"G.13.1.2","Periodic monitoring for continued compliance to build standards and security requirements?",null,null,null,null,"18.2.3","Technical Compliance Review",3,null,13,1,2,0,0,0,{"$f":"IF(J146=\"\",\"\",IF(D146=\"\",0,IF(D146=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D146=\"Yes\"),AND($M$1=\"Scaled\",D146>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D146=\"No\"),AND($M$1=\"Scaled\",D146<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1292,"G.13.2","Are users required to ‘su’ or ‘sudo’ into root?",null,null,null,null,"9.2.1","User Registration and De-registration",2,null,13,2,0,0,0,0,{"$f":"IF(J147=\"\",\"\",IF(D147=\"\",0,IF(D147=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D147=\"Yes\"),AND($M$1=\"Scaled\",D147>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D147=\"No\"),AND($M$1=\"Scaled\",D147<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1294,"G.13.3","Does remote SU/root access require multi-factor authentication?",null,null,null,null,"9.1.2","Access to Networks and Network Services",2,null,13,3,0,0,0,0,{"$f":"IF(J148=\"\",\"\",IF(D148=\"\",0,IF(D148=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D148=\"Yes\"),AND($M$1=\"Scaled\",D148>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D148=\"No\"),AND($M$1=\"Scaled\",D148<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1301,"G.13.4","Are remote access tools that do not require authentication (e.g., rhost, shost) allowed?",null,null,null,null,"9.1.2","Access to Networks and Network Services",2,null,13,4,0,0,0,0,{"$f":"IF(J149=\"\",\"\",IF(D149=\"\",0,IF(D149=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D149=\"Yes\"),AND($M$1=\"Scaled\",D149>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D149=\"No\"),AND($M$1=\"Scaled\",D149<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1302,"G.13.5","Is access to modify startup and shutdown scripts restricted to root-level users?",null,null,null,null,"9.4.4.d","Use of Privileged Utility Programs",2,null,13,5,0,0,0,0,{"$f":"IF(J150=\"\",\"\",IF(D150=\"\",0,IF(D150=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D150=\"Yes\"),AND($M$1=\"Scaled\",D150>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D150=\"No\"),AND($M$1=\"Scaled\",D150<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1303,"G.13.6","Are all unnecessary/unused services turned off?",null,null,null,null,"9.4.4.h","Use of Privileged Utility Programs",2,null,13,6,0,0,0,0,{"$f":"IF(J151=\"\",\"\",IF(D151=\"\",0,IF(D151=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D151=\"Yes\"),AND($M$1=\"Scaled\",D151>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D151=\"No\"),AND($M$1=\"Scaled\",D151<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1314,"G.13.7","Are logs regularly reviewed using a specific methodology to uncover potential incidents?",null,null,null,null,"9.4.4.f","Use of Privileged Utility Programs",2,null,13,7,0,0,0,0,{"$f":"IF(J152=\"\",\"\",IF(D152=\"\",0,IF(D152=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D152=\"Yes\"),AND($M$1=\"Scaled\",D152>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D152=\"No\"),AND($M$1=\"Scaled\",D152<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1316,"G.13.8","Do operating system event logs contain sufficient detail to support incident investigation including failed login attempts?",null,null,null,"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging","12.4.1","Event Logging",2,null,13,8,0,0,0,0,{"$f":"IF(J153=\"\",\"\",IF(D153=\"\",0,IF(D153=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D153=\"Yes\"),AND($M$1=\"Scaled\",D153>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D153=\"No\"),AND($M$1=\"Scaled\",D153<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1307,"G.13.9","Are operating system logs retained for a minimum of one year?",null,null,null,"G.11 Log Retention ","12.4.2 ","Protection of Log Information",2,null,13,9,0,0,0,0,{"$f":"IF(J154=\"\",\"\",IF(D154=\"\",0,IF(D154=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D154=\"Yes\"),AND($M$1=\"Scaled\",D154>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D154=\"No\"),AND($M$1=\"Scaled\",D154<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1329,"G.13.10","In the event of an operating system audit log failure, does the system generate an alert?",null,null,null,"G.11 Log Retention ","12.4.2 ","Protection of Log Information",2,null,13,10,0,0,0,0,{"$f":"IF(J155=\"\",\"\",IF(D155=\"\",0,IF(D155=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D155=\"Yes\"),AND($M$1=\"Scaled\",D155>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D155=\"No\"),AND($M$1=\"Scaled\",D155<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1333,"G.13.11","Are audit logs stored on alternate systems?",null,null,null,"G.11 Log Retention ","12.4.2 ","Protection of Log Information",2,null,13,11,0,0,0,0,{"$f":"IF(J156=\"\",\"\",IF(D156=\"\",0,IF(D156=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D156=\"Yes\"),AND($M$1=\"Scaled\",D156>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D156=\"No\"),AND($M$1=\"Scaled\",D156<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1334,"G.13.12","Are audit logs protected against modification, deletion, and/or inappropriate access?",null,null,null,"G.11 Log Retention ","12.4.2 ","Protection of Log Information",2,null,13,12,0,0,0,0,{"$f":"IF(J157=\"\",\"\",IF(D157=\"\",0,IF(D157=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D157=\"Yes\"),AND($M$1=\"Scaled\",D157>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D157=\"No\"),AND($M$1=\"Scaled\",D157<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1342,"G.13.13","Minimum password length at least eight characters?",null,null,null,"H.1 Password Controls","9.3.1.d","Use of Secret Authentication Information",2,null,13,13,0,0,0,0,{"$f":"IF(J158=\"\",\"\",IF(D158=\"\",0,IF(D158=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D158=\"Yes\"),AND($M$1=\"Scaled\",D158>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D158=\"No\"),AND($M$1=\"Scaled\",D158<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1348,"G.13.14","Complex passwords required?",null,null,null,"H.1 Password Controls","9.3.1.d\n\n9.4.3.c","Use of Secret Authentication Information\nPassword Management System",2,null,13,14,0,0,0,0,{"$f":"IF(J159=\"\",\"\",IF(D159=\"\",0,IF(D159=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D159=\"Yes\"),AND($M$1=\"Scaled\",D159>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D159=\"No\"),AND($M$1=\"Scaled\",D159<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1353,"G.13.15","Minimum password expiration at least 90 days?",null,null,null,"H.1 Password Controls","9.4.3.e","Password Management System",2,null,13,15,0,0,0,0,{"$f":"IF(J160=\"\",\"\",IF(D160=\"\",0,IF(D160=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D160=\"Yes\"),AND($M$1=\"Scaled\",D160>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D160=\"No\"),AND($M$1=\"Scaled\",D160<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1358,"G.13.16","Password history at least 12 before reuse?",null,null,null,"H.1 Password Controls","9.4.3.f","Password Management System",2,null,13,16,0,0,0,0,{"$f":"IF(J161=\"\",\"\",IF(D161=\"\",0,IF(D161=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D161=\"Yes\"),AND($M$1=\"Scaled\",D161>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D161=\"No\"),AND($M$1=\"Scaled\",D161<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2636,"G.13.17","Initial password required to be changed at first logon?",null,null,null,"H.1 Password Controls","9.4.3.d","Password Management System",2,null,13,17,0,0,0,0,{"$f":"IF(J162=\"\",\"\",IF(D162=\"\",0,IF(D162=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D162=\"Yes\"),AND($M$1=\"Scaled\",D162>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D162=\"No\"),AND($M$1=\"Scaled\",D162<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1378,"G.13.18","Passwords encrypted in transit?",null,null,null,"H.1 Password Controls","9.4.3.i","Password Management System",2,null,13,18,0,0,0,0,{"$f":"IF(J163=\"\",\"\",IF(D163=\"\",0,IF(D163=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D163=\"Yes\"),AND($M$1=\"Scaled\",D163>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D163=\"No\"),AND($M$1=\"Scaled\",D163<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1379,"G.13.19","Passwords encrypted or hashed in storage?",null,null,null,"H.1 Password Controls","9.4.3.i","Password Management System",2,null,13,19,0,0,0,0,{"$f":"IF(J164=\"\",\"\",IF(D164=\"\",0,IF(D164=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D164=\"Yes\"),AND($M$1=\"Scaled\",D164>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D164=\"No\"),AND($M$1=\"Scaled\",D164<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1380,"G.13.20","Passwords displayed when entered into a system?",null,null,null,"H.1 Password Controls","9.4.3.g","Password Management System",2,null,13,20,0,0,0,0,{"$f":"IF(J165=\"\",\"\",IF(D165=\"\",0,IF(D165=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D165=\"Yes\"),AND($M$1=\"Scaled\",D165>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D165=\"No\"),AND($M$1=\"Scaled\",D165<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1287,"G.13.21","User accounts associated to a unique individual?",null,null,null,"H.1 Password Controls","9.4.3.a","Password Management System",2,null,13,21,0,0,0,0,{"$f":"IF(J166=\"\",\"\",IF(D166=\"\",0,IF(D166=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D166=\"Yes\"),AND($M$1=\"Scaled\",D166>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D166=\"No\"),AND($M$1=\"Scaled\",D166<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1362,"G.13.22","Does the system lock an account when three to five invalid login attempts are made?",null,null,null,"H.1 Password Controls","9.4.2","Secure Log-On Procedures",2,null,13,22,0,0,0,0,{"$f":"IF(J167=\"\",\"\",IF(D167=\"\",0,IF(D167=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D167=\"Yes\"),AND($M$1=\"Scaled\",D167>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D167=\"No\"),AND($M$1=\"Scaled\",D167<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1382,"G.14","Are Windows systems used to transmit, process or store Scoped Data? If yes, are there:",null,null,null,null,"NA","",1,null,14,0,0,0,0,0,{"$f":"IF(J168=\"\",\"\",IF(D168=\"\",0,IF(D168=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D168=\"Yes\"),AND($M$1=\"Scaled\",D168>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D168=\"No\"),AND($M$1=\"Scaled\",D168<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,1,1]
[1383,"G.14.1","Windows hardening standards?",null,null,null,"I.3 Secure System Hardening Standards","13.1.1.e","Network Controls",2,null,14,1,0,0,0,0,{"$f":"IF(J169=\"\",\"\",IF(D169=\"\",0,IF(D169=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D169=\"Yes\"),AND($M$1=\"Scaled\",D169>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D169=\"No\"),AND($M$1=\"Scaled\",D169<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4116,"G.14.1.1","Are the standards reviewed and/or updated at least monthly to ensure any security vulnerabilities are addressed?",null,null,null,null,"NA",null,3,null,14,1,1,0,0,0,{"$f":"IF(J170=\"\",\"\",IF(D170=\"\",0,IF(D170=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D170=\"Yes\"),AND($M$1=\"Scaled\",D170>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D170=\"No\"),AND($M$1=\"Scaled\",D170<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1441,"G.14.1.2","Standard builds/security compliance checks?",null,null,null,null,"18.2.3","Technical Compliance Review",3,null,14,1,2,0,0,0,{"$f":"IF(J171=\"\",\"\",IF(D171=\"\",0,IF(D171=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D171=\"Yes\"),AND($M$1=\"Scaled\",D171>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D171=\"No\"),AND($M$1=\"Scaled\",D171<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1439,"G.14.2","Current patches?",null,null,null,"I.4 System Patching","12.6.1.d","Control of Technical Vulnerabilities",2,null,14,2,0,0,0,0,{"$f":"IF(J172=\"\",\"\",IF(D172=\"\",0,IF(D172=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D172=\"Yes\"),AND($M$1=\"Scaled\",D172>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D172=\"No\"),AND($M$1=\"Scaled\",D172<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1395,"G.14.3","Unnecessary/unused services turned off?",null,null,null,null,"9.4.4.h","Use of Privileged Utility Programs",2,null,14,3,0,0,0,0,{"$f":"IF(J173=\"\",\"\",IF(D173=\"\",0,IF(D173=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D173=\"Yes\"),AND($M$1=\"Scaled\",D173>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D173=\"No\"),AND($M$1=\"Scaled\",D173<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1451,"G.14.4","Regular log reviews using a specific methodology to uncover potential incidents?",null,null,null,null,"9.4.4.f","Use of Privileged Utility Programs",2,null,14,4,0,0,0,0,{"$f":"IF(J174=\"\",\"\",IF(D174=\"\",0,IF(D174=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D174=\"Yes\"),AND($M$1=\"Scaled\",D174>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D174=\"No\"),AND($M$1=\"Scaled\",D174<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1453,"G.14.5","Sufficient information in the logs to evaluate incidents?",null,null,null,"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging","12.4.1","EventLlogging",2,null,14,5,0,0,0,0,{"$f":"IF(J175=\"\",\"\",IF(D175=\"\",0,IF(D175=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D175=\"Yes\"),AND($M$1=\"Scaled\",D175>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D175=\"No\"),AND($M$1=\"Scaled\",D175<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1444,"G.14.6","Logs retained for a minimum of one year?",null,null,null,"G.11 Log Retention ","12.4.2","Protection of Log Information",2,null,14,6,0,0,0,0,{"$f":"IF(J176=\"\",\"\",IF(D176=\"\",0,IF(D176=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D176=\"Yes\"),AND($M$1=\"Scaled\",D176>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D176=\"No\"),AND($M$1=\"Scaled\",D176<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1464,"G.14.7","System generated alerts in the event of an audit log failure?",null,null,null,"G.11 Log Retention ","12.4.2","Protection of Log Information",2,null,14,7,0,0,0,0,{"$f":"IF(J177=\"\",\"\",IF(D177=\"\",0,IF(D177=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D177=\"Yes\"),AND($M$1=\"Scaled\",D177>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D177=\"No\"),AND($M$1=\"Scaled\",D177<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1468,"G.14.8","Audit logs stored on alternate systems?",null,null,null,"G.11 Log Retention ","12.4.2","Protection of Log Information",2,null,14,8,0,0,0,0,{"$f":"IF(J178=\"\",\"\",IF(D178=\"\",0,IF(D178=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D178=\"Yes\"),AND($M$1=\"Scaled\",D178>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D178=\"No\"),AND($M$1=\"Scaled\",D178<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1469,"G.14.9","Audit logs protected against modification, deletion, and/or inappropriate access?",null,null,null,"G.11 Log Retention ","12.4.2","Protection of Log Information",2,null,14,9,0,0,0,0,{"$f":"IF(J179=\"\",\"\",IF(D179=\"\",0,IF(D179=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D179=\"Yes\"),AND($M$1=\"Scaled\",D179>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D179=\"No\"),AND($M$1=\"Scaled\",D179<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1396,"G.14.10","Minimum password length at least eight characters?",null,null,null,"H.1 Password Controls","9.3.1.d","Use of Secret Authentication Information",2,null,14,10,0,0,0,0,{"$f":"IF(J180=\"\",\"\",IF(D180=\"\",0,IF(D180=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D180=\"Yes\"),AND($M$1=\"Scaled\",D180>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D180=\"No\"),AND($M$1=\"Scaled\",D180<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1402,"G.14.11","Complex passwords required?",null,null,null,"H.1 Password Controls","9.3.1.d\n\n9.4.3.c","Use of Secret Authentication Information\nPassword Management System",2,null,14,11,0,0,0,0,{"$f":"IF(J181=\"\",\"\",IF(D181=\"\",0,IF(D181=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D181=\"Yes\"),AND($M$1=\"Scaled\",D181>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D181=\"No\"),AND($M$1=\"Scaled\",D181<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1407,"G.14.12","Minimum password expiration at least every 90 days?",null,null,null,"H.1 Password Controls","9.4.3.e","Password Management System",2,null,14,12,0,0,0,0,{"$f":"IF(J182=\"\",\"\",IF(D182=\"\",0,IF(D182=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D182=\"Yes\"),AND($M$1=\"Scaled\",D182>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D182=\"No\"),AND($M$1=\"Scaled\",D182<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1412,"G.14.13","Password history of 12 before reuse?",null,null,null,"H.1 Password Controls","9.4.3.f","Password Management System",2,null,14,13,0,0,0,0,{"$f":"IF(J183=\"\",\"\",IF(D183=\"\",0,IF(D183=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D183=\"Yes\"),AND($M$1=\"Scaled\",D183>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D183=\"No\"),AND($M$1=\"Scaled\",D183<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2637,"G.14.14","Initial password required to be changed at first logon?",null,null,null,"H.1 Password Controls","9.4.3.d","Password Management System",2,null,14,14,0,0,0,0,{"$f":"IF(J184=\"\",\"\",IF(D184=\"\",0,IF(D184=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D184=\"Yes\"),AND($M$1=\"Scaled\",D184>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D184=\"No\"),AND($M$1=\"Scaled\",D184<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1431,"G.14.15","Can a PIN or secret question be a stand-alone method of authentication?",null,null,null,"H.1 Password Controls","9.4.2","Secure Log-On Procedures",2,null,14,15,0,0,0,0,{"$f":"IF(J185=\"\",\"\",IF(D185=\"\",0,IF(D185=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D185=\"Yes\"),AND($M$1=\"Scaled\",D185>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D185=\"No\"),AND($M$1=\"Scaled\",D185<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1432,"G.14.16","Passwords encrypted in transit?",null,null,null,"H.1 Password Controls","9.4.3.i","Password Management System",2,null,14,16,0,0,0,0,{"$f":"IF(J186=\"\",\"\",IF(D186=\"\",0,IF(D186=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D186=\"Yes\"),AND($M$1=\"Scaled\",D186>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D186=\"No\"),AND($M$1=\"Scaled\",D186<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1433,"G.14.17","Passwords encrypted or hashed in storage?",null,null,null,"H.1 Password Controls","9.4.3.i","Password Management System",2,null,14,17,0,0,0,0,{"$f":"IF(J187=\"\",\"\",IF(D187=\"\",0,IF(D187=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D187=\"Yes\"),AND($M$1=\"Scaled\",D187>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D187=\"No\"),AND($M$1=\"Scaled\",D187<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1434,"G.14.18","Passwords displayed when entered into a system?",null,null,null,"H.1 Password Controls","9.4.3.g","Password Management System",2,null,14,18,0,0,0,0,{"$f":"IF(J188=\"\",\"\",IF(D188=\"\",0,IF(D188=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D188=\"Yes\"),AND($M$1=\"Scaled\",D188>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D188=\"No\"),AND($M$1=\"Scaled\",D188<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2638,"G.14.19","User accounts associated to a unique individual?",null,null,null,"H.1 Password Controls","9.4.3.a","Password Management System",2,null,14,19,0,0,0,0,{"$f":"IF(J189=\"\",\"\",IF(D189=\"\",0,IF(D189=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D189=\"Yes\"),AND($M$1=\"Scaled\",D189>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D189=\"No\"),AND($M$1=\"Scaled\",D189<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1416,"G.14.20","Does the system lock an account when three to five invalid login attempts are made?",null,null,null,"H.1 Password Controls","9.4.2","Secure Log-On Procedures",2,null,14,20,0,0,0,0,{"$f":"IF(J190=\"\",\"\",IF(D190=\"\",0,IF(D190=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D190=\"Yes\"),AND($M$1=\"Scaled\",D190>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D190=\"No\"),AND($M$1=\"Scaled\",D190<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1478,"G.15","Is a mainframe used to transmit, process or store Scoped Systems and Data? If yes, are:",null,null,null,null,"NA","",1,null,15,0,0,0,0,0,{"$f":"IF(J191=\"\",\"\",IF(D191=\"\",0,IF(D191=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D191=\"Yes\"),AND($M$1=\"Scaled\",D191>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D191=\"No\"),AND($M$1=\"Scaled\",D191<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,1,1]
[1503,"G.15.1","Mainframe security controls documented?",null,null,null,null,"13.1.1.a","Network Controls",2,null,15,1,0,0,0,0,{"$f":"IF(J192=\"\",\"\",IF(D192=\"\",0,IF(D192=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D192=\"Yes\"),AND($M$1=\"Scaled\",D192>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D192=\"No\"),AND($M$1=\"Scaled\",D192<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1504,"G.15.1.1","Reviews performed to validate compliance with documented standards?",null,null,null,null,"18.2.3","Technical Compliance Review",3,null,15,1,1,0,0,0,{"$f":"IF(J193=\"\",\"\",IF(D193=\"\",0,IF(D193=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D193=\"Yes\"),AND($M$1=\"Scaled\",D193>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D193=\"No\"),AND($M$1=\"Scaled\",D193<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1489,"G.15.2","Transmission encrypted?",null,null,null,null,"13.2.1.f","Information Transfer Policies and Procedures",2,null,15,2,0,0,0,0,{"$f":"IF(J194=\"\",\"\",IF(D194=\"\",0,IF(D194=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D194=\"Yes\"),AND($M$1=\"Scaled\",D194>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D194=\"No\"),AND($M$1=\"Scaled\",D194<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1492,"G.15.3","Authentication required for access to any transaction or database system?",null,null,null,null,"9.4.2","Secure Log-On Procedures",2,null,15,3,0,0,0,0,{"$f":"IF(J195=\"\",\"\",IF(D195=\"\",0,IF(D195=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D195=\"Yes\"),AND($M$1=\"Scaled\",D195>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D195=\"No\"),AND($M$1=\"Scaled\",D195<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1496,"G.15.4","Job scheduling systems secured to control the submission of production jobs?",null,null,null,null,"9.4.4","Use of Privileged Utility Programs",2,null,15,4,0,0,0,0,{"$f":"IF(J196=\"\",\"\",IF(D196=\"\",0,IF(D196=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D196=\"Yes\"),AND($M$1=\"Scaled\",D196>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D196=\"No\"),AND($M$1=\"Scaled\",D196<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1497,"G.15.5","Storage management personnel (tape operators) given privileged access to mainframe systems?",null,null,null,null,"9.4.4","Use of Privileged Utility Programs",2,null,15,5,0,0,0,0,{"$f":"IF(J197=\"\",\"\",IF(D197=\"\",0,IF(D197=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D197=\"Yes\"),AND($M$1=\"Scaled\",D197>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D197=\"No\"),AND($M$1=\"Scaled\",D197<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1502,"G.15.6","ESM (RACF) and inherent security configuration settings configured to support the access control standards and requirements?",null,null,null,null,"13.1.1.f","Network Controls",2,null,{"$f":"IF(L197=\"\",1,IF(J198=1,L197+1,L197))","v":15},{"$f":"IF(M197=\"\",0,IF(L197<>L198,0,IF($J198=2,M197+1,M197)))","v":6},{"$f":"IF(N197=\"\",0,IF(M197<>M198,0,IF($J198=3,N197+1,N197)))","v":0},{"$f":"IF(O197=\"\",0,IF(N197<>N198,0,IF($J198=4,O197+1,O197)))","v":0},{"$f":"IF(P197=\"\",0,IF(O197<>O198,0,IF($J198=5,P197+1,P197)))","v":0},{"$f":"IF(OR(Master=\"Master\",J198=0,K198=1),0,IF(ISNA(VLOOKUP(A198,L2_Array,22,FALSE)),0,VLOOKUP(A198,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J198=\"\",\"\",IF(D198=\"\",0,IF(D198=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D198=\"Yes\"),AND($M$1=\"Scaled\",D198>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D198=\"No\"),AND($M$1=\"Scaled\",D198<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J198=\"\",\"\",IF(Q198>0,Q198,IF(R198>0,R198,0)))","v":0},{"$f":"IF(J198=\"\",\"\",IF(OR(J198=1,T197=\"\"),1,IF(OR(AND(K197=1,(J198-J196<>0)),AND(T197=0,J197=J198),AND(K197=1,J198=J196)),0,1)))","v":1},{"$f":"IF(J198=\"\",U197,IF(AND(S198>1,OR(U197=\"\",U197=0,U197>=J198)),J198,IF(J198>U197,U197,0)))","v":0},{"$f":"IF(Master=\"Master\",R198,IF(V197=\"\",S198,IF(OR(AND(U198>0,S198<V197),AND(U198=1,S198<=V197)),V197,S198)))","v":0},{"$f":"IF(J198=\"\",\"\",IF(OR(AND(T197=1,U198=1),S198>0,AND(T199=0,W199=1)),1,0))","v":0},{"$f":"IF(J198=\"\",\"\",IF(OR(AND(U198>0,T198=1),AND(T198=1,W198=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A198,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(J198=1,S198=1),2,IF(AND(V197=1,L198=L197),2,IF(AND(AC197=2,L198=L197),2,IF(J198=1,1,\"\"))))","v":""}]
[1513,"G.15.7","Regular review of logs using a specific methodology to uncover potential incidents?",null,null,null,null,"12.4.1","Event Logging",2,null,15,7,0,0,0,0,{"$f":"IF(J199=\"\",\"\",IF(D199=\"\",0,IF(D199=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D199=\"Yes\"),AND($M$1=\"Scaled\",D199>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D199=\"No\"),AND($M$1=\"Scaled\",D199<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1515,{"$f":"IF(J200=0,\"\",IF(J200=1,Q$1&\".\"&L200,IF(J200=2,Q$1&\".\"&L200&\".\"&M200,IF(J200=3,Q$1&\".\"&L200&\".\"&M200&\".\"&N200,IF(J200=4,Q$1&\".\"&L200&\".\"&M200&\".\"&N200&\".\"&O200,IF(J200=5,Q$1&\".\"&L200&\".\"&M200&\".\"&N200&\".\"&O200&\".\"&P200))))))","v":"G.15.8"},"System generated alerts in the event of an audit log failure?",null,null,null,"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging","12.4.2","Protection of Log Information",2,null,15,8,0,0,0,0,{"$f":"IF(J200=\"\",\"\",IF(D200=\"\",0,IF(D200=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D200=\"Yes\"),AND($M$1=\"Scaled\",D200>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D200=\"No\"),AND($M$1=\"Scaled\",D200<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1506,"G.15.9","Logs retained for a minimum of one year?",null,null,null,"G.11 Log Retention ","NA",null,2,null,15,9,0,0,0,0,{"$f":"IF(J201=\"\",\"\",IF(D201=\"\",0,IF(D201=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D201=\"Yes\"),AND($M$1=\"Scaled\",D201>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D201=\"No\"),AND($M$1=\"Scaled\",D201<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1531,"G.15.10","Audit logs adequately protected against modification, deletion, and/or inappropriate access?",null,null,null,"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging","12.4.2","Protection of Log Information",2,null,15,10,0,0,0,0,{"$f":"IF(J202=\"\",\"\",IF(D202=\"\",0,IF(D202=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D202=\"Yes\"),AND($M$1=\"Scaled\",D202>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D202=\"No\"),AND($M$1=\"Scaled\",D202<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1539,"G.15.11","Minimum password length at least eight characters?",null,null,null,"H.1 Password Controls","9.3.1.d","Use of Secret Authentication Information",2,null,15,11,0,0,0,0,{"$f":"IF(J203=\"\",\"\",IF(D203=\"\",0,IF(D203=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D203=\"Yes\"),AND($M$1=\"Scaled\",D203>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D203=\"No\"),AND($M$1=\"Scaled\",D203<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1545,"G.15.12","Complex passwords required?",null,null,null,"H.1 Password Controls","9.3.1.d                                     9.4.3.c","Use of Secret Authentication Information\nPassword Management System",2,null,15,12,0,0,0,0,{"$f":"IF(J204=\"\",\"\",IF(D204=\"\",0,IF(D204=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D204=\"Yes\"),AND($M$1=\"Scaled\",D204>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D204=\"No\"),AND($M$1=\"Scaled\",D204<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1550,"G.15.13","Minimum password expiration at least 90 days?",null,null,null,"H.1 Password Controls","9.4.3.e","Password Management System",2,null,15,13,0,0,0,0,{"$f":"IF(J205=\"\",\"\",IF(D205=\"\",0,IF(D205=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D205=\"Yes\"),AND($M$1=\"Scaled\",D205>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D205=\"No\"),AND($M$1=\"Scaled\",D205<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1555,"G.15.14","Password history of 12 before reuse?",null,null,null,"H.1 Password Controls","9.4.3.f","Password Management System",2,null,15,14,0,0,0,0,{"$f":"IF(J206=\"\",\"\",IF(D206=\"\",0,IF(D206=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D206=\"Yes\"),AND($M$1=\"Scaled\",D206>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D206=\"No\"),AND($M$1=\"Scaled\",D206<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1570,"G.15.15","Password minimum age?",null,null,null,"H.1 Password Controls","9.4.3.e","Password Management System",2,null,15,15,0,0,0,0,{"$f":"IF(J207=\"\",\"\",IF(D207=\"\",0,IF(D207=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D207=\"Yes\"),AND($M$1=\"Scaled\",D207>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D207=\"No\"),AND($M$1=\"Scaled\",D207<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2639,"G.15.16","Initial password required to be changed at first logon?",null,null,null,"H.1 Password Controls","9.4.3.d","Password Management System",2,null,15,16,0,0,0,0,{"$f":"IF(J208=\"\",\"\",IF(D208=\"\",0,IF(D208=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D208=\"Yes\"),AND($M$1=\"Scaled\",D208>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D208=\"No\"),AND($M$1=\"Scaled\",D208<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1574,"G.15.17","Can a PIN or secret question be a stand alone method of authentication?",null,null,null,null,"9.4.2 ","Secure Log-On Procedures",2,null,15,17,0,0,0,0,{"$f":"IF(J209=\"\",\"\",IF(D209=\"\",0,IF(D209=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D209=\"Yes\"),AND($M$1=\"Scaled\",D209>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D209=\"No\"),AND($M$1=\"Scaled\",D209<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1575,"G.15.18","Passwords encrypted in transit?",null,null,null,"H.1 Password Controls","9.4.3.i","Password Management System",2,null,15,18,0,0,0,0,{"$f":"IF(J210=\"\",\"\",IF(D210=\"\",0,IF(D210=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D210=\"Yes\"),AND($M$1=\"Scaled\",D210>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D210=\"No\"),AND($M$1=\"Scaled\",D210<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1576,"G.15.19","Passwords encrypted or hashed in storage?",null,null,null,"H.1 Password Controls","9.4.3.i","Password Management System",2,null,15,19,0,0,0,0,{"$f":"IF(J211=\"\",\"\",IF(D211=\"\",0,IF(D211=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D211=\"Yes\"),AND($M$1=\"Scaled\",D211>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D211=\"No\"),AND($M$1=\"Scaled\",D211<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1577,"G.15.20","Passwords displayed when entered into a system?",null,null,null,"H.1 Password Controls","9.4.3.g","Password Management System",2,null,15,20,0,0,0,0,{"$f":"IF(J212=\"\",\"\",IF(D212=\"\",0,IF(D212=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D212=\"Yes\"),AND($M$1=\"Scaled\",D212>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D212=\"No\"),AND($M$1=\"Scaled\",D212<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2640,"G.15.21","User accounts associated to a unique individual?",null,null,null,"H.1 Password Controls","9.4.3.a","Password Management System",2,null,15,21,0,0,0,0,{"$f":"IF(J213=\"\",\"\",IF(D213=\"\",0,IF(D213=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D213=\"Yes\"),AND($M$1=\"Scaled\",D213>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D213=\"No\"),AND($M$1=\"Scaled\",D213<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1559,"G.15.22","Does the system lock an account when three to five invalid login attempts are made?",null,null,null,"H.1 Password Controls","9.4.2","Secure Log-On Procedures",2,null,15,22,0,0,0,0,{"$f":"IF(J214=\"\",\"\",IF(D214=\"\",0,IF(D214=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D214=\"Yes\"),AND($M$1=\"Scaled\",D214>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D214=\"No\"),AND($M$1=\"Scaled\",D214<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1564,"G.15.23","Administrator intervention required to unlock an account?",null,null,null,"H.1 Password Controls","9.4.2","Secure Log-On Procedures",2,null,15,23,0,0,0,0,{"$f":"IF(J215=\"\",\"\",IF(D215=\"\",0,IF(D215=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D215=\"Yes\"),AND($M$1=\"Scaled\",D215>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D215=\"No\"),AND($M$1=\"Scaled\",D215<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1579,"G.16","Is an AS400 used to transmit, process or store Scoped Systems and Data? If yes, are:",null,null,null,null,"NA","",1,null,16,0,0,0,0,0,{"$f":"IF(J216=\"\",\"\",IF(D216=\"\",0,IF(D216=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D216=\"Yes\"),AND($M$1=\"Scaled\",D216>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D216=\"No\"),AND($M$1=\"Scaled\",D216<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,1,1]
[2641,"G.16.1","Security controls documented?",null,null,null,null,"13.1.1.a","Network Controls",2,null,16,1,0,0,0,0,{"$f":"IF(J217=\"\",\"\",IF(D217=\"\",0,IF(D217=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D217=\"Yes\"),AND($M$1=\"Scaled\",D217>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D217=\"No\"),AND($M$1=\"Scaled\",D217<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1598,"G.16.1.1","Systems periodically monitored to ensure continued compliance with the documented standards?",null,null,null,null,"18.2.3","Technical Compliance Review",3,null,16,1,1,0,0,0,{"$f":"IF(J218=\"\",\"\",IF(D218=\"\",0,IF(D218=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D218=\"Yes\"),AND($M$1=\"Scaled\",D218>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D218=\"No\"),AND($M$1=\"Scaled\",D218<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1580,"G.16.2","Group profile assignments based on constituent role?",null,null,null,null,"9.1.1.k","Access Control Policy",2,null,16,2,0,0,0,0,{"$f":"IF(J219=\"\",\"\",IF(D219=\"\",0,IF(D219=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D219=\"Yes\"),AND($M$1=\"Scaled\",D219>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D219=\"No\"),AND($M$1=\"Scaled\",D219<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1581,"G.16.3","Group profile assignments approved?",null,null,null,null,"9.1.1.g","Access Control Policy",2,null,16,3,0,0,0,0,{"$f":"IF(J220=\"\",\"\",IF(D220=\"\",0,IF(D220=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D220=\"Yes\"),AND($M$1=\"Scaled\",D220>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D220=\"No\"),AND($M$1=\"Scaled\",D220<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1582,"G.16.4","User profiles created with the principle of least privilege?",null,null,null,null,"9.1.1.b","Access Control Policy",2,null,16,4,0,0,0,0,{"$f":"IF(J221=\"\",\"\",IF(D221=\"\",0,IF(D221=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D221=\"Yes\"),AND($M$1=\"Scaled\",D221>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D221=\"No\"),AND($M$1=\"Scaled\",D221<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1607,"G.16.5","Logs regularly reviewed using a specific methodology to uncover potential incidents?",null,null,null,"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging","12.4.1","Event Logging",2,null,16,5,0,0,0,0,{"$f":"IF(J222=\"\",\"\",IF(D222=\"\",0,IF(D222=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D222=\"Yes\"),AND($M$1=\"Scaled\",D222>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D222=\"No\"),AND($M$1=\"Scaled\",D222<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1609,"G.16.6","Sufficient information in the logs to evaluate incidents?",null,null,null,"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging","12.4.1","Event Logging",2,null,16,6,0,0,0,0,{"$f":"IF(J223=\"\",\"\",IF(D223=\"\",0,IF(D223=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D223=\"Yes\"),AND($M$1=\"Scaled\",D223>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D223=\"No\"),AND($M$1=\"Scaled\",D223<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1600,"G.16.7","Logs retained for a minimum of one year?",null,null,null,"G.11 Log Retention ","12.4.2","Protection of Log Information",2,null,16,7,0,0,0,0,{"$f":"IF(J224=\"\",\"\",IF(D224=\"\",0,IF(D224=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D224=\"Yes\"),AND($M$1=\"Scaled\",D224>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D224=\"No\"),AND($M$1=\"Scaled\",D224<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1620,"G.16.8","System generated alerts in the event of an audit log failure?",null,null,null,"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging","12.4.1","Event Logging",2,null,16,8,0,0,0,0,{"$f":"IF(J225=\"\",\"\",IF(D225=\"\",0,IF(D225=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D225=\"Yes\"),AND($M$1=\"Scaled\",D225>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D225=\"No\"),AND($M$1=\"Scaled\",D225<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1625,"G.16.9","Audit logs protected against modification, deletion, and/or inappropriate access?",null,null,null,"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging","12.4.2","Protection of Log Information",2,null,16,9,0,0,0,0,{"$f":"IF(J226=\"\",\"\",IF(D226=\"\",0,IF(D226=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D226=\"Yes\"),AND($M$1=\"Scaled\",D226>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D226=\"No\"),AND($M$1=\"Scaled\",D226<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1633,"G.16.10","Minimum password length at least eight characters:",null,null,null,"H.1 Password Controls","9.3.1.d","Use of Secret Authentication Information",2,null,16,10,0,0,0,0,{"$f":"IF(J227=\"\",\"\",IF(D227=\"\",0,IF(D227=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D227=\"Yes\"),AND($M$1=\"Scaled\",D227>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D227=\"No\"),AND($M$1=\"Scaled\",D227<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1639,"G.16.11","Complex passwords required?",null,null,null,"H.1 Password Controls","9.3.1.d                                     9.4.3.c","Use of Secret Authentication Information\nPassword Management System",2,null,16,11,0,0,0,0,{"$f":"IF(J228=\"\",\"\",IF(D228=\"\",0,IF(D228=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D228=\"Yes\"),AND($M$1=\"Scaled\",D228>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D228=\"No\"),AND($M$1=\"Scaled\",D228<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1644,"G.16.12","Minimum password expiration at least 90 days?",null,null,null,"H.1 Password Controls","9.4.3.e","Password Management System",2,null,16,12,0,0,0,0,{"$f":"IF(J229=\"\",\"\",IF(D229=\"\",0,IF(D229=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D229=\"Yes\"),AND($M$1=\"Scaled\",D229>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D229=\"No\"),AND($M$1=\"Scaled\",D229<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1649,"G.16.13","Password history of 12 before reuse?",null,null,null,"H.1 Password Controls","9.4.3.f","Password Management System",2,null,16,13,0,0,0,0,{"$f":"IF(J230=\"\",\"\",IF(D230=\"\",0,IF(D230=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D230=\"Yes\"),AND($M$1=\"Scaled\",D230>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D230=\"No\"),AND($M$1=\"Scaled\",D230<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2642,"G.16.14","Initial password required to be changed at first logon?",null,null,null,"H.1 Password Controls","9.4.3.d","Password Management System",2,null,16,14,0,0,0,0,{"$f":"IF(J231=\"\",\"\",IF(D231=\"\",0,IF(D231=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D231=\"Yes\"),AND($M$1=\"Scaled\",D231>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D231=\"No\"),AND($M$1=\"Scaled\",D231<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1668,"G.16.15","Can a PIN or secret question be a stand alone method of authentication?",null,null,null,"H.1 Password Controls","9.4.2","Secure Log-On Procedures",2,null,16,15,0,0,0,0,{"$f":"IF(J232=\"\",\"\",IF(D232=\"\",0,IF(D232=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D232=\"Yes\"),AND($M$1=\"Scaled\",D232>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D232=\"No\"),AND($M$1=\"Scaled\",D232<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1669,"G.16.16","Passwords encrypted in transit?",null,null,null,"H.1 Password Controls","9.4.3.i","Password Management System",2,null,16,16,0,0,0,0,{"$f":"IF(J233=\"\",\"\",IF(D233=\"\",0,IF(D233=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D233=\"Yes\"),AND($M$1=\"Scaled\",D233>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D233=\"No\"),AND($M$1=\"Scaled\",D233<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1670,"G.16.17","Passwords encrypted or hashed in storage?",null,null,null,"H.1 Password Controls","9.4.3.i","Password Management System",2,null,16,17,0,0,0,0,{"$f":"IF(J234=\"\",\"\",IF(D234=\"\",0,IF(D234=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D234=\"Yes\"),AND($M$1=\"Scaled\",D234>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D234=\"No\"),AND($M$1=\"Scaled\",D234<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1671,"G.16.18","Passwords displayed when entered into a system?",null,null,null,"H.1 Password Controls","9.4.3.g","Password Management System",2,null,16,18,0,0,0,0,{"$f":"IF(J235=\"\",\"\",IF(D235=\"\",0,IF(D235=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D235=\"Yes\"),AND($M$1=\"Scaled\",D235>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D235=\"No\"),AND($M$1=\"Scaled\",D235<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2643,"G.16.19","User accounts associated to a unique individual?",null,null,null,"H.1 Password Controls","9.4.3.a","Password Management System",2,null,16,19,0,0,0,0,{"$f":"IF(J236=\"\",\"\",IF(D236=\"\",0,IF(D236=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D236=\"Yes\"),AND($M$1=\"Scaled\",D236>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D236=\"No\"),AND($M$1=\"Scaled\",D236<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1653,"G.16.20","Does the system lock an account when three to five invalid login attempts are made?",null,null,null,"H.1 Password Controls","9.4.2","Secure Log-On Procedures",2,null,16,20,0,0,0,0,{"$f":"IF(J237=\"\",\"\",IF(D237=\"\",0,IF(D237=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D237=\"Yes\"),AND($M$1=\"Scaled\",D237>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D237=\"No\"),AND($M$1=\"Scaled\",D237<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2644,"G.16.21","Users required to log off when the session is finished?",null,null,null,null,"11.2.8.a","Unattended User Equipment",2,null,16,21,0,0,0,0,{"$f":"IF(J238=\"\",\"\",IF(D238=\"\",0,IF(D238=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D238=\"Yes\"),AND($M$1=\"Scaled\",D238>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D238=\"No\"),AND($M$1=\"Scaled\",D238<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1672,"G.17","Is an Open VMS (VAX or Alpha) system used to transmit, process or store Scoped Systems and Data? If yes, are:",null,null,null,null,"NA","",1,null,17,0,0,0,0,0,{"$f":"IF(J239=\"\",\"\",IF(D239=\"\",0,IF(D239=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D239=\"Yes\"),AND($M$1=\"Scaled\",D239>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D239=\"No\"),AND($M$1=\"Scaled\",D239<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,1,1]
[1679,"G.17.1","Administrative privilege restricted to those responsible for VMS administration?",null,null,null,null,"9.4.4.c","Use of Privileged Utility Programs",2,null,17,1,0,0,0,0,{"$f":"IF(J240=\"\",\"\",IF(D240=\"\",0,IF(D240=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D240=\"Yes\"),AND($M$1=\"Scaled\",D240>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D240=\"No\"),AND($M$1=\"Scaled\",D240<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1705,"G.17.2","Logs regularly reviewed using a specific methodology to uncover potential incidents?",null,null,null,null,"12.4.1","Event Logging",2,null,17,2,0,0,0,0,{"$f":"IF(J241=\"\",\"\",IF(D241=\"\",0,IF(D241=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D241=\"Yes\"),AND($M$1=\"Scaled\",D241>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D241=\"No\"),AND($M$1=\"Scaled\",D241<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1707,"G.17.3","Sufficient information to investigate incidents including (failed login attempts)?",null,null,null,"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging","12.4.1","Event Logging",2,null,17,3,0,0,0,0,{"$f":"IF(J242=\"\",\"\",IF(D242=\"\",0,IF(D242=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D242=\"Yes\"),AND($M$1=\"Scaled\",D242>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D242=\"No\"),AND($M$1=\"Scaled\",D242<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1698,"G.17.4","Logs retained for a minimum of one year?",null,null,null,"G.11 Log Retention ","12.4.2","Protection of Log Information",2,null,17,4,0,0,0,0,{"$f":"IF(J243=\"\",\"\",IF(D243=\"\",0,IF(D243=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D243=\"Yes\"),AND($M$1=\"Scaled\",D243>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D243=\"No\"),AND($M$1=\"Scaled\",D243<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1718,"G.17.5","System generated alerts in the event of an audit log failure?",null,null,null,"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging","12.4.1","Event Logging",2,null,17,5,0,0,0,0,{"$f":"IF(J244=\"\",\"\",IF(D244=\"\",0,IF(D244=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D244=\"Yes\"),AND($M$1=\"Scaled\",D244>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D244=\"No\"),AND($M$1=\"Scaled\",D244<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1723,"G.17.6","Are audit logs protected against modification, deletion, and/or inappropriate access?",null,null,null,"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging","12.4.2","Protection of Log Information",2,null,17,6,0,0,0,0,{"$f":"IF(J245=\"\",\"\",IF(D245=\"\",0,IF(D245=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D245=\"Yes\"),AND($M$1=\"Scaled\",D245>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D245=\"No\"),AND($M$1=\"Scaled\",D245<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1731,"G.17.7","Minimum password length at least eight characters?",null,null,null,"H.1 Password Controls","9.3.1.d","Use of Secret Authentication Information",2,null,17,7,0,0,0,0,{"$f":"IF(J246=\"\",\"\",IF(D246=\"\",0,IF(D246=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D246=\"Yes\"),AND($M$1=\"Scaled\",D246>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D246=\"No\"),AND($M$1=\"Scaled\",D246<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1737,"G.17.8","Complex passwords required?",null,null,null,"H.1 Password Controls","9.3.1.d                                     9.4.3.c","Use of Secret Authentication Information\nPassword Management System",2,null,17,8,0,0,0,0,{"$f":"IF(J247=\"\",\"\",IF(D247=\"\",0,IF(D247=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D247=\"Yes\"),AND($M$1=\"Scaled\",D247>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D247=\"No\"),AND($M$1=\"Scaled\",D247<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1742,"G.17.9","Minimum password expiration at least every 90 days?",null,null,null,"H.1 Password Controls","9.4.3.e","Password Management System",2,null,17,9,0,0,0,0,{"$f":"IF(J248=\"\",\"\",IF(D248=\"\",0,IF(D248=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D248=\"Yes\"),AND($M$1=\"Scaled\",D248>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D248=\"No\"),AND($M$1=\"Scaled\",D248<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1747,"G.17.10","Password history of 12 before reuse?",null,null,null,"H.1 Password Controls","9.4.3.f","Password Management System",2,null,17,10,0,0,0,0,{"$f":"IF(J249=\"\",\"\",IF(D249=\"\",0,IF(D249=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D249=\"Yes\"),AND($M$1=\"Scaled\",D249>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D249=\"No\"),AND($M$1=\"Scaled\",D249<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2646,"G.17.11","Initial password required to be changed at first logon?",null,null,null,"H.1 Password Controls","9.4.3.d","Password Management System",2,null,17,11,0,0,0,0,{"$f":"IF(J250=\"\",\"\",IF(D250=\"\",0,IF(D250=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D250=\"Yes\"),AND($M$1=\"Scaled\",D250>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D250=\"No\"),AND($M$1=\"Scaled\",D250<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1766,"G.17.12","Can a PIN or secret question be a stand alone method of authentication?",null,null,null,null,"9.4.2","Secure Log-On Procedures",2,null,17,12,0,0,0,0,{"$f":"IF(J251=\"\",\"\",IF(D251=\"\",0,IF(D251=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D251=\"Yes\"),AND($M$1=\"Scaled\",D251>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D251=\"No\"),AND($M$1=\"Scaled\",D251<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1767,"G.17.13","Passwords encrypted in transit?",null,null,null,"H.1 Password Controls","9.4.3.i","Password Management System",2,null,17,13,0,0,0,0,{"$f":"IF(J252=\"\",\"\",IF(D252=\"\",0,IF(D252=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D252=\"Yes\"),AND($M$1=\"Scaled\",D252>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D252=\"No\"),AND($M$1=\"Scaled\",D252<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1768,"G.17.14","Passwords encrypted or hashed in storage?",null,null,null,"H.1 Password Controls","9.4.3.i","Password Management System",2,null,17,14,0,0,0,0,{"$f":"IF(J253=\"\",\"\",IF(D253=\"\",0,IF(D253=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D253=\"Yes\"),AND($M$1=\"Scaled\",D253>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D253=\"No\"),AND($M$1=\"Scaled\",D253<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1769,"G.17.15","Passwords displayed when entered into a system?",null,null,null,"H.1 Password Controls","9.4.3.g","Password Management System",2,null,17,15,0,0,0,0,{"$f":"IF(J254=\"\",\"\",IF(D254=\"\",0,IF(D254=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D254=\"Yes\"),AND($M$1=\"Scaled\",D254>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D254=\"No\"),AND($M$1=\"Scaled\",D254<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2647,"G.17.16","User accounts associated to a unique individual?",null,null,null,"H.1 Password Controls","9.4.3.a","Password Management System",2,null,17,16,0,0,0,0,{"$f":"IF(J255=\"\",\"\",IF(D255=\"\",0,IF(D255=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D255=\"Yes\"),AND($M$1=\"Scaled\",D255>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D255=\"No\"),AND($M$1=\"Scaled\",D255<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1751,"G.17.17","Does the system lock an account when three to five invalid login attempts are made?",null,null,null,"H.1 Password Controls","9.4.2","Secure Log-On Procedures",2,null,17,17,0,0,0,0,{"$f":"IF(J256=\"\",\"\",IF(D256=\"\",0,IF(D256=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D256=\"Yes\"),AND($M$1=\"Scaled\",D256>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D256=\"No\"),AND($M$1=\"Scaled\",D256<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1770,"G.18","Are Web services provided? If yes, are:",null,null,null,null,"NA","",1,null,18,0,0,0,0,0,{"$f":"IF(J257=\"\",\"\",IF(D257=\"\",0,IF(D257=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D257=\"Yes\"),AND($M$1=\"Scaled\",D257>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D257=\"No\"),AND($M$1=\"Scaled\",D257<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1,1]
[2649,"G.18.1","Electronic commerce web sites or applications used to transmit, process or store Scoped Systems and Data?",null,null,null,"G.13 Website – Client Encryption","14.1.2","Securing Application Services on Public Networks",2,null,18,1,0,0,0,0,{"$f":"IF(J258=\"\",\"\",IF(D258=\"\",0,IF(D258=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D258=\"Yes\"),AND($M$1=\"Scaled\",D258>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D258=\"No\"),AND($M$1=\"Scaled\",D258<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2650,"G.18.1.1","Cryptographic controls used for the electronic commerce application (SSL)?",null,null,null,"G.13 Website – Client Encryption","14.1.2","Securing Application Services on Public Networks",3,null,18,1,1,0,0,0,{"$f":"IF(J259=\"\",\"\",IF(D259=\"\",0,IF(D259=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D259=\"Yes\"),AND($M$1=\"Scaled\",D259>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D259=\"No\"),AND($M$1=\"Scaled\",D259<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2651,"G.18.1.2","Users required to authenticate to the application?",null,null,null,"G.13 Website – Client Encryption","14.1.3","Protecting Application Services Transactions",3,null,18,1,2,0,0,0,{"$f":"IF(J260=\"\",\"\",IF(D260=\"\",0,IF(D260=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D260=\"Yes\"),AND($M$1=\"Scaled\",D260>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D260=\"No\"),AND($M$1=\"Scaled\",D260<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2652,"G.18.1.3","Transaction details stored in the DMZ?",null,null,null,null,"14.1.3.e","Protecting Application Services Transactions",3,null,18,1,3,0,0,0,{"$f":"IF(J261=\"\",\"\",IF(D261=\"\",0,IF(D261=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D261=\"Yes\"),AND($M$1=\"Scaled\",D261>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D261=\"No\"),AND($M$1=\"Scaled\",D261<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1771,"G.18.2","Is Windows IIS for these Web services used? If yes, is:",null,null,null,null,"NA","",2,null,{"$f":"IF(L261=\"\",1,IF(J262=1,L261+1,L261))","v":18},{"$f":"IF(M261=\"\",0,IF(L261<>L262,0,IF($J262=2,M261+1,M261)))","v":2},{"$f":"IF(N261=\"\",0,IF(M261<>M262,0,IF($J262=3,N261+1,N261)))","v":0},{"$f":"IF(O261=\"\",0,IF(N261<>N262,0,IF($J262=4,O261+1,O261)))","v":0},{"$f":"IF(P261=\"\",0,IF(O261<>O262,0,IF($J262=5,P261+1,P261)))","v":0},{"$f":"IF(OR(Master=\"Master\",J262=0,K262=1),0,IF(ISNA(VLOOKUP(A262,L2_Array,22,FALSE)),0,VLOOKUP(A262,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J262=\"\",\"\",IF(D262=\"\",0,IF(D262=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D262=\"Yes\"),AND($M$1=\"Scaled\",D262>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D262=\"No\"),AND($M$1=\"Scaled\",D262<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J262=\"\",\"\",IF(Q262>0,Q262,IF(R262>0,R262,0)))","v":0},{"$f":"IF(J262=\"\",\"\",IF(OR(J262=1,T261=\"\"),1,IF(OR(AND(K261=1,(J262-J260<>0)),AND(T261=0,J261=J262),AND(K261=1,J262=J260)),0,1)))","v":1},{"$f":"IF(J262=\"\",U261,IF(AND(S262>1,OR(U261=\"\",U261=0,U261>=J262)),J262,IF(J262>U261,U261,0)))","v":0},{"$f":"IF(Master=\"Master\",R262,IF(V261=\"\",S262,IF(OR(AND(U262>0,S262<V261),AND(U262=1,S262<=V261)),V261,S262)))","v":0},{"$f":"IF(J262=\"\",\"\",IF(OR(AND(T261=1,U262=1),S262>0,AND(T263=0,W263=1)),1,0))","v":0},{"$f":"IF(J262=\"\",\"\",IF(OR(AND(U262>0,T262=1),AND(T262=1,W262=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A262,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(J262=1,S262=1),2,IF(AND(V261=1,L262=L261),2,IF(AND(AC261=2,L262=L261),2,IF(J262=1,1,\"\"))))","v":""},1]
[1772,"G.18.2.1","Anonymous access to FTP disabled?",null,null,null,null,"13.2.2","Agreements on Information Transfer",3,null,18,2,1,0,0,0,{"$f":"IF(J263=\"\",\"\",IF(D263=\"\",0,IF(D263=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D263=\"Yes\"),AND($M$1=\"Scaled\",D263>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D263=\"No\"),AND($M$1=\"Scaled\",D263<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1773,{"$f":"IF(J264=0,\"\",IF(J264=1,Q$1&\".\"&L264,IF(J264=2,Q$1&\".\"&L264&\".\"&M264,IF(J264=3,Q$1&\".\"&L264&\".\"&M264&\".\"&N264,IF(J264=4,Q$1&\".\"&L264&\".\"&M264&\".\"&N264&\".\"&O264,IF(J264=5,Q$1&\".\"&L264&\".\"&M264&\".\"&N264&\".\"&O264&\".\"&P264))))))","v":"G.18.2.2"},"Membership to the IIS Administrators group restricted to those with web administration roles and responsibilities?",null,null,null,null,"9.2.3.b","Management of Privileged Access Rights",3,null,18,2,2,0,0,0,{"$f":"IF(J264=\"\",\"\",IF(D264=\"\",0,IF(D264=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D264=\"Yes\"),AND($M$1=\"Scaled\",D264>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D264=\"No\"),AND($M$1=\"Scaled\",D264<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1774,"G.18.2.3","Dedicated virtual directory structure used for each website?",null,null,null,null,"13.1.3","Segregation In Networks",3,null,18,2,3,0,0,0,{"$f":"IF(J265=\"\",\"\",IF(D265=\"\",0,IF(D265=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D265=\"Yes\"),AND($M$1=\"Scaled\",D265>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D265=\"No\"),AND($M$1=\"Scaled\",D265<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1776,"G.18.2.4","Unused services turned off on IIS servers?",null,null,null,null,"9.4.4.h","Use of Privileged Utility Programs",3,null,18,2,4,0,0,0,{"$f":"IF(J266=\"\",\"\",IF(D266=\"\",0,IF(D266=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D266=\"Yes\"),AND($M$1=\"Scaled\",D266>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D266=\"No\"),AND($M$1=\"Scaled\",D266<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1777,"G.18.2.5","Services running on standard ports?",null,null,null,null,"NA","",3,null,18,2,5,0,0,0,{"$f":"IF(J267=\"\",\"\",IF(D267=\"\",0,IF(D267=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D267=\"Yes\"),AND($M$1=\"Scaled\",D267>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D267=\"No\"),AND($M$1=\"Scaled\",D267<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1778,"G.18.2.6","Logging configured to support incident investigation?",null,null,null,null,12.4,"Logging and Monitoring",3,null,18,2,6,0,0,0,{"$f":"IF(J268=\"\",\"\",IF(D268=\"\",0,IF(D268=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D268=\"Yes\"),AND($M$1=\"Scaled\",D268>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D268=\"No\"),AND($M$1=\"Scaled\",D268<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1779,"G.18.2.7","Sample applications and scripts removed?",null,null,null,null,"9.4.4.h","Use of Privileged Utility Programs",3,null,18,2,7,0,0,0,{"$f":"IF(J269=\"\",\"\",IF(D269=\"\",0,IF(D269=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D269=\"Yes\"),AND($M$1=\"Scaled\",D269>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D269=\"No\"),AND($M$1=\"Scaled\",D269<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1780,"G.18.2.8","Least privilege used when setting IIS content permissions?",null,null,null,null,"9.1.1","Access Control Policy",3,null,18,2,8,0,0,0,{"$f":"IF(J270=\"\",\"\",IF(D270=\"\",0,IF(D270=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D270=\"Yes\"),AND($M$1=\"Scaled\",D270>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D270=\"No\"),AND($M$1=\"Scaled\",D270<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1781,"G.18.2.9","Content folder on the same drive as the operating system?",null,null,null,null,"NA","",3,null,18,2,9,0,0,0,{"$f":"IF(J271=\"\",\"\",IF(D271=\"\",0,IF(D271=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D271=\"Yes\"),AND($M$1=\"Scaled\",D271>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D271=\"No\"),AND($M$1=\"Scaled\",D271<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1782,"G.18.3","Is Apache used for these Web services? If yes, is:",null,null,null,null,"NA","",2,null,18,3,0,0,0,0,{"$f":"IF(J272=\"\",\"\",IF(D272=\"\",0,IF(D272=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D272=\"Yes\"),AND($M$1=\"Scaled\",D272>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D272=\"No\"),AND($M$1=\"Scaled\",D272<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[1783,"G.18.3.1","Logging configured to support incident investigation?",null,null,null,null,12.4,"Logging and Monitoring",3,null,18,3,1,0,0,0,{"$f":"IF(J273=\"\",\"\",IF(D273=\"\",0,IF(D273=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D273=\"Yes\"),AND($M$1=\"Scaled\",D273>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D273=\"No\"),AND($M$1=\"Scaled\",D273<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1784,"G.18.3.2","Anonymous access to FTP disabled?",null,null,null,null,"13.2.2","Agreements on Information Transfer",3,null,18,3,2,0,0,0,{"$f":"IF(J274=\"\",\"\",IF(D274=\"\",0,IF(D274=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D274=\"Yes\"),AND($M$1=\"Scaled\",D274>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D274=\"No\"),AND($M$1=\"Scaled\",D274<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1785,"G.18.3.3","Membership to the Apache group restricted to those with web administration roles and responsibilities?",null,null,null,null,"9.2.3.b","Management of Privileged Access Rights",3,null,18,3,3,0,0,0,{"$f":"IF(J275=\"\",\"\",IF(D275=\"\",0,IF(D275=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D275=\"Yes\"),AND($M$1=\"Scaled\",D275>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D275=\"No\"),AND($M$1=\"Scaled\",D275<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1786,"G.18.3.4","Dedicated virtual directory structure used for each website?",null,null,null,null,"13.1.3","Segregation In Networks",3,null,18,3,4,0,0,0,{"$f":"IF(J276=\"\",\"\",IF(D276=\"\",0,IF(D276=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D276=\"Yes\"),AND($M$1=\"Scaled\",D276>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D276=\"No\"),AND($M$1=\"Scaled\",D276<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1787,"G.18.3.5","Configuration options restricted to authorized users?",null,null,null,null,"9.1.1","Access Control Policy",3,null,18,3,5,0,0,0,{"$f":"IF(J277=\"\",\"\",IF(D277=\"\",0,IF(D277=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D277=\"Yes\"),AND($M$1=\"Scaled\",D277>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D277=\"No\"),AND($M$1=\"Scaled\",D277<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1788,"G.18.3.6","Services run on standard ports?",null,null,null,null,"NA","",3,null,18,3,6,0,0,0,{"$f":"IF(J278=\"\",\"\",IF(D278=\"\",0,IF(D278=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D278=\"Yes\"),AND($M$1=\"Scaled\",D278>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D278=\"No\"),AND($M$1=\"Scaled\",D278<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1789,"G.18.3.7","Sample applications and scripts removed?",null,null,null,null,"9.4.4.h","Use of Privileged Utility Programs",3,null,18,3,7,0,0,0,{"$f":"IF(J279=\"\",\"\",IF(D279=\"\",0,IF(D279=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D279=\"Yes\"),AND($M$1=\"Scaled\",D279>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D279=\"No\"),AND($M$1=\"Scaled\",D279<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1790,"G.18.3.8","Least privilege used when setting permissions?",null,null,null,"H.3 Logical Access Authorization","9.1.1","Access Control Policy",3,null,18,3,8,0,0,0,{"$f":"IF(J280=\"\",\"\",IF(D280=\"\",0,IF(D280=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D280=\"Yes\"),AND($M$1=\"Scaled\",D280>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D280=\"No\"),AND($M$1=\"Scaled\",D280<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1791,"G.19","Are desktop computers used to transmit, process or store Scoped Systems and Data. If yes, is:",null,null,null,null,"NA","",1,null,19,0,0,0,0,0,{"$f":"IF(J281=\"\",\"\",IF(D281=\"\",0,IF(D281=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D281=\"Yes\"),AND($M$1=\"Scaled\",D281>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D281=\"No\"),AND($M$1=\"Scaled\",D281<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,1,1]
[842,"G.19.1","Segregation of duties for granting access and approving access?",null,null,null,null,"9.1.1.f","Access Control Policy",2,null,19,1,0,0,0,0,{"$f":"IF(J282=\"\",\"\",IF(D282=\"\",0,IF(D282=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D282=\"Yes\"),AND($M$1=\"Scaled\",D282>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D282=\"No\"),AND($M$1=\"Scaled\",D282<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[845,"G.19.2","Segregation of duties for approving and implementing access requests?",null,null,null,null,"6.1.2 ","Segregation of Duties",2,null,19,2,0,0,0,0,{"$f":"IF(J283=\"\",\"\",IF(D283=\"\",0,IF(D283=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D283=\"Yes\"),AND($M$1=\"Scaled\",D283>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D283=\"No\"),AND($M$1=\"Scaled\",D283<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2954,"G.19.3","User able to use removable media (floppy disk, recordable CD, USB drive) without detection?",null,null,null,null,"8.3.1.b","Management of Removable Media",2,null,19,3,0,0,0,0,{"$f":"IF(J284=\"\",\"\",IF(D284=\"\",0,IF(D284=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D284=\"Yes\"),AND($M$1=\"Scaled\",D284>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D284=\"No\"),AND($M$1=\"Scaled\",D284<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[843,"G.19.4","User of a system also responsible for reviewing its security audit logs?",null,null,null,null,"6.1.2 ","Segregation of Duties",2,null,19,4,0,0,0,0,{"$f":"IF(J285=\"\",\"\",IF(D285=\"\",0,IF(D285=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D285=\"Yes\"),AND($M$1=\"Scaled\",D285>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D285=\"No\"),AND($M$1=\"Scaled\",D285<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[844,"G.19.5","Segregation of duties to prevent the user of a system from modifying or deleting its security audit logs?",null,null,null,null,"6.1.2 ","Segregation of Duties",2,null,19,5,0,0,0,0,{"$f":"IF(J286=\"\",\"\",IF(D286=\"\",0,IF(D286=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D286=\"Yes\"),AND($M$1=\"Scaled\",D286>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D286=\"No\"),AND($M$1=\"Scaled\",D286<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1792,"G.19.6","Standard operating environment required?",null,null,null,null,"13.1.1.e","Network Controls",2,null,19,6,0,0,0,0,{"$f":"IF(J287=\"\",\"\",IF(D287=\"\",0,IF(D287=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D287=\"Yes\"),AND($M$1=\"Scaled\",D287>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D287=\"No\"),AND($M$1=\"Scaled\",D287<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1013,"G.19.7","Content filtering proxy used prior to accessing the Internet?",null,null,null,null,"NA","Network Routing Control",2,null,19,7,0,0,0,0,{"$f":"IF(J288=\"\",\"\",IF(D288=\"\",0,IF(D288=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D288=\"Yes\"),AND($M$1=\"Scaled\",D288>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D288=\"No\"),AND($M$1=\"Scaled\",D288<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1793,"G.19.8","Security approval required prior to implementing non-standard operating equipment?",null,null,null,null,"13.1.1","Network Controls",2,null,19,8,0,0,0,0,{"$f":"IF(J289=\"\",\"\",IF(D289=\"\",0,IF(D289=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D289=\"Yes\"),AND($M$1=\"Scaled\",D289>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D289=\"No\"),AND($M$1=\"Scaled\",D289<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1794,"G.19.9","Security approval required prior to implementing freeware or shareware applications?",null,null,null,null,"13.1.1","Network Controls",2,null,19,9,0,0,0,0,{"$f":"IF(J290=\"\",\"\",IF(D290=\"\",0,IF(D290=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D290=\"Yes\"),AND($M$1=\"Scaled\",D290>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D290=\"No\"),AND($M$1=\"Scaled\",D290<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1797,"G.19.10","Non-company managed PCs used to connect to the company network?",null,null,null,null,"NA","",2,null,19,10,0,0,0,0,{"$f":"IF(J291=\"\",\"\",IF(D291=\"\",0,IF(D291=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D291=\"Yes\"),AND($M$1=\"Scaled\",D291>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D291=\"No\"),AND($M$1=\"Scaled\",D291<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1803,"G.19.11","Installation of software on company-owned equipment (workstations, mobile devices) restricted to administrators?",null,null,null,null,"13.1.1","Network Controls",2,null,19,11,0,0,0,0,{"$f":"IF(J292=\"\",\"\",IF(D292=\"\",0,IF(D292=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D292=\"Yes\"),AND($M$1=\"Scaled\",D292>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D292=\"No\"),AND($M$1=\"Scaled\",D292<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1805,"G.19.12","Users permitted to execute mobile code?",null,null,null,null,"12.2.1","Controls Against Malware",2,null,19,12,0,0,0,0,{"$f":"IF(J293=\"\",\"\",IF(D293=\"\",0,IF(D293=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D293=\"Yes\"),AND($M$1=\"Scaled\",D293>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D293=\"No\"),AND($M$1=\"Scaled\",D293<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]

{"sheet":"H. Access Control","index":14,"n_rows":59,"n_cols":30,"rows_kept":59,"cut":false,"hidden":false,"merged":[[2,1,2,8]]}
[11,"H. Access Control",null,null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,"Binary","Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"H"}]
[null,null,null,{"$f":"IF(X2=0,\"0%\",X2/T2)","v":"0%"},"Percent Complete",null,"Tab Automation:","Enable",null,{"$f":"COUNTA(J5:J59)","v":55},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(T5:T59,1)","v":52},null,null,null,{"$f":"COUNTIF(X5:X59,1)","v":0}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column F to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, select the word \"Disable\" in the Tab Automation field at the top of the page.\n     - Use the Maturity column to identify the maturity of the question. See the How To Guide for instructions on filling out this field.",null,null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter","Maturity N/A"]
[{"$f":"MAX(A5:A59)","v":3218},"Ques Num","Question/Request","Response","Maturity","Additional Information","AUP Reference","ISO 27002:2013 Relevance"]
[1998,{"$f":"IF(J5=0,\"\",IF(J5=1,Q$1&\".\"&L5,IF(J5=2,Q$1&\".\"&L5&\".\"&M5,IF(J5=3,Q$1&\".\"&L5&\".\"&M5&\".\"&N5,IF(J5=4,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5,IF(J5=5,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5&\".\"&P5))))))","v":"H.1"},"Are electronic systems used to transmit, process or store Scoped Systems and Data?",null,null,null,null,"NA","",1,null,{"$f":"IF(L4=\"\",1,IF(J5=1,L4+1,L4))","v":1},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($J5=2,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($J5=3,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($J5=4,O4+1,O4)))","v":0},{"$f":"IF(P4=\"\",0,IF(O4<>O5,0,IF($J5=5,P4+1,P4)))","v":0},{"$f":"IF(OR(Master=\"Master\",J5=0,K5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,22,FALSE)),0,VLOOKUP(A5,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D5=\"Yes\"),AND($M$1=\"Scaled\",D5>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D5=\"No\"),AND($M$1=\"Scaled\",D5<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J5=\"\",\"\",IF(Q5>0,Q5,IF(R5>0,R5,0)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(J5=1,T4=\"\"),1,IF(OR(AND(K4=1,(J5-J3<>0)),AND(T4=0,J4=J5),AND(K4=1,J5=J3)),0,1)))","v":1},{"$f":"IF(J5=\"\",U4,IF(AND(S5>1,OR(U4=\"\",U4=0,U4>=J5)),J5,IF(J5>U4,U4,0)))","v":0},{"$f":"IF(Master=\"Master\",R5,IF(V4=\"\",S5,IF(OR(AND(U5>0,S5<V4),AND(U5=1,S5<=V4)),V4,S5)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(T4=1,U5=1),S5>0,AND(T6=0,W6=1)),1,0))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(U5>0,T5=1),AND(T5=1,W5=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(J5=1,S5=1),2,IF(AND(V4=1,L5=L4),2,IF(AND(AC4=2,L5=L4),2,IF(J5=1,1,\"\"))))","v":1},1]
[1903,{"$f":"IF(J6=0,\"\",IF(J6=1,Q$1&\".\"&L6,IF(J6=2,Q$1&\".\"&L6&\".\"&M6,IF(J6=3,Q$1&\".\"&L6&\".\"&M6&\".\"&N6,IF(J6=4,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6,IF(J6=5,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6&\".\"&P6))))))","v":"H.1.1"},"Is there an access control policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?",null,null,null,"H. Access Control","9.1.1","Access control policy",2,null,{"$f":"IF(L5=\"\",1,IF(J6=1,L5+1,L5))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($J6=2,M5+1,M5)))","v":1},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($J6=3,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($J6=4,O5+1,O5)))","v":0},{"$f":"IF(P5=\"\",0,IF(O5<>O6,0,IF($J6=5,P5+1,P5)))","v":0},0,{"$f":"IF(J6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D6=\"Yes\"),AND($M$1=\"Scaled\",D6>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D6=\"No\"),AND($M$1=\"Scaled\",D6<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J6=\"\",\"\",IF(Q6>0,Q6,IF(R6>0,R6,0)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(J6=1,T5=\"\"),1,IF(OR(AND(K5=1,(J6-J4<>0)),AND(T5=0,J5=J6),AND(K5=1,J6=J4)),0,1)))","v":1},{"$f":"IF(J6=\"\",U5,IF(AND(S6>1,OR(U5=\"\",U5=0,U5>=J6)),J6,IF(J6>U5,U5,0)))","v":0},0,{"$f":"IF(J6=\"\",\"\",IF(OR(AND(T5=1,U6=1),S6>0,AND(T7=0,W7=1)),1,0))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(U6>0,T6=1),AND(T6=1,W6=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A6,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(J6=1,S6=1),2,IF(AND(V5=1,L6=L5),2,IF(AND(AC5=2,L6=L5),2,IF(J6=1,1,\"\"))))","v":""}]
[1908,"H.1.2","Does access control on applications, operating systems, databases, and network devices ensure users have least privilege?",null,null,null,null,"9.1.1.b","Access control policy",2,null,1,2,0,0,0,0,{"$f":"IF(J7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D7=\"Yes\"),AND($M$1=\"Scaled\",D7>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D7=\"No\"),AND($M$1=\"Scaled\",D7<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1911,"H.2","Are unique user IDs used for access?",null,null,null,"H.1 Password Controls","9.2.1.a","User registration and de-registration",1,null,2,0,0,0,0,0,{"$f":"IF(J8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D8=\"Yes\"),AND($M$1=\"Scaled\",D8>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D8=\"No\"),AND($M$1=\"Scaled\",D8<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[1913,"H.2.1","Can a user ID contain personal information (SSN, access level, admin of the user)?",null,null,null,null,"9.4.3.c","Password Management System",2,null,2,1,0,0,0,0,{"$f":"IF(J9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D9=\"Yes\"),AND($M$1=\"Scaled\",D9>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D9=\"No\"),AND($M$1=\"Scaled\",D9<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3205,"H.2.2","Is an inactive user ID deleted or disabled within 90 days?",null,null,null,"H.4 Inactive Accounts","9.2.6","Removal or adjustment of access rights",2,null,2,2,0,0,0,0,{"$f":"IF(J10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D10=\"Yes\"),AND($M$1=\"Scaled\",D10>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D10=\"No\"),AND($M$1=\"Scaled\",D10<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1915,"H.2.3","Can a user ID be shared?",null,null,null,null,"9.3.1.e","Use of secret authentication information",2,null,2,3,0,0,0,0,{"$f":"IF(J11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D11=\"Yes\"),AND($M$1=\"Scaled\",D11>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D11=\"No\"),AND($M$1=\"Scaled\",D11<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1916,"H.2.4","Is there a process to grant and approve access to systems transmitting, processing or storing Scoped Systems and Data?",null,null,null,"H.3 Logical Access Authorization","9.1.2.b","Access to networks and network services",2,null,2,4,0,0,0,0,{"$f":"IF(J12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D12=\"Yes\"),AND($M$1=\"Scaled\",D12>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D12=\"No\"),AND($M$1=\"Scaled\",D12<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3206,"H.2.4.1","Does access to electronic systems include a formal request and management approval?",null,null,null,"H.3 Logical Access Authorization","9.1.2.b","Access to networks and network services",3,null,2,4,1,0,0,0,{"$f":"IF(J13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D13=\"Yes\"),AND($M$1=\"Scaled\",D13>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D13=\"No\"),AND($M$1=\"Scaled\",D13<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1922,"H.2.4.2","Are approved requests for granting access logged, archived and maintained?",null,null,null,null,"9.2.5.e","Review of User Access Rights",3,null,2,4,2,0,0,0,{"$f":"IF(J14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D14=\"Yes\"),AND($M$1=\"Scaled\",D14>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D14=\"No\"),AND($M$1=\"Scaled\",D14<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1939,"H.2.5","Is system access limited by:",null,null,null,null,"9.4.1","Information access restriction",2,1,2,5,0,0,0,0,{"$f":"IF(J15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D15=\"Yes\"),AND($M$1=\"Scaled\",D15>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D15=\"No\"),AND($M$1=\"Scaled\",D15<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1940,"H.2.5.1","Time of day?",null,null,null,null,"NA",null,3,null,2,5,1,0,0,0,{"$f":"IF(J16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D16=\"Yes\"),AND($M$1=\"Scaled\",D16>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D16=\"No\"),AND($M$1=\"Scaled\",D16<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[1943,"H.2.5.2","Physical location?",null,null,null,null,"NA","",3,null,2,5,2,0,0,0,{"$f":"IF(J17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D17=\"Yes\"),AND($M$1=\"Scaled\",D17>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D17=\"No\"),AND($M$1=\"Scaled\",D17<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[1945,"H.2.5.3","Network subnet?",null,null,null,null,"NA","",3,null,2,5,3,0,0,0,{"$f":"IF(J18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D18=\"Yes\"),AND($M$1=\"Scaled\",D18>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D18=\"No\"),AND($M$1=\"Scaled\",D18<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[3207,"H.2.6","Are user access rights reviewed at least quarterly?",null,null,null,"H.9 Monitoring of All System Access Rights","9.2.5.a","Review of User Access Rights",2,null,2,6,0,0,0,0,{"$f":"IF(J19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D19=\"Yes\"),AND($M$1=\"Scaled\",D19>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D19=\"No\"),AND($M$1=\"Scaled\",D19<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2654,"H.2.7","Are access rights reviewed when a constituent changes roles?",null,null,null,"H.9 Monitoring of All System Access Rights","9.2.5.b","Review of User Access Rights",2,null,2,7,0,0,0,0,{"$f":"IF(J20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D20=\"Yes\"),AND($M$1=\"Scaled\",D20>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D20=\"No\"),AND($M$1=\"Scaled\",D20<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2655,"H.2.8","Are reviews of privileged systems conducted to ensure unauthorized privileges have not been obtained?",null,null,null,"H.8 Admin, Superuser and Group Accounts","9.2.5.d","Review of User Access Rights",2,null,2,8,0,0,0,0,{"$f":"IF(J21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D21=\"Yes\"),AND($M$1=\"Scaled\",D21>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D21=\"No\"),AND($M$1=\"Scaled\",D21<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3208,"H.2.9","Are privileged user access rights reviewed at least quarterly?",null,null,null,"H.8 Admin, Superuser and Group Accounts","9.2.5.c","Review of User Access Rights",2,null,2,9,0,0,0,0,{"$f":"IF(J22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D22=\"Yes\"),AND($M$1=\"Scaled\",D22>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D22=\"No\"),AND($M$1=\"Scaled\",D22<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2656,"H.2.10","Are changes to privileged user access rights logged?",null,null,null,"H.8 Admin, Superuser and Group Accounts","9.2.5.e","Review of User Access Rights",2,null,2,10,0,0,0,0,{"$f":"IF(J23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D23=\"Yes\"),AND($M$1=\"Scaled\",D23>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D23=\"No\"),AND($M$1=\"Scaled\",D23<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3209,"H.2.11","Are there logon banners for all electronic systems access?",null,null,null,"L.1 Presence of Log-on Banners","9.4.2.b","Secure Log-On Procedures",2,null,2,11,0,0,0,0,{"$f":"IF(J24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D24=\"Yes\"),AND($M$1=\"Scaled\",D24>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D24=\"No\"),AND($M$1=\"Scaled\",D24<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2006,"H.2.12","Upon logon failure, does the error message describe the cause of the failure to the user (Invalid password, invalid user ID, etc.)?",null,null,null,null,"9.4.2.d","Secure Log-On Procedures",2,null,2,12,0,0,0,0,{"$f":"IF(J25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D25=\"Yes\"),AND($M$1=\"Scaled\",D25>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D25=\"No\"),AND($M$1=\"Scaled\",D25<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2007,"H.2.13","Upon successful logon, does a message indicate the last time of successful logon?",null,null,null,null,"9.4.2.h","Secure Log-On Procedures",2,null,2,13,0,0,0,0,{"$f":"IF(J26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D26=\"Yes\"),AND($M$1=\"Scaled\",D26>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D26=\"No\"),AND($M$1=\"Scaled\",D26<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1910,"H.2.14","Is multi-factor authentication deployed for “high-risk” environments?",null,null,null,"H.7 Restrictions and Multifactor Authentication","9.1.2.e","Access to networks and network services",2,null,2,14,0,0,0,0,{"$f":"IF(J27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D27=\"Yes\"),AND($M$1=\"Scaled\",D27>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D27=\"No\"),AND($M$1=\"Scaled\",D27<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1912,"H.2.15","Do all users have a unique user ID when accessing applications?",null,null,null,null,"9.2.1.a","User registration and de-registration",2,null,2,15,0,0,0,0,{"$f":"IF(J28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D28=\"Yes\"),AND($M$1=\"Scaled\",D28>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D28=\"No\"),AND($M$1=\"Scaled\",D28<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2657,"H.2.16","Is the use of system utilities restricted to authorized users only?",null,null,null,null,"9.4.4","Use of privileged utility programs",2,null,2,16,0,0,0,0,{"$f":"IF(J29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D29=\"Yes\"),AND($M$1=\"Scaled\",D29>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D29=\"No\"),AND($M$1=\"Scaled\",D29<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3210,"H.2.17","Do inactive workstation lock within 15 minutes?",null,null,null,"H.5 Controls for Unattended Systems","9.4.2.k","Secure Log-On Procedures",2,null,2,17,0,0,0,0,{"$f":"IF(J30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D30=\"Yes\"),AND($M$1=\"Scaled\",D30>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D30=\"No\"),AND($M$1=\"Scaled\",D30<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3211,"H.2.18","Do inactive sessions timeout within 15 minutes?",null,null,null,"H.5 Controls for Unattended Systems","9.4.2.k","Secure Log-On Procedures",2,null,2,18,0,0,0,0,{"$f":"IF(J31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D31=\"Yes\"),AND($M$1=\"Scaled\",D31>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D31=\"No\"),AND($M$1=\"Scaled\",D31<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1948,"H.3","Are passwords required to access systems transmitting, processing or storing Scoped Systems and Data?",null,null,null,"H.1 Password Controls","9.4.3","Password Management System",1,null,3,0,0,0,0,0,{"$f":"IF(J32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D32=\"Yes\"),AND($M$1=\"Scaled\",D32>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D32=\"No\"),AND($M$1=\"Scaled\",D32<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[1949,"H.3.1","Is there a password policy for systems that transmit, process or store Scoped Systems and Data that has been approved by management and communicated to appropriate constituents? If yes, does it include:",null,null,null,"H. Access Control","9.4.3","Password Management System",2,null,3,1,0,0,0,0,{"$f":"IF(J33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D33=\"Yes\"),AND($M$1=\"Scaled\",D33>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D33=\"No\"),AND($M$1=\"Scaled\",D33<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2661,"H.3.1.1","Keep passwords confidential?",null,null,null,"H. Access Control","9.3.1.a","User responsibilities",3,null,3,1,1,0,0,0,{"$f":"IF(J34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D34=\"Yes\"),AND($M$1=\"Scaled\",D34>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D34=\"No\"),AND($M$1=\"Scaled\",D34<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2662,"H.3.1.2","Not keep a record of passwords (paper, software file or handheld device)?",null,null,null,"H. Access Control","9.3.1.b","User responsibilities",3,null,3,1,2,0,0,0,{"$f":"IF(J35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D35=\"Yes\"),AND($M$1=\"Scaled\",D35>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D35=\"No\"),AND($M$1=\"Scaled\",D35<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1977,"H.3.1.3","Change passwords when there is an indication of possible system or password compromise?",null,null,null,"H. Access Control","9.3.1.c","User responsibilities",3,null,3,1,3,0,0,0,{"$f":"IF(J36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D36=\"Yes\"),AND($M$1=\"Scaled\",D36>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D36=\"No\"),AND($M$1=\"Scaled\",D36<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1978,"H.3.1.4","Change passwords at regular intervals?",null,null,null,"H. Access Control","9.4.3.e","Password Management System",3,null,3,1,4,0,0,{"$f":"IF(OR(Master=\"Master\",J37=0,K37=1),0,IF(ISNA(VLOOKUP(A37,L2_Array,22,FALSE)),0,VLOOKUP(A37,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D37=\"Yes\"),AND($M$1=\"Scaled\",D37>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D37=\"No\"),AND($M$1=\"Scaled\",D37<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,{"$f":"IF(Master=\"Master\",R37,IF(V36=\"\",S37,IF(OR(AND(U37>0,S37<V36),AND(U37=1,S37<=V36)),V36,S37)))","v":0},0,0,0,null,null,null,""]
[2663,"H.3.1.5","Change temporary passwords at first logon?",null,null,null,"H. Access Control","9.4.3.d","Password Management System",3,null,3,1,5,0,0,0,{"$f":"IF(J38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D38=\"Yes\"),AND($M$1=\"Scaled\",D38>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D38=\"No\"),AND($M$1=\"Scaled\",D38<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1979,"H.3.1.6","Not include passwords in automated logon processes? (stored in a macro or function key)?",null,null,null,"H. Access Control","9.3.1.f","User responsibilities",3,null,3,1,6,0,0,0,{"$f":"IF(J39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D39=\"Yes\"),AND($M$1=\"Scaled\",D39>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D39=\"No\"),AND($M$1=\"Scaled\",D39<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1981,"H.3.1.7","Terminate or secure active sessions when finished?",null,null,null,"H. Access Control","11.2.8.a","Unattended User Equipment",3,null,3,1,7,0,0,0,{"$f":"IF(J40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D40=\"Yes\"),AND($M$1=\"Scaled\",D40>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D40=\"No\"),AND($M$1=\"Scaled\",D40<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2664,"H.3.1.8","Logoff terminals, PC or servers when the session is finished?",null,null,null,"H. Access Control","11.2.8.b","Unattended User Equipment",3,null,3,1,8,0,0,0,{"$f":"IF(J41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D41=\"Yes\"),AND($M$1=\"Scaled\",D41>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D41=\"No\"),AND($M$1=\"Scaled\",D41<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1980,"H.3.1.9","Lock (using key lock or equivalent control) when systems are unattended?",null,null,null,"H. Access Control","11.2.8.c","Unattended User Equipment",3,null,3,1,9,0,0,0,{"$f":"IF(J42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D42=\"Yes\"),AND($M$1=\"Scaled\",D42>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D42=\"No\"),AND($M$1=\"Scaled\",D42<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1974,"H.3.1.10","Prohibit users from sharing passwords?",null,null,null,"H. Access Control","9.3.1.g","User responsibilities",3,null,3,1,10,0,0,0,{"$f":"IF(J43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D43=\"Yes\"),AND($M$1=\"Scaled\",D43>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D43=\"No\"),AND($M$1=\"Scaled\",D43<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1975,"H.3.2","Are strong passwords required on systems transmitting, processing storing Scoped Systems and Data?",null,null,null,"H.1 Password Controls","9.3.1.d,                                    9.4.3.c","Use of secret authentication information,                                    Password management system",2,null,3,2,0,0,0,0,{"$f":"IF(J44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D44=\"Yes\"),AND($M$1=\"Scaled\",D44>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D44=\"No\"),AND($M$1=\"Scaled\",D44<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2008,"H.3.3","Are password files and application system data stored in different file systems?",null,null,null,"H.1 Password Controls","9.4.3.h","Password Management System",2,null,3,3,0,0,0,0,{"$f":"IF(J45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D45=\"Yes\"),AND($M$1=\"Scaled\",D45>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D45=\"No\"),AND($M$1=\"Scaled\",D45<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3212,"H.3.4","Are user ID and passwords communicated/distributed via separate media (e-mail and phone)?",null,null,null,"H.1 Password Controls","9.2.4.d ","Management of secret authentication information for users",2,null,3,4,0,0,0,0,{"$f":"IF(J46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D46=\"Yes\"),AND($M$1=\"Scaled\",D46>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D46=\"No\"),AND($M$1=\"Scaled\",D46<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1964,"H.3.5","Are new constituents issued random initial single use passwords?",null,null,null,"H.1 Password Controls","9.4.3.b","Password Management System",2,null,3,5,0,0,0,0,{"$f":"IF(J47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D47=\"Yes\"),AND($M$1=\"Scaled\",D47>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D47=\"No\"),AND($M$1=\"Scaled\",D47<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3213,"H.3.6","Do temporary passwords expire within 10 days?",null,null,null,"H.1 Password Controls","NA",null,2,null,3,6,0,0,0,0,{"$f":"IF(J48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D48=\"Yes\"),AND($M$1=\"Scaled\",D48>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D48=\"No\"),AND($M$1=\"Scaled\",D48<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3214,"H.3.7","Is a user’s identity verified prior to resetting a password?",null,null,null,"H.1 Password Controls","9.2.4.c","Management of secret authentication information for users",2,null,3,7,0,0,0,0,{"$f":"IF(J49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D49=\"Yes\"),AND($M$1=\"Scaled\",D49>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D49=\"No\"),AND($M$1=\"Scaled\",D49<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2659,"H.3.8","Are vendor default passwords removed, disabled or changed prior to placing the device or system into production?",null,null,null,"H.1 Password Controls","9.2.4.g","Management of secret authentication information for users",2,null,3,8,0,0,0,0,{"$f":"IF(J50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D50=\"Yes\"),AND($M$1=\"Scaled\",D50>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D50=\"No\"),AND($M$1=\"Scaled\",D50<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2971,"H.3.9","Is password reset authority restricted to authorized persons and/or an automated password reset tool?",null,null,null,"H.1 Password Controls","9.3.1.f","User responsibilities",2,null,3,9,0,0,0,0,{"$f":"IF(J51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D51=\"Yes\"),AND($M$1=\"Scaled\",D51>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D51=\"No\"),AND($M$1=\"Scaled\",D51<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2028,"H.4","Is remote access permitted?",null,null,null,null,6.2,"Mobile devices and teleworking",1,null,4,0,0,0,0,0,{"$f":"IF(J52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D52=\"Yes\"),AND($M$1=\"Scaled\",D52>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D52=\"No\"),AND($M$1=\"Scaled\",D52<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1,1]
[3215,"H.4.1","Is there a remote access policy for systems transmitting, processing and storing Scoped Systems and Data that has been approved by management and communicated to appropriate constituents?",null,null,null,null,"6.2.1                                        6.2.2","Mobile device policy,                  Teleworking",2,null,4,1,0,0,0,0,{"$f":"IF(J53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D53=\"Yes\"),AND($M$1=\"Scaled\",D53>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D53=\"No\"),AND($M$1=\"Scaled\",D53<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2972,"H.4.2","Is split tunneling or bridged internet connections allowed by policy and/or technical control?",null,null,null,null,"NA","",2,null,4,2,0,0,0,0,{"$f":"IF(J54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D54=\"Yes\"),AND($M$1=\"Scaled\",D54>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D54=\"No\"),AND($M$1=\"Scaled\",D54<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3216,"H.4.3","Is only company owned equipment permitted to connect remotely?",null,null,null,null,"6.2.1                                        6.2.2 ","Mobile device policy,                  Teleworking",2,null,4,3,0,0,0,0,{"$f":"IF(J55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D55=\"Yes\"),AND($M$1=\"Scaled\",D55>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D55=\"No\"),AND($M$1=\"Scaled\",D55<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3217,"H.4.4","Is remote desktop technology (Citrix) used to access the network remotely?",null,null,null,null,"6.2.2.d","Teleworking",2,null,4,4,0,0,0,0,{"$f":"IF(J56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D56=\"Yes\"),AND($M$1=\"Scaled\",D56>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D56=\"No\"),AND($M$1=\"Scaled\",D56<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3218,"H.4.5","Are remote users prevented from copying data to remote devices?",null,null,null,null,"6.2.2.d","Teleworking",2,null,4,5,0,0,0,0,{"$f":"IF(J57=\"\",\"\",IF(D57=\"\",0,IF(D57=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D57=\"Yes\"),AND($M$1=\"Scaled\",D57>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D57=\"No\"),AND($M$1=\"Scaled\",D57<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2964,"H.4.6","Are encrypted communications required for all remote connections?",null,null,null,null,"10.1.1.c","Policy on the use of cryptographic controls",2,null,4,6,0,0,0,0,{"$f":"IF(J58=\"\",\"\",IF(D58=\"\",0,IF(D58=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D58=\"Yes\"),AND($M$1=\"Scaled\",D58>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D58=\"No\"),AND($M$1=\"Scaled\",D58<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2048,"H.4.7","Is multi-factor authentication required for remote access?",null,null,null,"H.7 Restrictions and Multifactor Authentication","9.1.2.d","Access to networks and network services",2,null,4,7,0,0,0,0,{"$f":"IF(J59=\"\",\"\",IF(D59=\"\",0,IF(D59=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D59=\"Yes\"),AND($M$1=\"Scaled\",D59>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D59=\"No\"),AND($M$1=\"Scaled\",D59<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]

{"sheet":"I. Info Sys AD&M","index":15,"n_rows":99,"n_cols":30,"rows_kept":99,"cut":false,"hidden":false,"merged":[[2,1,2,8]]}
[11,"I. Information Systems Acquisition Development & Maintenance",null,null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,"Binary","Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"I"}]
[null,null,null,{"$f":"IF(X2=0,\"0%\",X2/T2)","v":"0%"},"Percent Complete",null,"Tab Automation:","Enable",null,{"$f":"COUNTA(J5:J99)","v":95},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(T5:T99,1)","v":95},null,null,null,{"$f":"COUNTIF(X5:X99,1)","v":0}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column F to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, select the word \"Disable\" in the Tab Automation field at the top of the page.\n     - Use the Maturity column to identify the maturity of the question. See the How To Guide for instructions on filling out this field.",null,null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter","Maturity N/A"]
[{"$f":"MAX(A5:A99)","v":3219},"Ques Num","Question/Request","Response","Maturity","Additional Information","AUP Reference","ISO 27002:2013 Relevance"]
[2665,{"$f":"IF(J5=0,\"\",IF(J5=1,Q$1&\".\"&L5,IF(J5=2,Q$1&\".\"&L5&\".\"&M5,IF(J5=3,Q$1&\".\"&L5&\".\"&M5&\".\"&N5,IF(J5=4,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5,IF(J5=5,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5&\".\"&P5))))))","v":"I.1"},"Are business information systems used to transmit, process or store Scoped Systems and Data? If yes, are:",null,null,null,null,14.1,"Security requirements of information systems",1,null,{"$f":"IF(L4=\"\",1,IF(J5=1,L4+1,L4))","v":1},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($J5=2,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($J5=3,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($J5=4,O4+1,O4)))","v":0},{"$f":"IF(P4=\"\",0,IF(O4<>O5,0,IF($J5=5,P4+1,P4)))","v":0},{"$f":"IF(OR(Master=\"Master\",J5=0,K5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,22,FALSE)),0,VLOOKUP(A5,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D5=\"Yes\"),AND($M$1=\"Scaled\",D5>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D5=\"No\"),AND($M$1=\"Scaled\",D5<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J5=\"\",\"\",IF(Q5>0,Q5,IF(R5>0,R5,0)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(J5=1,T4=\"\"),1,IF(OR(AND(K4=1,(J5-J3<>0)),AND(T4=0,J4=J5),AND(K4=1,J5=J3)),0,1)))","v":1},{"$f":"IF(J5=\"\",U4,IF(AND(S5>1,OR(U4=\"\",U4=0,U4>=J5)),J5,IF(J5>U4,U4,0)))","v":0},{"$f":"IF(Master=\"Master\",R5,IF(V4=\"\",S5,IF(OR(AND(U5>0,S5<V4),AND(U5=1,S5<=V4)),V4,S5)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(T4=1,U5=1),S5>0,AND(T6=0,W6=1)),1,0))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(U5>0,T5=1),AND(T5=1,W5=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(J5=1,S5=1),2,IF(AND(V4=1,L5=L4),2,IF(AND(AC4=2,L5=L4),2,IF(J5=1,1,\"\"))))","v":1}]
[2666,{"$f":"IF(J6=0,\"\",IF(J6=1,Q$1&\".\"&L6,IF(J6=2,Q$1&\".\"&L6&\".\"&M6,IF(J6=3,Q$1&\".\"&L6&\".\"&M6&\".\"&N6,IF(J6=4,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6,IF(J6=5,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6&\".\"&P6))))))","v":"I.1.1"},"Security requirements documented?",null,null,null,"I.5 Procedure: b.1","14.1.1 ","Information security requirements analysis and specification",2,null,{"$f":"IF(L5=\"\",1,IF(J6=1,L5+1,L5))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($J6=2,M5+1,M5)))","v":1},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($J6=3,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($J6=4,O5+1,O5)))","v":0},{"$f":"IF(P5=\"\",0,IF(O5<>O6,0,IF($J6=5,P5+1,P5)))","v":0},0,{"$f":"IF(J6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D6=\"Yes\"),AND($M$1=\"Scaled\",D6>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D6=\"No\"),AND($M$1=\"Scaled\",D6<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J6=\"\",\"\",IF(Q6>0,Q6,IF(R6>0,R6,0)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(J6=1,T5=\"\"),1,IF(OR(AND(K5=1,(J6-J4<>0)),AND(T5=0,J5=J6),AND(K5=1,J6=J4)),0,1)))","v":1},{"$f":"IF(J6=\"\",U5,IF(AND(S6>1,OR(U5=\"\",U5=0,U5>=J6)),J6,IF(J6>U5,U5,0)))","v":0},0,{"$f":"IF(J6=\"\",\"\",IF(OR(AND(T5=1,U6=1),S6>0,AND(T7=0,W7=1)),1,0))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(U6>0,T6=1),AND(T6=1,W6=1)),1,0))","v":0},0,null,null,null,{"$f":"IF(AND(J6=1,S6=1),2,IF(AND(V5=1,L6=L5),2,IF(AND(AC5=2,L6=L5),2,IF(J6=1,1,\"\"))))","v":""}]
[1795,"I.1.2","Information security reviews conducted and approved for the use or installation of open source software (Linux, Apache, etc.)?",null,null,null,"I.5 Procedure: b.1","14.1.1 ","Information security requirements analysis and specification",2,null,1,2,0,0,0,0,{"$f":"IF(J7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D7=\"Yes\"),AND($M$1=\"Scaled\",D7>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D7=\"No\"),AND($M$1=\"Scaled\",D7<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2058,"I.2","Is application development performed? If yes, does it provide:",null,null,null,null,"14.2.1","Secure development policy",1,null,2,0,0,0,0,0,{"$f":"IF(J8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D8=\"Yes\"),AND($M$1=\"Scaled\",D8>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D8=\"No\"),AND($M$1=\"Scaled\",D8<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[2198,"I.2.1","Independent security evaluation or certification?",null,null,null,null,"NA",null,2,null,2,1,0,0,0,0,{"$f":"IF(J9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D9=\"Yes\"),AND($M$1=\"Scaled\",D9>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D9=\"No\"),AND($M$1=\"Scaled\",D9<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2111,"I.2.2","Formal application methodology (OWASP)?",null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) code reviews","14.2.1 ","Secure development policy",2,null,2,2,0,0,0,0,{"$f":"IF(J10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D10=\"Yes\"),AND($M$1=\"Scaled\",D10>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D10=\"No\"),AND($M$1=\"Scaled\",D10<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2125,"I.2.3","An authenticated and maintained state for every data transaction?",null,null,null,null,"14.1.3.b.1","Protecting application services transactions",2,null,2,3,0,0,0,0,{"$f":"IF(J11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D11=\"Yes\"),AND($M$1=\"Scaled\",D11>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D11=\"No\"),AND($M$1=\"Scaled\",D11<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2126,"I.2.4","A means for secure session management?",null,null,null,null,"14.1.3.d","Protecting application services transactions",2,null,2,4,0,0,0,0,{"$f":"IF(J12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D12=\"Yes\"),AND($M$1=\"Scaled\",D12>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D12=\"No\"),AND($M$1=\"Scaled\",D12<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2129,"I.2.5","Comprehensive secure error handling?",null,null,null,null,"14.2.5 ","Secure system engineering principles",2,null,2,5,0,0,0,0,{"$f":"IF(J13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D13=\"Yes\"),AND($M$1=\"Scaled\",D13>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D13=\"No\"),AND($M$1=\"Scaled\",D13<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1269,"I.2.6","Audit log failures and generate an alert?",null,null,null,null,"12.4.1","Event logging",2,null,2,6,0,0,0,0,{"$f":"IF(J14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D14=\"Yes\"),AND($M$1=\"Scaled\",D14>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D14=\"No\"),AND($M$1=\"Scaled\",D14<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2182,"I.2.7","Development, test, and staging environment separate from the production environment? If so how are they separated:",null,null,null,null,"12.1.4","Separation of development, testing and operational environments",2,null,2,7,0,0,0,0,{"$f":"IF(J15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D15=\"Yes\"),AND($M$1=\"Scaled\",D15>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D15=\"No\"),AND($M$1=\"Scaled\",D15<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[849,"I.2.7.1","Logically?",null,null,null,null,"12.1.4","Separation of development, testing and operational environments",3,null,2,7,1,0,0,0,{"$f":"IF(J16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D16=\"Yes\"),AND($M$1=\"Scaled\",D16>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D16=\"No\"),AND($M$1=\"Scaled\",D16<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[850,"I.2.7.2","Physically?",null,null,null,null,"12.1.4","Separation of development, testing and operational environments",3,null,2,7,2,0,0,0,{"$f":"IF(J17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D17=\"Yes\"),AND($M$1=\"Scaled\",D17>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D17=\"No\"),AND($M$1=\"Scaled\",D17<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[852,"I.2.7.3","No segregation?",null,null,null,null,"12.1.4","Separation of development, testing and operational environments",3,null,2,7,3,0,0,0,{"$f":"IF(J18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D18=\"Yes\"),AND($M$1=\"Scaled\",D18>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D18=\"No\"),AND($M$1=\"Scaled\",D18<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[2059,"I.2.8","Is there a formal Software Development Life Cycle (SDLC) process? If yes, does it include:",null,null,null,"I.7 Application Security SDLC Phases","14.2.1 ","Secure development policy",2,null,2,8,0,0,0,0,{"$f":"IF(J19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D19=\"Yes\"),AND($M$1=\"Scaled\",D19>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D19=\"No\"),AND($M$1=\"Scaled\",D19<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,""]
[2098,"I.2.8.1","Peer code review, integration testing, and acceptance testing?",null,null,null,null,"14.2.2 ","System change control procedures",3,null,2,8,1,0,0,0,{"$f":"IF(J20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D20=\"Yes\"),AND($M$1=\"Scaled\",D20>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D20=\"No\"),AND($M$1=\"Scaled\",D20<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[847,"I.2.8.2","Separate source code repositories for production and non-production?",null,null,null,null,"9.4.5 ","Access control to program source code",3,null,2,8,2,0,0,0,{"$f":"IF(J21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D21=\"Yes\"),AND($M$1=\"Scaled\",D21>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D21=\"No\"),AND($M$1=\"Scaled\",D21<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2668,"I.2.9","Do IT support personnel have access to program source libraries?",null,null,null,null,"9.4.5.c","Access control to program source code",2,null,2,9,0,0,0,0,{"$f":"IF(J22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D22=\"Yes\"),AND($M$1=\"Scaled\",D22>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D22=\"No\"),AND($M$1=\"Scaled\",D22<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2669,"I.2.10","Is all access to program source libraries logged?",null,null,null,null,"9.4.5.f","Access control to program source code",2,null,2,10,0,0,0,0,{"$f":"IF(J23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D23=\"Yes\"),AND($M$1=\"Scaled\",D23>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D23=\"No\"),AND($M$1=\"Scaled\",D23<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2670,"I.2.11","Are change control procedures required for all changes to the production environment?",null,null,null,"G.21 Change Control","9.4.5.g","Access control to program source code",2,null,2,11,0,0,0,0,{"$f":"IF(J24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D24=\"Yes\"),AND($M$1=\"Scaled\",D24>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D24=\"No\"),AND($M$1=\"Scaled\",D24<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2144,"I.2.12","Do applications provide granular and comprehensive logging?",null,null,null,null,"12.4.1","Event logging",2,null,2,12,0,0,0,0,{"$f":"IF(J25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D25=\"Yes\"),AND($M$1=\"Scaled\",D25>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D25=\"No\"),AND($M$1=\"Scaled\",D25<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2070,"I.2.13","Are application sessions set to time out within 15 minutes or less?",null,null,null,"H.5 Controls for Unattended Systems","9.4.2.k","Secure log-on procedures",2,null,2,13,0,0,0,0,{"$f":"IF(J26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D26=\"Yes\"),AND($M$1=\"Scaled\",D26>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D26=\"No\"),AND($M$1=\"Scaled\",D26<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2153,"I.2.14","Is application development third party / outsourced developers onshore?",null,null,null,null,"14.2.7 ","Outsourced development",2,null,2,14,0,0,0,0,{"$f":"IF(J27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D27=\"Yes\"),AND($M$1=\"Scaled\",D27>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D27=\"No\"),AND($M$1=\"Scaled\",D27<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[2154,"I.2.15","Is application development third party / outsourced developers offshore?",null,null,null,null,"14.2.7 ","Outsourced development",2,null,2,15,0,0,0,0,{"$f":"IF(J28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D28=\"Yes\"),AND($M$1=\"Scaled\",D28>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D28=\"No\"),AND($M$1=\"Scaled\",D28<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[2155,"I.2.16","Are there access controls to protect source code and test data?",null,null,null,null,"9.4.5 ","Access control to program source code",2,null,2,16,0,0,0,0,{"$f":"IF(J29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D29=\"Yes\"),AND($M$1=\"Scaled\",D29>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D29=\"No\"),AND($M$1=\"Scaled\",D29<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2160,"I.2.17","Does the version management system provide segregation of code, data and environments?",null,null,null,null,"9.4.5 ","Access control to program source code",2,null,2,17,0,0,0,0,{"$f":"IF(J30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D30=\"Yes\"),AND($M$1=\"Scaled\",D30>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D30=\"No\"),AND($M$1=\"Scaled\",D30<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2164,"I.2.18","Do changes to applications or application code go through a risk assessment including application testing?",null,null,null,null,"14.2.2                                       14.2.4.a","System change control procedures,                                Restrictions on changes to software packages",2,null,2,18,0,0,0,0,{"$f":"IF(J31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D31=\"Yes\"),AND($M$1=\"Scaled\",D31>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D31=\"No\"),AND($M$1=\"Scaled\",D31<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2169,"I.2.19","Is Scoped Systems and Data ever used in the test, development, or QA environments? If yes, is:",null,null,null,null,"14.3.1 ","Protection of test data",2,null,2,19,0,0,0,0,{"$f":"IF(J32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D32=\"Yes\"),AND($M$1=\"Scaled\",D32>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D32=\"No\"),AND($M$1=\"Scaled\",D32<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[2672,"I.2.19.1","Authorization required when production data is copied to the test environment?",null,null,null,"I.7 Application Security SDLC Phases","14.3.1.b","Protection of test data",3,null,2,19,1,0,0,0,{"$f":"IF(J33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D33=\"Yes\"),AND($M$1=\"Scaled\",D33>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D33=\"No\"),AND($M$1=\"Scaled\",D33<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2171,"I.2.19.2","Test data destroyed following the testing phase?",null,null,null,null,"14.3.1.c","Protection of test data",3,null,2,19,2,0,0,0,{"$f":"IF(J34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D34=\"Yes\"),AND($M$1=\"Scaled\",D34>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D34=\"No\"),AND($M$1=\"Scaled\",D34<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2170,"I.2.19.3","Test data masked or obfuscated during the testing phase?",null,null,null,null,"14.3.1","Protection of test data",3,null,2,19,3,0,0,0,{"$f":"IF(J35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D35=\"Yes\"),AND($M$1=\"Scaled\",D35>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D35=\"No\"),AND($M$1=\"Scaled\",D35<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2673,"I.2.19.4","Copying to the test environment logged?",null,null,null,null,"14.3.1.d","Protection of test data",3,null,2,19,4,0,0,0,{"$f":"IF(J36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D36=\"Yes\"),AND($M$1=\"Scaled\",D36>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D36=\"No\"),AND($M$1=\"Scaled\",D36<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2019,"I.2.20","Are developers permitted to:",null,null,null,null,"14.2.1","Secure development policy",2,null,2,20,0,0,0,{"$f":"IF(OR(Master=\"Master\",J37=0,K37=1),0,IF(ISNA(VLOOKUP(A37,L2_Array,22,FALSE)),0,VLOOKUP(A37,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D37=\"Yes\"),AND($M$1=\"Scaled\",D37>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D37=\"No\"),AND($M$1=\"Scaled\",D37<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,{"$f":"IF(Master=\"Master\",R37,IF(V36=\"\",S37,IF(OR(AND(U37>0,S37<V36),AND(U37=1,S37<=V36)),V36,S37)))","v":0},0,0,{"$f":"IF(ISNA(VLOOKUP(A37,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,"",1]
[2020,"I.2.20.1","Access production environments, including read only access?",null,null,null,null,"14.2.1.b","Secure development policy",3,null,2,20,1,0,0,0,{"$f":"IF(J38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D38=\"Yes\"),AND($M$1=\"Scaled\",D38>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D38=\"No\"),AND($M$1=\"Scaled\",D38<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1909,"I.2.20.2","Access systems and applications based on established profiles that define responsibilities or job functions?",null,null,null,null,"9.1.1","Access Control Policy",3,null,2,20,2,0,0,0,{"$f":"IF(J39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D39=\"Yes\"),AND($M$1=\"Scaled\",D39>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D39=\"No\"),AND($M$1=\"Scaled\",D39<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2027,"I.2.20.3","Request or obtain access outside an established role (emergency access)?",null,null,null,null,"9.2.3.b","Management of privileged access rights",3,null,2,20,3,0,0,0,{"$f":"IF(J40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D40=\"Yes\"),AND($M$1=\"Scaled\",D40>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D40=\"No\"),AND($M$1=\"Scaled\",D40<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2970,"I.2.21","Are system, vendor, or service accounts disallowed for normal operations and monitored for usage?",null,null,null,null,"NA",null,2,null,2,21,0,0,0,0,{"$f":"IF(J41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D41=\"Yes\"),AND($M$1=\"Scaled\",D41>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D41=\"No\"),AND($M$1=\"Scaled\",D41<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2674,"I.2.22","Are access control procedures the same for both the test and production environment?",null,null,null,"H.5 Controls for Unattended Systems","14.3.1.a","Protection of test data",2,null,2,22,0,0,0,0,{"$f":"IF(J42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D42=\"Yes\"),AND($M$1=\"Scaled\",D42>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D42=\"No\"),AND($M$1=\"Scaled\",D42<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2172,"I.2.23","Prior to implementation, do applications go through a risk assessment and approval by security?",null,null,null,"I.7 Application Security SDLC Phases\nI.8 Security Review of Internal and External Applications","14.2.2                                       14.2.4.a","System change control procedures,                                Restrictions on changes to software packages",2,null,2,23,0,0,0,0,{"$f":"IF(J43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D43=\"Yes\"),AND($M$1=\"Scaled\",D43>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D43=\"No\"),AND($M$1=\"Scaled\",D43<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2177,"I.2.24","Is Internet facing software and infrastructure tested prior to implementation? If yes, does the testing include:",null,null,null,"I.6 Application Security Vulnerability Assessment and Remediation","14.1.1","Information security requirements analysis and specification",2,null,2,24,0,0,0,0,{"$f":"IF(J44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D44=\"Yes\"),AND($M$1=\"Scaled\",D44>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D44=\"No\"),AND($M$1=\"Scaled\",D44<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2179,"I.2.24.1","Issue tracking and resolution?",null,null,null,null,"14.1.1","Information security requirements analysis and specification",3,null,2,24,1,0,0,0,{"$f":"IF(J45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D45=\"Yes\"),AND($M$1=\"Scaled\",D45>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D45=\"No\"),AND($M$1=\"Scaled\",D45<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2180,"I.2.24.2","Metrics on software defects and release incidents?",null,null,null,null,"14.1.1","Information security requirements analysis and specification",3,null,2,24,2,0,0,0,{"$f":"IF(J46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D46=\"Yes\"),AND($M$1=\"Scaled\",D46>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D46=\"No\"),AND($M$1=\"Scaled\",D46<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2204,"I.2.25","Is there a documented change management / change control process? If yes, does it include:",null,null,null,"G.21 Change Control","14.2.2 ","System change control procedures",2,null,2,25,0,0,0,0,{"$f":"IF(J47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D47=\"Yes\"),AND($M$1=\"Scaled\",D47>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D47=\"No\"),AND($M$1=\"Scaled\",D47<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2206,"I.2.25.1","Testing prior to deployment?",null,null,null,"I.7 Application Security SDLC Phases","12.5.1.c ","Installation of software on operational systems",3,null,2,25,1,0,0,0,{"$f":"IF(J48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D48=\"Yes\"),AND($M$1=\"Scaled\",D48>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D48=\"No\"),AND($M$1=\"Scaled\",D48<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2207,"I.2.25.2","Management approval prior to deployment?",null,null,null,"I.8 Security Review of Internal and External Applications","12.5.1.a                                    14.2.2.f ","Installation of software on operational systems                              System change control procedures",3,null,2,25,2,0,0,0,{"$f":"IF(J49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D49=\"Yes\"),AND($M$1=\"Scaled\",D49>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D49=\"No\"),AND($M$1=\"Scaled\",D49<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2208,"I.2.25.3","Establishment of restart points?",null,null,null,null,"12.5.1.e","Control Of Operational Software",3,null,2,25,3,0,0,0,{"$f":"IF(J50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D50=\"Yes\"),AND($M$1=\"Scaled\",D50>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D50=\"No\"),AND($M$1=\"Scaled\",D50<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2209,"I.2.25.4","Management approval for changes?",null,null,null,null,"14.2.2.f","System change control procedures",3,null,2,25,4,0,0,0,{"$f":"IF(J51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D51=\"Yes\"),AND($M$1=\"Scaled\",D51>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D51=\"No\"),AND($M$1=\"Scaled\",D51<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2675,"I.2.25.5","Requirements for the transfer of software from development to production?",null,null,null,null,"12.1.4.a ","Separation of development, testing and operational environments",3,null,2,25,5,0,0,0,{"$f":"IF(J52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D52=\"Yes\"),AND($M$1=\"Scaled\",D52>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D52=\"No\"),AND($M$1=\"Scaled\",D52<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2210,"I.2.25.6","Review of code changes by information security?",null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) code reviews","12.5.1.c ","Installation of software on operational systems",3,null,2,25,6,0,0,0,{"$f":"IF(J53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D53=\"Yes\"),AND($M$1=\"Scaled\",D53>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D53=\"No\"),AND($M$1=\"Scaled\",D53<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2676,"I.2.25.7","Stakeholder communication and/or approvals?",null,null,null,"G.21 Change Control","14.2.2.f","System change control procedures",3,null,2,25,7,0,0,0,{"$f":"IF(J54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D54=\"Yes\"),AND($M$1=\"Scaled\",D54>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D54=\"No\"),AND($M$1=\"Scaled\",D54<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2677,"I.2.25.8","A list of individuals authorized to approve changes?",null,null,null,"G.21 Change Control","14.2.2.a","System change control procedures",3,null,2,25,8,0,0,0,{"$f":"IF(J55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D55=\"Yes\"),AND($M$1=\"Scaled\",D55>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D55=\"No\"),AND($M$1=\"Scaled\",D55<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2678,"I.2.25.9","An impact assessment to review all affected systems and applications?",null,null,null,"I.6 Application Security Vulnerability Assessment and Remediation\nI.13 Privacy Impact Analysis","14.2.2.e","System change control procedures",3,null,2,25,9,0,0,0,{"$f":"IF(J56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D56=\"Yes\"),AND($M$1=\"Scaled\",D56>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D56=\"No\"),AND($M$1=\"Scaled\",D56<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2679,"I.2.25.10","Documentation for all system changes?",null,null,null,"G.21 Change Control","14.2.2.h","System change control procedures",3,null,2,25,10,0,0,0,{"$f":"IF(J57=\"\",\"\",IF(D57=\"\",0,IF(D57=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D57=\"Yes\"),AND($M$1=\"Scaled\",D57>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D57=\"No\"),AND($M$1=\"Scaled\",D57<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2680,"I.2.25.11","Version control for all software?",null,null,null,null,"14.2.2.i","System change control procedures",3,null,2,25,11,0,0,0,{"$f":"IF(J58=\"\",\"\",IF(D58=\"\",0,IF(D58=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D58=\"Yes\"),AND($M$1=\"Scaled\",D58>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D58=\"No\"),AND($M$1=\"Scaled\",D58<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2681,"I.2.25.12","Logging of all change requests?",null,null,null,"G.21 Change Control","14.2.2.j","System change control procedures",3,null,2,25,12,0,0,0,{"$f":"IF(J59=\"\",\"\",IF(D59=\"\",0,IF(D59=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D59=\"Yes\"),AND($M$1=\"Scaled\",D59>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D59=\"No\"),AND($M$1=\"Scaled\",D59<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2682,"I.2.25.13","Changes only take place during specified and agreed upon times (green zone)?",null,null,null,"G.21 Change Control","14.2.2.l","System change control procedures",3,null,2,25,13,0,0,0,{"$f":"IF(J60=\"\",\"\",IF(D60=\"\",0,IF(D60=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D60=\"Yes\"),AND($M$1=\"Scaled\",D60>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D60=\"No\"),AND($M$1=\"Scaled\",D60<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2212,"I.2.25.14","Modifications and changes to software are strictly controlled?",null,null,null,"G.21 Change Control","14.2.2.e","System change control procedures",3,null,2,25,14,0,0,0,{"$f":"IF(J61=\"\",\"\",IF(D61=\"\",0,IF(D61=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D61=\"Yes\"),AND($M$1=\"Scaled\",D61>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D61=\"No\"),AND($M$1=\"Scaled\",D61<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2683,"I.2.26","Are audit logs maintained and reviewed for all program library updates?",null,null,null,null,"12.5.1.f ","Installation of software on operational systems",2,null,2,26,0,0,0,0,{"$f":"IF(J62=\"\",\"\",IF(D62=\"\",0,IF(D62=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D62=\"Yes\"),AND($M$1=\"Scaled\",D62>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D62=\"No\"),AND($M$1=\"Scaled\",D62<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2684,"I.2.27","Are compilers, editors or other development tools present in the production environment?",null,null,null,null,"12.1.4.e","Separation of development, testing and operational environments",2,null,2,27,0,0,0,0,{"$f":"IF(J63=\"\",\"\",IF(D63=\"\",0,IF(D63=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D63=\"Yes\"),AND($M$1=\"Scaled\",D63>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D63=\"No\"),AND($M$1=\"Scaled\",D63<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2872,"I.3","Are criteria for accepting new information systems, upgrades, and new versions established? If yes, do they include:",null,null,null,null,"12.1.3                                      14.2.9","Capacity management, System acceptance",1,null,3,0,0,0,0,0,{"$f":"IF(J64=\"\",\"\",IF(D64=\"\",0,IF(D64=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D64=\"Yes\"),AND($M$1=\"Scaled\",D64>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D64=\"No\"),AND($M$1=\"Scaled\",D64<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,1]
[2874,"I.3.1","Performance and computer capacity requirements?",null,null,null,null,"12.1.3","Capacity management",2,null,3,1,0,0,0,0,{"$f":"IF(J65=\"\",\"\",IF(D65=\"\",0,IF(D65=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D65=\"Yes\"),AND($M$1=\"Scaled\",D65>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D65=\"No\"),AND($M$1=\"Scaled\",D65<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2875,"I.3.2","Error recovery and restart procedures?",null,null,null,null,"12.1.1.h","Documented operating procedures",2,null,3,2,0,0,0,0,{"$f":"IF(J66=\"\",\"\",IF(D66=\"\",0,IF(D66=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D66=\"Yes\"),AND($M$1=\"Scaled\",D66>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D66=\"No\"),AND($M$1=\"Scaled\",D66<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2876,"I.3.3","Preparation and testing of operating procedures?",null,null,null,null,"14.2.2","System change control procedures",2,null,3,3,0,0,0,0,{"$f":"IF(J67=\"\",\"\",IF(D67=\"\",0,IF(D67=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D67=\"Yes\"),AND($M$1=\"Scaled\",D67>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D67=\"No\"),AND($M$1=\"Scaled\",D67<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2877,"I.3.4","Agreed set of security controls?",null,null,null,null,"14.2.9","System acceptance testing",2,null,3,4,0,0,0,0,{"$f":"IF(J68=\"\",\"\",IF(D68=\"\",0,IF(D68=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D68=\"Yes\"),AND($M$1=\"Scaled\",D68>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D68=\"No\"),AND($M$1=\"Scaled\",D68<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2878,"I.3.5","Effective manual procedures?",null,null,null,null,"NA",null,2,null,3,5,0,0,0,{"$f":"IF(OR(Master=\"Master\",J69=0,K69=1),0,IF(ISNA(VLOOKUP(A69,L2_Array,22,FALSE)),0,VLOOKUP(A69,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J69=\"\",\"\",IF(D69=\"\",0,IF(D69=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D69=\"Yes\"),AND($M$1=\"Scaled\",D69>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D69=\"No\"),AND($M$1=\"Scaled\",D69<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,{"$f":"IF(Master=\"Master\",R69,IF(V68=\"\",S69,IF(OR(AND(U69>0,S69<V68),AND(U69=1,S69<=V68)),V68,S69)))","v":0},0,0,{"$f":"IF(ISNA(VLOOKUP(A69,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,""]
[2879,{"$f":"IF(J70=0,\"\",IF(J70=1,Q$1&\".\"&L70,IF(J70=2,Q$1&\".\"&L70&\".\"&M70,IF(J70=3,Q$1&\".\"&L70&\".\"&M70&\".\"&N70,IF(J70=4,Q$1&\".\"&L70&\".\"&M70&\".\"&N70&\".\"&O70,IF(J70=5,Q$1&\".\"&L70&\".\"&M70&\".\"&N70&\".\"&O70&\".\"&P70))))))","v":"I.3.6"},"Business continuity arrangements?",null,null,null,null,"14.2.3.c","Technical review of applications after operating platform changes",2,null,{"$f":"IF(L69=\"\",1,IF(J70=1,L69+1,L69))","v":3},{"$f":"IF(M69=\"\",0,IF(L69<>L70,0,IF($J70=2,M69+1,M69)))","v":6},{"$f":"IF(N69=\"\",0,IF(M69<>M70,0,IF($J70=3,N69+1,N69)))","v":0},{"$f":"IF(O69=\"\",0,IF(N69<>N70,0,IF($J70=4,O69+1,O69)))","v":0},{"$f":"IF(P69=\"\",0,IF(O69<>O70,0,IF($J70=5,P69+1,P69)))","v":0},0,{"$f":"IF(J70=\"\",\"\",IF(D70=\"\",0,IF(D70=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D70=\"Yes\"),AND($M$1=\"Scaled\",D70>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D70=\"No\"),AND($M$1=\"Scaled\",D70<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J70=\"\",\"\",IF(Q70>0,Q70,IF(R70>0,R70,0)))","v":0},{"$f":"IF(J70=\"\",\"\",IF(OR(J70=1,T69=\"\"),1,IF(OR(AND(K69=1,(J70-J68<>0)),AND(T69=0,J69=J70),AND(K69=1,J70=J68)),0,1)))","v":1},{"$f":"IF(J70=\"\",U69,IF(AND(S70>1,OR(U69=\"\",U69=0,U69>=J70)),J70,IF(J70>U69,U69,0)))","v":0},0,{"$f":"IF(J70=\"\",\"\",IF(OR(AND(T69=1,U70=1),S70>0,AND(T71=0,W71=1)),1,0))","v":0},{"$f":"IF(J70=\"\",\"\",IF(OR(AND(U70>0,T70=1),AND(T70=1,W70=1)),1,0))","v":0},0,null,null,null,{"$f":"IF(AND(J70=1,S70=1),2,IF(AND(V69=1,L70=L69),2,IF(AND(AC69=2,L70=L69),2,IF(J70=1,1,\"\"))))","v":""}]
[2880,"I.3.7","Evidence that new system will not adversely affect existing systems, particularly at peak processing times, such as month end?",null,null,null,null,"14.2.3.a","Technical review of applications after operating platform changes",2,null,3,7,0,0,0,0,{"$f":"IF(J71=\"\",\"\",IF(D71=\"\",0,IF(D71=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D71=\"Yes\"),AND($M$1=\"Scaled\",D71>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D71=\"No\"),AND($M$1=\"Scaled\",D71<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2881,"I.3.8","Evidence of the effect on the overall security of the respondent?",null,null,null,null,"14.2.2.c","System change control procedures",2,null,3,8,0,0,0,0,{"$f":"IF(J72=\"\",\"\",IF(D72=\"\",0,IF(D72=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D72=\"Yes\"),AND($M$1=\"Scaled\",D72>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D72=\"No\"),AND($M$1=\"Scaled\",D72<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2595,"I.4","Are system resources reviewed to ensure adequate capacity is maintained?",null,null,null,null,"12.1.3","Capacity Management",1,null,4,0,0,0,0,0,{"$f":"IF(J73=\"\",\"\",IF(D73=\"\",0,IF(D73=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D73=\"Yes\"),AND($M$1=\"Scaled\",D73>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D73=\"No\"),AND($M$1=\"Scaled\",D73<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,1]
[2213,"I.5","Are systems and applications patched? If yes, does it include:",null,null,null,"I.4 System Patching","12.6.1 ","Management of technical vulnerabilities",1,null,5,0,0,0,0,0,{"$f":"IF(J74=\"\",\"\",IF(D74=\"\",0,IF(D74=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D74=\"Yes\"),AND($M$1=\"Scaled\",D74>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D74=\"No\"),AND($M$1=\"Scaled\",D74<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[2215,"I.5.1","Testing of patches, service packs, and hot fixes prior to installation?",null,null,null,"I.4 System Patching","12.6.1.g","Management of technical vulnerabilities",2,null,5,1,0,0,0,0,{"$f":"IF(J75=\"\",\"\",IF(D75=\"\",0,IF(D75=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D75=\"Yes\"),AND($M$1=\"Scaled\",D75>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D75=\"No\"),AND($M$1=\"Scaled\",D75<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2217,"I.5.2","Evaluation and prioritize vulnerabilities?",null,null,null,"I.6 Application Security Vulnerability Assessment and Remediation","12.6.1.f","Management of technical vulnerabilities",2,null,5,2,0,0,0,0,{"$f":"IF(J76=\"\",\"\",IF(D76=\"\",0,IF(D76=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D76=\"Yes\"),AND($M$1=\"Scaled\",D76>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D76=\"No\"),AND($M$1=\"Scaled\",D76<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2686,"I.5.3","Logging?",null,null,null,null,"12.6.1.h","Management of technical vulnerabilities",2,null,5,3,0,0,0,0,{"$f":"IF(J77=\"\",\"\",IF(D77=\"\",0,IF(D77=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D77=\"Yes\"),AND($M$1=\"Scaled\",D77>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D77=\"No\"),AND($M$1=\"Scaled\",D77<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2687,"I.5.4","Priority patching of high-risk systems first?",null,null,null,"I.4 System Patching","12.6.1.j","Management of technical vulnerabilities",2,null,5,4,0,0,0,0,{"$f":"IF(J78=\"\",\"\",IF(D78=\"\",0,IF(D78=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D78=\"Yes\"),AND($M$1=\"Scaled\",D78>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D78=\"No\"),AND($M$1=\"Scaled\",D78<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2216,"I.5.5","Are third party alert services used to keep up to date with the latest vulnerabilities?",null,null,null,null,"12.6.1.b","Management of technical vulnerabilities",2,null,5,5,0,0,0,0,{"$f":"IF(J79=\"\",\"\",IF(D79=\"\",0,IF(D79=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D79=\"Yes\"),AND($M$1=\"Scaled\",D79>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D79=\"No\"),AND($M$1=\"Scaled\",D79<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2230,"I.6","Is a web site supported, hosted or maintained that has access to Scoped Systems and Data? If yes, is there:",null,null,null,null,"NA",null,1,null,6,0,0,0,0,0,{"$f":"IF(J80=\"\",\"\",IF(D80=\"\",0,IF(D80=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D80=\"Yes\"),AND($M$1=\"Scaled\",D80>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D80=\"No\"),AND($M$1=\"Scaled\",D80<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[2231,"I.6.1","Regular penetration tests executed against web-based applications?",null,null,null,"I.1 Application Vulnerability Assessments/Ethical Hacking","18.2.3 ","Technical compliance review",2,null,6,1,0,0,0,0,{"$f":"IF(J81=\"\",\"\",IF(D81=\"\",0,IF(D81=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D81=\"Yes\"),AND($M$1=\"Scaled\",D81>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D81=\"No\"),AND($M$1=\"Scaled\",D81<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2076,"I.6.2","Physical separation of server components (web, application, database)?",null,null,null,null,"13.1.3 ","Segregation in networks",2,null,6,2,0,0,0,0,{"$f":"IF(J82=\"\",\"\",IF(D82=\"\",0,IF(D82=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D82=\"Yes\"),AND($M$1=\"Scaled\",D82>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D82=\"No\"),AND($M$1=\"Scaled\",D82<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2081,"I.6.3","Web applications configured to follow best practices or security guidelines (OWASP)?",null,null,null,null,"13.1.1","Network Controls",2,null,6,3,0,0,0,0,{"$f":"IF(J83=\"\",\"\",IF(D83=\"\",0,IF(D83=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D83=\"Yes\"),AND($M$1=\"Scaled\",D83>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D83=\"No\"),AND($M$1=\"Scaled\",D83<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2109,"I.6.4","Data input into applications validated for accuracy?",null,null,null,null,"14.2.1","Securing application services on public networks",2,null,6,4,0,0,0,0,{"$f":"IF(J84=\"\",\"\",IF(D84=\"\",0,IF(D84=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D84=\"Yes\"),AND($M$1=\"Scaled\",D84>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D84=\"No\"),AND($M$1=\"Scaled\",D84<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2110,"I.6.5","Validation checks include cross site scripting and SQL injections?",null,null,null,null,"14.2.1","Securing application services on public networks",2,null,6,5,0,0,0,0,{"$f":"IF(J85=\"\",\"\",IF(D85=\"\",0,IF(D85=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D85=\"Yes\"),AND($M$1=\"Scaled\",D85>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D85=\"No\"),AND($M$1=\"Scaled\",D85<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2225,"I.7","Are vulnerability tests (internal/external) performed on all applications at least annually? If yes, are there:",null,null,null,"I.1 Application Vulnerability Assessments/Ethical Hacking","18.2.3","Technical compliance review",1,null,7,0,0,0,0,0,{"$f":"IF(J86=\"\",\"\",IF(D86=\"\",0,IF(D86=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D86=\"Yes\"),AND($M$1=\"Scaled\",D86>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D86=\"No\"),AND($M$1=\"Scaled\",D86<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[2220,"I.7.1","Results tracked, remediated and reported to management?",null,null,null,null,"18.2.2","Compliance With Security Policies And Standards",2,null,7,1,0,0,0,0,{"$f":"IF(J87=\"\",\"\",IF(D87=\"\",0,IF(D87=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D87=\"Yes\"),AND($M$1=\"Scaled\",D87>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D87=\"No\"),AND($M$1=\"Scaled\",D87<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2233,"I.7.2","Processes to manage threat and vulnerability assessment tools and the data they collect?",null,null,null,"I.5 Application Security Program Governance","12.6.1","Management of technical vulnerabilities",2,null,7,2,0,0,0,0,{"$f":"IF(J88=\"\",\"\",IF(D88=\"\",0,IF(D88=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D88=\"Yes\"),AND($M$1=\"Scaled\",D88>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D88=\"No\"),AND($M$1=\"Scaled\",D88<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1806,"I.8","Are encryption tools managed and maintained for Scoped Data? If yes, is there:",null,null,null,"G.22 Data Security Policy - Encryption",10.1,"Cryptographic controls",1,null,8,0,0,0,0,0,{"$f":"IF(J89=\"\",\"\",IF(D89=\"\",0,IF(D89=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D89=\"Yes\"),AND($M$1=\"Scaled\",D89>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D89=\"No\"),AND($M$1=\"Scaled\",D89<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[1807,"I.8.1","An encryption policy?",null,null,null,"G.22 Data Security Policy - Encryption","10.1.1","Policy On The Use Of Cryptographic Controls",2,null,8,1,0,0,0,0,{"$f":"IF(J90=\"\",\"\",IF(D90=\"\",0,IF(D90=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D90=\"Yes\"),AND($M$1=\"Scaled\",D90>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D90=\"No\"),AND($M$1=\"Scaled\",D90<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1813,"I.8.2","Encryption in storage / at rest?",null,null,null,"G.22 Data Security Policy - Encryption","10.1.1 Section 2.a","Policy On The Use Of Cryptographic Controls",2,null,8,2,0,0,0,0,{"$f":"IF(J91=\"\",\"\",IF(D91=\"\",0,IF(D91=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D91=\"Yes\"),AND($M$1=\"Scaled\",D91>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D91=\"No\"),AND($M$1=\"Scaled\",D91<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3219,"I.8.3","Clear text data ever visible by anyone, including system administrators?",null,null,null,null,"NA",null,2,null,8,3,0,0,0,0,{"$f":"IF(J92=\"\",\"\",IF(D92=\"\",0,IF(D92=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D92=\"Yes\"),AND($M$1=\"Scaled\",D92>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D92=\"No\"),AND($M$1=\"Scaled\",D92<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1814,"I.8.4","Centralized key management system?",null,null,null,"G.22 Data Security Policy - Encryption","10.1.2","Key Management",2,null,8,4,0,0,0,0,{"$f":"IF(J93=\"\",\"\",IF(D93=\"\",0,IF(D93=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D93=\"Yes\"),AND($M$1=\"Scaled\",D93>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D93=\"No\"),AND($M$1=\"Scaled\",D93<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1815,"I.8.5","Encryption keys encrypted at rest and when transmitted?",null,null,null,"G.22 Data Security Policy - Encryption","10.1.2","Key Management",2,null,8,5,0,0,0,0,{"$f":"IF(J94=\"\",\"\",IF(D94=\"\",0,IF(D94=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D94=\"Yes\"),AND($M$1=\"Scaled\",D94>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D94=\"No\"),AND($M$1=\"Scaled\",D94<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1902,"I.8.6","Segregation of duties between key management duties and normal operational duties?",null,null,null,null,"6.1.2","Segregation Of Duties",2,null,8,6,0,0,0,0,{"$f":"IF(J95=\"\",\"\",IF(D95=\"\",0,IF(D95=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D95=\"Yes\"),AND($M$1=\"Scaled\",D95>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D95=\"No\"),AND($M$1=\"Scaled\",D95<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1865,"I.8.7","Key/certificate sharing between production and non-production?",null,null,null,null,"12.1.4.g","Separation Of Development, Test, And Operational Facilities",2,null,8,7,0,0,0,0,{"$f":"IF(J96=\"\",\"\",IF(D96=\"\",0,IF(D96=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D96=\"Yes\"),AND($M$1=\"Scaled\",D96>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D96=\"No\"),AND($M$1=\"Scaled\",D96<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1866,"I.8.8","Default certificates provided by vendors replaced with proprietary certificates?",null,null,null,null,"10.1.2.e","Key Management",2,null,8,8,0,0,0,0,{"$f":"IF(J97=\"\",\"\",IF(D97=\"\",0,IF(D97=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D97=\"Yes\"),AND($M$1=\"Scaled\",D97>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D97=\"No\"),AND($M$1=\"Scaled\",D97<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1859,"I.8.9","Segregation of access to both parts of an asymmetric key?",null,null,null,null,"10.1.2.d","Key Management",2,null,8,9,0,0,0,0,{"$f":"IF(J98=\"\",\"\",IF(D98=\"\",0,IF(D98=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D98=\"Yes\"),AND($M$1=\"Scaled\",D98>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D98=\"No\"),AND($M$1=\"Scaled\",D98<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[1860,"I.8.10","Asymmetric encryption key length a minimum of 2048 bit?",null,null,null,null,"NA",null,2,null,8,10,0,0,0,0,{"$f":"IF(J99=\"\",\"\",IF(D99=\"\",0,IF(D99=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D99=\"Yes\"),AND($M$1=\"Scaled\",D99>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D99=\"No\"),AND($M$1=\"Scaled\",D99<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]

{"sheet":"J. Incident Event & Comm Mgmt","index":16,"n_rows":45,"n_cols":30,"rows_kept":45,"cut":false,"hidden":false,"merged":[[2,1,2,8]]}
[11,"J. Incident Event and Communications Management",null,null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,"Binary","Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"J"}]
[null,null,null,{"$f":"IF(X2=0,\"0%\",X2/T2)","v":"0%"},"Percent Complete",null,"Tab Automation:","Enable",null,{"$f":"COUNTA(J5:J45)","v":41},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(T5:T45,1)","v":32},null,null,null,{"$f":"COUNTIF(X5:X45,1)","v":0}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column F to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, select the word \"Disable\" in the Tab Automation field at the top of the page.\n     - Use the Maturity column to identify the maturity of the question. See the How To Guide for instructions on filling out this field.",null,null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter","Maturity N/A"]
[{"$f":"MAX(A5:A45)","v":3046},"Ques Num","Question/Request","Response","Maturity","Additional Information","AUP Reference","ISO 27002:2013 Relevance"]
[2241,{"$f":"IF(J5=0,\"\",IF(J5=1,Q$1&\".\"&L5,IF(J5=2,Q$1&\".\"&L5&\".\"&M5,IF(J5=3,Q$1&\".\"&L5&\".\"&M5&\".\"&N5,IF(J5=4,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5,IF(J5=5,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5&\".\"&P5))))))","v":"J.1"},"Is there an Incident Management program?",null,null,null,null,16," Information security incident management",1,null,{"$f":"IF(L4=\"\",1,IF(J5=1,L4+1,L4))","v":1},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($J5=2,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($J5=3,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($J5=4,O4+1,O4)))","v":0},{"$f":"IF(P4=\"\",0,IF(O4<>O5,0,IF($J5=5,P4+1,P4)))","v":0},{"$f":"IF(OR(Master=\"Master\",J5=0,K5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,22,FALSE)),0,VLOOKUP(A5,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D5=\"Yes\"),AND($M$1=\"Scaled\",D5>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D5=\"No\"),AND($M$1=\"Scaled\",D5<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J5=\"\",\"\",IF(Q5>0,Q5,IF(R5>0,R5,0)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(J5=1,T4=\"\"),1,IF(OR(AND(K4=1,(J5-J3<>0)),AND(T4=0,J4=J5),AND(K4=1,J5=J3)),0,1)))","v":1},{"$f":"IF(J5=\"\",U4,IF(AND(S5>1,OR(U4=\"\",U4=0,U4>=J5)),J5,IF(J5>U4,U4,0)))","v":0},{"$f":"IF(Master=\"Master\",R5,IF(V4=\"\",S5,IF(OR(AND(U5>0,S5<V4),AND(U5=1,S5<=V4)),V4,S5)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(T4=1,U5=1),S5>0,AND(T6=0,W6=1)),1,0))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(U5>0,T5=1),AND(T5=1,W5=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(J5=1,S5=1),2,IF(AND(V4=1,L5=L4),2,IF(AND(AC4=2,L5=L4),2,IF(J5=1,1,\"\"))))","v":1}]
[2698,{"$f":"IF(J6=0,\"\",IF(J6=1,Q$1&\".\"&L6,IF(J6=2,Q$1&\".\"&L6&\".\"&M6,IF(J6=3,Q$1&\".\"&L6&\".\"&M6&\".\"&N6,IF(J6=4,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6,IF(J6=5,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6&\".\"&P6))))))","v":"J.1.1"},"Is there a documented policy for incident management that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?",null,null,null,"J.1 Information Security / Information Technology Incident Management - Policy and Procedures Content","16.1.1 ","Responsibilities and procedures",2,null,{"$f":"IF(L5=\"\",1,IF(J6=1,L5+1,L5))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($J6=2,M5+1,M5)))","v":1},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($J6=3,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($J6=4,O5+1,O5)))","v":0},{"$f":"IF(P5=\"\",0,IF(O5<>O6,0,IF($J6=5,P5+1,P5)))","v":0},0,{"$f":"IF(J6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D6=\"Yes\"),AND($M$1=\"Scaled\",D6>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D6=\"No\"),AND($M$1=\"Scaled\",D6<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J6=\"\",\"\",IF(Q6>0,Q6,IF(R6>0,R6,0)))","v":0},1,{"$f":"IF(J6=\"\",U5,IF(AND(S6>1,OR(U5=\"\",U5=0,U5>=J6)),J6,IF(J6>U5,U5,0)))","v":0},{"$f":"IF(Master=\"Master\",R6,IF(V5=\"\",S6,IF(OR(AND(U6>0,S6<V5),AND(U6=1,S6<=V5)),V5,S6)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(T5=1,U6=1),S6>0,AND(T7=0,W7=1)),1,0))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(U6>0,T6=1),AND(T6=1,W6=1)),1,0))","v":0},0,null,null,null,{"$f":"IF(AND(J6=1,S6=1),2,IF(AND(V5=1,L6=L5),2,IF(AND(AC5=2,L6=L5),2,IF(J6=1,1,\"\"))))","v":""}]
[2246,"J.1.2","Is there a formal Incident Response Plan. If yes, does it include:",null,null,null,"J. Incident Event and Communications Management","16.1.1.a.1","Responsibilities and procedures",2,null,1,2,0,0,0,0,{"$f":"IF(J7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D7=\"Yes\"),AND($M$1=\"Scaled\",D7>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D7=\"No\"),AND($M$1=\"Scaled\",D7<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2274,"J.1.2.1","Reporting procedure for an information security event?",null,null,null,"J.3 Incident Response Communication","16.1.1.a.2","Responsibilities and procedures",3,null,1,2,1,0,0,0,{"$f":"IF(J8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D8=\"Yes\"),AND($M$1=\"Scaled\",D8>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D8=\"No\"),AND($M$1=\"Scaled\",D8<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2699,"J.1.2.2","Escalation procedure?",null,null,null,"J.1 Procedure: b.6","16.1.1.a.6","Responsibilities and procedures",3,null,1,2,2,0,0,0,{"$f":"IF(J9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D9=\"Yes\"),AND($M$1=\"Scaled\",D9>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D9=\"No\"),AND($M$1=\"Scaled\",D9<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2276,"J.1.2.3","An Incident / Event Response team with defined roles and response related qualifications available 24x7x365?",null,null,null,"J.1 Procedure: b.2","16.1.5 ","Response to information security incidents",3,null,1,2,3,0,0,0,{"$f":"IF(J10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D10=\"Yes\"),AND($M$1=\"Scaled\",D10>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D10=\"No\"),AND($M$1=\"Scaled\",D10<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2280,"J.1.2.4","Procedures to collect and maintain a chain of custody for evidence during incident investigation?",null,null,null,"J.7 Information Security / Information Technology Incident Management - Incident Documentation","16.1.7","Collection of Evidence",3,null,1,2,4,0,0,0,{"$f":"IF(J11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D11=\"Yes\"),AND($M$1=\"Scaled\",D11>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D11=\"No\"),AND($M$1=\"Scaled\",D11<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2702,"J.1.2.5","Feedback process to ensure those reporting information security events are notified of the results after the issue has been dealt with and closed?",null,null,null,"J.3 Incident Response Communication","16.1.1.c.4","Responsibilities and procedures",3,null,1,2,5,0,0,0,{"$f":"IF(J12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D12=\"Yes\"),AND($M$1=\"Scaled\",D12>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D12=\"No\"),AND($M$1=\"Scaled\",D12<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2703,"J.1.2.6","Event reporting mechanism to support the reporting action, and to list all necessary actions in case of an information security event?",null,null,null,"J.7 Information Security / Information Technology Incident Management - Incident Documentation","16.1.1.a.2","Responsibilities and procedures",3,null,1,2,6,0,0,0,{"$f":"IF(J13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D13=\"Yes\"),AND($M$1=\"Scaled\",D13>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D13=\"No\"),AND($M$1=\"Scaled\",D13<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2704,"J.1.2.7","Actions to be taken in the event of an information security event?",null,null,null,"J.1 procedure b.5","16.1.1.c.1","Responsibilities and procedures",3,null,1,2,7,0,0,0,{"$f":"IF(J14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D14=\"Yes\"),AND($M$1=\"Scaled\",D14>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D14=\"No\"),AND($M$1=\"Scaled\",D14<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2705,"J.1.2.8","Formal disciplinary process for dealing with those who commit a security breach?",null,null,null,null,"16.1.1.c.3","Responsibilities and procedures",3,null,1,2,8,0,0,0,{"$f":"IF(J15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D15=\"Yes\"),AND($M$1=\"Scaled\",D15>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D15=\"No\"),AND($M$1=\"Scaled\",D15<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2273,"J.1.2.9","Process for assessing and executing client and third party notification requirements (legal, regulatory, and contractual)?",null,null,null,"J.3 Incident Response Communication","16.1.1.b.3","Responsibilities and procedures",3,null,1,2,9,0,0,0,{"$f":"IF(J16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D16=\"Yes\"),AND($M$1=\"Scaled\",D16>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D16=\"No\"),AND($M$1=\"Scaled\",D16<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2275,"J.1.2.10","Postmortem to include root cause analysis and remediation plan, provided to leadership?",null,null,null,"J.6  Information Security / Information Technology Incident Management - Analysis\nJ.7 Information Security / Information Technology Incident Management - Incident Documentation","16.1.5 ","Response to information security incidents",3,null,1,2,10,0,0,0,{"$f":"IF(J17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D17=\"Yes\"),AND($M$1=\"Scaled\",D17>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D17=\"No\"),AND($M$1=\"Scaled\",D17<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2249,"J.1.2.11","Is there an identification of incident process? If yes, does it include:",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.1.a.5","Responsibilities and procedures",3,null,1,2,11,0,0,0,{"$f":"IF(J18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D18=\"Yes\"),AND($M$1=\"Scaled\",D18>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D18=\"No\"),AND($M$1=\"Scaled\",D18<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2266,"J.1.2.11.1","Unauthorized physical access?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.2.e","Reporting information security events",4,null,1,2,11,1,0,0,{"$f":"IF(J19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D19=\"Yes\"),AND($M$1=\"Scaled\",D19>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D19=\"No\"),AND($M$1=\"Scaled\",D19<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2259,"J.1.2.11.2","Information system failure or loss of service?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.2.g","Reporting information security events",4,null,1,2,11,2,0,0,{"$f":"IF(J20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D20=\"Yes\"),AND($M$1=\"Scaled\",D20>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D20=\"No\"),AND($M$1=\"Scaled\",D20<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2264,"J.1.2.11.3","Malware activity (anti-virus, worms, Trojans)?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.2.h","Reporting information security events",4,null,1,2,11,3,0,0,{"$f":"IF(J21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D21=\"Yes\"),AND($M$1=\"Scaled\",D21>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D21=\"No\"),AND($M$1=\"Scaled\",D21<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2260,"J.1.2.11.4","Denial of service?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.2.f","Reporting information security events",4,null,1,2,11,4,0,0,{"$f":"IF(J22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D22=\"Yes\"),AND($M$1=\"Scaled\",D22>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D22=\"No\"),AND($M$1=\"Scaled\",D22<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2707,"J.1.2.11.5","Errors resulting from incomplete or inaccurate business data?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.2.b","Reporting information security events",4,null,1,2,11,5,0,0,{"$f":"IF(J23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D23=\"Yes\"),AND($M$1=\"Scaled\",D23>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D23=\"No\"),AND($M$1=\"Scaled\",D23<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2262,"J.1.2.11.6","Breach or loss of confidentiality?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.2.b","Reporting information security events",4,null,1,2,11,6,0,0,{"$f":"IF(J24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D24=\"Yes\"),AND($M$1=\"Scaled\",D24>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D24=\"No\"),AND($M$1=\"Scaled\",D24<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2261,"J.1.2.11.7","System exploit?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.2.f","Reporting information security events",4,null,1,2,11,7,0,0,{"$f":"IF(J25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D25=\"Yes\"),AND($M$1=\"Scaled\",D25>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D25=\"No\"),AND($M$1=\"Scaled\",D25<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2267,"J.1.2.11.8","Unauthorized logical access or use of system resources?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.2.h","Reporting information security events",4,null,1,2,11,8,0,0,{"$f":"IF(J26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D26=\"Yes\"),AND($M$1=\"Scaled\",D26>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D26=\"No\"),AND($M$1=\"Scaled\",D26<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2251,"J.1.2.11.9","Containment?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","NA",null,4,null,1,2,11,9,0,0,{"$f":"IF(J27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D27=\"Yes\"),AND($M$1=\"Scaled\",D27>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D27=\"No\"),AND($M$1=\"Scaled\",D27<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2256,"J.1.2.11.10","Remediation?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.5.f ","Response to information security incidents",4,null,1,2,11,10,0,0,{"$f":"IF(J28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D28=\"Yes\"),AND($M$1=\"Scaled\",D28>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D28=\"No\"),AND($M$1=\"Scaled\",D28<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2250,"J.1.2.11.11","Notification of stakeholders?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.1.a.6","Responsibilities and procedures",4,null,1,2,11,11,0,0,{"$f":"IF(J29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D29=\"Yes\"),AND($M$1=\"Scaled\",D29>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D29=\"No\"),AND($M$1=\"Scaled\",D29<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2253,"J.1.2.11.12","Tracking?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.1.a.2","Responsibilities and procedures",4,null,1,2,11,12,0,0,{"$f":"IF(J30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D30=\"Yes\"),AND($M$1=\"Scaled\",D30>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D30=\"No\"),AND($M$1=\"Scaled\",D30<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2254,"J.1.2.11.13","Repair?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.5.g","Response to information security incidents",4,null,1,2,11,13,0,0,{"$f":"IF(J31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D31=\"Yes\"),AND($M$1=\"Scaled\",D31>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D31=\"No\"),AND($M$1=\"Scaled\",D31<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2255,"J.1.2.11.14","Recovery?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.1.a.6","Responsibilities and procedures",4,null,1,2,11,14,0,0,{"$f":"IF(J32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D32=\"Yes\"),AND($M$1=\"Scaled\",D32>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D32=\"No\"),AND($M$1=\"Scaled\",D32<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2257,"J.1.2.11.15","Feedback and lessons learned?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.6 ","Learning from information security incidents",4,null,1,2,11,15,0,0,{"$f":"IF(J33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D33=\"Yes\"),AND($M$1=\"Scaled\",D33>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D33=\"No\"),AND($M$1=\"Scaled\",D33<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3046,"J.1.2.11.16","Unique, specific, applicable data breach notification requirements, including timing of notification (HIPAA/HITECH, state breach laws, client contracts)?",null,null,null,null,"16.1.1.a.6","Responsibilities and procedures",4,null,1,2,11,16,0,0,{"$f":"IF(J34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D34=\"Yes\"),AND($M$1=\"Scaled\",D34>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D34=\"No\"),AND($M$1=\"Scaled\",D34<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2708,"J.1.2.11.17","Annual testing of the procedures?",null,null,null,null,"16.1.6 ","Learning from information security incidents",4,null,1,2,11,17,0,0,{"$f":"IF(J35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D35=\"Yes\"),AND($M$1=\"Scaled\",D35>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D35=\"No\"),AND($M$1=\"Scaled\",D35<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2709,"J.1.3","Are the following considered Information Security events:",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.2","Reporting information security events",2,1,1,3,0,0,0,0,{"$f":"IF(J36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D36=\"Yes\"),AND($M$1=\"Scaled\",D36>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D36=\"No\"),AND($M$1=\"Scaled\",D36<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2710,"J.1.3.1","Loss of service (equipment or facility)?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.2.f","Reporting information security events",3,null,1,3,1,0,0,0,{"$f":"IF(J37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D37=\"Yes\"),AND($M$1=\"Scaled\",D37>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D37=\"No\"),AND($M$1=\"Scaled\",D37<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[2711,"J.1.3.2","System malfunction or overload?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.2.g","Reporting information security events",3,null,1,3,2,0,0,0,{"$f":"IF(J38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D38=\"Yes\"),AND($M$1=\"Scaled\",D38>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D38=\"No\"),AND($M$1=\"Scaled\",D38<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[2712,"J.1.3.3","Human error?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.2.c","Reporting information security events",3,null,1,3,3,0,0,0,{"$f":"IF(J39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D39=\"Yes\"),AND($M$1=\"Scaled\",D39>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D39=\"No\"),AND($M$1=\"Scaled\",D39<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[2713,"J.1.3.4","Non-compliance with policy or guidelines?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.2.d","Reporting information security events",3,null,1,3,4,0,0,0,{"$f":"IF(J40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D40=\"Yes\"),AND($M$1=\"Scaled\",D40>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D40=\"No\"),AND($M$1=\"Scaled\",D40<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[2714,"J.1.3.5","Breach of physical security arrangement?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.2.e","Reporting information security events",3,null,1,3,5,0,0,0,{"$f":"IF(J41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D41=\"Yes\"),AND($M$1=\"Scaled\",D41>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D41=\"No\"),AND($M$1=\"Scaled\",D41<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[2715,"J.1.3.6","Uncontrolled system change?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.2.f","Reporting information security events",3,null,1,3,6,0,0,0,{"$f":"IF(J42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D42=\"Yes\"),AND($M$1=\"Scaled\",D42>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D42=\"No\"),AND($M$1=\"Scaled\",D42<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[2716,"J.1.3.7","Malfunction of software or hardware?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.2.g","Reporting information security events",3,null,1,3,7,0,0,0,{"$f":"IF(J43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D43=\"Yes\"),AND($M$1=\"Scaled\",D43>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D43=\"No\"),AND($M$1=\"Scaled\",D43<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[2272,"J.1.3.8","Access violation?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.2.h","Reporting information security events",3,null,1,3,8,0,0,0,{"$f":"IF(J44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D44=\"Yes\"),AND($M$1=\"Scaled\",D44>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D44=\"No\"),AND($M$1=\"Scaled\",D44<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[2265,"J.1.3.9","Physical asset loss or theft?",null,null,null,"J.5  Information Security / Information Technology Incident Management - Detection","16.1.2.a","Reporting information security events",3,null,1,3,9,0,0,0,{"$f":"IF(J45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D45=\"Yes\"),AND($M$1=\"Scaled\",D45>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D45=\"No\"),AND($M$1=\"Scaled\",D45<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]

{"sheet":"K. Business Resiliency","index":17,"n_rows":138,"n_cols":30,"rows_kept":138,"cut":false,"hidden":false,"merged":[[2,1,2,8]]}
[11,"K. Business Resiliency",null,null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,"Binary","Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"K"}]
[null,null,null,{"$f":"IF(X2=0,\"0%\",X2/T2)","v":"0%"},"Percent Complete",null,"Tab Automation:","Enable",null,{"$f":"COUNTA(J5:J138)","v":134},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(T5:T138,1)","v":134},null,null,null,{"$f":"COUNTIF(X5:X138,1)","v":0}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column F to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, select the word \"Disable\" in the Tab Automation field at the top of the page.\n     - Use the Maturity column to identify the maturity of the question. See the How To Guide for instructions on filling out this field.",null,null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter","Maturity N/A"]
[{"$f":"MAX(A5:A138)","v":4089},"Ques Num","Question/Request","Response","Maturity","Additional Information","AUP Reference","ISO 22301:2012 Relevance"]
[2719,{"$f":"IF(J5=0,\"\",IF(J5=1,Q$1&\".\"&L5,IF(J5=2,Q$1&\".\"&L5&\".\"&M5,IF(J5=3,Q$1&\".\"&L5&\".\"&M5&\".\"&N5,IF(J5=4,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5,IF(J5=5,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5&\".\"&P5))))))","v":"K.1"},"Is there an established Business Resiliency program that has been approved by management and communicated to appropriate constituents? If yes, does it include:",null,null,null,"K.1 Business Resiliency Governance",5.2,"Management Commitment",1,null,{"$f":"IF(L4=\"\",1,IF(J5=1,L4+1,L4))","v":1},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($J5=2,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($J5=3,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($J5=4,O4+1,O4)))","v":0},{"$f":"IF(P4=\"\",0,IF(O4<>O5,0,IF($J5=5,P4+1,P4)))","v":0},{"$f":"IF(OR(Master=\"Master\",J5=0,K5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,22,FALSE)),0,VLOOKUP(A5,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D5=\"Yes\"),AND($M$1=\"Scaled\",D5>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D5=\"No\"),AND($M$1=\"Scaled\",D5<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J5=\"\",\"\",IF(Q5>0,Q5,IF(R5>0,R5,0)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(J5=1,T4=\"\"),1,IF(OR(AND(K4=1,(J5-J3<>0)),AND(T4=0,J4=J5),AND(K4=1,J5=J3)),0,1)))","v":1},{"$f":"IF(J5=\"\",U4,IF(AND(S5>1,OR(U4=\"\",U4=0,U4>=J5)),J5,IF(J5>U4,U4,0)))","v":0},{"$f":"IF(Master=\"Master\",R5,IF(V4=\"\",S5,IF(OR(AND(U5>0,S5<V4),AND(U5=1,S5<=V4)),V4,S5)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(T4=1,U5=1),S5>0,AND(T6=0,W6=1)),1,0))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(U5>0,T5=1),AND(T5=1,W5=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(J5=1,S5=1),2,IF(AND(V4=1,L5=L4),2,IF(AND(AC4=2,L5=L4),2,IF(J5=1,1,\"\"))))","v":1}]
[4014,{"$f":"IF(J6=0,\"\",IF(J6=1,Q$1&\".\"&L6,IF(J6=2,Q$1&\".\"&L6&\".\"&M6,IF(J6=3,Q$1&\".\"&L6&\".\"&M6&\".\"&N6,IF(J6=4,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6,IF(J6=5,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6&\".\"&P6))))))","v":"K.1.1"},"An individual program owner?",null,null,null,"K.1 Business Resiliency Governance",5.2,"Management Commitment",2,null,{"$f":"IF(L5=\"\",1,IF(J6=1,L5+1,L5))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($J6=2,M5+1,M5)))","v":1},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($J6=3,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($J6=4,O5+1,O5)))","v":0},{"$f":"IF(P5=\"\",0,IF(O5<>O6,0,IF($J6=5,P5+1,P5)))","v":0},{"$f":"IF(OR(Master=\"Master\",J6=0,K6=1),0,IF(ISNA(VLOOKUP(A6,L2_Array,22,FALSE)),0,VLOOKUP(A6,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D6=\"Yes\"),AND($M$1=\"Scaled\",D6>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D6=\"No\"),AND($M$1=\"Scaled\",D6<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J6=\"\",\"\",IF(Q6>0,Q6,IF(R6>0,R6,0)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(J6=1,T5=\"\"),1,IF(OR(AND(K5=1,(J6-J4<>0)),AND(T5=0,J5=J6),AND(K5=1,J6=J4)),0,1)))","v":1},{"$f":"IF(J6=\"\",U5,IF(AND(S6>1,OR(U5=\"\",U5=0,U5>=J6)),J6,IF(J6>U5,U5,0)))","v":0},{"$f":"IF(Master=\"Master\",R6,IF(V5=\"\",S6,IF(OR(AND(U6>0,S6<V5),AND(U6=1,S6<=V5)),V5,S6)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(T5=1,U6=1),S6>0,AND(T7=0,W7=1)),1,0))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(U6>0,T6=1),AND(T6=1,W6=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A6,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(J6=1,S6=1),2,IF(AND(V5=1,L6=L5),2,IF(AND(AC5=2,L6=L5),2,IF(J6=1,1,\"\"))))","v":""}]
[2281,"K.1.2","Is there a documented policy(ies) addressing Business Continuity and Disaster Recovery? If yes, does it include:",null,null,null,"K.1 Business Resiliency Governance",5.2,"Management Commitment",2,null,1,2,0,0,0,0,{"$f":"IF(J7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D7=\"Yes\"),AND($M$1=\"Scaled\",D7>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D7=\"No\"),AND($M$1=\"Scaled\",D7<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4015,"K.1.2.1","Approved by executive management?",null,null,null,"K.1 Business Resiliency Governance",5.2,"Management Commitment",3,null,1,2,1,0,0,0,{"$f":"IF(J8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D8=\"Yes\"),AND($M$1=\"Scaled\",D8>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D8=\"No\"),AND($M$1=\"Scaled\",D8<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4016,"K.1.2.2","Communicated to appropriate constituents?",null,null,null,"K.1 Business Resiliency Governance",5.3,"Policy",3,null,1,2,2,0,0,0,{"$f":"IF(J9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D9=\"Yes\"),AND($M$1=\"Scaled\",D9>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D9=\"No\"),AND($M$1=\"Scaled\",D9<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4017,"K.1.2.3","Has an owner been assigned to maintain and review the policy?",null,null,null,"K.1 Business Resiliency Governance",5.2,"Management Commitment",3,null,1,2,3,0,0,0,{"$f":"IF(J10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D10=\"Yes\"),AND($M$1=\"Scaled\",D10>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D10=\"No\"),AND($M$1=\"Scaled\",D10<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2341,"K.1.3","Is there a formal annual (or more frequent) executive management review of the Business Continuity program? If yes, do it include:",null,null,null,"K.1 Business Resiliency Governance",9.3000000000000007,"Management Review",2,null,1,3,0,0,0,0,{"$f":"IF(J11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D11=\"Yes\"),AND($M$1=\"Scaled\",D11>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D11=\"No\"),AND($M$1=\"Scaled\",D11<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4018,"K.1.3.1","Adequacy of resources including people, technology, facilities, and funding?",null,null,null,"K.1 Business Resiliency Governance",9.3000000000000007,"Management Review",3,null,1,3,1,0,0,0,{"$f":"IF(J12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D12=\"Yes\"),AND($M$1=\"Scaled\",D12>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D12=\"No\"),AND($M$1=\"Scaled\",D12<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4019,"K.1.3.2","Reporting of key program activity and value metrics?",null,null,null,"K.1 Business Resiliency Governance",9.3000000000000007,"Management Review",3,null,1,3,2,0,0,0,{"$f":"IF(J13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D13=\"Yes\"),AND($M$1=\"Scaled\",D13>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D13=\"No\"),AND($M$1=\"Scaled\",D13<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4020,"K.1.3.3","Results of Business Continuity Program audits and reviews, including those of key suppliers and partners where appropriate?",null,null,null,"K.7  Exercising",9.3000000000000007,"Management Review",3,null,1,3,3,0,0,0,{"$f":"IF(J14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D14=\"Yes\"),AND($M$1=\"Scaled\",D14>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D14=\"No\"),AND($M$1=\"Scaled\",D14<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4021,"K.1.3.4","Results of exercising and testing?",null,null,null,"K.7  Exercising",9.3000000000000007,"Management Review",3,null,1,3,4,0,0,0,{"$f":"IF(J15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D15=\"Yes\"),AND($M$1=\"Scaled\",D15>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D15=\"No\"),AND($M$1=\"Scaled\",D15<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4022,"K.1.3.5","Risks or issues not adequately addressed in any previous risk assessments?",null,null,null,"K.7  Exercising",9.3000000000000007,"Management Review",3,null,1,3,5,0,0,0,{"$f":"IF(J16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D16=\"Yes\"),AND($M$1=\"Scaled\",D16>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D16=\"No\"),AND($M$1=\"Scaled\",D16<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4023,"K.1.3.6","Lessons learned and actions arising from disruptive incidents?",null,null,null,"K.7  Exercising",9.3000000000000007,"Management Review",3,null,1,3,6,0,0,0,{"$f":"IF(J17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D17=\"Yes\"),AND($M$1=\"Scaled\",D17>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D17=\"No\"),AND($M$1=\"Scaled\",D17<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4024,"K.1.3.7","A defined and documented Business Resiliency life-cycle that includes Business Impact Analysis, Risk Assessment, Strategy and Plan Development, and Exercising/Testing?",null,null,null,"K Business Resiliency Management","0\n8.2","Introduction\r\nBusiness impact analysis and risk assessment",3,null,1,3,7,0,0,0,{"$f":"IF(J18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D18=\"Yes\"),AND($M$1=\"Scaled\",D18>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D18=\"No\"),AND($M$1=\"Scaled\",D18<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2287,"K.1.4","Has an independent third party evaluated the Business Resiliency Program within the past 12 months?",null,null,null,"NA",9.1999999999999993,"Internal Audit",2,null,1,4,0,0,0,0,{"$f":"IF(J19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D19=\"Yes\"),AND($M$1=\"Scaled\",D19>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D19=\"No\"),AND($M$1=\"Scaled\",D19<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2293,"K.1.5","Are awareness and education activities for all personnel assigned to a defined role in a plan, response/recovery management procedures, or overall program management?",null,null,null,"K.1 Business Resiliency Governance",7.3,"Awareness",2,null,1,5,0,0,0,0,{"$f":"IF(J20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D20=\"Yes\"),AND($M$1=\"Scaled\",D20>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D20=\"No\"),AND($M$1=\"Scaled\",D20<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4025,"K.1.6","Has senior management determined the desired competencies for the person(s) working within the Business Resiliency program? If yes, do they:",null,null,null,"K.1 Business Resiliency Governance",7.2,"Competence",2,null,1,6,0,0,0,0,{"$f":"IF(J21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D21=\"Yes\"),AND($M$1=\"Scaled\",D21>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D21=\"No\"),AND($M$1=\"Scaled\",D21<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4026,"K.1.6.1","Have appropriate actions been taken to ensure that person(s) working under the Business Resiliency program have or acquire the desired competencies?",null,null,null,"K.1 Business Resiliency Governance",7.2,"Competence",3,null,1,6,1,0,0,0,{"$f":"IF(J22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D22=\"Yes\"),AND($M$1=\"Scaled\",D22>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D22=\"No\"),AND($M$1=\"Scaled\",D22<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4027,"K.1.7","Have formal documentation and reference information relevant to the Business Resiliency program and procedures been created? If yes, are they:",null,null,null,"K.1 Business Resiliency Governance",7.5,"Documented information",2,null,1,7,0,0,0,0,{"$f":"IF(J23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D23=\"Yes\"),AND($M$1=\"Scaled\",D23>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D23=\"No\"),AND($M$1=\"Scaled\",D23<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4028,"K.1.7.1","Controlled to ensure its availability when and where it is needed?",null,null,null,"K.1 Business Resiliency Governance","7.5.3","Control of documented information",3,null,1,7,1,0,0,0,{"$f":"IF(J24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D24=\"Yes\"),AND($M$1=\"Scaled\",D24>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D24=\"No\"),AND($M$1=\"Scaled\",D24<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4029,"K.1.7.2","Controlled to ensure it is adequately protected from loss of confidentiality, improper use, or loss of integrity?",null,null,null,"K.1 Business Resiliency Governance","7.5.3","Control of documented information",3,null,1,7,2,0,0,0,{"$f":"IF(J25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D25=\"Yes\"),AND($M$1=\"Scaled\",D25>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D25=\"No\"),AND($M$1=\"Scaled\",D25<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4030,"K.1.7.3","Managed to assure control of changes and understanding of versions and changes?",null,null,null,"K.6 Maintenance and Continuous Improvement ","7.5.3","Control of documented information",3,null,1,7,3,0,0,0,{"$f":"IF(J26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D26=\"Yes\"),AND($M$1=\"Scaled\",D26>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D26=\"No\"),AND($M$1=\"Scaled\",D26<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4031,"K.1.7.4","Protected against compromise, unauthorized modification or deletion?",null,null,null,"K.6 Maintenance and Continuous Improvement ","7.5.3","Control of documented information",3,null,1,7,4,0,0,0,{"$f":"IF(J27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D27=\"Yes\"),AND($M$1=\"Scaled\",D27>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D27=\"No\"),AND($M$1=\"Scaled\",D27<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2765,"K.1.8","Do the products and/or services specified in the scope of this assessment fall within the scope of the Business Resiliency program? If yes do they:",null,null,null,"K.2 Business Impact Analysis","4.3.2","Scope of the BCMS",2,null,1,8,0,0,0,0,{"$f":"IF(J28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D28=\"Yes\"),AND($M$1=\"Scaled\",D28>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D28=\"No\"),AND($M$1=\"Scaled\",D28<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[4032,"K.1.8.1","Include recovery priority/ranking/tier for these products and/or services, in the contractual performance/service level terms?",null,null,null,"K.2 Business Impact Analysis","4.3.2","Scope of the BCMS",3,null,1,8,1,0,0,0,{"$f":"IF(J29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D29=\"Yes\"),AND($M$1=\"Scaled\",D29>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D29=\"No\"),AND($M$1=\"Scaled\",D29<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4033,"K.1.8.2","Fall into the highest possible recovery priority/ranking/tier specified within your Business Resiliency program?",null,null,null,"K.2 Business Impact Analysis","4.3.2","Scope of the BCMS",3,null,1,8,2,0,0,0,{"$f":"IF(J30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D30=\"Yes\"),AND($M$1=\"Scaled\",D30>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D30=\"No\"),AND($M$1=\"Scaled\",D30<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4034,"K.1.8.3","Include specific recovery objectives/requirements defined for those products and/or services?",null,null,null,"K.2 Business Impact Analysis","4.3.2","Scope of the BCMS",3,null,1,8,3,0,0,0,{"$f":"IF(J31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D31=\"Yes\"),AND($M$1=\"Scaled\",D31>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D31=\"No\"),AND($M$1=\"Scaled\",D31<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2329,"K.2","Has a Business Impact Analysis been conducted? If yes, does it include:",null,null,null,"K.2 Business Impact Analysis","8.2.2","Business impact analysis",1,null,2,0,0,0,0,0,{"$f":"IF(J32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D32=\"Yes\"),AND($M$1=\"Scaled\",D32>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D32=\"No\"),AND($M$1=\"Scaled\",D32<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[4035,"K.2.1","Validation and/or refresh at least annually? ",null,null,null,"K.2 Business Impact Analysis","8.2.2","Business impact analysis",2,null,2,1,0,0,0,0,{"$f":"IF(J33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D33=\"Yes\"),AND($M$1=\"Scaled\",D33>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D33=\"No\"),AND($M$1=\"Scaled\",D33<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2334,"K.2.2","Business Activity or Business Process Criticality (high, medium, low or numerical rating) that distinguishes the relative importance of each activity or process?",null,null,null,"K.2 Business Impact Analysis","8.2.2","Business impact analysis",2,null,2,2,0,0,0,0,{"$f":"IF(J34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D34=\"Yes\"),AND($M$1=\"Scaled\",D34>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D34=\"No\"),AND($M$1=\"Scaled\",D34<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2299,"K.2.3","Identification of applications, data, equipment, facilities, personnel, supplies and paper documents necessary for recovery?",null,null,null,"K.2 Business Impact Analysis\nK.3 Risk Assessment","?","addressed by 27031",2,null,2,3,0,0,0,0,{"$f":"IF(J35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D35=\"Yes\"),AND($M$1=\"Scaled\",D35>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D35=\"No\"),AND($M$1=\"Scaled\",D35<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2338,"K.2.4","Maximum Acceptable Outage / Maximum Tolerable Period of Disruption for each Business Activity or Business Process?",null,null,null,"K.2 Business Impact Analysis","8.2.2","Business impact analysis",2,null,2,4,0,0,0,0,{"$f":"IF(J36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D36=\"Yes\"),AND($M$1=\"Scaled\",D36>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D36=\"No\"),AND($M$1=\"Scaled\",D36<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2335,"K.2.5","Recovery Time Objectives for all essential application systems, network services, and other resources?",null,null,null,"K.2 Business Impact Analysis","8.2.2","Business impact analysis",2,null,2,5,0,0,0,0,{"$f":"IF(J37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D37=\"Yes\"),AND($M$1=\"Scaled\",D37>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D37=\"No\"),AND($M$1=\"Scaled\",D37<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2337,"K.2.6","Recovery Point Objective for all essential application systems?",null,null,null,"K.2 Business Impact Analysis","8.2.2","Business impact analysis",2,null,2,6,0,0,0,0,{"$f":"IF(J38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D38=\"Yes\"),AND($M$1=\"Scaled\",D38>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D38=\"No\"),AND($M$1=\"Scaled\",D38<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2760,"K.2.7","Impact to clients/customers?",null,null,null,"K.2 Business Impact Analysis","8.2.2","Business impact analysis",2,null,2,7,0,0,0,0,{"$f":"IF(J39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D39=\"Yes\"),AND($M$1=\"Scaled\",D39>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D39=\"No\"),AND($M$1=\"Scaled\",D39<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4036,"K.2.8","Capacity to address needs/expectations of all clients/customers?",null,null,null,"K.2 Business Impact Analysis","N/A",null,2,null,2,8,0,0,0,0,{"$f":"IF(J40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D40=\"Yes\"),AND($M$1=\"Scaled\",D40>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D40=\"No\"),AND($M$1=\"Scaled\",D40<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4037,"K.2.9","Identification of the recovery requirements for information security and the continuity of information security management?",null,null,null,"K.2 Business Impact Analysis","N/A",null,2,null,2,9,0,0,0,0,{"$f":"IF(J41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D41=\"Yes\"),AND($M$1=\"Scaled\",D41>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D41=\"No\"),AND($M$1=\"Scaled\",D41<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4038,"K.3","Is there a formal process focused on identifying and addressing risks of disruptive incidents to the organization? If yes, does it include:",null,null,null,"K.3 Risk Assessment","8.2.3","Risk assessment",1,null,3,0,0,0,0,0,{"$f":"IF(J42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D42=\"Yes\"),AND($M$1=\"Scaled\",D42>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D42=\"No\"),AND($M$1=\"Scaled\",D42<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[4039,"K.3.1","Identifying risks associated with disruptions to systems, information, people, third parties, and facilities?",null,null,null,"K.3 Risk Assessment","8.2.3","Risk assessment",2,null,3,1,0,0,0,0,{"$f":"IF(J43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D43=\"Yes\"),AND($M$1=\"Scaled\",D43>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D43=\"No\"),AND($M$1=\"Scaled\",D43<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4040,"K.3.2","Analysis of risks identified and determination of those requiring treatments?",null,null,null,"K.3 Risk Assessment","8.2.3","Risk assessment",2,null,3,2,0,0,0,0,{"$f":"IF(J44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D44=\"Yes\"),AND($M$1=\"Scaled\",D44>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D44=\"No\"),AND($M$1=\"Scaled\",D44<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4041,"K.3.3","Taking action on approved treatments?",null,null,null,"K.3 Risk Assessment","8.2.3","Risk assessment",2,null,3,3,0,0,0,0,{"$f":"IF(J45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D45=\"Yes\"),AND($M$1=\"Scaled\",D45>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D45=\"No\"),AND($M$1=\"Scaled\",D45<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4042,"K.4","Are specific response and recovery strategies defined for the prioritized activities? If yes, does it include:",null,null,null,"K.4 Response and Recovery Strategy","8.3.1","Determination and selection",1,null,4,0,0,0,0,0,{"$f":"IF(J46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D46=\"Yes\"),AND($M$1=\"Scaled\",D46>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D46=\"No\"),AND($M$1=\"Scaled\",D46<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[4043,"K.4.1","The resource dependencies associated with each prioritized activity? If yes, does they include:",null,null,null,"K.4 Response and Recovery Strategy","8.3.2","Establishing resource requirements",2,null,4,1,0,0,0,0,{"$f":"IF(J47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D47=\"Yes\"),AND($M$1=\"Scaled\",D47>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D47=\"No\"),AND($M$1=\"Scaled\",D47<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4044,"K.4.1.1","Personnel (40% or more)?",null,null,null,"K.4 Response and Recovery Strategy","8.3.2","Establishing resource requirements",3,null,4,1,1,0,0,0,{"$f":"IF(J48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D48=\"Yes\"),AND($M$1=\"Scaled\",D48>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D48=\"No\"),AND($M$1=\"Scaled\",D48<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4045,"K.4.1.2","Information and data?",null,null,null,"K.4 Response and Recovery Strategy","8.3.2","Establishing resource requirements",3,null,4,1,2,0,0,0,{"$f":"IF(J49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D49=\"Yes\"),AND($M$1=\"Scaled\",D49>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D49=\"No\"),AND($M$1=\"Scaled\",D49<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4046,"K.4.1.3","Information and communication technology?",null,null,null,"K.4 Response and Recovery Strategy","8.3.2","Establishing resource requirements",3,null,4,1,3,0,0,0,{"$f":"IF(J50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D50=\"Yes\"),AND($M$1=\"Scaled\",D50>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D50=\"No\"),AND($M$1=\"Scaled\",D50<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4047,"K.4.1.4","Work places/buildings?",null,null,null,"K.4 Response and Recovery Strategy","8.3.2","Establishing resource requirements",3,null,4,1,4,0,0,0,{"$f":"IF(J51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D51=\"Yes\"),AND($M$1=\"Scaled\",D51>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D51=\"No\"),AND($M$1=\"Scaled\",D51<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4048,"K.4.1.5","Third party services (e.g. partners and suppliers)?",null,null,null,"K.4 Response and Recovery Strategy","8.3.2","Establishing resource requirements",3,null,4,1,5,0,0,0,{"$f":"IF(J52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D52=\"Yes\"),AND($M$1=\"Scaled\",D52>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D52=\"No\"),AND($M$1=\"Scaled\",D52<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4049,"K.5","Are formal business continuity procedures developed and documented? If yes, do they Include:",null,null,null,"K.5 Business Activity Level Recovery Planning",8.4,"Establish and implement business continuity procedures",1,null,5,0,0,0,0,0,{"$f":"IF(J53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D53=\"Yes\"),AND($M$1=\"Scaled\",D53>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D53=\"No\"),AND($M$1=\"Scaled\",D53<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[4050,"K.5.1","Specific actions to be taken in response to a disruptive event?",null,null,null,"K.5 Business Activity Level Recovery Planning",8.4,"Establish and implement business continuity procedures",2,null,5,1,0,0,0,0,{"$f":"IF(J54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D54=\"Yes\"),AND($M$1=\"Scaled\",D54>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D54=\"No\"),AND($M$1=\"Scaled\",D54<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4051,"K.5.2","Key impacts including the unavailability of critical resource dependencies?",null,null,null,"K.5 Business Activity Level Recovery Planning",8.4,"Establish and implement business continuity procedures",2,null,5,2,0,0,0,0,{"$f":"IF(J55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D55=\"Yes\"),AND($M$1=\"Scaled\",D55>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D55=\"No\"),AND($M$1=\"Scaled\",D55<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4052,"K.5.3","The continuity of Information security activities and processes (e.g. intrusion detection, vulnerability management, log collection)?",null,null,null,"K.5 Business Activity Level Recovery Planning","N/A",null,2,null,5,3,0,0,0,0,{"$f":"IF(J56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D56=\"Yes\"),AND($M$1=\"Scaled\",D56>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D56=\"No\"),AND($M$1=\"Scaled\",D56<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4053,"K.5.4","The continuity of IT operations activities and processes (e.g. network operations, data center operations, help desk)?",null,null,null,"K.5 Business Activity Level Recovery Planning","N/A",null,2,null,5,4,0,0,0,0,{"$f":"IF(J57=\"\",\"\",IF(D57=\"\",0,IF(D57=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D57=\"Yes\"),AND($M$1=\"Scaled\",D57>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D57=\"No\"),AND($M$1=\"Scaled\",D57<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4054,"K.6","Has senior management assigned the responsibility for the overall management of the response and recovery efforts? If yes, does it include:",null,null,null,"K.1 Business Resiliency Governance","N/A",null,1,null,6,0,0,0,0,0,{"$f":"IF(J58=\"\",\"\",IF(D58=\"\",0,IF(D58=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D58=\"Yes\"),AND($M$1=\"Scaled\",D58>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D58=\"No\"),AND($M$1=\"Scaled\",D58<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[2342,"K.6.1","Virtual or physical command center where management can meet, organize, and manage emergency operations in a secure setting?",null,null,null,"K.1 Business Resiliency Governance","8.4.3","Warning and communication",2,null,6,1,0,0,0,0,{"$f":"IF(J59=\"\",\"\",IF(D59=\"\",0,IF(D59=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D59=\"Yes\"),AND($M$1=\"Scaled\",D59>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D59=\"No\"),AND($M$1=\"Scaled\",D59<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2289,"K.6.2","Conditions for activating the plan(s), and the associated roles and responsibilities?",null,null,null,"K.1 Business Resiliency Governance","8.4.2","Incident response structure",2,null,6,2,0,0,0,0,{"$f":"IF(J60=\"\",\"\",IF(D60=\"\",0,IF(D60=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D60=\"Yes\"),AND($M$1=\"Scaled\",D60>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D60=\"No\"),AND($M$1=\"Scaled\",D60<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2292,"K.6.3","Maintenance schedule to review, revise and test the recovery management plan?",null,null,null,"K.1 Business Resiliency Governance","8.4.1","Establish and implement business continuity procedures ",2,null,6,3,0,0,0,0,{"$f":"IF(J61=\"\",\"\",IF(D61=\"\",0,IF(D61=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D61=\"Yes\"),AND($M$1=\"Scaled\",D61>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D61=\"No\"),AND($M$1=\"Scaled\",D61<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2294,"K.6.4","Roles and responsibilities for those who invoke and execute the plan?",null,null,null,"K.1 Business Resiliency Governance","8.4.4","Business continuity plans",2,null,6,4,0,0,0,0,{"$f":"IF(J62=\"\",\"\",IF(D62=\"\",0,IF(D62=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D62=\"Yes\"),AND($M$1=\"Scaled\",D62>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D62=\"No\"),AND($M$1=\"Scaled\",D62<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2303,"K.6.5","Alternate and diverse means of communications in the event standard communication channels are unavailable?",null,null,null,"K.1 Business Resiliency Governance",7.4,"Communication",2,null,6,5,0,0,0,0,{"$f":"IF(J63=\"\",\"\",IF(D63=\"\",0,IF(D63=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D63=\"Yes\"),AND($M$1=\"Scaled\",D63>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D63=\"No\"),AND($M$1=\"Scaled\",D63<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2725,"K.6.6","Interaction with the media during an event?",null,null,null,"K.1 Business Resiliency Governance","8.4.2\n8.4.4","Incident response structure\r\nBusiness Continuity Plans",2,null,6,6,0,0,0,0,{"$f":"IF(J64=\"\",\"\",IF(D64=\"\",0,IF(D64=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D64=\"Yes\"),AND($M$1=\"Scaled\",D64>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D64=\"No\"),AND($M$1=\"Scaled\",D64<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2726,"K.6.7","Resumption procedures to return to normal business operations?",null,null,null,"K.1 Business Resiliency Governance","8.4.5","Recovery",2,null,6,7,0,0,0,0,{"$f":"IF(J65=\"\",\"\",IF(D65=\"\",0,IF(D65=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D65=\"Yes\"),AND($M$1=\"Scaled\",D65>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D65=\"No\"),AND($M$1=\"Scaled\",D65<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2728,"K.6.8","Notification and escalation to clients?",null,null,null,"K.1 Business Resiliency Governance","8.4.2","Incident response structure",2,null,6,8,0,0,0,0,{"$f":"IF(J66=\"\",\"\",IF(D66=\"\",0,IF(D66=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D66=\"Yes\"),AND($M$1=\"Scaled\",D66>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D66=\"No\"),AND($M$1=\"Scaled\",D66<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2286,"K.7","Is there a periodic (at least annual) review of your Business Resiliency Program? If yes, does it include:",null,null,null,"K.7  Exercising","8.4.1","Establish and implement business continuity procedures",1,null,7,0,0,0,0,0,{"$f":"IF(J67=\"\",\"\",IF(D67=\"\",0,IF(D67=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D67=\"Yes\"),AND($M$1=\"Scaled\",D67>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D67=\"No\"),AND($M$1=\"Scaled\",D67<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[4055,"K.7.1","Updates to the procedures as necessary after the review?",null,null,null,"K.6 Maintenance and Continuous Improvement\nK.7  Exercising","8.4.1","Establish and implement business continuity procedures",2,null,7,1,0,0,0,0,{"$f":"IF(J68=\"\",\"\",IF(D68=\"\",0,IF(D68=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D68=\"Yes\"),AND($M$1=\"Scaled\",D68>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D68=\"No\"),AND($M$1=\"Scaled\",D68<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4056,"K.7.2","Changes in business activities, dependencies and related recovery objectives?",null,null,null,"K.6 Maintenance and Continuous Improvement","8.4.1","Establish and implement business continuity procedures",2,null,7,2,0,0,0,0,{"$f":"IF(J69=\"\",\"\",IF(D69=\"\",0,IF(D69=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D69=\"Yes\"),AND($M$1=\"Scaled\",D69>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D69=\"No\"),AND($M$1=\"Scaled\",D69<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4057,"K.7.3","Changes in organizational structure and personnel changes?",null,null,null,"K.1 Business Resiliency Governance","N/A",null,2,null,{"$f":"IF(L69=\"\",1,IF(J70=1,L69+1,L69))","v":7},{"$f":"IF(M69=\"\",0,IF(L69<>L70,0,IF($J70=2,M69+1,M69)))","v":3},{"$f":"IF(N69=\"\",0,IF(M69<>M70,0,IF($J70=3,N69+1,N69)))","v":0},{"$f":"IF(O69=\"\",0,IF(N69<>N70,0,IF($J70=4,O69+1,O69)))","v":0},{"$f":"IF(P69=\"\",0,IF(O69<>O70,0,IF($J70=5,P69+1,P69)))","v":0},{"$f":"IF(OR(Master=\"Master\",J70=0,K70=1),0,IF(ISNA(VLOOKUP(A70,L2_Array,22,FALSE)),0,VLOOKUP(A70,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J70=\"\",\"\",IF(D70=\"\",0,IF(D70=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D70=\"Yes\"),AND($M$1=\"Scaled\",D70>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D70=\"No\"),AND($M$1=\"Scaled\",D70<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J70=\"\",\"\",IF(Q70>0,Q70,IF(R70>0,R70,0)))","v":0},{"$f":"IF(J70=\"\",\"\",IF(OR(J70=1,T69=\"\"),1,IF(OR(AND(K69=1,(J70-J68<>0)),AND(T69=0,J69=J70),AND(K69=1,J70=J68)),0,1)))","v":1},{"$f":"IF(J70=\"\",U69,IF(AND(S70>1,OR(U69=\"\",U69=0,U69>=J70)),J70,IF(J70>U69,U69,0)))","v":0},{"$f":"IF(Master=\"Master\",R70,IF(V69=\"\",S70,IF(OR(AND(U70>0,S70<V69),AND(U70=1,S70<=V69)),V69,S70)))","v":0},{"$f":"IF(J70=\"\",\"\",IF(OR(AND(T69=1,U70=1),S70>0,AND(T71=0,W71=1)),1,0))","v":0},{"$f":"IF(J70=\"\",\"\",IF(OR(AND(U70>0,T70=1),AND(T70=1,W70=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A70,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(J70=1,S70=1),2,IF(AND(V69=1,L70=L69),2,IF(AND(AC69=2,L70=L69),2,IF(J70=1,1,\"\"))))","v":""}]
[4058,{"$f":"IF(J71=0,\"\",IF(J71=1,Q$1&\".\"&L71,IF(J71=2,Q$1&\".\"&L71&\".\"&M71,IF(J71=3,Q$1&\".\"&L71&\".\"&M71&\".\"&N71,IF(J71=4,Q$1&\".\"&L71&\".\"&M71&\".\"&N71&\".\"&O71,IF(J71=5,Q$1&\".\"&L71&\".\"&M71&\".\"&N71&\".\"&O71&\".\"&P71))))))","v":"K.7.4"},"Emerging threats and identified new risks?",null,null,null,"K.2 Business Impact Analysis","N/A",null,2,null,7,4,0,0,0,0,{"$f":"IF(J71=\"\",\"\",IF(D71=\"\",0,IF(D71=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D71=\"Yes\"),AND($M$1=\"Scaled\",D71>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D71=\"No\"),AND($M$1=\"Scaled\",D71<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4059,"K.7.5","Warning and communication procedures and capabilities?",null,null,null,"K.1 Business Resiliency Governance","8.4.3","Warning and communication",2,null,7,5,0,0,0,0,{"$f":"IF(J72=\"\",\"\",IF(D72=\"\",0,IF(D72=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D72=\"Yes\"),AND($M$1=\"Scaled\",D72>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D72=\"No\"),AND($M$1=\"Scaled\",D72<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2298,"K.7.6","Environment changes are replicated to contingency environments e.g., hardware, software, etc.?",null,null,null,"K.6 Maintenance and Continuous Improvement","?","addressed by 27031",2,null,7,6,0,0,0,0,{"$f":"IF(J73=\"\",\"\",IF(D73=\"\",0,IF(D73=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D73=\"Yes\"),AND($M$1=\"Scaled\",D73>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D73=\"No\"),AND($M$1=\"Scaled\",D73<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2300,"K.7.7","Updates from the inventory of IT and telecom assets?",null,null,null,"K.6 Maintenance and Continuous Improvement","?","addressed by 27031",2,null,7,7,0,0,0,0,{"$f":"IF(J74=\"\",\"\",IF(D74=\"\",0,IF(D74=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D74=\"Yes\"),AND($M$1=\"Scaled\",D74>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D74=\"No\"),AND($M$1=\"Scaled\",D74<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2729,"K.8","Are there any dependencies on critical third party service providers? If so, have:",null,null,null,"K.2 Business Impact Analysis","8.1\n8.3\n8.3.1\n8.44","Operational Planning and Control\r\nBusiness continuity strategy\r\nDetermination and selection\r\nBusiness continuity plans",1,null,8,0,0,0,0,0,{"$f":"IF(J75=\"\",\"\",IF(D75=\"\",0,IF(D75=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D75=\"Yes\"),AND($M$1=\"Scaled\",D75>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D75=\"No\"),AND($M$1=\"Scaled\",D75<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1,1]
[2308,"K.8.1","Contact information for key service provider personnel been documented?",null,null,null,"K.1 Business Resiliency Governance\nK.2 Business Impact Analysis","N/A",null,2,null,8,1,0,0,0,0,{"$f":"IF(J76=\"\",\"\",IF(D76=\"\",0,IF(D76=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D76=\"Yes\"),AND($M$1=\"Scaled\",D76>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D76=\"No\"),AND($M$1=\"Scaled\",D76<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4060,"K.8.1.1","Is the contact information reviewed and updated at least annually?",null,null,null,"K.1 Business Resiliency Governance\nK.2 Business Impact Analysis","N/A",null,3,null,8,1,1,0,0,0,{"$f":"IF(J77=\"\",\"\",IF(D77=\"\",0,IF(D77=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D77=\"Yes\"),AND($M$1=\"Scaled\",D77>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D77=\"No\"),AND($M$1=\"Scaled\",D77<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2295,"K.8.2","Notification and escalation protocols been established?",null,null,null,"K.1 Business Resiliency Governance\nK.2 Business Impact Analysis","8.4.3","Warning and communication",2,null,8,2,0,0,0,0,{"$f":"IF(J78=\"\",\"\",IF(D78=\"\",0,IF(D78=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D78=\"Yes\"),AND($M$1=\"Scaled\",D78>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D78=\"No\"),AND($M$1=\"Scaled\",D78<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2730,"K.8.3","Communication in the event of a disruption that impacts the delivery of their products and services?",null,null,null,"K.1 Business Resiliency Governance\nK.2 Business Impact Analysis",7.4,"Communication",2,null,8,3,0,0,0,0,{"$f":"IF(J79=\"\",\"\",IF(D79=\"\",0,IF(D79=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D79=\"Yes\"),AND($M$1=\"Scaled\",D79>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D79=\"No\"),AND($M$1=\"Scaled\",D79<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2731,"K.8.4","Processes been implemented to notify the service provider when their Business Resiliency Procedures are modified?",null,null,null,"K.1 Business Resiliency Governance\nK.2 Business Impact Analysis","N/A",null,2,null,8,4,0,0,0,0,{"$f":"IF(J80=\"\",\"\",IF(D80=\"\",0,IF(D80=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D80=\"Yes\"),AND($M$1=\"Scaled\",D80>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D80=\"No\"),AND($M$1=\"Scaled\",D80<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2343,"K.9","Is there a formal, documented exercise and testing program in place? If yes, does it include:",null,null,null,"K.7 Exercising",8.5,"Exercising and testing",1,null,9,0,0,0,0,0,{"$f":"IF(J81=\"\",\"\",IF(D81=\"\",0,IF(D81=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D81=\"Yes\"),AND($M$1=\"Scaled\",D81>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D81=\"No\"),AND($M$1=\"Scaled\",D81<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[2346,"K.9.1","Specific IT Disaster Recovery exercises and tests that address the unavailability of specific resources? If yes, are the following included:",null,null,null,"K.7 Exercising",8.5,"Exercising and testing",2,null,9,1,0,0,0,0,{"$f":"IF(J82=\"\",\"\",IF(D82=\"\",0,IF(D82=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D82=\"Yes\"),AND($M$1=\"Scaled\",D82>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D82=\"No\"),AND($M$1=\"Scaled\",D82<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4061,"K.9.1.1","Production data center(s)?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,1,1,0,0,0,{"$f":"IF(J83=\"\",\"\",IF(D83=\"\",0,IF(D83=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D83=\"Yes\"),AND($M$1=\"Scaled\",D83>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D83=\"No\"),AND($M$1=\"Scaled\",D83<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4062,"K.9.1.2","Data stores?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,1,2,0,0,0,{"$f":"IF(J84=\"\",\"\",IF(D84=\"\",0,IF(D84=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D84=\"Yes\"),AND($M$1=\"Scaled\",D84>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D84=\"No\"),AND($M$1=\"Scaled\",D84<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4063,"K.9.1.3","Recovery supporting personnel (40% or more)?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,1,3,0,0,0,{"$f":"IF(J85=\"\",\"\",IF(D85=\"\",0,IF(D85=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D85=\"Yes\"),AND($M$1=\"Scaled\",D85>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D85=\"No\"),AND($M$1=\"Scaled\",D85<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4064,"K.9.1.4","Network?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,1,4,0,0,0,{"$f":"IF(J86=\"\",\"\",IF(D86=\"\",0,IF(D86=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D86=\"Yes\"),AND($M$1=\"Scaled\",D86>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D86=\"No\"),AND($M$1=\"Scaled\",D86<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4065,"K.9.2","Specific business activity exercises and tests that address the unavailability of specific resources i.e., realistic scenarios? If yes, does it include:",null,null,null,"K.7 Exercising",8.5,"Exercising and testing",2,null,9,2,0,0,0,0,{"$f":"IF(J87=\"\",\"\",IF(D87=\"\",0,IF(D87=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D87=\"Yes\"),AND($M$1=\"Scaled\",D87>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D87=\"No\"),AND($M$1=\"Scaled\",D87<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4066,"K.9.2.1","Information and communication technology?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,2,1,0,0,0,{"$f":"IF(J88=\"\",\"\",IF(D88=\"\",0,IF(D88=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D88=\"Yes\"),AND($M$1=\"Scaled\",D88>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D88=\"No\"),AND($M$1=\"Scaled\",D88<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4067,"K.9.2.2","Network due to dedicated denial of service / cyber attacks?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,2,2,0,0,0,{"$f":"IF(J89=\"\",\"\",IF(D89=\"\",0,IF(D89=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D89=\"Yes\"),AND($M$1=\"Scaled\",D89>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D89=\"No\"),AND($M$1=\"Scaled\",D89<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4068,"K.9.2.3","Work places/buildings?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,2,3,0,0,0,{"$f":"IF(J90=\"\",\"\",IF(D90=\"\",0,IF(D90=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D90=\"Yes\"),AND($M$1=\"Scaled\",D90>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D90=\"No\"),AND($M$1=\"Scaled\",D90<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4069,"K.9.2.4","Personnel?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,2,4,0,0,0,{"$f":"IF(J91=\"\",\"\",IF(D91=\"\",0,IF(D91=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D91=\"Yes\"),AND($M$1=\"Scaled\",D91>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D91=\"No\"),AND($M$1=\"Scaled\",D91<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4070,"K.9.2.5","Third party services (e.g. partners and suppliers)?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,2,5,0,0,0,{"$f":"IF(J92=\"\",\"\",IF(D92=\"\",0,IF(D92=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D92=\"Yes\"),AND($M$1=\"Scaled\",D92>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D92=\"No\"),AND($M$1=\"Scaled\",D92<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4071,"K.9.3","Are measurable recovery objectives defined for each exercise and test? If yes, do they include:",null,null,null,"K.7 Exercising",8.5,"Exercising and testing",2,null,9,3,0,0,0,0,{"$f":"IF(J93=\"\",\"\",IF(D93=\"\",0,IF(D93=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D93=\"Yes\"),AND($M$1=\"Scaled\",D93>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D93=\"No\"),AND($M$1=\"Scaled\",D93<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4072,"K.9.3.1","Recovery Time Objectives for all essential application systems, network services, and other resources?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,3,1,0,0,0,{"$f":"IF(J94=\"\",\"\",IF(D94=\"\",0,IF(D94=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D94=\"Yes\"),AND($M$1=\"Scaled\",D94>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D94=\"No\"),AND($M$1=\"Scaled\",D94<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4073,"K.9.3.2","Recovery Point Objective for all essential application systems?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,3,2,0,0,0,{"$f":"IF(J95=\"\",\"\",IF(D95=\"\",0,IF(D95=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D95=\"Yes\"),AND($M$1=\"Scaled\",D95>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D95=\"No\"),AND($M$1=\"Scaled\",D95<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4074,"K.9.4","Are the recovery objective attainment results and the issues identified evaluated with improvement actions identified and acted upon?",null,null,null,"K.7 Exercising",8.5,"Exercising and testing",2,null,9,4,0,0,0,0,{"$f":"IF(J96=\"\",\"\",IF(D96=\"\",0,IF(D96=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D96=\"Yes\"),AND($M$1=\"Scaled\",D96>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D96=\"No\"),AND($M$1=\"Scaled\",D96<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4075,"K.9.5","Is the exercise and testing schedule reviewed and enhanced when there are significant changes within the organization or to the environment in which it operates?",null,null,null,"K.7 Exercising",8.5,"Exercising and testing",2,null,9,5,0,0,0,0,{"$f":"IF(J97=\"\",\"\",IF(D97=\"\",0,IF(D97=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D97=\"Yes\"),AND($M$1=\"Scaled\",D97>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D97=\"No\"),AND($M$1=\"Scaled\",D97<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2779,"K.9.6","Is there an annual schedule of planned Business Resiliency exercises and tests? If yes, do they include:",null,null,null,"K.7 Exercising","?","addressed by 27031",2,null,9,6,0,0,0,0,{"$f":"IF(J98=\"\",\"\",IF(D98=\"\",0,IF(D98=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D98=\"Yes\"),AND($M$1=\"Scaled\",D98>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D98=\"No\"),AND($M$1=\"Scaled\",D98<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2351,"K.9.6.1","Evacuation drills?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,6,1,0,0,0,{"$f":"IF(J99=\"\",\"\",IF(D99=\"\",0,IF(D99=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D99=\"Yes\"),AND($M$1=\"Scaled\",D99>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D99=\"No\"),AND($M$1=\"Scaled\",D99<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2352,"K.9.6.2","Notification procedure and mechanism tests?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,6,2,0,0,0,{"$f":"IF(J100=\"\",\"\",IF(D100=\"\",0,IF(D100=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D100=\"Yes\"),AND($M$1=\"Scaled\",D100>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D100=\"No\"),AND($M$1=\"Scaled\",D100<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2353,"K.9.6.3","Tabletop exercises?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,6,3,0,0,0,{"$f":"IF(J101=\"\",\"\",IF(D101=\"\",0,IF(D101=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D101=\"Yes\"),AND($M$1=\"Scaled\",D101>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D101=\"No\"),AND($M$1=\"Scaled\",D101<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2354,"K.9.6.4","Application recovery tests?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,6,4,0,0,0,{"$f":"IF(J102=\"\",\"\",IF(D102=\"\",0,IF(D102=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D102=\"Yes\"),AND($M$1=\"Scaled\",D102>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D102=\"No\"),AND($M$1=\"Scaled\",D102<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2355,"K.9.6.5","Remote access tests?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,6,5,0,0,0,{"$f":"IF(J103=\"\",\"\",IF(D103=\"\",0,IF(D103=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D103=\"Yes\"),AND($M$1=\"Scaled\",D103>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D103=\"No\"),AND($M$1=\"Scaled\",D103<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2357,"K.9.6.6","Full scale exercises / end-to-end?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,6,6,0,0,0,{"$f":"IF(J104=\"\",\"\",IF(D104=\"\",0,IF(D104=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D104=\"Yes\"),AND($M$1=\"Scaled\",D104>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D104=\"No\"),AND($M$1=\"Scaled\",D104<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4076,"K.9.6.7","Production transaction processing?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,6,7,0,0,0,{"$f":"IF(J105=\"\",\"\",IF(D105=\"\",0,IF(D105=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D105=\"Yes\"),AND($M$1=\"Scaled\",D105>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D105=\"No\"),AND($M$1=\"Scaled\",D105<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4077,"K.9.6.8","Typical business volumes / full capacity?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,6,8,0,0,0,{"$f":"IF(J106=\"\",\"\",IF(D106=\"\",0,IF(D106=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D106=\"Yes\"),AND($M$1=\"Scaled\",D106>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D106=\"No\"),AND($M$1=\"Scaled\",D106<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2762,"K.9.6.9","Business relocation test?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,6,9,0,0,0,{"$f":"IF(J107=\"\",\"\",IF(D107=\"\",0,IF(D107=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D107=\"Yes\"),AND($M$1=\"Scaled\",D107>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D107=\"No\"),AND($M$1=\"Scaled\",D107<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2763,"K.9.6.10","Data center failover test?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,6,10,0,0,0,{"$f":"IF(J108=\"\",\"\",IF(D108=\"\",0,IF(D108=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D108=\"Yes\"),AND($M$1=\"Scaled\",D108>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D108=\"No\"),AND($M$1=\"Scaled\",D108<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2764,"K.9.6.11","Critical service providers included in testing?",null,null,null,"K.7 Exercising",8.5,"Exercising and testing",3,null,9,6,11,0,0,0,{"$f":"IF(J109=\"\",\"\",IF(D109=\"\",0,IF(D109=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D109=\"Yes\"),AND($M$1=\"Scaled\",D109>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D109=\"No\"),AND($M$1=\"Scaled\",D109<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2356,"K.9.6.12","Recovery site tests?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,6,12,0,0,0,{"$f":"IF(J110=\"\",\"\",IF(D110=\"\",0,IF(D110=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D110=\"Yes\"),AND($M$1=\"Scaled\",D110>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D110=\"No\"),AND($M$1=\"Scaled\",D110<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2348,"K.9.6.13","Assessment of the ability to retrieve vital records?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,6,13,0,0,0,{"$f":"IF(J111=\"\",\"\",IF(D111=\"\",0,IF(D111=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D111=\"Yes\"),AND($M$1=\"Scaled\",D111>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D111=\"No\"),AND($M$1=\"Scaled\",D111<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4078,"K.9.6.14","Recovery and continuity of information security controls that may be impacted by a Disaster Recovery event?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,6,14,0,0,0,{"$f":"IF(J112=\"\",\"\",IF(D112=\"\",0,IF(D112=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D112=\"Yes\"),AND($M$1=\"Scaled\",D112>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D112=\"No\"),AND($M$1=\"Scaled\",D112<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4079,"K.9.6.15","Recovery and continuity of information security operational processes and controls that may be impacted by a by a non-Disaster Recovery event (e.g. loss of physical work place, reduction in available IS personnel)?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,6,15,0,0,0,{"$f":"IF(J113=\"\",\"\",IF(D113=\"\",0,IF(D113=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D113=\"Yes\"),AND($M$1=\"Scaled\",D113>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D113=\"No\"),AND($M$1=\"Scaled\",D113<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4080,"K.9.6.16","Recovery and continuity of IT operational processes and controls that may be impacted by a by a non-Disaster Recovery event (e.g. loss of physical work place, reduction in available IT operations personnel)?",null,null,null,"K.7 Exercising","?","addressed by 27031",3,null,9,6,16,0,0,0,{"$f":"IF(J114=\"\",\"\",IF(D114=\"\",0,IF(D114=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D114=\"Yes\"),AND($M$1=\"Scaled\",D114>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D114=\"No\"),AND($M$1=\"Scaled\",D114<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4081,"K.9.7","Do planned exercises strive to increase the effectiveness of exercise scenarios over time?",null,null,null,"K.7 Exercising","N/A",null,2,null,9,7,0,0,0,0,{"$f":"IF(J115=\"\",\"\",IF(D115=\"\",0,IF(D115=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D115=\"Yes\"),AND($M$1=\"Scaled\",D115>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D115=\"No\"),AND($M$1=\"Scaled\",D115<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4082,"K.9.8","Are the results of exercises conducted internally shared with customers?",null,null,null,"K.7 Exercising","N/A",null,2,null,9,8,0,0,0,0,{"$f":"IF(J116=\"\",\"\",IF(D116=\"\",0,IF(D116=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D116=\"Yes\"),AND($M$1=\"Scaled\",D116>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D116=\"No\"),AND($M$1=\"Scaled\",D116<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4083,"K.9.9","Are joint exercises conducted with customers?",null,null,null,"K.7 Exercising","N/A",null,2,null,9,9,0,0,0,0,{"$f":"IF(J117=\"\",\"\",IF(D117=\"\",0,IF(D117=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D117=\"Yes\"),AND($M$1=\"Scaled\",D117>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D117=\"No\"),AND($M$1=\"Scaled\",D117<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4084,"K.9.10","Is there an established exercise scenario addressing cyber resilience? If yes, does it include:",null,null,null,"K.7 Exercising","N/A",null,2,null,9,10,0,0,0,0,{"$f":"IF(J118=\"\",\"\",IF(D118=\"\",0,IF(D118=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D118=\"Yes\"),AND($M$1=\"Scaled\",D118>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D118=\"No\"),AND($M$1=\"Scaled\",D118<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4085,"K.9.10.1","Malware?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,10,1,0,0,0,{"$f":"IF(J119=\"\",\"\",IF(D119=\"\",0,IF(D119=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D119=\"Yes\"),AND($M$1=\"Scaled\",D119>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D119=\"No\"),AND($M$1=\"Scaled\",D119<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4086,"K.9.10.2","Insider Threats?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,10,2,0,0,0,{"$f":"IF(J120=\"\",\"\",IF(D120=\"\",0,IF(D120=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D120=\"Yes\"),AND($M$1=\"Scaled\",D120>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D120=\"No\"),AND($M$1=\"Scaled\",D120<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4087,"K.9.10.3","Data or Systems Destruction and Corruption?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,10,3,0,0,0,{"$f":"IF(J121=\"\",\"\",IF(D121=\"\",0,IF(D121=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D121=\"Yes\"),AND($M$1=\"Scaled\",D121>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D121=\"No\"),AND($M$1=\"Scaled\",D121<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4088,"K.9.10.4","Communications Infrastructure Disruption?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,10,4,0,0,0,{"$f":"IF(J122=\"\",\"\",IF(D122=\"\",0,IF(D122=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D122=\"Yes\"),AND($M$1=\"Scaled\",D122>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D122=\"No\"),AND($M$1=\"Scaled\",D122<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4089,"K.9.10.5","Simultaneous Attack?",null,null,null,"K.7 Exercising","N/A",null,3,null,9,10,5,0,0,0,{"$f":"IF(J123=\"\",\"\",IF(D123=\"\",0,IF(D123=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D123=\"Yes\"),AND($M$1=\"Scaled\",D123>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D123=\"No\"),AND($M$1=\"Scaled\",D123<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2305,"K.10","Is there an Influenza Pandemic / Infectious Disease Outbreak Plan? If yes, does it include:",null,null,null,"K.8 Infectious Disease Planning","N/A",null,1,null,10,0,0,0,0,0,{"$f":"IF(J124=\"\",\"\",IF(D124=\"\",0,IF(D124=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D124=\"Yes\"),AND($M$1=\"Scaled\",D124>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D124=\"No\"),AND($M$1=\"Scaled\",D124<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[2751,"K.10.1","Trigger points for activating proactive and reactive elements of the plan?",null,null,null,"K.8 Infectious Disease Planning","N/A",null,2,null,10,1,0,0,0,0,{"$f":"IF(J125=\"\",\"\",IF(D125=\"\",0,IF(D125=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D125=\"Yes\"),AND($M$1=\"Scaled\",D125>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D125=\"No\"),AND($M$1=\"Scaled\",D125<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2747,"K.10.2","A defined exercise regime aligned with the response strategies and procedures within the plan?",null,null,null,"K.8 Infectious Disease Planning","N/A",null,2,null,10,2,0,0,0,0,{"$f":"IF(J126=\"\",\"\",IF(D126=\"\",0,IF(D126=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D126=\"Yes\"),AND($M$1=\"Scaled\",D126>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D126=\"No\"),AND($M$1=\"Scaled\",D126<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2748,"K.10.3","Verification of critical service provider pandemic / infectious disease procedures?",null,null,null,"K.8 Infectious Disease Planning","N/A",null,2,null,10,3,0,0,0,0,{"$f":"IF(J127=\"\",\"\",IF(D127=\"\",0,IF(D127=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D127=\"Yes\"),AND($M$1=\"Scaled\",D127>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D127=\"No\"),AND($M$1=\"Scaled\",D127<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2749,"K.10.4","Have the business impacts resulting from a pandemic event been identified in the Business Impact Analysis or any threat or risk related assessments?",null,null,null,"K.8 Infectious Disease Planning","N/A",null,2,null,10,4,0,0,0,0,{"$f":"IF(J128=\"\",\"\",IF(D128=\"\",0,IF(D128=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D128=\"Yes\"),AND($M$1=\"Scaled\",D128>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D128=\"No\"),AND($M$1=\"Scaled\",D128<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2752,"K.10.5","Travel and visitor restrictions?",null,null,null,"K.8 Infectious Disease Planning","N/A",null,2,null,10,5,0,0,0,0,{"$f":"IF(J129=\"\",\"\",IF(D129=\"\",0,IF(D129=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D129=\"Yes\"),AND($M$1=\"Scaled\",D129>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D129=\"No\"),AND($M$1=\"Scaled\",D129<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2753,"K.10.6","Cleaning and disinfecting protocols?",null,null,null,"K.8 Infectious Disease Planning","N/A",null,2,null,10,6,0,0,0,0,{"$f":"IF(J130=\"\",\"\",IF(D130=\"\",0,IF(D130=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D130=\"Yes\"),AND($M$1=\"Scaled\",D130>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D130=\"No\"),AND($M$1=\"Scaled\",D130<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2754,"K.10.7","Situation-specific HR policies and procedures?",null,null,null,"K.8 Infectious Disease Planning","N/A",null,2,null,10,7,0,0,0,0,{"$f":"IF(J131=\"\",\"\",IF(D131=\"\",0,IF(D131=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D131=\"Yes\"),AND($M$1=\"Scaled\",D131>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D131=\"No\"),AND($M$1=\"Scaled\",D131<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2755,"K.10.8","Social Distancing criteria / techniques (e.g. work from home, reduction of on-site work force)?",null,null,null,"K.8 Infectious Disease Planning","N/A",null,2,null,10,8,0,0,0,0,{"$f":"IF(J132=\"\",\"\",IF(D132=\"\",0,IF(D132=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D132=\"Yes\"),AND($M$1=\"Scaled\",D132>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D132=\"No\"),AND($M$1=\"Scaled\",D132<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2756,"K.10.9","Personal protective equipment for personnel (e.g. face masks)?",null,null,null,"K.8 Infectious Disease Planning","N/A",null,2,null,10,9,0,0,0,0,{"$f":"IF(J133=\"\",\"\",IF(D133=\"\",0,IF(D133=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D133=\"Yes\"),AND($M$1=\"Scaled\",D133>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D133=\"No\"),AND($M$1=\"Scaled\",D133<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2757,{"$f":"IF(J134=0,\"\",IF(J134=1,Q$1&\".\"&L134,IF(J134=2,Q$1&\".\"&L134&\".\"&M134,IF(J134=3,Q$1&\".\"&L134&\".\"&M134&\".\"&N134,IF(J134=4,Q$1&\".\"&L134&\".\"&M134&\".\"&N134&\".\"&O134,IF(J134=5,Q$1&\".\"&L134&\".\"&M134&\".\"&N134&\".\"&O134&\".\"&P134))))))","v":"K.10.10"},"Special food handling in cafeterias?",null,null,null,"K.8 Infectious Disease Planning","N/A",null,2,null,{"$f":"IF(L133=\"\",1,IF(J134=1,L133+1,L133))","v":10},{"$f":"IF(M133=\"\",0,IF(L133<>L134,0,IF($J134=2,M133+1,M133)))","v":10},{"$f":"IF(N133=\"\",0,IF(M133<>M134,0,IF($J134=3,N133+1,N133)))","v":0},{"$f":"IF(O133=\"\",0,IF(N133<>N134,0,IF($J134=4,O133+1,O133)))","v":0},{"$f":"IF(P133=\"\",0,IF(O133<>O134,0,IF($J134=5,P133+1,P133)))","v":0},{"$f":"IF(OR(Master=\"Master\",J134=0,K134=1),0,IF(ISNA(VLOOKUP(A134,L2_Array,22,FALSE)),0,VLOOKUP(A134,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J134=\"\",\"\",IF(D134=\"\",0,IF(D134=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D134=\"Yes\"),AND($M$1=\"Scaled\",D134>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D134=\"No\"),AND($M$1=\"Scaled\",D134<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J134=\"\",\"\",IF(Q134>0,Q134,IF(R134>0,R134,0)))","v":0},{"$f":"IF(J134=\"\",\"\",IF(OR(J134=1,T133=\"\"),1,IF(OR(AND(K133=1,(J134-J132<>0)),AND(T133=0,J133=J134),AND(K133=1,J134=J132)),0,1)))","v":1},{"$f":"IF(J134=\"\",U133,IF(AND(S134>1,OR(U133=\"\",U133=0,U133>=J134)),J134,IF(J134>U133,U133,0)))","v":0},{"$f":"IF(Master=\"Master\",R134,IF(V133=\"\",S134,IF(OR(AND(U134>0,S134<V133),AND(U134=1,S134<=V133)),V133,S134)))","v":0},{"$f":"IF(J134=\"\",\"\",IF(OR(AND(T133=1,U134=1),S134>0,AND(T135=0,W135=1)),1,0))","v":0},{"$f":"IF(J134=\"\",\"\",IF(OR(AND(U134>0,T134=1),AND(T134=1,W134=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A134,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(J134=1,S134=1),2,IF(AND(V133=1,L134=L133),2,IF(AND(AC133=2,L134=L133),2,IF(J134=1,1,\"\"))))","v":""}]
[2743,"K.10.11","Annual review and update?",null,null,null,"K.8 Infectious Disease Planning","N/A",null,2,null,10,11,0,0,0,0,{"$f":"IF(J135=\"\",\"\",IF(D135=\"\",0,IF(D135=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D135=\"Yes\"),AND($M$1=\"Scaled\",D135>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D135=\"No\"),AND($M$1=\"Scaled\",D135<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2365,"K.11","Is there insurance coverage for business interruptions or general services interruption? If yes, are there:",null,null,null,"K.9 Business Insurance","N/A",null,1,null,11,0,0,0,0,0,{"$f":"IF(J136=\"\",\"\",IF(D136=\"\",0,IF(D136=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D136=\"Yes\"),AND($M$1=\"Scaled\",D136>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D136=\"No\"),AND($M$1=\"Scaled\",D136<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[2366,"K.11.1","Limitations based on the cause of the interruption?",null,null,null,"K.9 Business Insurance","N/A",null,2,null,11,1,0,0,0,0,{"$f":"IF(J137=\"\",\"\",IF(D137=\"\",0,IF(D137=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D137=\"Yes\"),AND($M$1=\"Scaled\",D137>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D137=\"No\"),AND($M$1=\"Scaled\",D137<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[2367,"K.11.2","Insurance coverage for products and services provided to clients?",null,null,null,"K.9 Business Insurance","N/A",null,2,null,11,2,0,0,0,0,{"$f":"IF(J138=\"\",\"\",IF(D138=\"\",0,IF(D138=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D138=\"Yes\"),AND($M$1=\"Scaled\",D138>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D138=\"No\"),AND($M$1=\"Scaled\",D138<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]

{"sheet":"L. Compliance","index":18,"n_rows":44,"n_cols":30,"rows_kept":44,"cut":false,"hidden":false,"merged":[[2,1,2,8]]}
[11,"L. Compliance",null,null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,"Binary","Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"L"}]
[null,null,null,{"$f":"IF(X2=0,\"0%\",X2/T2)","v":"0%"},"Percent Complete",null,"Tab Automation:","Enable",null,{"$f":"COUNTA(J5:J44)","v":40},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(T5:T44,1)","v":40},null,null,null,{"$f":"COUNTIF(X5:X44,1)","v":0}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column F to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, select the word \"Disable\" in the Tab Automation field at the top of the page.\n     - Use the Maturity column to identify the maturity of the question. See the How To Guide for instructions on filling out this field.",null,null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter","Maturity N/A"]
[{"$f":"MAX(A5:A44)","v":4157},"Ques Num","Question/Request","Response","Maturity","Additional Information","AUP Reference","ISO 27002:2013 Relevance"]
[2826,{"$f":"IF(J5=0,\"\",IF(J5=1,Q$1&\".\"&L5,IF(J5=2,Q$1&\".\"&L5&\".\"&M5,IF(J5=3,Q$1&\".\"&L5&\".\"&M5&\".\"&N5,IF(J5=4,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5,IF(J5=5,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5&\".\"&P5))))))","v":"L.1"},"Is there an internal audit, risk management, or compliance department, or other management oversight unit with responsibility for identifying and tracking resolution of outstanding regulatory issues?",null,null,null,"L.3 Monitoring and Reporting - Compliance Requirement Identification","18.1.1 ","Identification of applicable legislation and contractual requirements",1,null,{"$f":"IF(L4=\"\",1,IF(J5=1,L4+1,L4))","v":1},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($J5=2,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($J5=3,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($J5=4,O4+1,O4)))","v":0},{"$f":"IF(P4=\"\",0,IF(O4<>O5,0,IF($J5=5,P4+1,P4)))","v":0},{"$f":"IF(OR(Master=\"Master\",J5=0,K5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,22,FALSE)),0,VLOOKUP(A5,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D5=\"Yes\"),AND($M$1=\"Scaled\",D5>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D5=\"No\"),AND($M$1=\"Scaled\",D5<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J5=\"\",\"\",IF(Q5>0,Q5,IF(R5>0,R5,0)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(J5=1,T4=\"\"),1,IF(OR(AND(K4=1,(J5-J3<>0)),AND(T4=0,J4=J5),AND(K4=1,J5=J3)),0,1)))","v":1},{"$f":"IF(J5=\"\",U4,IF(AND(S5>1,OR(U4=\"\",U4=0,U4>=J5)),J5,IF(J5>U4,U4,0)))","v":0},{"$f":"IF(Master=\"Master\",R5,IF(V4=\"\",S5,IF(OR(AND(U5>0,S5<V4),AND(U5=1,S5<=V4)),V4,S5)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(T4=1,U5=1),S5>0,AND(T6=0,W6=1)),1,0))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(U5>0,T5=1),AND(T5=1,W5=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(J5=1,S5=1),2,IF(AND(V4=1,L5=L4),2,IF(AND(AC4=2,L5=L4),2,IF(J5=1,1,\"\"))))","v":1}]
[4122,{"$f":"IF(J6=0,\"\",IF(J6=1,Q$1&\".\"&L6,IF(J6=2,Q$1&\".\"&L6&\".\"&M6,IF(J6=3,Q$1&\".\"&L6&\".\"&M6&\".\"&N6,IF(J6=4,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6,IF(J6=5,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6&\".\"&P6))))))","v":"L.1.1"},"Does the audit function have independence from the lines of business?",null,null,null,null,"NA",null,2,null,{"$f":"IF(L5=\"\",1,IF(J6=1,L5+1,L5))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($J6=2,M5+1,M5)))","v":1},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($J6=3,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($J6=4,O5+1,O5)))","v":0},{"$f":"IF(P5=\"\",0,IF(O5<>O6,0,IF($J6=5,P5+1,P5)))","v":0},{"$f":"IF(OR(Master=\"Master\",J6=0,K6=1),0,IF(ISNA(VLOOKUP(A6,L2_Array,22,FALSE)),0,VLOOKUP(A6,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D6=\"Yes\"),AND($M$1=\"Scaled\",D6>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D6=\"No\"),AND($M$1=\"Scaled\",D6<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J6=\"\",\"\",IF(Q6>0,Q6,IF(R6>0,R6,0)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(J6=1,T5=\"\"),1,IF(OR(AND(K5=1,(J6-J4<>0)),AND(T5=0,J5=J6),AND(K5=1,J6=J4)),0,1)))","v":1},{"$f":"IF(J6=\"\",U5,IF(AND(S6>1,OR(U5=\"\",U5=0,U5>=J6)),J6,IF(J6>U5,U5,0)))","v":0},{"$f":"IF(Master=\"Master\",R6,IF(V5=\"\",S6,IF(OR(AND(U6>0,S6<V5),AND(U6=1,S6<=V5)),V5,S6)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(T5=1,U6=1),S6>0,AND(T7=0,W7=1)),1,0))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(U6>0,T6=1),AND(T6=1,W6=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A6,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(J6=1,S6=1),2,IF(AND(V5=1,L6=L5),2,IF(AND(AC5=2,L6=L5),2,IF(J6=1,1,\"\"))))","v":""}]
[2376,"L.1.2","Are audits performed to ensure compliance with any legal, regulatory, or industry requirements?",null,null,null,null,"NA","",2,null,1,2,0,0,0,0,{"$f":"IF(J7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D7=\"Yes\"),AND($M$1=\"Scaled\",D7>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D7=\"No\"),AND($M$1=\"Scaled\",D7<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4123,"L.1.3","Are there staff dedicated to compliance and risk responsibilities?",null,null,null,null,"NA",null,2,null,1,3,0,0,0,0,{"$f":"IF(J8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D8=\"Yes\"),AND($M$1=\"Scaled\",D8>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D8=\"No\"),AND($M$1=\"Scaled\",D8<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4124,"L.1.4","Is training to employees on legislative and regulatory requirements provided and updated on a regular basis?",null,null,null,null,"NA",null,2,null,1,4,0,0,0,0,{"$f":"IF(J9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D9=\"Yes\"),AND($M$1=\"Scaled\",D9>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D9=\"No\"),AND($M$1=\"Scaled\",D9<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4125,"L.1.5","Are management reporting or reporting to government agencies maintained in accordance with applicable law?",null,null,null,"L.3 Monitoring and Reporting - Compliance Requirement Identification","NA",null,2,null,1,5,0,0,0,0,{"$f":"IF(J10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D10=\"Yes\"),AND($M$1=\"Scaled\",D10>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D10=\"No\"),AND($M$1=\"Scaled\",D10<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4126,"L.2","Are there policies and procedures to ensure compliance with applicable legislative, regulatory and contractual requirements to address intellectual property rights on business processes or information technology software products?",null,null,null,"L.4 Monitoring and Reporting - Compliance ","NA",null,1,null,2,0,0,0,0,0,{"$f":"IF(J11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D11=\"Yes\"),AND($M$1=\"Scaled\",D11>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D11=\"No\"),AND($M$1=\"Scaled\",D11<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[2837,"L.3","Is there a records retention policy covering paper & electronic records, including email in support of applicable regulations, standards and contractual requirements?",null,null,null,null,"18.1.3 ","Protection of records",1,null,3,0,0,0,0,0,{"$f":"IF(J12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D12=\"Yes\"),AND($M$1=\"Scaled\",D12>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D12=\"No\"),AND($M$1=\"Scaled\",D12<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[4127,"L.4","Is licensing maintained in all jurisdictions where the business is or where licensing is required?",null,null,null,null,"NA",null,1,null,4,0,0,0,0,0,{"$f":"IF(J13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D13=\"Yes\"),AND($M$1=\"Scaled\",D13>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D13=\"No\"),AND($M$1=\"Scaled\",D13<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[3733,"L.5","Is there an internal compliance and ethics program to ensure professional ethics and business practices are implemented?",null,null,null,"A.4 Professional Ethics and Business Practices","NA",null,1,null,5,0,0,0,0,0,{"$f":"IF(J14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D14=\"Yes\"),AND($M$1=\"Scaled\",D14>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D14=\"No\"),AND($M$1=\"Scaled\",D14<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[4128,"L.5.1","Is there an official whistleblowing policy and/or procedure to report compliance issues? ",null,null,null,"A.4 Professional Ethics and Business Practices","NA",null,2,null,5,1,0,0,0,0,{"$f":"IF(J15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D15=\"Yes\"),AND($M$1=\"Scaled\",D15>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D15=\"No\"),AND($M$1=\"Scaled\",D15<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4129,"L.5.2","Are there policies and procedures to address bribery, corruption or the prohibition of providing monetary offers to government officials, corporate representatives?",null,null,null,"A.4 Professional Ethics and Business Practices","NA",null,2,null,5,2,0,0,0,0,{"$f":"IF(J16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D16=\"Yes\"),AND($M$1=\"Scaled\",D16>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D16=\"No\"),AND($M$1=\"Scaled\",D16<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4130,"L.5.3","Are there policies and procedures for corporate governance and public responsibility?",null,null,null,"A.4 Professional Ethics and Business Practices","NA",null,2,null,5,3,0,0,0,0,{"$f":"IF(J17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D17=\"Yes\"),AND($M$1=\"Scaled\",D17>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D17=\"No\"),AND($M$1=\"Scaled\",D17<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4131,"L.5.4","Are there policies and procedures to maintain compliance with international requirements for trade and export?",null,null,null,"A.4 Professional Ethics and Business Practices","NA",null,2,null,5,4,0,0,0,0,{"$f":"IF(J18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D18=\"Yes\"),AND($M$1=\"Scaled\",D18>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D18=\"No\"),AND($M$1=\"Scaled\",D18<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4132,"L.5.5","Are there policies and procedures to address internal/external due diligence of business partners and business initiatives?",null,null,null,"A.4 Professional Ethics and Business Practices","NA",null,2,null,5,5,0,0,0,0,{"$f":"IF(J19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D19=\"Yes\"),AND($M$1=\"Scaled\",D19>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D19=\"No\"),AND($M$1=\"Scaled\",D19<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4133,"L.5.6","Are there defined monitoring and oversight functions for suspected fraud instances or fraud investigation?",null,null,null,"A.4 Professional Ethics and Business Practices","NA",null,2,null,5,6,0,0,0,0,{"$f":"IF(J20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D20=\"Yes\"),AND($M$1=\"Scaled\",D20>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D20=\"No\"),AND($M$1=\"Scaled\",D20<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4134,"L.5.7","Are there mechanisms in place to notify client for suspected or actual fraudulent activity?",null,null,null,"A.4 Professional Ethics and Business Practices","NA",null,2,null,5,7,0,0,0,0,{"$f":"IF(J21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D21=\"Yes\"),AND($M$1=\"Scaled\",D21>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D21=\"No\"),AND($M$1=\"Scaled\",D21<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4135,"L.6","Are marketing or selling activities conducted directly to Client's customers? If yes is/are there:",null,null,null,null,"NA",null,1,null,6,0,0,0,0,0,{"$f":"IF(J22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D22=\"Yes\"),AND($M$1=\"Scaled\",D22>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D22=\"No\"),AND($M$1=\"Scaled\",D22<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1,1]
[4157,"L.6.1","A formal consumer protection compliance program?",null,null,null,null,"NA",null,2,null,6,1,0,0,0,0,{"$f":"IF(J23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D23=\"Yes\"),AND($M$1=\"Scaled\",D23>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D23=\"No\"),AND($M$1=\"Scaled\",D23<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4136,"L.6.2","Training conducted for employees or agents with customer contact on consumer protection compliance responsibilities?",null,null,null,null,"NA",null,2,null,6,2,0,0,0,0,{"$f":"IF(J24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D24=\"Yes\"),AND($M$1=\"Scaled\",D24>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D24=\"No\"),AND($M$1=\"Scaled\",D24<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4137,"L.6.3","Processes in place to review call center scripts or call monitoring to identify compliance issues?",null,null,null,null,"NA",null,2,null,6,3,0,0,0,0,{"$f":"IF(J25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D25=\"Yes\"),AND($M$1=\"Scaled\",D25>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D25=\"No\"),AND($M$1=\"Scaled\",D25<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4138,"L.6.4","An incentive or compensation program for employees or agents directly related to consumer cross-sell or up-sell? If yes describe",null,null,null,null,"NA",null,2,null,6,4,0,0,0,0,{"$f":"IF(J26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D26=\"Yes\"),AND($M$1=\"Scaled\",D26>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D26=\"No\"),AND($M$1=\"Scaled\",D26<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4139,"L.6.5","Training conducted for employees or agents with customer interaction on compliant marketing practices?",null,null,null,null,"NA",null,2,null,6,5,0,0,0,0,{"$f":"IF(J27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D27=\"Yes\"),AND($M$1=\"Scaled\",D27>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D27=\"No\"),AND($M$1=\"Scaled\",D27<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4140,"L.6.6","Policies and procedures to ensure compliance with applicable laws and regulations including Unfair, Deceptive, or Abusive Acts or Practices? ",null,null,null,null,"NA",null,2,null,6,6,0,0,0,0,{"$f":"IF(J28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D28=\"Yes\"),AND($M$1=\"Scaled\",D28>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D28=\"No\"),AND($M$1=\"Scaled\",D28<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4141,"L.7","Are there direct interactions with your client's customers? If yes, is/are there:",null,null,null,null,"NA",null,1,null,7,0,0,0,0,0,{"$f":"IF(J29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D29=\"Yes\"),AND($M$1=\"Scaled\",D29>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D29=\"No\"),AND($M$1=\"Scaled\",D29<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1,1]
[4156,"L.7.1","A formalized complaint management function, including reporting within the organization?",null,null,null,null,null,null,2,null,7,1,0,0,0,0,{"$f":"IF(J30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D30=\"Yes\"),AND($M$1=\"Scaled\",D30>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D30=\"No\"),AND($M$1=\"Scaled\",D30<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4142,"L.7.2","A process to provide periodic summary reports regarding types and resolution of complaints?",null,null,null,null,"NA",null,2,null,7,2,0,0,0,0,{"$f":"IF(J31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D31=\"Yes\"),AND($M$1=\"Scaled\",D31>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D31=\"No\"),AND($M$1=\"Scaled\",D31<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4143,"L.7.3","A process to receive and respond to complaints or request from government agencies, including states attorney generals?",null,null,null,null,"NA",null,2,null,7,3,0,0,0,0,{"$f":"IF(J32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D32=\"Yes\"),AND($M$1=\"Scaled\",D32>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D32=\"No\"),AND($M$1=\"Scaled\",D32<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4144,"L.7.4","Calls recorded for telemarketing purposes or collections purposes?",null,null,null,null,"NA",null,2,null,7,4,0,0,0,0,{"$f":"IF(J33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D33=\"Yes\"),AND($M$1=\"Scaled\",D33>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D33=\"No\"),AND($M$1=\"Scaled\",D33<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4145,"L.7.5","Records retained for consumer complaints?",null,null,null,null,"NA",null,2,null,7,5,0,0,0,0,{"$f":"IF(J34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D34=\"Yes\"),AND($M$1=\"Scaled\",D34>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D34=\"No\"),AND($M$1=\"Scaled\",D34<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4146,"L.7.6","An escalation process to address complaints to management and the client? ",null,null,null,null,"NA",null,2,null,7,6,0,0,0,0,{"$f":"IF(J35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D35=\"Yes\"),AND($M$1=\"Scaled\",D35>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D35=\"No\"),AND($M$1=\"Scaled\",D35<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4147,"L.8","Are policies and procedures maintained for enabling compliance with applicable legal, regulatory, statutory, or contractual obligations related to any information security requirements? ",null,null,null,null,"NA",null,1,null,8,0,0,0,0,0,{"$f":"IF(J36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D36=\"Yes\"),AND($M$1=\"Scaled\",D36>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D36=\"No\"),AND($M$1=\"Scaled\",D36<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[4148,"L.8.1","Are procedures maintained for compliance with log-on banners to inform users of restrictions to access of data?",null,null,null,"L.1 Presence of Log-on Banners","NA",null,2,null,8,1,0,0,0,0,{"$f":"IF(J37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D37=\"Yes\"),AND($M$1=\"Scaled\",D37>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D37=\"No\"),AND($M$1=\"Scaled\",D37<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4149,"L.8.2","Are vulnerability testing and remediation processes maintained to meet information security requirements in accordance with applicable law or industry standards?",null,null,null,"L.2 Technical Compliance Checking - Vulnerability Testing and Remediation","NA",null,2,null,8,2,0,0,0,0,{"$f":"IF(J38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D38=\"Yes\"),AND($M$1=\"Scaled\",D38>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D38=\"No\"),AND($M$1=\"Scaled\",D38<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4150,"L.8.3","Are web site(s) maintained or hosted for the purpose of advertising, offering or managing or servicing accounts, products or services to client?",null,null,null,null,"NA",null,2,null,8,3,0,0,0,0,{"$f":"IF(J39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D39=\"Yes\"),AND($M$1=\"Scaled\",D39>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D39=\"No\"),AND($M$1=\"Scaled\",D39<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4151,"L.9","Is there a formalized governance process to identify and assess changes that could significantly affect the system of internal controls for security, confidentiality and availability?",null,null,null,"L.3 Monitoring and Reporting - Compliance Requirement Identification","NA",null,1,null,9,0,0,0,0,0,{"$f":"IF(J40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D40=\"Yes\"),AND($M$1=\"Scaled\",D40>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D40=\"No\"),AND($M$1=\"Scaled\",D40<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[4152,"L.9.1","Is there a formalized process for receiving, monitoring and where necessary implementing regulatory alerts?",null,null,null,"L.3 Monitoring and Reporting - Compliance Requirement Identification","NA",null,2,null,9,1,0,0,0,0,{"$f":"IF(J41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D41=\"Yes\"),AND($M$1=\"Scaled\",D41>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D41=\"No\"),AND($M$1=\"Scaled\",D41<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4153,"L.9.2","Are regulatory tracking reports maintained?",null,null,null,"L.3 Monitoring and Reporting - Compliance Requirement Identification","NA",null,2,null,9,2,0,0,0,0,{"$f":"IF(J42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D42=\"Yes\"),AND($M$1=\"Scaled\",D42>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D42=\"No\"),AND($M$1=\"Scaled\",D42<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4154,"L.10","Are accounts opened, transactions initiated or other account initiation activity applying payments, taking payments, transferring funds, etc. through either electronic, telephonic, written or in-person requests made on behalf of your client's?",null,null,null,null,"NA",null,1,null,10,0,0,0,0,0,{"$f":"IF(J43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D43=\"Yes\"),AND($M$1=\"Scaled\",D43>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D43=\"No\"),AND($M$1=\"Scaled\",D43<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[4155,"L.10.1","Are customer account activities monitored for unusual or suspicious activity?",null,null,null,null,"NA",null,2,null,10,1,0,0,0,0,{"$f":"IF(J44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D44=\"Yes\"),AND($M$1=\"Scaled\",D44>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D44=\"No\"),AND($M$1=\"Scaled\",D44<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]

{"sheet":"M. Mobile","index":19,"n_rows":56,"n_cols":30,"rows_kept":56,"cut":false,"hidden":false,"merged":[[2,1,2,8]]}
[11,"M. Mobile",null,null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,"Binary","Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"M"}]
[null,null,null,{"$f":"IF(X2=0,\"0%\",X2/T2)","v":"0%"},"Percent Complete",null,"Tab Automation:","Enable",null,{"$f":"COUNTA(J5:J56)","v":52},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(T5:T56,1)","v":43},null,null,null,{"$f":"COUNTIF(X5:X56,1)","v":0}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column F to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, select the word \"Disable\" in the Tab Automation field at the top of the page.\n     - Use the Maturity column to identify the maturity of the question. See the How To Guide for instructions on filling out this field.",null,null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter","Maturity N/A"]
[{"$f":"MAX(A5:A56)","v":4111},"Ques Num","Question/Request","Response","Maturity","Additional Information","AUP Reference","ISO 27002:2013 Relevance",null,null,null,0]
[4090,{"$f":"IF(J5=0,\"\",IF(J5=1,Q$1&\".\"&L5,IF(J5=2,Q$1&\".\"&L5&\".\"&M5,IF(J5=3,Q$1&\".\"&L5&\".\"&M5&\".\"&N5,IF(J5=4,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5,IF(J5=5,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5&\".\"&P5))))))","v":"M.1"},"Are constituents allowed to utilize mobile devices within your environment? If yes, which of the following functions are allowed:",null,null,null,null,null,null,1,null,{"$f":"IF(L4=\"\",1,IF(J5=1,L4+1,L4))","v":1},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($J5=2,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($J5=3,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($J5=4,O4+1,O4)))","v":0},{"$f":"IF(P4=\"\",0,IF(O4<>O5,0,IF($J5=5,P4+1,P4)))","v":0},{"$f":"IF(OR(Master=\"Master\",J5=0,K5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,22,FALSE)),0,VLOOKUP(A5,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D5=\"Yes\"),AND($M$1=\"Scaled\",D5>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D5=\"No\"),AND($M$1=\"Scaled\",D5<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J5=\"\",\"\",IF(Q5>0,Q5,IF(R5>0,R5,0)))","v":0},{"$f":"IF(OR(J5=\"\",J5=0),\"\",IF(OR(J5=1,T4=\"\"),1,IF(OR(AND(K4=1,(J5-J3<>0)),AND(T4=0,J4=J5),AND(K4=1,J5=J3)),0,1)))","v":1},{"$f":"IF(J5=\"\",U4,IF(AND(S5>1,OR(U4=\"\",U4=0,U4>=J5)),J5,IF(J5>U4,U4,0)))","v":0},{"$f":"IF(Master=\"Master\",R5,IF(V4=\"\",S5,IF(OR(AND(U5>0,S5<V4),AND(U5=1,S5<=V4)),V4,S5)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(T4=1,U5=1),S5>0,AND(T6=0,W6=1)),1,0))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(U5>0,T5=1),AND(T5=1,W5=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(J5=1,S5=1),2,IF(AND(V4=1,L5=L4),2,IF(AND(AC4=2,L5=L4),2,IF(J5=1,1,\"\"))))","v":1},1]
[4091,{"$f":"IF(J6=0,\"\",IF(J6=1,Q$1&\".\"&L6,IF(J6=2,Q$1&\".\"&L6&\".\"&M6,IF(J6=3,Q$1&\".\"&L6&\".\"&M6&\".\"&N6,IF(J6=4,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6,IF(J6=5,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6&\".\"&P6))))))","v":"M.1.1"},"View Scoped Data?",null,null,null,null,null,null,2,null,{"$f":"IF(L5=\"\",1,IF(J6=1,L5+1,L5))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($J6=2,M5+1,M5)))","v":1},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($J6=3,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($J6=4,O5+1,O5)))","v":0},{"$f":"IF(P5=\"\",0,IF(O5<>O6,0,IF($J6=5,P5+1,P5)))","v":0},{"$f":"IF(OR(Master=\"Master\",J6=0,K6=1),0,IF(ISNA(VLOOKUP(A6,L2_Array,22,FALSE)),0,VLOOKUP(A6,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D6=\"Yes\"),AND($M$1=\"Scaled\",D6>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D6=\"No\"),AND($M$1=\"Scaled\",D6<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J6=\"\",\"\",IF(Q6>0,Q6,IF(R6>0,R6,0)))","v":0},{"$f":"IF(OR(J6=\"\",J6=0),\"\",IF(OR(J6=1,T5=\"\"),1,IF(OR(AND(K5=1,(J6-J4<>0)),AND(T5=0,J5=J6),AND(K5=1,J6=J4)),0,1)))","v":1},{"$f":"IF(J6=\"\",U5,IF(AND(S6>1,OR(U5=\"\",U5=0,U5>=J6)),J6,IF(J6>U5,U5,0)))","v":0},0,{"$f":"IF(J6=\"\",\"\",IF(OR(AND(T5=1,U6=1),S6>0,AND(T7=0,W7=1)),1,0))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(U6>0,T6=1),AND(T6=1,W6=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A6,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(J6=1,S6=1),2,IF(AND(V5=1,L6=L5),2,IF(AND(AC5=2,L6=L5),2,IF(J6=1,1,\"\"))))","v":""}]
[4092,"M.1.2","Process Scoped Data?",null,null,null,null,null,null,2,null,1,2,0,0,0,0,{"$f":"IF(J7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D7=\"Yes\"),AND($M$1=\"Scaled\",D7>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D7=\"No\"),AND($M$1=\"Scaled\",D7<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,""]
[4093,"M.1.3","Delete Scoped Data?",null,null,null,null,null,null,2,null,1,3,0,0,0,0,{"$f":"IF(J8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D8=\"Yes\"),AND($M$1=\"Scaled\",D8>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D8=\"No\"),AND($M$1=\"Scaled\",D8<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,""]
[4094,"M.1.4","Store Scoped Data?",null,null,null,null,null,null,2,null,1,4,0,0,0,0,{"$f":"IF(J9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D9=\"Yes\"),AND($M$1=\"Scaled\",D9>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D9=\"No\"),AND($M$1=\"Scaled\",D9<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,""]
[3759,"M.2","Are mobile devices allowed to connect to the following:",null,null,null,null,"6.2.1","Mobile device policy",1,1,2,0,0,0,0,0,{"$f":"IF(J10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D10=\"Yes\"),AND($M$1=\"Scaled\",D10>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D10=\"No\"),AND($M$1=\"Scaled\",D10<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,1]
[4095,"M.2.1","Email?",null,null,null,null,null,null,2,null,2,1,0,0,0,0,{"$f":"IF(J11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D11=\"Yes\"),AND($M$1=\"Scaled\",D11>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D11=\"No\"),AND($M$1=\"Scaled\",D11<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[4096,"M.2.2","Scoped Systems and Data?",null,null,null,null,null,null,2,null,2,2,0,0,0,0,{"$f":"IF(J12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D12=\"Yes\"),AND($M$1=\"Scaled\",D12>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D12=\"No\"),AND($M$1=\"Scaled\",D12<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[4097,"M.3","Is there a mobile device management program in place that has been approved by management and communicated to appropriate constituents?",null,null,null,null,null,null,1,null,3,0,0,0,0,0,{"$f":"IF(J13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D13=\"Yes\"),AND($M$1=\"Scaled\",D13>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D13=\"No\"),AND($M$1=\"Scaled\",D13<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[3762,"M.3.1","Are all mobile devices evaluated as part of the IT Risk Management program?",null,null,null,null,"NA",null,2,null,3,1,0,0,0,0,{"$f":"IF(J14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D14=\"Yes\"),AND($M$1=\"Scaled\",D14>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D14=\"No\"),AND($M$1=\"Scaled\",D14<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3763,"M.3.2","Are any of the following mobile device ownership models supported:",null,null,null,null,"6.2.1","Mobile device policy",2,1,3,2,0,0,0,0,{"$f":"IF(J15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D15=\"Yes\"),AND($M$1=\"Scaled\",D15>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D15=\"No\"),AND($M$1=\"Scaled\",D15<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3764,"M.3.2.1","Respondent owned and managed mobile devices? (COPE, CL)",null,null,null,null,"6.2.1","Mobile device policy",3,null,3,2,1,0,0,0,{"$f":"IF(J16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D16=\"Yes\"),AND($M$1=\"Scaled\",D16>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D16=\"No\"),AND($M$1=\"Scaled\",D16<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[3765,"M.3.2.2","Constituent owned (BYOD) and respondent un-managed mobile devices?",null,null,null,null,"6.2.1","Mobile device policy",3,null,3,2,2,0,0,0,{"$f":"IF(J17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D17=\"Yes\"),AND($M$1=\"Scaled\",D17>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D17=\"No\"),AND($M$1=\"Scaled\",D17<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[3766,"M.3.2.3","Constituent owned (BYOD) and respondent managed mobile devices?",null,null,null,null,"6.2.1","Mobile device policy",3,null,3,2,3,0,0,0,{"$f":"IF(J18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D18=\"Yes\"),AND($M$1=\"Scaled\",D18>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D18=\"No\"),AND($M$1=\"Scaled\",D18<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[4098,"M.3.3","Is there a Mobile Device Management solution in place?",null,null,null,null,null,null,2,null,3,3,0,0,0,0,{"$f":"IF(J19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D19=\"Yes\"),AND($M$1=\"Scaled\",D19>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D19=\"No\"),AND($M$1=\"Scaled\",D19<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3773,"M.3.4","Prior to device on-boarding are constituents required to sign an legal agreement which details the obligations and rights related to mobile devices? If yes, does it include:",null,null,null,null,"6.2.1.Section 2.b","Mobile device policy",2,null,3,4,0,0,0,0,{"$f":"IF(J20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D20=\"Yes\"),AND($M$1=\"Scaled\",D20>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D20=\"No\"),AND($M$1=\"Scaled\",D20<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3774,"M.3.4.1","Owner of data on the mobile device?",null,null,null,null,"6.2.1.Section 2.b","Mobile device policy",3,null,3,4,1,0,0,0,{"$f":"IF(J21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D21=\"Yes\"),AND($M$1=\"Scaled\",D21>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D21=\"No\"),AND($M$1=\"Scaled\",D21<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3775,"M.3.4.2","User's responsibility in ensuring the security of the mobile device?",null,null,null,null,"6.2.1","Mobile device policy",3,null,3,4,2,0,0,0,{"$f":"IF(J22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D22=\"Yes\"),AND($M$1=\"Scaled\",D22>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D22=\"No\"),AND($M$1=\"Scaled\",D22<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4099,"M.3.4.3","Security requirements for Scoped Systems and Data will override user's personal use?",null,null,null,null,null,null,3,null,3,4,3,0,0,0,{"$f":"IF(J23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D23=\"Yes\"),AND($M$1=\"Scaled\",D23>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D23=\"No\"),AND($M$1=\"Scaled\",D23<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3782,"M.3.4.4","Support roles and responsibilities",null,null,null,null,"NA",null,3,null,3,4,4,0,0,0,{"$f":"IF(J24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D24=\"Yes\"),AND($M$1=\"Scaled\",D24>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D24=\"No\"),AND($M$1=\"Scaled\",D24<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3778,"M.3.5","In the event of a data compromise investigation, have procedures been implemented to do the following:",null,null,null,null,"NA",null,2,1,3,5,0,0,0,0,{"$f":"IF(J25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D25=\"Yes\"),AND($M$1=\"Scaled\",D25>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D25=\"No\"),AND($M$1=\"Scaled\",D25<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3779,"M.3.5.1","Remotely wipe the mobile device?",null,null,null,null,"NA",null,3,null,3,5,1,0,0,0,{"$f":"IF(J26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D26=\"Yes\"),AND($M$1=\"Scaled\",D26>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D26=\"No\"),AND($M$1=\"Scaled\",D26<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[3780,"M.3.5.2","Remotely access Scoped Data on the mobile?",null,null,null,null,"NA",null,3,null,3,5,2,0,0,0,{"$f":"IF(J27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D27=\"Yes\"),AND($M$1=\"Scaled\",D27>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D27=\"No\"),AND($M$1=\"Scaled\",D27<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[3781,"M.3.5.3","Physically access Scoped Data on the mobile device?",null,null,null,null,"NA",null,3,null,3,5,3,0,0,0,{"$f":"IF(J28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D28=\"Yes\"),AND($M$1=\"Scaled\",D28>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D28=\"No\"),AND($M$1=\"Scaled\",D28<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[4111,"M.3.5.4","Perform a forensic analysis on the mobile device?",null,null,null,null,"NA",null,3,null,3,5,4,0,0,0,{"$f":"IF(J29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D29=\"Yes\"),AND($M$1=\"Scaled\",D29>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D29=\"No\"),AND($M$1=\"Scaled\",D29<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,"",1]
[3783,"M.3.6","Is there an approved process to support the mobile device lifecycle? If yes, does it include:",null,null,null,null,"6.2.1.a","Mobile device policy",2,null,3,6,0,0,0,0,{"$f":"IF(J30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D30=\"Yes\"),AND($M$1=\"Scaled\",D30>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D30=\"No\"),AND($M$1=\"Scaled\",D30<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3784,"M.3.6.1","On-boarding mobile devices?",null,null,null,null,"6.2.1.a","Mobile device policy",3,null,3,6,1,0,0,0,{"$f":"IF(J31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D31=\"Yes\"),AND($M$1=\"Scaled\",D31>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D31=\"No\"),AND($M$1=\"Scaled\",D31<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3785,"M.3.6.2","Off-boarding mobile devices?",null,null,null,null,"6.2.1.a","Mobile device policy",3,null,3,6,2,0,0,0,{"$f":"IF(J32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D32=\"Yes\"),AND($M$1=\"Scaled\",D32>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D32=\"No\"),AND($M$1=\"Scaled\",D32<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3786,"M.3.6.3","Asset Tracking against the mobile devices each constituent is permitted to connect with?",null,null,null,null,"NA",null,3,null,3,6,3,0,0,0,{"$f":"IF(J33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D33=\"Yes\"),AND($M$1=\"Scaled\",D33>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D33=\"No\"),AND($M$1=\"Scaled\",D33<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3787,"M.3.7","Is there an approved process for IT to off-board mobile devices when a constituent terminates, or requests to on-board a new mobile device? If yes, does it:",null,null,null,null,"NA",null,2,null,3,7,0,0,0,0,{"$f":"IF(J34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D34=\"Yes\"),AND($M$1=\"Scaled\",D34>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D34=\"No\"),AND($M$1=\"Scaled\",D34<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3788,"M.3.7.1","Identify if the constituent has any legacy devices accessing Scoped Systems and Data?",null,null,null,null,"NA",null,3,null,3,7,1,0,0,0,{"$f":"IF(J35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D35=\"Yes\"),AND($M$1=\"Scaled\",D35>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D35=\"No\"),AND($M$1=\"Scaled\",D35<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3789,"M.3.7.2","Confirm that Scoped Data, respondent settings and accounts have been removed from the legacy mobile device?",null,null,null,null,"NA",null,3,null,3,7,2,0,0,0,{"$f":"IF(J36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D36=\"Yes\"),AND($M$1=\"Scaled\",D36>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D36=\"No\"),AND($M$1=\"Scaled\",D36<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4100,"M.3.8","Is the identity management system (directory services) integrated with mobile infrastructure to support people joining/leaving/changing roles in the enterprise?",null,null,null,null,null,null,2,null,3,8,0,0,0,0,{"$f":"IF(J37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D37=\"Yes\"),AND($M$1=\"Scaled\",D37>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D37=\"No\"),AND($M$1=\"Scaled\",D37<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,{"$f":"IF(Master=\"Master\",R37,IF(V36=\"\",S37,IF(OR(AND(U37>0,S37<V36),AND(U37=1,S37<=V36)),V36,S37)))","v":0},0,0,0,null,null,null,""]
[4101,"M.3.9","Is Mobile Device Management subject to an internal or external audit?",null,null,null,null,null,null,2,null,3,9,0,0,0,0,{"$f":"IF(J38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D38=\"Yes\"),AND($M$1=\"Scaled\",D38>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D38=\"No\"),AND($M$1=\"Scaled\",D38<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3823,"M.3.10","Are there approved mobile operating system versions permitted to connect to the respondent's environment? ",null,null,null,null,"6.2.1","Mobile device policy",2,null,3,10,0,0,0,0,{"$f":"IF(J39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D39=\"Yes\"),AND($M$1=\"Scaled\",D39>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D39=\"No\"),AND($M$1=\"Scaled\",D39<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3824,"M.3.10.1","Are mobile operating system versions that are deemed end of life permitted to connect to Scoped Systems and Data?",null,null,null,null,"6.2.1","Mobile device policy",3,null,3,10,1,0,0,0,{"$f":"IF(J40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D40=\"Yes\"),AND($M$1=\"Scaled\",D40>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D40=\"No\"),AND($M$1=\"Scaled\",D40<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3825,"M.3.11","Are constituents permitted to create and activate mobile hotspots? (Bring Your Own Network, BYON).",null,null,null,null,"6.2.1","Mobile device policy",2,null,3,11,0,0,0,0,{"$f":"IF(J41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D41=\"Yes\"),AND($M$1=\"Scaled\",D41>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D41=\"No\"),AND($M$1=\"Scaled\",D41<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3826,"M.3.12","Are mobile applications that access Scoped Systems and Data developed?",null,null,null,null,"NA",null,2,null,3,12,0,0,0,0,{"$f":"IF(J42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D42=\"Yes\"),AND($M$1=\"Scaled\",D42>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D42=\"No\"),AND($M$1=\"Scaled\",D42<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3829,"M.3.12.1","Are any actions performed by the application to Scoped Systems or Data? If yes, what are they:",null,null,null,null,"NA",null,3,null,3,12,1,0,0,0,{"$f":"IF(J43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D43=\"Yes\"),AND($M$1=\"Scaled\",D43>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D43=\"No\"),AND($M$1=\"Scaled\",D43<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3830,"M.3.12.1.1","Access?",null,null,null,null,"NA",null,4,null,3,12,1,1,0,0,{"$f":"IF(J44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D44=\"Yes\"),AND($M$1=\"Scaled\",D44>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D44=\"No\"),AND($M$1=\"Scaled\",D44<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3831,"M.3.12.1.2","Process?",null,null,null,null,"NA",null,4,null,3,12,1,2,0,0,{"$f":"IF(J45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D45=\"Yes\"),AND($M$1=\"Scaled\",D45>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D45=\"No\"),AND($M$1=\"Scaled\",D45<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3832,"M.3.12.1.3","Transmit?",null,null,null,null,"NA",null,4,null,3,12,1,3,0,0,{"$f":"IF(J46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D46=\"Yes\"),AND($M$1=\"Scaled\",D46>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D46=\"No\"),AND($M$1=\"Scaled\",D46<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3833,"M.3.12.1.4","Store locally?",null,null,null,null,"NA",null,4,null,3,12,1,4,0,0,{"$f":"IF(J47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D47=\"Yes\"),AND($M$1=\"Scaled\",D47>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D47=\"No\"),AND($M$1=\"Scaled\",D47<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4102,"M.3.13","Is Dynamic code analysis performed (including fuzzing)? ",null,null,null,null,null,null,2,null,3,13,0,0,0,0,{"$f":"IF(J48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D48=\"Yes\"),AND($M$1=\"Scaled\",D48>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D48=\"No\"),AND($M$1=\"Scaled\",D48<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4103,"M.3.14","Is there a standard mobile development framework?",null,null,null,null,null,null,2,null,3,14,0,0,0,0,{"$f":"IF(J49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D49=\"Yes\"),AND($M$1=\"Scaled\",D49>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D49=\"No\"),AND($M$1=\"Scaled\",D49<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4104,"M.3.15","Is threat modeling performed as part of the Mobile SDLC process?",null,null,null,null,null,null,2,null,3,15,0,0,0,0,{"$f":"IF(J50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D50=\"Yes\"),AND($M$1=\"Scaled\",D50>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D50=\"No\"),AND($M$1=\"Scaled\",D50<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4105,"M.3.16","Are anti-tamper or code obfuscation employed for mobile apps?",null,null,null,null,null,null,2,null,3,16,0,0,0,0,{"$f":"IF(J51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D51=\"Yes\"),AND($M$1=\"Scaled\",D51>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D51=\"No\"),AND($M$1=\"Scaled\",D51<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4106,"M.3.17","Is certificate or public pinning implemented?",null,null,null,null,null,null,2,null,3,17,0,0,0,0,{"$f":"IF(J52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D52=\"Yes\"),AND($M$1=\"Scaled\",D52>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D52=\"No\"),AND($M$1=\"Scaled\",D52<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4107,"M.3.18","Do push notifications contain only \"public\" information? ",null,null,null,null,null,null,2,null,3,18,0,0,0,0,{"$f":"IF(J53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D53=\"Yes\"),AND($M$1=\"Scaled\",D53>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D53=\"No\"),AND($M$1=\"Scaled\",D53<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4108,"M.3.19","Are biometrics used?",null,null,null,null,null,null,2,null,3,19,0,0,0,0,{"$f":"IF(J54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D54=\"Yes\"),AND($M$1=\"Scaled\",D54>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D54=\"No\"),AND($M$1=\"Scaled\",D54<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4109,"M.3.19.1"," Is biometric data secure/protect to ensure only appropriate use?",null,null,null,null,null,null,3,null,3,19,1,0,0,0,{"$f":"IF(J55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D55=\"Yes\"),AND($M$1=\"Scaled\",D55>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D55=\"No\"),AND($M$1=\"Scaled\",D55<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4110,"M.3.20","Are risk-based authentication or fraud detection/prevention capability used?",null,null,null,null,null,null,2,null,3,20,0,0,0,0,{"$f":"IF(J56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D56=\"Yes\"),AND($M$1=\"Scaled\",D56>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D56=\"No\"),AND($M$1=\"Scaled\",D56<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]

{"sheet":"P. Privacy","index":20,"n_rows":54,"n_cols":30,"rows_kept":54,"cut":false,"hidden":false,"merged":[[2,1,2,8]]}
[11,"P. Privacy",null,null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,"Binary","Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"P"}]
[null,null,null,{"$f":"IF(X2=0,\"0%\",X2/T2)","v":"0%"},"Percent Complete",null,"Tab Automation:","Enable",null,{"$f":"COUNTA(J5:J54)","v":50},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(T5:T54,1)","v":50},null,null,null,{"$f":"COUNTIF(X5:X54,1)","v":0}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column F to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, select the word \"Disable\" in the Tab Automation field at the top of the page.\n     - Use the Maturity column to identify the maturity of the question. See the How To Guide for instructions on filling out this field.",null,null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter","Maturity N/A"]
[{"$f":"MAX(A5:A54)","v":3864},"Ques Num","Question/Request","Response","Maturity","Additional Information","AUP Reference","ISO 27002:2013 Relevance",null,null,null,0]
[3687,{"$f":"IF(J5=0,\"\",IF(J5=1,Q$1&\".\"&L5,IF(J5=2,Q$1&\".\"&L5&\".\"&M5,IF(J5=3,Q$1&\".\"&L5&\".\"&M5&\".\"&N5,IF(J5=4,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5,IF(J5=5,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5&\".\"&P5))))))","v":"P.1"},"Is Scoped Data transmitted, processed, or stored that can be classified as non-public information (NPI), personally identifiable information (PII), or sensitive customer financial information? If yes, describe and list types of data:",null,null,null,null,"8.2.1","Classification of Information",1,null,{"$f":"IF(L4=\"\",1,IF(J5=1,L4+1,L4))","v":1},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($J5=2,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($J5=3,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($J5=4,O4+1,O4)))","v":0},{"$f":"IF(P4=\"\",0,IF(O4<>O5,0,IF($J5=5,P4+1,P4)))","v":0},{"$f":"IF(OR(Master=\"Master\",J5=0,K5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,22,FALSE)),0,VLOOKUP(A5,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D5=\"Yes\"),AND($M$1=\"Scaled\",D5>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D5=\"No\"),AND($M$1=\"Scaled\",D5<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J5=\"\",\"\",IF(Q5>0,Q5,IF(R5>0,R5,0)))","v":0},{"$f":"IF(OR(J5=\"\",J5=0),\"\",IF(OR(J5=1,T4=\"\"),1,IF(OR(AND(K4=1,(J5-J3<>0)),AND(T4=0,J4=J5),AND(K4=1,J5=J3)),0,1)))","v":1},{"$f":"IF(J5=\"\",U4,IF(AND(S5>1,OR(U4=\"\",U4=0,U4>=J5)),J5,IF(J5>U4,U4,0)))","v":0},{"$f":"IF(Master=\"Master\",R5,IF(V4=\"\",S5,IF(OR(AND(U5>0,S5<V4),AND(U5=1,S5<=V4)),V4,S5)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(T4=1,U5=1),S5>0,AND(T6=0,W6=1)),1,0))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(U5>0,T5=1),AND(T5=1,W5=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(J5=1,S5=1),2,IF(AND(V4=1,L5=L4),2,IF(AND(AC4=2,L5=L4),2,IF(J5=1,1,\"\"))))","v":1}]
[3221,{"$f":"IF(J6=0,\"\",IF(J6=1,Q$1&\".\"&L6,IF(J6=2,Q$1&\".\"&L6&\".\"&M6,IF(J6=3,Q$1&\".\"&L6&\".\"&M6&\".\"&N6,IF(J6=4,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6,IF(J6=5,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6&\".\"&P6))))))","v":"P.1.1"},"Is there a documented data protection program with administrative, technical, and physical safeguards for the protection of Scoped Data?",null,null,null,"P.6 Management of Client Scoped Privacy Data","NA",null,2,null,{"$f":"IF(L5=\"\",1,IF(J6=1,L5+1,L5))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($J6=2,M5+1,M5)))","v":1},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($J6=3,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($J6=4,O5+1,O5)))","v":0},{"$f":"IF(P5=\"\",0,IF(O5<>O6,0,IF($J6=5,P5+1,P5)))","v":0},0,{"$f":"IF(J6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D6=\"Yes\"),AND($M$1=\"Scaled\",D6>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D6=\"No\"),AND($M$1=\"Scaled\",D6<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J6=\"\",\"\",IF(Q6>0,Q6,IF(R6>0,R6,0)))","v":0},1,{"$f":"IF(J6=\"\",U5,IF(AND(S6>1,OR(U5=\"\",U5=0,U5>=J6)),J6,IF(J6>U5,U5,0)))","v":0},{"$f":"IF(Master=\"Master\",R6,IF(V5=\"\",S6,IF(OR(AND(U6>0,S6<V5),AND(U6=1,S6<=V5)),V5,S6)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(T5=1,U6=1),S6>0,AND(T7=0,W7=1)),1,0))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(U6>0,T6=1),AND(T6=1,W6=1)),1,0))","v":0},0,null,null,null,{"$f":"IF(AND(J6=1,S6=1),2,IF(AND(V5=1,L6=L5),2,IF(AND(AC5=2,L6=L5),2,IF(J6=1,1,\"\"))))","v":""}]
[3234,"P.1.2","Is a response program maintained that includes policies and procedures to address privacy incidents, unauthorized disclosure, unauthorized access or breach of Scoped Data?",null,null,null,"P.8 Privacy Event Notification and Response Management",16.100000000000001,"Management of information security incidents and improvements",2,null,1,2,0,0,0,0,{"$f":"IF(J7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D7=\"Yes\"),AND($M$1=\"Scaled\",D7>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D7=\"No\"),AND($M$1=\"Scaled\",D7<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,""]
[3690,"P.1.3","Do agreements with third parties who have access to Scoped Data, address confidentiality, audit, security, and privacy, including but not limited to incident response, ongoing monitoring, data sharing and secure disposal of Scoped Data?",null,null,null,"P.4 Privacy Third Party Agreements","15.1.2 ","Addressing security within supplier agreements",2,null,1,3,0,0,0,0,{"$f":"IF(J8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D8=\"Yes\"),AND($M$1=\"Scaled\",D8>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D8=\"No\"),AND($M$1=\"Scaled\",D8<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3691,"P.1.4","Are processes maintained to ensure the proper disposal of Scoped Data? If yes, describe.",null,null,null,null,"8.3.2 ","Disposal of media",2,null,1,4,0,0,0,0,{"$f":"IF(J9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D9=\"Yes\"),AND($M$1=\"Scaled\",D9>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D9=\"No\"),AND($M$1=\"Scaled\",D9<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3692,"P.1.5","Is there a process to limit or prevent the sharing of Scoped Data with affiliates unless authorized?",null,null,null,"P.6 Management of Client Scoped Privacy Data","8.2.3 ","Handling of assets",2,null,1,5,0,0,0,0,{"$f":"IF(J10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D10=\"Yes\"),AND($M$1=\"Scaled\",D10>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D10=\"No\"),AND($M$1=\"Scaled\",D10<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3284,"P.1.6","Is there a process to provide notification as required by regulatory authorities or law enforcement, to address incidents of unauthorized access or breach of Scoped Data?",null,null,null,"P.8 Privacy Event Notification and Response Management","16.1.2 ","Reporting information security events",2,null,1,6,0,0,0,0,{"$f":"IF(J11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D11=\"Yes\"),AND($M$1=\"Scaled\",D11>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D11=\"No\"),AND($M$1=\"Scaled\",D11<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3857,"P.1.7","For services provided on behalf of client that include direct interaction with client's customers are processes in place to log and report privacy complaints?",null,null,null,"P.4 Privacy Third Party Agreements","NA",null,2,null,1,7,0,0,0,0,{"$f":"IF(J12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D12=\"Yes\"),AND($M$1=\"Scaled\",D12>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D12=\"No\"),AND($M$1=\"Scaled\",D12<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3694,"P.2","Is Scoped Data transmitted, processed, or stored that can be classified as Protected Health Information (PHI), electronic health records, or personal health records of a covered entity? If yes, identify the classifications.",null,null,null,null,"8.2.1","Classification of Information",1,null,2,0,0,0,0,0,{"$f":"IF(J13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D13=\"Yes\"),AND($M$1=\"Scaled\",D13>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D13=\"No\"),AND($M$1=\"Scaled\",D13<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1,1]
[3858,"P.2.1"," Is PHI accessed, transmitted, processed or stored?",null,null,null,null,"NA",null,2,null,2,1,0,0,0,0,{"$f":"IF(J14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D14=\"Yes\"),AND($M$1=\"Scaled\",D14>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D14=\"No\"),AND($M$1=\"Scaled\",D14<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[3696,"P.2.2","Are there documented policies and procedures to detect and report unauthorized acquisition, use, or disclosure of PHI? If yes, describe.",null,null,null,"P.8 Privacy Event Notification and Response Management","16.1.2 ","Reporting information security events",2,null,2,2,0,0,0,0,{"$f":"IF(J15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D15=\"Yes\"),AND($M$1=\"Scaled\",D15>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D15=\"No\"),AND($M$1=\"Scaled\",D15<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3697,"P.2.3","Are there contractual provisions, and control mechanisms to ensure that privacy and security obligations of the respondent extend to the respondents suppliers, vendors, or subcontractors?",null,null,null,"P.4 Privacy Third Party Agreements","15.1.2 ","Addressing security within supplier agreements",2,null,2,3,0,0,0,0,{"$f":"IF(J16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D16=\"Yes\"),AND($M$1=\"Scaled\",D16>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D16=\"No\"),AND($M$1=\"Scaled\",D16<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3698,"P.2.4","Are there documented procedures for availability of access to PHI data or designated record set maintained by the respondent?",null,null,null,"P.6 Management of Client Scoped Privacy Data","8.2.3 ","Handling of assets",2,null,2,4,0,0,0,0,{"$f":"IF(J17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D17=\"Yes\"),AND($M$1=\"Scaled\",D17>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D17=\"No\"),AND($M$1=\"Scaled\",D17<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3699,"P.2.5","Are there documented procedures to enable the ability to reasonably amend PHI maintained by the respondent upon request?",null,null,null,"P.4 Privacy Third Party Agreements","NA",null,2,null,2,5,0,0,0,0,{"$f":"IF(J18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D18=\"Yes\"),AND($M$1=\"Scaled\",D18>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D18=\"No\"),AND($M$1=\"Scaled\",D18<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3700,"P.2.6","Are there logs or records of disclosures of PHI that can be provided upon request?",null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","8.2.3.b","Handling of assets",2,null,2,6,0,0,0,0,{"$f":"IF(J19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D19=\"Yes\"),AND($M$1=\"Scaled\",D19>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D19=\"No\"),AND($M$1=\"Scaled\",D19<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3701,"P.2.7","Is a business associate contract in place to address obligations for the privacy and security requirements for the services provided?",null,null,null,"P.4 Privacy Third Party Agreements","15.1.2 ","Addressing security within supplier agreements",2,null,2,7,0,0,0,0,{"$f":"IF(J20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D20=\"Yes\"),AND($M$1=\"Scaled\",D20>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D20=\"No\"),AND($M$1=\"Scaled\",D20<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,""]
[3702,"P.2.8","Are there training logs for employees with access to client PHI to meet the privacy and security obligations required by HIPAA? If yes, describe.",null,null,null,"P.7 Privacy Awareness","7.2.2 ","Information security awareness, education and training",2,null,2,8,0,0,0,0,{"$f":"IF(J21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D21=\"Yes\"),AND($M$1=\"Scaled\",D21>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D21=\"No\"),AND($M$1=\"Scaled\",D21<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3703,"P.2.9","Is there a documented process to provide notification as required by regulatory authorities or law enforcement, to address incidents of unauthorized access or breach of protected health information?",null,null,null,"P.8 Privacy Event Notification and Response Management","16.1.1.b.3 ","Responsibilities and procedures",2,null,2,9,0,0,0,0,{"$f":"IF(J22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D22=\"Yes\"),AND($M$1=\"Scaled\",D22>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D22=\"No\"),AND($M$1=\"Scaled\",D22<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3704,"P.3","For Scoped Data, is personal information about individuals transmitted to or received from countries outside the United States? If yes, list the countries.",null,null,null,null,"NA",null,1,null,3,0,0,0,0,0,{"$f":"IF(J23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D23=\"Yes\"),AND($M$1=\"Scaled\",D23>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D23=\"No\"),AND($M$1=\"Scaled\",D23<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1,1]
[3859,"P.3.1","Is information directly collected and used about individuals?",null,null,null,null,"NA",null,2,null,3,1,0,0,0,0,{"$f":"IF(J24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D24=\"Yes\"),AND($M$1=\"Scaled\",D24>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D24=\"No\"),AND($M$1=\"Scaled\",D24<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3239,"P.3.2","Are notices provided when information is directly collected from an individual? If yes, describe.",null,null,null,"P.2 Privacy Policy and Privacy Notices","NA",null,2,null,3,2,0,0,0,0,{"$f":"IF(J25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D25=\"Yes\"),AND($M$1=\"Scaled\",D25>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D25=\"No\"),AND($M$1=\"Scaled\",D25<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3707,"P.3.3","Are there documented operating procedures regarding limiting personal data collection and use?",null,null,null,null,"8.2.3 ","Handling of assets",2,null,3,3,0,0,0,0,{"$f":"IF(J26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D26=\"Yes\"),AND($M$1=\"Scaled\",D26>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D26=\"No\"),AND($M$1=\"Scaled\",D26<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3708,"P.3.4","Are there operating procedures for onward transfer of customer information? If yes, describe.",null,null,null,null,"13.2.1","Information transfer policies and procedures",2,null,3,4,0,0,0,0,{"$f":"IF(J27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D27=\"Yes\"),AND($M$1=\"Scaled\",D27>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D27=\"No\"),AND($M$1=\"Scaled\",D27<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3709,"P.3.5","Is Safe Harbor status maintained with the Department of Commerce with respect to the data protection applicable to the European Union?",null,null,null,"P.5 Legal Authorizations","NA",null,2,null,3,5,0,0,0,0,{"$f":"IF(J28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D28=\"Yes\"),AND($M$1=\"Scaled\",D28>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D28=\"No\"),AND($M$1=\"Scaled\",D28<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3254,"P.3.6","If customer data is directly collected from individuals, does the customer have the ability to opt out? ",null,null,null,null,"NA",null,2,null,3,6,0,0,0,0,{"$f":"IF(J29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D29=\"Yes\"),AND($M$1=\"Scaled\",D29>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D29=\"No\"),AND($M$1=\"Scaled\",D29<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3263,"P.3.7","If customer data of individuals is retained, are there processes and procedures to enable individuals to access, correct, amend, or delete inaccurate information?",null,null,null,null,"8.2.3 ","Handling of assets",2,null,3,7,0,0,0,0,{"$f":"IF(J30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D30=\"Yes\"),AND($M$1=\"Scaled\",D30>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D30=\"No\"),AND($M$1=\"Scaled\",D30<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3228,"P.3.8","Is there privacy awareness training provided to constituents regarding their obligation to data protection?",null,null,null,"P.7 Privacy Awareness","7.2.2 ","Information security awareness, education and training",2,null,3,8,0,0,0,0,{"$f":"IF(J31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D31=\"Yes\"),AND($M$1=\"Scaled\",D31>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D31=\"No\"),AND($M$1=\"Scaled\",D31<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,""]
[3713,"P.3.9","Are there documented procedures for cross border data flows of customer data to the US from other countries. If yes, list the countries:",null,null,null,"P.2 Privacy Policy and Privacy Notices","NA",null,2,null,3,9,0,0,0,0,{"$f":"IF(J32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D32=\"Yes\"),AND($M$1=\"Scaled\",D32>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D32=\"No\"),AND($M$1=\"Scaled\",D32<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3714,"P.3.10","Is there a documented response program with policies and procedures to address privacy incidents, unauthorized disclosure, unauthorized access or breach of Scoped Data?",null,null,null,"P.8 Privacy Event Notification and Response Management","16.1.1 ","Responsibilities and procedures",2,null,3,10,0,0,0,0,{"$f":"IF(J33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D33=\"Yes\"),AND($M$1=\"Scaled\",D33>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D33=\"No\"),AND($M$1=\"Scaled\",D33<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3715,"P.4","Is personal information disclosed to or retained by third parties? If yes, describe.",null,null,null,null,15,"Supplier Relationships",1,null,4,0,0,0,0,0,{"$f":"IF(J34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D34=\"Yes\"),AND($M$1=\"Scaled\",D34>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D34=\"No\"),AND($M$1=\"Scaled\",D34<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1,1]
[3270,"P.4.1","Are there contractual controls to ensure that personal information shared with third parties is limited to defined parameters for access, use and disclosure? If yes, describe. If no, explain reason.",null,null,null,"P.4 Privacy Third Party Agreements","15.1.2 ","Addressing security within supplier agreements",2,null,4,1,0,0,0,0,{"$f":"IF(J35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D35=\"Yes\"),AND($M$1=\"Scaled\",D35>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D35=\"No\"),AND($M$1=\"Scaled\",D35<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,""]
[3269,"P.4.2","Is personal information accessed, disclosed, processed, transmitted or retained with third parties outside the US? If yes, describe and list the countries.",null,null,null,null,15,"Supplier Relationships",2,null,4,2,0,0,0,0,{"$f":"IF(J36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D36=\"Yes\"),AND($M$1=\"Scaled\",D36>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D36=\"No\"),AND($M$1=\"Scaled\",D36<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,""]
[3718,"P.5","Is there a documented privacy policy or procedures for the protection of information transmitted, processed, or maintained on behalf of the client?",null,null,null,"P.2 Privacy Policy and Privacy Notices","15.1.1","Information security policy for supplier relationships",1,null,5,0,0,0,0,{"$f":"IF(OR(Master=\"Master\",J37=0,K37=1),0,IF(ISNA(VLOOKUP(A37,L2_Array,22,FALSE)),0,VLOOKUP(A37,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D37=\"Yes\"),AND($M$1=\"Scaled\",D37>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D37=\"No\"),AND($M$1=\"Scaled\",D37<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,{"$f":"IF(ISNA(VLOOKUP(A37,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,1]
[3224,"P.5.1","Are privacy policies and procedures reviewed and revised at least annually? ",null,null,null,"P.3 Privacy Organization and Program Maintenance","15.1.1.e","Information security policy for supplier relationships",2,null,5,1,0,0,0,0,{"$f":"IF(J38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D38=\"Yes\"),AND($M$1=\"Scaled\",D38>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D38=\"No\"),AND($M$1=\"Scaled\",D38<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3225,"P.6","Are there regular privacy risk assessments conducted? If yes, provide frequency and scope. If no, explain reason.",null,null,null,"P.3 Privacy Organization and Program Maintenance","15.1.3.i ","Information and communication technology supply chain",1,null,6,0,0,0,0,0,{"$f":"IF(J39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D39=\"Yes\"),AND($M$1=\"Scaled\",D39>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D39=\"No\"),AND($M$1=\"Scaled\",D39<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[3226,"P.6.1","Are identified privacy risks and associated mitigation plans formally documented and reviewed by management?",null,null,null,"P.3 Privacy Organization and Program Maintenance","15.1.1.l","Information security policy for supplier relationships",2,null,6,1,0,0,0,0,{"$f":"IF(J40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D40=\"Yes\"),AND($M$1=\"Scaled\",D40>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D40=\"No\"),AND($M$1=\"Scaled\",D40<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3227,"P.6.2","Are reasonable resources (in time and money) allocated to mitigating identified privacy risks?",null,null,null,null,"NA",null,2,null,6,2,0,0,0,0,{"$f":"IF(J41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D41=\"Yes\"),AND($M$1=\"Scaled\",D41>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D41=\"No\"),AND($M$1=\"Scaled\",D41<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3723,"P.7","Is there a data classification retention program that identifies the data types that require additional management and governance?",null,null,null,"P.1 Scoped Privacy Data Inventory and Flows",8.1999999999999993,"Information Classification",1,null,7,0,0,0,0,0,{"$f":"IF(J42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D42=\"Yes\"),AND($M$1=\"Scaled\",D42>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D42=\"No\"),AND($M$1=\"Scaled\",D42<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1]
[3724,"P.7.1","Are there documented policies, procedures, and controls to limit access based on need to know or minimum necessary for constituents? If yes, describe.",null,null,null,"P.6 Management of Client Scoped Privacy Data","9.1.1.b","Access control policy",2,null,7,1,0,0,0,0,{"$f":"IF(J43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D43=\"Yes\"),AND($M$1=\"Scaled\",D43>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D43=\"No\"),AND($M$1=\"Scaled\",D43<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,""]
[3235,"P.8","Is personal information collected directly from individuals? If yes, describe.",null,null,null,"P.6 Management of Client Scoped Privacy Data","NA",null,1,null,8,0,0,0,0,0,{"$f":"IF(J44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D44=\"Yes\"),AND($M$1=\"Scaled\",D44>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D44=\"No\"),AND($M$1=\"Scaled\",D44<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,1,1]
[3236,"P.9","Are controls in place to ensure that the collection of personal information is limited?",null,null,null,"P.6 Management of Client Scoped Privacy Data","8.2.3","Handling of assets",1,null,9,0,0,0,0,0,{"$f":"IF(J45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D45=\"Yes\"),AND($M$1=\"Scaled\",D45>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D45=\"No\"),AND($M$1=\"Scaled\",D45<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,1]
[3237,"P.10","Are controls in place to ensure that the collection and usage of personal information is limited and in compliance with applicable law?",null,null,null,"P.6 Management of Client Scoped Privacy Data","8.2.3","Handling of assets",1,null,10,0,0,0,0,0,{"$f":"IF(J46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D46=\"Yes\"),AND($M$1=\"Scaled\",D46>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D46=\"No\"),AND($M$1=\"Scaled\",D46<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,1]
[3860,"P.10.1","Are there enforcement mechanisms in place to address complaints, disputes, and recourse for violations of privacy compliance?",null,null,null,"P.6 Management of Client Scoped Privacy Data","NA",null,2,null,10,1,0,0,0,0,{"$f":"IF(J47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D47=\"Yes\"),AND($M$1=\"Scaled\",D47>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D47=\"No\"),AND($M$1=\"Scaled\",D47<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3729,"P.11"," Are transactions for covered accounts accessed, modified, or processed, including address changes and discrepancies? If yes, describe.",null,null,null,null,"NA",null,1,null,11,0,0,0,0,0,{"$f":"IF(J48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D48=\"Yes\"),AND($M$1=\"Scaled\",D48>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D48=\"No\"),AND($M$1=\"Scaled\",D48<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,1,1]
[3730,"P.11.1","Is there a documented identify theft prevention program approved by management in place to detect, prevent, and mitigate identify theft?",null,null,null,null,"NA",null,2,null,11,1,0,0,0,0,{"$f":"IF(J49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D49=\"Yes\"),AND($M$1=\"Scaled\",D49>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D49=\"No\"),AND($M$1=\"Scaled\",D49<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3731,"P.11.2","Are there documented policies and procedures for identifying and responding to relevant red flags on covered accounts, including address changes and discrepancies?",null,null,null,null,"NA",null,2,null,11,2,0,0,0,0,{"$f":"IF(J50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D50=\"Yes\"),AND($M$1=\"Scaled\",D50>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D50=\"No\"),AND($M$1=\"Scaled\",D50<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3861,"P.11.3","Is customer data transmitted, processed, or stored that can be classified as consumer report information provided by a consumer reporting agency?",null,null,null,null,8.1999999999999993,"Information Classification",2,null,11,3,0,0,0,0,{"$f":"IF(J51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D51=\"Yes\"),AND($M$1=\"Scaled\",D51>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D51=\"No\"),AND($M$1=\"Scaled\",D51<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3862,"P.12","Is there a compliance risk management system that addresses the quality and accuracy of reported consumer data?",null,null,null,null,"NA",null,1,null,12,0,0,0,0,0,{"$f":"IF(J52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D52=\"Yes\"),AND($M$1=\"Scaled\",D52>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D52=\"No\"),AND($M$1=\"Scaled\",D52<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,1]
[3863,"P.12.1","Is there a compliance risk management system that addresses the quality of assembling and maintaining the data?",null,null,null,null,"NA",null,2,null,12,1,0,0,0,0,{"$f":"IF(J53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D53=\"Yes\"),AND($M$1=\"Scaled\",D53>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D53=\"No\"),AND($M$1=\"Scaled\",D53<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3864,"P.12.2","Is there a mechanism in place for resolving consumer disputes?",null,null,null,null,"NA",null,2,null,12,2,0,0,0,0,{"$f":"IF(J54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D54=\"Yes\"),AND($M$1=\"Scaled\",D54>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D54=\"No\"),AND($M$1=\"Scaled\",D54<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]

{"sheet":"Q. Software Security","index":21,"n_rows":82,"n_cols":30,"rows_kept":82,"cut":false,"hidden":false,"merged":[[2,1,2,8]]}
[11,"Q. Software Application Security",null,null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,"Binary","Binary",null,null,null,{"$f":"LEFT(B1,1)","v":"Q"}]
[null,null,null,{"$f":"IF(X2=0,\"0%\",X2/T2)","v":"0%"},"Percent Complete",null,"Tab Automation:","Enable",null,{"$f":"COUNTA(J5:J82)","v":78},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(T5:T82,1)","v":78},null,null,null,{"$f":"COUNTIF(X5:X82,1)","v":0}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column F to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, select the word \"Disable\" in the Tab Automation field at the top of the page.\n     - Use the Maturity column to identify the maturity of the question. See the How To Guide for instructions on filling out this field.",null,null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk",null,null,"Optional\nScoring","Filter","Maturity N/A"]
[{"$f":"MAX(A5:A82)","v":4121},"Ques Num","Question/Request","Response","Maturity","Additional Information","AUP Reference","ISO 27002:2013 Relevance",null,null,null,0]
[3919,{"$f":"IF(J5=0,\"\",IF(J5=1,Q$1&\".\"&L5,IF(J5=2,Q$1&\".\"&L5&\".\"&M5,IF(J5=3,Q$1&\".\"&L5&\".\"&M5&\".\"&N5,IF(J5=4,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5,IF(J5=5,Q$1&\".\"&L5&\".\"&M5&\".\"&N5&\".\"&O5&\".\"&P5))))))","v":"Q.1"},"Is Software provided? ",null,null,null,"Q. Software Application Security","NA",null,1,null,{"$f":"IF(L4=\"\",1,IF(J5=1,L4+1,L4))","v":1},{"$f":"IF(M4=\"\",0,IF(L4<>L5,0,IF($J5=2,M4+1,M4)))","v":0},{"$f":"IF(N4=\"\",0,IF(M4<>M5,0,IF($J5=3,N4+1,N4)))","v":0},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($J5=4,O4+1,O4)))","v":0},{"$f":"IF(P4=\"\",0,IF(O4<>O5,0,IF($J5=5,P4+1,P4)))","v":0},{"$f":"IF(OR(Master=\"Master\",J5=0,K5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,22,FALSE)),0,VLOOKUP(A5,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D5=\"Yes\"),AND($M$1=\"Scaled\",D5>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D5=\"No\"),AND($M$1=\"Scaled\",D5<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J5=\"\",\"\",IF(Q5>0,Q5,IF(R5>0,R5,0)))","v":0},{"$f":"IF(OR(J5=\"\",J5=0),\"\",IF(OR(J5=1,T4=\"\"),1,IF(OR(AND(K4=1,(J5-J3<>0)),AND(T4=0,J4=J5),AND(K4=1,J5=J3)),0,1)))","v":1},{"$f":"IF(J5=\"\",U4,IF(AND(S5>1,OR(U4=\"\",U4=0,U4>=J5)),J5,IF(J5>U4,U4,0)))","v":0},{"$f":"IF(Master=\"Master\",R5,IF(V4=\"\",S5,IF(OR(AND(U5>0,S5<V4),AND(U5=1,S5<=V4)),V4,S5)))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(T4=1,U5=1),S5>0,AND(T6=0,W6=1)),1,0))","v":0},{"$f":"IF(J5=\"\",\"\",IF(OR(AND(U5>0,T5=1),AND(T5=1,W5=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(J5=1,S5=1),2,IF(AND(V4=1,L5=L4),2,IF(AND(AC4=2,L5=L4),2,IF(J5=1,1,\"\"))))","v":1},1]
[3920,{"$f":"IF(J6=0,\"\",IF(J6=1,Q$1&\".\"&L6,IF(J6=2,Q$1&\".\"&L6&\".\"&M6,IF(J6=3,Q$1&\".\"&L6&\".\"&M6&\".\"&N6,IF(J6=4,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6,IF(J6=5,Q$1&\".\"&L6&\".\"&M6&\".\"&N6&\".\"&O6&\".\"&P6))))))","v":"Q.1.1"},"Is there a secure software development lifecycle policy (including mobile software applications) that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?",null,null,null,"Q.1 Secure SDLC Policies, Standards and Procedures","14.2.1 ","Secure development policy",2,null,{"$f":"IF(L5=\"\",1,IF(J6=1,L5+1,L5))","v":1},{"$f":"IF(M5=\"\",0,IF(L5<>L6,0,IF($J6=2,M5+1,M5)))","v":1},{"$f":"IF(N5=\"\",0,IF(M5<>M6,0,IF($J6=3,N5+1,N5)))","v":0},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($J6=4,O5+1,O5)))","v":0},{"$f":"IF(P5=\"\",0,IF(O5<>O6,0,IF($J6=5,P5+1,P5)))","v":0},0,{"$f":"IF(J6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D6=\"Yes\"),AND($M$1=\"Scaled\",D6>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D6=\"No\"),AND($M$1=\"Scaled\",D6<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J6=\"\",\"\",IF(Q6>0,Q6,IF(R6>0,R6,0)))","v":0},1,{"$f":"IF(J6=\"\",U5,IF(AND(S6>1,OR(U5=\"\",U5=0,U5>=J6)),J6,IF(J6>U5,U5,0)))","v":0},{"$f":"IF(Master=\"Master\",R6,IF(V5=\"\",S6,IF(OR(AND(U6>0,S6<V5),AND(U6=1,S6<=V5)),V5,S6)))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(T5=1,U6=1),S6>0,AND(T7=0,W7=1)),1,0))","v":0},{"$f":"IF(J6=\"\",\"\",IF(OR(AND(U6>0,T6=1),AND(T6=1,W6=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A6,L2_Array,1,FALSE)),0,1)","v":1},null,null,null,{"$f":"IF(AND(J6=1,S6=1),2,IF(AND(V5=1,L6=L5),2,IF(AND(AC5=2,L6=L5),2,IF(J6=1,1,\"\"))))","v":""}]
[3921,"Q.1.1.1","Has the policy been reviewed in the last 12 months? If yes, did it include:",null,null,null,"Q.1 Secure SDLC Policies, Standards and Procedures","5.1.2","Review of policies for information security",3,null,1,1,1,0,0,0,{"$f":"IF(J7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D7=\"Yes\"),AND($M$1=\"Scaled\",D7>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D7=\"No\"),AND($M$1=\"Scaled\",D7<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3922,"Q.1.1.1.1","Feedback from interested parties?",null,null,null,"Q.1 Secure SDLC Policies, Standards and Procedures","5.1.2","Review of policies for information security",4,null,1,1,1,1,0,0,{"$f":"IF(J8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D8=\"Yes\"),AND($M$1=\"Scaled\",D8>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D8=\"No\"),AND($M$1=\"Scaled\",D8<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3923,"Q.1.1.1.2","Results of independent reviews?",null,null,null,"Q.1 Secure SDLC Policies, Standards and Procedures","5.1.2","Review of policies for information security",4,null,1,1,1,2,0,0,{"$f":"IF(J9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D9=\"Yes\"),AND($M$1=\"Scaled\",D9>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D9=\"No\"),AND($M$1=\"Scaled\",D9<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3924,"Q.1.1.1.3","Policy compliance?",null,null,null,"Q.1 Secure SDLC Policies, Standards and Procedures","5.1.2","Review of policies for information security",4,null,1,1,1,3,0,0,{"$f":"IF(J10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D10=\"Yes\"),AND($M$1=\"Scaled\",D10>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D10=\"No\"),AND($M$1=\"Scaled\",D10<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3925,"Q.1.1.1.4","Changes that could affect the approach to managing information security?",null,null,null,"Q.1 Secure SDLC Policies, Standards and Procedures","5.1.2","Review of policies for information security",4,null,1,1,1,4,0,0,{"$f":"IF(J11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D11=\"Yes\"),AND($M$1=\"Scaled\",D11>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D11=\"No\"),AND($M$1=\"Scaled\",D11<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3926,"Q.1.1.1.5","Reported information security incidents?",null,null,null,"Q.1 Secure SDLC Policies, Standards and Procedures","5.1.2","Review of policies for information security",4,null,1,1,1,5,0,0,{"$f":"IF(J12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D12=\"Yes\"),AND($M$1=\"Scaled\",D12>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D12=\"No\"),AND($M$1=\"Scaled\",D12<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3927,"Q.1.1.1.6","Recommendations provided by relevant authorities?",null,null,null,"Q.1 Secure SDLC Policies, Standards and Procedures","5.1.2","Review of policies for information security",4,null,1,1,1,6,0,0,{"$f":"IF(J13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D13=\"Yes\"),AND($M$1=\"Scaled\",D13>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D13=\"No\"),AND($M$1=\"Scaled\",D13<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3928,"Q.1.1.1.7","Records management?",null,null,null,"Q.1 Secure SDLC Policies, Standards and Procedures","5.1.2","Review of policies for information security",4,null,1,1,1,7,0,0,{"$f":"IF(J14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D14=\"Yes\"),AND($M$1=\"Scaled\",D14>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D14=\"No\"),AND($M$1=\"Scaled\",D14<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3929,"Q.1.1.2","Is there a process to approve exceptions to the policy? ",null,null,null,null,"5.1.2","Review of policies for information security",3,null,1,1,2,0,0,0,{"$f":"IF(J15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D15=\"Yes\"),AND($M$1=\"Scaled\",D15>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D15=\"No\"),AND($M$1=\"Scaled\",D15<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3930,"Q.1.1.2.1","Does security own the approval process?",null,null,null,"Q.1 Secure SDLC Policies, Standards and Procedures","5.1.2","Review of policies for information security",4,null,1,1,2,1,0,0,{"$f":"IF(J16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D16=\"Yes\"),AND($M$1=\"Scaled\",D16>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D16=\"No\"),AND($M$1=\"Scaled\",D16<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3931,"Q.1.1.3","Is the SDLC policy communicated? If yes, to:",null,null,null,null,"NA",null,3,null,1,1,3,0,0,0,{"$f":"IF(J17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D17=\"Yes\"),AND($M$1=\"Scaled\",D17>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D17=\"No\"),AND($M$1=\"Scaled\",D17<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[3932,"Q.1.1.3.1","Full time constituents?",null,null,null,null,"NA",null,4,null,1,1,3,1,0,0,{"$f":"IF(J18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D18=\"Yes\"),AND($M$1=\"Scaled\",D18>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D18=\"No\"),AND($M$1=\"Scaled\",D18<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3933,"Q.1.1.3.2","Part time constituents?",null,null,null,null,"NA",null,4,null,1,1,3,2,0,0,{"$f":"IF(J19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D19=\"Yes\"),AND($M$1=\"Scaled\",D19>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D19=\"No\"),AND($M$1=\"Scaled\",D19<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3934,"Q.1.1.3.3","Contractors?",null,null,null,null,"NA",null,4,null,1,1,3,3,0,0,{"$f":"IF(J20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D20=\"Yes\"),AND($M$1=\"Scaled\",D20>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D20=\"No\"),AND($M$1=\"Scaled\",D20<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3935,"Q.1.1.3.4","Temporary workers?",null,null,null,null,"NA",null,4,null,1,1,3,4,0,0,{"$f":"IF(J21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D21=\"Yes\"),AND($M$1=\"Scaled\",D21>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D21=\"No\"),AND($M$1=\"Scaled\",D21<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3936,"Q.1.2","Is a secure code review performed? If yes, what is the frequency:",null,null,null,"Q.1 Secure SDLC Policies, Standards and Procedures","14.2.1 ","Secure development policy",2,null,1,2,0,0,0,0,{"$f":"IF(J22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D22=\"Yes\"),AND($M$1=\"Scaled\",D22>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D22=\"No\"),AND($M$1=\"Scaled\",D22<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[3937,"Q.1.2.1","As developed?",null,null,null,null,"NA",null,3,null,1,2,1,0,0,0,{"$f":"IF(J23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D23=\"Yes\"),AND($M$1=\"Scaled\",D23>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D23=\"No\"),AND($M$1=\"Scaled\",D23<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3938,"Q.1.2.2","Monthly?",null,null,null,null,"NA",null,3,null,1,2,2,0,0,0,{"$f":"IF(J24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D24=\"Yes\"),AND($M$1=\"Scaled\",D24>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D24=\"No\"),AND($M$1=\"Scaled\",D24<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3939,"Q.1.2.3","Quarterly?",null,null,null,null,"NA",null,3,null,1,2,3,0,0,0,{"$f":"IF(J25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D25=\"Yes\"),AND($M$1=\"Scaled\",D25>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D25=\"No\"),AND($M$1=\"Scaled\",D25<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3940,"Q.1.2.4","Annually?",null,null,null,null,"NA",null,3,null,1,2,4,0,0,0,{"$f":"IF(J26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D26=\"Yes\"),AND($M$1=\"Scaled\",D26>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D26=\"No\"),AND($M$1=\"Scaled\",D26<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3941,"Q.1.2.5","Other?",null,null,null,null,"NA",null,3,null,1,2,5,0,0,0,{"$f":"IF(J27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D27=\"Yes\"),AND($M$1=\"Scaled\",D27>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D27=\"No\"),AND($M$1=\"Scaled\",D27<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3942,"Q.1.2.6","Third party review?",null,null,null,null,"NA",null,3,null,1,2,6,0,0,0,{"$f":"IF(J28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D28=\"Yes\"),AND($M$1=\"Scaled\",D28>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D28=\"No\"),AND($M$1=\"Scaled\",D28<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3943,"Q.1.3","Are applications given ratings that reflect the types of data accessed (e.g., high, medium low)?",null,null,null,"Q. 3 Risk Classification","14.1.1 ","Information security requirements analysis and specification",2,null,1,3,0,0,0,0,{"$f":"IF(J29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D29=\"Yes\"),AND($M$1=\"Scaled\",D29>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D29=\"No\"),AND($M$1=\"Scaled\",D29<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3944,"Q.1.4","Are the risks from internal and external sources clearly understood based on risk exposure?",null,null,null,"Q. 3 Risk Classification","14.1.1 ","Information security requirements analysis and specification",2,null,1,4,0,0,0,0,{"$f":"IF(J30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D30=\"Yes\"),AND($M$1=\"Scaled\",D30>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D30=\"No\"),AND($M$1=\"Scaled\",D30<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3945,"Q.1.5","Is there a Software Security Group responsible for application security?",null,null,null,null,"14.2.8","Software testing",2,null,1,5,0,0,0,0,{"$f":"IF(J31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D31=\"Yes\"),AND($M$1=\"Scaled\",D31>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D31=\"No\"),AND($M$1=\"Scaled\",D31<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3946,"Q.1.6","Is a security architecture risk analysis performed when new platforms are designed? If yes, does it include:",null,null,null,"Q.4 Secure Architectural Design Standards","14.1.1 ","Information security requirements analysis and specification",2,null,1,6,0,0,0,0,{"$f":"IF(J32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D32=\"Yes\"),AND($M$1=\"Scaled\",D32>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D32=\"No\"),AND($M$1=\"Scaled\",D32<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3947,"Q.1.6.1","Security feature review i.e., authentication, access controls, use of cryptography, etc.?",null,null,null,"Q.4 Secure Architectural Design Standards","14.1.1 ","Information security requirements analysis and specification",3,null,1,6,1,0,0,0,{"$f":"IF(J33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D33=\"Yes\"),AND($M$1=\"Scaled\",D33>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D33=\"No\"),AND($M$1=\"Scaled\",D33<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3948,"Q.1.6.2","Security architecture design review for high risk applications?",null,null,null,"Q.4 Secure Architectural Design Standards","14.1.1 ","Information security requirements analysis and specification",3,null,1,6,2,0,0,0,{"$f":"IF(J34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D34=\"Yes\"),AND($M$1=\"Scaled\",D34>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D34=\"No\"),AND($M$1=\"Scaled\",D34<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3949,"Q.1.6.3","Threat modeling into the business requirements/design process of the SDLC?",null,null,null,"Q.4 Secure Architectural Design Standards","14.2.9","System acceptance testing",3,null,1,6,3,0,0,0,{"$f":"IF(J35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D35=\"Yes\"),AND($M$1=\"Scaled\",D35>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D35=\"No\"),AND($M$1=\"Scaled\",D35<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3950,"Q.1.6.4","Review when major changes are introduced into applications?",null,null,null,null,"14.2.2","System change control procedures",3,null,1,6,4,0,0,0,{"$f":"IF(J36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D36=\"Yes\"),AND($M$1=\"Scaled\",D36>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D36=\"No\"),AND($M$1=\"Scaled\",D36<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3951,"Q.1.7","Is there a secure application development life cycle process? If yes, does it include:",null,null,null,"Q.1 Secure SDLC Policies, Standards and Procedures","14.2.1","Secure development policy",2,null,1,7,0,0,0,{"$f":"IF(OR(Master=\"Master\",J37=0,K37=1),0,IF(ISNA(VLOOKUP(A37,L2_Array,22,FALSE)),0,VLOOKUP(A37,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D37=\"Yes\"),AND($M$1=\"Scaled\",D37>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D37=\"No\"),AND($M$1=\"Scaled\",D37<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3952,"Q.1.7.1","Common vulnerabilities/bugs that need to be eliminated?",null,null,null,null,"14.2.1","Secure development policy",3,null,1,7,1,0,0,0,{"$f":"IF(J38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D38=\"Yes\"),AND($M$1=\"Scaled\",D38>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D38=\"No\"),AND($M$1=\"Scaled\",D38<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3953,"Q.1.7.2","Secure code reviews against the entire code base in the development phase?",null,null,null,"Q.5 Secure Code Review",14.2,"Security in development and support processes",3,null,1,7,2,0,0,0,{"$f":"IF(J39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D39=\"Yes\"),AND($M$1=\"Scaled\",D39>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D39=\"No\"),AND($M$1=\"Scaled\",D39<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3954,"Q.1.7.3","Review by qualified individual?",null,null,null,"Q.5 Secure Code Review","14.2.1.g","Secure development policy",3,null,1,7,3,0,0,0,{"$f":"IF(J40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D40=\"Yes\"),AND($M$1=\"Scaled\",D40>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D40=\"No\"),AND($M$1=\"Scaled\",D40<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3955,"Q.1.7.4","Use of automated code review tools?",null,null,null,"Q.5 Secure Code Review","14.2.9","System acceptance testing",3,null,1,7,4,0,0,0,{"$f":"IF(J41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D41=\"Yes\"),AND($M$1=\"Scaled\",D41>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D41=\"No\"),AND($M$1=\"Scaled\",D41<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3956,"Q.1.7.5","Remediation of findings?",null,null,null,"Q.5 Secure Code Review","14.2.9","System acceptance testing",3,null,1,7,5,0,0,0,{"$f":"IF(J42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D42=\"Yes\"),AND($M$1=\"Scaled\",D42>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D42=\"No\"),AND($M$1=\"Scaled\",D42<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3957,"Q.1.7.6","Formal software security training for developers?",null,null,null,null,"7.2.2"," Information security awareness, education and training",3,null,1,7,6,0,0,0,{"$f":"IF(J43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D43=\"Yes\"),AND($M$1=\"Scaled\",D43>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D43=\"No\"),AND($M$1=\"Scaled\",D43<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3958,"Q.1.7.7","Security experts that work with developers for every application?",null,null,null,null,"14.2.5 ","Secure system engineering principles",3,null,1,7,7,0,0,0,{"$f":"IF(J44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D44=\"Yes\"),AND($M$1=\"Scaled\",D44>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D44=\"No\"),AND($M$1=\"Scaled\",D44<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3959,"Q.1.7.8","Outsourcing development? If yes, describe:",null,null,null,null,"14.2.7","Outsourced development",3,null,1,7,8,0,0,0,{"$f":"IF(J45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D45=\"Yes\"),AND($M$1=\"Scaled\",D45>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D45=\"No\"),AND($M$1=\"Scaled\",D45<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3960,"Q.1.7.9","All developers subject to the SDLC?",null,null,null,null,"14.2.7.b","Outsourced development",3,null,1,7,9,0,0,0,{"$f":"IF(J46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D46=\"Yes\"),AND($M$1=\"Scaled\",D46>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D46=\"No\"),AND($M$1=\"Scaled\",D46<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3961,"Q.1.7.10","Identification of security defects documented and communicated with development to prevent reoccurrence?",null,null,null,"Q.5 Secure Code Review","14.2.7.c","Outsourced development",3,null,1,7,10,0,0,0,{"$f":"IF(J47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D47=\"Yes\"),AND($M$1=\"Scaled\",D47>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D47=\"No\"),AND($M$1=\"Scaled\",D47<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3962,"Q.1.8","Is there a QA and/or UAT process? If yes does it include:",null,null,null,"Q.7 QA_UAT Process","NA",null,2,null,1,8,0,0,0,0,{"$f":"IF(J48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D48=\"Yes\"),AND($M$1=\"Scaled\",D48>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D48=\"No\"),AND($M$1=\"Scaled\",D48<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3963,"Q.1.8.1","Edge/boundary value condition testing? ",null,null,null,"Q.7 QA_UAT Process","NA",null,3,null,1,8,1,0,0,0,{"$f":"IF(J49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D49=\"Yes\"),AND($M$1=\"Scaled\",D49>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D49=\"No\"),AND($M$1=\"Scaled\",D49<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3964,"Q.1.8.2","Testing procedures to determine whether security features are effective? If yes, are they:",null,null,null,"Q.7 QA_UAT Process","14.2.8","System security testing",3,null,1,8,2,0,0,0,{"$f":"IF(J50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D50=\"Yes\"),AND($M$1=\"Scaled\",D50>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D50=\"No\"),AND($M$1=\"Scaled\",D50<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3965,"Q.1.8.2.1","Derived by obtaining a list of security features by the architecture group?",null,null,null,"Q.7 QA_UAT Process","14.2.5","Secure system engineering principles",4,null,1,8,2,1,0,0,{"$f":"IF(J51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D51=\"Yes\"),AND($M$1=\"Scaled\",D51>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D51=\"No\"),AND($M$1=\"Scaled\",D51<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3966,"Q.1.8.3","Dynamic scanning against web based applications while in the Q/A phase? If no, is there a:",null,null,null,"Q.7 QA_UAT Process","14.2.9","System acceptance testing",3,null,1,8,3,0,0,0,{"$f":"IF(J52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D52=\"Yes\"),AND($M$1=\"Scaled\",D52>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D52=\"No\"),AND($M$1=\"Scaled\",D52<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3967,"Q.1.8.3.1","Form of black box testing or scripts specific to abuse cases that are used? ",null,null,null,"Q.7 QA_UAT Process","NA",null,4,null,1,8,3,1,0,0,{"$f":"IF(J53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D53=\"Yes\"),AND($M$1=\"Scaled\",D53>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D53=\"No\"),AND($M$1=\"Scaled\",D53<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3968,"Q.1.8.4","Remediation of security vulnerabilities identified?",null,null,null,"Q.7 QA_UAT Process","14.2.9","System acceptance testing",3,null,1,8,4,0,0,0,{"$f":"IF(J54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D54=\"Yes\"),AND($M$1=\"Scaled\",D54>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D54=\"No\"),AND($M$1=\"Scaled\",D54<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3969,"Q.1.8.5","Fuzz testing (e.g., small #'s, large #'s, negative values, binary sequences, command line inputs, random values, etc.}?",null,null,null,"Q.7 QA_UAT Process","NA",null,3,null,1,8,5,0,0,0,{"$f":"IF(J55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D55=\"Yes\"),AND($M$1=\"Scaled\",D55>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D55=\"No\"),AND($M$1=\"Scaled\",D55<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3970,"Q.1.9","Is each release subject to a full secure code review?",null,null,null,"Q.5 Secure Code Review","14.2.1","Secure development policy",2,null,1,9,0,0,0,0,{"$f":"IF(J56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D56=\"Yes\"),AND($M$1=\"Scaled\",D56>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D56=\"No\"),AND($M$1=\"Scaled\",D56<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3971,"Q.1.10","Are penetration tests performed? If yes, are they:",null,null,null,null,"14.2.9","System acceptance testing",2,null,1,10,0,0,0,0,{"$f":"IF(J57=\"\",\"\",IF(D57=\"\",0,IF(D57=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D57=\"Yes\"),AND($M$1=\"Scaled\",D57>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D57=\"No\"),AND($M$1=\"Scaled\",D57<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,"",1]
[3972,"Q.1.10.1","Performed by a 3rd party?",null,null,null,null,"14.2.9","System acceptance testing",3,null,1,10,1,0,0,0,{"$f":"IF(J58=\"\",\"\",IF(D58=\"\",0,IF(D58=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D58=\"Yes\"),AND($M$1=\"Scaled\",D58>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D58=\"No\"),AND($M$1=\"Scaled\",D58<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3973,"Q.1.10.2","Internal Penetration Testers? If yes, are they:",null,null,null,"Q.7 QA_UAT Process","14.2.9","System acceptance testing",3,null,1,10,2,0,0,0,{"$f":"IF(J59=\"\",\"\",IF(D59=\"\",0,IF(D59=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D59=\"Yes\"),AND($M$1=\"Scaled\",D59>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D59=\"No\"),AND($M$1=\"Scaled\",D59<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3974,"Q.1.10.2.1"," Part of the development group?",null,null,null,"Q.7 QA_UAT Process","14.2.9","System acceptance testing",4,null,1,10,2,1,0,0,{"$f":"IF(J60=\"\",\"\",IF(D60=\"\",0,IF(D60=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D60=\"Yes\"),AND($M$1=\"Scaled\",D60>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D60=\"No\"),AND($M$1=\"Scaled\",D60<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3975,"Q.1.10.3","Consistently use the same approach (e.g., tools, methods, time spent, etc.)?",null,null,null,"Q.7 QA_UAT Process","14.2.9","System acceptance testing",3,null,1,10,3,0,0,0,{"$f":"IF(J61=\"\",\"\",IF(D61=\"\",0,IF(D61=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D61=\"Yes\"),AND($M$1=\"Scaled\",D61>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D61=\"No\"),AND($M$1=\"Scaled\",D61<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3976,"Q.1.10.4","Performed on a set frequently? If yes, describe",null,null,null,"Q.7 QA_UAT Process","NA",null,3,null,1,10,4,0,0,0,{"$f":"IF(J62=\"\",\"\",IF(D62=\"\",0,IF(D62=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D62=\"Yes\"),AND($M$1=\"Scaled\",D62>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D62=\"No\"),AND($M$1=\"Scaled\",D62<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3977,"Q.1.10.5","Issues remediated?",null,null,null,"Q.7 QA_UAT Process","14.2.9","System acceptance testing",3,null,1,10,5,0,0,0,{"$f":"IF(J63=\"\",\"\",IF(D63=\"\",0,IF(D63=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D63=\"Yes\"),AND($M$1=\"Scaled\",D63>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D63=\"No\"),AND($M$1=\"Scaled\",D63<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3978,"Q.1.10.6","Conducted on the complete production version, not just the components",null,null,null,"Q.7 QA_UAT Process","14.2.9","System acceptance testing",3,null,1,10,6,0,0,0,{"$f":"IF(J64=\"\",\"\",IF(D64=\"\",0,IF(D64=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D64=\"Yes\"),AND($M$1=\"Scaled\",D64>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D64=\"No\"),AND($M$1=\"Scaled\",D64<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3979,"Q.1.10.7","Any un-remediated Penetration Test issues in the application under review?",null,null,null,"Q.7 QA_UAT Process","NA",null,3,null,1,10,7,0,0,0,{"$f":"IF(J65=\"\",\"\",IF(D65=\"\",0,IF(D65=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D65=\"Yes\"),AND($M$1=\"Scaled\",D65>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D65=\"No\"),AND($M$1=\"Scaled\",D65<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3980,"Q.1.10.8","Authenticated when a Penetration Test is performed?",null,null,null,"Q.7 QA_UAT Process","NA",null,3,null,1,10,8,0,0,0,{"$f":"IF(J66=\"\",\"\",IF(D66=\"\",0,IF(D66=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D66=\"Yes\"),AND($M$1=\"Scaled\",D66>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D66=\"No\"),AND($M$1=\"Scaled\",D66<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3981,"Q.1.10.9","Performed in the production environment?",null,null,null,"Q.7 QA_UAT Process","14.2.9","System acceptance testing",3,null,1,10,9,0,0,0,{"$f":"IF(J67=\"\",\"\",IF(D67=\"\",0,IF(D67=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D67=\"Yes\"),AND($M$1=\"Scaled\",D67>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D67=\"No\"),AND($M$1=\"Scaled\",D67<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3982,"Q.1.11","Are discovered vulnerabilities communicated to developers? If yes, explain",null,null,null,"Q.7 QA_UAT Process","14.2.6","Secure development environment",2,null,1,11,0,0,0,0,{"$f":"IF(J68=\"\",\"\",IF(D68=\"\",0,IF(D68=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D68=\"Yes\"),AND($M$1=\"Scaled\",D68>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D68=\"No\"),AND($M$1=\"Scaled\",D68<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3983,"Q.1.12","Does the Software Security Group interface with the Incident Response group or function? If yes, are:",null,null,null,null,"12.6.1.k","Management of Technical vulnerabilities",2,null,1,12,0,0,0,{"$f":"IF(OR(Master=\"Master\",J69=0,K69=1),0,IF(ISNA(VLOOKUP(A69,L2_Array,22,FALSE)),0,VLOOKUP(A69,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J69=\"\",\"\",IF(D69=\"\",0,IF(D69=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D69=\"Yes\"),AND($M$1=\"Scaled\",D69>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D69=\"No\"),AND($M$1=\"Scaled\",D69<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3984,{"$f":"IF(J70=0,\"\",IF(J70=1,Q$1&\".\"&L70,IF(J70=2,Q$1&\".\"&L70&\".\"&M70,IF(J70=3,Q$1&\".\"&L70&\".\"&M70&\".\"&N70,IF(J70=4,Q$1&\".\"&L70&\".\"&M70&\".\"&N70&\".\"&O70,IF(J70=5,Q$1&\".\"&L70&\".\"&M70&\".\"&N70&\".\"&O70&\".\"&P70))))))","v":"Q.1.12.1"},"Vulnerabilities identified by the Incident Response group provided to the Software Security Group?",null,null,null,null,"12.6.1.k","Management of Technical vulnerabilities",3,null,{"$f":"IF(L69=\"\",1,IF(J70=1,L69+1,L69))","v":1},{"$f":"IF(M69=\"\",0,IF(L69<>L70,0,IF($J70=2,M69+1,M69)))","v":12},{"$f":"IF(N69=\"\",0,IF(M69<>M70,0,IF($J70=3,N69+1,N69)))","v":1},{"$f":"IF(O69=\"\",0,IF(N69<>N70,0,IF($J70=4,O69+1,O69)))","v":0},{"$f":"IF(P69=\"\",0,IF(O69<>O70,0,IF($J70=5,P69+1,P69)))","v":0},0,{"$f":"IF(J70=\"\",\"\",IF(D70=\"\",0,IF(D70=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D70=\"Yes\"),AND($M$1=\"Scaled\",D70>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D70=\"No\"),AND($M$1=\"Scaled\",D70<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J70=\"\",\"\",IF(Q70>0,Q70,IF(R70>0,R70,0)))","v":0},{"$f":"IF(OR(J70=\"\",J70=0),\"\",IF(OR(J70=1,T69=\"\"),1,IF(OR(AND(K69=1,(J70-J68<>0)),AND(T69=0,J69=J70),AND(K69=1,J70=J68)),0,1)))","v":1},{"$f":"IF(J70=\"\",U69,IF(AND(S70>1,OR(U69=\"\",U69=0,U69>=J70)),J70,IF(J70>U69,U69,0)))","v":0},{"$f":"IF(Master=\"Master\",R70,IF(V69=\"\",S70,IF(OR(AND(U70>0,S70<V69),AND(U70=1,S70<=V69)),V69,S70)))","v":0},{"$f":"IF(J70=\"\",\"\",IF(OR(AND(T69=1,U70=1),S70>0,AND(T71=0,W71=1)),1,0))","v":0},{"$f":"IF(J70=\"\",\"\",IF(OR(AND(U70>0,T70=1),AND(T70=1,W70=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A70,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(J70=1,S70=1),2,IF(AND(V69=1,L70=L69),2,IF(AND(AC69=2,L70=L69),2,IF(J70=1,1,\"\"))))","v":""}]
[3985,"Q.1.13","Does the incident response process include steps to identify root/cause and prevent reoccurrence?",null,null,null,null,"16.1.1.a.2","Responsibilities and procedures",2,null,1,13,0,0,0,0,{"$f":"IF(J71=\"\",\"\",IF(D71=\"\",0,IF(D71=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D71=\"Yes\"),AND($M$1=\"Scaled\",D71>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D71=\"No\"),AND($M$1=\"Scaled\",D71<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3986,"Q.1.14","Are hosted production applications monitored for vulnerabilities?",null,null,null,null,14.1,"Security requirements of information systems",2,null,1,14,0,0,0,0,{"$f":"IF(J72=\"\",\"\",IF(D72=\"\",0,IF(D72=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D72=\"Yes\"),AND($M$1=\"Scaled\",D72>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D72=\"No\"),AND($M$1=\"Scaled\",D72<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3987,"Q.1.15","Are third party code reviews performed prior to release into production?",null,null,null,null,"NA",null,2,null,1,15,0,0,0,0,{"$f":"IF(J73=\"\",\"\",IF(D73=\"\",0,IF(D73=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D73=\"Yes\"),AND($M$1=\"Scaled\",D73>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D73=\"No\"),AND($M$1=\"Scaled\",D73<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3988,"Q.1.16","Is there a Change or Configuration Management policy or program? If yes, does it include:",null,null,null,"Q.1 Secure SDLC Policies, Standards and Procedures","12.1.2","Change management",2,null,1,16,0,0,0,0,{"$f":"IF(J74=\"\",\"\",IF(D74=\"\",0,IF(D74=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D74=\"Yes\"),AND($M$1=\"Scaled\",D74>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D74=\"No\"),AND($M$1=\"Scaled\",D74<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3989,"Q.1.16.1","Vulnerability Management to ensure code has been properly analyzed?",null,null,null,"Q.7 QA_UAT Process","12.1.2.c","Change management",3,null,1,16,1,0,0,0,{"$f":"IF(J75=\"\",\"\",IF(D75=\"\",0,IF(D75=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D75=\"Yes\"),AND($M$1=\"Scaled\",D75>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D75=\"No\"),AND($M$1=\"Scaled\",D75<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3990,"Q.1.17","Are applications analyzed on a regular basis to determine their vulnerability against recent attacks?",null,null,null,"Q.7 QA_UAT Process","12.2.1","Controls against malware",2,null,1,17,0,0,0,0,{"$f":"IF(J76=\"\",\"\",IF(D76=\"\",0,IF(D76=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D76=\"Yes\"),AND($M$1=\"Scaled\",D76>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D76=\"No\"),AND($M$1=\"Scaled\",D76<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3991,"Q.1.18","Are any vulnerabilities identified in production fed through the same mechanisms used to track and remediate results from Penetration Tests?",null,null,null,"Q.7 QA_UAT Process","12.2.1","Controls against malware",2,null,1,18,0,0,0,0,{"$f":"IF(J77=\"\",\"\",IF(D77=\"\",0,IF(D77=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D77=\"Yes\"),AND($M$1=\"Scaled\",D77>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D77=\"No\"),AND($M$1=\"Scaled\",D77<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4117,"Q.1.19","Are library modules used in the development of the application? If yes, are they:",null,null,null,null,"NA",null,2,null,{"$f":"IF(L77=\"\",1,IF(J78=1,L77+1,L77))","v":1},{"$f":"IF(M77=\"\",0,IF(L77<>L78,0,IF($J78=2,M77+1,M77)))","v":19},{"$f":"IF(N77=\"\",0,IF(M77<>M78,0,IF($J78=3,N77+1,N77)))","v":0},{"$f":"IF(O77=\"\",0,IF(N77<>N78,0,IF($J78=4,O77+1,O77)))","v":0},{"$f":"IF(P77=\"\",0,IF(O77<>O78,0,IF($J78=5,P77+1,P77)))","v":0},{"$f":"IF(OR(Master=\"Master\",J78=0,K78=1),0,IF(ISNA(VLOOKUP(A78,L2_Array,22,FALSE)),0,VLOOKUP(A78,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J78=\"\",\"\",IF(D78=\"\",0,IF(D78=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D78=\"Yes\"),AND($M$1=\"Scaled\",D78>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D78=\"No\"),AND($M$1=\"Scaled\",D78<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J78=\"\",\"\",IF(Q78>0,Q78,IF(R78>0,R78,0)))","v":0},{"$f":"IF(OR(J78=\"\",J78=0),\"\",IF(OR(J78=1,T77=\"\"),1,IF(OR(AND(K77=1,(J78-J76<>0)),AND(T77=0,J77=J78),AND(K77=1,J78=J76)),0,1)))","v":1},{"$f":"IF(J78=\"\",U77,IF(AND(S78>1,OR(U77=\"\",U77=0,U77>=J78)),J78,IF(J78>U77,U77,0)))","v":0},{"$f":"IF(Master=\"Master\",R78,IF(V77=\"\",S78,IF(OR(AND(U78>0,S78<V77),AND(U78=1,S78<=V77)),V77,S78)))","v":0},{"$f":"IF(J78=\"\",\"\",IF(OR(AND(T77=1,U78=1),S78>0,AND(T79=0,W79=1)),1,0))","v":0},{"$f":"IF(J78=\"\",\"\",IF(OR(AND(U78>0,T78=1),AND(T78=1,W78=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A78,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,"",1]
[4118,"Q.1.19.1","Inventoried?",null,null,null,null,"NA",null,3,null,1,19,1,0,0,0,{"$f":"IF(J79=\"\",\"\",IF(D79=\"\",0,IF(D79=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D79=\"Yes\"),AND($M$1=\"Scaled\",D79>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D79=\"No\"),AND($M$1=\"Scaled\",D79<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4119,"Q.1.19.2","Identified as to which application the libraries or modules are used in?",null,null,null,null,"NA",null,3,null,1,19,2,0,0,0,{"$f":"IF(J80=\"\",\"\",IF(D80=\"\",0,IF(D80=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D80=\"Yes\"),AND($M$1=\"Scaled\",D80>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D80=\"No\"),AND($M$1=\"Scaled\",D80<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4120,"Q.1.19.3","Version reviewed at least every 6 months?",null,null,null,null,"NA",null,3,null,1,19,3,0,0,0,{"$f":"IF(J81=\"\",\"\",IF(D81=\"\",0,IF(D81=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D81=\"Yes\"),AND($M$1=\"Scaled\",D81>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D81=\"No\"),AND($M$1=\"Scaled\",D81<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[4121,{"$f":"IF(J82=0,\"\",IF(J82=1,Q$1&\".\"&L82,IF(J82=2,Q$1&\".\"&L82&\".\"&M82,IF(J82=3,Q$1&\".\"&L82&\".\"&M82&\".\"&N82,IF(J82=4,Q$1&\".\"&L82&\".\"&M82&\".\"&N82&\".\"&O82,IF(J82=5,Q$1&\".\"&L82&\".\"&M82&\".\"&N82&\".\"&O82&\".\"&P82))))))","v":"Q.1.19.4"},"Open source?",null,null,null,null,"NA",null,3,null,{"$f":"IF(L81=\"\",1,IF(J82=1,L81+1,L81))","v":1},{"$f":"IF(M81=\"\",0,IF(L81<>L82,0,IF($J82=2,M81+1,M81)))","v":19},{"$f":"IF(N81=\"\",0,IF(M81<>M82,0,IF($J82=3,N81+1,N81)))","v":4},{"$f":"IF(O81=\"\",0,IF(N81<>N82,0,IF($J82=4,O81+1,O81)))","v":0},{"$f":"IF(P81=\"\",0,IF(O81<>O82,0,IF($J82=5,P81+1,P81)))","v":0},{"$f":"IF(OR(Master=\"Master\",J82=0,K82=1),0,IF(ISNA(VLOOKUP(A82,L2_Array,22,FALSE)),0,VLOOKUP(A82,L2_Array,22,FALSE)))","v":0},{"$f":"IF(J82=\"\",\"\",IF(D82=\"\",0,IF(D82=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D82=\"Yes\"),AND($M$1=\"Scaled\",D82>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D82=\"No\"),AND($M$1=\"Scaled\",D82<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(J82=\"\",\"\",IF(Q82>0,Q82,IF(R82>0,R82,0)))","v":0},{"$f":"IF(OR(J82=\"\",J82=0),\"\",IF(OR(J82=1,T81=\"\"),1,IF(OR(AND(K81=1,(J82-J80<>0)),AND(T81=0,J81=J82),AND(K81=1,J82=J80)),0,1)))","v":1},{"$f":"IF(J82=\"\",U81,IF(AND(S82>1,OR(U81=\"\",U81=0,U81>=J82)),J82,IF(J82>U81,U81,0)))","v":0},{"$f":"IF(Master=\"Master\",R82,IF(V81=\"\",S82,IF(OR(AND(U82>0,S82<V81),AND(U82=1,S82<=V81)),V81,S82)))","v":0},{"$f":"IF(J82=\"\",\"\",IF(OR(AND(T81=1,U82=1),S82>0,AND(T83=0,W83=1)),1,0))","v":0},{"$f":"IF(J82=\"\",\"\",IF(OR(AND(U82>0,T82=1),AND(T82=1,W82=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A82,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,""]

{"sheet":"V. Cloud Security","index":22,"n_rows":382,"n_cols":32,"rows_kept":382,"cut":false,"hidden":false,"merged":[[2,1,2,8]]}
[11,"V. Cloud Security",null,null,null,null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},"Binary","Binary",null,null,null,null,null,{"$f":"LEFT(B1,1)","v":"V"}]
[null,null,null,{"$f":"IF(Z2=0,\"0%\",Z2/V2)","v":"0%"},"Percent Complete",null,"Tab Automation:","Enable",null,null,null,{"$f":"COUNTA(L5:L382)","v":378},null,null,null,null,null,null,null,null,null,{"$f":"COUNTIF(V5:V382,1)","v":323},null,null,null,{"$f":"COUNTIF(Z5:Z382,1)","v":0}]
["Serial No","Questionnaire Instructions:\n     - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory.  Use the Additional Information Field in column F to provide.\n     - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, select the word \"Disable\" in the Tab Automation field at the top of the page.\n     - Use the Maturity column to identify the maturity of the question. See the How To Guide for instructions on filling out this field.",null,null,null,null,null,null,null,null,null,"Q Depth","Table ID",1,2,3,4,5,"HL Ans","Loc Ans","Comb Ans","Table Calc (Tot Q#)","Q Carry Dn","Resp Calc","T Carry Dn","Final Ans","HL Chk","Evaluating Cloud Risk for the Enterprise: A Shared Assessments Guide",null,"Optional\nScoring","Filter","Maturity N/A"]
[{"$f":"MAX(A5:A382)","v":3734},"Ques Num","Question/Request","Response","Maturity","Additional Information","Service Model","Deployment Model","AUP Reference","ISO 27002:2013 Relevance",null,null,null,0,null,null,null,null,null,null,null,null,null,null,null,null,null,"White Paper Description"]
[3304,{"$f":"IF(L5=0,\"\",IF(L5=1,S$1&\".\"&N5,IF(L5=2,S$1&\".\"&N5&\".\"&O5,IF(L5=3,S$1&\".\"&N5&\".\"&O5&\".\"&P5,IF(L5=4,S$1&\".\"&N5&\".\"&O5&\".\"&P5&\".\"&Q5,IF(L5=5,S$1&\".\"&N5&\".\"&O5&\".\"&P5&\".\"&Q5&\".\"&R5))))))","v":"V.1"},"Are Cloud Services provided? If yes, what service model is provided (select all that apply):",null,null,null,null,null,"V.1 Service and Deployment Models",4.3,"Determining the scope of the information management system",1,null,{"$f":"IF(N4=\"\",1,IF(L5=1,N4+1,N4))","v":1},{"$f":"IF(O4=\"\",0,IF(N4<>N5,0,IF($L5=2,O4+1,O4)))","v":0},{"$f":"IF(P4=\"\",0,IF(O4<>O5,0,IF($L5=3,P4+1,P4)))","v":0},{"$f":"IF(Q4=\"\",0,IF(P4<>P5,0,IF($L5=4,Q4+1,Q4)))","v":0},{"$f":"IF(R4=\"\",0,IF(Q4<>Q5,0,IF($L5=5,R4+1,R4)))","v":0},{"$f":"IF(OR(Master=\"Master\",L5=0,M5=1),0,IF(ISNA(VLOOKUP(A5,L2_Array,22,FALSE)),0,VLOOKUP(A5,L2_Array,22,FALSE)))","v":0},{"$f":"IF(L5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D5=\"Yes\"),AND($M$1=\"Scaled\",D5>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D5=\"No\"),AND($M$1=\"Scaled\",D5<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(L5=\"\",\"\",IF(S5>0,S5,IF(T5>0,T5,0)))","v":0},{"$f":"IF(OR(L5=\"\",L5=0),\"\",IF(OR(L5=1,V4=\"\"),1,IF(OR(AND(M4=1,(L5-L3<>0)),AND(V4=0,L4=L5),AND(M4=1,L5=L3)),0,1)))","v":1},{"$f":"IF(L5=\"\",W4,IF(AND(U5>1,OR(W4=\"\",W4=0,W4>=L5)),L5,IF(L5>W4,W4,0)))","v":0},{"$f":"IF(Master=\"Master\",T5,IF(X4=\"\",U5,IF(OR(AND(W5>0,U5<X4),AND(W5=1,U5<=X4)),X4,U5)))","v":0},{"$f":"IF(L5=\"\",\"\",IF(OR(AND(V4=1,W5=1),U5>0,AND(V6=0,Y6=1)),1,0))","v":0},{"$f":"IF(L5=\"\",\"\",IF(OR(AND(W5>0,V5=1),AND(V5=1,Y5=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A5,L2_Array,1,FALSE)),0,1)","v":1},"WP.1.A.1, WP.1.A.2",null,null,{"$f":"IF(AND(L5=1,U5=1),2,IF(AND(X4=1,N5=N4),2,IF(AND(AE4=2,N5=N4),2,IF(L5=1,1,\"\"))))","v":1}]
[3305,{"$f":"IF(L6=0,\"\",IF(L6=1,S$1&\".\"&N6,IF(L6=2,S$1&\".\"&N6&\".\"&O6,IF(L6=3,S$1&\".\"&N6&\".\"&O6&\".\"&P6,IF(L6=4,S$1&\".\"&N6&\".\"&O6&\".\"&P6&\".\"&Q6,IF(L6=5,S$1&\".\"&N6&\".\"&O6&\".\"&P6&\".\"&Q6&\".\"&R6))))))","v":"V.1.1"},"Software as a Service (SaaS)?",null,null,null,null,null,"V.1 Service and Deployment Models","NA",null,2,null,{"$f":"IF(N5=\"\",1,IF(L6=1,N5+1,N5))","v":1},{"$f":"IF(O5=\"\",0,IF(N5<>N6,0,IF($L6=2,O5+1,O5)))","v":1},{"$f":"IF(P5=\"\",0,IF(O5<>O6,0,IF($L6=3,P5+1,P5)))","v":0},{"$f":"IF(Q5=\"\",0,IF(P5<>P6,0,IF($L6=4,Q5+1,Q5)))","v":0},{"$f":"IF(R5=\"\",0,IF(Q5<>Q6,0,IF($L6=5,R5+1,R5)))","v":0},0,{"$f":"IF(L6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D6=\"Yes\"),AND($M$1=\"Scaled\",D6>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D6=\"No\"),AND($M$1=\"Scaled\",D6<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(L6=\"\",\"\",IF(S6>0,S6,IF(T6>0,T6,0)))","v":0},{"$f":"IF(OR(L6=\"\",L6=0),\"\",IF(OR(L6=1,V5=\"\"),1,IF(OR(AND(M5=1,(L6-L4<>0)),AND(V5=0,L5=L6),AND(M5=1,L6=L4)),0,1)))","v":1},{"$f":"IF(L6=\"\",W5,IF(AND(U6>1,OR(W5=\"\",W5=0,W5>=L6)),L6,IF(L6>W5,W5,0)))","v":0},{"$f":"IF(Master=\"Master\",T6,IF(X5=\"\",U6,IF(OR(AND(W6>0,U6<X5),AND(W6=1,U6<=X5)),X5,U6)))","v":0},{"$f":"IF(L6=\"\",\"\",IF(OR(AND(V5=1,W6=1),U6>0,AND(V7=0,Y7=1)),1,0))","v":0},{"$f":"IF(L6=\"\",\"\",IF(OR(AND(W6>0,V6=1),AND(V6=1,Y6=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A6,L2_Array,1,FALSE)),0,1)","v":1},"WP.1.A.1, WP.1.A.2",null,null,{"$f":"IF(AND(L6=1,U6=1),2,IF(AND(X5=1,N6=N5),2,IF(AND(AE5=2,N6=N5),2,IF(L6=1,1,\"\"))))","v":""}]
[3306,"V.1.2","Platform as a Service (PaaS)?",null,null,null,null,null,"V.1 Service and Deployment Models","NA",null,2,null,1,2,0,0,0,0,{"$f":"IF(L7=\"\",\"\",IF(D7=\"\",0,IF(D7=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D7=\"Yes\"),AND($M$1=\"Scaled\",D7>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D7=\"No\"),AND($M$1=\"Scaled\",D7<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.A.1, WP.1.A.2",null,null,""]
[3307,"V.1.3","Infrastructure as a Service (IaaS)?",null,null,null,null,null,"V.1 Service and Deployment Models","NA",null,2,null,1,3,0,0,0,0,{"$f":"IF(L8=\"\",\"\",IF(D8=\"\",0,IF(D8=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D8=\"Yes\"),AND($M$1=\"Scaled\",D8>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D8=\"No\"),AND($M$1=\"Scaled\",D8<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.A.1, WP.1.A.2",null,null,""]
[3308,"V.1.4","What deployment models are provided (select all that apply):",null,null,null,null,null,"V.1 Service and Deployment Models",4.3,"Determining the scope of the information management system",2,1,1,4,0,0,0,0,{"$f":"IF(L9=\"\",\"\",IF(D9=\"\",0,IF(D9=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D9=\"Yes\"),AND($M$1=\"Scaled\",D9>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D9=\"No\"),AND($M$1=\"Scaled\",D9<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.E.1",null,null,""]
[3309,"V.1.4.1","Private cloud?",null,null,null,null,null,"V.1 Service and Deployment Models","NA",null,3,null,1,4,1,0,0,0,{"$f":"IF(L10=\"\",\"\",IF(D10=\"\",0,IF(D10=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D10=\"Yes\"),AND($M$1=\"Scaled\",D10>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D10=\"No\"),AND($M$1=\"Scaled\",D10<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,1,"WP.1.E.1",null,null,""]
[3310,"V.1.4.2","Public cloud?",null,null,null,null,null,"V.1 Service and Deployment Models","NA",null,3,null,1,4,2,0,0,0,{"$f":"IF(L11=\"\",\"\",IF(D11=\"\",0,IF(D11=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D11=\"Yes\"),AND($M$1=\"Scaled\",D11>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D11=\"No\"),AND($M$1=\"Scaled\",D11<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,1,"WP.1.E.1",null,null,""]
[3311,"V.1.4.3","Community cloud?",null,null,null,null,null,"V.1 Service and Deployment Models","NA",null,3,null,1,4,3,0,0,0,{"$f":"IF(L12=\"\",\"\",IF(D12=\"\",0,IF(D12=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D12=\"Yes\"),AND($M$1=\"Scaled\",D12>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D12=\"No\"),AND($M$1=\"Scaled\",D12<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,1,"WP.1.E.1",null,null,""]
[3312,"V.1.4.4","Hybrid cloud?",null,null,null,null,null,"V.1 Service and Deployment Models","NA",null,3,null,1,4,4,0,0,0,{"$f":"IF(L13=\"\",\"\",IF(D13=\"\",0,IF(D13=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D13=\"Yes\"),AND($M$1=\"Scaled\",D13>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D13=\"No\"),AND($M$1=\"Scaled\",D13<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,1,"WP.1.E.1",null,null,""]
[3313,"V.1.5","Where is the cloud infrastructure hosted:",null,null,null,null,null,null,4.3,"Determining the scope of the information management system",2,1,1,5,0,0,0,0,{"$f":"IF(L14=\"\",\"\",IF(D14=\"\",0,IF(D14=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D14=\"Yes\"),AND($M$1=\"Scaled\",D14>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D14=\"No\"),AND($M$1=\"Scaled\",D14<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.E.1",null,null,""]
[3314,"V.1.5.1","Data center: single tenancy?",null,null,null,null,null,null,"NA",null,3,null,1,5,1,0,0,0,{"$f":"IF(L15=\"\",\"\",IF(D15=\"\",0,IF(D15=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D15=\"Yes\"),AND($M$1=\"Scaled\",D15>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D15=\"No\"),AND($M$1=\"Scaled\",D15<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.1",null,null,""]
[3315,"V.1.5.2","Co-location: dedicated server?",null,null,null,null,null,null,"NA",null,3,null,1,5,2,0,0,0,{"$f":"IF(L16=\"\",\"\",IF(D16=\"\",0,IF(D16=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D16=\"Yes\"),AND($M$1=\"Scaled\",D16>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D16=\"No\"),AND($M$1=\"Scaled\",D16<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.1",null,null,""]
[3686,"V.1.5.3","Co-location: shared server?",null,null,null,null,null,null,"NA",null,3,null,1,5,3,0,0,0,{"$f":"IF(L17=\"\",\"\",IF(D17=\"\",0,IF(D17=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D17=\"Yes\"),AND($M$1=\"Scaled\",D17>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D17=\"No\"),AND($M$1=\"Scaled\",D17<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.1",null,null,""]
[3316,"V.1.5.4","Co-location: dedicated cabinet?",null,null,null,null,null,null,"NA",null,3,null,1,5,4,0,0,0,{"$f":"IF(L18=\"\",\"\",IF(D18=\"\",0,IF(D18=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D18=\"Yes\"),AND($M$1=\"Scaled\",D18>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D18=\"No\"),AND($M$1=\"Scaled\",D18<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.1",null,null,""]
[3317,"V.1.5.5","Co-location: shared cabinet?",null,null,null,null,null,null,"NA",null,3,null,1,5,5,0,0,0,{"$f":"IF(L19=\"\",\"\",IF(D19=\"\",0,IF(D19=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D19=\"Yes\"),AND($M$1=\"Scaled\",D19>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D19=\"No\"),AND($M$1=\"Scaled\",D19<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.1",null,null,""]
[3318,"V.1.5.6","Co-location: dedicated cage?",null,null,null,null,null,null,"NA",null,3,null,1,5,6,0,0,0,{"$f":"IF(L20=\"\",\"\",IF(D20=\"\",0,IF(D20=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D20=\"Yes\"),AND($M$1=\"Scaled\",D20>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D20=\"No\"),AND($M$1=\"Scaled\",D20<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.1",null,null,""]
[3319,"V.1.5.7","Co-location: shared cage?",null,null,null,null,null,null,"NA",null,3,null,1,5,7,0,0,0,{"$f":"IF(L21=\"\",\"\",IF(D21=\"\",0,IF(D21=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D21=\"Yes\"),AND($M$1=\"Scaled\",D21>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D21=\"No\"),AND($M$1=\"Scaled\",D21<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.1",null,null,""]
[3320,"V.1.5.8","Cloud provider: (e.g., AWS)?",null,null,null,null,null,null,"NA",null,3,null,1,5,8,0,0,0,{"$f":"IF(L22=\"\",\"\",IF(D22=\"\",0,IF(D22=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D22=\"Yes\"),AND($M$1=\"Scaled\",D22>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D22=\"No\"),AND($M$1=\"Scaled\",D22<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.1",null,null,""]
[3321,"V.1.6","What legal jurisdiction does data reside (select all that apply):",null,null,null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","18.1.1 ","Identification of applicable legislation and contractual requirements",2,1,1,6,0,0,0,0,{"$f":"IF(L23=\"\",\"\",IF(D23=\"\",0,IF(D23=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D23=\"Yes\"),AND($M$1=\"Scaled\",D23>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D23=\"No\"),AND($M$1=\"Scaled\",D23<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3322,"V.1.6.1","USA?",null,null,null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","NA",null,3,null,1,6,1,0,0,0,{"$f":"IF(L24=\"\",\"\",IF(D24=\"\",0,IF(D24=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D24=\"Yes\"),AND($M$1=\"Scaled\",D24>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D24=\"No\"),AND($M$1=\"Scaled\",D24<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3323,"V.1.6.2","Canada?",null,null,null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","NA",null,3,null,1,6,2,0,0,0,{"$f":"IF(L25=\"\",\"\",IF(D25=\"\",0,IF(D25=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D25=\"Yes\"),AND($M$1=\"Scaled\",D25>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D25=\"No\"),AND($M$1=\"Scaled\",D25<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3324,"V.1.6.3","Asia?",null,null,null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","NA",null,3,null,1,6,3,0,0,0,{"$f":"IF(L26=\"\",\"\",IF(D26=\"\",0,IF(D26=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D26=\"Yes\"),AND($M$1=\"Scaled\",D26>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D26=\"No\"),AND($M$1=\"Scaled\",D26<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3325,"V.1.6.4","South America?",null,null,null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","NA",null,3,null,1,6,4,0,0,0,{"$f":"IF(L27=\"\",\"\",IF(D27=\"\",0,IF(D27=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D27=\"Yes\"),AND($M$1=\"Scaled\",D27>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D27=\"No\"),AND($M$1=\"Scaled\",D27<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3326,"V.1.6.5","Australia?",null,null,null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","NA",null,3,null,1,6,5,0,0,0,{"$f":"IF(L28=\"\",\"\",IF(D28=\"\",0,IF(D28=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D28=\"Yes\"),AND($M$1=\"Scaled\",D28>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D28=\"No\"),AND($M$1=\"Scaled\",D28<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3327,"V.1.6.6","Asia-Pacific?",null,null,null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","NA",null,3,null,1,6,6,0,0,0,{"$f":"IF(L29=\"\",\"\",IF(D29=\"\",0,IF(D29=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D29=\"Yes\"),AND($M$1=\"Scaled\",D29>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D29=\"No\"),AND($M$1=\"Scaled\",D29<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3328,"V.1.6.7","Africa?",null,null,null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","NA",null,3,null,1,6,7,0,0,0,{"$f":"IF(L30=\"\",\"\",IF(D30=\"\",0,IF(D30=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D30=\"Yes\"),AND($M$1=\"Scaled\",D30>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D30=\"No\"),AND($M$1=\"Scaled\",D30<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3684,"V.1.6.8","Europe (EU)?",null,null,null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","NA",null,3,null,1,6,8,0,0,0,{"$f":"IF(L31=\"\",\"\",IF(D31=\"\",0,IF(D31=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D31=\"Yes\"),AND($M$1=\"Scaled\",D31>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D31=\"No\"),AND($M$1=\"Scaled\",D31<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3685,"V.1.6.9","Europe (non-EU)?",null,null,null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","NA",null,3,null,1,6,9,0,0,0,{"$f":"IF(L32=\"\",\"\",IF(D32=\"\",0,IF(D32=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D32=\"Yes\"),AND($M$1=\"Scaled\",D32>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D32=\"No\"),AND($M$1=\"Scaled\",D32<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3329,"V.1.6.10","Other (please specify)?",null,null,null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","NA",null,3,null,1,6,10,0,0,0,{"$f":"IF(L33=\"\",\"\",IF(D33=\"\",0,IF(D33=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D33=\"Yes\"),AND($M$1=\"Scaled\",D33>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D33=\"No\"),AND($M$1=\"Scaled\",D33<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.1, WP.1.E.4, WP.1.G",null,null,""]
[3330,"V.1.7","Can clients define the legal jurisdictions of their data? If yes, can they define where the data is:",null,null,null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","18.1.1 ","Identification of applicable legislation and contractual requirements",2,null,1,7,0,0,0,0,{"$f":"IF(L34=\"\",\"\",IF(D34=\"\",0,IF(D34=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D34=\"Yes\"),AND($M$1=\"Scaled\",D34>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D34=\"No\"),AND($M$1=\"Scaled\",D34<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.G.3",null,null,""]
[3331,"V.1.7.1","Stored?",null,null,null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","NA",null,3,null,1,7,1,0,0,0,{"$f":"IF(L35=\"\",\"\",IF(D35=\"\",0,IF(D35=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D35=\"Yes\"),AND($M$1=\"Scaled\",D35>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D35=\"No\"),AND($M$1=\"Scaled\",D35<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.G.3",null,null,""]
[3332,"V.1.7.2","Processed?",null,null,null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","NA",null,3,null,1,7,2,0,0,0,{"$f":"IF(L36=\"\",\"\",IF(D36=\"\",0,IF(D36=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D36=\"Yes\"),AND($M$1=\"Scaled\",D36>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D36=\"No\"),AND($M$1=\"Scaled\",D36<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.G.3",null,null,""]
[3333,"V.1.7.3","Transmitted?",null,null,null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","NA",null,3,null,1,7,3,0,0,0,{"$f":"IF(L37=\"\",\"\",IF(D37=\"\",0,IF(D37=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D37=\"Yes\"),AND($M$1=\"Scaled\",D37>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D37=\"No\"),AND($M$1=\"Scaled\",D37<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.G.3",null,null,""]
[3334,"V.1.7.4","Accessed?",null,null,null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","NA",null,3,null,1,7,4,0,0,0,{"$f":"IF(L38=\"\",\"\",IF(D38=\"\",0,IF(D38=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D38=\"Yes\"),AND($M$1=\"Scaled\",D38>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D38=\"No\"),AND($M$1=\"Scaled\",D38<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.G.3",null,null,""]
[3335,"V.1.8","Are application instances part of the services provided?",null,null,null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","9.4.1 ","Information access restriction",2,null,1,8,0,0,0,0,{"$f":"IF(L39=\"\",\"\",IF(D39=\"\",0,IF(D39=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D39=\"Yes\"),AND($M$1=\"Scaled\",D39>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D39=\"No\"),AND($M$1=\"Scaled\",D39<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.G.3",null,null,""]
[3336,"V.1.8.1","Are these instances shared with other clients?",null,null,null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","NA",null,3,null,1,8,1,0,0,0,{"$f":"IF(L40=\"\",\"\",IF(D40=\"\",0,IF(D40=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D40=\"Yes\"),AND($M$1=\"Scaled\",D40>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D40=\"No\"),AND($M$1=\"Scaled\",D40<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.A.2, WP.1.A.8",null,null,""]
[3337,"V.1.9","Are database instances part of the services provided?",null,null,null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","9.4.1","Information access restriction",2,null,1,9,0,0,0,0,{"$f":"IF(L41=\"\",\"\",IF(D41=\"\",0,IF(D41=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D41=\"Yes\"),AND($M$1=\"Scaled\",D41>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D41=\"No\"),AND($M$1=\"Scaled\",D41<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.G.3",null,null,""]
[3338,"V.1.9.1","Are these instances shared with other clients?",null,null,null,null,null,"P.1 Scoped Privacy Data Inventory and Flows","NA",null,3,null,1,9,1,0,0,0,{"$f":"IF(L42=\"\",\"\",IF(D42=\"\",0,IF(D42=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D42=\"Yes\"),AND($M$1=\"Scaled\",D42>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D42=\"No\"),AND($M$1=\"Scaled\",D42<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.A.2, WP.1.A.8",null,null,""]
[3339,"V.1.10","Is data segmentation and separation capability between clients provided? If yes, is it:",null,null,null,null,null,"V.1 Service and Deployment Models","9.4.1 ","Information access restriction",2,null,1,10,0,0,0,0,{"$f":"IF(L43=\"\",\"\",IF(D43=\"\",0,IF(D43=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D43=\"Yes\"),AND($M$1=\"Scaled\",D43>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D43=\"No\"),AND($M$1=\"Scaled\",D43<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.A.1",null,null,""]
[3340,"V.1.10.1","Physical segmentation (private cloud)?",null,null,null,null,null,null,"9.4.1 ","Information access restriction",3,null,1,10,1,0,0,0,{"$f":"IF(L44=\"\",\"\",IF(D44=\"\",0,IF(D44=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D44=\"Yes\"),AND($M$1=\"Scaled\",D44>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D44=\"No\"),AND($M$1=\"Scaled\",D44<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1",null,null,""]
[3341,"V.1.10.2","Network segmentation?",null,null,null,null,null,null,"9.4.1 ","Information access restriction",3,null,1,10,2,0,0,0,{"$f":"IF(L45=\"\",\"\",IF(D45=\"\",0,IF(D45=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D45=\"Yes\"),AND($M$1=\"Scaled\",D45>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D45=\"No\"),AND($M$1=\"Scaled\",D45<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1",null,null,""]
[3342,"V.1.10.3","System segmentation (unique system instances (e.g., virtualization)?",null,null,null,null,null,null,"9.4.1 ","Information access restriction",3,null,1,10,3,0,0,0,{"$f":"IF(L46=\"\",\"\",IF(D46=\"\",0,IF(D46=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D46=\"Yes\"),AND($M$1=\"Scaled\",D46>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D46=\"No\"),AND($M$1=\"Scaled\",D46<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.D.1, WP.1.D.3",null,null,""]
[3343,"V.1.10.4","Application segmentation (unique application instances)?",null,null,null,null,null,null,"9.4.1 ","Information access restriction",3,null,1,10,4,0,0,0,{"$f":"IF(L47=\"\",\"\",IF(D47=\"\",0,IF(D47=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D47=\"Yes\"),AND($M$1=\"Scaled\",D47>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D47=\"No\"),AND($M$1=\"Scaled\",D47<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1",null,null,""]
[3344,"V.1.10.5","Application segmentation (e.g., application ID, metadata tagging)?",null,null,null,null,null,null,"9.4.1 ","Information access restriction",3,null,1,10,5,0,0,0,{"$f":"IF(L48=\"\",\"\",IF(D48=\"\",0,IF(D48=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D48=\"Yes\"),AND($M$1=\"Scaled\",D48>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D48=\"No\"),AND($M$1=\"Scaled\",D48<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1",null,null,""]
[3345,"V.1.10.6","Other (please specify)?",null,null,null,null,null,null,"9.4.1 ","Information access restriction",3,null,1,10,6,0,0,0,{"$f":"IF(L49=\"\",\"\",IF(D49=\"\",0,IF(D49=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D49=\"Yes\"),AND($M$1=\"Scaled\",D49>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D49=\"No\"),AND($M$1=\"Scaled\",D49<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3346,"V.1.11","Is Scoped Data encrypted? If yes, when:",null,null,null,null,null,"G.22 Data Security Policy – Encryption ","10.1.1                                                     13.1.2                                                14.1.3                                                                 18.1.3","Policy on The Use of Cryptographic Controls,\nSecurity of Network Services,\nProtecting application services transactions,\nProtection of records",2,null,1,11,0,0,0,0,{"$f":"IF(L50=\"\",\"\",IF(D50=\"\",0,IF(D50=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D50=\"Yes\"),AND($M$1=\"Scaled\",D50>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D50=\"No\"),AND($M$1=\"Scaled\",D50<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.A.7, WP.1.G.9",null,null,""]
[3347,"V.1.11.1","External: Network?",null,null,null,null,null,"G.22 Data Security Policy – Encryption, G.13 Website – Client Encryption","NA",null,3,null,1,11,1,0,0,0,{"$f":"IF(L51=\"\",\"\",IF(D51=\"\",0,IF(D51=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D51=\"Yes\"),AND($M$1=\"Scaled\",D51>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D51=\"No\"),AND($M$1=\"Scaled\",D51<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3348,"V.1.11.2","Internal: Network?",null,null,null,null,null,"G.22 Data Security Policy – Encryption, G.13 Website – Client Encryption","NA",null,3,null,1,11,2,0,0,0,{"$f":"IF(L52=\"\",\"\",IF(D52=\"\",0,IF(D52=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D52=\"Yes\"),AND($M$1=\"Scaled\",D52>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D52=\"No\"),AND($M$1=\"Scaled\",D52<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3349,"V.1.11.3","Internal: Storage?",null,null,null,null,null,"G.22 Data Security Policy – Encryption ","NA",null,3,null,1,11,3,0,0,0,{"$f":"IF(L53=\"\",\"\",IF(D53=\"\",0,IF(D53=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D53=\"Yes\"),AND($M$1=\"Scaled\",D53>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D53=\"No\"),AND($M$1=\"Scaled\",D53<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3350,"V.1.11.4","Vendors: Transit to third party vendors?",null,null,null,null,null,"G.22 Data Security Policy – Encryption ","NA",null,3,null,1,11,4,0,0,0,{"$f":"IF(L54=\"\",\"\",IF(D54=\"\",0,IF(D54=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D54=\"Yes\"),AND($M$1=\"Scaled\",D54>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D54=\"No\"),AND($M$1=\"Scaled\",D54<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3351,"V.1.11.5","Vendors: Stored by third party vendors?",null,null,null,null,null,"G.22 Data Security Policy – Encryption ","NA",null,3,null,1,11,5,0,0,0,{"$f":"IF(L55=\"\",\"\",IF(D55=\"\",0,IF(D55=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D55=\"Yes\"),AND($M$1=\"Scaled\",D55>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D55=\"No\"),AND($M$1=\"Scaled\",D55<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3352,"V.1.11.6","Other (please specify)?",null,null,null,null,null,null,"NA",null,3,null,1,11,6,0,0,0,{"$f":"IF(L56=\"\",\"\",IF(D56=\"\",0,IF(D56=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D56=\"Yes\"),AND($M$1=\"Scaled\",D56>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D56=\"No\"),AND($M$1=\"Scaled\",D56<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3353,"V.1.12","Are clients provided with the ability to generate a unique encryption key?",null,null,null,null,null,"G.22 Data Security Policy - Encryption","10.1.2","Key Management",2,null,1,12,0,0,0,0,{"$f":"IF(L57=\"\",\"\",IF(D57=\"\",0,IF(D57=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D57=\"Yes\"),AND($M$1=\"Scaled\",D57>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D57=\"No\"),AND($M$1=\"Scaled\",D57<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.A.6",null,null,""]
[3354,"V.1.13","Are clients provided with the ability to rotate their encryption key on a scheduled basis?",null,null,null,null,null,"G.22 Data Security Policy - Encryption","10.1.2","Key Management",2,null,1,13,0,0,0,0,{"$f":"IF(L58=\"\",\"\",IF(D58=\"\",0,IF(D58=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D58=\"Yes\"),AND($M$1=\"Scaled\",D58>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D58=\"No\"),AND($M$1=\"Scaled\",D58<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.A.6, WP.1.A.7",null,null,""]
[3355,"V.1.14","Is standards based federated ID capability available to clients (e.g., SAML, OpenID)?",null,null,null,null,null,null,"9.2.1","User registration and de-registration",2,null,1,14,0,0,0,0,{"$f":"IF(L59=\"\",\"\",IF(D59=\"\",0,IF(D59=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D59=\"Yes\"),AND($M$1=\"Scaled\",D59>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D59=\"No\"),AND($M$1=\"Scaled\",D59<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.H.2, WP.1.H.4",null,null,""]
[3356,"V.1.15","Are application self service features or an Internet accessible self-service portal available to clients? If yes, are the following functions available:",null,null,null,null,null,null,"9.4.1","Information access restriction",2,null,1,15,0,0,0,0,{"$f":"IF(L60=\"\",\"\",IF(D60=\"\",0,IF(D60=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D60=\"Yes\"),AND($M$1=\"Scaled\",D60>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D60=\"No\"),AND($M$1=\"Scaled\",D60<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,""]
[3357,"V.1.15.1","Provision users?",null,null,null,null,null,null,"9.2.2 ","User access provisioning",3,null,1,15,1,0,0,0,{"$f":"IF(L61=\"\",\"\",IF(D61=\"\",0,IF(D61=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D61=\"Yes\"),AND($M$1=\"Scaled\",D61>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D61=\"No\"),AND($M$1=\"Scaled\",D61<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.H.1, WP.1.H.3, WP.1.H.5, WP.1.H.7",null,null,""]
[3358,"V.1.15.2","Audit user entitlements?",null,null,null,null,null,null,"9.2.5","Review of User Access Rights",3,null,1,15,2,0,0,0,{"$f":"IF(L62=\"\",\"\",IF(D62=\"\",0,IF(D62=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D62=\"Yes\"),AND($M$1=\"Scaled\",D62>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D62=\"No\"),AND($M$1=\"Scaled\",D62<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.H.9",null,null,""]
[3359,"V.1.15.3","View uptime?",null,null,null,null,null,null,"12.4.1                                                     15.2.1","Event Logging,\nMonitoring and Review of Supplier Services",3,null,1,15,3,0,0,0,{"$f":"IF(L63=\"\",\"\",IF(D63=\"\",0,IF(D63=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D63=\"Yes\"),AND($M$1=\"Scaled\",D63>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D63=\"No\"),AND($M$1=\"Scaled\",D63<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.7, WP.1.K.8, WP.1.K.9, WP.1.K.10",null,null,""]
[3360,"V.1.15.4","View real-time service interruptions?",null,null,null,null,null,null,"12.4.1                                                     15.2.1","Event Logging,\nMonitoring and Review of Supplier Services",3,null,1,15,4,0,0,0,{"$f":"IF(L64=\"\",\"\",IF(D64=\"\",0,IF(D64=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D64=\"Yes\"),AND($M$1=\"Scaled\",D64>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D64=\"No\"),AND($M$1=\"Scaled\",D64<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.H.9, WP.1.H.10",null,null,""]
[3361,"V.1.15.5","View maintenance window information?",null,null,null,null,null,null,"12.4.1                                                     15.2.1","Event Logging,\nMonitoring and Review of Supplier Services",3,null,1,15,5,0,0,0,{"$f":"IF(L65=\"\",\"\",IF(D65=\"\",0,IF(D65=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D65=\"Yes\"),AND($M$1=\"Scaled\",D65>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D65=\"No\"),AND($M$1=\"Scaled\",D65<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.H.10",null,null,""]
[3362,"V.1.15.6","View access logs?",null,null,null,null,null,null,"12.4.1                                                     15.2.1","Event Logging,\nMonitoring and Review of Supplier Services",3,null,1,15,6,0,0,0,{"$f":"IF(L66=\"\",\"\",IF(D66=\"\",0,IF(D66=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D66=\"Yes\"),AND($M$1=\"Scaled\",D66>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D66=\"No\"),AND($M$1=\"Scaled\",D66<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.H.9, WP.1.H.10",null,null,""]
[3363,"V.1.15.7","Create or modify a new cloud instance?",null,null,null,null,null,null,"9.2.3.b ","Management of privileged access rights",3,null,1,15,7,0,0,0,{"$f":"IF(L67=\"\",\"\",IF(D67=\"\",0,IF(D67=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D67=\"Yes\"),AND($M$1=\"Scaled\",D67>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D67=\"No\"),AND($M$1=\"Scaled\",D67<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3364,"V.1.15.8","View system health and status?",null,null,null,null,null,null,"9.2.3","Management of privileged access rights",3,null,1,15,8,0,0,0,{"$f":"IF(L68=\"\",\"\",IF(D68=\"\",0,IF(D68=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D68=\"Yes\"),AND($M$1=\"Scaled\",D68>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D68=\"No\"),AND($M$1=\"Scaled\",D68<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.H.9, WP.1.H.10",null,null,""]
[3365,"V.1.15.9","Create IP access lists?",null,null,null,null,null,null,"9.2.3","Management of privileged access rights",3,null,1,15,9,0,0,{"$f":"IF(OR(Master=\"Master\",L69=0,M69=1),0,IF(ISNA(VLOOKUP(A69,L2_Array,22,FALSE)),0,VLOOKUP(A69,L2_Array,22,FALSE)))","v":0},{"$f":"IF(L69=\"\",\"\",IF(D69=\"\",0,IF(D69=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D69=\"Yes\"),AND($M$1=\"Scaled\",D69>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D69=\"No\"),AND($M$1=\"Scaled\",D69<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3366,{"$f":"IF(L70=0,\"\",IF(L70=1,S$1&\".\"&N70,IF(L70=2,S$1&\".\"&N70&\".\"&O70,IF(L70=3,S$1&\".\"&N70&\".\"&O70&\".\"&P70,IF(L70=4,S$1&\".\"&N70&\".\"&O70&\".\"&P70&\".\"&Q70,IF(L70=5,S$1&\".\"&N70&\".\"&O70&\".\"&P70&\".\"&Q70&\".\"&R70))))))","v":"V.1.15.10"},"View security events and alerts?",null,null,null,null,null,null,"9.2.3","Management of privileged access rights",3,null,{"$f":"IF(N69=\"\",1,IF(L70=1,N69+1,N69))","v":1},{"$f":"IF(O69=\"\",0,IF(N69<>N70,0,IF($L70=2,O69+1,O69)))","v":15},{"$f":"IF(P69=\"\",0,IF(O69<>O70,0,IF($L70=3,P69+1,P69)))","v":10},{"$f":"IF(Q69=\"\",0,IF(P69<>P70,0,IF($L70=4,Q69+1,Q69)))","v":0},{"$f":"IF(R69=\"\",0,IF(Q69<>Q70,0,IF($L70=5,R69+1,R69)))","v":0},0,{"$f":"IF(L70=\"\",\"\",IF(D70=\"\",0,IF(D70=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D70=\"Yes\"),AND($M$1=\"Scaled\",D70>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D70=\"No\"),AND($M$1=\"Scaled\",D70<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(L70=\"\",\"\",IF(S70>0,S70,IF(T70>0,T70,0)))","v":0},{"$f":"IF(OR(L70=\"\",L70=0),\"\",IF(OR(L70=1,V69=\"\"),1,IF(OR(AND(M69=1,(L70-L68<>0)),AND(V69=0,L69=L70),AND(M69=1,L70=L68)),0,1)))","v":1},{"$f":"IF(L70=\"\",W69,IF(AND(U70>1,OR(W69=\"\",W69=0,W69>=L70)),L70,IF(L70>W69,W69,0)))","v":0},{"$f":"IF(Master=\"Master\",T70,IF(X69=\"\",U70,IF(OR(AND(W70>0,U70<X69),AND(W70=1,U70<=X69)),X69,U70)))","v":0},{"$f":"IF(L70=\"\",\"\",IF(OR(AND(V69=1,W70=1),U70>0,AND(V71=0,Y71=1)),1,0))","v":0},{"$f":"IF(L70=\"\",\"\",IF(OR(AND(W70>0,V70=1),AND(V70=1,Y70=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A70,L2_Array,1,FALSE)),0,1)","v":0},"WP.1.H.9, WP.1.H.10",null,null,{"$f":"IF(AND(L70=1,U70=1),2,IF(AND(X69=1,N70=N69),2,IF(AND(AE69=2,N70=N69),2,IF(L70=1,1,\"\"))))","v":""}]
[3367,"V.1.15.11","Remote administrative access to the systems?",null,null,null,null,null,null,"9.2.3","Management of privileged access rights",3,null,1,15,11,0,0,0,{"$f":"IF(L71=\"\",\"\",IF(D71=\"\",0,IF(D71=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D71=\"Yes\"),AND($M$1=\"Scaled\",D71>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D71=\"No\"),AND($M$1=\"Scaled\",D71<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3368,"V.1.15.12","View raw system and application logs?",null,null,null,null,null,null,"9.2.3","Management of privileged access rights",3,null,1,15,12,0,0,0,{"$f":"IF(L72=\"\",\"\",IF(D72=\"\",0,IF(D72=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D72=\"Yes\"),AND($M$1=\"Scaled\",D72>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D72=\"No\"),AND($M$1=\"Scaled\",D72<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.H.9, WP.1.H.10",null,null,""]
[3369,"V.1.15.13","Specify data retention periods?",null,null,null,null,null,null,"9.2.3","Management of privileged access rights",3,null,1,15,13,0,0,0,{"$f":"IF(L73=\"\",\"\",IF(D73=\"\",0,IF(D73=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D73=\"Yes\"),AND($M$1=\"Scaled\",D73>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D73=\"No\"),AND($M$1=\"Scaled\",D73<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.2, WP.1.K.4",null,null,""]
[3370,"V.1.15.14","Delete data on request?",null,null,null,null,null,null,"9.2.3","Management of privileged access rights",3,null,1,15,14,0,0,0,{"$f":"IF(L74=\"\",\"\",IF(D74=\"\",0,IF(D74=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D74=\"Yes\"),AND($M$1=\"Scaled\",D74>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D74=\"No\"),AND($M$1=\"Scaled\",D74<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.2, WP.1.K.3",null,null,""]
[3371,"V.1.15.15","Data extraction tool or process to allow retrieval of data?",null,null,null,null,null,null,"9.2.3","Management of privileged access rights",3,null,1,15,15,0,0,0,{"$f":"IF(L75=\"\",\"\",IF(D75=\"\",0,IF(D75=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D75=\"Yes\"),AND($M$1=\"Scaled\",D75>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D75=\"No\"),AND($M$1=\"Scaled\",D75<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.5",null,null,""]
[3372,"V.1.15.16","Create image snapshots?",null,null,null,null,null,null,"9.2.3","Management of privileged access rights",3,null,1,15,16,0,0,0,{"$f":"IF(L76=\"\",\"\",IF(D76=\"\",0,IF(D76=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D76=\"Yes\"),AND($M$1=\"Scaled\",D76>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D76=\"No\"),AND($M$1=\"Scaled\",D76<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.D.1, WP.1.D.2",null,null,""]
[3373,"V.1.16","Is there a management approved process to ensure that image snapshots containing Scoped Data are authorized prior to being snapped?",null,null,null,null,null,null,"9.2.3","Management of privileged access rights",2,null,1,16,0,0,0,0,{"$f":"IF(L77=\"\",\"\",IF(D77=\"\",0,IF(D77=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D77=\"Yes\"),AND($M$1=\"Scaled\",D77>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D77=\"No\"),AND($M$1=\"Scaled\",D77<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.D.2",null,null,""]
[3374,"V.1.16.1","Are image snapshots containing Scoped Data stored in an environment where the security controls protecting them are commensurate with the production environment?",null,null,null,null,null,null,"9.2.3","Management of privileged access rights",3,null,1,16,1,0,0,0,{"$f":"IF(L78=\"\",\"\",IF(D78=\"\",0,IF(D78=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D78=\"Yes\"),AND($M$1=\"Scaled\",D78>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D78=\"No\"),AND($M$1=\"Scaled\",D78<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.D.2",null,null,""]
[3375,"V.1.17","Are clients provided the ability to:",null,null,null,null,null,null,"NA",null,2,1,1,17,0,0,0,0,{"$f":"IF(L79=\"\",\"\",IF(D79=\"\",0,IF(D79=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D79=\"Yes\"),AND($M$1=\"Scaled\",D79>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D79=\"No\"),AND($M$1=\"Scaled\",D79<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.10",null,null,""]
[3376,"V.1.17.1","Execute a vulnerability scan of the external environment?",null,null,null,null,null,"I.1 Application Vulnerability Assessments/Ethical Hacking","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,17,1,0,0,0,{"$f":"IF(L80=\"\",\"\",IF(D80=\"\",0,IF(D80=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D80=\"Yes\"),AND($M$1=\"Scaled\",D80>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D80=\"No\"),AND($M$1=\"Scaled\",D80<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[3377,"V.1.17.2","Execute a penetration test of the external environment?",null,null,null,null,null,"I.1 Application Vulnerability Assessments/Ethical Hacking","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,17,2,0,0,0,{"$f":"IF(L81=\"\",\"\",IF(D81=\"\",0,IF(D81=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D81=\"Yes\"),AND($M$1=\"Scaled\",D81>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D81=\"No\"),AND($M$1=\"Scaled\",D81<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.A.10, WP.1.I.7.d",null,null,""]
[3378,"V.1.17.3","Execute a secure code review?",null,null,null,null,null,"I.2 Secure Systems Development Life Cycle Code Reviews","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,17,3,0,0,0,{"$f":"IF(L82=\"\",\"\",IF(D82=\"\",0,IF(D82=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D82=\"Yes\"),AND($M$1=\"Scaled\",D82>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D82=\"No\"),AND($M$1=\"Scaled\",D82<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[3379,"V.1.18","Is there a cloud audit program to address client audit and assessment requirements? If yes, does this program permit:",null,null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",2,null,1,18,0,0,0,0,{"$f":"IF(L83=\"\",\"\",IF(D83=\"\",0,IF(D83=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D83=\"Yes\"),AND($M$1=\"Scaled\",D83>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D83=\"No\"),AND($M$1=\"Scaled\",D83<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,""]
[3380,"V.1.18.1","Onsite assessments by clients?",null,null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,18,1,0,0,0,{"$f":"IF(L84=\"\",\"\",IF(D84=\"\",0,IF(D84=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D84=\"Yes\"),AND($M$1=\"Scaled\",D84>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D84=\"No\"),AND($M$1=\"Scaled\",D84<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.F.5",null,null,""]
[3381,"V.1.18.2","Program documentation describing audit capabilities, roles and responsibilities?",null,null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,18,2,0,0,0,{"$f":"IF(L85=\"\",\"\",IF(D85=\"\",0,IF(D85=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D85=\"Yes\"),AND($M$1=\"Scaled\",D85>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D85=\"No\"),AND($M$1=\"Scaled\",D85<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.F.4, WP.1.F.5 ",null,null,""]
[3382,"V.1.18.3","Scheduled internal audits?",null,null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,18,3,0,0,0,{"$f":"IF(L86=\"\",\"\",IF(D86=\"\",0,IF(D86=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D86=\"Yes\"),AND($M$1=\"Scaled\",D86>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D86=\"No\"),AND($M$1=\"Scaled\",D86<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.J.6",null,null,""]
[3383,"V.1.18.4","Controls verification and validation performed by independent, third party information security professionals?",null,null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,18,4,0,0,0,{"$f":"IF(L87=\"\",\"\",IF(D87=\"\",0,IF(D87=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D87=\"Yes\"),AND($M$1=\"Scaled\",D87>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D87=\"No\"),AND($M$1=\"Scaled\",D87<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.F.4, WP.1.F.5 ",null,null,""]
[3384,"V.1.19","Is there a full time internal security team assigned to protecting the cloud infrastructure?",null,null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",2,null,1,19,0,0,0,0,{"$f":"IF(L88=\"\",\"\",IF(D88=\"\",0,IF(D88=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D88=\"Yes\"),AND($M$1=\"Scaled\",D88>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D88=\"No\"),AND($M$1=\"Scaled\",D88<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3385,"V.1.20","Are the following artifacts available during a client audit:",null,null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",2,1,1,20,0,0,0,0,{"$f":"IF(L89=\"\",\"\",IF(D89=\"\",0,IF(D89=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D89=\"Yes\"),AND($M$1=\"Scaled\",D89>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D89=\"No\"),AND($M$1=\"Scaled\",D89<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.E.1",null,null,""]
[3386,"V.1.20.1","Cloud topology and architecture diagrams?",null,null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,20,1,0,0,0,{"$f":"IF(L90=\"\",\"\",IF(D90=\"\",0,IF(D90=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D90=\"Yes\"),AND($M$1=\"Scaled\",D90>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D90=\"No\"),AND($M$1=\"Scaled\",D90<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.A.1, WP.1.E.1",null,null,""]
[3387,"V.1.20.2","Connectivity diagrams?",null,null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,20,2,0,0,0,{"$f":"IF(L91=\"\",\"\",IF(D91=\"\",0,IF(D91=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D91=\"Yes\"),AND($M$1=\"Scaled\",D91>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D91=\"No\"),AND($M$1=\"Scaled\",D91<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.A.1, WP.1.E.1",null,null,""]
[3388,"V.1.20.3","List of ports that are open externally?",null,null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,20,3,0,0,0,{"$f":"IF(L92=\"\",\"\",IF(D92=\"\",0,IF(D92=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D92=\"Yes\"),AND($M$1=\"Scaled\",D92>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D92=\"No\"),AND($M$1=\"Scaled\",D92<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.A.1, WP.1.E.1, WP.1.H.6, WP.1.I.2",null,null,""]
[3389,"V.1.20.4","Component and system configuration standards?",null,null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,20,4,0,0,0,{"$f":"IF(L93=\"\",\"\",IF(D93=\"\",0,IF(D93=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D93=\"Yes\"),AND($M$1=\"Scaled\",D93>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D93=\"No\"),AND($M$1=\"Scaled\",D93<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.I.4",null,null,""]
[3390,"V.1.20.5","Standard operating procedures?",null,null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,20,5,0,0,0,{"$f":"IF(L94=\"\",\"\",IF(D94=\"\",0,IF(D94=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D94=\"Yes\"),AND($M$1=\"Scaled\",D94>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D94=\"No\"),AND($M$1=\"Scaled\",D94<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.K.6",null,null,""]
[3391,"V.1.21","Who is responsible for user entitlement audits:",null,null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",2,1,1,21,0,0,0,0,{"$f":"IF(L95=\"\",\"\",IF(D95=\"\",0,IF(D95=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D95=\"Yes\"),AND($M$1=\"Scaled\",D95>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D95=\"No\"),AND($M$1=\"Scaled\",D95<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.H.9, WP.1.F.4, WP.1.F.5",null,null,""]
[3392,"V.1.21.1","Cloud provider?",null,null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,21,1,0,0,0,{"$f":"IF(L96=\"\",\"\",IF(D96=\"\",0,IF(D96=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D96=\"Yes\"),AND($M$1=\"Scaled\",D96>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D96=\"No\"),AND($M$1=\"Scaled\",D96<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.H.9, WP.1.F.4, WP.1.F.5",null,null,""]
[3393,"V.1.21.2","Client?",null,null,null,null,null,"V.3 Cloud Audit Program","15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",3,null,1,21,2,0,0,0,{"$f":"IF(L97=\"\",\"\",IF(D97=\"\",0,IF(D97=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D97=\"Yes\"),AND($M$1=\"Scaled\",D97>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D97=\"No\"),AND($M$1=\"Scaled\",D97<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.H.9, WP.1.F.4, WP.1.F.5",null,null,""]
[3394,"V.1.22","Is there a formal development methodology in operation? If yes, does this include:",null,null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","12.5.1","Control of Operational Software",2,null,1,22,0,0,0,0,{"$f":"IF(L98=\"\",\"\",IF(D98=\"\",0,IF(D98=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D98=\"Yes\"),AND($M$1=\"Scaled\",D98>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D98=\"No\"),AND($M$1=\"Scaled\",D98<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3",null,null,""]
[3395,"V.1.22.1","Waterfall",null,null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","NA",null,3,null,1,22,1,0,0,0,{"$f":"IF(L99=\"\",\"\",IF(D99=\"\",0,IF(D99=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D99=\"Yes\"),AND($M$1=\"Scaled\",D99>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D99=\"No\"),AND($M$1=\"Scaled\",D99<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3",null,null,""]
[3396,"V.1.22.2","Agile? If yes, what groups:",null,null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","NA",null,3,null,1,22,2,0,0,0,{"$f":"IF(L100=\"\",\"\",IF(D100=\"\",0,IF(D100=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D100=\"Yes\"),AND($M$1=\"Scaled\",D100>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D100=\"No\"),AND($M$1=\"Scaled\",D100<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3",null,null,""]
[3397,"V.1.22.2.1","Development?",null,null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","NA",null,4,null,1,22,2,1,0,0,{"$f":"IF(L101=\"\",\"\",IF(D101=\"\",0,IF(D101=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D101=\"Yes\"),AND($M$1=\"Scaled\",D101>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D101=\"No\"),AND($M$1=\"Scaled\",D101<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3",null,null,""]
[3398,"V.1.22.2.2","QA?",null,null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","NA",null,4,null,1,22,2,2,0,0,{"$f":"IF(L102=\"\",\"\",IF(D102=\"\",0,IF(D102=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D102=\"Yes\"),AND($M$1=\"Scaled\",D102>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D102=\"No\"),AND($M$1=\"Scaled\",D102<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3",null,null,""]
[3399,"V.1.22.2.3","Security?",null,null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","NA",null,4,null,1,22,2,3,0,0,{"$f":"IF(L103=\"\",\"\",IF(D103=\"\",0,IF(D103=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D103=\"Yes\"),AND($M$1=\"Scaled\",D103>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D103=\"No\"),AND($M$1=\"Scaled\",D103<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3",null,null,""]
[3400,"V.1.22.3","Other?",null,null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","NA",null,3,null,1,22,3,0,0,0,{"$f":"IF(L104=\"\",\"\",IF(D104=\"\",0,IF(D104=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D104=\"Yes\"),AND($M$1=\"Scaled\",D104>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D104=\"No\"),AND($M$1=\"Scaled\",D104<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3401,"V.1.23","Is there a formal process to ensure clients are notified prior to changes being made which may impact their service? If yes, what is the communication method:",null,null,null,null,null,"G.21 Change Control","12.1.2","Change management",2,null,1,23,0,0,0,0,{"$f":"IF(L105=\"\",\"\",IF(D105=\"\",0,IF(D105=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D105=\"Yes\"),AND($M$1=\"Scaled\",D105>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D105=\"No\"),AND($M$1=\"Scaled\",D105<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.F.6, WP.1.E.3",null,null,""]
[3402,"V.1.23.1","Post to website or portal?",null,null,null,null,null,"G.21 Change Control","NA",null,3,null,1,23,1,0,0,0,{"$f":"IF(L106=\"\",\"\",IF(D106=\"\",0,IF(D106=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D106=\"Yes\"),AND($M$1=\"Scaled\",D106>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D106=\"No\"),AND($M$1=\"Scaled\",D106<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.F.6, WP.1.E.3, WP.1.H.10",null,null,""]
[3403,"V.1.23.2","Email?",null,null,null,null,null,"G.21 Change Control","NA",null,3,null,1,23,2,0,0,0,{"$f":"IF(L107=\"\",\"\",IF(D107=\"\",0,IF(D107=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D107=\"Yes\"),AND($M$1=\"Scaled\",D107>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D107=\"No\"),AND($M$1=\"Scaled\",D107<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.F.6, WP.1.E.3",null,null,""]
[3404,"V.1.23.3","Verbal?",null,null,null,null,null,"G.21 Change Control","NA",null,3,null,1,23,3,0,0,0,{"$f":"IF(L108=\"\",\"\",IF(D108=\"\",0,IF(D108=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D108=\"Yes\"),AND($M$1=\"Scaled\",D108>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D108=\"No\"),AND($M$1=\"Scaled\",D108<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.F.6, WP.1.E.3",null,null,""]
[3405,"V.1.23.4","Other?",null,null,null,null,null,"G.21 Change Control","NA",null,3,null,1,23,4,0,0,0,{"$f":"IF(L109=\"\",\"\",IF(D109=\"\",0,IF(D109=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D109=\"Yes\"),AND($M$1=\"Scaled\",D109>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D109=\"No\"),AND($M$1=\"Scaled\",D109<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.F.6, WP.1.E.3",null,null,""]
[3406,"V.1.24","Is there a scheduled maintenance window? If yes, what is the frequency:",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.6.1 ","Management of technical vulnerabilities",2,null,1,24,0,0,0,0,{"$f":"IF(L110=\"\",\"\",IF(D110=\"\",0,IF(D110=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D110=\"Yes\"),AND($M$1=\"Scaled\",D110>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D110=\"No\"),AND($M$1=\"Scaled\",D110<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3407,"V.1.24.1","Daily?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","NA",null,3,null,1,24,1,0,0,0,{"$f":"IF(L111=\"\",\"\",IF(D111=\"\",0,IF(D111=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D111=\"Yes\"),AND($M$1=\"Scaled\",D111>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D111=\"No\"),AND($M$1=\"Scaled\",D111<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3408,"V.1.24.2","Weekly?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","NA",null,3,null,1,24,2,0,0,0,{"$f":"IF(L112=\"\",\"\",IF(D112=\"\",0,IF(D112=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D112=\"Yes\"),AND($M$1=\"Scaled\",D112>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D112=\"No\"),AND($M$1=\"Scaled\",D112<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3409,"V.1.24.3","Biweekly?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","NA",null,3,null,1,24,3,0,0,0,{"$f":"IF(L113=\"\",\"\",IF(D113=\"\",0,IF(D113=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D113=\"Yes\"),AND($M$1=\"Scaled\",D113>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D113=\"No\"),AND($M$1=\"Scaled\",D113<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3410,"V.1.24.4","Monthly?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","NA",null,3,null,1,24,4,0,0,0,{"$f":"IF(L114=\"\",\"\",IF(D114=\"\",0,IF(D114=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D114=\"Yes\"),AND($M$1=\"Scaled\",D114>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D114=\"No\"),AND($M$1=\"Scaled\",D114<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3411,"V.1.24.5","Other?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","NA",null,3,null,1,24,5,0,0,0,{"$f":"IF(L115=\"\",\"\",IF(D115=\"\",0,IF(D115=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D115=\"Yes\"),AND($M$1=\"Scaled\",D115>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D115=\"No\"),AND($M$1=\"Scaled\",D115<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3412,"V.1.25","Is there a scheduled maintenance window which results in client downtime? If yes, what is the downtime:",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","14.2.2.l","System change control procedures",2,null,1,25,0,0,0,0,{"$f":"IF(L116=\"\",\"\",IF(D116=\"\",0,IF(D116=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D116=\"Yes\"),AND($M$1=\"Scaled\",D116>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D116=\"No\"),AND($M$1=\"Scaled\",D116<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3413,"V.1.25.1","< 30 min?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","NA",null,3,null,1,25,1,0,0,0,{"$f":"IF(L117=\"\",\"\",IF(D117=\"\",0,IF(D117=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D117=\"Yes\"),AND($M$1=\"Scaled\",D117>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D117=\"No\"),AND($M$1=\"Scaled\",D117<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3414,"V.1.25.2",">30 min < 60 min?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","NA",null,3,null,1,25,2,0,0,0,{"$f":"IF(L118=\"\",\"\",IF(D118=\"\",0,IF(D118=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D118=\"Yes\"),AND($M$1=\"Scaled\",D118>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D118=\"No\"),AND($M$1=\"Scaled\",D118<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3415,"V.1.25.3",">60 min < 120 min?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","NA",null,3,null,1,25,3,0,0,0,{"$f":"IF(L119=\"\",\"\",IF(D119=\"\",0,IF(D119=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D119=\"Yes\"),AND($M$1=\"Scaled\",D119>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D119=\"No\"),AND($M$1=\"Scaled\",D119<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3416,"V.1.25.4",">120 min < 180 min?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","NA",null,3,null,1,25,4,0,0,0,{"$f":"IF(L120=\"\",\"\",IF(D120=\"\",0,IF(D120=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D120=\"Yes\"),AND($M$1=\"Scaled\",D120>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D120=\"No\"),AND($M$1=\"Scaled\",D120<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3417,"V.1.25.5","Other?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","NA",null,3,null,1,25,5,0,0,0,{"$f":"IF(L121=\"\",\"\",IF(D121=\"\",0,IF(D121=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D121=\"Yes\"),AND($M$1=\"Scaled\",D121>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D121=\"No\"),AND($M$1=\"Scaled\",D121<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.6, WP.1.K.7, WP.1.K.8",null,null,""]
[3418,"V.1.26","Is there an online incident response status portal, which outlines planned and unplanned outages? If yes, how long after an unplanned outage is this updated:",null,null,null,null,null,"J. Information Security Incident Management, P.8 Privacy Incident and Response Management","14.2.2","System change control procedures",2,null,1,26,0,0,0,0,{"$f":"IF(L122=\"\",\"\",IF(D122=\"\",0,IF(D122=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D122=\"Yes\"),AND($M$1=\"Scaled\",D122>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D122=\"No\"),AND($M$1=\"Scaled\",D122<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.F.6, WP.1.E.3",null,null,""]
[3419,"V.1.26.1","Real-time?",null,null,null,null,null,null,"NA",null,3,null,1,26,1,0,0,0,{"$f":"IF(L123=\"\",\"\",IF(D123=\"\",0,IF(D123=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D123=\"Yes\"),AND($M$1=\"Scaled\",D123>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D123=\"No\"),AND($M$1=\"Scaled\",D123<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.F.6, WP.1.E.3",null,null,""]
[3420,"V.1.26.2","< 30 min?",null,null,null,null,null,null,"NA",null,3,null,1,26,2,0,0,0,{"$f":"IF(L124=\"\",\"\",IF(D124=\"\",0,IF(D124=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D124=\"Yes\"),AND($M$1=\"Scaled\",D124>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D124=\"No\"),AND($M$1=\"Scaled\",D124<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.F.6, WP.1.E.3",null,null,""]
[3421,"V.1.26.3",">30 min < 60 min?",null,null,null,null,null,null,"NA",null,3,null,1,26,3,0,0,0,{"$f":"IF(L125=\"\",\"\",IF(D125=\"\",0,IF(D125=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D125=\"Yes\"),AND($M$1=\"Scaled\",D125>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D125=\"No\"),AND($M$1=\"Scaled\",D125<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.F.6, WP.1.E.3",null,null,""]
[3422,"V.1.26.4",">60 min < 120 min?",null,null,null,null,null,null,"NA",null,3,null,1,26,4,0,0,0,{"$f":"IF(L126=\"\",\"\",IF(D126=\"\",0,IF(D126=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D126=\"Yes\"),AND($M$1=\"Scaled\",D126>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D126=\"No\"),AND($M$1=\"Scaled\",D126<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.F.6, WP.1.E.3",null,null,""]
[3423,"V.1.26.5",">120 min < 180 min?",null,null,null,null,null,null,"NA",null,3,null,1,26,5,0,0,0,{"$f":"IF(L127=\"\",\"\",IF(D127=\"\",0,IF(D127=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D127=\"Yes\"),AND($M$1=\"Scaled\",D127>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D127=\"No\"),AND($M$1=\"Scaled\",D127<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.F.6, WP.1.E.3",null,null,""]
[3424,"V.1.26.6","Other?",null,null,null,null,null,null,"NA",null,3,null,1,26,6,0,0,0,{"$f":"IF(L128=\"\",\"\",IF(D128=\"\",0,IF(D128=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D128=\"Yes\"),AND($M$1=\"Scaled\",D128>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D128=\"No\"),AND($M$1=\"Scaled\",D128<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.F.6, WP.1.E.3",null,null,""]
[3425,"V.1.27","Is there the option for clients to opt-in or opt-out of specific features in releases?",null,null,null,null,null,null,"14.2.2","System change control procedures",2,null,1,27,0,0,0,0,{"$f":"IF(L129=\"\",\"\",IF(D129=\"\",0,IF(D129=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D129=\"Yes\"),AND($M$1=\"Scaled\",D129>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D129=\"No\"),AND($M$1=\"Scaled\",D129<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3426,"V.1.28","Is there a 24x7x365 staffed phone number available to clients to report security incidents?",null,null,null,null,null,"J. Information Security Incident Management, P.8 Privacy Incident and Response Management","15.1.1.h ","Information security policy for supplier relationships",2,null,1,28,0,0,0,0,{"$f":"IF(L130=\"\",\"\",IF(D130=\"\",0,IF(D130=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D130=\"Yes\"),AND($M$1=\"Scaled\",D130>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D130=\"No\"),AND($M$1=\"Scaled\",D130<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.E.3, WP.1.G.10",null,null,""]
[3427,"V.1.29","Are applications created and released into production? If yes, what is the release frequency:",null,null,null,null,null,"Q.1 Secure SDLC Policies, Standards and Procedures","12.5.1","Control of Operational Software",2,null,1,29,0,0,0,0,{"$f":"IF(L131=\"\",\"\",IF(D131=\"\",0,IF(D131=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D131=\"Yes\"),AND($M$1=\"Scaled\",D131>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D131=\"No\"),AND($M$1=\"Scaled\",D131<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7",null,null,""]
[3428,"V.1.29.1","Ad hoc?",null,null,null,null,null,null,"NA",null,3,null,1,29,1,0,0,0,{"$f":"IF(L132=\"\",\"\",IF(D132=\"\",0,IF(D132=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D132=\"Yes\"),AND($M$1=\"Scaled\",D132>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D132=\"No\"),AND($M$1=\"Scaled\",D132<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3429,"V.1.29.2","Daily?",null,null,null,null,null,null,"NA",null,3,null,1,29,2,0,0,{"$f":"IF(OR(Master=\"Master\",L133=0,M133=1),0,IF(ISNA(VLOOKUP(A133,L2_Array,22,FALSE)),0,VLOOKUP(A133,L2_Array,22,FALSE)))","v":0},{"$f":"IF(L133=\"\",\"\",IF(D133=\"\",0,IF(D133=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D133=\"Yes\"),AND($M$1=\"Scaled\",D133>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D133=\"No\"),AND($M$1=\"Scaled\",D133<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3430,{"$f":"IF(L134=0,\"\",IF(L134=1,S$1&\".\"&N134,IF(L134=2,S$1&\".\"&N134&\".\"&O134,IF(L134=3,S$1&\".\"&N134&\".\"&O134&\".\"&P134,IF(L134=4,S$1&\".\"&N134&\".\"&O134&\".\"&P134&\".\"&Q134,IF(L134=5,S$1&\".\"&N134&\".\"&O134&\".\"&P134&\".\"&Q134&\".\"&R134))))))","v":"V.1.29.3"},"Weekly?",null,null,null,null,null,null,"NA",null,3,null,{"$f":"IF(N133=\"\",1,IF(L134=1,N133+1,N133))","v":1},{"$f":"IF(O133=\"\",0,IF(N133<>N134,0,IF($L134=2,O133+1,O133)))","v":29},{"$f":"IF(P133=\"\",0,IF(O133<>O134,0,IF($L134=3,P133+1,P133)))","v":3},{"$f":"IF(Q133=\"\",0,IF(P133<>P134,0,IF($L134=4,Q133+1,Q133)))","v":0},{"$f":"IF(R133=\"\",0,IF(Q133<>Q134,0,IF($L134=5,R133+1,R133)))","v":0},0,{"$f":"IF(L134=\"\",\"\",IF(D134=\"\",0,IF(D134=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D134=\"Yes\"),AND($M$1=\"Scaled\",D134>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D134=\"No\"),AND($M$1=\"Scaled\",D134<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(L134=\"\",\"\",IF(S134>0,S134,IF(T134>0,T134,0)))","v":0},{"$f":"IF(OR(L134=\"\",L134=0),\"\",IF(OR(L134=1,V133=\"\"),1,IF(OR(AND(M133=1,(L134-L132<>0)),AND(V133=0,L133=L134),AND(M133=1,L134=L132)),0,1)))","v":1},{"$f":"IF(L134=\"\",W133,IF(AND(U134>1,OR(W133=\"\",W133=0,W133>=L134)),L134,IF(L134>W133,W133,0)))","v":0},{"$f":"IF(Master=\"Master\",T134,IF(X133=\"\",U134,IF(OR(AND(W134>0,U134<X133),AND(W134=1,U134<=X133)),X133,U134)))","v":0},{"$f":"IF(L134=\"\",\"\",IF(OR(AND(V133=1,W134=1),U134>0,AND(V135=0,Y135=1)),1,0))","v":0},{"$f":"IF(L134=\"\",\"\",IF(OR(AND(W134>0,V134=1),AND(V134=1,Y134=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A134,L2_Array,1,FALSE)),0,1)","v":0},null,null,null,{"$f":"IF(AND(L134=1,U134=1),2,IF(AND(X133=1,N134=N133),2,IF(AND(AE133=2,N134=N133),2,IF(L134=1,1,\"\"))))","v":""}]
[3431,"V.1.29.4","Biweekly?",null,null,null,null,null,null,"NA",null,3,null,1,29,4,0,0,0,{"$f":"IF(L135=\"\",\"\",IF(D135=\"\",0,IF(D135=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D135=\"Yes\"),AND($M$1=\"Scaled\",D135>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D135=\"No\"),AND($M$1=\"Scaled\",D135<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3432,"V.1.29.5","Monthly?",null,null,null,null,null,null,"NA",null,3,null,1,29,5,0,0,0,{"$f":"IF(L136=\"\",\"\",IF(D136=\"\",0,IF(D136=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D136=\"Yes\"),AND($M$1=\"Scaled\",D136>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D136=\"No\"),AND($M$1=\"Scaled\",D136<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3433,"V.1.29.6","> 3 months?",null,null,null,null,null,null,"NA",null,3,null,1,29,6,0,0,0,{"$f":"IF(L137=\"\",\"\",IF(D137=\"\",0,IF(D137=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D137=\"Yes\"),AND($M$1=\"Scaled\",D137>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D137=\"No\"),AND($M$1=\"Scaled\",D137<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3434,"V.1.29.7","> 6 months?",null,null,null,null,null,null,"NA",null,3,null,1,29,7,0,0,0,{"$f":"IF(L138=\"\",\"\",IF(D138=\"\",0,IF(D138=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D138=\"Yes\"),AND($M$1=\"Scaled\",D138>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D138=\"No\"),AND($M$1=\"Scaled\",D138<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3435,"V.1.29.8","Other?",null,null,null,null,null,null,"NA",null,3,null,1,29,8,0,0,0,{"$f":"IF(L139=\"\",\"\",IF(D139=\"\",0,IF(D139=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D139=\"Yes\"),AND($M$1=\"Scaled\",D139>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D139=\"No\"),AND($M$1=\"Scaled\",D139<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3436,"V.1.30","Is there an automated secure source code review? If yes, what is the frequency:",null,null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","12.5.1","Control of Operational Software",2,null,1,30,0,0,0,0,{"$f":"IF(L140=\"\",\"\",IF(D140=\"\",0,IF(D140=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D140=\"Yes\"),AND($M$1=\"Scaled\",D140>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D140=\"No\"),AND($M$1=\"Scaled\",D140<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7",null,null,""]
[3437,"V.1.30.1","Ad hoc?",null,null,null,null,null,null,"NA",null,3,null,1,30,1,0,0,0,{"$f":"IF(L141=\"\",\"\",IF(D141=\"\",0,IF(D141=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D141=\"Yes\"),AND($M$1=\"Scaled\",D141>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D141=\"No\"),AND($M$1=\"Scaled\",D141<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3438,"V.1.30.2","Daily?",null,null,null,null,null,null,"NA",null,3,null,1,30,2,0,0,0,{"$f":"IF(L142=\"\",\"\",IF(D142=\"\",0,IF(D142=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D142=\"Yes\"),AND($M$1=\"Scaled\",D142>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D142=\"No\"),AND($M$1=\"Scaled\",D142<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3439,"V.1.30.3","Weekly?",null,null,null,null,null,null,"NA",null,3,null,1,30,3,0,0,0,{"$f":"IF(L143=\"\",\"\",IF(D143=\"\",0,IF(D143=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D143=\"Yes\"),AND($M$1=\"Scaled\",D143>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D143=\"No\"),AND($M$1=\"Scaled\",D143<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3440,"V.1.30.4","Biweekly?",null,null,null,null,null,null,"NA",null,3,null,1,30,4,0,0,0,{"$f":"IF(L144=\"\",\"\",IF(D144=\"\",0,IF(D144=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D144=\"Yes\"),AND($M$1=\"Scaled\",D144>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D144=\"No\"),AND($M$1=\"Scaled\",D144<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3441,"V.1.30.5","Monthly?",null,null,null,null,null,null,"NA",null,3,null,1,30,5,0,0,0,{"$f":"IF(L145=\"\",\"\",IF(D145=\"\",0,IF(D145=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D145=\"Yes\"),AND($M$1=\"Scaled\",D145>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D145=\"No\"),AND($M$1=\"Scaled\",D145<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3442,"V.1.30.6","> 3 months?",null,null,null,null,null,null,"NA",null,3,null,1,30,6,0,0,0,{"$f":"IF(L146=\"\",\"\",IF(D146=\"\",0,IF(D146=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D146=\"Yes\"),AND($M$1=\"Scaled\",D146>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D146=\"No\"),AND($M$1=\"Scaled\",D146<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3443,"V.1.30.7","> 6 months?",null,null,null,null,null,null,"NA",null,3,null,1,30,7,0,0,0,{"$f":"IF(L147=\"\",\"\",IF(D147=\"\",0,IF(D147=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D147=\"Yes\"),AND($M$1=\"Scaled\",D147>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D147=\"No\"),AND($M$1=\"Scaled\",D147<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3444,"V.1.30.8","Other?",null,null,null,null,null,null,"NA",null,3,null,1,30,8,0,0,0,{"$f":"IF(L148=\"\",\"\",IF(D148=\"\",0,IF(D148=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D148=\"Yes\"),AND($M$1=\"Scaled\",D148>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D148=\"No\"),AND($M$1=\"Scaled\",D148<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3445,"V.1.31","Is source code security reviewed manually? If yes, what is the frequency:",null,null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","12.2.1                                                      12.5.1","Controls against malware,\nControl of Operational Software",2,null,1,31,0,0,0,0,{"$f":"IF(L149=\"\",\"\",IF(D149=\"\",0,IF(D149=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D149=\"Yes\"),AND($M$1=\"Scaled\",D149>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D149=\"No\"),AND($M$1=\"Scaled\",D149<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7",null,null,""]
[3446,"V.1.31.1","Ad hoc?",null,null,null,null,null,null,"NA",null,3,null,1,31,1,0,0,0,{"$f":"IF(L150=\"\",\"\",IF(D150=\"\",0,IF(D150=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D150=\"Yes\"),AND($M$1=\"Scaled\",D150>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D150=\"No\"),AND($M$1=\"Scaled\",D150<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3447,"V.1.31.2","Daily?",null,null,null,null,null,null,"NA",null,3,null,1,31,2,0,0,0,{"$f":"IF(L151=\"\",\"\",IF(D151=\"\",0,IF(D151=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D151=\"Yes\"),AND($M$1=\"Scaled\",D151>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D151=\"No\"),AND($M$1=\"Scaled\",D151<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3448,"V.1.31.3","Weekly?",null,null,null,null,null,null,"NA",null,3,null,1,31,3,0,0,0,{"$f":"IF(L152=\"\",\"\",IF(D152=\"\",0,IF(D152=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D152=\"Yes\"),AND($M$1=\"Scaled\",D152>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D152=\"No\"),AND($M$1=\"Scaled\",D152<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3449,"V.1.31.4","Biweekly?",null,null,null,null,null,null,"NA",null,3,null,1,31,4,0,0,0,{"$f":"IF(L153=\"\",\"\",IF(D153=\"\",0,IF(D153=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D153=\"Yes\"),AND($M$1=\"Scaled\",D153>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D153=\"No\"),AND($M$1=\"Scaled\",D153<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3450,"V.1.31.5","Monthly?",null,null,null,null,null,null,"NA",null,3,null,1,31,5,0,0,0,{"$f":"IF(L154=\"\",\"\",IF(D154=\"\",0,IF(D154=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D154=\"Yes\"),AND($M$1=\"Scaled\",D154>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D154=\"No\"),AND($M$1=\"Scaled\",D154<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3451,"V.1.31.6","> 3 months?",null,null,null,null,null,null,"NA",null,3,null,1,31,6,0,0,0,{"$f":"IF(L155=\"\",\"\",IF(D155=\"\",0,IF(D155=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D155=\"Yes\"),AND($M$1=\"Scaled\",D155>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D155=\"No\"),AND($M$1=\"Scaled\",D155<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3452,"V.1.31.7","> 6 months?",null,null,null,null,null,null,"NA",null,3,null,1,31,7,0,0,0,{"$f":"IF(L156=\"\",\"\",IF(D156=\"\",0,IF(D156=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D156=\"Yes\"),AND($M$1=\"Scaled\",D156>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D156=\"No\"),AND($M$1=\"Scaled\",D156<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3453,"V.1.31.8","Other?",null,null,null,null,null,null,"NA",null,3,null,1,31,8,0,0,0,{"$f":"IF(L157=\"\",\"\",IF(D157=\"\",0,IF(D157=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D157=\"Yes\"),AND($M$1=\"Scaled\",D157>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D157=\"No\"),AND($M$1=\"Scaled\",D157<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3454,"V.1.32","Are automated penetration tests performed? If yes, what is the frequency:",null,null,null,null,null,"I.1 Application Vulnerability Assessments/Ethical Hacking","12.2.1                                                      12.5.1                                              12.6.1","Controls against malware,\nControl of Operational Software                                    Management of technical vulnerabilities",2,null,1,32,0,0,0,0,{"$f":"IF(L158=\"\",\"\",IF(D158=\"\",0,IF(D158=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D158=\"Yes\"),AND($M$1=\"Scaled\",D158>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D158=\"No\"),AND($M$1=\"Scaled\",D158<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7, WP.1.A.10",null,null,""]
[3455,"V.1.32.1","Ad hoc?",null,null,null,null,null,null,"NA",null,3,null,1,32,1,0,0,0,{"$f":"IF(L159=\"\",\"\",IF(D159=\"\",0,IF(D159=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D159=\"Yes\"),AND($M$1=\"Scaled\",D159>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D159=\"No\"),AND($M$1=\"Scaled\",D159<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3456,"V.1.32.2","Daily?",null,null,null,null,null,null,"NA",null,3,null,1,32,2,0,0,0,{"$f":"IF(L160=\"\",\"\",IF(D160=\"\",0,IF(D160=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D160=\"Yes\"),AND($M$1=\"Scaled\",D160>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D160=\"No\"),AND($M$1=\"Scaled\",D160<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3457,"V.1.32.3","Weekly?",null,null,null,null,null,null,"NA",null,3,null,1,32,3,0,0,0,{"$f":"IF(L161=\"\",\"\",IF(D161=\"\",0,IF(D161=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D161=\"Yes\"),AND($M$1=\"Scaled\",D161>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D161=\"No\"),AND($M$1=\"Scaled\",D161<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3458,"V.1.32.4","Biweekly?",null,null,null,null,null,null,"NA",null,3,null,1,32,4,0,0,0,{"$f":"IF(L162=\"\",\"\",IF(D162=\"\",0,IF(D162=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D162=\"Yes\"),AND($M$1=\"Scaled\",D162>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D162=\"No\"),AND($M$1=\"Scaled\",D162<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3459,"V.1.32.5","Monthly?",null,null,null,null,null,null,"NA",null,3,null,1,32,5,0,0,0,{"$f":"IF(L163=\"\",\"\",IF(D163=\"\",0,IF(D163=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D163=\"Yes\"),AND($M$1=\"Scaled\",D163>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D163=\"No\"),AND($M$1=\"Scaled\",D163<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3460,"V.1.32.6","> 3 months?",null,null,null,null,null,null,"NA",null,3,null,1,32,6,0,0,0,{"$f":"IF(L164=\"\",\"\",IF(D164=\"\",0,IF(D164=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D164=\"Yes\"),AND($M$1=\"Scaled\",D164>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D164=\"No\"),AND($M$1=\"Scaled\",D164<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3461,"V.1.32.7","> 6 months?",null,null,null,null,null,null,"NA",null,3,null,1,32,7,0,0,0,{"$f":"IF(L165=\"\",\"\",IF(D165=\"\",0,IF(D165=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D165=\"Yes\"),AND($M$1=\"Scaled\",D165>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D165=\"No\"),AND($M$1=\"Scaled\",D165<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3462,"V.1.32.8","Other?",null,null,null,null,null,null,"NA",null,3,null,1,32,8,0,0,0,{"$f":"IF(L166=\"\",\"\",IF(D166=\"\",0,IF(D166=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D166=\"Yes\"),AND($M$1=\"Scaled\",D166>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D166=\"No\"),AND($M$1=\"Scaled\",D166<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3463,"V.1.33","Are manual penetration tests performed? If yes, what is the frequency:",null,null,null,null,null,"I.1 Application Vulnerability Assessments/Ethical Hacking","12.2.1                                                      12.5.1                                              12.6.1","Controls against malware,\nControl of Operational Software                                    Management of technical vulnerabilities",2,null,1,33,0,0,0,0,{"$f":"IF(L167=\"\",\"\",IF(D167=\"\",0,IF(D167=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D167=\"Yes\"),AND($M$1=\"Scaled\",D167>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D167=\"No\"),AND($M$1=\"Scaled\",D167<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7, WP.1.A.10",null,null,""]
[3464,"V.1.33.1","Ad hoc?",null,null,null,null,null,null,"NA",null,3,null,1,33,1,0,0,0,{"$f":"IF(L168=\"\",\"\",IF(D168=\"\",0,IF(D168=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D168=\"Yes\"),AND($M$1=\"Scaled\",D168>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D168=\"No\"),AND($M$1=\"Scaled\",D168<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3465,"V.1.33.2","Daily?",null,null,null,null,null,null,"NA",null,3,null,1,33,2,0,0,0,{"$f":"IF(L169=\"\",\"\",IF(D169=\"\",0,IF(D169=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D169=\"Yes\"),AND($M$1=\"Scaled\",D169>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D169=\"No\"),AND($M$1=\"Scaled\",D169<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3466,"V.1.33.3","Weekly?",null,null,null,null,null,null,"NA",null,3,null,1,33,3,0,0,0,{"$f":"IF(L170=\"\",\"\",IF(D170=\"\",0,IF(D170=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D170=\"Yes\"),AND($M$1=\"Scaled\",D170>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D170=\"No\"),AND($M$1=\"Scaled\",D170<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3467,"V.1.33.4","Biweekly?",null,null,null,null,null,null,"NA",null,3,null,1,33,4,0,0,0,{"$f":"IF(L171=\"\",\"\",IF(D171=\"\",0,IF(D171=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D171=\"Yes\"),AND($M$1=\"Scaled\",D171>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D171=\"No\"),AND($M$1=\"Scaled\",D171<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3468,"V.1.33.5","Monthly?",null,null,null,null,null,null,"NA",null,3,null,1,33,5,0,0,0,{"$f":"IF(L172=\"\",\"\",IF(D172=\"\",0,IF(D172=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D172=\"Yes\"),AND($M$1=\"Scaled\",D172>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D172=\"No\"),AND($M$1=\"Scaled\",D172<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3469,"V.1.33.6","> 3 months?",null,null,null,null,null,null,"NA",null,3,null,1,33,6,0,0,0,{"$f":"IF(L173=\"\",\"\",IF(D173=\"\",0,IF(D173=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D173=\"Yes\"),AND($M$1=\"Scaled\",D173>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D173=\"No\"),AND($M$1=\"Scaled\",D173<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3470,"V.1.33.7","> 6 months?",null,null,null,null,null,null,"NA",null,3,null,1,33,7,0,0,0,{"$f":"IF(L174=\"\",\"\",IF(D174=\"\",0,IF(D174=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D174=\"Yes\"),AND($M$1=\"Scaled\",D174>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D174=\"No\"),AND($M$1=\"Scaled\",D174<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3471,"V.1.33.8","Other?",null,null,null,null,null,null,"NA",null,3,null,1,33,8,0,0,0,{"$f":"IF(L175=\"\",\"\",IF(D175=\"\",0,IF(D175=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D175=\"Yes\"),AND($M$1=\"Scaled\",D175>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D175=\"No\"),AND($M$1=\"Scaled\",D175<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3472,"V.1.34","Are clients provided with the ability to specify where their data will be stored? If yes, what level:",null,null,null,null,null,"P.6 Management of Client Scoped Privacy Data","8.1.1                                                        15.1.1                                                         18.1.1","Inventory of Assets,                   Information security policy for supplier relationships,\nIdentification of Applicable Legislation",2,null,1,34,0,0,0,0,{"$f":"IF(L176=\"\",\"\",IF(D176=\"\",0,IF(D176=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D176=\"Yes\"),AND($M$1=\"Scaled\",D176>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D176=\"No\"),AND($M$1=\"Scaled\",D176<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.E.4, WP.1.G.2, WP.1.G.3",null,null,""]
[3473,"V.1.34.1","Data classification zone: based on security classification level (e.g., production networks, PCI networks)",null,null,null,null,null,"P.6 Management of Client Scoped Privacy Data","NA",null,3,null,1,34,1,0,0,0,{"$f":"IF(L177=\"\",\"\",IF(D177=\"\",0,IF(D177=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D177=\"Yes\"),AND($M$1=\"Scaled\",D177>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D177=\"No\"),AND($M$1=\"Scaled\",D177<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.E.4, WP.1.G.2, WP.1.G.3",null,null,""]
[3474,"V.1.34.2","Data center?",null,null,null,null,null,"P.6 Management of Client Scoped Privacy Data","NA",null,3,null,1,34,2,0,0,0,{"$f":"IF(L178=\"\",\"\",IF(D178=\"\",0,IF(D178=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D178=\"Yes\"),AND($M$1=\"Scaled\",D178>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D178=\"No\"),AND($M$1=\"Scaled\",D178<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.E.4, WP.1.G.2, WP.1.G.3",null,null,""]
[3475,"V.1.34.3","Country?",null,null,null,null,null,"P.6 Management of Client Scoped Privacy Data","NA",null,3,null,1,34,3,0,0,0,{"$f":"IF(L179=\"\",\"\",IF(D179=\"\",0,IF(D179=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D179=\"Yes\"),AND($M$1=\"Scaled\",D179>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D179=\"No\"),AND($M$1=\"Scaled\",D179<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.E.4, WP.1.G.2, WP.1.G.3",null,null,""]
[3476,"V.1.34.4","Location based on legal jurisdiction?",null,null,null,null,null,"P.6 Management of Client Scoped Privacy Data","NA",null,3,null,1,34,4,0,0,0,{"$f":"IF(L180=\"\",\"\",IF(D180=\"\",0,IF(D180=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D180=\"Yes\"),AND($M$1=\"Scaled\",D180>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D180=\"No\"),AND($M$1=\"Scaled\",D180<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.E.4, WP.1.G.2, WP.1.G.3",null,null,""]
[3477,"V.1.35","Are there legal data ownership agreements with clients? If yes, do they include:",null,null,null,null,null,"P.6 Management of Client Scoped Privacy Data","18.1.2                                                      18.2.3","Intellectual Property Rights,\nProtection of  Records",2,null,1,35,0,0,0,0,{"$f":"IF(L181=\"\",\"\",IF(D181=\"\",0,IF(D181=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D181=\"Yes\"),AND($M$1=\"Scaled\",D181>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D181=\"No\"),AND($M$1=\"Scaled\",D181<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.G.1",null,null,""]
[3478,"V.1.35.1","Who owns the data?",null,null,null,null,null,"P.6 Management of Client Scoped Privacy Data","18.1.2                                                      18.2.3","Intellectual Property Rights,\nProtection of  Records",3,null,1,35,1,0,0,0,{"$f":"IF(L182=\"\",\"\",IF(D182=\"\",0,IF(D182=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D182=\"Yes\"),AND($M$1=\"Scaled\",D182>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D182=\"No\"),AND($M$1=\"Scaled\",D182<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.G.1",null,null,""]
[3479,"V.1.35.2","What rights (if any) the cloud provider has to the client's complete data?",null,null,null,null,null,"P.6 Management of Client Scoped Privacy Data","18.1.2                                                      18.2.3","Intellectual Property Rights,\nProtection of  Records",3,null,1,35,2,0,0,0,{"$f":"IF(L183=\"\",\"\",IF(D183=\"\",0,IF(D183=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D183=\"Yes\"),AND($M$1=\"Scaled\",D183>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D183=\"No\"),AND($M$1=\"Scaled\",D183<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.G.1",null,null,""]
[3480,"V.1.35.3","What rights (if any) the cloud provider has to the client's aggregate/sanitized data?",null,null,null,null,null,"P.6 Management of Client Scoped Privacy Data","18.1.2                                                      18.2.3","Intellectual Property Rights,\nProtection of  Records",3,null,1,35,3,0,0,0,{"$f":"IF(L184=\"\",\"\",IF(D184=\"\",0,IF(D184=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D184=\"Yes\"),AND($M$1=\"Scaled\",D184>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D184=\"No\"),AND($M$1=\"Scaled\",D184<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.G.1",null,null,""]
[3481,"V.1.36","Does the ability exist to legally demonstrate sufficient data segmentation, in the event of a client subpoena or a forensics incident, so as not to impact other clients data if using resource pooling? If yes, is there a:",null,null,null,null,null,"V.1 Service and Deployment Models","16.1.1                                                     16.1.7","Responsibilities and Procedures,\nCollection of Evidence.",2,null,1,36,0,0,0,0,{"$f":"IF(L185=\"\",\"\",IF(D185=\"\",0,IF(D185=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D185=\"Yes\"),AND($M$1=\"Scaled\",D185>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D185=\"No\"),AND($M$1=\"Scaled\",D185<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.L.2, WP.1.G.5",null,null,""]
[3482,"V.1.36.1","Legal strategy document that can be shared with the client?",null,null,null,null,null,null,"NA",null,3,null,1,36,1,0,0,0,{"$f":"IF(L186=\"\",\"\",IF(D186=\"\",0,IF(D186=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D186=\"Yes\"),AND($M$1=\"Scaled\",D186>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D186=\"No\"),AND($M$1=\"Scaled\",D186<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.L.2, WP.1.G.5",null,null,""]
[3483,"V.1.36.2","Legal counsel (in-house or external) approval?",null,null,null,null,null,null,"NA",null,3,null,1,36,2,0,0,0,{"$f":"IF(L187=\"\",\"\",IF(D187=\"\",0,IF(D187=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D187=\"Yes\"),AND($M$1=\"Scaled\",D187>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D187=\"No\"),AND($M$1=\"Scaled\",D187<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.L.2, WP.1.G.5",null,null,""]
[3484,"V.1.37","Is there a data retention/destruction schedule? If yes, is it:",null,null,null,null,null,null,8.3000000000000007,"Media Handling",2,null,1,37,0,0,0,0,{"$f":"IF(L188=\"\",\"\",IF(D188=\"\",0,IF(D188=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D188=\"Yes\"),AND($M$1=\"Scaled\",D188>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D188=\"No\"),AND($M$1=\"Scaled\",D188<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3485,"V.1.37.1","Online: disk?",null,null,null,null,null,null,"NA",null,3,null,1,37,1,0,0,0,{"$f":"IF(L189=\"\",\"\",IF(D189=\"\",0,IF(D189=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D189=\"Yes\"),AND($M$1=\"Scaled\",D189>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D189=\"No\"),AND($M$1=\"Scaled\",D189<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.2, WP.1.K.3, WP.1.K.5",null,null,""]
[3486,"V.1.37.2","Offline: media: (e.g., DLT, DVD)?",null,null,null,null,null,null,"NA",null,3,null,1,37,2,0,0,0,{"$f":"IF(L190=\"\",\"\",IF(D190=\"\",0,IF(D190=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D190=\"Yes\"),AND($M$1=\"Scaled\",D190>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D190=\"No\"),AND($M$1=\"Scaled\",D190<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.2, WP.1.K.3, WP.1.K.5",null,null,""]
[3487,"V.1.37.3","Online: data managed by third party vendors?",null,null,null,null,null,null,"NA",null,3,null,1,37,3,0,0,0,{"$f":"IF(L191=\"\",\"\",IF(D191=\"\",0,IF(D191=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D191=\"Yes\"),AND($M$1=\"Scaled\",D191>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D191=\"No\"),AND($M$1=\"Scaled\",D191<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.2, WP.1.K.3, WP.1.K.5",null,null,""]
[3488,"V.1.37.4","Offline: data managed by third party vendors?",null,null,null,null,null,null,"NA",null,3,null,1,37,4,0,0,0,{"$f":"IF(L192=\"\",\"\",IF(D192=\"\",0,IF(D192=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D192=\"Yes\"),AND($M$1=\"Scaled\",D192>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D192=\"No\"),AND($M$1=\"Scaled\",D192<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.2, WP.1.K.3, WP.1.K.5",null,null,""]
[3489,"V.1.38","Is there a self-service portal or API call available to clients which provides the ability to place a \"Legal hold\" on client data which may be subject to a legal action, without impacting other clients data retention or destruction schedules?",null,null,null,null,null,"P.6 Management of Client Scoped Privacy Data","16.1.1                                                      16.1.7                                                          18.1.2                                             18.1.3","Responsibilities and Procedures,\nCollection of Evidence,\nIntellectual Property Rights,\nProtection of records",2,null,1,38,0,0,0,0,{"$f":"IF(L193=\"\",\"\",IF(D193=\"\",0,IF(D193=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D193=\"Yes\"),AND($M$1=\"Scaled\",D193>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D193=\"No\"),AND($M$1=\"Scaled\",D193<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.K.4",null,null,""]
[3490,"V.1.39","Is a Cloud API available to clients?",null,null,null,null,null,"H.3 Logical Access Authorization","NA",null,2,null,1,39,0,0,0,0,{"$f":"IF(L194=\"\",\"\",IF(D194=\"\",0,IF(D194=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D194=\"Yes\"),AND($M$1=\"Scaled\",D194>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D194=\"No\"),AND($M$1=\"Scaled\",D194<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,""]
[3491,"V.1.39.1","Is there a formal security program established to include API security reviews? If yes, does this include:",null,null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","12.5.1","Control of Operational Software",3,null,1,39,1,0,0,0,{"$f":"IF(L195=\"\",\"\",IF(D195=\"\",0,IF(D195=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D195=\"Yes\"),AND($M$1=\"Scaled\",D195>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D195=\"No\"),AND($M$1=\"Scaled\",D195<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3492,"V.1.39.1.1","API security evaluated at the requirements phase?",null,null,null,null,null,null,"12.5.1","Control of Operational Software",4,null,1,39,1,1,0,0,{"$f":"IF(L196=\"\",\"\",IF(D196=\"\",0,IF(D196=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D196=\"Yes\"),AND($M$1=\"Scaled\",D196>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D196=\"No\"),AND($M$1=\"Scaled\",D196<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3493,"V.1.39.1.2","Security review of API design?",null,null,null,null,null,null,"12.5.1","Control of Operational Software",4,null,1,39,1,2,0,{"$f":"IF(OR(Master=\"Master\",L197=0,M197=1),0,IF(ISNA(VLOOKUP(A197,L2_Array,22,FALSE)),0,VLOOKUP(A197,L2_Array,22,FALSE)))","v":0},{"$f":"IF(L197=\"\",\"\",IF(D197=\"\",0,IF(D197=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D197=\"Yes\"),AND($M$1=\"Scaled\",D197>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D197=\"No\"),AND($M$1=\"Scaled\",D197<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3494,{"$f":"IF(L198=0,\"\",IF(L198=1,S$1&\".\"&N198,IF(L198=2,S$1&\".\"&N198&\".\"&O198,IF(L198=3,S$1&\".\"&N198&\".\"&O198&\".\"&P198,IF(L198=4,S$1&\".\"&N198&\".\"&O198&\".\"&P198&\".\"&Q198,IF(L198=5,S$1&\".\"&N198&\".\"&O198&\".\"&P198&\".\"&Q198&\".\"&R198))))))","v":"V.1.39.1.3"},"API permission model review?",null,null,null,null,null,null,"12.5.1","Control of Operational Software",4,null,{"$f":"IF(N197=\"\",1,IF(L198=1,N197+1,N197))","v":1},{"$f":"IF(O197=\"\",0,IF(N197<>N198,0,IF($L198=2,O197+1,O197)))","v":39},{"$f":"IF(P197=\"\",0,IF(O197<>O198,0,IF($L198=3,P197+1,P197)))","v":1},{"$f":"IF(Q197=\"\",0,IF(P197<>P198,0,IF($L198=4,Q197+1,Q197)))","v":3},{"$f":"IF(R197=\"\",0,IF(Q197<>Q198,0,IF($L198=5,R197+1,R197)))","v":0},0,{"$f":"IF(L198=\"\",\"\",IF(D198=\"\",0,IF(D198=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D198=\"Yes\"),AND($M$1=\"Scaled\",D198>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D198=\"No\"),AND($M$1=\"Scaled\",D198<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(L198=\"\",\"\",IF(S198>0,S198,IF(T198>0,T198,0)))","v":0},{"$f":"IF(OR(L198=\"\",L198=0),\"\",IF(OR(L198=1,V197=\"\"),1,IF(OR(AND(M197=1,(L198-L196<>0)),AND(V197=0,L197=L198),AND(M197=1,L198=L196)),0,1)))","v":1},{"$f":"IF(L198=\"\",W197,IF(AND(U198>1,OR(W197=\"\",W197=0,W197>=L198)),L198,IF(L198>W197,W197,0)))","v":0},{"$f":"IF(Master=\"Master\",T198,IF(X197=\"\",U198,IF(OR(AND(W198>0,U198<X197),AND(W198=1,U198<=X197)),X197,U198)))","v":0},{"$f":"IF(L198=\"\",\"\",IF(OR(AND(V197=1,W198=1),U198>0,AND(V199=0,Y199=1)),1,0))","v":0},{"$f":"IF(L198=\"\",\"\",IF(OR(AND(W198>0,V198=1),AND(V198=1,Y198=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A198,L2_Array,1,FALSE)),0,1)","v":0},"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,{"$f":"IF(AND(L198=1,U198=1),2,IF(AND(X197=1,N198=N197),2,IF(AND(AE197=2,N198=N197),2,IF(L198=1,1,\"\"))))","v":""}]
[3495,"V.1.39.2","Is the API code security tested against OWASP top 10 security issues? If yes, does this include:",null,null,null,null,null,null,"12.6.1","Management of technical vulnerabilities",3,null,1,39,2,0,0,0,{"$f":"IF(L199=\"\",\"\",IF(D199=\"\",0,IF(D199=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D199=\"Yes\"),AND($M$1=\"Scaled\",D199>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D199=\"No\"),AND($M$1=\"Scaled\",D199<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3496,"V.1.39.2.1","Data scoping?",null,null,null,null,null,null,"NA",null,4,null,1,39,2,1,0,0,{"$f":"IF(L200=\"\",\"\",IF(D200=\"\",0,IF(D200=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D200=\"Yes\"),AND($M$1=\"Scaled\",D200>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D200=\"No\"),AND($M$1=\"Scaled\",D200<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3497,"V.1.39.2.2","XSS?",null,null,null,null,null,null,"NA",null,4,null,1,39,2,2,0,0,{"$f":"IF(L201=\"\",\"\",IF(D201=\"\",0,IF(D201=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D201=\"Yes\"),AND($M$1=\"Scaled\",D201>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D201=\"No\"),AND($M$1=\"Scaled\",D201<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3498,"V.1.39.2.3","SQL injection?",null,null,null,null,null,null,"NA",null,4,null,1,39,2,3,0,0,{"$f":"IF(L202=\"\",\"\",IF(D202=\"\",0,IF(D202=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D202=\"Yes\"),AND($M$1=\"Scaled\",D202>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D202=\"No\"),AND($M$1=\"Scaled\",D202<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3499,"V.1.39.2.4","Session abuse?",null,null,null,null,null,null,"NA",null,4,null,1,39,2,4,0,0,{"$f":"IF(L203=\"\",\"\",IF(D203=\"\",0,IF(D203=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D203=\"Yes\"),AND($M$1=\"Scaled\",D203>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D203=\"No\"),AND($M$1=\"Scaled\",D203<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3500,"V.1.39.2.5","Replay attack?",null,null,null,null,null,null,"NA",null,4,null,1,39,2,5,0,0,{"$f":"IF(L204=\"\",\"\",IF(D204=\"\",0,IF(D204=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D204=\"Yes\"),AND($M$1=\"Scaled\",D204>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D204=\"No\"),AND($M$1=\"Scaled\",D204<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3501,"V.1.39.2.6","DoS?",null,null,null,null,null,null,"NA",null,4,null,1,39,2,6,0,0,{"$f":"IF(L205=\"\",\"\",IF(D205=\"\",0,IF(D205=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D205=\"Yes\"),AND($M$1=\"Scaled\",D205>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D205=\"No\"),AND($M$1=\"Scaled\",D205<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3502,"V.1.39.2.7","Data Leakage",null,null,null,null,null,null,"NA",null,4,null,1,39,2,7,0,0,{"$f":"IF(L206=\"\",\"\",IF(D206=\"\",0,IF(D206=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D206=\"Yes\"),AND($M$1=\"Scaled\",D206>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D206=\"No\"),AND($M$1=\"Scaled\",D206<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.3, WP.1.I.4, WP.1.I.7",null,null,""]
[3503,"V.1.39.3","Is there the self-service ability to control access to APIs? If yes, does it include:",null,null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","9.1.2 ","Access to networks and network services",3,null,1,39,3,0,0,0,{"$f":"IF(L207=\"\",\"\",IF(D207=\"\",0,IF(D207=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D207=\"Yes\"),AND($M$1=\"Scaled\",D207>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D207=\"No\"),AND($M$1=\"Scaled\",D207<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.H.10, WP.1.A.1",null,null,""]
[3504,"V.1.39.3.1","Network: Network access control (e.g., firewall ACL)?",null,null,null,null,null,"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review","9.1.2 ","Access to networks and network services",4,null,1,39,3,1,0,0,{"$f":"IF(L208=\"\",\"\",IF(D208=\"\",0,IF(D208=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D208=\"Yes\"),AND($M$1=\"Scaled\",D208>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D208=\"No\"),AND($M$1=\"Scaled\",D208<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.A.2, WP.1.A.3",null,null,""]
[3505,"V.1.39.3.2","Network: VPN?",null,null,null,null,null,null,"9.1.2 ","Access to networks and network services",4,null,1,39,3,2,0,0,{"$f":"IF(L209=\"\",\"\",IF(D209=\"\",0,IF(D209=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D209=\"Yes\"),AND($M$1=\"Scaled\",D209>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D209=\"No\"),AND($M$1=\"Scaled\",D209<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.A.2, WP.1.A.3",null,null,""]
[3506,"V.1.39.3.3","Application: Application access control (e.g., application ACL)?",null,null,null,null,null,"I.5 Application Security Program Governance","9.4.1","Information access restriction",4,null,1,39,3,3,0,0,{"$f":"IF(L210=\"\",\"\",IF(D210=\"\",0,IF(D210=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D210=\"Yes\"),AND($M$1=\"Scaled\",D210>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D210=\"No\"),AND($M$1=\"Scaled\",D210<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.2, WP.1.A.1, WP.1.A.2, WP.1.A.3",null,null,""]
[3507,"V.1.39.3.4","Credential: username/password?",null,null,null,null,null,null,"9.4.2","Secure log-on procedures",4,null,1,39,3,4,0,0,{"$f":"IF(L211=\"\",\"\",IF(D211=\"\",0,IF(D211=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D211=\"Yes\"),AND($M$1=\"Scaled\",D211>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D211=\"No\"),AND($M$1=\"Scaled\",D211<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.2, WP.1.A.1, WP.1.A.2, WP.1.A.3",null,null,""]
[3508,"V.1.39.3.5","Credential: client side certificate?",null,null,null,null,null,null,"9.4.1","Information access restriction",4,null,1,39,3,5,0,0,{"$f":"IF(L212=\"\",\"\",IF(D212=\"\",0,IF(D212=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D212=\"Yes\"),AND($M$1=\"Scaled\",D212>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D212=\"No\"),AND($M$1=\"Scaled\",D212<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.2, WP.1.A.1, WP.1.A.2, WP.1.A.3",null,null,""]
[3509,"V.1.39.3.6","Credential: multi factor authentication?",null,null,null,null,null,null,"9.4.2","Secure log-on procedures",4,null,1,39,3,6,0,0,{"$f":"IF(L213=\"\",\"\",IF(D213=\"\",0,IF(D213=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D213=\"Yes\"),AND($M$1=\"Scaled\",D213>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D213=\"No\"),AND($M$1=\"Scaled\",D213<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.2, WP.1.A.1, WP.1.A.2, WP.1.A.3",null,null,""]
[3510,"V.1.39.4","Is there a self-service kill switch available to clients to disable an API in the event of a security incident (e.g., DoS)?",null,null,null,null,null,null,"9.4.1","Information access restriction",3,null,1,39,4,0,0,0,{"$f":"IF(L214=\"\",\"\",IF(D214=\"\",0,IF(D214=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D214=\"Yes\"),AND($M$1=\"Scaled\",D214>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D214=\"No\"),AND($M$1=\"Scaled\",D214<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.4, WP.1.I.7",null,null,""]
[3511,"V.1.39.5","Does the API have the ability to alert, block or lock based on rate limit?",null,null,null,null,null,null,"9.4.2","Secure log-on procedures",3,null,1,39,5,0,0,0,{"$f":"IF(L215=\"\",\"\",IF(D215=\"\",0,IF(D215=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D215=\"Yes\"),AND($M$1=\"Scaled\",D215>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D215=\"No\"),AND($M$1=\"Scaled\",D215<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.4, WP.1.I.7",null,null,""]
[3512,"V.1.39.6","Is Scoped Data encrypted in the API response? ",null,null,null,null,null,null,"10.1.1                                                     13.1.2","Policy on The Use of Cryptographic Controls  Security of network services",3,null,1,39,6,0,0,0,{"$f":"IF(L216=\"\",\"\",IF(D216=\"\",0,IF(D216=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D216=\"Yes\"),AND($M$1=\"Scaled\",D216>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D216=\"No\"),AND($M$1=\"Scaled\",D216<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.5, WP.1.A.6, WP.1.G.9, WP.1.I.4, WP.1.I.7",null,null,""]
[3513,"V.1.39.7","Is Scoped Data encrypted in the API request?",null,null,null,null,null,null,"10.1.1                                                     13.1.2","Policy on The Use of Cryptographic Controls  Security of network services",3,null,1,39,7,0,0,0,{"$f":"IF(L217=\"\",\"\",IF(D217=\"\",0,IF(D217=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D217=\"Yes\"),AND($M$1=\"Scaled\",D217>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D217=\"No\"),AND($M$1=\"Scaled\",D217<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.5, WP.1.A.6, WP.1.G.9, WP.1.I.4, WP.1.I.7",null,null,""]
[3514,"V.1.39.8","Is there an option for the API request calls to be digitally signed?",null,null,null,null,null,null,"10.1.1                                                     13.1.2","Policy on The Use of Cryptographic Controls  Security of network services",3,null,1,39,8,0,0,0,{"$f":"IF(L218=\"\",\"\",IF(D218=\"\",0,IF(D218=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D218=\"Yes\"),AND($M$1=\"Scaled\",D218>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D218=\"No\"),AND($M$1=\"Scaled\",D218<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.4, WP.1.I.7",null,null,""]
[3515,"V.1.39.9","Is there an option for the API response calls to be digitally signed?",null,null,null,null,null,null,"10.1.1                                                     13.1.2","Policy on The Use of Cryptographic Controls  Security of network services",3,null,1,39,9,0,0,0,{"$f":"IF(L219=\"\",\"\",IF(D219=\"\",0,IF(D219=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D219=\"Yes\"),AND($M$1=\"Scaled\",D219>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D219=\"No\"),AND($M$1=\"Scaled\",D219<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.4, WP.1.I.7",null,null,""]
[3516,"V.1.40","Is there a client management portal which allows distributed business accounts (business units/departments) to be managed under a single central corporate account?",null,null,null,null,null,null,"15.2.1","Monitoring and review of supplier services",2,null,1,40,0,0,0,0,{"$f":"IF(L220=\"\",\"\",IF(D220=\"\",0,IF(D220=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D220=\"Yes\"),AND($M$1=\"Scaled\",D220>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D220=\"No\"),AND($M$1=\"Scaled\",D220<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.J.1, WP.1.J.7, WP.1.A.3, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.H.6, WP.1.H.10",null,null,""]
[3517,"V.1.41","Are background checks performed? If yes, are they for:",null,null,null,null,null,"E.3 Background Investigation Policy Content","7.1.1                                                        7.2.1","Screening                         Management responsibilities",2,null,1,41,0,0,0,0,{"$f":"IF(L221=\"\",\"\",IF(D221=\"\",0,IF(D221=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D221=\"Yes\"),AND($M$1=\"Scaled\",D221>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D221=\"No\"),AND($M$1=\"Scaled\",D221<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3518,"V.1.41.1","Cloud provider staff?",null,null,null,null,null,null,"7.1.1                                                        7.2.1","Screening                         Management responsibilities",3,null,1,41,1,0,0,0,{"$f":"IF(L222=\"\",\"\",IF(D222=\"\",0,IF(D222=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D222=\"Yes\"),AND($M$1=\"Scaled\",D222>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D222=\"No\"),AND($M$1=\"Scaled\",D222<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3519,"V.1.41.2","Cloud provider contractors?",null,null,null,null,null,null,"7.1.1                                                        7.2.1","Screening                         Management responsibilities",3,null,1,41,2,0,0,0,{"$f":"IF(L223=\"\",\"\",IF(D223=\"\",0,IF(D223=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D223=\"Yes\"),AND($M$1=\"Scaled\",D223>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D223=\"No\"),AND($M$1=\"Scaled\",D223<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3520,"V.1.41.3","Cloud provider subcontractor?",null,null,null,null,null,null,"7.1.1                                                        7.2.1","Screening                         Management responsibilities",3,null,1,41,3,0,0,0,{"$f":"IF(L224=\"\",\"\",IF(D224=\"\",0,IF(D224=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D224=\"Yes\"),AND($M$1=\"Scaled\",D224>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D224=\"No\"),AND($M$1=\"Scaled\",D224<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3521,"V.1.41.4","What is the default frequency of the background checks:",null,null,null,null,null,null,"7.1.1                                                        7.2.1","Screening                         Management responsibilities",3,1,1,41,4,0,0,0,{"$f":"IF(L225=\"\",\"\",IF(D225=\"\",0,IF(D225=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D225=\"Yes\"),AND($M$1=\"Scaled\",D225>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D225=\"No\"),AND($M$1=\"Scaled\",D225<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3522,"V.1.41.4.1","At time of hire?",null,null,null,null,null,null,"NA",null,4,null,1,41,4,1,0,0,{"$f":"IF(L226=\"\",\"\",IF(D226=\"\",0,IF(D226=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D226=\"Yes\"),AND($M$1=\"Scaled\",D226>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D226=\"No\"),AND($M$1=\"Scaled\",D226<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3523,"V.1.41.4.2","Quarterly?",null,null,null,null,null,null,"NA",null,4,null,1,41,4,2,0,0,{"$f":"IF(L227=\"\",\"\",IF(D227=\"\",0,IF(D227=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D227=\"Yes\"),AND($M$1=\"Scaled\",D227>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D227=\"No\"),AND($M$1=\"Scaled\",D227<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3524,"V.1.41.4.3","Semiannually?",null,null,null,null,null,null,"NA",null,4,null,1,41,4,3,0,0,{"$f":"IF(L228=\"\",\"\",IF(D228=\"\",0,IF(D228=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D228=\"Yes\"),AND($M$1=\"Scaled\",D228>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D228=\"No\"),AND($M$1=\"Scaled\",D228<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3525,"V.1.41.4.4","Annually?",null,null,null,null,null,null,"NA",null,4,null,1,41,4,4,0,0,{"$f":"IF(L229=\"\",\"\",IF(D229=\"\",0,IF(D229=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D229=\"Yes\"),AND($M$1=\"Scaled\",D229>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D229=\"No\"),AND($M$1=\"Scaled\",D229<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3526,"V.1.41.4.5","Other?",null,null,null,null,null,null,"NA",null,4,null,1,41,4,5,0,0,{"$f":"IF(L230=\"\",\"\",IF(D230=\"\",0,IF(D230=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D230=\"Yes\"),AND($M$1=\"Scaled\",D230>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D230=\"No\"),AND($M$1=\"Scaled\",D230<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3532,"V.1.41.5","Who performs background checks on direct contractors",null,null,null,null,null,null,"7.1.1                                                        7.2.1","Screening                         Management responsibilities",3,1,1,41,5,0,0,0,{"$f":"IF(L231=\"\",\"\",IF(D231=\"\",0,IF(D231=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D231=\"Yes\"),AND($M$1=\"Scaled\",D231>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D231=\"No\"),AND($M$1=\"Scaled\",D231<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3533,"V.1.41.5.1","Direct contracting firm?",null,null,null,null,null,null,"NA",null,4,null,1,41,5,1,0,0,{"$f":"IF(L232=\"\",\"\",IF(D232=\"\",0,IF(D232=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D232=\"Yes\"),AND($M$1=\"Scaled\",D232>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D232=\"No\"),AND($M$1=\"Scaled\",D232<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3534,"V.1.41.5.2","Subcontracting firm?",null,null,null,null,null,null,"NA",null,4,null,1,41,5,2,0,0,{"$f":"IF(L233=\"\",\"\",IF(D233=\"\",0,IF(D233=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D233=\"Yes\"),AND($M$1=\"Scaled\",D233>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D233=\"No\"),AND($M$1=\"Scaled\",D233<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,null,null,null,""]
[3535,"V.1.41.5.3","Cloud provider?",null,null,null,null,null,null,"NA",null,4,null,1,41,5,3,0,0,{"$f":"IF(L234=\"\",\"\",IF(D234=\"\",0,IF(D234=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D234=\"Yes\"),AND($M$1=\"Scaled\",D234>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D234=\"No\"),AND($M$1=\"Scaled\",D234<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3536,"V.1.41.5.4","Client?",null,null,null,null,null,null,"NA",null,4,null,1,41,5,4,0,0,{"$f":"IF(L235=\"\",\"\",IF(D235=\"\",0,IF(D235=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D235=\"Yes\"),AND($M$1=\"Scaled\",D235>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D235=\"No\"),AND($M$1=\"Scaled\",D235<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3537,"V.1.41.5.5","Other?",null,null,null,null,null,null,"NA",null,4,null,1,41,5,5,0,0,{"$f":"IF(L236=\"\",\"\",IF(D236=\"\",0,IF(D236=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D236=\"Yes\"),AND($M$1=\"Scaled\",D236>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D236=\"No\"),AND($M$1=\"Scaled\",D236<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7",null,null,""]
[3538,"V.1.42","Is two factor authentication required to access the production cloud environment containing Scoped Data?  If yes, does it include:",null,null,null,null,null,"I.6 Application Security Vulnerability Assessment and Remediation","9.3.1","Use of secret authentication information",2,null,1,42,0,0,0,0,{"$f":"IF(L237=\"\",\"\",IF(D237=\"\",0,IF(D237=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D237=\"Yes\"),AND($M$1=\"Scaled\",D237>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D237=\"No\"),AND($M$1=\"Scaled\",D237<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.H.6, WP.1.I.4, WP.1.I.7",null,null,""]
[3539,"V.1.42.1","Admin access (shell or UI): Internally from within cloud provider network?",null,null,null,null,null,null,"9.4.1","Information access restriction",3,null,1,42,1,0,0,0,{"$f":"IF(L238=\"\",\"\",IF(D238=\"\",0,IF(D238=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D238=\"Yes\"),AND($M$1=\"Scaled\",D238>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D238=\"No\"),AND($M$1=\"Scaled\",D238<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.H.6, WP.1.I.4, WP.1.I.7",null,null,""]
[3540,"V.1.42.2","Non-admin access (shell or UI): Internally from within cloud provider network?",null,null,null,null,null,null,"9.4.1","Information access restriction",3,null,1,42,2,0,0,0,{"$f":"IF(L239=\"\",\"\",IF(D239=\"\",0,IF(D239=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D239=\"Yes\"),AND($M$1=\"Scaled\",D239>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D239=\"No\"),AND($M$1=\"Scaled\",D239<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.H.6, WP.1.I.4, WP.1.I.7",null,null,""]
[3541,"V.1.42.3","Admin access (shell or UI): remote access?",null,null,null,null,null,null,"9.4.1","Information access restriction",3,null,1,42,3,0,0,0,{"$f":"IF(L240=\"\",\"\",IF(D240=\"\",0,IF(D240=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D240=\"Yes\"),AND($M$1=\"Scaled\",D240>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D240=\"No\"),AND($M$1=\"Scaled\",D240<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.H.6, WP.1.I.4, WP.1.I.7",null,null,""]
[3542,"V.1.42.4","Non-admin access (shell or UI): remote access?",null,null,null,null,null,null,"9.4.1","Information access restriction",3,null,1,42,4,0,0,0,{"$f":"IF(L241=\"\",\"\",IF(D241=\"\",0,IF(D241=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D241=\"Yes\"),AND($M$1=\"Scaled\",D241>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D241=\"No\"),AND($M$1=\"Scaled\",D241<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.H.6, WP.1.I.4, WP.1.I.7",null,null,""]
[3543,"V.1.43","Are staff able to access client Scoped Data? If not, which of the following controls are used to prevent this:",null,null,null,null,null,"H.3 Logical Access Authorization","9.2.3\n9.4.1","Management of privileged access rights                                Information access restriction",2,null,1,43,0,0,0,0,{"$f":"IF(L242=\"\",\"\",IF(D242=\"\",0,IF(D242=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D242=\"Yes\"),AND($M$1=\"Scaled\",D242>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D242=\"No\"),AND($M$1=\"Scaled\",D242<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3544,"V.1.43.1","Preventative controls (e.g., technical)?",null,null,null,null,null,null,"9.2.3\n9.4.2","Management of privileged access rights                                Information access restriction",3,null,1,43,1,0,0,0,{"$f":"IF(L243=\"\",\"\",IF(D243=\"\",0,IF(D243=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D243=\"Yes\"),AND($M$1=\"Scaled\",D243>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D243=\"No\"),AND($M$1=\"Scaled\",D243<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3545,"V.1.43.2","Detective controls?",null,null,null,null,null,null,"9.2.3\n9.4.3","Management of privileged access rights                                Information access restriction",3,null,1,43,2,0,0,0,{"$f":"IF(L244=\"\",\"\",IF(D244=\"\",0,IF(D244=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D244=\"Yes\"),AND($M$1=\"Scaled\",D244>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D244=\"No\"),AND($M$1=\"Scaled\",D244<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3546,"V.1.43.3","Corrective controls?",null,null,null,null,null,null,"9.2.3\n9.4.4","Management of privileged access rights                                Information access restriction",3,null,1,43,3,0,0,0,{"$f":"IF(L245=\"\",\"\",IF(D245=\"\",0,IF(D245=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D245=\"Yes\"),AND($M$1=\"Scaled\",D245>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D245=\"No\"),AND($M$1=\"Scaled\",D245<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3547,"V.1.43.4","Policy controls?",null,null,null,null,null,null,"9.2.3\n9.4.5","Management of privileged access rights                                Information access restriction",3,null,1,43,4,0,0,0,{"$f":"IF(L246=\"\",\"\",IF(D246=\"\",0,IF(D246=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D246=\"Yes\"),AND($M$1=\"Scaled\",D246>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D246=\"No\"),AND($M$1=\"Scaled\",D246<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3548,"V.1.44","Are staff able to access client Scoped Data in an unencrypted state?",null,null,null,null,null,"H.3 Logical Access Authorization","9.2.3\n9.4.6","Management of privileged access rights                                Information access restriction",2,null,1,44,0,0,0,0,{"$f":"IF(L247=\"\",\"\",IF(D247=\"\",0,IF(D247=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D247=\"Yes\"),AND($M$1=\"Scaled\",D247>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D247=\"No\"),AND($M$1=\"Scaled\",D247<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3549,"V.1.45","Are staff able to access client's encryption key? If not, which of the following controls are used to prevent this:",null,null,null,null,null,"H.3 Logical Access Authorization","9.2.3\n9.4.7","Management of privileged access rights                                Information access restriction",2,null,1,45,0,0,0,0,{"$f":"IF(L248=\"\",\"\",IF(D248=\"\",0,IF(D248=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D248=\"Yes\"),AND($M$1=\"Scaled\",D248>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D248=\"No\"),AND($M$1=\"Scaled\",D248<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3550,"V.1.45.1","Preventative controls (e.g., technical)?",null,null,null,null,null,null,"NA",null,3,null,1,45,1,0,0,0,{"$f":"IF(L249=\"\",\"\",IF(D249=\"\",0,IF(D249=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D249=\"Yes\"),AND($M$1=\"Scaled\",D249>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D249=\"No\"),AND($M$1=\"Scaled\",D249<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3551,"V.1.45.2","Detective controls?",null,null,null,null,null,null,"NA",null,3,null,1,45,2,0,0,0,{"$f":"IF(L250=\"\",\"\",IF(D250=\"\",0,IF(D250=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D250=\"Yes\"),AND($M$1=\"Scaled\",D250>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D250=\"No\"),AND($M$1=\"Scaled\",D250<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3552,"V.1.45.3","Corrective controls?",null,null,null,null,null,null,"NA",null,3,null,1,45,3,0,0,0,{"$f":"IF(L251=\"\",\"\",IF(D251=\"\",0,IF(D251=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D251=\"Yes\"),AND($M$1=\"Scaled\",D251>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D251=\"No\"),AND($M$1=\"Scaled\",D251<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3553,"V.1.45.4","Policy controls?",null,null,null,null,null,null,"NA",null,3,null,1,45,4,0,0,0,{"$f":"IF(L252=\"\",\"\",IF(D252=\"\",0,IF(D252=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D252=\"Yes\"),AND($M$1=\"Scaled\",D252>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D252=\"No\"),AND($M$1=\"Scaled\",D252<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3554,"V.1.46","Is there a process which allows the client to specifically list who from the cloud provider will have access to their Scoped Systems and Data? If yes, does this include:",null,null,null,null,null,"H.3 Logical Access Authorization","9.1.1                                                        9.2.3","\tAccess Control Policy\nManagement of privileged access rights",2,null,1,46,0,0,0,0,{"$f":"IF(L253=\"\",\"\",IF(D253=\"\",0,IF(D253=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D253=\"Yes\"),AND($M$1=\"Scaled\",D253>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D253=\"No\"),AND($M$1=\"Scaled\",D253<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3555,"V.1.46.1","Role based access groups?",null,null,null,null,null,null,"NA",null,3,null,1,46,1,0,0,0,{"$f":"IF(L254=\"\",\"\",IF(D254=\"\",0,IF(D254=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D254=\"Yes\"),AND($M$1=\"Scaled\",D254>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D254=\"No\"),AND($M$1=\"Scaled\",D254<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3556,"V.1.46.2","Written approval from client?",null,null,null,null,null,null,"NA",null,3,null,1,46,2,0,0,0,{"$f":"IF(L255=\"\",\"\",IF(D255=\"\",0,IF(D255=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D255=\"Yes\"),AND($M$1=\"Scaled\",D255>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D255=\"No\"),AND($M$1=\"Scaled\",D255<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3557,"V.1.46.3","Other?",null,null,null,null,null,null,"NA",null,3,null,1,46,3,0,0,0,{"$f":"IF(L256=\"\",\"\",IF(D256=\"\",0,IF(D256=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D256=\"Yes\"),AND($M$1=\"Scaled\",D256>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D256=\"No\"),AND($M$1=\"Scaled\",D256<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1",null,null,""]
[3558,"V.1.47","Are staff technically prevented from accessing the cloud environment via non-managed private devices? If yes, is it from:",null,null,null,null,null,"H.3 Logical Access Authorization","9.1.1                                                        9.1.2                                                                               9.2.1                                                  9.2.3 ","Access control policy,\nAccess to networks and network services,\nUser registration and de-registration,\nManagement of privileged access rights",2,null,1,47,0,0,0,0,{"$f":"IF(L257=\"\",\"\",IF(D257=\"\",0,IF(D257=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D257=\"Yes\"),AND($M$1=\"Scaled\",D257>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D257=\"No\"),AND($M$1=\"Scaled\",D257<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.E.2, WP.1.H.6",null,null,""]
[3559,"V.1.47.1","Admin access (shell or UI): Internally from within cloud provider network?",null,null,null,null,null,null,"NA",null,3,null,1,47,1,0,0,0,{"$f":"IF(L258=\"\",\"\",IF(D258=\"\",0,IF(D258=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D258=\"Yes\"),AND($M$1=\"Scaled\",D258>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D258=\"No\"),AND($M$1=\"Scaled\",D258<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.E.2, WP.1.H.6",null,null,""]
[3560,"V.1.47.2","Non-Admin access (shell or UI): Internally from within cloud provider network?",null,null,null,null,null,null,"NA",null,3,null,1,47,2,0,0,0,{"$f":"IF(L259=\"\",\"\",IF(D259=\"\",0,IF(D259=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D259=\"Yes\"),AND($M$1=\"Scaled\",D259>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D259=\"No\"),AND($M$1=\"Scaled\",D259<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.E.2, WP.1.H.6",null,null,""]
[3561,"V.1.47.3","Admin access (shell or UI): Remote access?",null,null,null,null,null,null,"NA",null,3,null,1,47,3,0,0,0,{"$f":"IF(L260=\"\",\"\",IF(D260=\"\",0,IF(D260=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D260=\"Yes\"),AND($M$1=\"Scaled\",D260>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D260=\"No\"),AND($M$1=\"Scaled\",D260<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.E.2, WP.1.H.6",null,null,""]
[3562,"V.1.47.4","Non-admin access (shell or UI): remote access?",null,null,null,null,null,null,"NA",null,3,null,1,47,4,0,0,{"$f":"IF(OR(Master=\"Master\",L261=0,M261=1),0,IF(ISNA(VLOOKUP(A261,L2_Array,22,FALSE)),0,VLOOKUP(A261,L2_Array,22,FALSE)))","v":0},{"$f":"IF(L261=\"\",\"\",IF(D261=\"\",0,IF(D261=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D261=\"Yes\"),AND($M$1=\"Scaled\",D261>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D261=\"No\"),AND($M$1=\"Scaled\",D261<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.E.2, WP.1.H.6",null,null,""]
[3563,{"$f":"IF(L262=0,\"\",IF(L262=1,S$1&\".\"&N262,IF(L262=2,S$1&\".\"&N262&\".\"&O262,IF(L262=3,S$1&\".\"&N262&\".\"&O262&\".\"&P262,IF(L262=4,S$1&\".\"&N262&\".\"&O262&\".\"&P262&\".\"&Q262,IF(L262=5,S$1&\".\"&N262&\".\"&O262&\".\"&P262&\".\"&Q262&\".\"&R262))))))","v":"V.1.48"},"Are there controls to prevent one client attempting to compromise another client in a resource pooled environment? If yes, does that include:",null,null,null,null,null,"H.3 Logical Access Authorization","12.4.1                                                      15.2.1","Event Logging,\nMonitoring and review of supplier services",2,null,{"$f":"IF(N261=\"\",1,IF(L262=1,N261+1,N261))","v":1},{"$f":"IF(O261=\"\",0,IF(N261<>N262,0,IF($L262=2,O261+1,O261)))","v":48},{"$f":"IF(P261=\"\",0,IF(O261<>O262,0,IF($L262=3,P261+1,P261)))","v":0},{"$f":"IF(Q261=\"\",0,IF(P261<>P262,0,IF($L262=4,Q261+1,Q261)))","v":0},{"$f":"IF(R261=\"\",0,IF(Q261<>Q262,0,IF($L262=5,R261+1,R261)))","v":0},0,{"$f":"IF(L262=\"\",\"\",IF(D262=\"\",0,IF(D262=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D262=\"Yes\"),AND($M$1=\"Scaled\",D262>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D262=\"No\"),AND($M$1=\"Scaled\",D262<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(L262=\"\",\"\",IF(S262>0,S262,IF(T262>0,T262,0)))","v":0},{"$f":"IF(OR(L262=\"\",L262=0),\"\",IF(OR(L262=1,V261=\"\"),1,IF(OR(AND(M261=1,(L262-L260<>0)),AND(V261=0,L261=L262),AND(M261=1,L262=L260)),0,1)))","v":1},{"$f":"IF(L262=\"\",W261,IF(AND(U262>1,OR(W261=\"\",W261=0,W261>=L262)),L262,IF(L262>W261,W261,0)))","v":0},{"$f":"IF(Master=\"Master\",T262,IF(X261=\"\",U262,IF(OR(AND(W262>0,U262<X261),AND(W262=1,U262<=X261)),X261,U262)))","v":0},{"$f":"IF(L262=\"\",\"\",IF(OR(AND(V261=1,W262=1),U262>0,AND(V263=0,Y263=1)),1,0))","v":0},{"$f":"IF(L262=\"\",\"\",IF(OR(AND(W262>0,V262=1),AND(V262=1,Y262=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A262,L2_Array,1,FALSE)),0,1)","v":1},"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2",null,null,{"$f":"IF(AND(L262=1,U262=1),2,IF(AND(X261=1,N262=N261),2,IF(AND(AE261=2,N262=N261),2,IF(L262=1,1,\"\"))))","v":""}]
[3564,"V.1.48.1","Inbound/Outbound firewall?",null,null,null,null,null,null,"12.4.1                                                      15.2.1","Event Logging,\nMonitoring and review of supplier services",3,null,1,48,1,0,0,0,{"$f":"IF(L263=\"\",\"\",IF(D263=\"\",0,IF(D263=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D263=\"Yes\"),AND($M$1=\"Scaled\",D263>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D263=\"No\"),AND($M$1=\"Scaled\",D263<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2",null,null,""]
[3565,"V.1.48.2","IPS?",null,null,null,null,null,null,"12.4.1                                                      15.2.1","Event Logging,\nMonitoring and review of supplier services",3,null,1,48,2,0,0,0,{"$f":"IF(L264=\"\",\"\",IF(D264=\"\",0,IF(D264=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D264=\"Yes\"),AND($M$1=\"Scaled\",D264>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D264=\"No\"),AND($M$1=\"Scaled\",D264<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2",null,null,""]
[3566,"V.1.48.3","Real-time alerting?",null,null,null,null,null,null,"12.4.1                                                      15.2.1","Event Logging,\nMonitoring and review of supplier services",3,null,1,48,3,0,0,0,{"$f":"IF(L265=\"\",\"\",IF(D265=\"\",0,IF(D265=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D265=\"Yes\"),AND($M$1=\"Scaled\",D265>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D265=\"No\"),AND($M$1=\"Scaled\",D265<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2",null,null,""]
[3567,"V.1.48.4","Real-time monitoring by cloud provider?",null,null,null,null,null,null,"12.4.1                                                      15.2.1","Event Logging,\nMonitoring and review of supplier services",3,null,1,48,4,0,0,0,{"$f":"IF(L266=\"\",\"\",IF(D266=\"\",0,IF(D266=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D266=\"Yes\"),AND($M$1=\"Scaled\",D266>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D266=\"No\"),AND($M$1=\"Scaled\",D266<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2",null,null,""]
[3568,"V.1.49","Is a default hardened base virtual image available to clients? If yes, does it include:",null,null,null,null,null,"I.3 Secure System Hardening Standards","NA",null,2,null,1,49,0,0,0,0,{"$f":"IF(L267=\"\",\"\",IF(D267=\"\",0,IF(D267=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D267=\"Yes\"),AND($M$1=\"Scaled\",D267>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D267=\"No\"),AND($M$1=\"Scaled\",D267<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3569,"V.1.49.1","Cloud providers default hardened Image?",null,null,null,null,null,null,"NA",null,3,null,1,49,1,0,0,0,{"$f":"IF(L268=\"\",\"\",IF(D268=\"\",0,IF(D268=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D268=\"Yes\"),AND($M$1=\"Scaled\",D268>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D268=\"No\"),AND($M$1=\"Scaled\",D268<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3570,"V.1.49.2","Client supplied default hardening Image?",null,null,null,null,null,null,"NA",null,3,null,1,49,2,0,0,0,{"$f":"IF(L269=\"\",\"\",IF(D269=\"\",0,IF(D269=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D269=\"Yes\"),AND($M$1=\"Scaled\",D269>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D269=\"No\"),AND($M$1=\"Scaled\",D269<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3571,"V.1.49.3","Center for Internet Security (CIS) hardening standard?",null,null,null,null,null,null,"NA",null,3,null,1,49,3,0,0,0,{"$f":"IF(L270=\"\",\"\",IF(D270=\"\",0,IF(D270=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D270=\"Yes\"),AND($M$1=\"Scaled\",D270>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D270=\"No\"),AND($M$1=\"Scaled\",D270<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3572,"V.1.49.4","National Institute of Standards and Technology (NIST) hardening standard?",null,null,null,null,null,null,"NA",null,3,null,1,49,4,0,0,0,{"$f":"IF(L271=\"\",\"\",IF(D271=\"\",0,IF(D271=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D271=\"Yes\"),AND($M$1=\"Scaled\",D271>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D271=\"No\"),AND($M$1=\"Scaled\",D271<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3573,"V.1.49.5","SANS hardening standard?",null,null,null,null,null,null,"NA",null,3,null,1,49,5,0,0,0,{"$f":"IF(L272=\"\",\"\",IF(D272=\"\",0,IF(D272=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D272=\"Yes\"),AND($M$1=\"Scaled\",D272>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D272=\"No\"),AND($M$1=\"Scaled\",D272<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3574,"V.1.49.6","Vendor hardening standard?",null,null,null,null,null,null,"NA",null,3,null,1,49,6,0,0,0,{"$f":"IF(L273=\"\",\"\",IF(D273=\"\",0,IF(D273=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D273=\"Yes\"),AND($M$1=\"Scaled\",D273>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D273=\"No\"),AND($M$1=\"Scaled\",D273<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3575,"V.1.49.7","Other?",null,null,null,null,null,null,"NA",null,3,null,1,49,7,0,0,0,{"$f":"IF(L274=\"\",\"\",IF(D274=\"\",0,IF(D274=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D274=\"Yes\"),AND($M$1=\"Scaled\",D274>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D274=\"No\"),AND($M$1=\"Scaled\",D274<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3576,"V.1.50","Are systems and applications patched? If yes, how:",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.6.1 ","Management of technical vulnerabilities",2,null,1,50,0,0,0,0,{"$f":"IF(L275=\"\",\"\",IF(D275=\"\",0,IF(D275=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D275=\"Yes\"),AND($M$1=\"Scaled\",D275>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D275=\"No\"),AND($M$1=\"Scaled\",D275<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3577,"V.1.50.1","Cloud provider: deploy to the live server?",null,null,null,null,null,null,"NA",null,3,null,1,50,1,0,0,0,{"$f":"IF(L276=\"\",\"\",IF(D276=\"\",0,IF(D276=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D276=\"Yes\"),AND($M$1=\"Scaled\",D276>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D276=\"No\"),AND($M$1=\"Scaled\",D276<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.C.2, WP.1.C.3, WP.1.C.4, WP.1.F.4, WP.1.I.4, WP.1.I.6, WP.1.J.5",null,null,""]
[3578,"V.1.50.2","Client: deploy to the live server?",null,null,null,null,null,null,"NA",null,3,null,1,50,2,0,0,0,{"$f":"IF(L277=\"\",\"\",IF(D277=\"\",0,IF(D277=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D277=\"Yes\"),AND($M$1=\"Scaled\",D277>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D277=\"No\"),AND($M$1=\"Scaled\",D277<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.C.2, WP.1.C.3, WP.1.C.4, WP.1.F.4, WP.1.I.4, WP.1.I.6, WP.1.J.5",null,null,""]
[3579,"V.1.50.3","Cloud provider: deploy to the base image?",null,null,null,null,null,null,"NA",null,3,null,1,50,3,0,0,0,{"$f":"IF(L278=\"\",\"\",IF(D278=\"\",0,IF(D278=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D278=\"Yes\"),AND($M$1=\"Scaled\",D278>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D278=\"No\"),AND($M$1=\"Scaled\",D278<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.C.2, WP.1.C.3, WP.1.C.4, WP.1.F.4, WP.1.I.4, WP.1.I.6, WP.1.J.5",null,null,""]
[3580,"V.1.50.4","Client: deploy to the base image?",null,null,null,null,null,null,"NA",null,3,null,1,50,4,0,0,0,{"$f":"IF(L279=\"\",\"\",IF(D279=\"\",0,IF(D279=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D279=\"Yes\"),AND($M$1=\"Scaled\",D279>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D279=\"No\"),AND($M$1=\"Scaled\",D279<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.C.2, WP.1.C.3, WP.1.C.4, WP.1.F.4, WP.1.I.4, WP.1.I.6, WP.1.J.5",null,null,""]
[3581,"V.1.50.5","Other?",null,null,null,null,null,null,"NA",null,3,null,1,50,5,0,0,0,{"$f":"IF(L280=\"\",\"\",IF(D280=\"\",0,IF(D280=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D280=\"Yes\"),AND($M$1=\"Scaled\",D280>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D280=\"No\"),AND($M$1=\"Scaled\",D280<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.C.2, WP.1.C.3, WP.1.C.4, WP.1.F.4, WP.1.I.4, WP.1.I.6, WP.1.J.5",null,null,""]
[3582,"V.1.51","Which of the following are responsible for the base image and patching:",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.6.1 ","Management of technical vulnerabilities",2,1,1,51,0,0,0,0,{"$f":"IF(L281=\"\",\"\",IF(D281=\"\",0,IF(D281=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D281=\"Yes\"),AND($M$1=\"Scaled\",D281>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D281=\"No\"),AND($M$1=\"Scaled\",D281<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3583,"V.1.51.1","Cloud provider: initial base image hardening and patching?",null,null,null,null,null,null,"NA",null,3,null,1,51,1,0,0,0,{"$f":"IF(L282=\"\",\"\",IF(D282=\"\",0,IF(D282=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D282=\"Yes\"),AND($M$1=\"Scaled\",D282>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D282=\"No\"),AND($M$1=\"Scaled\",D282<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3584,"V.1.51.2","Client: Initial base image hardening and patching?",null,null,null,null,null,null,"NA",null,3,null,1,51,2,0,0,0,{"$f":"IF(L283=\"\",\"\",IF(D283=\"\",0,IF(D283=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D283=\"Yes\"),AND($M$1=\"Scaled\",D283>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D283=\"No\"),AND($M$1=\"Scaled\",D283<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3585,"V.1.51.3","Cloud provider: ongoing hardening and patching?",null,null,null,null,null,null,"NA",null,3,null,1,51,3,0,0,0,{"$f":"IF(L284=\"\",\"\",IF(D284=\"\",0,IF(D284=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D284=\"Yes\"),AND($M$1=\"Scaled\",D284>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D284=\"No\"),AND($M$1=\"Scaled\",D284<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3586,"V.1.51.4","Client: ongoing hardening and patching?",null,null,null,null,null,null,"NA",null,3,null,1,51,4,0,0,0,{"$f":"IF(L285=\"\",\"\",IF(D285=\"\",0,IF(D285=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D285=\"Yes\"),AND($M$1=\"Scaled\",D285>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D285=\"No\"),AND($M$1=\"Scaled\",D285<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4",null,null,""]
[3587,"V.1.52","Can image versions be electronically signed to insure integrity? If yes, who would perform:",null,null,null,null,null,null,"14.2.2                                                     14.2.4","System change control procedures,                                Restrictions on changes to software packages",2,null,1,52,0,0,0,0,{"$f":"IF(L286=\"\",\"\",IF(D286=\"\",0,IF(D286=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D286=\"Yes\"),AND($M$1=\"Scaled\",D286>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D286=\"No\"),AND($M$1=\"Scaled\",D286<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.D.1, WP.1.D.2, WP.1.D.3, WP.1.J.4, WP.1.J.5, WP.1.F4",null,null,""]
[3588,"V.1.52.1","Cloud provider?",null,null,null,null,null,null,"NA",null,3,null,1,52,1,0,0,0,{"$f":"IF(L287=\"\",\"\",IF(D287=\"\",0,IF(D287=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D287=\"Yes\"),AND($M$1=\"Scaled\",D287>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D287=\"No\"),AND($M$1=\"Scaled\",D287<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.D.1, WP.1.D.2, WP.1.D.3, WP.1.J.4, WP.1.J.5, WP.1.F4",null,null,""]
[3589,"V.1.52.2","Client?",null,null,null,null,null,null,"NA",null,3,null,1,52,2,0,0,0,{"$f":"IF(L288=\"\",\"\",IF(D288=\"\",0,IF(D288=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D288=\"Yes\"),AND($M$1=\"Scaled\",D288>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D288=\"No\"),AND($M$1=\"Scaled\",D288<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.D.1, WP.1.D.2, WP.1.D.3, WP.1.J.4, WP.1.J.5, WP.1.F4",null,null,""]
[3590,"V.1.53","Can clients run their own security services within their own cloud environment? If yes, can it include:",null,null,null,null,null,"V.3 Cloud Audit Program","12.4.1                                                     12.4.3                                                 12.5                                                12.6.1 ","Event logging,                           Administrator and operator logs,                                     Control of operational software,                   Management of technical vulnerabilities",2,null,1,53,0,0,0,0,{"$f":"IF(L289=\"\",\"\",IF(D289=\"\",0,IF(D289=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D289=\"Yes\"),AND($M$1=\"Scaled\",D289>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D289=\"No\"),AND($M$1=\"Scaled\",D289<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6",null,null,""]
[3591,"V.1.53.1","Firewall?",null,null,null,null,null,null,"NA",null,3,null,1,53,1,0,0,0,{"$f":"IF(L290=\"\",\"\",IF(D290=\"\",0,IF(D290=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D290=\"Yes\"),AND($M$1=\"Scaled\",D290>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D290=\"No\"),AND($M$1=\"Scaled\",D290<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6",null,null,""]
[3592,"V.1.53.2","IDS/IPS?",null,null,null,null,null,null,"NA",null,3,null,1,53,2,0,0,0,{"$f":"IF(L291=\"\",\"\",IF(D291=\"\",0,IF(D291=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D291=\"Yes\"),AND($M$1=\"Scaled\",D291>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D291=\"No\"),AND($M$1=\"Scaled\",D291<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6",null,null,""]
[3593,"V.1.53.3","Data integrity monitoring (host based Integrity)?",null,null,null,null,null,null,"NA",null,3,null,1,53,3,0,0,0,{"$f":"IF(L292=\"\",\"\",IF(D292=\"\",0,IF(D292=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D292=\"Yes\"),AND($M$1=\"Scaled\",D292>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D292=\"No\"),AND($M$1=\"Scaled\",D292<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6",null,null,""]
[3594,"V.1.53.4","Anti virus?",null,null,null,null,null,null,"NA",null,3,null,1,53,4,0,0,0,{"$f":"IF(L293=\"\",\"\",IF(D293=\"\",0,IF(D293=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D293=\"Yes\"),AND($M$1=\"Scaled\",D293>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D293=\"No\"),AND($M$1=\"Scaled\",D293<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6",null,null,""]
[3595,"V.1.53.5","Other (please specify)?",null,null,null,null,null,null,"NA",null,3,null,1,53,5,0,0,0,{"$f":"IF(L294=\"\",\"\",IF(D294=\"\",0,IF(D294=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D294=\"Yes\"),AND($M$1=\"Scaled\",D294>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D294=\"No\"),AND($M$1=\"Scaled\",D294<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6",null,null,""]
[3596,"V.1.54","Is 24x7x365 security monitoring performed? If yes, does it include:",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.4.1                                                     12.4.3                                                 12.5                                                12.6.1 ","Event logging,                           Administrator and operator logs,                                     Control of operational software,                   Management of technical vulnerabilities",2,null,1,54,0,0,0,0,{"$f":"IF(L295=\"\",\"\",IF(D295=\"\",0,IF(D295=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D295=\"Yes\"),AND($M$1=\"Scaled\",D295>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D295=\"No\"),AND($M$1=\"Scaled\",D295<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.2",null,null,""]
[3597,"V.1.54.1","Inbound: Internet to cloud platform (client)?",null,null,null,null,null,null,"NA",null,3,null,1,54,1,0,0,0,{"$f":"IF(L296=\"\",\"\",IF(D296=\"\",0,IF(D296=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D296=\"Yes\"),AND($M$1=\"Scaled\",D296>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D296=\"No\"),AND($M$1=\"Scaled\",D296<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.2",null,null,""]
[3598,"V.1.54.2","Outbound: Cloud platform (client) to internet?",null,null,null,null,null,null,"NA",null,3,null,1,54,2,0,0,0,{"$f":"IF(L297=\"\",\"\",IF(D297=\"\",0,IF(D297=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D297=\"Yes\"),AND($M$1=\"Scaled\",D297>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D297=\"No\"),AND($M$1=\"Scaled\",D297<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.2",null,null,""]
[3599,"V.1.54.3","Internal: Cloud staff environment to cloud platform (client)?",null,null,null,null,null,null,"NA",null,3,null,1,54,3,0,0,0,{"$f":"IF(L298=\"\",\"\",IF(D298=\"\",0,IF(D298=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D298=\"Yes\"),AND($M$1=\"Scaled\",D298>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D298=\"No\"),AND($M$1=\"Scaled\",D298<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.2",null,null,""]
[3600,"V.1.54.4","Internal: Cloud platform (client) to cloud staff environment?",null,null,null,null,null,null,"NA",null,3,null,1,54,4,0,0,0,{"$f":"IF(L299=\"\",\"\",IF(D299=\"\",0,IF(D299=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D299=\"Yes\"),AND($M$1=\"Scaled\",D299>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D299=\"No\"),AND($M$1=\"Scaled\",D299<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.2",null,null,""]
[3601,"V.1.54.5","Internal: Cloud platform (client) to cloud platform (client)?",null,null,null,null,null,null,"NA",null,3,null,1,54,5,0,0,0,{"$f":"IF(L300=\"\",\"\",IF(D300=\"\",0,IF(D300=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D300=\"Yes\"),AND($M$1=\"Scaled\",D300>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D300=\"No\"),AND($M$1=\"Scaled\",D300<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.2",null,null,""]
[3602,"V.1.55","Is there a specific Recovery Time Objective (RTO)? If yes, specify.",null,null,null,null,null,null,"17.1.2","Implementing information security continuity",2,null,1,55,0,0,0,0,{"$f":"IF(L301=\"\",\"\",IF(D301=\"\",0,IF(D301=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D301=\"Yes\"),AND($M$1=\"Scaled\",D301>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D301=\"No\"),AND($M$1=\"Scaled\",D301<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.K.10",null,null,""]
[3603,"V.1.56","Is there a specific Recovery Point Objective (RPO)? If yes, specify.",null,null,null,null,null,null,"17.1.2","Implementing information security continuity",2,null,1,56,0,0,0,0,{"$f":"IF(L302=\"\",\"\",IF(D302=\"\",0,IF(D302=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D302=\"Yes\"),AND($M$1=\"Scaled\",D302>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D302=\"No\"),AND($M$1=\"Scaled\",D302<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.11",null,null,""]
[3604,"V.1.57","Are any critical vendors necessary to provide the scoped services to clients?",null,null,null,null,null,"V.2 Nested Service Provider Relationships","17.1.2                                                     17.2.1","Implementing information security continuity \nAvailability of information processing facilities",2,null,1,57,0,0,0,0,{"$f":"IF(L303=\"\",\"\",IF(D303=\"\",0,IF(D303=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D303=\"Yes\"),AND($M$1=\"Scaled\",D303>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D303=\"No\"),AND($M$1=\"Scaled\",D303<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3605,"V.1.57.1","Is a critical vendor dependency chart made available to clients?",null,null,null,null,null,"V.2 Nested Service Provider Relationships","17.1.2                                                     17.2.1","Implementing information security continuity \nAvailability of information processing facilities",3,null,1,57,1,0,0,0,{"$f":"IF(L304=\"\",\"\",IF(D304=\"\",0,IF(D304=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D304=\"Yes\"),AND($M$1=\"Scaled\",D304>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D304=\"No\"),AND($M$1=\"Scaled\",D304<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.7",null,null,""]
[3606,"V.1.57.2","Are each of the vendors identified in the vendor dependency chart subjected to at least an annual disaster recovery test for service provided? If yes, is the test:",null,null,null,null,null,"V.2 Nested Service Provider Relationships","17.1.2                                                     17.2.1","Implementing information security continuity \nAvailability of information processing facilities",3,null,1,57,2,0,0,0,{"$f":"IF(L305=\"\",\"\",IF(D305=\"\",0,IF(D305=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D305=\"Yes\"),AND($M$1=\"Scaled\",D305>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D305=\"No\"),AND($M$1=\"Scaled\",D305<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.11",null,null,""]
[3607,"V.1.57.2.1","Table top?",null,null,null,null,null,null,"NA",null,4,null,1,57,2,1,0,0,{"$f":"IF(L306=\"\",\"\",IF(D306=\"\",0,IF(D306=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D306=\"Yes\"),AND($M$1=\"Scaled\",D306>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D306=\"No\"),AND($M$1=\"Scaled\",D306<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.11",null,null,""]
[3608,"V.1.57.2.2","Simulated test?",null,null,null,null,null,null,"NA",null,4,null,1,57,2,2,0,0,{"$f":"IF(L307=\"\",\"\",IF(D307=\"\",0,IF(D307=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D307=\"Yes\"),AND($M$1=\"Scaled\",D307>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D307=\"No\"),AND($M$1=\"Scaled\",D307<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.11",null,null,""]
[3609,"V.1.57.2.3","Functional test?",null,null,null,null,null,null,"NA",null,4,null,1,57,2,3,0,0,{"$f":"IF(L308=\"\",\"\",IF(D308=\"\",0,IF(D308=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D308=\"Yes\"),AND($M$1=\"Scaled\",D308>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D308=\"No\"),AND($M$1=\"Scaled\",D308<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.11",null,null,""]
[3610,"V.1.57.2.4","Full scale failover?",null,null,null,null,null,null,"NA",null,4,null,1,57,2,4,0,0,{"$f":"IF(L309=\"\",\"\",IF(D309=\"\",0,IF(D309=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D309=\"Yes\"),AND($M$1=\"Scaled\",D309>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D309=\"No\"),AND($M$1=\"Scaled\",D309<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.11",null,null,""]
[3611,"V.1.58","How many different critical vendors is the live cloud platform running on at any given time:",null,null,null,null,null,"V.2 Nested Service Provider Relationships","17.1.3","Verify, review and evaluate information security continuity",2,1,1,58,0,0,0,0,{"$f":"IF(L310=\"\",\"\",IF(D310=\"\",0,IF(D310=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D310=\"Yes\"),AND($M$1=\"Scaled\",D310>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D310=\"No\"),AND($M$1=\"Scaled\",D310<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.11",null,null,""]
[3612,"V.1.58.1","1?",null,null,null,null,null,null,"NA",null,3,null,1,58,1,0,0,0,{"$f":"IF(L311=\"\",\"\",IF(D311=\"\",0,IF(D311=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D311=\"Yes\"),AND($M$1=\"Scaled\",D311>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D311=\"No\"),AND($M$1=\"Scaled\",D311<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.K.11",null,null,""]
[3613,"V.1.58.2",">1 <2?",null,null,null,null,null,null,"NA",null,3,null,1,58,2,0,0,0,{"$f":"IF(L312=\"\",\"\",IF(D312=\"\",0,IF(D312=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D312=\"Yes\"),AND($M$1=\"Scaled\",D312>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D312=\"No\"),AND($M$1=\"Scaled\",D312<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.K.11",null,null,""]
[3614,"V.1.58.3","> 2?",null,null,null,null,null,null,"NA",null,3,null,1,58,3,0,0,0,{"$f":"IF(L313=\"\",\"\",IF(D313=\"\",0,IF(D313=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D313=\"Yes\"),AND($M$1=\"Scaled\",D313>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D313=\"No\"),AND($M$1=\"Scaled\",D313<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.K.11",null,null,""]
[3615,"V.1.59","How many separate data center(s) is the live cloud platform running in at any one time:",null,null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,1,1,59,0,0,0,0,{"$f":"IF(L314=\"\",\"\",IF(D314=\"\",0,IF(D314=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D314=\"Yes\"),AND($M$1=\"Scaled\",D314>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D314=\"No\"),AND($M$1=\"Scaled\",D314<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.11",null,null,""]
[3616,"V.1.59.1","1?",null,null,null,null,null,null,"NA",null,3,null,1,59,1,0,0,0,{"$f":"IF(L315=\"\",\"\",IF(D315=\"\",0,IF(D315=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D315=\"Yes\"),AND($M$1=\"Scaled\",D315>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D315=\"No\"),AND($M$1=\"Scaled\",D315<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.K.11",null,null,""]
[3617,"V.1.59.2",">1 <2?",null,null,null,null,null,null,"NA",null,3,null,1,59,2,0,0,0,{"$f":"IF(L316=\"\",\"\",IF(D316=\"\",0,IF(D316=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D316=\"Yes\"),AND($M$1=\"Scaled\",D316>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D316=\"No\"),AND($M$1=\"Scaled\",D316<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.K.11",null,null,""]
[3618,"V.1.59.3","> 2?",null,null,null,null,null,null,"NA",null,3,null,1,59,3,0,0,0,{"$f":"IF(L317=\"\",\"\",IF(D317=\"\",0,IF(D317=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D317=\"Yes\"),AND($M$1=\"Scaled\",D317>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D317=\"No\"),AND($M$1=\"Scaled\",D317<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.K.11",null,null,""]
[3619,"V.1.60","Which availability mode is the critical cloud infrastructure running:",null,null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,1,1,60,0,0,0,0,{"$f":"IF(L318=\"\",\"\",IF(D318=\"\",0,IF(D318=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D318=\"Yes\"),AND($M$1=\"Scaled\",D318>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D318=\"No\"),AND($M$1=\"Scaled\",D318<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.7",null,null,""]
[3620,"V.1.60.1","Cold standby?",null,null,null,null,null,null,"NA",null,3,null,1,60,1,0,0,0,{"$f":"IF(L319=\"\",\"\",IF(D319=\"\",0,IF(D319=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D319=\"Yes\"),AND($M$1=\"Scaled\",D319>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D319=\"No\"),AND($M$1=\"Scaled\",D319<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.K.7",null,null,""]
[3621,"V.1.60.2","Warm standby?",null,null,null,null,null,null,"NA",null,3,null,1,60,2,0,0,0,{"$f":"IF(L320=\"\",\"\",IF(D320=\"\",0,IF(D320=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D320=\"Yes\"),AND($M$1=\"Scaled\",D320>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D320=\"No\"),AND($M$1=\"Scaled\",D320<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.K.7",null,null,""]
[3622,"V.1.60.3","Active, Active?",null,null,null,null,null,null,"NA",null,3,null,1,60,3,0,0,0,{"$f":"IF(L321=\"\",\"\",IF(D321=\"\",0,IF(D321=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D321=\"Yes\"),AND($M$1=\"Scaled\",D321>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D321=\"No\"),AND($M$1=\"Scaled\",D321<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,0,0,0,0,0,0,"WP.1.K.7",null,null,""]
[3623,"V.1.61","Are the failover sites for the underlying infrastructure running on the same vendor physical systems?",null,null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,null,1,61,0,0,0,0,{"$f":"IF(L322=\"\",\"\",IF(D322=\"\",0,IF(D322=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D322=\"Yes\"),AND($M$1=\"Scaled\",D322>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D322=\"No\"),AND($M$1=\"Scaled\",D322<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.K.12",null,null,""]
[3734,"V.1.62","Are the failover sites for the underlying infrastructure running on different vendor physical systems?",null,null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,null,1,62,0,0,0,0,{"$f":"IF(L323=\"\",\"\",IF(D323=\"\",0,IF(D323=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D323=\"Yes\"),AND($M$1=\"Scaled\",D323>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D323=\"No\"),AND($M$1=\"Scaled\",D323<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.12",null,null,""]
[3624,"V.1.63","Is the critical infrastructure running active/active at two or more sites?",null,null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,null,1,63,0,0,0,0,{"$f":"IF(L324=\"\",\"\",IF(D324=\"\",0,IF(D324=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D324=\"Yes\"),AND($M$1=\"Scaled\",D324>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D324=\"No\"),AND($M$1=\"Scaled\",D324<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.K.12",null,null,""]
[3625,"V.1.64","Are sites failed over as part of normal operation or as part of a test? If yes, what is the frequency:",null,null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,null,1,64,0,0,0,{"$f":"IF(OR(Master=\"Master\",L325=0,M325=1),0,IF(ISNA(VLOOKUP(A325,L2_Array,22,FALSE)),0,VLOOKUP(A325,L2_Array,22,FALSE)))","v":0},{"$f":"IF(L325=\"\",\"\",IF(D325=\"\",0,IF(D325=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D325=\"Yes\"),AND($M$1=\"Scaled\",D325>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D325=\"No\"),AND($M$1=\"Scaled\",D325<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.K.11",null,null,""]
[3626,{"$f":"IF(L326=0,\"\",IF(L326=1,S$1&\".\"&N326,IF(L326=2,S$1&\".\"&N326&\".\"&O326,IF(L326=3,S$1&\".\"&N326&\".\"&O326&\".\"&P326,IF(L326=4,S$1&\".\"&N326&\".\"&O326&\".\"&P326&\".\"&Q326,IF(L326=5,S$1&\".\"&N326&\".\"&O326&\".\"&P326&\".\"&Q326&\".\"&R326))))))","v":"V.1.64.1"},"Never?",null,null,null,null,null,null,"NA",null,3,null,{"$f":"IF(N325=\"\",1,IF(L326=1,N325+1,N325))","v":1},{"$f":"IF(O325=\"\",0,IF(N325<>N326,0,IF($L326=2,O325+1,O325)))","v":64},{"$f":"IF(P325=\"\",0,IF(O325<>O326,0,IF($L326=3,P325+1,P325)))","v":1},{"$f":"IF(Q325=\"\",0,IF(P325<>P326,0,IF($L326=4,Q325+1,Q325)))","v":0},{"$f":"IF(R325=\"\",0,IF(Q325<>Q326,0,IF($L326=5,R325+1,R325)))","v":0},0,{"$f":"IF(L326=\"\",\"\",IF(D326=\"\",0,IF(D326=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D326=\"Yes\"),AND($M$1=\"Scaled\",D326>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D326=\"No\"),AND($M$1=\"Scaled\",D326<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},{"$f":"IF(L326=\"\",\"\",IF(S326>0,S326,IF(T326>0,T326,0)))","v":0},{"$f":"IF(OR(L326=\"\",L326=0),\"\",IF(OR(L326=1,V325=\"\"),1,IF(OR(AND(M325=1,(L326-L324<>0)),AND(V325=0,L325=L326),AND(M325=1,L326=L324)),0,1)))","v":1},{"$f":"IF(L326=\"\",W325,IF(AND(U326>1,OR(W325=\"\",W325=0,W325>=L326)),L326,IF(L326>W325,W325,0)))","v":0},{"$f":"IF(Master=\"Master\",T326,IF(X325=\"\",U326,IF(OR(AND(W326>0,U326<X325),AND(W326=1,U326<=X325)),X325,U326)))","v":0},{"$f":"IF(L326=\"\",\"\",IF(OR(AND(V325=1,W326=1),U326>0,AND(V327=0,Y327=1)),1,0))","v":0},{"$f":"IF(L326=\"\",\"\",IF(OR(AND(W326>0,V326=1),AND(V326=1,Y326=1)),1,0))","v":0},{"$f":"IF(ISNA(VLOOKUP(A326,L2_Array,1,FALSE)),0,1)","v":0},"WP.1.K.11",null,null,{"$f":"IF(AND(L326=1,U326=1),2,IF(AND(X325=1,N326=N325),2,IF(AND(AE325=2,N326=N325),2,IF(L326=1,1,\"\"))))","v":""}]
[3627,"V.1.64.2","Weekly?",null,null,null,null,null,null,"NA",null,3,null,1,64,2,0,0,0,{"$f":"IF(L327=\"\",\"\",IF(D327=\"\",0,IF(D327=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D327=\"Yes\"),AND($M$1=\"Scaled\",D327>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D327=\"No\"),AND($M$1=\"Scaled\",D327<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.11",null,null,""]
[3628,"V.1.64.3","Monthly?",null,null,null,null,null,null,"NA",null,3,null,1,64,3,0,0,0,{"$f":"IF(L328=\"\",\"\",IF(D328=\"\",0,IF(D328=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D328=\"Yes\"),AND($M$1=\"Scaled\",D328>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D328=\"No\"),AND($M$1=\"Scaled\",D328<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.11",null,null,""]
[3629,"V.1.64.4","Annually?",null,null,null,null,null,null,"NA",null,3,null,1,64,4,0,0,0,{"$f":"IF(L329=\"\",\"\",IF(D329=\"\",0,IF(D329=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D329=\"Yes\"),AND($M$1=\"Scaled\",D329>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D329=\"No\"),AND($M$1=\"Scaled\",D329<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.11",null,null,""]
[3630,"V.1.64.5","Dependent on change?",null,null,null,null,null,null,"NA",null,3,null,1,64,5,0,0,0,{"$f":"IF(L330=\"\",\"\",IF(D330=\"\",0,IF(D330=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D330=\"Yes\"),AND($M$1=\"Scaled\",D330>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D330=\"No\"),AND($M$1=\"Scaled\",D330<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.11",null,null,""]
[3631,"V.1.64.6","Continuous?",null,null,null,null,null,null,"NA",null,3,null,1,64,6,0,0,0,{"$f":"IF(L331=\"\",\"\",IF(D331=\"\",0,IF(D331=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D331=\"Yes\"),AND($M$1=\"Scaled\",D331>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D331=\"No\"),AND($M$1=\"Scaled\",D331<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.11",null,null,""]
[3632,"V.1.65","Are all suppliers of critical hardware, network services and facility services involved in annual continuity and recovery tests?",null,null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,null,1,65,0,0,0,0,{"$f":"IF(L332=\"\",\"\",IF(D332=\"\",0,IF(D332=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D332=\"Yes\"),AND($M$1=\"Scaled\",D332>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D332=\"No\"),AND($M$1=\"Scaled\",D332<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.K.11",null,null,""]
[3633,"V.1.66","Is the maturity of IT management processes formally evaluated at least annually using an established benchmark (e.g., COBIT maturity models)?",null,null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,null,1,66,0,0,0,0,{"$f":"IF(L333=\"\",\"\",IF(D333=\"\",0,IF(D333=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D333=\"Yes\"),AND($M$1=\"Scaled\",D333>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D333=\"No\"),AND($M$1=\"Scaled\",D333<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3634,"V.1.67","Are all critical technology service providers described on an architecture diagram that includes physical systems and facilities?",null,null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,null,1,67,0,0,0,0,{"$f":"IF(L334=\"\",\"\",IF(D334=\"\",0,IF(D334=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D334=\"Yes\"),AND($M$1=\"Scaled\",D334>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D334=\"No\"),AND($M$1=\"Scaled\",D334<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.E.1",null,null,""]
[3635,"V.1.67.1","Do the BCP failover test scenarios contain fail-over across critical vendors?",null,null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",3,null,1,67,1,0,0,0,{"$f":"IF(L335=\"\",\"\",IF(D335=\"\",0,IF(D335=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D335=\"Yes\"),AND($M$1=\"Scaled\",D335>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D335=\"No\"),AND($M$1=\"Scaled\",D335<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.6",null,null,""]
[3636,"V.1.67.2","Are there requirements to review and update the BCP for each significant business change to the critical supporting vendors?",null,null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",3,null,1,67,2,0,0,0,{"$f":"IF(L336=\"\",\"\",IF(D336=\"\",0,IF(D336=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D336=\"Yes\"),AND($M$1=\"Scaled\",D336>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D336=\"No\"),AND($M$1=\"Scaled\",D336<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.12",null,null,""]
[3637,"V.1.68","Are \"Red and Blue\" fully redundant networks run at the physical level?",null,null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,null,1,68,0,0,0,0,{"$f":"IF(L337=\"\",\"\",IF(D337=\"\",0,IF(D337=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D337=\"Yes\"),AND($M$1=\"Scaled\",D337>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D337=\"No\"),AND($M$1=\"Scaled\",D337<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3638,"V.1.69","Is there sufficient redundancy capacity to ensure services are not impacted in multi-tenancy environments during peak usage and above?",null,null,null,null,null,null,"17.1.3","Verify, review and evaluate information security continuity",2,null,1,69,0,0,0,0,{"$f":"IF(L338=\"\",\"\",IF(D338=\"\",0,IF(D338=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D338=\"Yes\"),AND($M$1=\"Scaled\",D338>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D338=\"No\"),AND($M$1=\"Scaled\",D338<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,""]
[3639,"V.1.70","Do contracts include a penalty or remediation clause for breach of availability and continuity SLAs? If yes, is the penalty based on:",null,null,null,null,null,null,"15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",2,null,1,70,0,0,0,0,{"$f":"IF(L339=\"\",\"\",IF(D339=\"\",0,IF(D339=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D339=\"Yes\"),AND($M$1=\"Scaled\",D339>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D339=\"No\"),AND($M$1=\"Scaled\",D339<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,null,null,null,""]
[3640,"V.1.70.1","Direct damages arising from breach of warranty or contract?",null,null,null,null,null,null,"NA",null,3,null,1,70,1,0,0,0,{"$f":"IF(L340=\"\",\"\",IF(D340=\"\",0,IF(D340=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D340=\"Yes\"),AND($M$1=\"Scaled\",D340>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D340=\"No\"),AND($M$1=\"Scaled\",D340<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3641,"V.1.70.2","Indirect damages arising from breach of warranty or contract?",null,null,null,null,null,null,"NA",null,3,null,1,70,2,0,0,0,{"$f":"IF(L341=\"\",\"\",IF(D341=\"\",0,IF(D341=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D341=\"Yes\"),AND($M$1=\"Scaled\",D341>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D341=\"No\"),AND($M$1=\"Scaled\",D341<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3642,"V.1.70.3","Indemnification for damages from breach of service obligations (or claims against customer for breach of service obligations)?",null,null,null,null,null,null,"NA",null,3,null,1,70,3,0,0,0,{"$f":"IF(L342=\"\",\"\",IF(D342=\"\",0,IF(D342=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D342=\"Yes\"),AND($M$1=\"Scaled\",D342>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D342=\"No\"),AND($M$1=\"Scaled\",D342<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3643,"V.1.70.4","Service credits for downtime?",null,null,null,null,null,null,"NA",null,3,null,1,70,4,0,0,0,{"$f":"IF(L343=\"\",\"\",IF(D343=\"\",0,IF(D343=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D343=\"Yes\"),AND($M$1=\"Scaled\",D343>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D343=\"No\"),AND($M$1=\"Scaled\",D343<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3644,"V.1.70.5","Grant customer a termination and/or refund right?",null,null,null,null,null,null,"NA",null,3,null,1,70,5,0,0,0,{"$f":"IF(L344=\"\",\"\",IF(D344=\"\",0,IF(D344=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D344=\"Yes\"),AND($M$1=\"Scaled\",D344>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D344=\"No\"),AND($M$1=\"Scaled\",D344<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3645,"V.1.70.6","Continued obligation to apply effort to resolve a problem?",null,null,null,null,null,null,"NA",null,3,null,1,70,6,0,0,0,{"$f":"IF(L345=\"\",\"\",IF(D345=\"\",0,IF(D345=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D345=\"Yes\"),AND($M$1=\"Scaled\",D345>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D345=\"No\"),AND($M$1=\"Scaled\",D345<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3646,"V.1.70.7","Calculation of business loss based on actual damages?",null,null,null,null,null,null,"NA",null,3,null,1,70,7,0,0,0,{"$f":"IF(L346=\"\",\"\",IF(D346=\"\",0,IF(D346=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D346=\"Yes\"),AND($M$1=\"Scaled\",D346>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D346=\"No\"),AND($M$1=\"Scaled\",D346<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3647,"V.1.71","Is priority access to resources from suppliers contractually ensured in the event of an adverse situation, affecting multiple customers of suppliers (e.g., fuel oil, recovery center space)?",null,null,null,null,null,null,"15.1.2                                                      15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",2,null,1,71,0,0,0,0,{"$f":"IF(L347=\"\",\"\",IF(D347=\"\",0,IF(D347=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D347=\"Yes\"),AND($M$1=\"Scaled\",D347>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D347=\"No\"),AND($M$1=\"Scaled\",D347<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3649,"V.1.72","Are Hypervisors used to manage systems used to transmit, process or store Scoped Data? If yes, are there:",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","14.1.2","Securing application services on public networks",2,null,1,72,0,0,0,0,{"$f":"IF(L348=\"\",\"\",IF(D348=\"\",0,IF(D348=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D348=\"Yes\"),AND($M$1=\"Scaled\",D348>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D348=\"No\"),AND($M$1=\"Scaled\",D348<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,1,"WP.1.D.1",null,null,""]
[3650,"V.1.72.1","Hypervisor hardening standards applied?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.6.1 ","Management of technical vulnerabilities",3,null,1,72,1,0,0,0,{"$f":"IF(L349=\"\",\"\",IF(D349=\"\",0,IF(D349=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D349=\"Yes\"),AND($M$1=\"Scaled\",D349>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D349=\"No\"),AND($M$1=\"Scaled\",D349<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.3",null,null,""]
[3651,"V.1.72.2","Standard builds/security compliance checks?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.6.1 ","Management of technical vulnerabilities",3,null,1,72,2,0,0,0,{"$f":"IF(L350=\"\",\"\",IF(D350=\"\",0,IF(D350=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D350=\"Yes\"),AND($M$1=\"Scaled\",D350>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D350=\"No\"),AND($M$1=\"Scaled\",D350<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.D.1",null,null,""]
[3652,"V.1.72.3","Current patches?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.6.1 ","Management of technical vulnerabilities",3,null,1,72,3,0,0,0,{"$f":"IF(L351=\"\",\"\",IF(D351=\"\",0,IF(D351=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D351=\"Yes\"),AND($M$1=\"Scaled\",D351>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D351=\"No\"),AND($M$1=\"Scaled\",D351<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.6",null,null,""]
[3653,"V.1.72.4","Unnecessary/unused services turned off?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.6.1 ","Management of technical vulnerabilities",3,null,1,72,4,0,0,0,{"$f":"IF(L352=\"\",\"\",IF(D352=\"\",0,IF(D352=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D352=\"Yes\"),AND($M$1=\"Scaled\",D352>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D352=\"No\"),AND($M$1=\"Scaled\",D352<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.4",null,null,""]
[3654,"V.1.72.5","Regular log reviews using a specific methodology to uncover potential incidents?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.4.1","Event logging",3,null,1,72,5,0,0,0,{"$f":"IF(L353=\"\",\"\",IF(D353=\"\",0,IF(D353=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D353=\"Yes\"),AND($M$1=\"Scaled\",D353>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D353=\"No\"),AND($M$1=\"Scaled\",D353<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.H.9",null,null,""]
[3655,"V.1.72.6","Sufficient information in the logs to evaluate incidents?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.4.1","Event logging",3,null,1,72,6,0,0,0,{"$f":"IF(L354=\"\",\"\",IF(D354=\"\",0,IF(D354=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D354=\"Yes\"),AND($M$1=\"Scaled\",D354>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D354=\"No\"),AND($M$1=\"Scaled\",D354<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.H.9",null,null,""]
[3656,"V.1.72.7","Logs retained for a minimum of one year?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.4.1","Event logging",3,null,1,72,7,0,0,0,{"$f":"IF(L355=\"\",\"\",IF(D355=\"\",0,IF(D355=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D355=\"Yes\"),AND($M$1=\"Scaled\",D355>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D355=\"No\"),AND($M$1=\"Scaled\",D355<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.H.9",null,null,""]
[3657,"V.1.72.8","System generated alerts in the event of an audit log failure?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.4.1","Event logging",3,null,1,72,8,0,0,0,{"$f":"IF(L356=\"\",\"\",IF(D356=\"\",0,IF(D356=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D356=\"Yes\"),AND($M$1=\"Scaled\",D356>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D356=\"No\"),AND($M$1=\"Scaled\",D356<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.H.9, WP.1.H.10",null,null,""]
[3658,"V.1.72.9","Audit logs stored on alternate systems?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.4.1","Event logging",3,null,1,72,9,0,0,0,{"$f":"IF(L357=\"\",\"\",IF(D357=\"\",0,IF(D357=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D357=\"Yes\"),AND($M$1=\"Scaled\",D357>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D357=\"No\"),AND($M$1=\"Scaled\",D357<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.H.9",null,null,""]
[3659,"V.1.72.10","Audit logs protected against modification, deletion, and/or inappropriate access?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.4.1","Event logging",3,null,1,72,10,0,0,0,{"$f":"IF(L358=\"\",\"\",IF(D358=\"\",0,IF(D358=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D358=\"Yes\"),AND($M$1=\"Scaled\",D358>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D358=\"No\"),AND($M$1=\"Scaled\",D358<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.H.9",null,null,""]
[3660,"V.1.72.11","Minimum password length at least eight characters?",null,null,null,null,null,"H.1 Password Controls","9.3.1","Use of secret authentication information",3,null,1,72,11,0,0,0,{"$f":"IF(L359=\"\",\"\",IF(D359=\"\",0,IF(D359=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D359=\"Yes\"),AND($M$1=\"Scaled\",D359>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D359=\"No\"),AND($M$1=\"Scaled\",D359<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.4",null,null,""]
[3661,"V.1.72.12","Complex passwords required?",null,null,null,null,null,"H.1 Password Controls","9.3.1","Use of secret authentication information",3,null,1,72,12,0,0,0,{"$f":"IF(L360=\"\",\"\",IF(D360=\"\",0,IF(D360=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D360=\"Yes\"),AND($M$1=\"Scaled\",D360>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D360=\"No\"),AND($M$1=\"Scaled\",D360<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.4",null,null,""]
[3662,"V.1.72.13","Minimum password expiration at least every 90 days?",null,null,null,null,null,"H.1 Password Controls","9.3.1","Use of secret authentication information",3,null,1,72,13,0,0,0,{"$f":"IF(L361=\"\",\"\",IF(D361=\"\",0,IF(D361=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D361=\"Yes\"),AND($M$1=\"Scaled\",D361>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D361=\"No\"),AND($M$1=\"Scaled\",D361<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.4",null,null,""]
[3663,"V.1.72.14","Password history of 12 before reuse?",null,null,null,null,null,"H.1 Password Controls","9.3.1","Use of secret authentication information",3,null,1,72,14,0,0,0,{"$f":"IF(L362=\"\",\"\",IF(D362=\"\",0,IF(D362=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D362=\"Yes\"),AND($M$1=\"Scaled\",D362>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D362=\"No\"),AND($M$1=\"Scaled\",D362<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.4",null,null,""]
[3664,"V.1.72.15","Password change requirements at first logon?",null,null,null,null,null,"H.1 Password Controls","9.3.1","Use of secret authentication information",3,null,1,72,15,0,0,0,{"$f":"IF(L363=\"\",\"\",IF(D363=\"\",0,IF(D363=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D363=\"Yes\"),AND($M$1=\"Scaled\",D363>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D363=\"No\"),AND($M$1=\"Scaled\",D363<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.4",null,null,""]
[3665,"V.1.72.16","Stand alone authentication requirements such as a PIN or secret question?",null,null,null,null,null,"H.1 Password Controls","9.3.1","Use of secret authentication information",3,null,1,72,16,0,0,0,{"$f":"IF(L364=\"\",\"\",IF(D364=\"\",0,IF(D364=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D364=\"Yes\"),AND($M$1=\"Scaled\",D364>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D364=\"No\"),AND($M$1=\"Scaled\",D364<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.I.4",null,null,""]
[3666,"V.1.72.17","Passwords encrypted in transit?",null,null,null,null,null,"H.1 Password Controls","9.3.1                                                        10.1.1","Use of secret authentication information,                                        Policy on the use of cryptographic controls",3,null,1,72,17,0,0,0,{"$f":"IF(L365=\"\",\"\",IF(D365=\"\",0,IF(D365=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D365=\"Yes\"),AND($M$1=\"Scaled\",D365>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D365=\"No\"),AND($M$1=\"Scaled\",D365<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3667,"V.1.72.18","Passwords encrypted or hashed in storage?",null,null,null,null,null,"H.1 Password Controls","9.3.1","Use of secret authentication information",3,null,1,72,18,0,0,0,{"$f":"IF(L366=\"\",\"\",IF(D366=\"\",0,IF(D366=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D366=\"Yes\"),AND($M$1=\"Scaled\",D366>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D366=\"No\"),AND($M$1=\"Scaled\",D366<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3668,"V.1.72.19","Passwords displayed when entered into a system?",null,null,null,null,null,"H.1 Password Controls","9.3.1","Use of secret authentication information",3,null,1,72,19,0,0,0,{"$f":"IF(L367=\"\",\"\",IF(D367=\"\",0,IF(D367=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D367=\"Yes\"),AND($M$1=\"Scaled\",D367>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D367=\"No\"),AND($M$1=\"Scaled\",D367<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.7",null,null,""]
[3669,"V.1.72.20","User accounts associated to a unique individual?",null,null,null,null,null,"H.1 Password Controls","9.2.1 ","User registration and de-registration",3,null,1,72,20,0,0,0,{"$f":"IF(L368=\"\",\"\",IF(D368=\"\",0,IF(D368=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D368=\"Yes\"),AND($M$1=\"Scaled\",D368>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D368=\"No\"),AND($M$1=\"Scaled\",D368<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.6",null,null,""]
[3670,"V.1.72.21","System lock requirements after 3-5 invalid login attempts?",null,null,null,null,null,null,"9.2.4 ","Management of secret authentication information of users",3,null,1,72,21,0,0,0,{"$f":"IF(L369=\"\",\"\",IF(D369=\"\",0,IF(D369=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D369=\"Yes\"),AND($M$1=\"Scaled\",D369>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D369=\"No\"),AND($M$1=\"Scaled\",D369<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.7",null,null,""]
[3671,"V.1.72.22","Restricted administrative access to the management interfaces?",null,null,null,null,null,"H.3 Logical Access Authorization","9.1.1                                                  9.2.3","Access control policy,               Management of privileged access rights",3,null,1,72,22,0,0,0,{"$f":"IF(L370=\"\",\"\",IF(D370=\"\",0,IF(D370=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D370=\"Yes\"),AND($M$1=\"Scaled\",D370>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D370=\"No\"),AND($M$1=\"Scaled\",D370<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.7",null,null,""]
[3672,"V.1.72.23","Disabling unneeded hypervisor services (e.g., file-sharing between the guest and the host operating system)?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","9.4.1","Information access restriction",3,null,1,72,23,0,0,0,{"$f":"IF(L371=\"\",\"\",IF(D371=\"\",0,IF(D371=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D371=\"Yes\"),AND($M$1=\"Scaled\",D371>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D371=\"No\"),AND($M$1=\"Scaled\",D371<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.7",null,null,""]
[3673,"V.1.72.24","Introspection capabilities to monitor the security of each guest operating system?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.4.1","Event logging",3,null,1,72,24,0,0,0,{"$f":"IF(L372=\"\",\"\",IF(D372=\"\",0,IF(D372=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D372=\"Yes\"),AND($M$1=\"Scaled\",D372>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D372=\"No\"),AND($M$1=\"Scaled\",D372<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.7",null,null,""]
[3674,"V.1.72.25","Introspection capabilities to monitor the security of activity taking place between each guest operating system?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.4.1","Event logging",3,null,1,72,25,0,0,0,{"$f":"IF(L373=\"\",\"\",IF(D373=\"\",0,IF(D373=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D373=\"Yes\"),AND($M$1=\"Scaled\",D373>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D373=\"No\"),AND($M$1=\"Scaled\",D373<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.7",null,null,""]
[3675,"V.1.72.26"," Separate network VLANs for host operating system communication with guest operating systems?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","13.1.3","Segregation in networks",3,null,1,72,26,0,0,0,{"$f":"IF(L374=\"\",\"\",IF(D374=\"\",0,IF(D374=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D374=\"Yes\"),AND($M$1=\"Scaled\",D374>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D374=\"No\"),AND($M$1=\"Scaled\",D374<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.2, WP.1.A.3, WP.1.A.8",null,null,""]
[3676,"V.1.72.27","Guest operating systems communicate on separate VLAN's from other Guest operating systems that they do not need to communicate with?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","13.1.3","Segregation in networks",3,null,1,72,27,0,0,0,{"$f":"IF(L375=\"\",\"\",IF(D375=\"\",0,IF(D375=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D375=\"Yes\"),AND($M$1=\"Scaled\",D375>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D375=\"No\"),AND($M$1=\"Scaled\",D375<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.2, WP.1.A.3, WP.1.A.8",null,null,""]
[3677,"V.1.72.28","Host operating system management interface on a separate network than those used by guest operating systems?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","13.1.3","Segregation in networks",3,null,1,72,28,0,0,0,{"$f":"IF(L376=\"\",\"\",IF(D376=\"\",0,IF(D376=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D376=\"Yes\"),AND($M$1=\"Scaled\",D376>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D376=\"No\"),AND($M$1=\"Scaled\",D376<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.2, WP.1.A.3, WP.1.A.8",null,null,""]
[3678,"V.1.72.29","Two factor authentication for access to the administrative interfaces?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","9.1.1","Access control policy",3,null,1,72,29,0,0,0,{"$f":"IF(L377=\"\",\"\",IF(D377=\"\",0,IF(D377=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D377=\"Yes\"),AND($M$1=\"Scaled\",D377>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D377=\"No\"),AND($M$1=\"Scaled\",D377<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3679,"V.1.72.30","Volume or disk partitioning to prevent inadvertent resource bottlenecks from guest operating systems?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.1.3","Capacity Management",3,null,1,72,30,0,0,0,{"$f":"IF(L378=\"\",\"\",IF(D378=\"\",0,IF(D378=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D378=\"Yes\"),AND($M$1=\"Scaled\",D378>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D378=\"No\"),AND($M$1=\"Scaled\",D378<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.A.2, WP.1.A.3, WP.1.A.8",null,null,""]
[3680,"V.1.72.31","Approval process before VMs can be created to avoid VM sprawl?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.1.2","Change Management",3,null,1,72,31,0,0,0,{"$f":"IF(L379=\"\",\"\",IF(D379=\"\",0,IF(D379=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D379=\"Yes\"),AND($M$1=\"Scaled\",D379>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D379=\"No\"),AND($M$1=\"Scaled\",D379<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3681,"V.1.72.32","Migration of VMs logged including source and target systems, time, user?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.4.1","Event logging",3,null,1,72,32,0,0,0,{"$f":"IF(L380=\"\",\"\",IF(D380=\"\",0,IF(D380=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D380=\"Yes\"),AND($M$1=\"Scaled\",D380>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D380=\"No\"),AND($M$1=\"Scaled\",D380<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]
[3682,"V.1.72.33","VM's in the same host sharing the risk and data classification?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.1.4","Separation of Development, Test, And Operational Facilities",3,null,1,72,33,0,0,0,{"$f":"IF(L381=\"\",\"\",IF(D381=\"\",0,IF(D381=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D381=\"Yes\"),AND($M$1=\"Scaled\",D381>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D381=\"No\"),AND($M$1=\"Scaled\",D381<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,"WP.1.K.1",null,null,""]
[3683,"V.1.72.34","VM's in the same host sharing system sensitivity level grouping (development and production not present on the same host)?",null,null,null,null,null,"V.4 Security Review of Hypervisor Configuration","12.1.4","Separation of Development, Test, And Operational Facilities",3,null,1,72,34,0,0,0,{"$f":"IF(L382=\"\",\"\",IF(D382=\"\",0,IF(D382=\"N/A\",3,IF(OR(AND($M$1=\"Binary\",D382=\"Yes\"),AND($M$1=\"Scaled\",D382>Dashboard!$D$12)),1,IF(OR(AND($M$1=\"Binary\",D382=\"No\"),AND($M$1=\"Scaled\",D382<=Dashboard!$D$12)),2,\"Oops there is an error\")))))","v":0},0,1,0,0,0,0,0,null,null,null,""]

{"sheet":"Z. Additional Questions","index":23,"n_rows":5,"n_cols":7,"rows_kept":5,"cut":false,"hidden":false,"merged":[[2,0,2,6]]}
["Z. Additional Questions"]
[]
["This tab is used to supply any additional questions not covered by this SIG. Questions on this tab will not be analyzed by the SIG Management Tool."]
[]
["Ques Num","Question/Request","Response","Additional Information","AUP Reference","ISO Ref Num","ISO Ref Text"]

{"sheet":"Glossary","index":24,"n_rows":142,"n_cols":3,"rows_kept":142,"cut":false,"hidden":false,"merged":[]}
[null,"Acceptable Use Policy","Part of the information security framework that defines what users are and are not allowed to do with the IT systems of the respondent. It should contain a subset of the information security policy and refer users to the full security policy when relevant. It should also clearly define the sanctions applied if a user violates the policy."]
[null,"Glossary"]
[null,"Term","Definition"]
[null,"Acknowledgement of Acceptable Use","A written attestation from a user of an information system indicating the user's acceptance and willingness to comply with the relevant information systems control policies."]
[null,"Anti-Tailgating / Anti-Piggybacking Mechanism","Two sets of doors whereby access to the second is not granted until the individual has passed through (and closed) the first, often referred to as a \"man trap.\" A controlled turnstile is also considered an anti-tailgating/piggybacking mechanism."]
[null,"Asset Classification","The category or type assigned to an asset, which is derived from the asset classification policy. Asset classifications frequently vary from company to company."]
[null,"Asset Control Tag","A unique identification number assigned to all inventoried assets."]
[null,"Asset Management Program","A program for managing an organization's assets which includes formalized governance, policies, and procedures. "]
[null,"Attribute","A property or field of a particular object."]
[null,"Baseline","A benchmark by which subsequent items are measured."]
[null,"Battery","An electrochemical cell (or enclosed and protected material) that can be charged electrically to provide a static potential for power or released electrical charge when needed."]
[null,"Biometric Reader","A device that uses measurable biological characteristics such as fingerprints or iris patterns to assist in authenticating a person to an electronic system."]
[null,"Business Continuity","A set of planning, preparatory and related activities which are intended to ensure an organization's critical business functions will either continue to operate despite serious incidents or disasters that might otherwise have interrupted them, or will be recovered to an operational state within a reasonably short period."]
[null,"Business Impact Analysis (BIA)","This term is applicable across Technology Risk Management, in both information security and business continuity planning domains. An impact analysis results in the differentiation between critical and non-critical business functions. A function may be considered critical if there is an unacceptable impact to stakeholders from damage to the function. The perception of the acceptability of disruption may be modified by the cost of establishing and maintaining appropriate business or technical recovery solutions. A function may also be considered critical if dictated by law."]
[null,"Business Process","An end-to-end service made available to internal or external parties that usually corresponds to standard service products that the Service Provider offers to clients."]
[null,"Business Resiliency","The ability an organization has to quickly adapt to disruptions while maintaining continuous business operations and safeguarding people, assets and overall brand equity. Business resilience is more than disaster recovery, it includes post-disaster strategies to avoid costly downtime, the identification and resolution of vulnerabilities and the ability to maintain business operations in the face of additional, unexpected breaches."]
[null,"Business Resiliency Procedure","A process that defines exactly how, for which applications, and for how long a business plans to continue functioning after a disruptive event. The business resiliency procedure is usually an overarching procedure that includes both operational and technology-related tasks."]
[null,"Change Initiation Request (CIR)","A document (physical or electronic) used to track change requests, including new features, enhancement requests, defects, and changed requirements. The change initiation request document must contain:\n - The name of the person initiating the change\n - The system affected by the change\n - A description of the change, including the file name(s) and file location(s)\n - The date the change will occur\n - An approval signature by someone other than the person initiating the change\n - An approval date"]
[null,"Clean Room","A network segment or subnet where data is sanitized for mobile devices access only."]
[null,"Climate Control System","A combination of sensors and equipment that monitors the temperature and humidity in a sensitive environment (such as a data center) and that automatically heats/cools/dehumidifies as needed to keep the atmosphere within acceptable tolerances."]
[null,"Cloud Computing - NIST Definition","Cloud Computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider  interaction.  This Cloud model promotes availability and is composed of five essential characteristics, three service models, and four deployment models."]
[null,"Cloud Computing – NIST Definition of Deployment Models - Community Cloud","The Cloud infrastructure is shared by several respondents and supports a specific community that has shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be managed by the respondent or subcontractor and may exist on premise or off premise."]
[null,"Cloud Computing – NIST Definition of Deployment Models - Hybrid Cloud","The Cloud infrastructure is a composition of two or more Clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability (e.g., Cloud bursting for load balancing between Clouds)."]
[null,"Cloud Computing – NIST Definition of Deployment Models - Private Cloud","The Cloud infrastructure is operated solely for the respondent. It may be managed by the organization or a third party and may exist on premise or off premise."]
[null,"Cloud Computing – NIST Definition of Deployment Models - Public Cloud","The Cloud infrastructure is made available to the general public or a large industry group and is owned by the Respondent selling Cloud services."]
[null,"Cloud Computing - NIST Definition of Essential Characteristics - Broad Access Network","Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs)."]
[null,"Cloud Computing - NIST Definition of Essential Characteristics - Measured Service","Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service."]
[null,"Cloud Computing - NIST Definition of Essential Characteristics - On-Demand Self-Service","A consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service’s provider."]
[null,"Cloud Computing - NIST Definition of Essential Characteristics - Rapid Elasticity","Capabilities can be rapidly and elastically provisioned, in some cases automatically, to quickly scale out and rapidly released to quickly scale in. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be purchased in any quantity at any time."]
[null,"Cloud Computing - NIST Definition of Essential Characteristics - Resource Pooling","The provider’s computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand. There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter). Examples of resources include storage, processing, memory, network bandwidth, and virtual machines. "]
[null,"Cloud Computing – NIST Definition of Service Models - Cloud Infrastructure as a Service (IaaS)"," The capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying Cloud infrastructure but has control over operating systems, storage, deployed applications, and possibly limited control of select networking components (e.g., host firewalls)."]
[null,"Cloud Computing – NIST Definition of Service Models - Cloud Platform as a Service (PaaS)"," The capability provided to the consumer is to deploy onto the Cloud infrastructure consumer-created or acquired applications created using programming languages and tools supported by the provider. The consumer does not manage or control the underlying Cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly application hosting environment configurations."]
[null,"Cloud Computing – NIST Definition of Service Models - Cloud Software as a Service (SaaS)","The capability provided to the consumer is to use the provider’s applications running on a Cloud infrastructure. The applications are accessible from various client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying Cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application."]
[null,"Cold Site","A remote facility that provides the equipment necessary for data and process restoration."]
[null,"Communications Plan","A tool for communicating information on the considerations and implications of respondent business continuity to improve decision making."]
[null,"Confidentiality","The protection of sensitive information from unauthorized disclosure and sensitive facilities due to physical, technical, or electronic penetration or exploitation."]
[null,"Constituent","An active employee or contractor."]
[null,"Contractor","A contracted professional with expertise in a particular domain or area."]
[null,"Covered Entity","(As defined by the HIPAA Rules requirement) A covered entity can be an Individual, a business and/or an agency who must comply with HIPAA rules to protect the privacy and security of health information and must provide individuals with certain rights related to their health information (i.e. Doctors, Health Insurance Companies, healthcare clearing house)."]
[null,"Demilitarized Zone (DMZ)","A controlled network space, delimited by firewalls or other policy-enforcing devices, which is neither inside an organization's network nor directly part of the Internet. A DMZ is typically used to isolate the respondent's most highly secured information assets while allowing predefined access to those assets that must provide or receive data outside of the respondent. The access and services provided should be restricted to the absolute minimum required."]
[null,"Disaster Recovery","The process, policies and procedures related to preparing for recovery or continuation of technology infrastructure critical to the respondent after a natural or human-induced disaster. Disaster recovery is a subset of business continuity"]
[null,"Enclosed","Closed in, surrounded, or included within."]
[null,"Exception","A result that deviates from the norm or expectation."]
[null,"Exclusion","An item not fully covered by the question."]
[null,"External Vulnerability Scan","A systematic review process executed from a network address outside of the Scoped Systems and Data network that uses software tools designed to search for and map systems for weaknesses in an application, computer or network. The intent is to determine if there are points of weakness in the security control system that can be exploited from outside the network."]
[null,"Externally Facing","The network entry point that receives inbound traffic."]
[null,"Extranet","An intranet that is partially accessible to authorized outsiders."]
[null,"Facility","A structure or building, or multiple structures or buildings, in which operations are conducted for the services provided. These operations include handling, processing and storage of information, data or systems, as well as personnel that support the operations."]
[null,"Fire Suppression System","A combination of sensors and equipment designed to detect the presence of heat/smoke/fire and actuate a fire retardant or fire extinguishing system."]
[null,"Firewall","A set of related programs, located at a network gateway server, that protects the resources of private networks from other networks. Firewalls may be application/proxy, packet-filtering, or stateful-based. Examples of firewalls are Cisco PIX, Check Point Firewall, Juniper NetScreen and Cyberguard. (Though they contain some firewall functionality, routers are not included in this definition.)"]
[null,"Firewall Rule","Information added to the firewall configuration to define the respondent's security policy through conditional statements that tell the firewall how to react in a particular situation."]
[null,"Fluid Sensor","A mechanical device that is sensitive to the presence of water or moisture that transmits a signal to a measuring or control instrument."]
[null,"Gateway","A node on a network that facilitates the communication of information between two or more nodes."]
[null,"General Perimeter","An area with fully enclosed walls that extend from floor to ceiling (beyond raised floors and ceilings) surrounding the secure perimeter. This may be the same floor as the secure perimeter, if shared by other tenants in the facility, or the facility itself."]
[null,"Generator","A device that converts mechanical energy to electrical energy via an engine (usually fuel-powered) that provides electrical current as input to a power source."]
[null,"Hardware Systems","Includes servers and network devices."]
[null,"Heat Detector","A mechanical device that is sensitive to temperature and transmits a signal to a measuring or control instrument."]
[null,"Hot Site","A duplicate of the respondent’s original site, with full computer systems and near-complete backups of user data."]
[null,"Immediate Perimeter","A rack or cage that houses the Scoped Systems and Data."]
[null,"Incident","Events outside normal operations that disrupt normal operational processes. An incident can be a relatively minor event, such as running out of disk space on a server, or a major disruption, such as a breach of database security and the loss of private and confidential customer information."]
[null,"Incident Severity","A ranking of an event’s significance that uses, at a minimum, a three-point scale: minor, moderately severe, and severe. For each level of severity, the respondent's IT department should define acceptable resolution times, escalation procedures, and reporting procedures."]
[null,"Intermediate Distribution Frame IDF","A free-standing or wall-mounted rack for managing and interconnecting the telecommunications cable between end user devices and a main distribution frame (MDF)."]
[null,"Internal Vulnerability Scan","A systematic review process using software tools designed to search for and map systems for weaknesses in an application, computer or network, executed from a network address within the Scoped Systems and Data network. Internal vulnerability scans are used to determine whether points of weakness in the security control system exist that could be exploited by a user with access to the internal network."]
[null,"Internet","A global network connecting millions of computers. More than 100 countries are linked into exchanges of data, news and opinions."]
[null,"Internet Protocol (IP)","A networking standard that allows messages to be sent back and forth over the Internet or other IP networks."]
[null,"Intranet","An IP network that resides behind a firewall and is accessible only to people who are members of the same organization."]
[null,"Intrusion Detection Systems (IDS)","A security inspection system for computers and networks that can allow for the inspection of systems activity and inbound/outbound network activity. The IDS key function identifies suspicious activity or patterns that may indicate a network or system attack."]
[null,"Intrusion Protection System (IPS)","A more sophisticated Intrusion Detection System (IDS) that allows administrators to configure predefined actions to be taken if suspicious activity is detected."]
[null,"Inventory","An itemized list of current assets."]
[null,"Local Backup","A method for backing up data on the local system. For example, an attached tape or storage device."]
[null,"Main Distribution Frame","A wiring rack that connects outside lines with internal lines. Main distribution frames are used to connect public or private lines entering the building to the respondent’s internal networks"]
[null,"Map of Dependencies","A diagram that illustrates how a business process relates to its supporting capabilities. (“Supporting capabilities” include: people involved in the delivery of the business process, application software, middleware software, servers, storage, networking, physical facilities, and people involved in the IT and physical infrastructure management.)"]
[null,"Master Change Log","A document or database that contains a report of each change initiation request (CIR) (approved or rejected). The document or database must contain:\n - Reference to a CIR\n - Date submitted\n - Date of change\n - Name of affected system\n - Approval status (approved or rejected)"]
[null,"MD5","A one-way cryptographic hash algorithm that produces a unique 128-bit alphanumeric fingerprint of its input."]
[null,"Mobile Code","Software code that is transferred from one computer to another and that executes automatically. Examples of mobile code include scripts (JavaScript, VBScript), Java applets, ActiveX controls, Flash animations, Shockwave movies (and Xtras), and macros embedded in Microsoft Office documents."]
[null,"Mobile Device Management Solution","Mobile device management (MDM) is an industry term for the administration of mobile devices, such as smartphones, tablet computers, laptops and desktop computers. MDM is usually implemented with the use of a third party product that has management features for particular vendors of mobile devices. It can incorporate safeguards related to but not limited to password controls, remote wipe, remote lock, detection of jailbreak devices, encryption validation."]
[null,"Mobile Device Policy","Policy implemented which governs the use of Mobile devices whether they be BYOD or corporate issued. This policy can incorporate details related to Security training, Terms of Use, constituent responsibilities, data handling and access controls."]
[null,"Modem","A device that allows a computer or terminal to transmit data over an analog telephone line."]
[null,"Network Address Translation (NAT)","A process of rewriting the source and/or destination addresses of IP packets as they pass through a network device."]
[null,"Network Devices","Units that mediate data in a computer network. Computer networking devices are also called network equipment, Intermediate Systems (IS) or InterWorking Unit (IWU)."]
[null,"Network Segment","A portion of a computer network that is separated from the remainder of the network by a device such as a repeater, hub, bridge, switch or router. Each segment may contain one or multiple computers or other hosts. Network segments are typically established for throughput and/or security reasons."]
[null,"Network time protocol (NTP)","A protocol designed to synchronize the clocks of computers over a network."]
[null,"Node","Any physical device with a unique network address."]
[null,"Non-Employees","Auditors, consultants, contractors, and vendors."]
[null,"Owner","An individual or entity that has approved management responsibility for controlling the production, development, maintenance, use and security of the assets. Ownership is not an indication of property rights to the asset."]
[null,"Ownership","A formally assigned responsibility for a given asset."]
[null,"Penetration Testing","A conventional security control and the one most widely used by software vendors."]
[null,"Personal Identification Number (PIN)","A secret shared between a user and a system that can be used to authenticate the user to the system."]
[null,"Physical Media","Any portable device or substance (e.g., paper) used to store data for specific and legitimate purposes. Examples of physical media include:\n - Magnetic tapes and disks\n - Cartridges, including 9-track, DAT, and VHS\n - Optical disks in CD and DVD format\n - Microfilm/fiche\n - Paper (e.g., computer-generated reports and other printouts)\n - Static memory devices, such as USB memory sticks"]
[null,"Port Scan","A systematic scan of a computer's ports that identifies open doors. Used in managing networks, port scanning also can be used maliciously to find a weakened access point from which to break into computer."]
[null,"Post-Deployment Test Document","A document that provides evidence that the change was tested and approved in the production environment. The document must contain:\n - Reference to a CIR\n - Identified deployment resources\n - Deployment start date\n - Deployment end date\n - Expected results\n - Actual results\n - Approval signature\n - Approval date"]
[null,"Power Redundancy","Any type of power delivery mechanism that provides continuous power to connected systems in the event of a failure in the main delivery mechanism for electricity. Such mechanisms include multiple electric feeds, automatic failover generators, and uninterruptible power supplies."]
[null,"Pre-Deployment Test Document","A document (electronic or paper) that provides evidence that the requested changes were tested prior to deployment in the production environment. A pre-deployment test document is inspected for:\n - Reference to a CIR\n - Identified testing resources\n - Testing start date\n - Testing end date\n - Expected test results\n - Actual test results"]
[null,"Protocol","A set of rules and formats that enable the proper exchange of information between different systems."]
[null,"Publicly Accessible","In networking terms, able to accept a connection originating from the public domain, e.g., the Internet."]
[null,"Quality Analysis and User Acceptance Testing (QA UAT)","Testing the quality of a software product and can be done by user acceptance testing. In functional testing and system testing, a company would perform all tests with an attitude to break it. In your UAT, the user would run through real-life examples being focused on how the user would actually utilize the product."]
[null,"Raised Floor","Used in data center construction, a raised floor above the \"true\" floor allows air conditioning flow and wiring to pass freely under equipment. The space between the true and raised floors is accessed by removable floor tiles."]
[null,"Receiver Company","The organization that has contracted with a service provider for a specific service."]
[null,"Residual Risk Rating Scoring Method","A calculation of the risk that remains after security controls have been applied."]
[null,"Risk Prioritization Scoring Method","A systematic approach that quantifies risk in terms of loss potential, then sequences individual risks to determine the order in which compensating controls should be implemented."]
[null,"Sanctions Check","In most countries, organizations are prohibited by law from doing business with drugs and arms merchants and terrorist organizations.  Sanctions lists ranging from OFAC to the EU Consolidated Lists to the Interpol Most Wanted to the Hong Kong and Singapore Monetary Authority exist.  Part of due diligence in vendor selection should include screening of the third party against sanctions lists."]
[null,"Scoped Systems and Data","Computer hardware, software and/or Non-Public Personal Information that is stored, transmitted, or processed by the service provider in scope for the engagement."]
[null,"Scoping Meeting","A meeting held prior to commencement of a Shared Assessments engagement, to determine the Scoped Systems and Data to be included in a company's Standardized Information Gathering Questionnaire (SIG) and Agreed Upon Procedures (AUP) assessment."]
[null,"Secure Code Review","The process of identifying whether software code meets the respondent's security requirements."]
[null,"Secure Perimeter","A space fully enclosed by walls that surround the immediate perimeter and that extend from floor to ceiling (beyond raised floors and ceilings), which is contained, and whose points of entry are secured."]
[null,"Secure Socket Layer (SSL)","A protocol developed by Netscape for transmitting private documents via the Internet. SSL uses a cryptographic system with two keys to encrypt data: a public key known to everyone and a private or secret key known only to the recipient of the message."]
[null,"Secure Workspace","An environment from where people work from their desks with the purpose of accessing, editing or inputting Scoped Systems and Data on a computer, telephone or physical media, e.g., a BPO or call center environment."]
[null,"Secure Workspace Perimeter","A space fully enclosed by walls that surround the Secure Workspace which is contained, and whose points of entry and exit are secured."]
[null,"Security Architecture Risk Analysis","Defines concepts, methods, and techniques for analyzing the architecture and design of software systems for security flaws."]
[null,"Security Policy","A published document or set of documents defining requirements for one or more aspects of information security."]
[null,"Server","A computer that makes services, such as access to data files, programs, and peripheral devices, available to workstations on a network."]
[null,"Service Provider","An subcontractor that provides outsourced services, such as data processing, business operations, applications, systems or staffing."]
[null,"Service Set Identifier (SSID)","A 32-character unique identifier attached to the header of packets sent over a wide area network to identify each packet as part of that network."]
[null,"Simple Mail Transfer Protocol (SMTP)","The de facto standard for email transmissions across the Internet."]
[null,"Smoke Detector","A mechanical device that is sensitive to the presence of smoke or particulate material in the air that transmits a signal to a measuring or control instrument."]
[null,"Software","Vendor developed software code used for custom or commercial-off-the-shelf purposes."]
[null,"Software Architecture","The process of defining a structured software solution that meets all of the technical and operational requirements, while optimizing common quality attributes such as performance, security, and manageability."]
[null,"Software Development Life Cycle (SDLC)","A series of processes which provide a model for the development and lifecycle management of Software Applications."]
[null,"Software Security Group","A group whose charter is to assist in the design, review and implementation of software that protects the information and resources contained in and controlled by that software."]
[null,"Status Change","Change to employment status that is recorded by human resources, such as promotions, demotions or departmental changes."]
[null,"Stewardship","The act of managing and maintaining a given asset."]
[null,"Strong Password","Password length must be a minimum of seven (7) characters, must not to contain a common usage word or a word found in the English dictionary, may not contain user name, any part of a full name or access level of the user and must contain characters from at least three (3) of the following four (4) classes of characters:\n • Upper case letters (A, B, C, ….Z)\n • Lower case letters (a, b, c, ….z)\n • Numbers (0,1, 2, …9)\n • Non-alphanumeric (\"special characters\") such as punctuation symbols"]
[null,"Subcontractor"," is a business or an individual that signs a contract to perform part or all of the obligations of another's contract."]
[null,"System Owner","The business unit that retains financial ownership or decision rights for the business use of the asset."]
[null,"System Steward","The primary assigned administrator responsible for maintenance and day-to-day tasks that support the business."]
[null,"Third Party","All entities or persons that work on behalf of the organization but are not its employees, including consultants, contingent workers, clients, business partners, service providers, subcontractors, vendors, suppliers, affiliates and any other person or entity that accesses Scoped Systems and Data."]
[null,"Threat Impact Calculation Method","A systematic method of determining the loss potential of a particular threat, based on the value of assets affected."]
[null,"Threat Modeling","Threat modeling allows you to systematically identify and rate the threats that are most likely to affect your system. By identifying and rating threats based on a solid understanding of the architecture and implementation of your application, you can address threats with appropriate countermeasures in a logical order, starting with the threats that present the greatest risk.\n\nThreat modeling has a structured approach that is far more cost efficient and effective than applying security features in a haphazard manner without knowing precisely what threats each feature is supposed to address."]
[null,"Threat Probability Calculation Method","A systematic method of determining the potential for a particular threat to occur, based on the likelihood of the occurrence collected from internal staff, past records, and official security records.\n Threats x Vulnerability x Asset Value = Total Risk\n (Threats x Vulnerability x Asset Value) x Controls Gap = Residual Risk"]
[null,"Token","A unique identifier generated on both a host and small, user-held device that allows the user to authenticate to the host."]
[null,"True Ceiling","The permanent overhead interior surface of a room, constructed of solid building materials offering resistance to and evidence of unauthorized entry."]
[null,"True Floor","The permanent bottom interior surface of a room, constructed of solid building materials offering resistance to and evidence of unauthorized entry."]
[null,"Unapproved","Operating without consent."]
[null,"Unidentified","Being or having an unknown or unnamed source."]
[null,"Uninterruptible Power Supply (UPS)","A power supply consisting of a bank of batteries, which is continually charged. When power fails, the UPS becomes the source of electrical current for computer equipment until the batteries are discharged. A UPS is often connected to a generator that can provide electrical power indefinitely."]
[null,"Vibration Alarm Sensor","An alarm that responds to vibrations in the surface onto which it is mounted. A normally closed switch momentarily opens when the sensor is subjected to a vibration of sufficiently large amplitude."]
[null,"Virtual Private Network (VPN)","A communication tunnel running through a shared network, such as the Internet, which uses encryption and other security mechanisms to ensure the data cannot be intercepted and that the data senders and receivers are authenticated."]
[null,"Volumetric Alarm Sensor","An alarm sensor designed and employed to detect an unauthorized person in a confined space when the space is normally unoccupied. Such alarms include ultrasonic, microwave, and infrared sensors."]
[null,"War Walk","Also known as \"war drive,\" using a laptop to \"sniff\" for wireless access points. War walking may be used to locate a public access point for personal use or as a controls assessment to identify access points that are inadequately secured and may indicate an elevated risk of breach."]
[null,"Warm Site","A remote facility which replicates production data in set intervals."]
[null,"Water Sensor","A mechanical device sensitive to the presence of water or moisture that transmits a signal to a measuring or control instrument."]
[null,"Workstation","(1) Single-user computers typically linked together to form a local area network, that can also be used as standalone systems. (2) In networking, any computer connected to a local area network, including a workstation or personal computer."]

{"sheet":"Formula Notes","index":25,"n_rows":44,"n_cols":4,"rows_kept":44,"cut":false,"hidden":false,"merged":[]}
["Formula Notes"]
["Column","Description"]
["A\n<Serial No>","This is a unique record for a question. This value is sequential starting with one on Tab A to the end of questions on last tab. Any row that is not a question will not have a number. The highest value used as a unique identifier is located on this tab in cell C22 (below)."]
["A4","Calculates the highest serial number on the tab. This tab cell C22 identifies the highest serial number used so new question serial numbers can be used. Retired serial numbers are never re-used."]
["D\nConditional Formatting\n<Response>","The conditional formatting looks in column J and U to determine the background of the cell. If the value in column J =1, conditional formatting sets the background to a hash (no response required) to indicated the top of a table question. If the value in column U = 1 the background will be green indicating a \"Yes\" response. If the value in column U = 2 than the background will turn orange indicating a \"No\" response. If the value in column U = 3 the background turns violet to indicate an N/A response. The default background is light blue.",null,"If this SIG will be a Master SIG to be used with the SMT, select Master below. If this SIG will be distributed leave blank."]
["E\nConditional Formatting\n<Additional Information>","The conditional formatting looks in column J. If the value in column J =1, conditional formatting sets the background to a hash (no response required) to indicated the top of a table question."]
["I\n<Q Depth>","Values in this column indicate the depth (number of decimal places) the question has."]
["J\n<Table ID>","A value of \"1\" in this cell indicate the top of a table."]
["K\n<1>","This formula is used to calculate the first digit of the question number. It looks to see if there is a value in the cell above, if not it assumes the value should be a 1. Next it looks to see if the depth is 1, If so, it will increment by one, if not it pulls down the value from the cell above."]
["L - O\n<2 - 5>","This formula is used to calculate the second through fifth digits of the question number. It first looks at the cell above and if blank it assumes a 0. If not blank, it looks at it's next highest neighbor above to see if there is a transition, it there is a transition then it resets to 0, Lastly it looks at the question depth to see if it is the same depth as above. If so it increments, if not it will pull down the value from above."]
["P\n<HL Ans>","This formula is used to carry over and convert the answer from the Lite tab to a number on the detail tabs. The VLOOKUP will search the L2_Array named field to find the question serial number and bring back the answer number in that array. For proper SMT operation, if Master (this tab, D6) is selected then high level responses are ignored."]
["Q\n<Loc Ans>","This formula converts the local answer to a number. It first checks to see if the depth is not blank. If it is then assumes the answer should be blank. If the depth field is not blank the formula converts the local answer to a number. 0 = No answer, 1 = \"Yes\", 2 = \"No\" and 3 = \"N/A\"."]
["R\n<Comb Ans>","This formula is used to combine the high level answer and the local answer. If the question depth is blank a blank is assumed. Responses are evaluated in the following order 1st - Lite, 2nd - local response."]
["S\n<Table Calc (Tot Q#)>","The value in this cell determines if the question is actually a question or if it is part of a response list for a question. The logic looks above, below and in column H to make the determination."]
["T\n<Q Carry Dn>","This formula carries parent responses down to it's children. It first looks for a blank in the question depth and if blank will carry down the value from above. If the question has been answered it will bring over the question depth. If the questions not answered it will compare the local question depth to the previous value if the depth is greater the previous value will be carried down, if not it will turn to 0."]
["U\n<Resp Calc>","This formula works with the Q Carry Dn formula to carry the value of the response down. If response is No or N/A those responses values are carried down to the next parent question. For proper SMT operation, if Master is selected (this tab, D6) response carry down is disabled."]
["V\n<T Carry Dn>","The value in this cell identifies if a question in a table has been answered. If any value in a response list is answered the result will be rolled up the next cell until it reaches the list identifier."]
["W\n<Final Ans>","The result in this cell determines if a question has been answered and is used to count the actual questions answered not answers as part of a response list. This is a simple AND function to combine the values in columns T, S and V."]
["X\n<HL Chk>","Identifies if the question is duplicated on the Lite tab"]
[]
["Column (Cell)","Formula","Highest Ser #"]
["A","Hard coded, unique serial number (Rows without questions have no serial numbers)",{"$f":"MAX('Business Information'!A3,Documentation!A2,Lite!A4,'A. Risk Management'!A4,'B. Security Policy'!A4,'C. Organizational Security'!A4,'D. Asset Management'!A4,'E. Human Resource Security'!A4,'F. Physical and Environmental'!A4,'G. Communications and Ops Mgmt'!A4,'H. Access Control'!A4,'I. Info Sys AD&M'!A4,'J. Incident Event & Comm Mgmt'!A4,'K. Business Resiliency'!A4,'L. Compliance'!A4, 'M. Mobile'!A4,'P. Privacy'!A4,'Q. Software Security'!A4,'V. Cloud Security'!A4)","v":4157}]
["A4 (some tabs location is different)","MAX(An:An)"]
["D Conditional Formatting"]
["E Conditional Formatting"]
["I","Manually entered question depth value (0 - 5)"]
["J","Manually entered table top identifier (if 1 than table top)"]
["K","IF(Kn-1=\"\",1,IF(In=1,Kn-1+1,Kn-1))"]
["L (M - O) are similar ","IF(Ln-1=\"\",0,IF(Kn-1<>Kn,0,IF($In=2,Ln-1+1,Ln-1)))"]
["P","IF(OR(Master=\"Master\",In=0,Jn=1),0,IF(ISNA(VLOOKUP(An,L2_Array,21,FALSE)),0,VLOOKUP(An,L2_Array,21,FALSE)))"]
["Q","IF(In=\"\",\"\",IF(Dn=\"Yes\",1,IF(Dn=\"No\",2,IF(Dn=\"N/A\",3,0))))"]
["R","IF(In=\"\",\"\",IF(Pn>0,Pn,IF(Qn>0,Qn,0)))"]
["S","IF(OR(In=\"\",In=0),\"\",IF(OR(In=1,Sn-1=\"\"),1,IF(OR(AND(Jn-1=1,(In-In-2<>0)),AND(Sn-1=0,In-1=I5),AND(Jn-1=1,In=In-2)),0,1)))"]
["T","IF(In=\"\",Tn-1,IF(AND(Rn>1,OR(Tn-1=\"\",Tn-1=0,Tn-1>=In)),In,IF(In>Tn-1,Tn-1,0)))"]
["U","IF(Master=\"Master\",Qn,IF(Un-1=\"\",Rn,IF(OR(AND(Tn>0,Rn<Un-1),AND(Tn=1,Rn<=Un-1)),Un-1,Rn)))"]
["V","IF(In=\"\",\"\",IF(OR(AND(Sn-1=1,Tn=1),Rn>0,AND(Sn+1=0,Vn+1=1)),1,0))"]
["W","IF(In=\"\",\"\",IF(OR(AND(Tn>0,Sn=1),AND(Sn=1,Vn=1)),1,0))"]
["X","IF(ISNA(VLOOKUP(An,L2_Array,1,FALSE)),\"\",1)"]
[]
["Named Range","Formula"]
["Master","Formula Notes'!$D$5"]
["L2_Array","Lv2_Questions!$A$4:$U$568"]
["SIG_Data","Full!$E$3:$H$951"]
["Sheet Protection","E87qVQ4E"]

{"sheet":"Full","index":26,"n_rows":1598,"n_cols":19,"rows_kept":1598,"cut":false,"hidden":false,"merged":[[0,10,0,11]]}
["Ser No.","Depth","Table","SL ID","Ques Num","SIG Question Text","Response","Maturity","Additional Information","AUP 2015 Relevance","ISO 27002:2013 Relevance",null,"Appendix J Section and  Line Reference","COBIT 4.0 Relevance",null,"PCI 3.0","FFIEC","COBIT 4.1 Relevance","Shared Assessments Program Cloud Computing White Paper Description"]
[{"$f":"'A. Risk Management'!B1","v":"A. Risk Assessment and Treatment"},null,null,null,{"$f":"'A. Risk Management'!B1","v":"A. Risk Assessment and Treatment"}]
[{"$f":"'A. Risk Management'!A5","v":3198},{"$f":"'A. Risk Management'!J5","v":1},{"$f":"'A. Risk Management'!K5","v":0},{"$f":"'A. Risk Management'!Y5","v":1},{"$f":"'A. Risk Management'!B5","v":"A.1"},{"$f":"'A. Risk Management'!C5","v":"Is there a risk assessment program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the program? if yes, does it include:"},{"$f":"'A. Risk Management'!D5","v":0},{"$f":"'A. Risk Management'!E5","v":0},{"$f":"'A. Risk Management'!F5","v":0},{"$f":"'A. Risk Management'!G5","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!H5","v":"5.1                                            6.1.2"},{"$f":"'A. Risk Management'!I5","v":"Leadership & Commitment,                Information Security Risk Assessment"},null,null,null,12.2,"IS.1.3.1 BCP.1.2.1 BCP.1.3.5 MGMT.1.6.1.1 OPS.1.3","PO9.4"]
[{"$f":"'A. Risk Management'!A6","v":2409},{"$f":"'A. Risk Management'!J6","v":2},{"$f":"'A. Risk Management'!K6","v":0},{"$f":"'A. Risk Management'!Y6","v":0},{"$f":"'A. Risk Management'!B6","v":"A.1.1"},{"$f":"'A. Risk Management'!C6","v":"A risk assessment, conducted within the last 12 months?"},{"$f":"'A. Risk Management'!D6","v":0},{"$f":"'A. Risk Management'!E6","v":0},{"$f":"'A. Risk Management'!F6","v":0},{"$f":"'A. Risk Management'!G6","v":"A.2 IT & Infrastructure Risk Assessment Life Cycle"},{"$f":"'A. Risk Management'!H6","v":8.1999999999999993},{"$f":"'A. Risk Management'!I6","v":" Information security risk assessment"},null,"PO9.1","IT and business risk management alignment management process","12.2.b","IS.1.3.1.3 D&A.1.4.1.1 AUDIT.1.7.1.1","PO9.1, PO9.2, PO9.4, DS4.1, DS4.3"]
[{"$f":"'A. Risk Management'!A7","v":2325},{"$f":"'A. Risk Management'!J7","v":2},{"$f":"'A. Risk Management'!K7","v":0},{"$f":"'A. Risk Management'!Y7","v":0},{"$f":"'A. Risk Management'!B7","v":"A.1.2"},{"$f":"'A. Risk Management'!C7","v":"Risk Governance?"},{"$f":"'A. Risk Management'!D7","v":0},{"$f":"'A. Risk Management'!E7","v":0},{"$f":"'A. Risk Management'!F7","v":0},{"$f":"'A. Risk Management'!G7","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!H7","v":"N/A"},{"$f":"'A. Risk Management'!I7","v":0},null,null,null,"12.2.a","N/A","N/A"]
[{"$f":"'A. Risk Management'!A8","v":2326},{"$f":"'A. Risk Management'!J8","v":2},{"$f":"'A. Risk Management'!K8","v":0},{"$f":"'A. Risk Management'!Y8","v":0},{"$f":"'A. Risk Management'!B8","v":"A.1.3"},{"$f":"'A. Risk Management'!C8","v":"Range of assets to include: people, processes, data and technology?"},{"$f":"'A. Risk Management'!D8","v":0},{"$f":"'A. Risk Management'!E8","v":0},{"$f":"'A. Risk Management'!F8","v":0},{"$f":"'A. Risk Management'!G8","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!H8","v":"N/A"},{"$f":"'A. Risk Management'!I8","v":0},null,null,null,"N/A","IS.1.3.1.1 MGMT.1.5.2.1","N/A"]
[{"$f":"'A. Risk Management'!A9","v":2420},{"$f":"'A. Risk Management'!J9","v":2},{"$f":"'A. Risk Management'!K9","v":0},{"$f":"'A. Risk Management'!Y9","v":0},{"$f":"'A. Risk Management'!B9","v":"A.1.4"},{"$f":"'A. Risk Management'!C9","v":"Range of threats to include: malicious, natural, accidental, cyber, business changes (transaction volume)?"},{"$f":"'A. Risk Management'!D9","v":0},{"$f":"'A. Risk Management'!E9","v":0},{"$f":"'A. Risk Management'!F9","v":0},{"$f":"'A. Risk Management'!G9","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!H9","v":"6.1.2"},{"$f":"'A. Risk Management'!I9","v":"Information Security Risk Assessment"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'A. Risk Management'!A10","v":2425},{"$f":"'A. Risk Management'!J10","v":2},{"$f":"'A. Risk Management'!K10","v":0},{"$f":"'A. Risk Management'!Y10","v":0},{"$f":"'A. Risk Management'!B10","v":"A.1.5"},{"$f":"'A. Risk Management'!C10","v":"Risk scoping?"},{"$f":"'A. Risk Management'!D10","v":0},{"$f":"'A. Risk Management'!E10","v":0},{"$f":"'A. Risk Management'!F10","v":0},{"$f":"'A. Risk Management'!G10","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!H10","v":"6.1.2"},{"$f":"'A. Risk Management'!I10","v":"Information Security Risk Assessment"},null,null,null,"N/A","N/A","PO9.4"]
[{"$f":"'A. Risk Management'!A11","v":2426},{"$f":"'A. Risk Management'!J11","v":2},{"$f":"'A. Risk Management'!K11","v":0},{"$f":"'A. Risk Management'!Y11","v":0},{"$f":"'A. Risk Management'!B11","v":"A.1.6"},{"$f":"'A. Risk Management'!C11","v":"Risk context?"},{"$f":"'A. Risk Management'!D11","v":0},{"$f":"'A. Risk Management'!E11","v":0},{"$f":"'A. Risk Management'!F11","v":0},{"$f":"'A. Risk Management'!G11","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!H11","v":"6.1.2"},{"$f":"'A. Risk Management'!I11","v":"Information Security Risk Assessment"},null,null,null,"N/A","N/A","PO9.4"]
[{"$f":"'A. Risk Management'!A12","v":2427},{"$f":"'A. Risk Management'!J12","v":2},{"$f":"'A. Risk Management'!K12","v":0},{"$f":"'A. Risk Management'!Y12","v":0},{"$f":"'A. Risk Management'!B12","v":"A.1.7"},{"$f":"'A. Risk Management'!C12","v":"Risk training plan?"},{"$f":"'A. Risk Management'!D12","v":0},{"$f":"'A. Risk Management'!E12","v":0},{"$f":"'A. Risk Management'!F12","v":0},{"$f":"'A. Risk Management'!G12","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!H12","v":"6.1.2"},{"$f":"'A. Risk Management'!I12","v":"Information Security Risk Assessment"},null,null,null,"N/A","N/A","PO9.4"]
[{"$f":"'A. Risk Management'!A13","v":2431},{"$f":"'A. Risk Management'!J13","v":2},{"$f":"'A. Risk Management'!K13","v":0},{"$f":"'A. Risk Management'!Y13","v":0},{"$f":"'A. Risk Management'!B13","v":"A.1.8"},{"$f":"'A. Risk Management'!C13","v":"Risk evaluation criteria?"},{"$f":"'A. Risk Management'!D13","v":0},{"$f":"'A. Risk Management'!E13","v":0},{"$f":"'A. Risk Management'!F13","v":0},{"$f":"'A. Risk Management'!G13","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!H13","v":"6.1.2"},{"$f":"'A. Risk Management'!I13","v":"Information Security Risk Assessment"},null,null,null,"N/A","N/A","PO9.4"]
[{"$f":"'A. Risk Management'!A14","v":2429},{"$f":"'A. Risk Management'!J14","v":2},{"$f":"'A. Risk Management'!K14","v":0},{"$f":"'A. Risk Management'!Y14","v":0},{"$f":"'A. Risk Management'!B14","v":"A.1.9"},{"$f":"'A. Risk Management'!C14","v":"Risk scenarios? If yes:"},{"$f":"'A. Risk Management'!D14","v":0},{"$f":"'A. Risk Management'!E14","v":0},{"$f":"'A. Risk Management'!F14","v":0},{"$f":"'A. Risk Management'!G14","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!H14","v":"6.1.2"},{"$f":"'A. Risk Management'!I14","v":"Information Security Risk Assessment"},null,null,null,"N/A","MGMT.1.5.2.1","N/A"]
[{"$f":"'A. Risk Management'!A15","v":2430},{"$f":"'A. Risk Management'!J15","v":3},{"$f":"'A. Risk Management'!K15","v":0},{"$f":"'A. Risk Management'!Y15","v":0},{"$f":"'A. Risk Management'!B15","v":"A.1.9.1"},{"$f":"'A. Risk Management'!C15","v":"Have scenarios been created for a variety of events with a range of possible threats that could impact the range of assets?"},{"$f":"'A. Risk Management'!D15","v":0},{"$f":"'A. Risk Management'!E15","v":0},{"$f":"'A. Risk Management'!F15","v":0},{"$f":"'A. Risk Management'!G15","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!H15","v":"6.1.2"},{"$f":"'A. Risk Management'!I15","v":"Information Security Risk Assessment"},null,null,null,"N/A","IS.1.3.1.4","N/A"]
[{"$f":"'A. Risk Management'!A16","v":2428},{"$f":"'A. Risk Management'!J16","v":3},{"$f":"'A. Risk Management'!K16","v":0},{"$f":"'A. Risk Management'!Y16","v":0},{"$f":"'A. Risk Management'!B16","v":"A.1.9.2"},{"$f":"'A. Risk Management'!C16","v":"Do the scenarios include threat types impacting all assets resulting in business impact?"},{"$f":"'A. Risk Management'!D16","v":0},{"$f":"'A. Risk Management'!E16","v":0},{"$f":"'A. Risk Management'!F16","v":0},{"$f":"'A. Risk Management'!G16","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"'A. Risk Management'!H16","v":"6.1.2"},{"$f":"'A. Risk Management'!I16","v":"Information Security Risk Assessment"},null,null,null,"N/A","N/A","PO9.4"]
[{"$f":"'A. Risk Management'!A17","v":3285},{"$f":"'A. Risk Management'!J17","v":2},{"$f":"'A. Risk Management'!K17","v":0},{"$f":"'A. Risk Management'!Y17","v":0},{"$f":"'A. Risk Management'!B17","v":"A.1.10"},{"$f":"'A. Risk Management'!C17","v":"Ownership, action plan, response plan, management update?"},{"$f":"'A. Risk Management'!D17","v":0},{"$f":"'A. Risk Management'!E17","v":0},{"$f":"'A. Risk Management'!F17","v":0},{"$f":"'A. Risk Management'!G17","v":"A.2 IT & Infrastructure Risk Assessment Life Cycle"},{"$f":"'A. Risk Management'!H17","v":"6.1.2"},{"$f":"'A. Risk Management'!I17","v":"Information Security Risk Assessment"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'A. Risk Management'!A18","v":3286},{"$f":"'A. Risk Management'!J18","v":1},{"$f":"'A. Risk Management'!K18","v":0},{"$f":"'A. Risk Management'!Y18","v":0},{"$f":"'A. Risk Management'!B18","v":"A.2"},{"$f":"'A. Risk Management'!C18","v":"Are controls identified for each risk classified as: preventive, detective, corrective, predictive (technical or administrative controls)?"},{"$f":"'A. Risk Management'!D18","v":0},{"$f":"'A. Risk Management'!E18","v":0},{"$f":"'A. Risk Management'!F18","v":0},{"$f":"'A. Risk Management'!G18","v":"A.2 IT & Infrastructure Risk Assessment Life Cycle"},{"$f":"'A. Risk Management'!H18","v":"6.1.3"},{"$f":"'A. Risk Management'!I18","v":"Information Security Risk treatment"},null,null,null,"N/A","IS.1.3.2","PO9.4"]
[{"$f":"'A. Risk Management'!A19","v":0},{"$f":"'A. Risk Management'!J19","v":0},{"$f":"'A. Risk Management'!K19","v":0},{"$f":"'A. Risk Management'!Y19","v":0},{"$f":"'A. Risk Management'!B19","v":0},{"$f":"'A. Risk Management'!C19","v":0},{"$f":"'A. Risk Management'!D19","v":0},{"$f":"'A. Risk Management'!E19","v":0},{"$f":"'A. Risk Management'!F19","v":0},{"$f":"'A. Risk Management'!G19","v":0},{"$f":"'A. Risk Management'!H19","v":0},{"$f":"'A. Risk Management'!I19","v":0}]
[]
[{"$f":"'B. Security Policy'!B1","v":"B. Security Policy"},null,null,null,{"$f":"'B. Security Policy'!B1","v":"B. Security Policy"}]
[{"$f":"'B. Security Policy'!A5","v":3199},{"$f":"'B. Security Policy'!J5","v":1},{"$f":"'B. Security Policy'!K5","v":0},{"$f":"'B. Security Policy'!Y5","v":1},{"$f":"'B. Security Policy'!B5","v":"B.1"},{"$f":"'B. Security Policy'!C5","v":"Is there an information security policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy? If yes, does the policy contain:"},{"$f":"'B. Security Policy'!D5","v":0},{"$f":"'B. Security Policy'!E5","v":0},{"$f":"'B. Security Policy'!F5","v":0},{"$f":"'B. Security Policy'!G5","v":"B.1 Information Security Policy Content & Maintenance"},{"$f":"'B. Security Policy'!H5","v":"5.1.1"},{"$f":"'B. Security Policy'!I5","v":"Policies for information security"},null,"PO6.1","IT policy and control environment","5.4, 12.1","IS.1.4.1","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'B. Security Policy'!A6","v":2467},{"$f":"'B. Security Policy'!J6","v":2},{"$f":"'B. Security Policy'!K6","v":0},{"$f":"'B. Security Policy'!Y6","v":0},{"$f":"'B. Security Policy'!B6","v":"B.1.1"},{"$f":"'B. Security Policy'!C6","v":"Risk assessment?"},{"$f":"'B. Security Policy'!D6","v":0},{"$f":"'B. Security Policy'!E6","v":0},{"$f":"'B. Security Policy'!F6","v":0},{"$f":"'B. Security Policy'!G6","v":"A.1 IT & Infrastructure Risk Governance"},{"$f":"'B. Security Policy'!H6","v":"N/A"},{"$f":"'B. Security Policy'!I6","v":0},null,"PO6.1","IT policy and control environment",12.2,"IS.1.3.3.5","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'B. Security Policy'!A7","v":45},{"$f":"'B. Security Policy'!J7","v":2},{"$f":"'B. Security Policy'!K7","v":0},{"$f":"'B. Security Policy'!Y7","v":0},{"$f":"'B. Security Policy'!B7","v":"B.1.2"},{"$f":"'B. Security Policy'!C7","v":"Risk management?"},{"$f":"'B. Security Policy'!D7","v":0},{"$f":"'B. Security Policy'!E7","v":0},{"$f":"'B. Security Policy'!F7","v":0},{"$f":"'B. Security Policy'!G7","v":"A.1 IT & Infrastructure Risk Governance"},{"$f":"'B. Security Policy'!H7","v":"N/A"},{"$f":"'B. Security Policy'!I7","v":0},null,"PO6.1","IT policy and control environment",12.2,"N/A","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'B. Security Policy'!A8","v":47},{"$f":"'B. Security Policy'!J8","v":2},{"$f":"'B. Security Policy'!K8","v":0},{"$f":"'B. Security Policy'!Y8","v":0},{"$f":"'B. Security Policy'!B8","v":"B.1.3"},{"$f":"'B. Security Policy'!C8","v":"Security awareness training/education?"},{"$f":"'B. Security Policy'!D8","v":0},{"$f":"'B. Security Policy'!E8","v":0},{"$f":"'B. Security Policy'!F8","v":0},{"$f":"'B. Security Policy'!G8","v":0},{"$f":"'B. Security Policy'!H8","v":"N/A"},{"$f":"'B. Security Policy'!I8","v":0},null,"PO6.1","IT policy and control environment",12.6,"N/A","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'B. Security Policy'!A9","v":24},{"$f":"'B. Security Policy'!J9","v":2},{"$f":"'B. Security Policy'!K9","v":0},{"$f":"'B. Security Policy'!Y9","v":0},{"$f":"'B. Security Policy'!B9","v":"B.1.4"},{"$f":"'B. Security Policy'!C9","v":"Business continuity?"},{"$f":"'B. Security Policy'!D9","v":0},{"$f":"'B. Security Policy'!E9","v":0},{"$f":"'B. Security Policy'!F9","v":0},{"$f":"'B. Security Policy'!G9","v":0},{"$f":"'B. Security Policy'!H9","v":"N/A"},{"$f":"'B. Security Policy'!I9","v":0},null,"PO6.1","IT policy and control environment","N/A","IS.1.4.1.12 BCP.1.4.3.1","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'B. Security Policy'!A10","v":57},{"$f":"'B. Security Policy'!J10","v":2},{"$f":"'B. Security Policy'!K10","v":0},{"$f":"'B. Security Policy'!Y10","v":0},{"$f":"'B. Security Policy'!B10","v":"B.1.5"},{"$f":"'B. Security Policy'!C10","v":"Consequences for non-compliance with corporate policies?"},{"$f":"'B. Security Policy'!D10","v":0},{"$f":"'B. Security Policy'!E10","v":0},{"$f":"'B. Security Policy'!F10","v":0},{"$f":"'B. Security Policy'!G10","v":0},{"$f":"'B. Security Policy'!H10","v":"N/A"},{"$f":"'B. Security Policy'!I10","v":0},null,"PO6.1","IT policy and control environment","N/A","IS.1.4.2.2","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'B. Security Policy'!A11","v":2469},{"$f":"'B. Security Policy'!J11","v":2},{"$f":"'B. Security Policy'!K11","v":0},{"$f":"'B. Security Policy'!Y11","v":0},{"$f":"'B. Security Policy'!B11","v":"B.1.6"},{"$f":"'B. Security Policy'!C11","v":"Responsibilities for information security management?"},{"$f":"'B. Security Policy'!D11","v":0},{"$f":"'B. Security Policy'!E11","v":0},{"$f":"'B. Security Policy'!F11","v":0},{"$f":"'B. Security Policy'!G11","v":0},{"$f":"'B. Security Policy'!H11","v":"5.1.1"},{"$f":"'B. Security Policy'!I11","v":"Policies for information security"},null,"PO6.1","IT policy and control environment",12.4,"N/A","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'B. Security Policy'!A12","v":21},{"$f":"'B. Security Policy'!J12","v":2},{"$f":"'B. Security Policy'!K12","v":0},{"$f":"'B. Security Policy'!Y12","v":0},{"$f":"'B. Security Policy'!B12","v":"B.1.7"},{"$f":"'B. Security Policy'!C12","v":"Acceptable use?"},{"$f":"'B. Security Policy'!D12","v":0},{"$f":"'B. Security Policy'!E12","v":0},{"$f":"'B. Security Policy'!F12","v":0},{"$f":"'B. Security Policy'!G12","v":0},{"$f":"'B. Security Policy'!H12","v":"5.1.1"},{"$f":"'B. Security Policy'!I12","v":"Policies for information security"},null,"PO4.10","Supervision","12.3.5","IS.1.4.1.1.1","PO4.10, PO6.2"]
[{"$f":"'B. Security Policy'!A13","v":22},{"$f":"'B. Security Policy'!J13","v":2},{"$f":"'B. Security Policy'!K13","v":0},{"$f":"'B. Security Policy'!Y13","v":0},{"$f":"'B. Security Policy'!B13","v":"B.1.8"},{"$f":"'B. Security Policy'!C13","v":"Access control?"},{"$f":"'B. Security Policy'!D13","v":0},{"$f":"'B. Security Policy'!E13","v":0},{"$f":"'B. Security Policy'!F13","v":0},{"$f":"'B. Security Policy'!G13","v":0},{"$f":"'B. Security Policy'!H13","v":"5.1.1"},{"$f":"'B. Security Policy'!I13","v":"Policies for information security"},null,null,null,"8,12.5.5","IS.1.4.1.1","N/A"]
[{"$f":"'B. Security Policy'!A14","v":23},{"$f":"'B. Security Policy'!J14","v":2},{"$f":"'B. Security Policy'!K14","v":0},{"$f":"'B. Security Policy'!Y14","v":0},{"$f":"'B. Security Policy'!B14","v":"B.1.9"},{"$f":"'B. Security Policy'!C14","v":"Application security?"},{"$f":"'B. Security Policy'!D14","v":0},{"$f":"'B. Security Policy'!E14","v":0},{"$f":"'B. Security Policy'!F14","v":0},{"$f":"'B. Security Policy'!G14","v":0},{"$f":"'B. Security Policy'!H14","v":"N/A"},{"$f":"'B. Security Policy'!I14","v":0},null,null,null,"6.3.b","IS.1.4.1.3.3","N/A"]
[{"$f":"'B. Security Policy'!A15","v":25},{"$f":"'B. Security Policy'!J15","v":2},{"$f":"'B. Security Policy'!K15","v":0},{"$f":"'B. Security Policy'!Y15","v":0},{"$f":"'B. Security Policy'!B15","v":"B.1.10"},{"$f":"'B. Security Policy'!C15","v":"Change control?"},{"$f":"'B. Security Policy'!D15","v":0},{"$f":"'B. Security Policy'!E15","v":0},{"$f":"'B. Security Policy'!F15","v":0},{"$f":"'B. Security Policy'!G15","v":0},{"$f":"'B. Security Policy'!H15","v":"N/A"},{"$f":"'B. Security Policy'!I15","v":0},null,null,null,"6.3.2, 6.4.5","IS.1.4.1.8","N/A"]
[{"$f":"'B. Security Policy'!A16","v":26},{"$f":"'B. Security Policy'!J16","v":2},{"$f":"'B. Security Policy'!K16","v":0},{"$f":"'B. Security Policy'!Y16","v":0},{"$f":"'B. Security Policy'!B16","v":"B.1.11"},{"$f":"'B. Security Policy'!C16","v":"Clean desk?"},{"$f":"'B. Security Policy'!D16","v":0},{"$f":"'B. Security Policy'!E16","v":0},{"$f":"'B. Security Policy'!F16","v":0},{"$f":"'B. Security Policy'!G16","v":0},{"$f":"'B. Security Policy'!H16","v":"5.1.1"},{"$f":"'B. Security Policy'!I16","v":"Policies for information security"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'B. Security Policy'!A17","v":27},{"$f":"'B. Security Policy'!J17","v":2},{"$f":"'B. Security Policy'!K17","v":0},{"$f":"'B. Security Policy'!Y17","v":0},{"$f":"'B. Security Policy'!B17","v":"B.1.12"},{"$f":"'B. Security Policy'!C17","v":"Computer and communication systems access and use?"},{"$f":"'B. Security Policy'!D17","v":0},{"$f":"'B. Security Policy'!E17","v":0},{"$f":"'B. Security Policy'!F17","v":0},{"$f":"'B. Security Policy'!G17","v":0},{"$f":"'B. Security Policy'!H17","v":"5.1.1"},{"$f":"'B. Security Policy'!I17","v":"Policies for information security"},null,null,null,"6.5.8,6.5.10, 7.1, 7.1.2, 7.1.3, 7.2, 8","IS.1.4.1.1 IS.1.4.1.2.3 IS.1.4.1.3.3 IS.1.4.1.4.3","N/A"]
[{"$f":"'B. Security Policy'!A18","v":28},{"$f":"'B. Security Policy'!J18","v":2},{"$f":"'B. Security Policy'!K18","v":0},{"$f":"'B. Security Policy'!Y18","v":0},{"$f":"'B. Security Policy'!B18","v":"B.1.13"},{"$f":"'B. Security Policy'!C18","v":"Data handling?"},{"$f":"'B. Security Policy'!D18","v":0},{"$f":"'B. Security Policy'!E18","v":0},{"$f":"'B. Security Policy'!F18","v":0},{"$f":"'B. Security Policy'!G18","v":0},{"$f":"'B. Security Policy'!H18","v":"5.1.1"},{"$f":"'B. Security Policy'!I18","v":"Policies for information security"},null,null,null,4,"IS.1.4.1.10","N/A"]
[{"$f":"'B. Security Policy'!A19","v":29},{"$f":"'B. Security Policy'!J19","v":2},{"$f":"'B. Security Policy'!K19","v":0},{"$f":"'B. Security Policy'!Y19","v":0},{"$f":"'B. Security Policy'!B19","v":"B.1.14"},{"$f":"'B. Security Policy'!C19","v":"Desktop computing?"},{"$f":"'B. Security Policy'!D19","v":0},{"$f":"'B. Security Policy'!E19","v":0},{"$f":"'B. Security Policy'!F19","v":0},{"$f":"'B. Security Policy'!G19","v":0},{"$f":"'B. Security Policy'!H19","v":"N/A"},{"$f":"'B. Security Policy'!I19","v":0},null,null,null,"2.2.2, 2.2.4, 2.2.5","IS.1.4.1.4","N/A"]
[{"$f":"'B. Security Policy'!A20","v":30},{"$f":"'B. Security Policy'!J20","v":2},{"$f":"'B. Security Policy'!K20","v":0},{"$f":"'B. Security Policy'!Y20","v":0},{"$f":"'B. Security Policy'!B20","v":"B.1.15"},{"$f":"'B. Security Policy'!C20","v":"Disaster recovery?"},{"$f":"'B. Security Policy'!D20","v":0},{"$f":"'B. Security Policy'!E20","v":0},{"$f":"'B. Security Policy'!F20","v":0},{"$f":"'B. Security Policy'!G20","v":0},{"$f":"'B. Security Policy'!H20","v":"N/A"},{"$f":"'B. Security Policy'!I20","v":0},null,null,null,"N/A","IS.1.4.1.12","N/A"]
[{"$f":"'B. Security Policy'!A21","v":31},{"$f":"'B. Security Policy'!J21","v":2},{"$f":"'B. Security Policy'!K21","v":0},{"$f":"'B. Security Policy'!Y21","v":0},{"$f":"'B. Security Policy'!B21","v":"B.1.16"},{"$f":"'B. Security Policy'!C21","v":"Email?"},{"$f":"'B. Security Policy'!D21","v":0},{"$f":"'B. Security Policy'!E21","v":0},{"$f":"'B. Security Policy'!F21","v":0},{"$f":"'B. Security Policy'!G21","v":0},{"$f":"'B. Security Policy'!H21","v":"N/A"},{"$f":"'B. Security Policy'!I21","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'B. Security Policy'!A22","v":32},{"$f":"'B. Security Policy'!J22","v":2},{"$f":"'B. Security Policy'!K22","v":0},{"$f":"'B. Security Policy'!Y22","v":0},{"$f":"'B. Security Policy'!B22","v":"B.1.17"},{"$f":"'B. Security Policy'!C22","v":"Constituent accountability?"},{"$f":"'B. Security Policy'!D22","v":0},{"$f":"'B. Security Policy'!E22","v":0},{"$f":"'B. Security Policy'!F22","v":0},{"$f":"'B. Security Policy'!G22","v":0},{"$f":"'B. Security Policy'!H22","v":"5.1.1"},{"$f":"'B. Security Policy'!I22","v":"Policies for information security"},null,null,null,"12.3.10, 12.4, 12.5, 12.6.2","N/A","N/A"]
[{"$f":"'B. Security Policy'!A23","v":33},{"$f":"'B. Security Policy'!J23","v":2},{"$f":"'B. Security Policy'!K23","v":0},{"$f":"'B. Security Policy'!Y23","v":0},{"$f":"'B. Security Policy'!B23","v":"B.1.18"},{"$f":"'B. Security Policy'!C23","v":"Encryption?"},{"$f":"'B. Security Policy'!D23","v":0},{"$f":"'B. Security Policy'!E23","v":0},{"$f":"'B. Security Policy'!F23","v":0},{"$f":"'B. Security Policy'!G23","v":0},{"$f":"'B. Security Policy'!H23","v":"N/A"},{"$f":"'B. Security Policy'!I23","v":0},null,null,null,"3.4, 3.5, 3.6, 4.1, ","IS.1.4.1.6","N/A"]
[{"$f":"'B. Security Policy'!A24","v":34},{"$f":"'B. Security Policy'!J24","v":2},{"$f":"'B. Security Policy'!K24","v":0},{"$f":"'B. Security Policy'!Y24","v":0},{"$f":"'B. Security Policy'!B24","v":"B.1.19"},{"$f":"'B. Security Policy'!C24","v":"Exception process?"},{"$f":"'B. Security Policy'!D24","v":0},{"$f":"'B. Security Policy'!E24","v":0},{"$f":"'B. Security Policy'!F24","v":0},{"$f":"'B. Security Policy'!G24","v":0},{"$f":"'B. Security Policy'!H24","v":"5.1.1"},{"$f":"'B. Security Policy'!I24","v":"Policies for information security"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'B. Security Policy'!A25","v":35},{"$f":"'B. Security Policy'!J25","v":2},{"$f":"'B. Security Policy'!K25","v":0},{"$f":"'B. Security Policy'!Y25","v":0},{"$f":"'B. Security Policy'!B25","v":"B.1.20"},{"$f":"'B. Security Policy'!C25","v":"Information classification?"},{"$f":"'B. Security Policy'!D25","v":0},{"$f":"'B. Security Policy'!E25","v":0},{"$f":"'B. Security Policy'!F25","v":0},{"$f":"'B. Security Policy'!G25","v":0},{"$f":"'B. Security Policy'!H25","v":"5.1.1"},{"$f":"'B. Security Policy'!I25","v":"Policies for information security"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'B. Security Policy'!A26","v":36},{"$f":"'B. Security Policy'!J26","v":2},{"$f":"'B. Security Policy'!K26","v":0},{"$f":"'B. Security Policy'!Y26","v":0},{"$f":"'B. Security Policy'!B26","v":"B.1.21"},{"$f":"'B. Security Policy'!C26","v":"Internet/Intranet access and use?"},{"$f":"'B. Security Policy'!D26","v":0},{"$f":"'B. Security Policy'!E26","v":0},{"$f":"'B. Security Policy'!F26","v":0},{"$f":"'B. Security Policy'!G26","v":0},{"$f":"'B. Security Policy'!H26","v":"N/A"},{"$f":"'B. Security Policy'!I26","v":0},null,null,null,"4, 7, 10","IS.1.4.1.2","N/A"]
[{"$f":"'B. Security Policy'!A27","v":37},{"$f":"'B. Security Policy'!J27","v":2},{"$f":"'B. Security Policy'!K27","v":0},{"$f":"'B. Security Policy'!Y27","v":0},{"$f":"'B. Security Policy'!B27","v":"B.1.22"},{"$f":"'B. Security Policy'!C27","v":"Mobile computing?"},{"$f":"'B. Security Policy'!D27","v":0},{"$f":"'B. Security Policy'!E27","v":0},{"$f":"'B. Security Policy'!F27","v":0},{"$f":"'B. Security Policy'!G27","v":0},{"$f":"'B. Security Policy'!H27","v":"N/A"},{"$f":"'B. Security Policy'!I27","v":0},null,null,null,12.3,"IS.1.4.1.4","N/A"]
[{"$f":"'B. Security Policy'!A28","v":38},{"$f":"'B. Security Policy'!J28","v":2},{"$f":"'B. Security Policy'!K28","v":0},{"$f":"'B. Security Policy'!Y28","v":0},{"$f":"'B. Security Policy'!B28","v":"B.1.23"},{"$f":"'B. Security Policy'!C28","v":"Network security?"},{"$f":"'B. Security Policy'!D28","v":0},{"$f":"'B. Security Policy'!E28","v":0},{"$f":"'B. Security Policy'!F28","v":0},{"$f":"'B. Security Policy'!G28","v":0},{"$f":"'B. Security Policy'!H28","v":"N/A"},{"$f":"'B. Security Policy'!I28","v":0},null,null,null,"1.1.5, 1.1.6, 1.2, 2.2, 6.2, 11.2, 11.4","IS.1.4.1.2","N/A"]
[{"$f":"'B. Security Policy'!A29","v":39},{"$f":"'B. Security Policy'!J29","v":2},{"$f":"'B. Security Policy'!K29","v":0},{"$f":"'B. Security Policy'!Y29","v":0},{"$f":"'B. Security Policy'!B29","v":"B.1.24"},{"$f":"'B. Security Policy'!C29","v":"Operating system security?"},{"$f":"'B. Security Policy'!D29","v":0},{"$f":"'B. Security Policy'!E29","v":0},{"$f":"'B. Security Policy'!F29","v":0},{"$f":"'B. Security Policy'!G29","v":0},{"$f":"'B. Security Policy'!H29","v":"N/A"},{"$f":"'B. Security Policy'!I29","v":0},null,null,null,"1.1.5, 1.1.6, 1.2, 2.2, 6.2, 11.2, 11.5","IS.1.4.1.3.2 IS.1.4.1.4.2","N/A"]
[{"$f":"'B. Security Policy'!A30","v":40},{"$f":"'B. Security Policy'!J30","v":2},{"$f":"'B. Security Policy'!K30","v":0},{"$f":"'B. Security Policy'!Y30","v":0},{"$f":"'B. Security Policy'!B30","v":"B.1.25"},{"$f":"'B. Security Policy'!C30","v":"Personnel security and termination?"},{"$f":"'B. Security Policy'!D30","v":0},{"$f":"'B. Security Policy'!E30","v":0},{"$f":"'B. Security Policy'!F30","v":0},{"$f":"'B. Security Policy'!G30","v":0},{"$f":"'B. Security Policy'!H30","v":"5.1.1"},{"$f":"'B. Security Policy'!I30","v":"Policies for information security"},null,null,null,"12.3, 12.4, 12.5","IS.1.4.1.9","N/A"]
[{"$f":"'B. Security Policy'!A31","v":41},{"$f":"'B. Security Policy'!J31","v":2},{"$f":"'B. Security Policy'!K31","v":0},{"$f":"'B. Security Policy'!Y31","v":0},{"$f":"'B. Security Policy'!B31","v":"B.1.26"},{"$f":"'B. Security Policy'!C31","v":"Physical access?"},{"$f":"'B. Security Policy'!D31","v":0},{"$f":"'B. Security Policy'!E31","v":0},{"$f":"'B. Security Policy'!F31","v":0},{"$f":"'B. Security Policy'!G31","v":0},{"$f":"'B. Security Policy'!H31","v":"5.1.1"},{"$f":"'B. Security Policy'!I31","v":"Policies for information security"},null,null,null,9,"IS.1.4.1.5","N/A"]
[{"$f":"'B. Security Policy'!A32","v":42},{"$f":"'B. Security Policy'!J32","v":2},{"$f":"'B. Security Policy'!K32","v":0},{"$f":"'B. Security Policy'!Y32","v":0},{"$f":"'B. Security Policy'!B32","v":"B.1.27"},{"$f":"'B. Security Policy'!C32","v":"Policy maintenance?"},{"$f":"'B. Security Policy'!D32","v":0},{"$f":"'B. Security Policy'!E32","v":0},{"$f":"'B. Security Policy'!F32","v":0},{"$f":"'B. Security Policy'!G32","v":0},{"$f":"'B. Security Policy'!H32","v":"5.1.1"},{"$f":"'B. Security Policy'!I32","v":"Policies for information security"},null,null,null,12.1,"N/A","N/A"]
[{"$f":"'B. Security Policy'!A33","v":44},{"$f":"'B. Security Policy'!J33","v":2},{"$f":"'B. Security Policy'!K33","v":0},{"$f":"'B. Security Policy'!Y33","v":0},{"$f":"'B. Security Policy'!B33","v":"B.1.28"},{"$f":"'B. Security Policy'!C33","v":"Remote access?"},{"$f":"'B. Security Policy'!D33","v":0},{"$f":"'B. Security Policy'!E33","v":0},{"$f":"'B. Security Policy'!F33","v":0},{"$f":"'B. Security Policy'!G33","v":0},{"$f":"'B. Security Policy'!H33","v":"N/A"},{"$f":"'B. Security Policy'!I33","v":0},null,null,null,"12.3.8, 12.3.9, 12.3.10","IS.1.4.1.2.4","N/A"]
[{"$f":"'B. Security Policy'!A34","v":48},{"$f":"'B. Security Policy'!J34","v":2},{"$f":"'B. Security Policy'!K34","v":0},{"$f":"'B. Security Policy'!Y34","v":0},{"$f":"'B. Security Policy'!B34","v":"B.1.29"},{"$f":"'B. Security Policy'!C34","v":"Security incident and privacy event management?"},{"$f":"'B. Security Policy'!D34","v":0},{"$f":"'B. Security Policy'!E34","v":0},{"$f":"'B. Security Policy'!F34","v":0},{"$f":"'B. Security Policy'!G34","v":0},{"$f":"'B. Security Policy'!H34","v":"5.1.1"},{"$f":"'B. Security Policy'!I34","v":"Policies for information security"},null,null,null,"12.5.3","N/A","N/A"]
[{"$f":"'B. Security Policy'!A35","v":46},{"$f":"'B. Security Policy'!J35","v":2},{"$f":"'B. Security Policy'!K35","v":0},{"$f":"'B. Security Policy'!Y35","v":0},{"$f":"'B. Security Policy'!B35","v":"B.1.30"},{"$f":"'B. Security Policy'!C35","v":"Secure disposal?"},{"$f":"'B. Security Policy'!D35","v":0},{"$f":"'B. Security Policy'!E35","v":0},{"$f":"'B. Security Policy'!F35","v":0},{"$f":"'B. Security Policy'!G35","v":0},{"$f":"'B. Security Policy'!H35","v":"N/A"},{"$f":"'B. Security Policy'!I35","v":0},null,null,null,9.8000000000000007,"IS.1.4.1.10","N/A"]
[{"$f":"'B. Security Policy'!A36","v":3287},{"$f":"'B. Security Policy'!J36","v":2},{"$f":"'B. Security Policy'!K36","v":0},{"$f":"'B. Security Policy'!Y36","v":0},{"$f":"'B. Security Policy'!B36","v":"B.1.31"},{"$f":"'B. Security Policy'!C36","v":"Social media, social networking?"},{"$f":"'B. Security Policy'!D36","v":0},{"$f":"'B. Security Policy'!E36","v":0},{"$f":"'B. Security Policy'!F36","v":0},{"$f":"'B. Security Policy'!G36","v":0},{"$f":"'B. Security Policy'!H36","v":"N/A"},{"$f":"'B. Security Policy'!I36","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'B. Security Policy'!A37","v":50},{"$f":"'B. Security Policy'!J37","v":2},{"$f":"'B. Security Policy'!K37","v":0},{"$f":"'B. Security Policy'!Y37","v":0},{"$f":"'B. Security Policy'!B37","v":"B.1.32"},{"$f":"'B. Security Policy'!C37","v":"Vulnerability management?"},{"$f":"'B. Security Policy'!D37","v":0},{"$f":"'B. Security Policy'!E37","v":0},{"$f":"'B. Security Policy'!F37","v":0},{"$f":"'B. Security Policy'!G37","v":0},{"$f":"'B. Security Policy'!H37","v":"5.1.1"},{"$f":"'B. Security Policy'!I37","v":"Policies for information security"},null,null,null,"1.2, 1.3, 1.4, 11","N/A","N/A"]
[{"$f":"'B. Security Policy'!A38","v":4112},{"$f":"'B. Security Policy'!J38","v":2},{"$f":"'B. Security Policy'!K38","v":0},{"$f":"'B. Security Policy'!Y38","v":0},{"$f":"'B. Security Policy'!B38","v":"B.1.33"},{"$f":"'B. Security Policy'!C38","v":"Terms of Use for Mobile Devices?"},{"$f":"'B. Security Policy'!D38","v":0},{"$f":"'B. Security Policy'!E38","v":0},{"$f":"'B. Security Policy'!F38","v":0},{"$f":"'B. Security Policy'!G38","v":0},{"$f":"'B. Security Policy'!H38","v":"N/A"},{"$f":"'B. Security Policy'!I38","v":0},null,"PO3.1","Technological direction planning","12.2.b","IS.1.4.2.7","PO3.1, PO5.3, PO5.4, PO6.3, PO9.4, DS5.2, DS5.3, ME2.2, ME2.5, ME2.7, ME4.7"]
[{"$f":"'B. Security Policy'!A39","v":2471},{"$f":"'B. Security Policy'!J39","v":2},{"$f":"'B. Security Policy'!K39","v":0},{"$f":"'B. Security Policy'!Y39","v":1},{"$f":"'B. Security Policy'!B39","v":"B.1.34"},{"$f":"'B. Security Policy'!C39","v":"Have the policies been reviewed in the last 12 months? If yes, did the review include:"},{"$f":"'B. Security Policy'!D39","v":0},{"$f":"'B. Security Policy'!E39","v":0},{"$f":"'B. Security Policy'!F39","v":0},{"$f":"'B. Security Policy'!G39","v":"B.1 Procedure: b.2"},{"$f":"'B. Security Policy'!H39","v":"5.1.2"},{"$f":"'B. Security Policy'!I39","v":"Review of the policies for information security"},null,"PO3.1","Technological direction planning","N/A","N/A","PO3.1, PO5.3, PO5.4, PO6.3, PO9.4, DS5.2, DS5.3, ME2.2, ME2.5, ME2.7, ME4.7"]
[{"$f":"'B. Security Policy'!A40","v":2473},{"$f":"'B. Security Policy'!J40","v":3},{"$f":"'B. Security Policy'!K40","v":0},{"$f":"'B. Security Policy'!Y40","v":0},{"$f":"'B. Security Policy'!B40","v":"B.1.34.1"},{"$f":"'B. Security Policy'!C40","v":"Feedback from interested parties?"},{"$f":"'B. Security Policy'!D40","v":0},{"$f":"'B. Security Policy'!E40","v":0},{"$f":"'B. Security Policy'!F40","v":0},{"$f":"'B. Security Policy'!G40","v":0},{"$f":"'B. Security Policy'!H40","v":"5.1.2"},{"$f":"'B. Security Policy'!I40","v":"Review of the policies for information security"},null,"PO3.1","Technological direction planning","N/A","N/A","PO3.1, PO5.3, PO5.4, PO6.3, PO9.4, DS5.2, DS5.3, ME2.2, ME2.5, ME2.7, ME4.7"]
[{"$f":"'B. Security Policy'!A41","v":2474},{"$f":"'B. Security Policy'!J41","v":3},{"$f":"'B. Security Policy'!K41","v":0},{"$f":"'B. Security Policy'!Y41","v":0},{"$f":"'B. Security Policy'!B41","v":"B.1.34.2"},{"$f":"'B. Security Policy'!C41","v":"Results of independent reviews?"},{"$f":"'B. Security Policy'!D41","v":0},{"$f":"'B. Security Policy'!E41","v":0},{"$f":"'B. Security Policy'!F41","v":0},{"$f":"'B. Security Policy'!G41","v":0},{"$f":"'B. Security Policy'!H41","v":"5.1.2"},{"$f":"'B. Security Policy'!I41","v":"Review of the policies for information security"},null,"PO3.1","Technological direction planning","N/A","N/A","PO3.1, PO5.3, PO5.4, PO6.3, PO9.4, DS5.2, DS5.3, ME2.2, ME2.5, ME2.7, ME4.7"]
[{"$f":"'B. Security Policy'!A42","v":2478},{"$f":"'B. Security Policy'!J42","v":3},{"$f":"'B. Security Policy'!K42","v":0},{"$f":"'B. Security Policy'!Y42","v":0},{"$f":"'B. Security Policy'!B42","v":"B.1.34.3"},{"$f":"'B. Security Policy'!C42","v":"Policy compliance?"},{"$f":"'B. Security Policy'!D42","v":0},{"$f":"'B. Security Policy'!E42","v":0},{"$f":"'B. Security Policy'!F42","v":0},{"$f":"'B. Security Policy'!G42","v":0},{"$f":"'B. Security Policy'!H42","v":"5.1.2"},{"$f":"'B. Security Policy'!I42","v":"Review of the policies for information security"},null,"PO3.1","Technological direction planning","N/A","N/A","PO3.1, PO5.3, PO5.4, PO6.3, PO9.4, DS5.2, DS5.3, ME2.2, ME2.5, ME2.7, ME4.7"]
[{"$f":"'B. Security Policy'!A43","v":2479},{"$f":"'B. Security Policy'!J43","v":3},{"$f":"'B. Security Policy'!K43","v":0},{"$f":"'B. Security Policy'!Y43","v":0},{"$f":"'B. Security Policy'!B43","v":"B.1.34.4"},{"$f":"'B. Security Policy'!C43","v":"Changes that could affect the approach to managing information security?"},{"$f":"'B. Security Policy'!D43","v":0},{"$f":"'B. Security Policy'!E43","v":0},{"$f":"'B. Security Policy'!F43","v":0},{"$f":"'B. Security Policy'!G43","v":0},{"$f":"'B. Security Policy'!H43","v":"5.1.2"},{"$f":"'B. Security Policy'!I43","v":"Review of the policies for information security"},null,"PO3.1","Technological direction planning","12.5.3","N/A","PO3.1, PO5.3, PO5.4, PO6.3, PO9.4, DS5.2, DS5.3, ME2.2, ME2.5, ME2.7, ME4.7"]
[{"$f":"'B. Security Policy'!A44","v":2481},{"$f":"'B. Security Policy'!J44","v":3},{"$f":"'B. Security Policy'!K44","v":0},{"$f":"'B. Security Policy'!Y44","v":0},{"$f":"'B. Security Policy'!B44","v":"B.1.34.5"},{"$f":"'B. Security Policy'!C44","v":"Reported information security incidents?"},{"$f":"'B. Security Policy'!D44","v":0},{"$f":"'B. Security Policy'!E44","v":0},{"$f":"'B. Security Policy'!F44","v":0},{"$f":"'B. Security Policy'!G44","v":0},{"$f":"'B. Security Policy'!H44","v":"5.1.2"},{"$f":"'B. Security Policy'!I44","v":"Review of the policies for information security"},null,"PO3.1","Technological direction planning","N/A","N/A","PO3.1, PO5.3, PO5.4, PO6.3, PO9.4, DS5.2, DS5.3, ME2.2, ME2.5, ME2.7, ME4.7"]
[{"$f":"'B. Security Policy'!A45","v":2482},{"$f":"'B. Security Policy'!J45","v":3},{"$f":"'B. Security Policy'!K45","v":0},{"$f":"'B. Security Policy'!Y45","v":0},{"$f":"'B. Security Policy'!B45","v":"B.1.34.6"},{"$f":"'B. Security Policy'!C45","v":"Recommendations provided by relevant authorities?"},{"$f":"'B. Security Policy'!D45","v":0},{"$f":"'B. Security Policy'!E45","v":0},{"$f":"'B. Security Policy'!F45","v":0},{"$f":"'B. Security Policy'!G45","v":0},{"$f":"'B. Security Policy'!H45","v":"5.1.2"},{"$f":"'B. Security Policy'!I45","v":"Review of the policies for information security"},null,"PO3.1","Technological direction planning","N/A","N/A","PO3.1, PO5.3, PO5.4, PO6.3, PO9.4, DS5.2, DS5.3, ME2.2, ME2.5, ME2.7, ME4.7"]
[{"$f":"'B. Security Policy'!A46","v":2483},{"$f":"'B. Security Policy'!J46","v":3},{"$f":"'B. Security Policy'!K46","v":0},{"$f":"'B. Security Policy'!Y46","v":0},{"$f":"'B. Security Policy'!B46","v":"B.1.34.7"},{"$f":"'B. Security Policy'!C46","v":"Records management?"},{"$f":"'B. Security Policy'!D46","v":0},{"$f":"'B. Security Policy'!E46","v":0},{"$f":"'B. Security Policy'!F46","v":0},{"$f":"'B. Security Policy'!G46","v":0},{"$f":"'B. Security Policy'!H46","v":"5.1.2"},{"$f":"'B. Security Policy'!I46","v":"Review of the policies for information security"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'B. Security Policy'!A47","v":53},{"$f":"'B. Security Policy'!J47","v":2},{"$f":"'B. Security Policy'!K47","v":0},{"$f":"'B. Security Policy'!Y47","v":0},{"$f":"'B. Security Policy'!B47","v":"B.1.35"},{"$f":"'B. Security Policy'!C47","v":"Is there a process to approve exceptions to the policy? "},{"$f":"'B. Security Policy'!D47","v":0},{"$f":"'B. Security Policy'!E47","v":0},{"$f":"'B. Security Policy'!F47","v":0},{"$f":"'B. Security Policy'!G47","v":0},{"$f":"'B. Security Policy'!H47","v":"5.1.2"},{"$f":"'B. Security Policy'!I47","v":"Review of the policies for information security"},null,null,null,12.5,"N/A","N/A"]
[{"$f":"'B. Security Policy'!A48","v":54},{"$f":"'B. Security Policy'!J48","v":3},{"$f":"'B. Security Policy'!K48","v":0},{"$f":"'B. Security Policy'!Y48","v":0},{"$f":"'B. Security Policy'!B48","v":"B.1.35.1"},{"$f":"'B. Security Policy'!C48","v":"Does security own the approval process?"},{"$f":"'B. Security Policy'!D48","v":0},{"$f":"'B. Security Policy'!E48","v":0},{"$f":"'B. Security Policy'!F48","v":0},{"$f":"'B. Security Policy'!G48","v":0},{"$f":"'B. Security Policy'!H48","v":"N/A"},{"$f":"'B. Security Policy'!I48","v":0},null,"PO6.1","IT policy and control environment","12.6.2","MGMT.1.2.1.15.1","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'B. Security Policy'!A49","v":19},{"$f":"'B. Security Policy'!J49","v":2},{"$f":"'B. Security Policy'!K49","v":0},{"$f":"'B. Security Policy'!Y49","v":0},{"$f":"'B. Security Policy'!B49","v":"B.1.36"},{"$f":"'B. Security Policy'!C49","v":"Is the information security policy communicated? If yes, is it communicated to:"},{"$f":"'B. Security Policy'!D49","v":0},{"$f":"'B. Security Policy'!E49","v":0},{"$f":"'B. Security Policy'!F49","v":0},{"$f":"'B. Security Policy'!G49","v":0},{"$f":"'B. Security Policy'!H49","v":"5.1.1"},{"$f":"'B. Security Policy'!I49","v":"Policies for information security"},null,null,null,"12.6.2","N/A","N/A"]
[{"$f":"'B. Security Policy'!A50","v":223},{"$f":"'B. Security Policy'!J50","v":3},{"$f":"'B. Security Policy'!K50","v":0},{"$f":"'B. Security Policy'!Y50","v":0},{"$f":"'B. Security Policy'!B50","v":"B.1.36.1"},{"$f":"'B. Security Policy'!C50","v":"Full time constituents?"},{"$f":"'B. Security Policy'!D50","v":0},{"$f":"'B. Security Policy'!E50","v":0},{"$f":"'B. Security Policy'!F50","v":0},{"$f":"'B. Security Policy'!G50","v":0},{"$f":"'B. Security Policy'!H50","v":"5.1.1"},{"$f":"'B. Security Policy'!I50","v":"Policies for information security"},null,null,null,"12.6.2","N/A","N/A"]
[{"$f":"'B. Security Policy'!A51","v":224},{"$f":"'B. Security Policy'!J51","v":3},{"$f":"'B. Security Policy'!K51","v":0},{"$f":"'B. Security Policy'!Y51","v":0},{"$f":"'B. Security Policy'!B51","v":"B.1.36.2"},{"$f":"'B. Security Policy'!C51","v":"Part time constituents?"},{"$f":"'B. Security Policy'!D51","v":0},{"$f":"'B. Security Policy'!E51","v":0},{"$f":"'B. Security Policy'!F51","v":0},{"$f":"'B. Security Policy'!G51","v":0},{"$f":"'B. Security Policy'!H51","v":"5.1.1"},{"$f":"'B. Security Policy'!I51","v":"Policies for information security"},null,null,null,"12.8.2","N/A","N/A"]
[{"$f":"'B. Security Policy'!A52","v":225},{"$f":"'B. Security Policy'!J52","v":3},{"$f":"'B. Security Policy'!K52","v":0},{"$f":"'B. Security Policy'!Y52","v":0},{"$f":"'B. Security Policy'!B52","v":"B.1.36.3"},{"$f":"'B. Security Policy'!C52","v":"Contractors?"},{"$f":"'B. Security Policy'!D52","v":0},{"$f":"'B. Security Policy'!E52","v":0},{"$f":"'B. Security Policy'!F52","v":0},{"$f":"'B. Security Policy'!G52","v":0},{"$f":"'B. Security Policy'!H52","v":"5.1.1"},{"$f":"'B. Security Policy'!I52","v":"Policies for information security"},null,null,null,12.8,"N/A","N/A"]
[{"$f":"'B. Security Policy'!A53","v":3886},{"$f":"'B. Security Policy'!J53","v":1},{"$f":"'B. Security Policy'!K53","v":0},{"$f":"'B. Security Policy'!Y53","v":1},{"$f":"'B. Security Policy'!B53","v":"B.2"},{"$f":"'B. Security Policy'!C53","v":"Is there a vendor management program?"},{"$f":"'B. Security Policy'!D53","v":0},{"$f":"'B. Security Policy'!E53","v":0},{"$f":"'B. Security Policy'!F53","v":0},{"$f":"'B. Security Policy'!G53","v":"B.3 Vendor Management Program"},{"$f":"'B. Security Policy'!H53","v":"N/A"},{"$f":"'B. Security Policy'!I53","v":0},null,null,null,"12.8.4"]
[{"$f":"'B. Security Policy'!A54","v":3887},{"$f":"'B. Security Policy'!J54","v":2},{"$f":"'B. Security Policy'!K54","v":0},{"$f":"'B. Security Policy'!Y54","v":0},{"$f":"'B. Security Policy'!B54","v":"B.2.1"},{"$f":"'B. Security Policy'!C54","v":"Does the vendor management program include an individual or group responsible for capturing, maintaining and tracking subcontractor information security issues? If yes, is there:"},{"$f":"'B. Security Policy'!D54","v":0},{"$f":"'B. Security Policy'!E54","v":0},{"$f":"'B. Security Policy'!F54","v":0},{"$f":"'B. Security Policy'!G54","v":0},{"$f":"'B. Security Policy'!H54","v":"N/A"},{"$f":"'B. Security Policy'!I54","v":0},null,null,null,"N/A"]
[{"$f":"'B. Security Policy'!A55","v":3888},{"$f":"'B. Security Policy'!J55","v":3},{"$f":"'B. Security Policy'!K55","v":0},{"$f":"'B. Security Policy'!Y55","v":0},{"$f":"'B. Security Policy'!B55","v":"B.2.1.1"},{"$f":"'B. Security Policy'!C55","v":"Risk rating of the issue (e.g., H/M/L, 1-5, etc.)?"},{"$f":"'B. Security Policy'!D55","v":0},{"$f":"'B. Security Policy'!E55","v":0},{"$f":"'B. Security Policy'!F55","v":0},{"$f":"'B. Security Policy'!G55","v":"B.3 Procedure: b.1"},{"$f":"'B. Security Policy'!H55","v":"N/A"},{"$f":"'B. Security Policy'!I55","v":0},null,null,null,"N/A"]
[{"$f":"'B. Security Policy'!A56","v":3889},{"$f":"'B. Security Policy'!J56","v":3},{"$f":"'B. Security Policy'!K56","v":0},{"$f":"'B. Security Policy'!Y56","v":0},{"$f":"'B. Security Policy'!B56","v":"B.2.1.2"},{"$f":"'B. Security Policy'!C56","v":"Documented corrective action or remediation plan?"},{"$f":"'B. Security Policy'!D56","v":0},{"$f":"'B. Security Policy'!E56","v":0},{"$f":"'B. Security Policy'!F56","v":0},{"$f":"'B. Security Policy'!G56","v":"B.3 Procedure: b.2"},{"$f":"'B. Security Policy'!H56","v":"N/A"},{"$f":"'B. Security Policy'!I56","v":0},null,null,null,"N/A"]
[{"$f":"'B. Security Policy'!A57","v":3890},{"$f":"'B. Security Policy'!J57","v":3},{"$f":"'B. Security Policy'!K57","v":0},{"$f":"'B. Security Policy'!Y57","v":0},{"$f":"'B. Security Policy'!B57","v":"B.2.1.3"},{"$f":"'B. Security Policy'!C57","v":"Target remediation date?"},{"$f":"'B. Security Policy'!D57","v":0},{"$f":"'B. Security Policy'!E57","v":0},{"$f":"'B. Security Policy'!F57","v":0},{"$f":"'B. Security Policy'!G57","v":"B.3 Procedure: b.3"},{"$f":"'B. Security Policy'!H57","v":"N/A"},{"$f":"'B. Security Policy'!I57","v":0},null,null,null,"N/A"]
[{"$f":"'B. Security Policy'!A58","v":3891},{"$f":"'B. Security Policy'!J58","v":3},{"$f":"'B. Security Policy'!K58","v":0},{"$f":"'B. Security Policy'!Y58","v":0},{"$f":"'B. Security Policy'!B58","v":"B.2.1.4"},{"$f":"'B. Security Policy'!C58","v":"On-going communication with subcontractor to discuss status of remediation? "},{"$f":"'B. Security Policy'!D58","v":0},{"$f":"'B. Security Policy'!E58","v":0},{"$f":"'B. Security Policy'!F58","v":0},{"$f":"'B. Security Policy'!G58","v":"B.3 Procedure: b.4"},{"$f":"'B. Security Policy'!H58","v":"N/A"},{"$f":"'B. Security Policy'!I58","v":0},null,null,null,"N/A"]
[{"$f":"'B. Security Policy'!A59","v":3892},{"$f":"'B. Security Policy'!J59","v":3},{"$f":"'B. Security Policy'!K59","v":0},{"$f":"'B. Security Policy'!Y59","v":0},{"$f":"'B. Security Policy'!B59","v":"B.2.1.5"},{"$f":"'B. Security Policy'!C59","v":"Escalation procedure if the remediation date is not met?"},{"$f":"'B. Security Policy'!D59","v":0},{"$f":"'B. Security Policy'!E59","v":0},{"$f":"'B. Security Policy'!F59","v":0},{"$f":"'B. Security Policy'!G59","v":"B.3 Procedure: b.5"},{"$f":"'B. Security Policy'!H59","v":"N/A"},{"$f":"'B. Security Policy'!I59","v":0},null,null,null,"N/A"]
[{"$f":"'B. Security Policy'!A60","v":3893},{"$f":"'B. Security Policy'!J60","v":3},{"$f":"'B. Security Policy'!K60","v":0},{"$f":"'B. Security Policy'!Y60","v":0},{"$f":"'B. Security Policy'!B60","v":"B.2.1.6"},{"$f":"'B. Security Policy'!C60","v":"Sign-off when remediation is fully implemented?"},{"$f":"'B. Security Policy'!D60","v":0},{"$f":"'B. Security Policy'!E60","v":0},{"$f":"'B. Security Policy'!F60","v":0},{"$f":"'B. Security Policy'!G60","v":"B.3 Procedure: b.6"},{"$f":"'B. Security Policy'!H60","v":"N/A"},{"$f":"'B. Security Policy'!I60","v":0},null,null,null,"N/A"]
[{"$f":"'B. Security Policy'!A61","v":3894},{"$f":"'B. Security Policy'!J61","v":3},{"$f":"'B. Security Policy'!K61","v":0},{"$f":"'B. Security Policy'!Y61","v":0},{"$f":"'B. Security Policy'!B61","v":"B.2.1.7"},{"$f":"'B. Security Policy'!C61","v":"Reporting on remediation? If yes, does it include:"},{"$f":"'B. Security Policy'!D61","v":0},{"$f":"'B. Security Policy'!E61","v":0},{"$f":"'B. Security Policy'!F61","v":0},{"$f":"'B. Security Policy'!G61","v":"B.3 Procedure: b.7"},{"$f":"'B. Security Policy'!H61","v":"N/A"},{"$f":"'B. Security Policy'!I61","v":0},null,null,null,"N/A"]
[{"$f":"'B. Security Policy'!A62","v":3895},{"$f":"'B. Security Policy'!J62","v":4},{"$f":"'B. Security Policy'!K62","v":0},{"$f":"'B. Security Policy'!Y62","v":0},{"$f":"'B. Security Policy'!B62","v":"B.2.1.7.1"},{"$f":"'B. Security Policy'!C62","v":"Identification of stakeholders?"},{"$f":"'B. Security Policy'!D62","v":0},{"$f":"'B. Security Policy'!E62","v":0},{"$f":"'B. Security Policy'!F62","v":0},{"$f":"'B. Security Policy'!G62","v":0},{"$f":"'B. Security Policy'!H62","v":"N/A"},{"$f":"'B. Security Policy'!I62","v":0},null,null,null,"N/A"]
[{"$f":"'B. Security Policy'!A63","v":3896},{"$f":"'B. Security Policy'!J63","v":4},{"$f":"'B. Security Policy'!K63","v":0},{"$f":"'B. Security Policy'!Y63","v":0},{"$f":"'B. Security Policy'!B63","v":"B.2.1.7.2"},{"$f":"'B. Security Policy'!C63","v":"Reporting frequency?"},{"$f":"'B. Security Policy'!D63","v":0},{"$f":"'B. Security Policy'!E63","v":0},{"$f":"'B. Security Policy'!F63","v":0},{"$f":"'B. Security Policy'!G63","v":0},{"$f":"'B. Security Policy'!H63","v":"N/A"},{"$f":"'B. Security Policy'!I63","v":0}]
[{"$f":"'B. Security Policy'!A64","v":0},{"$f":"'B. Security Policy'!J64","v":0},{"$f":"'B. Security Policy'!K64","v":0},{"$f":"'B. Security Policy'!Y64","v":0},{"$f":"'B. Security Policy'!B64","v":0},{"$f":"'B. Security Policy'!C64","v":0},{"$f":"'B. Security Policy'!D64","v":0},{"$f":"'B. Security Policy'!E64","v":0},{"$f":"'B. Security Policy'!F64","v":0},{"$f":"'B. Security Policy'!G64","v":0},{"$f":"'B. Security Policy'!H64","v":0},{"$f":"'B. Security Policy'!I64","v":0}]
[{"$f":"'B. Security Policy'!A65","v":0},{"$f":"'B. Security Policy'!J65","v":0},{"$f":"'B. Security Policy'!K65","v":0},{"$f":"'B. Security Policy'!Y65","v":0},{"$f":"'B. Security Policy'!B65","v":0},{"$f":"'B. Security Policy'!C65","v":0},{"$f":"'B. Security Policy'!D65","v":0},{"$f":"'B. Security Policy'!E65","v":0},{"$f":"'B. Security Policy'!F65","v":0},{"$f":"'B. Security Policy'!G65","v":0},{"$f":"'B. Security Policy'!H65","v":0},{"$f":"'B. Security Policy'!I65","v":0}]
[{"$f":"'C. Organizational Security'!B1","v":"C. Organizational Security"},null,null,null,{"$f":"'C. Organizational Security'!B1","v":"C. Organizational Security"}]
[{"$f":"'C. Organizational Security'!A5","v":58},{"$f":"'C. Organizational Security'!J5","v":1},{"$f":"'C. Organizational Security'!K5","v":0},{"$f":"'C. Organizational Security'!Y5","v":1},{"$f":"'C. Organizational Security'!B5","v":"C.1"},{"$f":"'C. Organizational Security'!C5","v":"Is there a respondent information security function responsible for security initiatives? If yes, does it include:"},{"$f":"'C. Organizational Security'!D5","v":0},{"$f":"'C. Organizational Security'!E5","v":0},{"$f":"'C. Organizational Security'!F5","v":0},{"$f":"'C. Organizational Security'!G5","v":"C.2 Security Organization Roles/Responsibilities"},{"$f":"'C. Organizational Security'!H5","v":"6.1.1"},{"$f":"'C. Organizational Security'!I5","v":"Information Security Roles and Responsibilities"},null,"PO3.3","Monitoring of future trends and regulations",12.5,"IS.1.7.4 MGMT.1.6.1.6","PO3.3, PO3.5, PO4.3, PO4.4, PO4.5, PO4.8, PO6.3, PO6.4, PO6.5, DS5.1"]
[{"$f":"'C. Organizational Security'!A6","v":61},{"$f":"'C. Organizational Security'!J6","v":2},{"$f":"'C. Organizational Security'!K6","v":0},{"$f":"'C. Organizational Security'!Y6","v":0},{"$f":"'C. Organizational Security'!B6","v":"C.1.1"},{"$f":"'C. Organizational Security'!C6","v":"Creation, review and approve of information security policies?"},{"$f":"'C. Organizational Security'!D6","v":0},{"$f":"'C. Organizational Security'!E6","v":0},{"$f":"'C. Organizational Security'!F6","v":0},{"$f":"'C. Organizational Security'!G6","v":0},{"$f":"'C. Organizational Security'!H6","v":"5.1.2"},{"$f":"'C. Organizational Security'!I6","v":"Review of the policies for information security"},null,"PO3.3","Monitoring of future trends and regulations","12.5.1","N/A","PO3.3, PO3.5, PO4.3, PO4.4, PO4.5, PO4.8, PO6.3, PO6.4, PO6.5, DS5.1"]
[{"$f":"'C. Organizational Security'!A7","v":2488},{"$f":"'C. Organizational Security'!J7","v":2},{"$f":"'C. Organizational Security'!K7","v":0},{"$f":"'C. Organizational Security'!Y7","v":0},{"$f":"'C. Organizational Security'!B7","v":"C.1.2"},{"$f":"'C. Organizational Security'!C7","v":"Review the effectiveness of information security policy implementation?"},{"$f":"'C. Organizational Security'!D7","v":0},{"$f":"'C. Organizational Security'!E7","v":0},{"$f":"'C. Organizational Security'!F7","v":0},{"$f":"'C. Organizational Security'!G7","v":0},{"$f":"'C. Organizational Security'!H7","v":"5.1.2"},{"$f":"'C. Organizational Security'!I7","v":"Management commitment to information security"},null,"PO3.3","Monitoring of future trends and regulations","N/A","N/A","PO3.3, PO3.5, PO4.3, PO4.4, PO4.5, PO4.8, PO6.3, PO6.4, PO6.5, DS5.1"]
[{"$f":"'C. Organizational Security'!A8","v":2490},{"$f":"'C. Organizational Security'!J8","v":2},{"$f":"'C. Organizational Security'!K8","v":0},{"$f":"'C. Organizational Security'!Y8","v":0},{"$f":"'C. Organizational Security'!B8","v":"C.1.3"},{"$f":"'C. Organizational Security'!C8","v":"Manage assignment of specific roles and responsibilities for information security?"},{"$f":"'C. Organizational Security'!D8","v":0},{"$f":"'C. Organizational Security'!E8","v":0},{"$f":"'C. Organizational Security'!F8","v":0},{"$f":"'C. Organizational Security'!G8","v":0},{"$f":"'C. Organizational Security'!H8","v":"6.1.1.c"},{"$f":"'C. Organizational Security'!I8","v":"Management commitment to information security"},null,"PO3.3","Monitoring of future trends and regulations",12.5,"IS.1.4.2.3","PO3.3, PO3.5, PO4.3, PO4.4, PO4.5, PO4.8, PO6.3, PO6.4, PO6.5, DS5.1"]
[{"$f":"'C. Organizational Security'!A9","v":65},{"$f":"'C. Organizational Security'!J9","v":2},{"$f":"'C. Organizational Security'!K9","v":0},{"$f":"'C. Organizational Security'!Y9","v":0},{"$f":"'C. Organizational Security'!B9","v":"C.1.4"},{"$f":"'C. Organizational Security'!C9","v":"Develop and maintain an overall strategic security plan?"},{"$f":"'C. Organizational Security'!D9","v":0},{"$f":"'C. Organizational Security'!E9","v":0},{"$f":"'C. Organizational Security'!F9","v":0},{"$f":"'C. Organizational Security'!G9","v":0},{"$f":"'C. Organizational Security'!H9","v":6.1},{"$f":"'C. Organizational Security'!I9","v":"Internal Organization"},null,"PO3.3","Monitoring of future trends and regulations","12.5.1","N/A","PO3.3, PO3.5, PO4.3, PO4.4, PO4.5, PO4.8, PO6.3, PO6.4, PO6.5, DS5.1"]
[{"$f":"'C. Organizational Security'!A10","v":2494},{"$f":"'C. Organizational Security'!J10","v":2},{"$f":"'C. Organizational Security'!K10","v":0},{"$f":"'C. Organizational Security'!Y10","v":0},{"$f":"'C. Organizational Security'!B10","v":"C.1.5"},{"$f":"'C. Organizational Security'!C10","v":"Consistent implementation of information security across different parts of the respondent's organization?"},{"$f":"'C. Organizational Security'!D10","v":0},{"$f":"'C. Organizational Security'!E10","v":0},{"$f":"'C. Organizational Security'!F10","v":0},{"$f":"'C. Organizational Security'!G10","v":0},{"$f":"'C. Organizational Security'!H10","v":"5.1.1"},{"$f":"'C. Organizational Security'!I10","v":"Policies for Information security"},null,"PO4.4","Organisational placement of the IT function","N/A","N/A","PO4.4, PO4.5, PO4.6, PO4.8, PO4.10, PO6.5, DS5.1, DS5.2, DS5.3"]
[{"$f":"'C. Organizational Security'!A11","v":63},{"$f":"'C. Organizational Security'!J11","v":2},{"$f":"'C. Organizational Security'!K11","v":0},{"$f":"'C. Organizational Security'!Y11","v":0},{"$f":"'C. Organizational Security'!B11","v":"C.1.6"},{"$f":"'C. Organizational Security'!C11","v":"Review and monitor information security / privacy incidents or events?"},{"$f":"'C. Organizational Security'!D11","v":0},{"$f":"'C. Organizational Security'!E11","v":0},{"$f":"'C. Organizational Security'!F11","v":0},{"$f":"'C. Organizational Security'!G11","v":0},{"$f":"'C. Organizational Security'!H11","v":"18.2.1"},{"$f":"'C. Organizational Security'!I11","v":"Independent review of information security"},null,"PO3.1","Technological direction planning","12.5.3","IS.2.M.1.2","PO3.1, PO5.3, PO5.4, PO6.3, PO9.4, DS5.2, DS5.3, ME2.2, ME2.5, ME2.7, ME4.7"]
[{"$f":"'C. Organizational Security'!A12","v":62},{"$f":"'C. Organizational Security'!J12","v":2},{"$f":"'C. Organizational Security'!K12","v":0},{"$f":"'C. Organizational Security'!Y12","v":0},{"$f":"'C. Organizational Security'!B12","v":"C.1.7"},{"$f":"'C. Organizational Security'!C12","v":"Monitor significant changes in the exposure of information assets?"},{"$f":"'C. Organizational Security'!D12","v":0},{"$f":"'C. Organizational Security'!E12","v":0},{"$f":"'C. Organizational Security'!F12","v":0},{"$f":"'C. Organizational Security'!G12","v":0},{"$f":"'C. Organizational Security'!H12","v":"6.1.1"},{"$f":"'C. Organizational Security'!I12","v":"Information Security Roles and Responsibilities"},null,"PO4.4","Organisational placement of the IT function",6.4,"N/A","PO4.4, PO4.6, PO4.8, PO4.9, PO4.10"]
[{"$f":"'C. Organizational Security'!A13","v":2500},{"$f":"'C. Organizational Security'!J13","v":2},{"$f":"'C. Organizational Security'!K13","v":0},{"$f":"'C. Organizational Security'!Y13","v":0},{"$f":"'C. Organizational Security'!B13","v":"C.1.8"},{"$f":"'C. Organizational Security'!C13","v":"Contacts with information security special interest groups, specialist security forums, or professional associations?"},{"$f":"'C. Organizational Security'!D13","v":0},{"$f":"'C. Organizational Security'!E13","v":0},{"$f":"'C. Organizational Security'!F13","v":0},{"$f":"'C. Organizational Security'!G13","v":0},{"$f":"'C. Organizational Security'!H13","v":"6.1.4"},{"$f":"'C. Organizational Security'!I13","v":"Contact with special interest groups"},null,"PO4.15","Relationships","N/A","IS.1.6.3","PO4.15, DS4.1, DS4.2"]
[{"$f":"'C. Organizational Security'!A14","v":67},{"$f":"'C. Organizational Security'!J14","v":2},{"$f":"'C. Organizational Security'!K14","v":0},{"$f":"'C. Organizational Security'!Y14","v":0},{"$f":"'C. Organizational Security'!B14","v":"C.1.9"},{"$f":"'C. Organizational Security'!C14","v":"Identify and document instances of non-compliance with security policies?"},{"$f":"'C. Organizational Security'!D14","v":0},{"$f":"'C. Organizational Security'!E14","v":0},{"$f":"'C. Organizational Security'!F14","v":0},{"$f":"'C. Organizational Security'!G14","v":0},{"$f":"'C. Organizational Security'!H14","v":"18.2.2"},{"$f":"'C. Organizational Security'!I14","v":"Compliance with security policies and standards"},null,"PO4.8","Responsibility for risk, security and compliance","N/A","N/A","PO4.8, PO6.2, ME2.1, ME2.2, ME2.3, ME2.4, ME2.5, ME2.6, ME2.7"]
[{"$f":"'C. Organizational Security'!A15","v":2889},{"$f":"'C. Organizational Security'!J15","v":2},{"$f":"'C. Organizational Security'!K15","v":0},{"$f":"'C. Organizational Security'!Y15","v":0},{"$f":"'C. Organizational Security'!B15","v":"C.1.10"},{"$f":"'C. Organizational Security'!C15","v":"Identify key Information Technology roles?"},{"$f":"'C. Organizational Security'!D15","v":0},{"$f":"'C. Organizational Security'!E15","v":0},{"$f":"'C. Organizational Security'!F15","v":0},{"$f":"'C. Organizational Security'!G15","v":0},{"$f":"'C. Organizational Security'!H15","v":"6.1.1"},{"$f":"'C. Organizational Security'!I15","v":"Information Security Roles and Responsibilities"},null,"PO4.13","Key IT personnel",12.5,"IS.1.6.7","N/A"]
[{"$f":"'C. Organizational Security'!A16","v":71},{"$f":"'C. Organizational Security'!J16","v":1},{"$f":"'C. Organizational Security'!K16","v":0},{"$f":"'C. Organizational Security'!Y16","v":1},{"$f":"'C. Organizational Security'!B16","v":"C.2"},{"$f":"'C. Organizational Security'!C16","v":"Do external parties have access to Scoped Systems and Data or processing facilities? If yes, is:"},{"$f":"'C. Organizational Security'!D16","v":0},{"$f":"'C. Organizational Security'!E16","v":0},{"$f":"'C. Organizational Security'!F16","v":0},{"$f":"'C. Organizational Security'!G16","v":0},{"$f":"'C. Organizational Security'!H16","v":15},{"$f":"'C. Organizational Security'!I16","v":"Supplier relationships"},null,null,null,12.8,"N/A","PO6.4, DS5.5, ME2.2, ME2.5, ME4.7"]
[{"$f":"'C. Organizational Security'!A17","v":2512},{"$f":"'C. Organizational Security'!J17","v":2},{"$f":"'C. Organizational Security'!K17","v":0},{"$f":"'C. Organizational Security'!Y17","v":0},{"$f":"'C. Organizational Security'!B17","v":"C.2.1"},{"$f":"'C. Organizational Security'!C17","v":"Access prohibited prior to a risk assessment being conducted?"},{"$f":"'C. Organizational Security'!D17","v":0},{"$f":"'C. Organizational Security'!E17","v":0},{"$f":"'C. Organizational Security'!F17","v":0},{"$f":"'C. Organizational Security'!G17","v":0},{"$f":"'C. Organizational Security'!H17","v":"15.1.1"},{"$f":"'C. Organizational Security'!I17","v":"Information security policy for supplier relationships"},null,"PO4.14","Contracted staff policies and procedures","12.8.3","IS.1.5.1 IS.1.5.4 O.1.2.1 O.1.3.5 MGMT.1.6.1.5 O.1.2.1.2 E-BANK.1.4.2.13 RPS.1.2.1.5","PO4.14, DS2.1, DS2.3, DS5.4, DS5.9, DS5.11, DS12.3"]
[{"$f":"'C. Organizational Security'!A18","v":2514},{"$f":"'C. Organizational Security'!J18","v":2},{"$f":"'C. Organizational Security'!K18","v":0},{"$f":"'C. Organizational Security'!Y18","v":0},{"$f":"'C. Organizational Security'!B18","v":"C.2.2"},{"$f":"'C. Organizational Security'!C18","v":"A risk assessment performed on third parties?"},{"$f":"'C. Organizational Security'!D18","v":0},{"$f":"'C. Organizational Security'!E18","v":0},{"$f":"'C. Organizational Security'!F18","v":0},{"$f":"'C. Organizational Security'!G18","v":0},{"$f":"'C. Organizational Security'!H18","v":"15.1.1"},{"$f":"'C. Organizational Security'!I18","v":"Information security policy for supplier relationships"},null,"PO4.14","Contracted staff policies and procedures","12.8.4","RPS.1.8.4 RPS.1.11.1.3","PO4.14, DS2.1, DS2.3, DS5.4, DS5.9, DS5.11, DS12.3"]
[{"$f":"'C. Organizational Security'!A19","v":101},{"$f":"'C. Organizational Security'!J19","v":2},{"$f":"'C. Organizational Security'!K19","v":0},{"$f":"'C. Organizational Security'!Y19","v":0},{"$f":"'C. Organizational Security'!B19","v":"C.2.3"},{"$f":"'C. Organizational Security'!C19","v":"A controls assessment performed on third parties?"},{"$f":"'C. Organizational Security'!D19","v":0},{"$f":"'C. Organizational Security'!E19","v":0},{"$f":"'C. Organizational Security'!F19","v":0},{"$f":"'C. Organizational Security'!G19","v":0},{"$f":"'C. Organizational Security'!H19","v":"15.1.1"},{"$f":"'C. Organizational Security'!I19","v":"Information security policy for supplier relationships"},null,"PO4.14","Contracted staff policies and procedures","12.8.4","IS.1.4.1.11 O.2.D.4 AUDIT.1.13.1 RPS.1.11.2.3","PO4.14, DS2.1, DS2.3, DS5.4, DS5.9, DS5.11, DS12.3"]
[{"$f":"'C. Organizational Security'!A20","v":2516},{"$f":"'C. Organizational Security'!J20","v":2},{"$f":"'C. Organizational Security'!K20","v":0},{"$f":"'C. Organizational Security'!Y20","v":0},{"$f":"'C. Organizational Security'!B20","v":"C.2.4"},{"$f":"'C. Organizational Security'!C20","v":"Agreements in place when customers access Scoped Systems and Data?"},{"$f":"'C. Organizational Security'!D20","v":0},{"$f":"'C. Organizational Security'!E20","v":0},{"$f":"'C. Organizational Security'!F20","v":0},{"$f":"'C. Organizational Security'!G20","v":0},{"$f":"'C. Organizational Security'!H20","v":"15.1.2"},{"$f":"'C. Organizational Security'!I20","v":"Addressing security within supplier agreements"},null,"PO6.2","Enterprise IT risk and internal control framework","12.8.2","N/A","PO6.2, DS5.4"]
[{"$f":"'C. Organizational Security'!A21","v":2501},{"$f":"'C. Organizational Security'!J21","v":2},{"$f":"'C. Organizational Security'!K21","v":0},{"$f":"'C. Organizational Security'!Y21","v":0},{"$f":"'C. Organizational Security'!B21","v":"C.2.5"},{"$f":"'C. Organizational Security'!C21","v":"Does management require the use of confidentiality or non-disclosure agreements for all third parties? If yes, do they contain:"},{"$f":"'C. Organizational Security'!D21","v":0},{"$f":"'C. Organizational Security'!E21","v":0},{"$f":"'C. Organizational Security'!F21","v":0},{"$f":"'C. Organizational Security'!G21","v":0},{"$f":"'C. Organizational Security'!H21","v":"7.1.2.a"},{"$f":"'C. Organizational Security'!I21","v":"Terms and conditions of employment"},null,"PO4.6","Roles and responsibilities","N/A","IS.1.5.3 IS.2.F.3","PO4.6, PO4.14, PO8.3, AI5.1, AI5.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'C. Organizational Security'!A22","v":2506},{"$f":"'C. Organizational Security'!J22","v":3},{"$f":"'C. Organizational Security'!K22","v":0},{"$f":"'C. Organizational Security'!Y22","v":0},{"$f":"'C. Organizational Security'!B22","v":"C.2.5.1"},{"$f":"'C. Organizational Security'!C22","v":"Ownership of information, trade secrets and intellectual property?"},{"$f":"'C. Organizational Security'!D22","v":0},{"$f":"'C. Organizational Security'!E22","v":0},{"$f":"'C. Organizational Security'!F22","v":0},{"$f":"'C. Organizational Security'!G22","v":0},{"$f":"'C. Organizational Security'!H22","v":"15.1.2"},{"$f":"'C. Organizational Security'!I22","v":"Addressing security within supplier agreements"},null,"PO4.6","Roles and responsibilities","N/A","N/A","PO4.6, PO4.14, PO8.3, AI5.1, AI5.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'C. Organizational Security'!A23","v":2507},{"$f":"'C. Organizational Security'!J23","v":3},{"$f":"'C. Organizational Security'!K23","v":0},{"$f":"'C. Organizational Security'!Y23","v":0},{"$f":"'C. Organizational Security'!B23","v":"C.2.5.2"},{"$f":"'C. Organizational Security'!C23","v":"Permitted use of confidential information, and granting of rights to the signatory to use information?"},{"$f":"'C. Organizational Security'!D23","v":0},{"$f":"'C. Organizational Security'!E23","v":0},{"$f":"'C. Organizational Security'!F23","v":0},{"$f":"'C. Organizational Security'!G23","v":0},{"$f":"'C. Organizational Security'!H23","v":"15.1.2"},{"$f":"'C. Organizational Security'!I23","v":"Addressing security within supplier agreements"},null,"PO4.6","Roles and responsibilities","N/A","IS.2.M.17","PO4.6, PO4.14, PO8.3, AI5.1, AI5.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'C. Organizational Security'!A24","v":2509},{"$f":"'C. Organizational Security'!J24","v":3},{"$f":"'C. Organizational Security'!K24","v":0},{"$f":"'C. Organizational Security'!Y24","v":0},{"$f":"'C. Organizational Security'!B24","v":"C.2.5.3"},{"$f":"'C. Organizational Security'!C24","v":"Process for notification and reporting of unauthorized disclosure or confidential information breaches?"},{"$f":"'C. Organizational Security'!D24","v":0},{"$f":"'C. Organizational Security'!E24","v":0},{"$f":"'C. Organizational Security'!F24","v":0},{"$f":"'C. Organizational Security'!G24","v":0},{"$f":"'C. Organizational Security'!H24","v":"15.1.2"},{"$f":"'C. Organizational Security'!I24","v":"Addressing security within supplier agreements"},null,"PO4.6","Roles and responsibilities","N/A","IS.1.6.10 IS.1.6.11.2 IS.1.6.11.3","PO4.6, PO4.14, PO8.3, AI5.1, AI5.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'C. Organizational Security'!A25","v":2511},{"$f":"'C. Organizational Security'!J25","v":3},{"$f":"'C. Organizational Security'!K25","v":0},{"$f":"'C. Organizational Security'!Y25","v":0},{"$f":"'C. Organizational Security'!B25","v":"C.2.5.4"},{"$f":"'C. Organizational Security'!C25","v":"Expected actions to be taken in case of a breach of this agreement?"},{"$f":"'C. Organizational Security'!D25","v":0},{"$f":"'C. Organizational Security'!E25","v":0},{"$f":"'C. Organizational Security'!F25","v":0},{"$f":"'C. Organizational Security'!G25","v":0},{"$f":"'C. Organizational Security'!H25","v":"15.1.2"},{"$f":"'C. Organizational Security'!I25","v":"Addressing security within supplier agreements"},null,"PO4.6","Roles and responsibilities","N/A","N/A","PO4.6, PO4.14, PO8.3, AI5.1, AI5.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'C. Organizational Security'!A26","v":72},{"$f":"'C. Organizational Security'!J26","v":2},{"$f":"'C. Organizational Security'!K26","v":0},{"$f":"'C. Organizational Security'!Y26","v":0},{"$f":"'C. Organizational Security'!B26","v":"C.2.6"},{"$f":"'C. Organizational Security'!C26","v":"Are there contracts with third party service providers who have access to Scoped Systems and Data ? If yes, do they include: "},{"$f":"'C. Organizational Security'!D26","v":0},{"$f":"'C. Organizational Security'!E26","v":0},{"$f":"'C. Organizational Security'!F26","v":0},{"$f":"'C. Organizational Security'!G26","v":"C.1 Service Provider Agreements"},{"$f":"'C. Organizational Security'!H26","v":"15.1.2"},{"$f":"'C. Organizational Security'!I26","v":"Addressing security within supplier agreements"},null,"PO4.14","Contracted staff policies and procedures","12.8.2","IS.1.5.2 O.1.3.4 O.2.C.2 IS.2.J.1 D&A.1.6.1.11 WPS.1.2.2.1 WPS.1.2.2.3 E-BANK.1.3.2.6  RPS.1.1.5.6 RPS.1.3.2.2 RPS.1.8.4","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A27","v":74},{"$f":"'C. Organizational Security'!J27","v":3},{"$f":"'C. Organizational Security'!K27","v":0},{"$f":"'C. Organizational Security'!Y27","v":0},{"$f":"'C. Organizational Security'!B27","v":"C.2.6.1"},{"$f":"'C. Organizational Security'!C27","v":"Non-Disclosure Agreement?"},{"$f":"'C. Organizational Security'!D27","v":0},{"$f":"'C. Organizational Security'!E27","v":0},{"$f":"'C. Organizational Security'!F27","v":0},{"$f":"'C. Organizational Security'!G27","v":"C.1 Procedure: d.2"},{"$f":"'C. Organizational Security'!H27","v":0},{"$f":"'C. Organizational Security'!I27","v":0},null,"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, DS2.1, DS2.3, DS5.4, DS5.9, DS5.11, DS12.3"]
[{"$f":"'C. Organizational Security'!A28","v":73},{"$f":"'C. Organizational Security'!J28","v":3},{"$f":"'C. Organizational Security'!K28","v":0},{"$f":"'C. Organizational Security'!Y28","v":0},{"$f":"'C. Organizational Security'!B28","v":"C.2.6.2"},{"$f":"'C. Organizational Security'!C28","v":"Confidentiality Agreement?"},{"$f":"'C. Organizational Security'!D28","v":0},{"$f":"'C. Organizational Security'!E28","v":0},{"$f":"'C. Organizational Security'!F28","v":0},{"$f":"'C. Organizational Security'!G28","v":"C.1 Procedure: d.2"},{"$f":"'C. Organizational Security'!H28","v":0},{"$f":"'C. Organizational Security'!I28","v":0},null,"PO4.14","Contracted staff policies and procedures","N/A","RPS.2.O.4.8","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A29","v":88},{"$f":"'C. Organizational Security'!J29","v":3},{"$f":"'C. Organizational Security'!K29","v":0},{"$f":"'C. Organizational Security'!Y29","v":0},{"$f":"'C. Organizational Security'!B29","v":"C.2.6.3"},{"$f":"'C. Organizational Security'!C29","v":"Media handling?"},{"$f":"'C. Organizational Security'!D29","v":0},{"$f":"'C. Organizational Security'!E29","v":0},{"$f":"'C. Organizational Security'!F29","v":0},{"$f":"'C. Organizational Security'!G29","v":0},{"$f":"'C. Organizational Security'!H29","v":0},{"$f":"'C. Organizational Security'!I29","v":0},null,"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A30","v":100},{"$f":"'C. Organizational Security'!J30","v":3},{"$f":"'C. Organizational Security'!K30","v":0},{"$f":"'C. Organizational Security'!Y30","v":0},{"$f":"'C. Organizational Security'!B30","v":"C.2.6.4"},{"$f":"'C. Organizational Security'!C30","v":"Requirement of an awareness program to communicate security standards and expectations?"},{"$f":"'C. Organizational Security'!D30","v":0},{"$f":"'C. Organizational Security'!E30","v":0},{"$f":"'C. Organizational Security'!F30","v":0},{"$f":"'C. Organizational Security'!G30","v":0},{"$f":"'C. Organizational Security'!H30","v":"15.1.2"},{"$f":"'C. Organizational Security'!I30","v":"Addressing security within supplier agreements"},null,"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A31","v":2517},{"$f":"'C. Organizational Security'!J31","v":3},{"$f":"'C. Organizational Security'!K31","v":0},{"$f":"'C. Organizational Security'!Y31","v":0},{"$f":"'C. Organizational Security'!B31","v":"C.2.6.5"},{"$f":"'C. Organizational Security'!C31","v":"Responsibilities regarding hardware and software installation and maintenance?"},{"$f":"'C. Organizational Security'!D31","v":0},{"$f":"'C. Organizational Security'!E31","v":0},{"$f":"'C. Organizational Security'!F31","v":0},{"$f":"'C. Organizational Security'!G31","v":0},{"$f":"'C. Organizational Security'!H31","v":0},{"$f":"'C. Organizational Security'!I31","v":0},null,"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A32","v":2518},{"$f":"'C. Organizational Security'!J32","v":3},{"$f":"'C. Organizational Security'!K32","v":0},{"$f":"'C. Organizational Security'!Y32","v":0},{"$f":"'C. Organizational Security'!B32","v":"C.2.6.6"},{"$f":"'C. Organizational Security'!C32","v":"Clear reporting structure and agreed reporting formats?"},{"$f":"'C. Organizational Security'!D32","v":0},{"$f":"'C. Organizational Security'!E32","v":0},{"$f":"'C. Organizational Security'!F32","v":0},{"$f":"'C. Organizational Security'!G32","v":0},{"$f":"'C. Organizational Security'!H32","v":"15.2.1"},{"$f":"'C. Organizational Security'!I32","v":"Monitoring and review of supplier services"},null,"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A33","v":2519},{"$f":"'C. Organizational Security'!J33","v":3},{"$f":"'C. Organizational Security'!K33","v":0},{"$f":"'C. Organizational Security'!Y33","v":0},{"$f":"'C. Organizational Security'!B33","v":"C.2.6.7"},{"$f":"'C. Organizational Security'!C33","v":"Clear and specified process of change management?"},{"$f":"'C. Organizational Security'!D33","v":0},{"$f":"'C. Organizational Security'!E33","v":0},{"$f":"'C. Organizational Security'!F33","v":0},{"$f":"'C. Organizational Security'!G33","v":0},{"$f":"'C. Organizational Security'!H33","v":0},{"$f":"'C. Organizational Security'!I33","v":0},null,"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A34","v":80},{"$f":"'C. Organizational Security'!J34","v":3},{"$f":"'C. Organizational Security'!K34","v":0},{"$f":"'C. Organizational Security'!Y34","v":0},{"$f":"'C. Organizational Security'!B34","v":"C.2.6.8"},{"$f":"'C. Organizational Security'!C34","v":"Notification of change?"},{"$f":"'C. Organizational Security'!D34","v":0},{"$f":"'C. Organizational Security'!E34","v":0},{"$f":"'C. Organizational Security'!F34","v":0},{"$f":"'C. Organizational Security'!G34","v":0},{"$f":"'C. Organizational Security'!H34","v":0},{"$f":"'C. Organizational Security'!I34","v":0},null,"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A35","v":99},{"$f":"'C. Organizational Security'!J35","v":3},{"$f":"'C. Organizational Security'!K35","v":0},{"$f":"'C. Organizational Security'!Y35","v":0},{"$f":"'C. Organizational Security'!B35","v":"C.2.6.9"},{"$f":"'C. Organizational Security'!C35","v":"Process to address any identified issues?"},{"$f":"'C. Organizational Security'!D35","v":0},{"$f":"'C. Organizational Security'!E35","v":0},{"$f":"'C. Organizational Security'!F35","v":0},{"$f":"'C. Organizational Security'!G35","v":0},{"$f":"'C. Organizational Security'!H35","v":"15.1.2"},{"$f":"'C. Organizational Security'!I35","v":"Addressing security within supplier agreements"},null,"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A36","v":2520},{"$f":"'C. Organizational Security'!J36","v":3},{"$f":"'C. Organizational Security'!K36","v":0},{"$f":"'C. Organizational Security'!Y36","v":0},{"$f":"'C. Organizational Security'!B36","v":"C.2.6.10"},{"$f":"'C. Organizational Security'!C36","v":"Access control policy?"},{"$f":"'C. Organizational Security'!D36","v":0},{"$f":"'C. Organizational Security'!E36","v":0},{"$f":"'C. Organizational Security'!F36","v":0},{"$f":"'C. Organizational Security'!G36","v":0},{"$f":"'C. Organizational Security'!H36","v":"15.1.2"},{"$f":"'C. Organizational Security'!I36","v":"Addressing security within supplier agreements"},null,"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A37","v":81},{"$f":"'C. Organizational Security'!J37","v":3},{"$f":"'C. Organizational Security'!K37","v":0},{"$f":"'C. Organizational Security'!Y37","v":0},{"$f":"'C. Organizational Security'!B37","v":"C.2.6.11"},{"$f":"'C. Organizational Security'!C37","v":"Breach notification?"},{"$f":"'C. Organizational Security'!D37","v":0},{"$f":"'C. Organizational Security'!E37","v":0},{"$f":"'C. Organizational Security'!F37","v":0},{"$f":"'C. Organizational Security'!G37","v":0},{"$f":"'C. Organizational Security'!H37","v":"15.1.2"},{"$f":"'C. Organizational Security'!I37","v":"Addressing security within supplier agreements"},null,"PO4.14","Contracted staff policies and procedures","N/A","IS.2.J.5 RPS.2.N.5.2.10","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A38","v":2521},{"$f":"'C. Organizational Security'!J38","v":3},{"$f":"'C. Organizational Security'!K38","v":0},{"$f":"'C. Organizational Security'!Y38","v":0},{"$f":"'C. Organizational Security'!B38","v":"C.2.6.12"},{"$f":"'C. Organizational Security'!C38","v":"Description of the product or service to be provided?"},{"$f":"'C. Organizational Security'!D38","v":0},{"$f":"'C. Organizational Security'!E38","v":0},{"$f":"'C. Organizational Security'!F38","v":0},{"$f":"'C. Organizational Security'!G38","v":0},{"$f":"'C. Organizational Security'!H38","v":"15.1.2"},{"$f":"'C. Organizational Security'!I38","v":"Addressing security within supplier agreements"},null,"PO4.14","Contracted staff policies and procedures","N/A","E-BANK.1.3.2.1 RPS.2.O.4.1","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A39","v":2522},{"$f":"'C. Organizational Security'!J39","v":3},{"$f":"'C. Organizational Security'!K39","v":0},{"$f":"'C. Organizational Security'!Y39","v":0},{"$f":"'C. Organizational Security'!B39","v":"C.2.6.13"},{"$f":"'C. Organizational Security'!C39","v":"Description of the information to be made available along with its security classification?"},{"$f":"'C. Organizational Security'!D39","v":0},{"$f":"'C. Organizational Security'!E39","v":0},{"$f":"'C. Organizational Security'!F39","v":0},{"$f":"'C. Organizational Security'!G39","v":0},{"$f":"'C. Organizational Security'!H39","v":"15.1.2"},{"$f":"'C. Organizational Security'!I39","v":"Addressing security within supplier agreements"},null,"PO4.14","Contracted staff policies and procedures","N/A","RPS.2.N.5.2.4","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A40","v":82},{"$f":"'C. Organizational Security'!J40","v":3},{"$f":"'C. Organizational Security'!K40","v":0},{"$f":"'C. Organizational Security'!Y40","v":0},{"$f":"'C. Organizational Security'!B40","v":"C.2.6.14"},{"$f":"'C. Organizational Security'!C40","v":"SLAs?"},{"$f":"'C. Organizational Security'!D40","v":0},{"$f":"'C. Organizational Security'!E40","v":0},{"$f":"'C. Organizational Security'!F40","v":0},{"$f":"'C. Organizational Security'!G40","v":0},{"$f":"'C. Organizational Security'!H40","v":"15.1.2"},{"$f":"'C. Organizational Security'!I40","v":"Addressing security within supplier agreements"},null,"PO4.14","Contracted staff policies and procedures","N/A","O.1.3.4.1 D&A.1.6.1.11.1 AUDIT.2.F.2.7 RPS.2.O.4.2","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A41","v":76},{"$f":"'C. Organizational Security'!J41","v":3},{"$f":"'C. Organizational Security'!K41","v":0},{"$f":"'C. Organizational Security'!Y41","v":0},{"$f":"'C. Organizational Security'!B41","v":"C.2.6.15"},{"$f":"'C. Organizational Security'!C41","v":"Audit reporting?"},{"$f":"'C. Organizational Security'!D41","v":0},{"$f":"'C. Organizational Security'!E41","v":0},{"$f":"'C. Organizational Security'!F41","v":0},{"$f":"'C. Organizational Security'!G41","v":0},{"$f":"'C. Organizational Security'!H41","v":"15.1.2"},{"$f":"'C. Organizational Security'!I41","v":"Addressing security within supplier agreements"},null,"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A42","v":92},{"$f":"'C. Organizational Security'!J42","v":3},{"$f":"'C. Organizational Security'!K42","v":0},{"$f":"'C. Organizational Security'!Y42","v":0},{"$f":"'C. Organizational Security'!B42","v":"C.2.6.16"},{"$f":"'C. Organizational Security'!C42","v":"Ongoing monitoring?"},{"$f":"'C. Organizational Security'!D42","v":0},{"$f":"'C. Organizational Security'!E42","v":0},{"$f":"'C. Organizational Security'!F42","v":0},{"$f":"'C. Organizational Security'!G42","v":0},{"$f":"'C. Organizational Security'!H42","v":"15.1.3"},{"$f":"'C. Organizational Security'!I42","v":"Information and Communication technology supply chain"},null,"PO4.14","Contracted staff policies and procedures","12.8.4","IS.2.M.10.2 E-BANK.1.3.3.1","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A43","v":98},{"$f":"'C. Organizational Security'!J43","v":3},{"$f":"'C. Organizational Security'!K43","v":0},{"$f":"'C. Organizational Security'!Y43","v":0},{"$f":"'C. Organizational Security'!B43","v":"C.2.6.17"},{"$f":"'C. Organizational Security'!C43","v":"A process to regularly monitor to ensure compliance with security standards?"},{"$f":"'C. Organizational Security'!D43","v":0},{"$f":"'C. Organizational Security'!E43","v":0},{"$f":"'C. Organizational Security'!F43","v":0},{"$f":"'C. Organizational Security'!G43","v":0},{"$f":"'C. Organizational Security'!H43","v":"15.1.3"},{"$f":"'C. Organizational Security'!I43","v":"Information and Communication technology supply chain"},null,"PO4.14","Contracted staff policies and procedures","12.8.4","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A44","v":77},{"$f":"'C. Organizational Security'!J44","v":3},{"$f":"'C. Organizational Security'!K44","v":0},{"$f":"'C. Organizational Security'!Y44","v":0},{"$f":"'C. Organizational Security'!B44","v":"C.2.6.18"},{"$f":"'C. Organizational Security'!C44","v":"Onsite review?"},{"$f":"'C. Organizational Security'!D44","v":0},{"$f":"'C. Organizational Security'!E44","v":0},{"$f":"'C. Organizational Security'!F44","v":0},{"$f":"'C. Organizational Security'!G44","v":0},{"$f":"'C. Organizational Security'!H44","v":"15.1.3"},{"$f":"'C. Organizational Security'!I44","v":"Information and Communication technology supply chain"},null,"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A45","v":78},{"$f":"'C. Organizational Security'!J45","v":3},{"$f":"'C. Organizational Security'!K45","v":0},{"$f":"'C. Organizational Security'!Y45","v":0},{"$f":"'C. Organizational Security'!B45","v":"C.2.6.19"},{"$f":"'C. Organizational Security'!C45","v":"Right to audit?"},{"$f":"'C. Organizational Security'!D45","v":0},{"$f":"'C. Organizational Security'!E45","v":0},{"$f":"'C. Organizational Security'!F45","v":0},{"$f":"'C. Organizational Security'!G45","v":0},{"$f":"'C. Organizational Security'!H45","v":"15.1.2"},{"$f":"'C. Organizational Security'!I45","v":"Addressing security within supplier agreements"},null,"PO4.14","Contracted staff policies and procedures","N/A","E-BANK.1.3.2.17 RPS.2.N.5.2.18 RPS.2.O.4.6","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A46","v":79},{"$f":"'C. Organizational Security'!J46","v":3},{"$f":"'C. Organizational Security'!K46","v":0},{"$f":"'C. Organizational Security'!Y46","v":0},{"$f":"'C. Organizational Security'!B46","v":"C.2.6.20"},{"$f":"'C. Organizational Security'!C46","v":"Right to inspect?"},{"$f":"'C. Organizational Security'!D46","v":0},{"$f":"'C. Organizational Security'!E46","v":0},{"$f":"'C. Organizational Security'!F46","v":0},{"$f":"'C. Organizational Security'!G46","v":0},{"$f":"'C. Organizational Security'!H46","v":"15.1.2"},{"$f":"'C. Organizational Security'!I46","v":"Addressing security within supplier agreements"},null,"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A47","v":91},{"$f":"'C. Organizational Security'!J47","v":3},{"$f":"'C. Organizational Security'!K47","v":0},{"$f":"'C. Organizational Security'!Y47","v":0},{"$f":"'C. Organizational Security'!B47","v":"C.2.6.21"},{"$f":"'C. Organizational Security'!C47","v":"Problem reporting and escalation procedures?"},{"$f":"'C. Organizational Security'!D47","v":0},{"$f":"'C. Organizational Security'!E47","v":0},{"$f":"'C. Organizational Security'!F47","v":0},{"$f":"'C. Organizational Security'!G47","v":0},{"$f":"'C. Organizational Security'!H47","v":"15.1.2"},{"$f":"'C. Organizational Security'!I47","v":"Addressing security within supplier agreements"},null,"PO4.14","Contracted staff policies and procedures","N/A","E-BANK.1.3.2.10 RPS.2.N.5.2.11","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A48","v":96},{"$f":"'C. Organizational Security'!J48","v":3},{"$f":"'C. Organizational Security'!K48","v":0},{"$f":"'C. Organizational Security'!Y48","v":0},{"$f":"'C. Organizational Security'!B48","v":"C.2.6.22"},{"$f":"'C. Organizational Security'!C48","v":"Business resumption responsibilities?"},{"$f":"'C. Organizational Security'!D48","v":0},{"$f":"'C. Organizational Security'!E48","v":0},{"$f":"'C. Organizational Security'!F48","v":0},{"$f":"'C. Organizational Security'!G48","v":0},{"$f":"'C. Organizational Security'!H48","v":0},{"$f":"'C. Organizational Security'!I48","v":0},null,"PO4.14","Contracted staff policies and procedures","N/A","RPS.2.O.4.20","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A49","v":85},{"$f":"'C. Organizational Security'!J49","v":3},{"$f":"'C. Organizational Security'!K49","v":0},{"$f":"'C. Organizational Security'!Y49","v":0},{"$f":"'C. Organizational Security'!B49","v":"C.2.6.23"},{"$f":"'C. Organizational Security'!C49","v":"Indemnification/liability?"},{"$f":"'C. Organizational Security'!D49","v":0},{"$f":"'C. Organizational Security'!E49","v":0},{"$f":"'C. Organizational Security'!F49","v":0},{"$f":"'C. Organizational Security'!G49","v":0},{"$f":"'C. Organizational Security'!H49","v":"15.1.2"},{"$f":"'C. Organizational Security'!I49","v":"Addressing security within supplier agreements"},null,"PO4.14","Contracted staff policies and procedures","N/A","RPS.2.N.5.2.3 RPS.2.O.1.7 RPS.2.O.4.10","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A50","v":87},{"$f":"'C. Organizational Security'!J50","v":3},{"$f":"'C. Organizational Security'!K50","v":0},{"$f":"'C. Organizational Security'!Y50","v":0},{"$f":"'C. Organizational Security'!B50","v":"C.2.6.24"},{"$f":"'C. Organizational Security'!C50","v":"Privacy requirements?"},{"$f":"'C. Organizational Security'!D50","v":0},{"$f":"'C. Organizational Security'!E50","v":0},{"$f":"'C. Organizational Security'!F50","v":0},{"$f":"'C. Organizational Security'!G50","v":0},{"$f":"'C. Organizational Security'!H50","v":"15.1.2"},{"$f":"'C. Organizational Security'!I50","v":"Addressing security within supplier agreements"},null,"PO4.14","Contracted staff policies and procedures","N/A","D&A.1.6.1.11.2","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A51","v":90},{"$f":"'C. Organizational Security'!J51","v":3},{"$f":"'C. Organizational Security'!K51","v":0},{"$f":"'C. Organizational Security'!Y51","v":0},{"$f":"'C. Organizational Security'!B51","v":"C.2.6.25"},{"$f":"'C. Organizational Security'!C51","v":"Dispute resolution?"},{"$f":"'C. Organizational Security'!D51","v":0},{"$f":"'C. Organizational Security'!E51","v":0},{"$f":"'C. Organizational Security'!F51","v":0},{"$f":"'C. Organizational Security'!G51","v":0},{"$f":"'C. Organizational Security'!H51","v":"15.1.2"},{"$f":"'C. Organizational Security'!I51","v":"Addressing security within supplier agreements"},null,"PO4.14","Contracted staff policies and procedures","N/A","RPS.1.11.2.5 RPS.2.N.5.2.8 RPS.2.O.4.12","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A52","v":94},{"$f":"'C. Organizational Security'!J52","v":3},{"$f":"'C. Organizational Security'!K52","v":0},{"$f":"'C. Organizational Security'!Y52","v":0},{"$f":"'C. Organizational Security'!B52","v":"C.2.6.26"},{"$f":"'C. Organizational Security'!C52","v":"Choice of venue?"},{"$f":"'C. Organizational Security'!D52","v":0},{"$f":"'C. Organizational Security'!E52","v":0},{"$f":"'C. Organizational Security'!F52","v":0},{"$f":"'C. Organizational Security'!G52","v":0},{"$f":"'C. Organizational Security'!H52","v":0},{"$f":"'C. Organizational Security'!I52","v":0},null,"PO4.14","Contracted staff policies and procedures","N/A","RPS.2.O.4.18","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A53","v":83},{"$f":"'C. Organizational Security'!J53","v":3},{"$f":"'C. Organizational Security'!K53","v":0},{"$f":"'C. Organizational Security'!Y53","v":0},{"$f":"'C. Organizational Security'!B53","v":"C.2.6.27"},{"$f":"'C. Organizational Security'!C53","v":"Data ownership?"},{"$f":"'C. Organizational Security'!D53","v":0},{"$f":"'C. Organizational Security'!E53","v":0},{"$f":"'C. Organizational Security'!F53","v":0},{"$f":"'C. Organizational Security'!G53","v":0},{"$f":"'C. Organizational Security'!H53","v":"15.1.2"},{"$f":"'C. Organizational Security'!I53","v":"Addressing security within supplier agreements"},null,"PO4.14","Contracted staff policies and procedures","N/A","E-BANK.1.3.2.15 RPS.2.O.4.7","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A54","v":95},{"$f":"'C. Organizational Security'!J54","v":3},{"$f":"'C. Organizational Security'!K54","v":0},{"$f":"'C. Organizational Security'!Y54","v":0},{"$f":"'C. Organizational Security'!B54","v":"C.2.6.28"},{"$f":"'C. Organizational Security'!C54","v":"Ownership of intellectual property?"},{"$f":"'C. Organizational Security'!D54","v":0},{"$f":"'C. Organizational Security'!E54","v":0},{"$f":"'C. Organizational Security'!F54","v":0},{"$f":"'C. Organizational Security'!G54","v":0},{"$f":"'C. Organizational Security'!H54","v":"15.1.2"},{"$f":"'C. Organizational Security'!I54","v":"Addressing security within supplier agreements"},null,"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A55","v":2523},{"$f":"'C. Organizational Security'!J55","v":3},{"$f":"'C. Organizational Security'!K55","v":0},{"$f":"'C. Organizational Security'!Y55","v":0},{"$f":"'C. Organizational Security'!B55","v":"C.2.6.29"},{"$f":"'C. Organizational Security'!C55","v":"Involvement of the third party with subcontractors?"},{"$f":"'C. Organizational Security'!D55","v":0},{"$f":"'C. Organizational Security'!E55","v":0},{"$f":"'C. Organizational Security'!F55","v":0},{"$f":"'C. Organizational Security'!G55","v":0},{"$f":"'C. Organizational Security'!H55","v":"15.1.2"},{"$f":"'C. Organizational Security'!I55","v":"Addressing security within supplier agreements"},null,"PO4.14","Contracted staff policies and procedures","N/A","E-BANK.1.3.2.13 RPS.2.O.4.14","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A56","v":2524},{"$f":"'C. Organizational Security'!J56","v":3},{"$f":"'C. Organizational Security'!K56","v":0},{"$f":"'C. Organizational Security'!Y56","v":0},{"$f":"'C. Organizational Security'!B56","v":"C.2.6.30"},{"$f":"'C. Organizational Security'!C56","v":"Security controls these subcontractors need to implement?"},{"$f":"'C. Organizational Security'!D56","v":0},{"$f":"'C. Organizational Security'!E56","v":0},{"$f":"'C. Organizational Security'!F56","v":0},{"$f":"'C. Organizational Security'!G56","v":0},{"$f":"'C. Organizational Security'!H56","v":"15.1.2"},{"$f":"'C. Organizational Security'!I56","v":"Addressing security within supplier agreements"},null,"PO4.14","Contracted staff policies and procedures","N/A","RPS.2.O.4.4 RPS.2.O.4.15","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A57","v":86},{"$f":"'C. Organizational Security'!J57","v":3},{"$f":"'C. Organizational Security'!K57","v":0},{"$f":"'C. Organizational Security'!Y57","v":0},{"$f":"'C. Organizational Security'!B57","v":"C.2.6.31"},{"$f":"'C. Organizational Security'!C57","v":"Termination/exit clause?"},{"$f":"'C. Organizational Security'!D57","v":0},{"$f":"'C. Organizational Security'!E57","v":0},{"$f":"'C. Organizational Security'!F57","v":0},{"$f":"'C. Organizational Security'!G57","v":0},{"$f":"'C. Organizational Security'!H57","v":0},{"$f":"'C. Organizational Security'!I57","v":0},null,"PO4.14","Contracted staff policies and procedures","N/A","RPS.2.N.5.2.18","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A58","v":2525},{"$f":"'C. Organizational Security'!J58","v":3},{"$f":"'C. Organizational Security'!K58","v":0},{"$f":"'C. Organizational Security'!Y58","v":0},{"$f":"'C. Organizational Security'!B58","v":"C.2.6.32"},{"$f":"'C. Organizational Security'!C58","v":"Contingency plan in case either party wishes to terminate the relationship before the end of the agreements?"},{"$f":"'C. Organizational Security'!D58","v":0},{"$f":"'C. Organizational Security'!E58","v":0},{"$f":"'C. Organizational Security'!F58","v":0},{"$f":"'C. Organizational Security'!G58","v":0},{"$f":"'C. Organizational Security'!H58","v":0},{"$f":"'C. Organizational Security'!I58","v":0},null,"PO4.14","Contracted staff policies and procedures","N/A","E-BANK.1.3.2.11","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A59","v":2526},{"$f":"'C. Organizational Security'!J59","v":3},{"$f":"'C. Organizational Security'!K59","v":0},{"$f":"'C. Organizational Security'!Y59","v":0},{"$f":"'C. Organizational Security'!B59","v":"C.2.6.33"},{"$f":"'C. Organizational Security'!C59","v":"Renegotiation of agreements if the security requirements of the respondent change?"},{"$f":"'C. Organizational Security'!D59","v":0},{"$f":"'C. Organizational Security'!E59","v":0},{"$f":"'C. Organizational Security'!F59","v":0},{"$f":"'C. Organizational Security'!G59","v":0},{"$f":"'C. Organizational Security'!H59","v":0},{"$f":"'C. Organizational Security'!I59","v":0},null,"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A60","v":2527},{"$f":"'C. Organizational Security'!J60","v":3},{"$f":"'C. Organizational Security'!K60","v":0},{"$f":"'C. Organizational Security'!Y60","v":0},{"$f":"'C. Organizational Security'!B60","v":"C.2.6.34"},{"$f":"'C. Organizational Security'!C60","v":"Current documentation of asset lists, licenses, agreements or rights relating to them?"},{"$f":"'C. Organizational Security'!D60","v":0},{"$f":"'C. Organizational Security'!E60","v":0},{"$f":"'C. Organizational Security'!F60","v":0},{"$f":"'C. Organizational Security'!G60","v":0},{"$f":"'C. Organizational Security'!H60","v":"15.2.2"},{"$f":"'C. Organizational Security'!I60","v":"Managing changes to supplier services"},null,"PO4.14","Contracted staff policies and procedures","N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'C. Organizational Security'!A61","v":0},{"$f":"'C. Organizational Security'!J61","v":0},{"$f":"'C. Organizational Security'!K61","v":0},{"$f":"'C. Organizational Security'!Y61","v":0},{"$f":"'C. Organizational Security'!B61","v":0},{"$f":"'C. Organizational Security'!C61","v":0},{"$f":"'C. Organizational Security'!D61","v":0},{"$f":"'C. Organizational Security'!E61","v":0},{"$f":"'C. Organizational Security'!F61","v":0},{"$f":"'C. Organizational Security'!G61","v":0},{"$f":"'C. Organizational Security'!H61","v":0},{"$f":"'C. Organizational Security'!I61","v":0}]
[]
[{"$f":"'D. Asset Management'!B1","v":"D. Asset Management"},null,null,null,{"$f":"'D. Asset Management'!B1","v":"D. Asset Management"}]
[{"$f":"'D. Asset Management'!A5","v":3200},{"$f":"'D. Asset Management'!J5","v":1},{"$f":"'D. Asset Management'!K5","v":0},{"$f":"'D. Asset Management'!Y5","v":1},{"$f":"'D. Asset Management'!B5","v":"D.1"},{"$f":"'D. Asset Management'!C5","v":"Is there an asset management program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"'D. Asset Management'!D5","v":0},{"$f":"'D. Asset Management'!E5","v":0},{"$f":"'D. Asset Management'!F5","v":0},{"$f":"'D. Asset Management'!G5","v":"D. Assessment Management"},{"$f":"'D. Asset Management'!H5","v":8.1},{"$f":"'D. Asset Management'!I5","v":"Responsibility for Assets"},null,null,null,"N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'D. Asset Management'!A6","v":106},{"$f":"'D. Asset Management'!J6","v":2},{"$f":"'D. Asset Management'!K6","v":0},{"$f":"'D. Asset Management'!Y6","v":0},{"$f":"'D. Asset Management'!B6","v":"D.1.1"},{"$f":"'D. Asset Management'!C6","v":"Is there an inventory system for hardware and software assets? If yes, does it include:"},{"$f":"'D. Asset Management'!D6","v":0},{"$f":"'D. Asset Management'!E6","v":0},{"$f":"'D. Asset Management'!F6","v":0},{"$f":"'D. Asset Management'!G6","v":"D.1 Asset Accounting and Inventory"},{"$f":"'D. Asset Management'!H6","v":"8.1.1"},{"$f":"'D. Asset Management'!I6","v":"Inventory of Assets"},null,"PO2.1","Enterprise information architecture model",2.4,"D&A.1.11.1.1 OPS.1.4.1 OPS.2.12.A RPS.1.2.2.5","PO2.2, DS9.2, DS9.3"]
[{"$f":"'D. Asset Management'!A7","v":108},{"$f":"'D. Asset Management'!J7","v":3},{"$f":"'D. Asset Management'!K7","v":0},{"$f":"'D. Asset Management'!Y7","v":0},{"$f":"'D. Asset Management'!B7","v":"D.1.1.1"},{"$f":"'D. Asset Management'!C7","v":"Asset control tag?"},{"$f":"'D. Asset Management'!D7","v":0},{"$f":"'D. Asset Management'!E7","v":0},{"$f":"'D. Asset Management'!F7","v":0},{"$f":"'D. Asset Management'!G7","v":"D.1 Procedure: c"},{"$f":"'D. Asset Management'!H7","v":"N/A"},{"$f":"'D. Asset Management'!I7","v":""},null,null,null,"N/A","OPS.2.12.E.11","N/A"]
[{"$f":"'D. Asset Management'!A8","v":113},{"$f":"'D. Asset Management'!J8","v":3},{"$f":"'D. Asset Management'!K8","v":0},{"$f":"'D. Asset Management'!Y8","v":0},{"$f":"'D. Asset Management'!B8","v":"D.1.1.2"},{"$f":"'D. Asset Management'!C8","v":"Operating system?"},{"$f":"'D. Asset Management'!D8","v":0},{"$f":"'D. Asset Management'!E8","v":0},{"$f":"'D. Asset Management'!F8","v":0},{"$f":"'D. Asset Management'!G8","v":"D.1 Procedure: c"},{"$f":"'D. Asset Management'!H8","v":"N/A"},{"$f":"'D. Asset Management'!I8","v":""},null,null,null,"N/A","OPS.2.12.A.1.2","N/A"]
[{"$f":"'D. Asset Management'!A9","v":114},{"$f":"'D. Asset Management'!J9","v":3},{"$f":"'D. Asset Management'!K9","v":0},{"$f":"'D. Asset Management'!Y9","v":0},{"$f":"'D. Asset Management'!B9","v":"D.1.1.3"},{"$f":"'D. Asset Management'!C9","v":"Physical location?"},{"$f":"'D. Asset Management'!D9","v":0},{"$f":"'D. Asset Management'!E9","v":0},{"$f":"'D. Asset Management'!F9","v":0},{"$f":"'D. Asset Management'!G9","v":"D.1 Procedure: c"},{"$f":"'D. Asset Management'!H9","v":"N/A"},{"$f":"'D. Asset Management'!I9","v":""},null,null,null,"N/A","OPS.2.12.A.1.7","N/A"]
[{"$f":"'D. Asset Management'!A10","v":115},{"$f":"'D. Asset Management'!J10","v":3},{"$f":"'D. Asset Management'!K10","v":0},{"$f":"'D. Asset Management'!Y10","v":0},{"$f":"'D. Asset Management'!B10","v":"D.1.1.4"},{"$f":"'D. Asset Management'!C10","v":"Serial number?"},{"$f":"'D. Asset Management'!D10","v":0},{"$f":"'D. Asset Management'!E10","v":0},{"$f":"'D. Asset Management'!F10","v":0},{"$f":"'D. Asset Management'!G10","v":0},{"$f":"'D. Asset Management'!H10","v":"N/A"},{"$f":"'D. Asset Management'!I10","v":""},null,null,null,"N/A","OPS.2.12.A.3.3","N/A"]
[{"$f":"'D. Asset Management'!A11","v":109},{"$f":"'D. Asset Management'!J11","v":3},{"$f":"'D. Asset Management'!K11","v":0},{"$f":"'D. Asset Management'!Y11","v":0},{"$f":"'D. Asset Management'!B11","v":"D.1.1.5"},{"$f":"'D. Asset Management'!C11","v":"Business function supported?"},{"$f":"'D. Asset Management'!D11","v":0},{"$f":"'D. Asset Management'!E11","v":0},{"$f":"'D. Asset Management'!F11","v":0},{"$f":"'D. Asset Management'!G11","v":0},{"$f":"'D. Asset Management'!H11","v":"N/A"},{"$f":"'D. Asset Management'!I11","v":""},null,null,null,"N/A","OPS.2.12.A.1.6","N/A"]
[{"$f":"'D. Asset Management'!A12","v":110},{"$f":"'D. Asset Management'!J12","v":3},{"$f":"'D. Asset Management'!K12","v":0},{"$f":"'D. Asset Management'!Y12","v":0},{"$f":"'D. Asset Management'!B12","v":"D.1.1.6"},{"$f":"'D. Asset Management'!C12","v":"Environment (dev, test, etc.)?"},{"$f":"'D. Asset Management'!D12","v":0},{"$f":"'D. Asset Management'!E12","v":0},{"$f":"'D. Asset Management'!F12","v":0},{"$f":"'D. Asset Management'!G12","v":"D.1 Procedure: c"},{"$f":"'D. Asset Management'!H12","v":"N/A"},{"$f":"'D. Asset Management'!I12","v":""},null,null,null,"N/A","OPS.2.12.A.1.8","N/A"]
[{"$f":"'D. Asset Management'!A13","v":112},{"$f":"'D. Asset Management'!J13","v":3},{"$f":"'D. Asset Management'!K13","v":0},{"$f":"'D. Asset Management'!Y13","v":0},{"$f":"'D. Asset Management'!B13","v":"D.1.1.7"},{"$f":"'D. Asset Management'!C13","v":"IP address?"},{"$f":"'D. Asset Management'!D13","v":0},{"$f":"'D. Asset Management'!E13","v":0},{"$f":"'D. Asset Management'!F13","v":0},{"$f":"'D. Asset Management'!G13","v":0},{"$f":"'D. Asset Management'!H13","v":"N/A"},{"$f":"'D. Asset Management'!I13","v":""},null,null,null,"N/A","OPS.2.12.A.1.7 OPS.2.12.A.2.2","N/A"]
[{"$f":"'D. Asset Management'!A14","v":119},{"$f":"'D. Asset Management'!J14","v":2},{"$f":"'D. Asset Management'!K14","v":0},{"$f":"'D. Asset Management'!Y14","v":0},{"$f":"'D. Asset Management'!B14","v":"D.1.2"},{"$f":"'D. Asset Management'!C14","v":"Is there a detailed description of software licenses (number of seats, concurrent users, etc.) ?"},{"$f":"'D. Asset Management'!D14","v":0},{"$f":"'D. Asset Management'!E14","v":0},{"$f":"'D. Asset Management'!F14","v":0},{"$f":"'D. Asset Management'!G14","v":"D.1 Asset Accounting and Inventory"},{"$f":"'D. Asset Management'!H14","v":"N/A"},{"$f":"'D. Asset Management'!I14","v":""},null,null,null,"N/A","D&A.1.6.1.10.6 OPS.2.12.A.3.6","N/A"]
[{"$f":"'D. Asset Management'!A15","v":120},{"$f":"'D. Asset Management'!J15","v":2},{"$f":"'D. Asset Management'!K15","v":0},{"$f":"'D. Asset Management'!Y15","v":0},{"$f":"'D. Asset Management'!B15","v":"D.1.3"},{"$f":"'D. Asset Management'!C15","v":"Is ownership assigned for information and assets? If yes, is the owner responsible to:"},{"$f":"'D. Asset Management'!D15","v":0},{"$f":"'D. Asset Management'!E15","v":0},{"$f":"'D. Asset Management'!F15","v":0},{"$f":"'D. Asset Management'!G15","v":0},{"$f":"'D. Asset Management'!H15","v":"8.1.2"},{"$f":"'D. Asset Management'!I15","v":"Ownership of Assets"},null,"PO4.9","Data and system ownership","N/A","N/A","PO4.9, DS9.2"]
[{"$f":"'D. Asset Management'!A16","v":2530},{"$f":"'D. Asset Management'!J16","v":3},{"$f":"'D. Asset Management'!K16","v":0},{"$f":"'D. Asset Management'!Y16","v":0},{"$f":"'D. Asset Management'!B16","v":"D.1.3.1"},{"$f":"'D. Asset Management'!C16","v":"Appropriately classify information and assets?"},{"$f":"'D. Asset Management'!D16","v":0},{"$f":"'D. Asset Management'!E16","v":0},{"$f":"'D. Asset Management'!F16","v":0},{"$f":"'D. Asset Management'!G16","v":0},{"$f":"'D. Asset Management'!H16","v":"8.2.1"},{"$f":"'D. Asset Management'!I16","v":"Classification of Information"},null,"PO4.9","Data and system ownership","2.4, 9.6.1","N/A","PO4.9, DS9.2"]
[{"$f":"'D. Asset Management'!A17","v":121},{"$f":"'D. Asset Management'!J17","v":3},{"$f":"'D. Asset Management'!K17","v":0},{"$f":"'D. Asset Management'!Y17","v":0},{"$f":"'D. Asset Management'!B17","v":"D.1.3.2"},{"$f":"'D. Asset Management'!C17","v":"Review and approve access to those information and assets?"},{"$f":"'D. Asset Management'!D17","v":0},{"$f":"'D. Asset Management'!E17","v":0},{"$f":"'D. Asset Management'!F17","v":0},{"$f":"'D. Asset Management'!G17","v":0},{"$f":"'D. Asset Management'!H17","v":"8.1.2"},{"$f":"'D. Asset Management'!I17","v":"Ownership of Assets"},null,"PO4.9","Data and system ownership",7,"N/A","PO4.9, DS9.2"]
[{"$f":"'D. Asset Management'!A18","v":2531},{"$f":"'D. Asset Management'!J18","v":3},{"$f":"'D. Asset Management'!K18","v":0},{"$f":"'D. Asset Management'!Y18","v":0},{"$f":"'D. Asset Management'!B18","v":"D.1.3.3"},{"$f":"'D. Asset Management'!C18","v":"Establish, document and implement rules for the acceptable use of information and assets?"},{"$f":"'D. Asset Management'!D18","v":0},{"$f":"'D. Asset Management'!E18","v":0},{"$f":"'D. Asset Management'!F18","v":0},{"$f":"'D. Asset Management'!G18","v":0},{"$f":"'D. Asset Management'!H18","v":"8.1.3"},{"$f":"'D. Asset Management'!I18","v":"Acceptable Use of Assets"},null,"PO4.10","Supervision","7.2.2","N/A","PO4.10, PO6.2"]
[{"$f":"'D. Asset Management'!A19","v":2532},{"$f":"'D. Asset Management'!J19","v":1},{"$f":"'D. Asset Management'!K19","v":0},{"$f":"'D. Asset Management'!Y19","v":1},{"$f":"'D. Asset Management'!B19","v":"D.2"},{"$f":"'D. Asset Management'!C19","v":"Are information and assets classified?"},{"$f":"'D. Asset Management'!D19","v":0},{"$f":"'D. Asset Management'!E19","v":0},{"$f":"'D. Asset Management'!F19","v":0},{"$f":"'D. Asset Management'!G19","v":"D.1 Procedure: e.1"},{"$f":"'D. Asset Management'!H19","v":"8.2.1"},{"$f":"'D. Asset Management'!I19","v":"Classification of Information"},null,"PO2.3","Data classification scheme","9.6.1","N/A","PO2, AI2, DS9"]
[{"$f":"'D. Asset Management'!A20","v":3201},{"$f":"'D. Asset Management'!J20","v":2},{"$f":"'D. Asset Management'!K20","v":0},{"$f":"'D. Asset Management'!Y20","v":0},{"$f":"'D. Asset Management'!B20","v":"D.2.1"},{"$f":"'D. Asset Management'!C20","v":"Is there an information asset classification policy or program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"'D. Asset Management'!D20","v":0},{"$f":"'D. Asset Management'!E20","v":0},{"$f":"'D. Asset Management'!F20","v":0},{"$f":"'D. Asset Management'!G20","v":"D.1 Procedure: e.1"},{"$f":"'D. Asset Management'!H20","v":"8.2.1"},{"$f":"'D. Asset Management'!I20","v":"Classification of Information"},null,"PO2.3","Data classification scheme","N/A","N/A","PO2, AI2, DS9"]
[{"$f":"'D. Asset Management'!A21","v":2533},{"$f":"'D. Asset Management'!J21","v":2},{"$f":"'D. Asset Management'!K21","v":0},{"$f":"'D. Asset Management'!Y21","v":0},{"$f":"'D. Asset Management'!B21","v":"D.2.2"},{"$f":"'D. Asset Management'!C21","v":"Is there a procedure for handling of information and assets? If yes, does it include:"},{"$f":"'D. Asset Management'!D21","v":0},{"$f":"'D. Asset Management'!E21","v":0},{"$f":"'D. Asset Management'!F21","v":0},{"$f":"'D. Asset Management'!G21","v":"G.15 Physical Media Tracking"},{"$f":"'D. Asset Management'!H21","v":"8.2.3"},{"$f":"'D. Asset Management'!I21","v":"Handling of Assets"},null,"DS9.1","Configuration repository and baseline","N/A","IS.2.L.1.1","PO2, AI2, DS9"]
[{"$f":"'D. Asset Management'!A22","v":136},{"$f":"'D. Asset Management'!J22","v":3},{"$f":"'D. Asset Management'!K22","v":0},{"$f":"'D. Asset Management'!Y22","v":0},{"$f":"'D. Asset Management'!B22","v":"D.2.2.1"},{"$f":"'D. Asset Management'!C22","v":"Data ownership?"},{"$f":"'D. Asset Management'!D22","v":0},{"$f":"'D. Asset Management'!E22","v":0},{"$f":"'D. Asset Management'!F22","v":0},{"$f":"'D. Asset Management'!G22","v":0},{"$f":"'D. Asset Management'!H22","v":"8.1.2"},{"$f":"'D. Asset Management'!I22","v":"Ownership of Assets"},null,"PO4.9","Data and system ownership","N/A","N/A","PO4.9, DS9.2"]
[{"$f":"'D. Asset Management'!A23","v":128},{"$f":"'D. Asset Management'!J23","v":3},{"$f":"'D. Asset Management'!K23","v":0},{"$f":"'D. Asset Management'!Y23","v":0},{"$f":"'D. Asset Management'!B23","v":"D.2.2.2"},{"$f":"'D. Asset Management'!C23","v":"Data access controls including authorization?"},{"$f":"'D. Asset Management'!D23","v":0},{"$f":"'D. Asset Management'!E23","v":0},{"$f":"'D. Asset Management'!F23","v":0},{"$f":"'D. Asset Management'!G23","v":0},{"$f":"'D. Asset Management'!H23","v":"8.2.3"},{"$f":"'D. Asset Management'!I23","v":"Handling of Assets"},null,null,null,null,"N/A","PO4.9, DS9.2"]
[{"$f":"'D. Asset Management'!A24","v":134},{"$f":"'D. Asset Management'!J24","v":3},{"$f":"'D. Asset Management'!K24","v":0},{"$f":"'D. Asset Management'!Y24","v":0},{"$f":"'D. Asset Management'!B24","v":"D.2.2.3"},{"$f":"'D. Asset Management'!C24","v":"Data labeling?"},{"$f":"'D. Asset Management'!D24","v":0},{"$f":"'D. Asset Management'!E24","v":0},{"$f":"'D. Asset Management'!F24","v":0},{"$f":"'D. Asset Management'!G24","v":0},{"$f":"'D. Asset Management'!H24","v":"8.2.2"},{"$f":"'D. Asset Management'!I24","v":"Labeling of information"},null,"DS9.1","Configuration repository and baseline","N/A","N/A","PO6.2, DS11.6"]
[{"$f":"'D. Asset Management'!A25","v":135},{"$f":"'D. Asset Management'!J25","v":3},{"$f":"'D. Asset Management'!K25","v":0},{"$f":"'D. Asset Management'!Y25","v":0},{"$f":"'D. Asset Management'!B25","v":"D.2.2.4"},{"$f":"'D. Asset Management'!C25","v":"Data on removable media?"},{"$f":"'D. Asset Management'!D25","v":0},{"$f":"'D. Asset Management'!E25","v":0},{"$f":"'D. Asset Management'!F25","v":0},{"$f":"'D. Asset Management'!G25","v":0},{"$f":"'D. Asset Management'!H25","v":"8.3.1"},{"$f":"'D. Asset Management'!I25","v":"Management of Removable Media"},null,null,null,null,"N/A","PO2.3, DS11.2, DS11.3, DS11.4"]
[{"$f":"'D. Asset Management'!A26","v":133},{"$f":"'D. Asset Management'!J26","v":3},{"$f":"'D. Asset Management'!K26","v":0},{"$f":"'D. Asset Management'!Y26","v":0},{"$f":"'D. Asset Management'!B26","v":"D.2.2.5"},{"$f":"'D. Asset Management'!C26","v":"Data in transit?"},{"$f":"'D. Asset Management'!D26","v":0},{"$f":"'D. Asset Management'!E26","v":0},{"$f":"'D. Asset Management'!F26","v":0},{"$f":"'D. Asset Management'!G26","v":"G.16 Security of Media in Transit"},{"$f":"'D. Asset Management'!H26","v":"8.3.3"},{"$f":"'D. Asset Management'!I26","v":"Physical media transfer"},null,"DS9.1","Configuration repository and baseline","9.6.2","N/A","PO2, AI2, DS9"]
[{"$f":"'D. Asset Management'!A27","v":131},{"$f":"'D. Asset Management'!J27","v":3},{"$f":"'D. Asset Management'!K27","v":0},{"$f":"'D. Asset Management'!Y27","v":0},{"$f":"'D. Asset Management'!B27","v":"D.2.2.6"},{"$f":"'D. Asset Management'!C27","v":"Data encryption?"},{"$f":"'D. Asset Management'!D27","v":0},{"$f":"'D. Asset Management'!E27","v":0},{"$f":"'D. Asset Management'!F27","v":0},{"$f":"'D. Asset Management'!G27","v":"G.22 Data Security Policy - Encryption"},{"$f":"'D. Asset Management'!H27","v":"10.1.1"},{"$f":"'D. Asset Management'!I27","v":"Policy on the use of cryptographic controls"},null,"PO6.2","Enterprise IT risk and internal control framework",4,"IS.2.K.1","PO6, AI2, DS5"]
[{"$f":"'D. Asset Management'!A28","v":132},{"$f":"'D. Asset Management'!J28","v":3},{"$f":"'D. Asset Management'!K28","v":0},{"$f":"'D. Asset Management'!Y28","v":0},{"$f":"'D. Asset Management'!B28","v":"D.2.2.7"},{"$f":"'D. Asset Management'!C28","v":"Data in storage?"},{"$f":"'D. Asset Management'!D28","v":0},{"$f":"'D. Asset Management'!E28","v":0},{"$f":"'D. Asset Management'!F28","v":0},{"$f":"'D. Asset Management'!G28","v":0},{"$f":"'D. Asset Management'!H28","v":"11.2.6"},{"$f":"'D. Asset Management'!I28","v":"Security of equipment and assets off-premise"},null,"PO6.2","Enterprise IT risk and internal control framework","9.5.1","IS.2.M.10.5","PO6.2, DS11.6"]
[{"$f":"'D. Asset Management'!A29","v":137},{"$f":"'D. Asset Management'!J29","v":3},{"$f":"'D. Asset Management'!K29","v":0},{"$f":"'D. Asset Management'!Y29","v":0},{"$f":"'D. Asset Management'!B29","v":"D.2.2.8"},{"$f":"'D. Asset Management'!C29","v":"Data reclassification?"},{"$f":"'D. Asset Management'!D29","v":0},{"$f":"'D. Asset Management'!E29","v":0},{"$f":"'D. Asset Management'!F29","v":0},{"$f":"'D. Asset Management'!G29","v":0},{"$f":"'D. Asset Management'!H29","v":"8.1.2"},{"$f":"'D. Asset Management'!I29","v":"Ownership of Assets"},null,"PO4.9","Data and system ownership","N/A","N/A","PO4.9, DS9.2"]
[{"$f":"'D. Asset Management'!A30","v":138},{"$f":"'D. Asset Management'!J30","v":3},{"$f":"'D. Asset Management'!K30","v":0},{"$f":"'D. Asset Management'!Y30","v":0},{"$f":"'D. Asset Management'!B30","v":"D.2.2.9"},{"$f":"'D. Asset Management'!C30","v":"Data retention?"},{"$f":"'D. Asset Management'!D30","v":0},{"$f":"'D. Asset Management'!E30","v":0},{"$f":"'D. Asset Management'!F30","v":0},{"$f":"'D. Asset Management'!G30","v":0},{"$f":"'D. Asset Management'!H30","v":0},{"$f":"'D. Asset Management'!I30","v":""},null,null,null,"3.1.a","N/A","N/A"]
[{"$f":"'D. Asset Management'!A31","v":129},{"$f":"'D. Asset Management'!J31","v":3},{"$f":"'D. Asset Management'!K31","v":0},{"$f":"'D. Asset Management'!Y31","v":0},{"$f":"'D. Asset Management'!B31","v":"D.2.2.10"},{"$f":"'D. Asset Management'!C31","v":"Data destruction?"},{"$f":"'D. Asset Management'!D31","v":0},{"$f":"'D. Asset Management'!E31","v":0},{"$f":"'D. Asset Management'!F31","v":0},{"$f":"'D. Asset Management'!G31","v":"D.2 Asset Destruction"},{"$f":"'D. Asset Management'!H31","v":"8.1.2"},{"$f":"'D. Asset Management'!I31","v":"Ownership of Assets"},null,"DS9.1","Configuration repository and baseline","3.1.a","N/A","DS11.3, DS11.4"]
[{"$f":"'D. Asset Management'!A32","v":130},{"$f":"'D. Asset Management'!J32","v":3},{"$f":"'D. Asset Management'!K32","v":0},{"$f":"'D. Asset Management'!Y32","v":0},{"$f":"'D. Asset Management'!B32","v":"D.2.2.11"},{"$f":"'D. Asset Management'!C32","v":"Data disposal?"},{"$f":"'D. Asset Management'!D32","v":0},{"$f":"'D. Asset Management'!E32","v":0},{"$f":"'D. Asset Management'!F32","v":0},{"$f":"'D. Asset Management'!G32","v":"D.2 Asset Destruction"},{"$f":"'D. Asset Management'!H32","v":"8.3.2"},{"$f":"'D. Asset Management'!I32","v":"Disposal of Media"},null,"DS11.3","Media library management system","3.1.a","N/A","DS11.3, DS11.4"]
[{"$f":"'D. Asset Management'!A33","v":2534},{"$f":"'D. Asset Management'!J33","v":3},{"$f":"'D. Asset Management'!K33","v":0},{"$f":"'D. Asset Management'!Y33","v":0},{"$f":"'D. Asset Management'!B33","v":"D.2.2.12"},{"$f":"'D. Asset Management'!C33","v":"Reviewed at least annually?"},{"$f":"'D. Asset Management'!D33","v":0},{"$f":"'D. Asset Management'!E33","v":0},{"$f":"'D. Asset Management'!F33","v":0},{"$f":"'D. Asset Management'!G33","v":0},{"$f":"'D. Asset Management'!H33","v":"8.1.2"},{"$f":"'D. Asset Management'!I33","v":"Ownership of Assets"},null,"PO2.3","Data classification scheme","12.1.1","IS.2.L.1.4","PO2, AI2, DS9"]
[{"$f":"'D. Asset Management'!A34","v":2535},{"$f":"'D. Asset Management'!J34","v":3},{"$f":"'D. Asset Management'!K34","v":0},{"$f":"'D. Asset Management'!Y34","v":0},{"$f":"'D. Asset Management'!B34","v":"D.2.2.13"},{"$f":"'D. Asset Management'!C34","v":"Data handling based on classification?"},{"$f":"'D. Asset Management'!D34","v":0},{"$f":"'D. Asset Management'!E34","v":0},{"$f":"'D. Asset Management'!F34","v":0},{"$f":"'D. Asset Management'!G34","v":"G.15 Physical Media Tracking"},{"$f":"'D. Asset Management'!H34","v":"8.2.3"},{"$f":"'D. Asset Management'!I34","v":"Handling of Assets"},null,"DS9.1","Configuration repository and baseline","N/A","N/A","PO2, AI2, DS9"]
[{"$f":"'D. Asset Management'!A35","v":139},{"$f":"'D. Asset Management'!J35","v":3},{"$f":"'D. Asset Management'!K35","v":0},{"$f":"'D. Asset Management'!Y35","v":0},{"$f":"'D. Asset Management'!B35","v":"D.2.2.14"},{"$f":"'D. Asset Management'!C35","v":"Physical media destruction?"},{"$f":"'D. Asset Management'!D35","v":0},{"$f":"'D. Asset Management'!E35","v":0},{"$f":"'D. Asset Management'!F35","v":0},{"$f":"'D. Asset Management'!G35","v":"D.2 Asset Destruction"},{"$f":"'D. Asset Management'!H35","v":"8.3.2"},{"$f":"'D. Asset Management'!I35","v":"Disposal of Media"},null,"DS11.3","Media library management system",9.8000000000000007,"IS.1.4.1.10 IS.2.C.14 IS.2.D.5 IS.2.E.2 IS.2.L.2.1 IS.2.L.2.1","DS11.3, DS11.4"]
[{"$f":"'D. Asset Management'!A36","v":140},{"$f":"'D. Asset Management'!J36","v":3},{"$f":"'D. Asset Management'!K36","v":0},{"$f":"'D. Asset Management'!Y36","v":0},{"$f":"'D. Asset Management'!B36","v":"D.2.2.15"},{"$f":"'D. Asset Management'!C36","v":"Reuse of physical media (tapes, disk drives, etc.)?"},{"$f":"'D. Asset Management'!D36","v":0},{"$f":"'D. Asset Management'!E36","v":0},{"$f":"'D. Asset Management'!F36","v":0},{"$f":"'D. Asset Management'!G36","v":0},{"$f":"'D. Asset Management'!H36","v":"11.2.7"},{"$f":"'D. Asset Management'!I36","v":"Secure Disposal or Re-Use of Equipment"},null,"DS11.4","Disposal","9.8.2","IS.2.E.2 IS.2.L.2.1 IS.2.L.2.1","DS11.4"]
[{"$f":"'D. Asset Management'!A37","v":0},{"$f":"'D. Asset Management'!J37","v":0},{"$f":"'D. Asset Management'!K37","v":0},{"$f":"'D. Asset Management'!Y37","v":0},{"$f":"'D. Asset Management'!B37","v":0},{"$f":"'D. Asset Management'!C37","v":0},{"$f":"'D. Asset Management'!D37","v":0},{"$f":"'D. Asset Management'!E37","v":0},{"$f":"'D. Asset Management'!F37","v":0},{"$f":"'D. Asset Management'!G37","v":0},{"$f":"'D. Asset Management'!H37","v":0},{"$f":"'D. Asset Management'!I37","v":0}]
[{"$f":"'D. Asset Management'!A38","v":0},{"$f":"'D. Asset Management'!J38","v":0},{"$f":"'D. Asset Management'!K38","v":0},{"$f":"'D. Asset Management'!Y38","v":0},{"$f":"'D. Asset Management'!B38","v":0},{"$f":"'D. Asset Management'!C38","v":0},{"$f":"'D. Asset Management'!D38","v":0},{"$f":"'D. Asset Management'!E38","v":0},{"$f":"'D. Asset Management'!F38","v":0},{"$f":"'D. Asset Management'!G38","v":0},{"$f":"'D. Asset Management'!H38","v":0},{"$f":"'D. Asset Management'!I38","v":0}]
[{"$f":"'E. Human Resource Security'!B1","v":"E. Human Resource Security"},null,null,null,{"$f":"'E. Human Resource Security'!B1","v":"E. Human Resource Security"}]
[{"$f":"'E. Human Resource Security'!A5","v":2536},{"$f":"'E. Human Resource Security'!J5","v":1},{"$f":"'E. Human Resource Security'!K5","v":0},{"$f":"'E. Human Resource Security'!Y5","v":1},{"$f":"'E. Human Resource Security'!B5","v":"E.1"},{"$f":"'E. Human Resource Security'!C5","v":"Are security roles and responsibilities of constituents defined and documented in accordance with the respondent’s information security policy?"},{"$f":"'E. Human Resource Security'!D5","v":0},{"$f":"'E. Human Resource Security'!E5","v":0},{"$f":"'E. Human Resource Security'!F5","v":0},{"$f":"'E. Human Resource Security'!G5","v":"C.2 Security Organization Roles/Responsibilities"},{"$f":"'E. Human Resource Security'!H5","v":"6.1.1"},{"$f":"'E. Human Resource Security'!I5","v":"Information security roles and responsibilities"},null,"PO4.6","Roles and responsibilities",12.1,"IS.2.M.15.1 MGMT.1.6.1.2 WPS.2.2.1.3.1","PO4.6, PO4.8, PO6.3, PO7.1, PO7.2, PO7.3, DS5.4"]
[{"$f":"'E. Human Resource Security'!A6","v":2538},{"$f":"'E. Human Resource Security'!J6","v":1},{"$f":"'E. Human Resource Security'!K6","v":0},{"$f":"'E. Human Resource Security'!Y6","v":1},{"$f":"'E. Human Resource Security'!B6","v":"E.2"},{"$f":"'E. Human Resource Security'!C6","v":"Is a background screening performed prior to allowing constituent access to Scoped Systems and Data? If yes, does it include:"},{"$f":"'E. Human Resource Security'!D6","v":0},{"$f":"'E. Human Resource Security'!E6","v":0},{"$f":"'E. Human Resource Security'!F6","v":0},{"$f":"'E. Human Resource Security'!G6","v":"E.3 Background Investigation Policy Content"},{"$f":"'E. Human Resource Security'!H6","v":"7.1.1"},{"$f":"'E. Human Resource Security'!I6","v":"Screening"},null,null,null,12.7,"IS.2.F.1","N/A"]
[{"$f":"'E. Human Resource Security'!A7","v":148},{"$f":"'E. Human Resource Security'!J7","v":2},{"$f":"'E. Human Resource Security'!K7","v":0},{"$f":"'E. Human Resource Security'!Y7","v":0},{"$f":"'E. Human Resource Security'!B7","v":"E.2.1"},{"$f":"'E. Human Resource Security'!C7","v":"Criminal?"},{"$f":"'E. Human Resource Security'!D7","v":0},{"$f":"'E. Human Resource Security'!E7","v":0},{"$f":"'E. Human Resource Security'!F7","v":0},{"$f":"'E. Human Resource Security'!G7","v":"E.3 Procedure: b.7"},{"$f":"'E. Human Resource Security'!H7","v":"7.1.1.e "},{"$f":"'E. Human Resource Security'!I7","v":"Screening"},null,"PO4.6","Roles and responsibilities","N/A","N/A","PO4.6, PO7.1, PO7.6, DS2.3"]
[{"$f":"'E. Human Resource Security'!A8","v":155},{"$f":"'E. Human Resource Security'!J8","v":2},{"$f":"'E. Human Resource Security'!K8","v":0},{"$f":"'E. Human Resource Security'!Y8","v":0},{"$f":"'E. Human Resource Security'!B8","v":"E.2.2"},{"$f":"'E. Human Resource Security'!C8","v":"Credit?"},{"$f":"'E. Human Resource Security'!D8","v":0},{"$f":"'E. Human Resource Security'!E8","v":0},{"$f":"'E. Human Resource Security'!F8","v":0},{"$f":"'E. Human Resource Security'!G8","v":"E.3 Procedure: b.6"},{"$f":"'E. Human Resource Security'!H8","v":"7.1.1.e "},{"$f":"'E. Human Resource Security'!I8","v":"Screening"},null,"PO4.6","Roles and responsibilities","N/A","N/A","PO4.6, PO7.1, PO7.6, DS2.3"]
[{"$f":"'E. Human Resource Security'!A9","v":162},{"$f":"'E. Human Resource Security'!J9","v":2},{"$f":"'E. Human Resource Security'!K9","v":0},{"$f":"'E. Human Resource Security'!Y9","v":0},{"$f":"'E. Human Resource Security'!B9","v":"E.2.3"},{"$f":"'E. Human Resource Security'!C9","v":"Academic?"},{"$f":"'E. Human Resource Security'!D9","v":0},{"$f":"'E. Human Resource Security'!E9","v":0},{"$f":"'E. Human Resource Security'!F9","v":0},{"$f":"'E. Human Resource Security'!G9","v":"E.3 Procedure: b.5"},{"$f":"'E. Human Resource Security'!H9","v":"7.1.1.e "},{"$f":"'E. Human Resource Security'!I9","v":"Screening"},null,"PO4.6","Roles and responsibilities","N/A","N/A","PO4.6, PO7.1, PO7.6, DS2.3"]
[{"$f":"'E. Human Resource Security'!A10","v":169},{"$f":"'E. Human Resource Security'!J10","v":2},{"$f":"'E. Human Resource Security'!K10","v":0},{"$f":"'E. Human Resource Security'!Y10","v":0},{"$f":"'E. Human Resource Security'!B10","v":"E.2.4"},{"$f":"'E. Human Resource Security'!C10","v":"Reference?"},{"$f":"'E. Human Resource Security'!D10","v":0},{"$f":"'E. Human Resource Security'!E10","v":0},{"$f":"'E. Human Resource Security'!F10","v":0},{"$f":"'E. Human Resource Security'!G10","v":"E.3 Procedure: b.8"},{"$f":"'E. Human Resource Security'!H10","v":"7.1.1.e "},{"$f":"'E. Human Resource Security'!I10","v":"Screening"},null,"PO4.6","Roles and responsibilities","N/A","N/A","PO4.6, PO7.1, PO7.6, DS2.3"]
[{"$f":"'E. Human Resource Security'!A11","v":2539},{"$f":"'E. Human Resource Security'!J11","v":2},{"$f":"'E. Human Resource Security'!K11","v":0},{"$f":"'E. Human Resource Security'!Y11","v":0},{"$f":"'E. Human Resource Security'!B11","v":"E.2.5"},{"$f":"'E. Human Resource Security'!C11","v":"Resume or curriculum vitae?"},{"$f":"'E. Human Resource Security'!D11","v":0},{"$f":"'E. Human Resource Security'!E11","v":0},{"$f":"'E. Human Resource Security'!F11","v":0},{"$f":"'E. Human Resource Security'!G11","v":"E.3 Procedure: b.4"},{"$f":"'E. Human Resource Security'!H11","v":"7.1.1.e "},{"$f":"'E. Human Resource Security'!I11","v":"Screening"},null,"PO4.6","Roles and responsibilities","N/A","RPS.1.1.3.1.2","PO4.6, PO7.1, PO7.6, DS2.3"]
[{"$f":"'E. Human Resource Security'!A12","v":176},{"$f":"'E. Human Resource Security'!J12","v":2},{"$f":"'E. Human Resource Security'!K12","v":0},{"$f":"'E. Human Resource Security'!Y12","v":0},{"$f":"'E. Human Resource Security'!B12","v":"E.2.6"},{"$f":"'E. Human Resource Security'!C12","v":"Drug Screening?"},{"$f":"'E. Human Resource Security'!D12","v":0},{"$f":"'E. Human Resource Security'!E12","v":0},{"$f":"'E. Human Resource Security'!F12","v":0},{"$f":"'E. Human Resource Security'!G12","v":"E.3 Procedure: b.10"},{"$f":"'E. Human Resource Security'!H12","v":"NA"},{"$f":"'E. Human Resource Security'!I12","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A13","v":4007},{"$f":"'E. Human Resource Security'!J13","v":1},{"$f":"'E. Human Resource Security'!K13","v":0},{"$f":"'E. Human Resource Security'!Y13","v":0},{"$f":"'E. Human Resource Security'!B13","v":"E.3"},{"$f":"'E. Human Resource Security'!C13","v":"Are periodic background checks conducted? If yes, do they include the following individuals:"},{"$f":"'E. Human Resource Security'!D13","v":0},{"$f":"'E. Human Resource Security'!E13","v":0},{"$f":"'E. Human Resource Security'!F13","v":0},{"$f":"'E. Human Resource Security'!G13","v":0},{"$f":"'E. Human Resource Security'!H13","v":"NA"},{"$f":"'E. Human Resource Security'!I13","v":0}]
[{"$f":"'E. Human Resource Security'!A14","v":4008},{"$f":"'E. Human Resource Security'!J14","v":2},{"$f":"'E. Human Resource Security'!K14","v":0},{"$f":"'E. Human Resource Security'!Y14","v":0},{"$f":"'E. Human Resource Security'!B14","v":"E.3.1"},{"$f":"'E. Human Resource Security'!C14","v":"Senior Management?"},{"$f":"'E. Human Resource Security'!D14","v":0},{"$f":"'E. Human Resource Security'!E14","v":0},{"$f":"'E. Human Resource Security'!F14","v":0},{"$f":"'E. Human Resource Security'!G14","v":0},{"$f":"'E. Human Resource Security'!H14","v":"NA"},{"$f":"'E. Human Resource Security'!I14","v":0}]
[{"$f":"'E. Human Resource Security'!A15","v":4009},{"$f":"'E. Human Resource Security'!J15","v":2},{"$f":"'E. Human Resource Security'!K15","v":0},{"$f":"'E. Human Resource Security'!Y15","v":0},{"$f":"'E. Human Resource Security'!B15","v":"E.3.2"},{"$f":"'E. Human Resource Security'!C15","v":"Subcontractors?"},{"$f":"'E. Human Resource Security'!D15","v":0},{"$f":"'E. Human Resource Security'!E15","v":0},{"$f":"'E. Human Resource Security'!F15","v":0},{"$f":"'E. Human Resource Security'!G15","v":0},{"$f":"'E. Human Resource Security'!H15","v":"NA"},{"$f":"'E. Human Resource Security'!I15","v":0}]
[{"$f":"'E. Human Resource Security'!A16","v":4010},{"$f":"'E. Human Resource Security'!J16","v":2},{"$f":"'E. Human Resource Security'!K16","v":0},{"$f":"'E. Human Resource Security'!Y16","v":0},{"$f":"'E. Human Resource Security'!B16","v":"E.3.3"},{"$f":"'E. Human Resource Security'!C16","v":"All other employees?"},{"$f":"'E. Human Resource Security'!D16","v":0},{"$f":"'E. Human Resource Security'!E16","v":0},{"$f":"'E. Human Resource Security'!F16","v":0},{"$f":"'E. Human Resource Security'!G16","v":0},{"$f":"'E. Human Resource Security'!H16","v":"NA"},{"$f":"'E. Human Resource Security'!I16","v":0}]
[{"$f":"'E. Human Resource Security'!A17","v":183},{"$f":"'E. Human Resource Security'!J17","v":1},{"$f":"'E. Human Resource Security'!K17","v":0},{"$f":"'E. Human Resource Security'!Y17","v":1},{"$f":"'E. Human Resource Security'!B17","v":"E.4"},{"$f":"'E. Human Resource Security'!C17","v":"Are new hires required to sign any agreements upon hire? If yes, does it include:"},{"$f":"'E. Human Resource Security'!D17","v":0},{"$f":"'E. Human Resource Security'!E17","v":0},{"$f":"'E. Human Resource Security'!F17","v":0},{"$f":"'E. Human Resource Security'!G17","v":"E.5 Agreements for Employees"},{"$f":"'E. Human Resource Security'!H17","v":"7.1.2"},{"$f":"'E. Human Resource Security'!I17","v":"Terms and conditions of employment"},null,"PO4.6","Roles and responsibilities","12.6.2","IS.2.A.8.1 IS.2.F.4 IS.2.F.2","PO4.6, PO7.1, PO7.3, DS2.3"]
[{"$f":"'E. Human Resource Security'!A18","v":184},{"$f":"'E. Human Resource Security'!J18","v":2},{"$f":"'E. Human Resource Security'!K18","v":0},{"$f":"'E. Human Resource Security'!Y18","v":0},{"$f":"'E. Human Resource Security'!B18","v":"E.4.1"},{"$f":"'E. Human Resource Security'!C18","v":"Acceptable Use?"},{"$f":"'E. Human Resource Security'!D18","v":0},{"$f":"'E. Human Resource Security'!E18","v":0},{"$f":"'E. Human Resource Security'!F18","v":0},{"$f":"'E. Human Resource Security'!G18","v":"E.5 Agreements for Employees"},{"$f":"'E. Human Resource Security'!H18","v":"8.1.3"},{"$f":"'E. Human Resource Security'!I18","v":"Acceptable use of assets"},null,"PO4.10","Supervision","12.3.5","N/A","PO4.10, PO6.2"]
[{"$f":"'E. Human Resource Security'!A19","v":191},{"$f":"'E. Human Resource Security'!J19","v":2},{"$f":"'E. Human Resource Security'!K19","v":0},{"$f":"'E. Human Resource Security'!Y19","v":0},{"$f":"'E. Human Resource Security'!B19","v":"E.4.2"},{"$f":"'E. Human Resource Security'!C19","v":"Code of Conduct / Ethics?"},{"$f":"'E. Human Resource Security'!D19","v":0},{"$f":"'E. Human Resource Security'!E19","v":0},{"$f":"'E. Human Resource Security'!F19","v":0},{"$f":"'E. Human Resource Security'!G19","v":"E.5 Agreements for Employees"},{"$f":"'E. Human Resource Security'!H19","v":"7.1.2"},{"$f":"'E. Human Resource Security'!I19","v":"Terms and conditions of employment"},null,"PO4.6","Roles and responsibilities","N/A","N/A","PO4.6, PO7.1, PO7.3, DS2.3"]
[{"$f":"'E. Human Resource Security'!A20","v":198},{"$f":"'E. Human Resource Security'!J20","v":2},{"$f":"'E. Human Resource Security'!K20","v":0},{"$f":"'E. Human Resource Security'!Y20","v":0},{"$f":"'E. Human Resource Security'!B20","v":"E.4.3"},{"$f":"'E. Human Resource Security'!C20","v":"Non-Disclosure Agreement?"},{"$f":"'E. Human Resource Security'!D20","v":0},{"$f":"'E. Human Resource Security'!E20","v":0},{"$f":"'E. Human Resource Security'!F20","v":0},{"$f":"'E. Human Resource Security'!G20","v":"E.5 Agreements for Employees"},{"$f":"'E. Human Resource Security'!H20","v":"7.1.2"},{"$f":"'E. Human Resource Security'!I20","v":"Terms and conditions of employment"},null,"PO4.6","Roles and responsibilities","N/A","N/A","PO4.6, PO7.1, PO7.3, DS2.3"]
[{"$f":"'E. Human Resource Security'!A21","v":205},{"$f":"'E. Human Resource Security'!J21","v":2},{"$f":"'E. Human Resource Security'!K21","v":0},{"$f":"'E. Human Resource Security'!Y21","v":0},{"$f":"'E. Human Resource Security'!B21","v":"E.4.4"},{"$f":"'E. Human Resource Security'!C21","v":"Confidentiality Agreement?"},{"$f":"'E. Human Resource Security'!D21","v":0},{"$f":"'E. Human Resource Security'!E21","v":0},{"$f":"'E. Human Resource Security'!F21","v":0},{"$f":"'E. Human Resource Security'!G21","v":"E.5 Agreements for Employees"},{"$f":"'E. Human Resource Security'!H21","v":"7.1.2"},{"$f":"'E. Human Resource Security'!I21","v":"Terms and conditions of employment"},null,"PO4.6","Roles and responsibilities","N/A","N/A","PO4.6, PO7.1, PO7.3, DS2.3"]
[{"$f":"'E. Human Resource Security'!A22","v":4113},{"$f":"'E. Human Resource Security'!J22","v":2},{"$f":"'E. Human Resource Security'!K22","v":0},{"$f":"'E. Human Resource Security'!Y22","v":0},{"$f":"'E. Human Resource Security'!B22","v":"E.4.5"},{"$f":"'E. Human Resource Security'!C22","v":"Terms of Use for Mobile Devices?"},{"$f":"'E. Human Resource Security'!D22","v":0},{"$f":"'E. Human Resource Security'!E22","v":0},{"$f":"'E. Human Resource Security'!F22","v":0},{"$f":"'E. Human Resource Security'!G22","v":0},{"$f":"'E. Human Resource Security'!H22","v":"NA"},{"$f":"'E. Human Resource Security'!I22","v":0}]
[{"$f":"'E. Human Resource Security'!A23","v":2555},{"$f":"'E. Human Resource Security'!J23","v":2},{"$f":"'E. Human Resource Security'!K23","v":0},{"$f":"'E. Human Resource Security'!Y23","v":0},{"$f":"'E. Human Resource Security'!B23","v":"E.4.6"},{"$f":"'E. Human Resource Security'!C23","v":"Are constituents required to sign annual acknowledgements? If yes, do they include:"},{"$f":"'E. Human Resource Security'!D23","v":0},{"$f":"'E. Human Resource Security'!E23","v":0},{"$f":"'E. Human Resource Security'!F23","v":0},{"$f":"'E. Human Resource Security'!G23","v":"E.5 Agreements for Employees"},{"$f":"'E. Human Resource Security'!H23","v":"NA"},{"$f":"'E. Human Resource Security'!I23","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A24","v":265},{"$f":"'E. Human Resource Security'!J24","v":3},{"$f":"'E. Human Resource Security'!K24","v":0},{"$f":"'E. Human Resource Security'!Y24","v":0},{"$f":"'E. Human Resource Security'!B24","v":"E.4.6.1"},{"$f":"'E. Human Resource Security'!C24","v":"Acceptable Use?"},{"$f":"'E. Human Resource Security'!D24","v":0},{"$f":"'E. Human Resource Security'!E24","v":0},{"$f":"'E. Human Resource Security'!F24","v":0},{"$f":"'E. Human Resource Security'!G24","v":"E.5 Agreements for Employees"},{"$f":"'E. Human Resource Security'!H24","v":"NA"},{"$f":"'E. Human Resource Security'!I24","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A25","v":272},{"$f":"'E. Human Resource Security'!J25","v":3},{"$f":"'E. Human Resource Security'!K25","v":0},{"$f":"'E. Human Resource Security'!Y25","v":0},{"$f":"'E. Human Resource Security'!B25","v":"E.4.6.2"},{"$f":"'E. Human Resource Security'!C25","v":"Code of Conduct / Ethics?"},{"$f":"'E. Human Resource Security'!D25","v":0},{"$f":"'E. Human Resource Security'!E25","v":0},{"$f":"'E. Human Resource Security'!F25","v":0},{"$f":"'E. Human Resource Security'!G25","v":"E.5 Agreements for Employees"},{"$f":"'E. Human Resource Security'!H25","v":"NA"},{"$f":"'E. Human Resource Security'!I25","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A26","v":279},{"$f":"'E. Human Resource Security'!J26","v":3},{"$f":"'E. Human Resource Security'!K26","v":0},{"$f":"'E. Human Resource Security'!Y26","v":0},{"$f":"'E. Human Resource Security'!B26","v":"E.4.6.3"},{"$f":"'E. Human Resource Security'!C26","v":"Non-Disclosure Agreement?"},{"$f":"'E. Human Resource Security'!D26","v":0},{"$f":"'E. Human Resource Security'!E26","v":0},{"$f":"'E. Human Resource Security'!F26","v":0},{"$f":"'E. Human Resource Security'!G26","v":"E.5 Agreements for Employees"},{"$f":"'E. Human Resource Security'!H26","v":"NA"},{"$f":"'E. Human Resource Security'!I26","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A27","v":286},{"$f":"'E. Human Resource Security'!J27","v":3},{"$f":"'E. Human Resource Security'!K27","v":0},{"$f":"'E. Human Resource Security'!Y27","v":0},{"$f":"'E. Human Resource Security'!B27","v":"E.4.6.4"},{"$f":"'E. Human Resource Security'!C27","v":"Confidentiality Agreement?"},{"$f":"'E. Human Resource Security'!D27","v":0},{"$f":"'E. Human Resource Security'!E27","v":0},{"$f":"'E. Human Resource Security'!F27","v":0},{"$f":"'E. Human Resource Security'!G27","v":"E.5 Agreements for Employees"},{"$f":"'E. Human Resource Security'!H27","v":"NA"},{"$f":"'E. Human Resource Security'!I27","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A28","v":212},{"$f":"'E. Human Resource Security'!J28","v":1},{"$f":"'E. Human Resource Security'!K28","v":0},{"$f":"'E. Human Resource Security'!Y28","v":1},{"$f":"'E. Human Resource Security'!B28","v":"E.5"},{"$f":"'E. Human Resource Security'!C28","v":"Is there a security awareness training program? If yes, does it include:"},{"$f":"'E. Human Resource Security'!D28","v":0},{"$f":"'E. Human Resource Security'!E28","v":0},{"$f":"'E. Human Resource Security'!F28","v":0},{"$f":"'E. Human Resource Security'!G28","v":"E.1 Security Awareness Training Program Maintenance"},{"$f":"'E. Human Resource Security'!H28","v":"7.2.2"},{"$f":"'E. Human Resource Security'!I28","v":"Information security awareness, education, and training"},null,"PO4.6","Roles and responsibilities",12.6,"IS.1.7.2 E-BANK.1.4.2.11 E-BANK.1.4.2.12","PO4.6, PO6.2, PO6.4, PO7.2, PO7.4, PO7.7, AI1.1, AI7.1, DS5.1, DS5.2, DS5.3, DS7.1, DS7.2"]
[{"$f":"'E. Human Resource Security'!A29","v":214},{"$f":"'E. Human Resource Security'!J29","v":2},{"$f":"'E. Human Resource Security'!K29","v":0},{"$f":"'E. Human Resource Security'!Y29","v":0},{"$f":"'E. Human Resource Security'!B29","v":"E.5.1"},{"$f":"'E. Human Resource Security'!C29","v":"Security policies, procedures and processes?"},{"$f":"'E. Human Resource Security'!D29","v":0},{"$f":"'E. Human Resource Security'!E29","v":0},{"$f":"'E. Human Resource Security'!F29","v":0},{"$f":"'E. Human Resource Security'!G29","v":"E.1 Security Awareness Training Program Maintenance"},{"$f":"'E. Human Resource Security'!H29","v":"7.2.2"},{"$f":"'E. Human Resource Security'!I29","v":"Information security awareness, education, and training"},null,"PO4.6","Roles and responsibilities",12.1,"RPS.1.4.2 RPS.2.N.10.1","PO4.6, PO6.2, PO6.4, PO7.2, PO7.4, PO7.7, AI1.1, AI7.1, DS5.1, DS5.2, DS5.3, DS7.1, DS7.2"]
[{"$f":"'E. Human Resource Security'!A30","v":215},{"$f":"'E. Human Resource Security'!J30","v":2},{"$f":"'E. Human Resource Security'!K30","v":0},{"$f":"'E. Human Resource Security'!Y30","v":0},{"$f":"'E. Human Resource Security'!B30","v":"E.5.2"},{"$f":"'E. Human Resource Security'!C30","v":"Scored test to evaluate successful completion?"},{"$f":"'E. Human Resource Security'!D30","v":0},{"$f":"'E. Human Resource Security'!E30","v":0},{"$f":"'E. Human Resource Security'!F30","v":0},{"$f":"'E. Human Resource Security'!G30","v":"E.1 Security Awareness Training Program Maintenance"},{"$f":"'E. Human Resource Security'!H30","v":"NA"},{"$f":"'E. Human Resource Security'!I30","v":0},null,null,null,"12.6.1","E-BANK.1.4.2.12","N/A"]
[{"$f":"'E. Human Resource Security'!A31","v":3302},{"$f":"'E. Human Resource Security'!J31","v":2},{"$f":"'E. Human Resource Security'!K31","v":0},{"$f":"'E. Human Resource Security'!Y31","v":0},{"$f":"'E. Human Resource Security'!B31","v":"E.5.3"},{"$f":"'E. Human Resource Security'!C31","v":"New Hire and annual participation?"},{"$f":"'E. Human Resource Security'!D31","v":0},{"$f":"'E. Human Resource Security'!E31","v":0},{"$f":"'E. Human Resource Security'!F31","v":0},{"$f":"'E. Human Resource Security'!G31","v":"E.2 Security Awareness Training Attendance"},{"$f":"'E. Human Resource Security'!H31","v":"7.2.2"},{"$f":"'E. Human Resource Security'!I31","v":"Information security awareness, education, and training"},null,"PO4.6","Roles and responsibilities","12.6.1","N/A","PO4.6, PO6.2, PO6.4, PO7.2, PO7.4, PO7.7, AI1.1, AI7.1, DS5.1, DS5.2, DS5.3, DS7.1, DS7.2"]
[{"$f":"'E. Human Resource Security'!A32","v":218},{"$f":"'E. Human Resource Security'!J32","v":2},{"$f":"'E. Human Resource Security'!K32","v":0},{"$f":"'E. Human Resource Security'!Y32","v":0},{"$f":"'E. Human Resource Security'!B32","v":"E.5.4"},{"$f":"'E. Human Resource Security'!C32","v":"Training commensurate with levels of responsibilities and access?"},{"$f":"'E. Human Resource Security'!D32","v":0},{"$f":"'E. Human Resource Security'!E32","v":0},{"$f":"'E. Human Resource Security'!F32","v":0},{"$f":"'E. Human Resource Security'!G32","v":"E.2 Security Awareness Training Attendance"},{"$f":"'E. Human Resource Security'!H32","v":"7.2.2"},{"$f":"'E. Human Resource Security'!I32","v":"Information security awareness, education, and training"},null,"PO4.6","Roles and responsibilities",12.4,"IS.1.2.8.1","PO4.6, PO6.2, PO6.4, PO7.2, PO7.4, PO7.7, AI1.1, AI7.1, DS5.1, DS5.2, DS5.3, DS7.1, DS7.2"]
[{"$f":"'E. Human Resource Security'!A33","v":219},{"$f":"'E. Human Resource Security'!J33","v":2},{"$f":"'E. Human Resource Security'!K33","v":0},{"$f":"'E. Human Resource Security'!Y33","v":0},{"$f":"'E. Human Resource Security'!B33","v":"E.5.5"},{"$f":"'E. Human Resource Security'!C33","v":"Additional training for those responsible for information security?"},{"$f":"'E. Human Resource Security'!D33","v":0},{"$f":"'E. Human Resource Security'!E33","v":0},{"$f":"'E. Human Resource Security'!F33","v":0},{"$f":"'E. Human Resource Security'!G33","v":0},{"$f":"'E. Human Resource Security'!H33","v":"7.2.2"},{"$f":"'E. Human Resource Security'!I33","v":"Information security awareness, education, and training"},null,"PO4.6","Roles and responsibilities",12.4,"IS.1.2.8.1","PO4.6, PO6.2, PO6.4, PO7.2, PO7.4, PO7.7, AI1.1, AI7.1, DS5.1, DS5.2, DS5.3, DS7.1, DS7.2"]
[{"$f":"'E. Human Resource Security'!A34","v":4114},{"$f":"'E. Human Resource Security'!J34","v":2},{"$f":"'E. Human Resource Security'!K34","v":0},{"$f":"'E. Human Resource Security'!Y34","v":0},{"$f":"'E. Human Resource Security'!B34","v":"E.5.6"},{"$f":"'E. Human Resource Security'!C34","v":"Mobile Device security awareness?"},{"$f":"'E. Human Resource Security'!D34","v":0},{"$f":"'E. Human Resource Security'!E34","v":0},{"$f":"'E. Human Resource Security'!F34","v":0},{"$f":"'E. Human Resource Security'!G34","v":0},{"$f":"'E. Human Resource Security'!H34","v":"NA"},{"$f":"'E. Human Resource Security'!I34","v":0},null,"PO4.15","Relationships","N/A","N/A","PO4.15, DS4.1, DS4.2"]
[{"$f":"'E. Human Resource Security'!A35","v":220},{"$f":"'E. Human Resource Security'!J35","v":1},{"$f":"'E. Human Resource Security'!K35","v":0},{"$f":"'E. Human Resource Security'!Y35","v":0},{"$f":"'E. Human Resource Security'!B35","v":"E.6"},{"$f":"'E. Human Resource Security'!C35","v":"Do information security personnel have professional security certifications?"},{"$f":"'E. Human Resource Security'!D35","v":0},{"$f":"'E. Human Resource Security'!E35","v":0},{"$f":"'E. Human Resource Security'!F35","v":0},{"$f":"'E. Human Resource Security'!G35","v":0},{"$f":"'E. Human Resource Security'!H35","v":"6.1.4"},{"$f":"'E. Human Resource Security'!I35","v":"Contact with special interest groups"}]
[{"$f":"'E. Human Resource Security'!A36","v":293},{"$f":"'E. Human Resource Security'!J36","v":1},{"$f":"'E. Human Resource Security'!K36","v":0},{"$f":"'E. Human Resource Security'!Y36","v":1},{"$f":"'E. Human Resource Security'!B36","v":"E.7"},{"$f":"'E. Human Resource Security'!C36","v":"Is there a disciplinary process for non-compliance with information security policies?"},{"$f":"'E. Human Resource Security'!D36","v":0},{"$f":"'E. Human Resource Security'!E36","v":0},{"$f":"'E. Human Resource Security'!F36","v":0},{"$f":"'E. Human Resource Security'!G36","v":0},{"$f":"'E. Human Resource Security'!H36","v":"7.2.3"},{"$f":"'E. Human Resource Security'!I36","v":"Disciplinary process"},null,"PO4.8","Responsibility for risk, security and compliance","N/A","IS.1.7.6","PO4.8, PO7.8, DS5.6"]
[{"$f":"'E. Human Resource Security'!A37","v":2557},{"$f":"'E. Human Resource Security'!J37","v":1},{"$f":"'E. Human Resource Security'!K37","v":0},{"$f":"'E. Human Resource Security'!Y37","v":1},{"$f":"'E. Human Resource Security'!B37","v":"E.8"},{"$f":"'E. Human Resource Security'!C37","v":"Is there a constituent termination or change of status process?"},{"$f":"'E. Human Resource Security'!D37","v":0},{"$f":"'E. Human Resource Security'!E37","v":0},{"$f":"'E. Human Resource Security'!F37","v":0},{"$f":"'E. Human Resource Security'!G37","v":"E.6 Separation Procedures"},{"$f":"'E. Human Resource Security'!H37","v":7.3},{"$f":"'E. Human Resource Security'!I37","v":"Termination responsibilities"},null,"PO7.8","Job change and termination","N/A","OPS.1.5.3.5","PO4.8, PO7.8, DS5.6"]
[{"$f":"'E. Human Resource Security'!A38","v":294},{"$f":"'E. Human Resource Security'!J38","v":2},{"$f":"'E. Human Resource Security'!K38","v":0},{"$f":"'E. Human Resource Security'!Y38","v":0},{"$f":"'E. Human Resource Security'!B38","v":"E.8.1"},{"$f":"'E. Human Resource Security'!C38","v":"Is there a documented termination or change of status policy or process that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"'E. Human Resource Security'!D38","v":0},{"$f":"'E. Human Resource Security'!E38","v":0},{"$f":"'E. Human Resource Security'!F38","v":0},{"$f":"'E. Human Resource Security'!G38","v":0},{"$f":"'E. Human Resource Security'!H38","v":7.3},{"$f":"'E. Human Resource Security'!I38","v":"Termination responsibilities"},null,"PO7.8","Job change and termination","N/A","IS.1.4.1.1.2","PO4.8, PO7.8, DS5.6"]
[{"$f":"'E. Human Resource Security'!A39","v":299},{"$f":"'E. Human Resource Security'!J39","v":2},{"$f":"'E. Human Resource Security'!K39","v":0},{"$f":"'E. Human Resource Security'!Y39","v":0},{"$f":"'E. Human Resource Security'!B39","v":"E.8.2"},{"$f":"'E. Human Resource Security'!C39","v":"Does HR notify security / access administration of constituent termination for access rights removal? If yes, is notification provided:"},{"$f":"'E. Human Resource Security'!D39","v":0},{"$f":"'E. Human Resource Security'!E39","v":0},{"$f":"'E. Human Resource Security'!F39","v":0},{"$f":"'E. Human Resource Security'!G39","v":"E.6 Separation Procedures\nH.2 Revoke System and Physical Access"},{"$f":"'E. Human Resource Security'!H39","v":"7.3.1"},{"$f":"'E. Human Resource Security'!I39","v":"Termination or change of employment responsibilities"},null,"PO7.8","Job change and termination","N/A","IS.2.A.5.1 WPS.2.9.2.6","PO7.8, DS5.4"]
[{"$f":"'E. Human Resource Security'!A40","v":301},{"$f":"'E. Human Resource Security'!J40","v":3},{"$f":"'E. Human Resource Security'!K40","v":0},{"$f":"'E. Human Resource Security'!Y40","v":0},{"$f":"'E. Human Resource Security'!B40","v":"E.8.2.1"},{"$f":"'E. Human Resource Security'!C40","v":"On the actual date?"},{"$f":"'E. Human Resource Security'!D40","v":0},{"$f":"'E. Human Resource Security'!E40","v":0},{"$f":"'E. Human Resource Security'!F40","v":0},{"$f":"'E. Human Resource Security'!G40","v":0},{"$f":"'E. Human Resource Security'!H40","v":"NA"},{"$f":"'E. Human Resource Security'!I40","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A41","v":302},{"$f":"'E. Human Resource Security'!J41","v":3},{"$f":"'E. Human Resource Security'!K41","v":0},{"$f":"'E. Human Resource Security'!Y41","v":0},{"$f":"'E. Human Resource Security'!B41","v":"E.8.2.2"},{"$f":"'E. Human Resource Security'!C41","v":"Two to seven days after termination?"},{"$f":"'E. Human Resource Security'!D41","v":0},{"$f":"'E. Human Resource Security'!E41","v":0},{"$f":"'E. Human Resource Security'!F41","v":0},{"$f":"'E. Human Resource Security'!G41","v":0},{"$f":"'E. Human Resource Security'!H41","v":"NA"},{"$f":"'E. Human Resource Security'!I41","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A42","v":303},{"$f":"'E. Human Resource Security'!J42","v":3},{"$f":"'E. Human Resource Security'!K42","v":0},{"$f":"'E. Human Resource Security'!Y42","v":0},{"$f":"'E. Human Resource Security'!B42","v":"E.8.2.3"},{"$f":"'E. Human Resource Security'!C42","v":"Greater than seven days after termination?"},{"$f":"'E. Human Resource Security'!D42","v":0},{"$f":"'E. Human Resource Security'!E42","v":0},{"$f":"'E. Human Resource Security'!F42","v":0},{"$f":"'E. Human Resource Security'!G42","v":0},{"$f":"'E. Human Resource Security'!H42","v":"NA"},{"$f":"'E. Human Resource Security'!I42","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A43","v":304},{"$f":"'E. Human Resource Security'!J43","v":2},{"$f":"'E. Human Resource Security'!K43","v":0},{"$f":"'E. Human Resource Security'!Y43","v":0},{"$f":"'E. Human Resource Security'!B43","v":"E.8.3"},{"$f":"'E. Human Resource Security'!C43","v":"Does HR notify security / access administration of a constituent change of status for access rights removal? If yes, is notification provided:"},{"$f":"'E. Human Resource Security'!D43","v":0},{"$f":"'E. Human Resource Security'!E43","v":0},{"$f":"'E. Human Resource Security'!F43","v":0},{"$f":"'E. Human Resource Security'!G43","v":"E.6 Separation Procedures\nH.2 Revoke System and Physical Access"},{"$f":"'E. Human Resource Security'!H43","v":"7.3.1"},{"$f":"'E. Human Resource Security'!I43","v":"Termination or change of employment responsibilities"},null,"PO7.8","Job change and termination","N/A","IS.2.A.5.2 WPS.2.9.2.6","PO7.8, DS5.4"]
[{"$f":"'E. Human Resource Security'!A44","v":306},{"$f":"'E. Human Resource Security'!J44","v":3},{"$f":"'E. Human Resource Security'!K44","v":0},{"$f":"'E. Human Resource Security'!Y44","v":0},{"$f":"'E. Human Resource Security'!B44","v":"E.8.3.1"},{"$f":"'E. Human Resource Security'!C44","v":"On the actual date of the change of status?"},{"$f":"'E. Human Resource Security'!D44","v":0},{"$f":"'E. Human Resource Security'!E44","v":0},{"$f":"'E. Human Resource Security'!F44","v":0},{"$f":"'E. Human Resource Security'!G44","v":0},{"$f":"'E. Human Resource Security'!H44","v":"NA"},{"$f":"'E. Human Resource Security'!I44","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A45","v":307},{"$f":"'E. Human Resource Security'!J45","v":3},{"$f":"'E. Human Resource Security'!K45","v":0},{"$f":"'E. Human Resource Security'!Y45","v":0},{"$f":"'E. Human Resource Security'!B45","v":"E.8.3.2"},{"$f":"'E. Human Resource Security'!C45","v":"Two to seven days after the change of status?"},{"$f":"'E. Human Resource Security'!D45","v":0},{"$f":"'E. Human Resource Security'!E45","v":0},{"$f":"'E. Human Resource Security'!F45","v":0},{"$f":"'E. Human Resource Security'!G45","v":0},{"$f":"'E. Human Resource Security'!H45","v":"NA"},{"$f":"'E. Human Resource Security'!I45","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A46","v":308},{"$f":"'E. Human Resource Security'!J46","v":3},{"$f":"'E. Human Resource Security'!K46","v":0},{"$f":"'E. Human Resource Security'!Y46","v":0},{"$f":"'E. Human Resource Security'!B46","v":"E.8.3.3"},{"$f":"'E. Human Resource Security'!C46","v":"Greater than seven days after the change of status?"},{"$f":"'E. Human Resource Security'!D46","v":0},{"$f":"'E. Human Resource Security'!E46","v":0},{"$f":"'E. Human Resource Security'!F46","v":0},{"$f":"'E. Human Resource Security'!G46","v":0},{"$f":"'E. Human Resource Security'!H46","v":"NA"},{"$f":"'E. Human Resource Security'!I46","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'E. Human Resource Security'!A47","v":2558},{"$f":"'E. Human Resource Security'!J47","v":2},{"$f":"'E. Human Resource Security'!K47","v":1},{"$f":"'E. Human Resource Security'!Y47","v":0},{"$f":"'E. Human Resource Security'!B47","v":"E.8.4"},{"$f":"'E. Human Resource Security'!C47","v":"Are constituents required to return assets (laptop, desktop, PDA, cell phones, access cards, tokens, smart cards, keys, proprietary documentation) upon:"},{"$f":"'E. Human Resource Security'!D47","v":0},{"$f":"'E. Human Resource Security'!E47","v":0},{"$f":"'E. Human Resource Security'!F47","v":0},{"$f":"'E. Human Resource Security'!G47","v":"H.2 Revoke System and Physical Access"},{"$f":"'E. Human Resource Security'!H47","v":"8.1.4"},{"$f":"'E. Human Resource Security'!I47","v":"Return of assets"},null,"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, PO7.8"]
[{"$f":"'E. Human Resource Security'!A48","v":310},{"$f":"'E. Human Resource Security'!J48","v":3},{"$f":"'E. Human Resource Security'!K48","v":0},{"$f":"'E. Human Resource Security'!Y48","v":0},{"$f":"'E. Human Resource Security'!B48","v":"E.8.4.1"},{"$f":"'E. Human Resource Security'!C48","v":"Termination?"},{"$f":"'E. Human Resource Security'!D48","v":0},{"$f":"'E. Human Resource Security'!E48","v":0},{"$f":"'E. Human Resource Security'!F48","v":0},{"$f":"'E. Human Resource Security'!G48","v":0},{"$f":"'E. Human Resource Security'!H48","v":"8.1.4"},{"$f":"'E. Human Resource Security'!I48","v":"Return of assets"},null,"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, PO7.8"]
[{"$f":"'E. Human Resource Security'!A49","v":4011},{"$f":"'E. Human Resource Security'!J49","v":1},{"$f":"'E. Human Resource Security'!K49","v":0},{"$f":"'E. Human Resource Security'!Y49","v":0},{"$f":"'E. Human Resource Security'!B49","v":"E.9"},{"$f":"'E. Human Resource Security'!C49","v":"Is there a succession and redundancy planning for key management and support personnel? If yes, does it include:"},{"$f":"'E. Human Resource Security'!D49","v":0},{"$f":"'E. Human Resource Security'!E49","v":0},{"$f":"'E. Human Resource Security'!F49","v":0},{"$f":"'E. Human Resource Security'!G49","v":0},{"$f":"'E. Human Resource Security'!H49","v":"NA"},{"$f":"'E. Human Resource Security'!I49","v":0},null,"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, PO7.8"]
[{"$f":"'E. Human Resource Security'!A50","v":4012},{"$f":"'E. Human Resource Security'!J50","v":2},{"$f":"'E. Human Resource Security'!K50","v":0},{"$f":"'E. Human Resource Security'!Y50","v":0},{"$f":"'E. Human Resource Security'!B50","v":"E.9.1"},{"$f":"'E. Human Resource Security'!C50","v":"Senior Management?"},{"$f":"'E. Human Resource Security'!D50","v":0},{"$f":"'E. Human Resource Security'!E50","v":0},{"$f":"'E. Human Resource Security'!F50","v":0},{"$f":"'E. Human Resource Security'!G50","v":0},{"$f":"'E. Human Resource Security'!H50","v":"NA"},{"$f":"'E. Human Resource Security'!I50","v":0}]
[{"$f":"'E. Human Resource Security'!A51","v":4013},{"$f":"'E. Human Resource Security'!J51","v":2},{"$f":"'E. Human Resource Security'!K51","v":0},{"$f":"'E. Human Resource Security'!Y51","v":0},{"$f":"'E. Human Resource Security'!B51","v":"E.9.2"},{"$f":"'E. Human Resource Security'!C51","v":"Key support, operations and development areas?"},{"$f":"'E. Human Resource Security'!D51","v":0},{"$f":"'E. Human Resource Security'!E51","v":0},{"$f":"'E. Human Resource Security'!F51","v":0},{"$f":"'E. Human Resource Security'!G51","v":0},{"$f":"'E. Human Resource Security'!H51","v":"NA"},{"$f":"'E. Human Resource Security'!I51","v":0}]
[{"$f":"'E. Human Resource Security'!A52","v":0},{"$f":"'E. Human Resource Security'!J52","v":0},{"$f":"'E. Human Resource Security'!K52","v":0},{"$f":"'E. Human Resource Security'!Y52","v":0},{"$f":"'E. Human Resource Security'!B52","v":0},{"$f":"'E. Human Resource Security'!C52","v":0},{"$f":"'E. Human Resource Security'!D52","v":0},{"$f":"'E. Human Resource Security'!E52","v":0},{"$f":"'E. Human Resource Security'!F52","v":0},{"$f":"'E. Human Resource Security'!G52","v":0},{"$f":"'E. Human Resource Security'!H52","v":0},{"$f":"'E. Human Resource Security'!I52","v":0}]
[null,null,null,null,{"$f":"'E. Human Resource Security'!B53","v":0},{"$f":"'E. Human Resource Security'!C53","v":0},{"$f":"'E. Human Resource Security'!D53","v":0},{"$f":"'E. Human Resource Security'!E53","v":0},{"$f":"'E. Human Resource Security'!F53","v":0},{"$f":"'E. Human Resource Security'!G53","v":0},{"$f":"'E. Human Resource Security'!H53","v":0},{"$f":"'E. Human Resource Security'!I53","v":0}]
[{"$f":"'F. Physical and Environmental'!B1","v":"F. Physical and Environmental Security"},null,null,null,{"$f":"'F. Physical and Environmental'!B1","v":"F. Physical and Environmental Security"}]
[{"$f":"'F. Physical and Environmental'!A5","v":2559},{"$f":"'F. Physical and Environmental'!J5","v":1},{"$f":"'F. Physical and Environmental'!K5","v":0},{"$f":"'F. Physical and Environmental'!Y5","v":1},{"$f":"'F. Physical and Environmental'!B5","v":"F.1"},{"$f":"'F. Physical and Environmental'!C5","v":"Is there a physical security program?"},{"$f":"'F. Physical and Environmental'!D5","v":0},{"$f":"'F. Physical and Environmental'!E5","v":0},{"$f":"'F. Physical and Environmental'!F5","v":0},{"$f":"'F. Physical and Environmental'!G5","v":0},{"$f":"'F. Physical and Environmental'!H5","v":"5.1.1"},{"$f":"'F. Physical and Environmental'!I5","v":"Policies for information security"},null,"PO6.1","IT policy and control environment",12.1,"IS.2.E.1 OPS.1.5.1.6 OPS.1.5.1.8 WPS.2.2.1.3.5 AUDIT.2.D.1.10 E-BANK.1.4.2.8 E-BANK.1.5.4 RPS.1.2.2.2","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'F. Physical and Environmental'!A6","v":312},{"$f":"'F. Physical and Environmental'!J6","v":2},{"$f":"'F. Physical and Environmental'!K6","v":0},{"$f":"'F. Physical and Environmental'!Y6","v":0},{"$f":"'F. Physical and Environmental'!B6","v":"F.1.1"},{"$f":"'F. Physical and Environmental'!C6","v":"Is there a documented physical security policy approved by management, communicated to constituents and an owner assigned to maintain and review the policy?"},{"$f":"'F. Physical and Environmental'!D6","v":0},{"$f":"'F. Physical and Environmental'!E6","v":0},{"$f":"'F. Physical and Environmental'!F6","v":0},{"$f":"'F. Physical and Environmental'!G6","v":"B.1 Information Security Policy Content and Maintenance"},{"$f":"'F. Physical and Environmental'!H6","v":"5.1.1"},{"$f":"'F. Physical and Environmental'!I6","v":"Policies for information security"},null,"PO6.1","IT policy and control environment",9.1,"N/A","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'F. Physical and Environmental'!A7","v":2560},{"$f":"'F. Physical and Environmental'!J7","v":2},{"$f":"'F. Physical and Environmental'!K7","v":0},{"$f":"'F. Physical and Environmental'!Y7","v":1},{"$f":"'F. Physical and Environmental'!B7","v":"F.1.2"},{"$f":"'F. Physical and Environmental'!C7","v":"Are reasonable physical security and environmental controls present in the building/data center that contains Scoped Systems and Data? If yes, does it include:"},{"$f":"'F. Physical and Environmental'!D7","v":0},{"$f":"'F. Physical and Environmental'!E7","v":0},{"$f":"'F. Physical and Environmental'!F7","v":0},{"$f":"'F. Physical and Environmental'!G7","v":"F. Physical and Environmental Security"},{"$f":"'F. Physical and Environmental'!H7","v":11.1},{"$f":"'F. Physical and Environmental'!I7","v":"Secure areas"},null,null,null,9.3000000000000007,"N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A8","v":2561},{"$f":"'F. Physical and Environmental'!J8","v":3},{"$f":"'F. Physical and Environmental'!K8","v":0},{"$f":"'F. Physical and Environmental'!Y8","v":0},{"$f":"'F. Physical and Environmental'!B8","v":"F.1.2.1"},{"$f":"'F. Physical and Environmental'!C8","v":"Signage to identify the operations of the facility (data center)?"},{"$f":"'F. Physical and Environmental'!D8","v":0},{"$f":"'F. Physical and Environmental'!E8","v":0},{"$f":"'F. Physical and Environmental'!F8","v":0},{"$f":"'F. Physical and Environmental'!G8","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H8","v":"11.1.3"},{"$f":"'F. Physical and Environmental'!I8","v":"Securing offices, rooms, and facilities"},null,"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A9","v":351},{"$f":"'F. Physical and Environmental'!J9","v":3},{"$f":"'F. Physical and Environmental'!K9","v":0},{"$f":"'F. Physical and Environmental'!Y9","v":0},{"$f":"'F. Physical and Environmental'!B9","v":"F.1.2.2"},{"$f":"'F. Physical and Environmental'!C9","v":"Other tenants using the building?"},{"$f":"'F. Physical and Environmental'!D9","v":0},{"$f":"'F. Physical and Environmental'!E9","v":0},{"$f":"'F. Physical and Environmental'!F9","v":0},{"$f":"'F. Physical and Environmental'!G9","v":0},{"$f":"'F. Physical and Environmental'!H9","v":"NA"},{"$f":"'F. Physical and Environmental'!I9","v":0},null,"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A10","v":381},{"$f":"'F. Physical and Environmental'!J10","v":3},{"$f":"'F. Physical and Environmental'!K10","v":0},{"$f":"'F. Physical and Environmental'!Y10","v":0},{"$f":"'F. Physical and Environmental'!B10","v":"F.1.2.3"},{"$f":"'F. Physical and Environmental'!C10","v":"Access restricted and logs kept of all access?"},{"$f":"'F. Physical and Environmental'!D10","v":0},{"$f":"'F. Physical and Environmental'!E10","v":0},{"$f":"'F. Physical and Environmental'!F10","v":0},{"$f":"'F. Physical and Environmental'!G10","v":"F.5 Secure Workspace Access Reporting"},{"$f":"'F. Physical and Environmental'!H10","v":"11.1.2"},{"$f":"'F. Physical and Environmental'!I10","v":"Physical entry controls"},null,"DS12.2","Physical security measures",9.3000000000000007,"OPS.2.12.E.5 IS.2.E.3.2 WPS.2.9.1.1","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A11","v":387},{"$f":"'F. Physical and Environmental'!J11","v":3},{"$f":"'F. Physical and Environmental'!K11","v":0},{"$f":"'F. Physical and Environmental'!Y11","v":0},{"$f":"'F. Physical and Environmental'!B11","v":"F.1.2.4"},{"$f":"'F. Physical and Environmental'!C11","v":"Electronic system (key card, token, fob, biometric reader etc.) to control access?"},{"$f":"'F. Physical and Environmental'!D11","v":0},{"$f":"'F. Physical and Environmental'!E11","v":0},{"$f":"'F. Physical and Environmental'!F11","v":0},{"$f":"'F. Physical and Environmental'!G11","v":"F.4 Secure Workspace Perimeter"},{"$f":"'F. Physical and Environmental'!H11","v":"11.1.2"},{"$f":"'F. Physical and Environmental'!I11","v":"Physical entry controls"},null,"DS12.2","Physical security measures",9.1,"N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A12","v":391},{"$f":"'F. Physical and Environmental'!J12","v":3},{"$f":"'F. Physical and Environmental'!K12","v":0},{"$f":"'F. Physical and Environmental'!Y12","v":0},{"$f":"'F. Physical and Environmental'!B12","v":"F.1.2.5"},{"$f":"'F. Physical and Environmental'!C12","v":"Cipher locks (electronic or mechanical) to control access within or to the facility? If yes, is there a process to:"},{"$f":"'F. Physical and Environmental'!D12","v":0},{"$f":"'F. Physical and Environmental'!E12","v":0},{"$f":"'F. Physical and Environmental'!F12","v":0},{"$f":"'F. Physical and Environmental'!G12","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H12","v":"11.1.2"},{"$f":"'F. Physical and Environmental'!I12","v":"Physical entry controls"},null,"DS12.2","Physical security measures",9.1,"N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A13","v":392},{"$f":"'F. Physical and Environmental'!J13","v":4},{"$f":"'F. Physical and Environmental'!K13","v":0},{"$f":"'F. Physical and Environmental'!Y13","v":0},{"$f":"'F. Physical and Environmental'!B13","v":"F.1.2.5.1"},{"$f":"'F. Physical and Environmental'!C13","v":"Change the code(s) at least every 90 days?"},{"$f":"'F. Physical and Environmental'!D13","v":0},{"$f":"'F. Physical and Environmental'!E13","v":0},{"$f":"'F. Physical and Environmental'!F13","v":0},{"$f":"'F. Physical and Environmental'!G13","v":0},{"$f":"'F. Physical and Environmental'!H13","v":"NA"},{"$f":"'F. Physical and Environmental'!I13","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A14","v":394},{"$f":"'F. Physical and Environmental'!J14","v":4},{"$f":"'F. Physical and Environmental'!K14","v":0},{"$f":"'F. Physical and Environmental'!Y14","v":0},{"$f":"'F. Physical and Environmental'!B14","v":"F.1.2.5.2"},{"$f":"'F. Physical and Environmental'!C14","v":"Change the code(s) when an authorized individual is terminated or transferred to another role?"},{"$f":"'F. Physical and Environmental'!D14","v":0},{"$f":"'F. Physical and Environmental'!E14","v":0},{"$f":"'F. Physical and Environmental'!F14","v":0},{"$f":"'F. Physical and Environmental'!G14","v":0},{"$f":"'F. Physical and Environmental'!H14","v":"9.2.1"},{"$f":"'F. Physical and Environmental'!I14","v":"User registration and de-registration"},null,"PO7.8","Job change and termination","N/A","N/A","PO7.8, DS5.4"]
[{"$f":"'F. Physical and Environmental'!A15","v":374},{"$f":"'F. Physical and Environmental'!J15","v":3},{"$f":"'F. Physical and Environmental'!K15","v":0},{"$f":"'F. Physical and Environmental'!Y15","v":0},{"$f":"'F. Physical and Environmental'!B15","v":"F.1.2.6"},{"$f":"'F. Physical and Environmental'!C15","v":"Security guards that provide onsite security services?"},{"$f":"'F. Physical and Environmental'!D15","v":0},{"$f":"'F. Physical and Environmental'!E15","v":0},{"$f":"'F. Physical and Environmental'!F15","v":0},{"$f":"'F. Physical and Environmental'!G15","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H15","v":"11.1.1.c "},{"$f":"'F. Physical and Environmental'!I15","v":"Physical security perimeter"},null,"DS12.1","Site selection and layout","N/A","OPS.2.12.E.6","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A16","v":3288},{"$f":"'F. Physical and Environmental'!J16","v":3},{"$f":"'F. Physical and Environmental'!K16","v":0},{"$f":"'F. Physical and Environmental'!Y16","v":0},{"$f":"'F. Physical and Environmental'!B16","v":"F.1.2.7"},{"$f":"'F. Physical and Environmental'!C16","v":"Perimeter physical barrier (such as fence or walls)?"},{"$f":"'F. Physical and Environmental'!D16","v":0},{"$f":"'F. Physical and Environmental'!E16","v":0},{"$f":"'F. Physical and Environmental'!F16","v":0},{"$f":"'F. Physical and Environmental'!G16","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H16","v":"11.1.1.d "},{"$f":"'F. Physical and Environmental'!I16","v":"Physical security perimeter"},null,"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A17","v":371},{"$f":"'F. Physical and Environmental'!J17","v":3},{"$f":"'F. Physical and Environmental'!K17","v":0},{"$f":"'F. Physical and Environmental'!Y17","v":0},{"$f":"'F. Physical and Environmental'!B17","v":"F.1.2.8"},{"$f":"'F. Physical and Environmental'!C17","v":"Entry and exit doors alarmed (forced entry, propped open) and/or monitored by security guards?"},{"$f":"'F. Physical and Environmental'!D17","v":0},{"$f":"'F. Physical and Environmental'!E17","v":0},{"$f":"'F. Physical and Environmental'!F17","v":0},{"$f":"'F. Physical and Environmental'!G17","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H17","v":"11.1.1.e "},{"$f":"'F. Physical and Environmental'!I17","v":"Physical security perimeter"},null,"DS12.1","Site selection and layout","9.1.1","OPS.2.12.E.10","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A18","v":395},{"$f":"'F. Physical and Environmental'!J18","v":3},{"$f":"'F. Physical and Environmental'!K18","v":0},{"$f":"'F. Physical and Environmental'!Y18","v":0},{"$f":"'F. Physical and Environmental'!B18","v":"F.1.2.9"},{"$f":"'F. Physical and Environmental'!C18","v":"A mechanism to prevent tailgating / piggybacking?"},{"$f":"'F. Physical and Environmental'!D18","v":0},{"$f":"'F. Physical and Environmental'!E18","v":0},{"$f":"'F. Physical and Environmental'!F18","v":0},{"$f":"'F. Physical and Environmental'!G18","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H18","v":"11.1.1.c "},{"$f":"'F. Physical and Environmental'!I18","v":"Physical entry controls"},null,"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A19","v":360},{"$f":"'F. Physical and Environmental'!J19","v":3},{"$f":"'F. Physical and Environmental'!K19","v":0},{"$f":"'F. Physical and Environmental'!Y19","v":0},{"$f":"'F. Physical and Environmental'!B19","v":"F.1.2.10"},{"$f":"'F. Physical and Environmental'!C19","v":"External lighting?"},{"$f":"'F. Physical and Environmental'!D19","v":0},{"$f":"'F. Physical and Environmental'!E19","v":0},{"$f":"'F. Physical and Environmental'!F19","v":0},{"$f":"'F. Physical and Environmental'!G19","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H19","v":0},{"$f":"'F. Physical and Environmental'!I19","v":0},null,"DS12.1","Site selection and layout","N/A","OPS.2.12.E.4","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A20","v":364},{"$f":"'F. Physical and Environmental'!J20","v":3},{"$f":"'F. Physical and Environmental'!K20","v":0},{"$f":"'F. Physical and Environmental'!Y20","v":0},{"$f":"'F. Physical and Environmental'!B20","v":"F.1.2.11"},{"$f":"'F. Physical and Environmental'!C20","v":"Lighting on all doors?"},{"$f":"'F. Physical and Environmental'!D20","v":0},{"$f":"'F. Physical and Environmental'!E20","v":0},{"$f":"'F. Physical and Environmental'!F20","v":0},{"$f":"'F. Physical and Environmental'!G20","v":0},{"$f":"'F. Physical and Environmental'!H20","v":0},{"$f":"'F. Physical and Environmental'!I20","v":0},null,"DS12.1","Site selection and layout","N/A","OPS.2.12.E.4","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A21","v":365},{"$f":"'F. Physical and Environmental'!J21","v":3},{"$f":"'F. Physical and Environmental'!K21","v":0},{"$f":"'F. Physical and Environmental'!Y21","v":0},{"$f":"'F. Physical and Environmental'!B21","v":"F.1.2.12"},{"$f":"'F. Physical and Environmental'!C21","v":"Exterior doors with external hinge pins?"},{"$f":"'F. Physical and Environmental'!D21","v":0},{"$f":"'F. Physical and Environmental'!E21","v":0},{"$f":"'F. Physical and Environmental'!F21","v":0},{"$f":"'F. Physical and Environmental'!G21","v":0},{"$f":"'F. Physical and Environmental'!H21","v":"11.1.1.b "},{"$f":"'F. Physical and Environmental'!I21","v":"Physical security perimeter"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A22","v":358},{"$f":"'F. Physical and Environmental'!J22","v":3},{"$f":"'F. Physical and Environmental'!K22","v":0},{"$f":"'F. Physical and Environmental'!Y22","v":0},{"$f":"'F. Physical and Environmental'!B22","v":"F.1.2.13"},{"$f":"'F. Physical and Environmental'!C22","v":"Windows with contact or break alarms on all windows?"},{"$f":"'F. Physical and Environmental'!D22","v":0},{"$f":"'F. Physical and Environmental'!E22","v":0},{"$f":"'F. Physical and Environmental'!F22","v":0},{"$f":"'F. Physical and Environmental'!G22","v":0},{"$f":"'F. Physical and Environmental'!H22","v":"11.1.1.b "},{"$f":"'F. Physical and Environmental'!I22","v":"Physical security perimeter"},null,"DS12.1","Site selection and layout","N/A","OPS.2.12.E.10","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A23","v":366},{"$f":"'F. Physical and Environmental'!J23","v":3},{"$f":"'F. Physical and Environmental'!K23","v":0},{"$f":"'F. Physical and Environmental'!Y23","v":0},{"$f":"'F. Physical and Environmental'!B23","v":"F.1.2.14"},{"$f":"'F. Physical and Environmental'!C23","v":"CCTV with video stored at least 90 days?"},{"$f":"'F. Physical and Environmental'!D23","v":0},{"$f":"'F. Physical and Environmental'!E23","v":0},{"$f":"'F. Physical and Environmental'!F23","v":0},{"$f":"'F. Physical and Environmental'!G23","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H23","v":"NA"},{"$f":"'F. Physical and Environmental'!I23","v":0},null,null,null,"N/A","IS.2.E.3.2","N/A"]
[{"$f":"'F. Physical and Environmental'!A24","v":566},{"$f":"'F. Physical and Environmental'!J24","v":3},{"$f":"'F. Physical and Environmental'!K24","v":0},{"$f":"'F. Physical and Environmental'!Y24","v":0},{"$f":"'F. Physical and Environmental'!B24","v":"F.1.2.15"},{"$f":"'F. Physical and Environmental'!C24","v":"Fluid or water sensor?"},{"$f":"'F. Physical and Environmental'!D24","v":0},{"$f":"'F. Physical and Environmental'!E24","v":0},{"$f":"'F. Physical and Environmental'!F24","v":0},{"$f":"'F. Physical and Environmental'!G24","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H24","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!I24","v":"Protecting against external and environmental threats"},null,"DS5.7","Protection of security technology","N/A","OPS.2.12.D.6","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A25","v":3297},{"$f":"'F. Physical and Environmental'!J25","v":3},{"$f":"'F. Physical and Environmental'!K25","v":0},{"$f":"'F. Physical and Environmental'!Y25","v":0},{"$f":"'F. Physical and Environmental'!B25","v":"F.1.2.16"},{"$f":"'F. Physical and Environmental'!C25","v":"Air conditioning and humidity controls?"},{"$f":"'F. Physical and Environmental'!D25","v":0},{"$f":"'F. Physical and Environmental'!E25","v":0},{"$f":"'F. Physical and Environmental'!F25","v":0},{"$f":"'F. Physical and Environmental'!G25","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H25","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!I25","v":"Protecting against external and environmental threats"},null,"DS5.7","Protection of security technology","N/A","OPS.1.7.1.3","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A26","v":3298},{"$f":"'F. Physical and Environmental'!J26","v":3},{"$f":"'F. Physical and Environmental'!K26","v":0},{"$f":"'F. Physical and Environmental'!Y26","v":0},{"$f":"'F. Physical and Environmental'!B26","v":"F.1.2.17"},{"$f":"'F. Physical and Environmental'!C26","v":"Heat detection?"},{"$f":"'F. Physical and Environmental'!D26","v":0},{"$f":"'F. Physical and Environmental'!E26","v":0},{"$f":"'F. Physical and Environmental'!F26","v":0},{"$f":"'F. Physical and Environmental'!G26","v":0},{"$f":"'F. Physical and Environmental'!H26","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!I26","v":"Protecting against external and environmental threats"},null,"DS5.7","Protection of security technology","N/A","N/A","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A27","v":569},{"$f":"'F. Physical and Environmental'!J27","v":3},{"$f":"'F. Physical and Environmental'!K27","v":0},{"$f":"'F. Physical and Environmental'!Y27","v":0},{"$f":"'F. Physical and Environmental'!B27","v":"F.1.2.18"},{"$f":"'F. Physical and Environmental'!C27","v":"Smoke detection?"},{"$f":"'F. Physical and Environmental'!D27","v":0},{"$f":"'F. Physical and Environmental'!E27","v":0},{"$f":"'F. Physical and Environmental'!F27","v":0},{"$f":"'F. Physical and Environmental'!G27","v":0},{"$f":"'F. Physical and Environmental'!H27","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!I27","v":"Protecting against external and environmental threats"},null,"DS5.7","Protection of security technology","N/A","OPS.1.7.1.6 OPS.2.12.D.5","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A28","v":3303},{"$f":"'F. Physical and Environmental'!J28","v":3},{"$f":"'F. Physical and Environmental'!K28","v":0},{"$f":"'F. Physical and Environmental'!Y28","v":0},{"$f":"'F. Physical and Environmental'!B28","v":"F.1.2.19"},{"$f":"'F. Physical and Environmental'!C28","v":"Fire suppression?"},{"$f":"'F. Physical and Environmental'!D28","v":0},{"$f":"'F. Physical and Environmental'!E28","v":0},{"$f":"'F. Physical and Environmental'!F28","v":0},{"$f":"'F. Physical and Environmental'!G28","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H28","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!I28","v":"Protecting against external and environmental threats"},null,"DS12.4","Protection against environmental factors","N/A","OPS.1.7.1.6 OPS.2.12.D.5","DS12.4"]
[{"$f":"'F. Physical and Environmental'!A29","v":3289},{"$f":"'F. Physical and Environmental'!J29","v":3},{"$f":"'F. Physical and Environmental'!K29","v":0},{"$f":"'F. Physical and Environmental'!Y29","v":0},{"$f":"'F. Physical and Environmental'!B29","v":"F.1.2.20"},{"$f":"'F. Physical and Environmental'!C29","v":"Multiple power feeds?"},{"$f":"'F. Physical and Environmental'!D29","v":0},{"$f":"'F. Physical and Environmental'!E29","v":0},{"$f":"'F. Physical and Environmental'!F29","v":0},{"$f":"'F. Physical and Environmental'!G29","v":0},{"$f":"'F. Physical and Environmental'!H29","v":"11.2.2"},{"$f":"'F. Physical and Environmental'!I29","v":"Supporting utilities"},null,"DS12.4","Protection against environmental factors","N/A","OPS.1.7.1.1","DS12.4, DS12.5"]
[{"$f":"'F. Physical and Environmental'!A30","v":3290},{"$f":"'F. Physical and Environmental'!J30","v":3},{"$f":"'F. Physical and Environmental'!K30","v":0},{"$f":"'F. Physical and Environmental'!Y30","v":0},{"$f":"'F. Physical and Environmental'!B30","v":"F.1.2.21"},{"$f":"'F. Physical and Environmental'!C30","v":"Multiple communication feeds?"},{"$f":"'F. Physical and Environmental'!D30","v":0},{"$f":"'F. Physical and Environmental'!E30","v":0},{"$f":"'F. Physical and Environmental'!F30","v":0},{"$f":"'F. Physical and Environmental'!G30","v":0},{"$f":"'F. Physical and Environmental'!H30","v":"11.2.2"},{"$f":"'F. Physical and Environmental'!I30","v":"Supporting utilities"},null,"DS12.4","Protection against environmental factors","N/A","N/A","DS12.4, DS12.5"]
[{"$f":"'F. Physical and Environmental'!A31","v":382},{"$f":"'F. Physical and Environmental'!J31","v":3},{"$f":"'F. Physical and Environmental'!K31","v":0},{"$f":"'F. Physical and Environmental'!Y31","v":0},{"$f":"'F. Physical and Environmental'!B31","v":"F.1.2.22"},{"$f":"'F. Physical and Environmental'!C31","v":"Physical access control procedures? If yes, is there:"},{"$f":"'F. Physical and Environmental'!D31","v":0},{"$f":"'F. Physical and Environmental'!E31","v":0},{"$f":"'F. Physical and Environmental'!F31","v":0},{"$f":"'F. Physical and Environmental'!G31","v":0},{"$f":"'F. Physical and Environmental'!H31","v":"11.1.1.a "},{"$f":"'F. Physical and Environmental'!I31","v":"Physical security perimeter"},null,"DS12.1","Site selection and layout","N/A","IS.2.E.3.1","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A32","v":383},{"$f":"'F. Physical and Environmental'!J32","v":4},{"$f":"'F. Physical and Environmental'!K32","v":0},{"$f":"'F. Physical and Environmental'!Y32","v":0},{"$f":"'F. Physical and Environmental'!B32","v":"F.1.2.22.1"},{"$f":"'F. Physical and Environmental'!C32","v":"Segregation of duties for issuing and approving access to the facility (keys, badge, etc.)?"},{"$f":"'F. Physical and Environmental'!D32","v":0},{"$f":"'F. Physical and Environmental'!E32","v":0},{"$f":"'F. Physical and Environmental'!F32","v":0},{"$f":"'F. Physical and Environmental'!G32","v":0},{"$f":"'F. Physical and Environmental'!H32","v":"9.1.1.f "},{"$f":"'F. Physical and Environmental'!I32","v":"Access control policy"},null,"PO2.1","Enterprise information architecture model","N/A","N/A","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'F. Physical and Environmental'!A33","v":384},{"$f":"'F. Physical and Environmental'!J33","v":4},{"$f":"'F. Physical and Environmental'!K33","v":0},{"$f":"'F. Physical and Environmental'!Y33","v":0},{"$f":"'F. Physical and Environmental'!B33","v":"F.1.2.22.2"},{"$f":"'F. Physical and Environmental'!C33","v":"Access reviews at least every six months?"},{"$f":"'F. Physical and Environmental'!D33","v":0},{"$f":"'F. Physical and Environmental'!E33","v":0},{"$f":"'F. Physical and Environmental'!F33","v":0},{"$f":"'F. Physical and Environmental'!G33","v":0},{"$f":"'F. Physical and Environmental'!H33","v":"9.1.1.h                                       9.2.5"},{"$f":"'F. Physical and Environmental'!I33","v":"Access control policy,         Review of user access rights"},null,"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A34","v":389},{"$f":"'F. Physical and Environmental'!J34","v":4},{"$f":"'F. Physical and Environmental'!K34","v":0},{"$f":"'F. Physical and Environmental'!Y34","v":0},{"$f":"'F. Physical and Environmental'!B34","v":"F.1.2.22.3"},{"$f":"'F. Physical and Environmental'!C34","v":"Collection of access equipment (badges, keys, change pin numbers, etc.) when a constituent is terminated or changes status and no longer require access?"},{"$f":"'F. Physical and Environmental'!D34","v":0},{"$f":"'F. Physical and Environmental'!E34","v":0},{"$f":"'F. Physical and Environmental'!F34","v":0},{"$f":"'F. Physical and Environmental'!G34","v":0},{"$f":"'F. Physical and Environmental'!H34","v":"9.1.1.i "},{"$f":"'F. Physical and Environmental'!I34","v":"Access control policy"},null,"DS12.2","Physical security measures","N/A","IS.2.E.3.3","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A35","v":390},{"$f":"'F. Physical and Environmental'!J35","v":4},{"$f":"'F. Physical and Environmental'!K35","v":0},{"$f":"'F. Physical and Environmental'!Y35","v":0},{"$f":"'F. Physical and Environmental'!B35","v":"F.1.2.22.4"},{"$f":"'F. Physical and Environmental'!C35","v":"A process to report lost or stolen access cards / keys?"},{"$f":"'F. Physical and Environmental'!D35","v":0},{"$f":"'F. Physical and Environmental'!E35","v":0},{"$f":"'F. Physical and Environmental'!F35","v":0},{"$f":"'F. Physical and Environmental'!G35","v":0},{"$f":"'F. Physical and Environmental'!H35","v":"11.1.2.d "},{"$f":"'F. Physical and Environmental'!I35","v":"Physical entry controls"},null,"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A36","v":396},{"$f":"'F. Physical and Environmental'!J36","v":2},{"$f":"'F. Physical and Environmental'!K36","v":0},{"$f":"'F. Physical and Environmental'!Y36","v":1},{"$f":"'F. Physical and Environmental'!B36","v":"F.1.3"},{"$f":"'F. Physical and Environmental'!C36","v":"Are visitors permitted in the facility? If yes, are they required to:"},{"$f":"'F. Physical and Environmental'!D36","v":0},{"$f":"'F. Physical and Environmental'!E36","v":0},{"$f":"'F. Physical and Environmental'!F36","v":0},{"$f":"'F. Physical and Environmental'!G36","v":"F.10 Visitor Management"},{"$f":"'F. Physical and Environmental'!H36","v":"11.1.2 "},{"$f":"'F. Physical and Environmental'!I36","v":"Physical entry controls"},null,"DS12.2","Physical security measures",9.4,"OPS.2.12.E.9 WPS.2.9.1.2","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A37","v":397},{"$f":"'F. Physical and Environmental'!J37","v":3},{"$f":"'F. Physical and Environmental'!K37","v":0},{"$f":"'F. Physical and Environmental'!Y37","v":0},{"$f":"'F. Physical and Environmental'!B37","v":"F.1.3.1"},{"$f":"'F. Physical and Environmental'!C37","v":"Sign in and out?"},{"$f":"'F. Physical and Environmental'!D37","v":0},{"$f":"'F. Physical and Environmental'!E37","v":0},{"$f":"'F. Physical and Environmental'!F37","v":0},{"$f":"'F. Physical and Environmental'!G37","v":"F.10 Procedure: b.1"},{"$f":"'F. Physical and Environmental'!H37","v":"11.1.2.a "},{"$f":"'F. Physical and Environmental'!I37","v":"Physical entry controls"},null,"DS12.2","Physical security measures","9.4.4","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A38","v":398},{"$f":"'F. Physical and Environmental'!J38","v":3},{"$f":"'F. Physical and Environmental'!K38","v":0},{"$f":"'F. Physical and Environmental'!Y38","v":0},{"$f":"'F. Physical and Environmental'!B38","v":"F.1.3.2"},{"$f":"'F. Physical and Environmental'!C38","v":"Provide a government issued ID?"},{"$f":"'F. Physical and Environmental'!D38","v":0},{"$f":"'F. Physical and Environmental'!E38","v":0},{"$f":"'F. Physical and Environmental'!F38","v":0},{"$f":"'F. Physical and Environmental'!G38","v":"F.10 Procedure: c"},{"$f":"'F. Physical and Environmental'!H38","v":"11.1.2.a "},{"$f":"'F. Physical and Environmental'!I38","v":"Physical entry controls"},null,"DS12.2","Physical security measures","9.4.2","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A39","v":399},{"$f":"'F. Physical and Environmental'!J39","v":3},{"$f":"'F. Physical and Environmental'!K39","v":0},{"$f":"'F. Physical and Environmental'!Y39","v":0},{"$f":"'F. Physical and Environmental'!B39","v":"F.1.3.3"},{"$f":"'F. Physical and Environmental'!C39","v":"Be escorted through secure areas?"},{"$f":"'F. Physical and Environmental'!D39","v":0},{"$f":"'F. Physical and Environmental'!E39","v":0},{"$f":"'F. Physical and Environmental'!F39","v":0},{"$f":"'F. Physical and Environmental'!G39","v":"F.10 Procedure: c"},{"$f":"'F. Physical and Environmental'!H39","v":0},{"$f":"'F. Physical and Environmental'!I39","v":0},null,"DS12.2","Physical security measures","9.4.1","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A40","v":2944},{"$f":"'F. Physical and Environmental'!J40","v":3},{"$f":"'F. Physical and Environmental'!K40","v":0},{"$f":"'F. Physical and Environmental'!Y40","v":0},{"$f":"'F. Physical and Environmental'!B40","v":"F.1.3.4"},{"$f":"'F. Physical and Environmental'!C40","v":"Wear badge distinguishing them from employees?"},{"$f":"'F. Physical and Environmental'!D40","v":0},{"$f":"'F. Physical and Environmental'!E40","v":0},{"$f":"'F. Physical and Environmental'!F40","v":0},{"$f":"'F. Physical and Environmental'!G40","v":"F.10 Procedure: c"},{"$f":"'F. Physical and Environmental'!H40","v":"11.1.2.a "},{"$f":"'F. Physical and Environmental'!I40","v":"Physical entry controls"},null,null,null,"9.4.2","OPS.2.12.E.9","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A41","v":400},{"$f":"'F. Physical and Environmental'!J41","v":3},{"$f":"'F. Physical and Environmental'!K41","v":0},{"$f":"'F. Physical and Environmental'!Y41","v":0},{"$f":"'F. Physical and Environmental'!B41","v":"F.1.3.5"},{"$f":"'F. Physical and Environmental'!C41","v":"Are visitor logs maintained for at least 90 days?"},{"$f":"'F. Physical and Environmental'!D41","v":0},{"$f":"'F. Physical and Environmental'!E41","v":0},{"$f":"'F. Physical and Environmental'!F41","v":0},{"$f":"'F. Physical and Environmental'!G41","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H41","v":"NA"},{"$f":"'F. Physical and Environmental'!I41","v":0},null,"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A42","v":492},{"$f":"'F. Physical and Environmental'!J42","v":2},{"$f":"'F. Physical and Environmental'!K42","v":0},{"$f":"'F. Physical and Environmental'!Y42","v":0},{"$f":"'F. Physical and Environmental'!B42","v":"F.1.4"},{"$f":"'F. Physical and Environmental'!C42","v":"Is there a loading dock at the facility? If yes, is there:"},{"$f":"'F. Physical and Environmental'!D42","v":0},{"$f":"'F. Physical and Environmental'!E42","v":0},{"$f":"'F. Physical and Environmental'!F42","v":0},{"$f":"'F. Physical and Environmental'!G42","v":0},{"$f":"'F. Physical and Environmental'!H42","v":"11.1.6"},{"$f":"'F. Physical and Environmental'!I42","v":"Delivery and loading areas"},null,"AI7.10","System distribution","N/A","N/A","DS5.7, DS12.1, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A43","v":493},{"$f":"'F. Physical and Environmental'!J43","v":3},{"$f":"'F. Physical and Environmental'!K43","v":0},{"$f":"'F. Physical and Environmental'!Y43","v":0},{"$f":"'F. Physical and Environmental'!B43","v":"F.1.4.1"},{"$f":"'F. Physical and Environmental'!C43","v":"Any other tenants using the loading dock?"},{"$f":"'F. Physical and Environmental'!D43","v":0},{"$f":"'F. Physical and Environmental'!E43","v":0},{"$f":"'F. Physical and Environmental'!F43","v":0},{"$f":"'F. Physical and Environmental'!G43","v":0},{"$f":"'F. Physical and Environmental'!H43","v":"NA"},{"$f":"'F. Physical and Environmental'!I43","v":0},null,"AI7.10","System distribution","N/A","N/A","DS5.7, DS12.1, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A44","v":495},{"$f":"'F. Physical and Environmental'!J44","v":3},{"$f":"'F. Physical and Environmental'!K44","v":0},{"$f":"'F. Physical and Environmental'!Y44","v":0},{"$f":"'F. Physical and Environmental'!B44","v":"F.1.4.2"},{"$f":"'F. Physical and Environmental'!C44","v":"A security guards at each point of entry?"},{"$f":"'F. Physical and Environmental'!D44","v":0},{"$f":"'F. Physical and Environmental'!E44","v":0},{"$f":"'F. Physical and Environmental'!F44","v":0},{"$f":"'F. Physical and Environmental'!G44","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H44","v":"NA"},{"$f":"'F. Physical and Environmental'!I44","v":0},null,"AI7.10","System distribution","N/A","N/A","DS5.7, DS12.1, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A45","v":513},{"$f":"'F. Physical and Environmental'!J45","v":3},{"$f":"'F. Physical and Environmental'!K45","v":0},{"$f":"'F. Physical and Environmental'!Y45","v":0},{"$f":"'F. Physical and Environmental'!B45","v":"F.1.4.3"},{"$f":"'F. Physical and Environmental'!C45","v":"Smoke detector?"},{"$f":"'F. Physical and Environmental'!D45","v":0},{"$f":"'F. Physical and Environmental'!E45","v":0},{"$f":"'F. Physical and Environmental'!F45","v":0},{"$f":"'F. Physical and Environmental'!G45","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H45","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!I45","v":"Protecting against external and environmental threats"},null,"DS5.7","Protection of security technology","N/A","OPS.1.7.1.6 OPS.2.12.D.5","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A46","v":514},{"$f":"'F. Physical and Environmental'!J46","v":3},{"$f":"'F. Physical and Environmental'!K46","v":0},{"$f":"'F. Physical and Environmental'!Y46","v":0},{"$f":"'F. Physical and Environmental'!B46","v":"F.1.4.4"},{"$f":"'F. Physical and Environmental'!C46","v":"Fire alarm?"},{"$f":"'F. Physical and Environmental'!D46","v":0},{"$f":"'F. Physical and Environmental'!E46","v":0},{"$f":"'F. Physical and Environmental'!F46","v":0},{"$f":"'F. Physical and Environmental'!G46","v":0},{"$f":"'F. Physical and Environmental'!H46","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!I46","v":"Protecting against external and environmental threats"},null,"DS5.7","Protection of security technology","N/A","N/A","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A47","v":516},{"$f":"'F. Physical and Environmental'!J47","v":3},{"$f":"'F. Physical and Environmental'!K47","v":0},{"$f":"'F. Physical and Environmental'!Y47","v":0},{"$f":"'F. Physical and Environmental'!B47","v":"F.1.4.5"},{"$f":"'F. Physical and Environmental'!C47","v":"Fire suppression?"},{"$f":"'F. Physical and Environmental'!D47","v":0},{"$f":"'F. Physical and Environmental'!E47","v":0},{"$f":"'F. Physical and Environmental'!F47","v":0},{"$f":"'F. Physical and Environmental'!G47","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H47","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!I47","v":"Protecting against external and environmental threats"},null,"DS12.4","Protection against environmental factors","N/A","N/A","DS12.4"]
[{"$f":"'F. Physical and Environmental'!A48","v":508},{"$f":"'F. Physical and Environmental'!J48","v":3},{"$f":"'F. Physical and Environmental'!K48","v":0},{"$f":"'F. Physical and Environmental'!Y48","v":0},{"$f":"'F. Physical and Environmental'!B48","v":"F.1.4.6"},{"$f":"'F. Physical and Environmental'!C48","v":"CCTV and the video stored for at least 90 days?"},{"$f":"'F. Physical and Environmental'!D48","v":0},{"$f":"'F. Physical and Environmental'!E48","v":0},{"$f":"'F. Physical and Environmental'!F48","v":0},{"$f":"'F. Physical and Environmental'!G48","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H48","v":"NA"},{"$f":"'F. Physical and Environmental'!I48","v":0},null,"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A49","v":3203},{"$f":"'F. Physical and Environmental'!J49","v":3},{"$f":"'F. Physical and Environmental'!K49","v":0},{"$f":"'F. Physical and Environmental'!Y49","v":0},{"$f":"'F. Physical and Environmental'!B49","v":"F.1.4.7"},{"$f":"'F. Physical and Environmental'!C49","v":"Restricted access and logs kept of all access?"},{"$f":"'F. Physical and Environmental'!D49","v":0},{"$f":"'F. Physical and Environmental'!E49","v":0},{"$f":"'F. Physical and Environmental'!F49","v":0},{"$f":"'F. Physical and Environmental'!G49","v":0},{"$f":"'F. Physical and Environmental'!H49","v":"11.1.2.c "},{"$f":"'F. Physical and Environmental'!I49","v":"Physical entry controls"},null,"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A50","v":541},{"$f":"'F. Physical and Environmental'!J50","v":2},{"$f":"'F. Physical and Environmental'!K50","v":0},{"$f":"'F. Physical and Environmental'!Y50","v":0},{"$f":"'F. Physical and Environmental'!B50","v":"F.1.5"},{"$f":"'F. Physical and Environmental'!C50","v":"Is there a battery/UPS room? If yes, does it contain:"},{"$f":"'F. Physical and Environmental'!D50","v":0},{"$f":"'F. Physical and Environmental'!E50","v":0},{"$f":"'F. Physical and Environmental'!F50","v":0},{"$f":"'F. Physical and Environmental'!G50","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H50","v":"11.2.2 "},{"$f":"'F. Physical and Environmental'!I50","v":"Supporting utilities"},null,"DS12.4","Protection against environmental factors","N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A51","v":543},{"$f":"'F. Physical and Environmental'!J51","v":3},{"$f":"'F. Physical and Environmental'!K51","v":0},{"$f":"'F. Physical and Environmental'!Y51","v":0},{"$f":"'F. Physical and Environmental'!B51","v":"F.1.5.1"},{"$f":"'F. Physical and Environmental'!C51","v":"Hydrogen sensors?"},{"$f":"'F. Physical and Environmental'!D51","v":0},{"$f":"'F. Physical and Environmental'!E51","v":0},{"$f":"'F. Physical and Environmental'!F51","v":0},{"$f":"'F. Physical and Environmental'!G51","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H51","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!I51","v":"Protecting against external and environmental threats"},null,"DS5.7","Protection of security technology","N/A","N/A","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A52","v":570},{"$f":"'F. Physical and Environmental'!J52","v":3},{"$f":"'F. Physical and Environmental'!K52","v":0},{"$f":"'F. Physical and Environmental'!Y52","v":0},{"$f":"'F. Physical and Environmental'!B52","v":"F.1.5.2"},{"$f":"'F. Physical and Environmental'!C52","v":"Monitored fire alarm?"},{"$f":"'F. Physical and Environmental'!D52","v":0},{"$f":"'F. Physical and Environmental'!E52","v":0},{"$f":"'F. Physical and Environmental'!F52","v":0},{"$f":"'F. Physical and Environmental'!G52","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H52","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!I52","v":"Protecting against external and environmental threats"},null,"DS5.7","Protection of security technology","N/A","N/A","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A53","v":3204},{"$f":"'F. Physical and Environmental'!J53","v":3},{"$f":"'F. Physical and Environmental'!K53","v":0},{"$f":"'F. Physical and Environmental'!Y53","v":0},{"$f":"'F. Physical and Environmental'!B53","v":"F.1.5.3"},{"$f":"'F. Physical and Environmental'!C53","v":"Fire suppression system?"},{"$f":"'F. Physical and Environmental'!D53","v":0},{"$f":"'F. Physical and Environmental'!E53","v":0},{"$f":"'F. Physical and Environmental'!F53","v":0},{"$f":"'F. Physical and Environmental'!G53","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H53","v":"11.1.4"},{"$f":"'F. Physical and Environmental'!I53","v":"Protecting against external and environmental threats"},null,"DS12.4","Protection against environmental factors","N/A","OPS.1.7.1.6 OPS.2.12.D.5","DS12.4"]
[{"$f":"'F. Physical and Environmental'!A54","v":560},{"$f":"'F. Physical and Environmental'!J54","v":3},{"$f":"'F. Physical and Environmental'!K54","v":0},{"$f":"'F. Physical and Environmental'!Y54","v":0},{"$f":"'F. Physical and Environmental'!B54","v":"F.1.5.4"},{"$f":"'F. Physical and Environmental'!C54","v":"CCTV and the video stored for at least 90 days?"},{"$f":"'F. Physical and Environmental'!D54","v":0},{"$f":"'F. Physical and Environmental'!E54","v":0},{"$f":"'F. Physical and Environmental'!F54","v":0},{"$f":"'F. Physical and Environmental'!G54","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H54","v":"NA"},{"$f":"'F. Physical and Environmental'!I54","v":0},null,"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A55","v":546},{"$f":"'F. Physical and Environmental'!J55","v":3},{"$f":"'F. Physical and Environmental'!K55","v":0},{"$f":"'F. Physical and Environmental'!Y55","v":0},{"$f":"'F. Physical and Environmental'!B55","v":"F.1.5.5"},{"$f":"'F. Physical and Environmental'!C55","v":"Restricted access and logs kept of all access?"},{"$f":"'F. Physical and Environmental'!D55","v":0},{"$f":"'F. Physical and Environmental'!E55","v":0},{"$f":"'F. Physical and Environmental'!F55","v":0},{"$f":"'F. Physical and Environmental'!G55","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H55","v":"11.1.2.c"},{"$f":"'F. Physical and Environmental'!I55","v":"Physical entry controls"},null,"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A56","v":454},{"$f":"'F. Physical and Environmental'!J56","v":3},{"$f":"'F. Physical and Environmental'!K56","v":0},{"$f":"'F. Physical and Environmental'!Y56","v":0},{"$f":"'F. Physical and Environmental'!B56","v":"F.1.5.6"},{"$f":"'F. Physical and Environmental'!C56","v":"Does UPS support N+1?"},{"$f":"'F. Physical and Environmental'!D56","v":0},{"$f":"'F. Physical and Environmental'!E56","v":0},{"$f":"'F. Physical and Environmental'!F56","v":0},{"$f":"'F. Physical and Environmental'!G56","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H56","v":"11.2.2 "},{"$f":"'F. Physical and Environmental'!I56","v":"Supporting utilities"},null,"DS12.4","Protection against environmental factors","N/A","N/A","DS12.4, DS12.5"]
[{"$f":"'F. Physical and Environmental'!A57","v":621},{"$f":"'F. Physical and Environmental'!J57","v":2},{"$f":"'F. Physical and Environmental'!K57","v":0},{"$f":"'F. Physical and Environmental'!Y57","v":0},{"$f":"'F. Physical and Environmental'!B57","v":"F.1.6"},{"$f":"'F. Physical and Environmental'!C57","v":"Is there a generator or generator area? If yes, is there:"},{"$f":"'F. Physical and Environmental'!D57","v":0},{"$f":"'F. Physical and Environmental'!E57","v":0},{"$f":"'F. Physical and Environmental'!F57","v":0},{"$f":"'F. Physical and Environmental'!G57","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H57","v":"11.2.2 "},{"$f":"'F. Physical and Environmental'!I57","v":"Supporting utilities"},null,"DS12.4","Protection against environmental factors","N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A58","v":627},{"$f":"'F. Physical and Environmental'!J58","v":3},{"$f":"'F. Physical and Environmental'!K58","v":0},{"$f":"'F. Physical and Environmental'!Y58","v":0},{"$f":"'F. Physical and Environmental'!B58","v":"F.1.6.1"},{"$f":"'F. Physical and Environmental'!C58","v":"A fuel supply readily available to ensure uninterrupted service?"},{"$f":"'F. Physical and Environmental'!D58","v":0},{"$f":"'F. Physical and Environmental'!E58","v":0},{"$f":"'F. Physical and Environmental'!F58","v":0},{"$f":"'F. Physical and Environmental'!G58","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H58","v":"11.2.2 "},{"$f":"'F. Physical and Environmental'!I58","v":"Supporting utilities"},null,"DS12.4","Protection against environmental factors","N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A59","v":628},{"$f":"'F. Physical and Environmental'!J59","v":3},{"$f":"'F. Physical and Environmental'!K59","v":0},{"$f":"'F. Physical and Environmental'!Y59","v":0},{"$f":"'F. Physical and Environmental'!B59","v":"F.1.6.2"},{"$f":"'F. Physical and Environmental'!C59","v":"Adequate capacity to supply power for at least 48 hours?"},{"$f":"'F. Physical and Environmental'!D59","v":0},{"$f":"'F. Physical and Environmental'!E59","v":0},{"$f":"'F. Physical and Environmental'!F59","v":0},{"$f":"'F. Physical and Environmental'!G59","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H59","v":"11.2.2 "},{"$f":"'F. Physical and Environmental'!I59","v":"Supporting utilities"},null,"DS12.4","Protection against environmental factors","N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A60","v":629},{"$f":"'F. Physical and Environmental'!J60","v":3},{"$f":"'F. Physical and Environmental'!K60","v":0},{"$f":"'F. Physical and Environmental'!Y60","v":0},{"$f":"'F. Physical and Environmental'!B60","v":"F.1.6.3"},{"$f":"'F. Physical and Environmental'!C60","v":"Restricted access and logs kept of all access?"},{"$f":"'F. Physical and Environmental'!D60","v":0},{"$f":"'F. Physical and Environmental'!E60","v":0},{"$f":"'F. Physical and Environmental'!F60","v":0},{"$f":"'F. Physical and Environmental'!G60","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H60","v":"11.1.2.c"},{"$f":"'F. Physical and Environmental'!I60","v":"Physical Entry Controls"},null,"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A61","v":640},{"$f":"'F. Physical and Environmental'!J61","v":3},{"$f":"'F. Physical and Environmental'!K61","v":0},{"$f":"'F. Physical and Environmental'!Y61","v":0},{"$f":"'F. Physical and Environmental'!B61","v":"F.1.6.4"},{"$f":"'F. Physical and Environmental'!C61","v":"CCTV and the video stored for at least 90 days?"},{"$f":"'F. Physical and Environmental'!D61","v":0},{"$f":"'F. Physical and Environmental'!E61","v":0},{"$f":"'F. Physical and Environmental'!F61","v":0},{"$f":"'F. Physical and Environmental'!G61","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H61","v":"NA"},{"$f":"'F. Physical and Environmental'!I61","v":0},null,"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A62","v":656},{"$f":"'F. Physical and Environmental'!J62","v":2},{"$f":"'F. Physical and Environmental'!K62","v":0},{"$f":"'F. Physical and Environmental'!Y62","v":0},{"$f":"'F. Physical and Environmental'!B62","v":"F.1.7"},{"$f":"'F. Physical and Environmental'!C62","v":"Is there a mailroom that handles Scoped Data? If yes, is access:"},{"$f":"'F. Physical and Environmental'!D62","v":0},{"$f":"'F. Physical and Environmental'!E62","v":0},{"$f":"'F. Physical and Environmental'!F62","v":0},{"$f":"'F. Physical and Environmental'!G62","v":0},{"$f":"'F. Physical and Environmental'!H62","v":"12.1.1"},{"$f":"'F. Physical and Environmental'!I62","v":"Documented operating procedures"},null,"AI1.1","Definition and maintenance of business functional and technical requirements","N/A","N/A","AI1.1, AI4.4, DS13.1"]
[{"$f":"'F. Physical and Environmental'!A63","v":660},{"$f":"'F. Physical and Environmental'!J63","v":3},{"$f":"'F. Physical and Environmental'!K63","v":0},{"$f":"'F. Physical and Environmental'!Y63","v":0},{"$f":"'F. Physical and Environmental'!B63","v":"F.1.7.1"},{"$f":"'F. Physical and Environmental'!C63","v":"Restricted access and logs kept of all access?"},{"$f":"'F. Physical and Environmental'!D63","v":0},{"$f":"'F. Physical and Environmental'!E63","v":0},{"$f":"'F. Physical and Environmental'!F63","v":0},{"$f":"'F. Physical and Environmental'!G63","v":0},{"$f":"'F. Physical and Environmental'!H63","v":"11.1.2.c"},{"$f":"'F. Physical and Environmental'!I63","v":"Physical entry controls"},null,"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A64","v":3291},{"$f":"'F. Physical and Environmental'!J64","v":3},{"$f":"'F. Physical and Environmental'!K64","v":0},{"$f":"'F. Physical and Environmental'!Y64","v":0},{"$f":"'F. Physical and Environmental'!B64","v":"F.1.7.2"},{"$f":"'F. Physical and Environmental'!C64","v":"CCTV and the video stored for at least 90 days?"},{"$f":"'F. Physical and Environmental'!D64","v":0},{"$f":"'F. Physical and Environmental'!E64","v":0},{"$f":"'F. Physical and Environmental'!F64","v":0},{"$f":"'F. Physical and Environmental'!G64","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H64","v":"NA"},{"$f":"'F. Physical and Environmental'!I64","v":0},null,"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A65","v":685},{"$f":"'F. Physical and Environmental'!J65","v":2},{"$f":"'F. Physical and Environmental'!K65","v":0},{"$f":"'F. Physical and Environmental'!Y65","v":0},{"$f":"'F. Physical and Environmental'!B65","v":"F.1.8"},{"$f":"'F. Physical and Environmental'!C65","v":"Is there a media library to store Scoped Data? If yes, is access:"},{"$f":"'F. Physical and Environmental'!D65","v":0},{"$f":"'F. Physical and Environmental'!E65","v":0},{"$f":"'F. Physical and Environmental'!F65","v":0},{"$f":"'F. Physical and Environmental'!G65","v":0},{"$f":"'F. Physical and Environmental'!H65","v":"12.1.1"},{"$f":"'F. Physical and Environmental'!I65","v":"Documented operating procedures"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A66","v":694},{"$f":"'F. Physical and Environmental'!J66","v":3},{"$f":"'F. Physical and Environmental'!K66","v":0},{"$f":"'F. Physical and Environmental'!Y66","v":0},{"$f":"'F. Physical and Environmental'!B66","v":"F.1.8.1"},{"$f":"'F. Physical and Environmental'!C66","v":"Restricted and logs kept of all access?"},{"$f":"'F. Physical and Environmental'!D66","v":0},{"$f":"'F. Physical and Environmental'!E66","v":0},{"$f":"'F. Physical and Environmental'!F66","v":0},{"$f":"'F. Physical and Environmental'!G66","v":0},{"$f":"'F. Physical and Environmental'!H66","v":"11.1.2.c"},{"$f":"'F. Physical and Environmental'!I66","v":"Physical entry controls"},null,"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A67","v":3292},{"$f":"'F. Physical and Environmental'!J67","v":3},{"$f":"'F. Physical and Environmental'!K67","v":0},{"$f":"'F. Physical and Environmental'!Y67","v":0},{"$f":"'F. Physical and Environmental'!B67","v":"F.1.8.2"},{"$f":"'F. Physical and Environmental'!C67","v":"CCTV and the video stored for at least 90 days?"},{"$f":"'F. Physical and Environmental'!D67","v":0},{"$f":"'F. Physical and Environmental'!E67","v":0},{"$f":"'F. Physical and Environmental'!F67","v":0},{"$f":"'F. Physical and Environmental'!G67","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H67","v":"NA"},{"$f":"'F. Physical and Environmental'!I67","v":0},null,"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A68","v":778},{"$f":"'F. Physical and Environmental'!J68","v":2},{"$f":"'F. Physical and Environmental'!K68","v":0},{"$f":"'F. Physical and Environmental'!Y68","v":0},{"$f":"'F. Physical and Environmental'!B68","v":"F.1.9"},{"$f":"'F. Physical and Environmental'!C68","v":"Is there a separate room for telecom equipment? If yes, is access:"},{"$f":"'F. Physical and Environmental'!D68","v":0},{"$f":"'F. Physical and Environmental'!E68","v":0},{"$f":"'F. Physical and Environmental'!F68","v":0},{"$f":"'F. Physical and Environmental'!G68","v":0},{"$f":"'F. Physical and Environmental'!H68","v":"12.1.1"},{"$f":"'F. Physical and Environmental'!I68","v":"Documented operating procedures"},null,null,null,"N/A","OPS.1.7.1.2","N/A"]
[{"$f":"'F. Physical and Environmental'!A69","v":781},{"$f":"'F. Physical and Environmental'!J69","v":3},{"$f":"'F. Physical and Environmental'!K69","v":0},{"$f":"'F. Physical and Environmental'!Y69","v":0},{"$f":"'F. Physical and Environmental'!B69","v":"F.1.9.1"},{"$f":"'F. Physical and Environmental'!C69","v":"Monitored with CCTV and the video stored for 90 days?"},{"$f":"'F. Physical and Environmental'!D69","v":0},{"$f":"'F. Physical and Environmental'!E69","v":0},{"$f":"'F. Physical and Environmental'!F69","v":0},{"$f":"'F. Physical and Environmental'!G69","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H69","v":"NA"},{"$f":"'F. Physical and Environmental'!I69","v":0},null,"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A70","v":786},{"$f":"'F. Physical and Environmental'!J70","v":3},{"$f":"'F. Physical and Environmental'!K70","v":0},{"$f":"'F. Physical and Environmental'!Y70","v":0},{"$f":"'F. Physical and Environmental'!B70","v":"F.1.9.2"},{"$f":"'F. Physical and Environmental'!C70","v":"Restricted and logs kept of all access?"},{"$f":"'F. Physical and Environmental'!D70","v":0},{"$f":"'F. Physical and Environmental'!E70","v":0},{"$f":"'F. Physical and Environmental'!F70","v":0},{"$f":"'F. Physical and Environmental'!G70","v":0},{"$f":"'F. Physical and Environmental'!H70","v":"11.1.2.c"},{"$f":"'F. Physical and Environmental'!I70","v":"Physical entry controls"},null,"DS5.7","Protection of security technology","N/A","OPS.1.8.2.1","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A71","v":401},{"$f":"'F. Physical and Environmental'!J71","v":1},{"$f":"'F. Physical and Environmental'!K71","v":0},{"$f":"'F. Physical and Environmental'!Y71","v":0},{"$f":"'F. Physical and Environmental'!B71","v":"F.2"},{"$f":"'F. Physical and Environmental'!C71","v":"Do the Scoped Systems and Data reside in a data center? If yes, is there:"},{"$f":"'F. Physical and Environmental'!D71","v":0},{"$f":"'F. Physical and Environmental'!E71","v":0},{"$f":"'F. Physical and Environmental'!F71","v":0},{"$f":"'F. Physical and Environmental'!G71","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H71","v":"11.2.1.b"},{"$f":"'F. Physical and Environmental'!I71","v":"Equipment siting and protection"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A72","v":435},{"$f":"'F. Physical and Environmental'!J72","v":2},{"$f":"'F. Physical and Environmental'!K72","v":0},{"$f":"'F. Physical and Environmental'!Y72","v":0},{"$f":"'F. Physical and Environmental'!B72","v":"F.2.1"},{"$f":"'F. Physical and Environmental'!C72","v":"Fluid or water sensor?"},{"$f":"'F. Physical and Environmental'!D72","v":0},{"$f":"'F. Physical and Environmental'!E72","v":0},{"$f":"'F. Physical and Environmental'!F72","v":0},{"$f":"'F. Physical and Environmental'!G72","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H72","v":0},{"$f":"'F. Physical and Environmental'!I72","v":0},null,"DS5.7","Protection of security technology","N/A","OPS.2.12.D.6","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A73","v":434},{"$f":"'F. Physical and Environmental'!J73","v":2},{"$f":"'F. Physical and Environmental'!K73","v":0},{"$f":"'F. Physical and Environmental'!Y73","v":0},{"$f":"'F. Physical and Environmental'!B73","v":"F.2.2"},{"$f":"'F. Physical and Environmental'!C73","v":"Air conditioning?"},{"$f":"'F. Physical and Environmental'!D73","v":0},{"$f":"'F. Physical and Environmental'!E73","v":0},{"$f":"'F. Physical and Environmental'!F73","v":0},{"$f":"'F. Physical and Environmental'!G73","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H73","v":"11.2.1.e"},{"$f":"'F. Physical and Environmental'!I73","v":"Equipment siting and protection"},null,"DS5.7","Protection of security technology","N/A","OPS.1.7.1.3","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A74","v":436},{"$f":"'F. Physical and Environmental'!J74","v":2},{"$f":"'F. Physical and Environmental'!K74","v":0},{"$f":"'F. Physical and Environmental'!Y74","v":0},{"$f":"'F. Physical and Environmental'!B74","v":"F.2.3"},{"$f":"'F. Physical and Environmental'!C74","v":"Heat detection?"},{"$f":"'F. Physical and Environmental'!D74","v":0},{"$f":"'F. Physical and Environmental'!E74","v":0},{"$f":"'F. Physical and Environmental'!F74","v":0},{"$f":"'F. Physical and Environmental'!G74","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H74","v":"11.2.1.e"},{"$f":"'F. Physical and Environmental'!I74","v":"Equipment siting and protection"},null,"DS5.7","Protection of security technology","N/A","N/A","DS5.7, DS12.4"]
[{"$f":"'F. Physical and Environmental'!A75","v":439},{"$f":"'F. Physical and Environmental'!J75","v":2},{"$f":"'F. Physical and Environmental'!K75","v":0},{"$f":"'F. Physical and Environmental'!Y75","v":0},{"$f":"'F. Physical and Environmental'!B75","v":"F.2.4"},{"$f":"'F. Physical and Environmental'!C75","v":"Smoke detection?"},{"$f":"'F. Physical and Environmental'!D75","v":0},{"$f":"'F. Physical and Environmental'!E75","v":0},{"$f":"'F. Physical and Environmental'!F75","v":0},{"$f":"'F. Physical and Environmental'!G75","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H75","v":"11.2.1.e"},{"$f":"'F. Physical and Environmental'!I75","v":"Equipment siting and protection"},null,"DS5.7","Protection of security technology","N/A","OPS.1.7.1.6 OPS.2.12.D.5","DS12.4, DS12.5"]
[{"$f":"'F. Physical and Environmental'!A76","v":441},{"$f":"'F. Physical and Environmental'!J76","v":2},{"$f":"'F. Physical and Environmental'!K76","v":0},{"$f":"'F. Physical and Environmental'!Y76","v":0},{"$f":"'F. Physical and Environmental'!B76","v":"F.2.5"},{"$f":"'F. Physical and Environmental'!C76","v":"Vibration alarm / sensor?"},{"$f":"'F. Physical and Environmental'!D76","v":0},{"$f":"'F. Physical and Environmental'!E76","v":0},{"$f":"'F. Physical and Environmental'!F76","v":0},{"$f":"'F. Physical and Environmental'!G76","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H76","v":"11.2.1.e"},{"$f":"'F. Physical and Environmental'!I76","v":"Equipment siting and protection"},null,"DS5.7","Protection of security technology","N/A","N/A","DS12.4, DS12.5"]
[{"$f":"'F. Physical and Environmental'!A77","v":442},{"$f":"'F. Physical and Environmental'!J77","v":2},{"$f":"'F. Physical and Environmental'!K77","v":0},{"$f":"'F. Physical and Environmental'!Y77","v":0},{"$f":"'F. Physical and Environmental'!B77","v":"F.2.6"},{"$f":"'F. Physical and Environmental'!C77","v":"Monitored fire alarm?"},{"$f":"'F. Physical and Environmental'!D77","v":0},{"$f":"'F. Physical and Environmental'!E77","v":0},{"$f":"'F. Physical and Environmental'!F77","v":0},{"$f":"'F. Physical and Environmental'!G77","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H77","v":"11.2.1.e"},{"$f":"'F. Physical and Environmental'!I77","v":"Equipment siting and protection"},null,"DS5.7","Protection of security technology","N/A","N/A","DS12.4, DS12.5"]
[{"$f":"'F. Physical and Environmental'!A78","v":443},{"$f":"'F. Physical and Environmental'!J78","v":2},{"$f":"'F. Physical and Environmental'!K78","v":0},{"$f":"'F. Physical and Environmental'!Y78","v":0},{"$f":"'F. Physical and Environmental'!B78","v":"F.2.7"},{"$f":"'F. Physical and Environmental'!C78","v":"Fire suppression (e.g., dry, chemical, wet pipe)?"},{"$f":"'F. Physical and Environmental'!D78","v":0},{"$f":"'F. Physical and Environmental'!E78","v":0},{"$f":"'F. Physical and Environmental'!F78","v":0},{"$f":"'F. Physical and Environmental'!G78","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H78","v":"11.2.1.e"},{"$f":"'F. Physical and Environmental'!I78","v":"Equipment siting and protection"},null,"DS12.4","Protection against environmental factors","N/A","OPS.1.7.1.6 OPS.2.12.D.5","DS12.4"]
[{"$f":"'F. Physical and Environmental'!A79","v":447},{"$f":"'F. Physical and Environmental'!J79","v":2},{"$f":"'F. Physical and Environmental'!K79","v":0},{"$f":"'F. Physical and Environmental'!Y79","v":0},{"$f":"'F. Physical and Environmental'!B79","v":"F.2.8"},{"$f":"'F. Physical and Environmental'!C79","v":"Multiple power feeds?"},{"$f":"'F. Physical and Environmental'!D79","v":0},{"$f":"'F. Physical and Environmental'!E79","v":0},{"$f":"'F. Physical and Environmental'!F79","v":0},{"$f":"'F. Physical and Environmental'!G79","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H79","v":"11.2.2"},{"$f":"'F. Physical and Environmental'!I79","v":"Supporting utilities"},null,"DS12.4","Protection against environmental factors","N/A","OPS.1.7.1.1","DS12.4, DS12.5"]
[{"$f":"'F. Physical and Environmental'!A80","v":448},{"$f":"'F. Physical and Environmental'!J80","v":2},{"$f":"'F. Physical and Environmental'!K80","v":0},{"$f":"'F. Physical and Environmental'!Y80","v":0},{"$f":"'F. Physical and Environmental'!B80","v":"F.2.9"},{"$f":"'F. Physical and Environmental'!C80","v":"Multiple communication feeds?"},{"$f":"'F. Physical and Environmental'!D80","v":0},{"$f":"'F. Physical and Environmental'!E80","v":0},{"$f":"'F. Physical and Environmental'!F80","v":0},{"$f":"'F. Physical and Environmental'!G80","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H80","v":"11.2.2"},{"$f":"'F. Physical and Environmental'!I80","v":"Supporting utilities"},null,"DS12.4","Protection against environmental factors","N/A","N/A","DS12.4, DS12.5"]
[{"$f":"'F. Physical and Environmental'!A81","v":455},{"$f":"'F. Physical and Environmental'!J81","v":2},{"$f":"'F. Physical and Environmental'!K81","v":0},{"$f":"'F. Physical and Environmental'!Y81","v":0},{"$f":"'F. Physical and Environmental'!B81","v":"F.2.10"},{"$f":"'F. Physical and Environmental'!C81","v":"Are there generator(s)?"},{"$f":"'F. Physical and Environmental'!D81","v":0},{"$f":"'F. Physical and Environmental'!E81","v":0},{"$f":"'F. Physical and Environmental'!F81","v":0},{"$f":"'F. Physical and Environmental'!G81","v":"F.1 Environmental Controls – Computing Hardware"},{"$f":"'F. Physical and Environmental'!H81","v":"11.2.2"},{"$f":"'F. Physical and Environmental'!I81","v":"Supporting utilities"},null,"DS12.4","Protection against environmental factors","N/A","N/A","DS12.4, DS12.5"]
[{"$f":"'F. Physical and Environmental'!A82","v":403},{"$f":"'F. Physical and Environmental'!J82","v":2},{"$f":"'F. Physical and Environmental'!K82","v":0},{"$f":"'F. Physical and Environmental'!Y82","v":0},{"$f":"'F. Physical and Environmental'!B82","v":"F.2.11"},{"$f":"'F. Physical and Environmental'!C82","v":"Is access to the data center restricted and logs kept of all access?"},{"$f":"'F. Physical and Environmental'!D82","v":0},{"$f":"'F. Physical and Environmental'!E82","v":0},{"$f":"'F. Physical and Environmental'!F82","v":0},{"$f":"'F. Physical and Environmental'!G82","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H82","v":"11.1.2.c"},{"$f":"'F. Physical and Environmental'!I82","v":"Physical entry controls"},null,"DS12.1","Site selection and layout","9.1.1","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A83","v":411},{"$f":"'F. Physical and Environmental'!J83","v":3},{"$f":"'F. Physical and Environmental'!K83","v":0},{"$f":"'F. Physical and Environmental'!Y83","v":0},{"$f":"'F. Physical and Environmental'!B83","v":"F.2.11.1"},{"$f":"'F. Physical and Environmental'!C83","v":"Badge readers at points of entry?"},{"$f":"'F. Physical and Environmental'!D83","v":0},{"$f":"'F. Physical and Environmental'!E83","v":0},{"$f":"'F. Physical and Environmental'!F83","v":0},{"$f":"'F. Physical and Environmental'!G83","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H83","v":"11.1.2"},{"$f":"'F. Physical and Environmental'!I83","v":"Physical entry controls"},null,"DS12.2","Physical security measures","9.1.1","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A84","v":413},{"$f":"'F. Physical and Environmental'!J84","v":3},{"$f":"'F. Physical and Environmental'!K84","v":0},{"$f":"'F. Physical and Environmental'!Y84","v":0},{"$f":"'F. Physical and Environmental'!B84","v":"F.2.11.2"},{"$f":"'F. Physical and Environmental'!C84","v":"Locked doors requiring a key or PIN at points of entry?"},{"$f":"'F. Physical and Environmental'!D84","v":0},{"$f":"'F. Physical and Environmental'!E84","v":0},{"$f":"'F. Physical and Environmental'!F84","v":0},{"$f":"'F. Physical and Environmental'!G84","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H84","v":"11.1.2"},{"$f":"'F. Physical and Environmental'!I84","v":"Physical entry controls"},null,"DS12.2","Physical security measures","9.1.1","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A85","v":404},{"$f":"'F. Physical and Environmental'!J85","v":3},{"$f":"'F. Physical and Environmental'!K85","v":0},{"$f":"'F. Physical and Environmental'!Y85","v":0},{"$f":"'F. Physical and Environmental'!B85","v":"F.2.11.3"},{"$f":"'F. Physical and Environmental'!C85","v":"Access request procedures?"},{"$f":"'F. Physical and Environmental'!D85","v":0},{"$f":"'F. Physical and Environmental'!E85","v":0},{"$f":"'F. Physical and Environmental'!F85","v":0},{"$f":"'F. Physical and Environmental'!G85","v":"H.7 Physical Access Controls"},{"$f":"'F. Physical and Environmental'!H85","v":"9.1.1.g"},{"$f":"'F. Physical and Environmental'!I85","v":"Access control policy"},null,"DS12.2","Physical security measures",9.3000000000000007,"N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A86","v":406},{"$f":"'F. Physical and Environmental'!J86","v":4},{"$f":"'F. Physical and Environmental'!K86","v":0},{"$f":"'F. Physical and Environmental'!Y86","v":0},{"$f":"'F. Physical and Environmental'!B86","v":"F.2.11.3.1"},{"$f":"'F. Physical and Environmental'!C86","v":"Segregation of duties for issuing and approving access?"},{"$f":"'F. Physical and Environmental'!D86","v":0},{"$f":"'F. Physical and Environmental'!E86","v":0},{"$f":"'F. Physical and Environmental'!F86","v":0},{"$f":"'F. Physical and Environmental'!G86","v":"H.7 Physical Access Controls"},{"$f":"'F. Physical and Environmental'!H86","v":"9.1.1.f"},{"$f":"'F. Physical and Environmental'!I86","v":"Access control policy"},null,"PO2.1","Enterprise information architecture model","N/A","N/A","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'F. Physical and Environmental'!A87","v":407},{"$f":"'F. Physical and Environmental'!J87","v":4},{"$f":"'F. Physical and Environmental'!K87","v":0},{"$f":"'F. Physical and Environmental'!Y87","v":0},{"$f":"'F. Physical and Environmental'!B87","v":"F.2.11.3.2"},{"$f":"'F. Physical and Environmental'!C87","v":"Access reviews conducted at least every six months?"},{"$f":"'F. Physical and Environmental'!D87","v":0},{"$f":"'F. Physical and Environmental'!E87","v":0},{"$f":"'F. Physical and Environmental'!F87","v":0},{"$f":"'F. Physical and Environmental'!G87","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!H87","v":"9.1.1.h                                       9.2.5"},{"$f":"'F. Physical and Environmental'!I87","v":"Access control policy,         Review of user access rights"},null,"DS12.1","Site selection and layout","9.1.1","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A88","v":420},{"$f":"'F. Physical and Environmental'!J88","v":3},{"$f":"'F. Physical and Environmental'!K88","v":0},{"$f":"'F. Physical and Environmental'!Y88","v":0},{"$f":"'F. Physical and Environmental'!B88","v":"F.2.11.4"},{"$f":"'F. Physical and Environmental'!C88","v":"Is there a mechanism to thwart tailgating / piggybacking into the data center?"},{"$f":"'F. Physical and Environmental'!D88","v":0},{"$f":"'F. Physical and Environmental'!E88","v":0},{"$f":"'F. Physical and Environmental'!F88","v":0},{"$f":"'F. Physical and Environmental'!G88","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H88","v":"NA"},{"$f":"'F. Physical and Environmental'!I88","v":0},null,"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A89","v":414},{"$f":"'F. Physical and Environmental'!J89","v":2},{"$f":"'F. Physical and Environmental'!K89","v":0},{"$f":"'F. Physical and Environmental'!Y89","v":0},{"$f":"'F. Physical and Environmental'!B89","v":"F.2.12"},{"$f":"'F. Physical and Environmental'!C89","v":"Are there security guards at points of entry?"},{"$f":"'F. Physical and Environmental'!D89","v":0},{"$f":"'F. Physical and Environmental'!E89","v":0},{"$f":"'F. Physical and Environmental'!F89","v":0},{"$f":"'F. Physical and Environmental'!G89","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H89","v":"11.1.1.c"},{"$f":"'F. Physical and Environmental'!I89","v":"Physical security perimeter"},null,"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A90","v":415},{"$f":"'F. Physical and Environmental'!J90","v":3},{"$f":"'F. Physical and Environmental'!K90","v":0},{"$f":"'F. Physical and Environmental'!Y90","v":0},{"$f":"'F. Physical and Environmental'!B90","v":"F.2.12.1"},{"$f":"'F. Physical and Environmental'!C90","v":"Do the security guards monitor security systems and alarms?"},{"$f":"'F. Physical and Environmental'!D90","v":0},{"$f":"'F. Physical and Environmental'!E90","v":0},{"$f":"'F. Physical and Environmental'!F90","v":0},{"$f":"'F. Physical and Environmental'!G90","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H90","v":"11.1.1.c"},{"$f":"'F. Physical and Environmental'!I90","v":"Physical security perimeter"},null,"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A91","v":417},{"$f":"'F. Physical and Environmental'!J91","v":2},{"$f":"'F. Physical and Environmental'!K91","v":0},{"$f":"'F. Physical and Environmental'!Y91","v":0},{"$f":"'F. Physical and Environmental'!B91","v":"F.2.13"},{"$f":"'F. Physical and Environmental'!C91","v":"Are visitors permitted in the data center?"},{"$f":"'F. Physical and Environmental'!D91","v":0},{"$f":"'F. Physical and Environmental'!E91","v":0},{"$f":"'F. Physical and Environmental'!F91","v":0},{"$f":"'F. Physical and Environmental'!G91","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H91","v":"11.1.2"},{"$f":"'F. Physical and Environmental'!I91","v":"Physical entry controls"},null,"DS12.2","Physical security measures","9.4.1","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A92","v":418},{"$f":"'F. Physical and Environmental'!J92","v":3},{"$f":"'F. Physical and Environmental'!K92","v":0},{"$f":"'F. Physical and Environmental'!Y92","v":0},{"$f":"'F. Physical and Environmental'!B92","v":"F.2.13.1"},{"$f":"'F. Physical and Environmental'!C92","v":"Are they required to sign in and out of the data center?"},{"$f":"'F. Physical and Environmental'!D92","v":0},{"$f":"'F. Physical and Environmental'!E92","v":0},{"$f":"'F. Physical and Environmental'!F92","v":0},{"$f":"'F. Physical and Environmental'!G92","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H92","v":"11.1.2.a"},{"$f":"'F. Physical and Environmental'!I92","v":"Physical entry controls"},null,"DS12.2","Physical security measures","9.4.4","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A93","v":419},{"$f":"'F. Physical and Environmental'!J93","v":3},{"$f":"'F. Physical and Environmental'!K93","v":0},{"$f":"'F. Physical and Environmental'!Y93","v":0},{"$f":"'F. Physical and Environmental'!B93","v":"F.2.13.2"},{"$f":"'F. Physical and Environmental'!C93","v":"Are they escorted within the data center?"},{"$f":"'F. Physical and Environmental'!D93","v":0},{"$f":"'F. Physical and Environmental'!E93","v":0},{"$f":"'F. Physical and Environmental'!F93","v":0},{"$f":"'F. Physical and Environmental'!G93","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H93","v":"11.1.2.a"},{"$f":"'F. Physical and Environmental'!I93","v":"Physical entry controls"},null,"DS12.2","Physical security measures","9.4.1","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A94","v":421},{"$f":"'F. Physical and Environmental'!J94","v":2},{"$f":"'F. Physical and Environmental'!K94","v":0},{"$f":"'F. Physical and Environmental'!Y94","v":0},{"$f":"'F. Physical and Environmental'!B94","v":"F.2.14"},{"$f":"'F. Physical and Environmental'!C94","v":"Are all entry and exit points to the data center alarmed?"},{"$f":"'F. Physical and Environmental'!D94","v":0},{"$f":"'F. Physical and Environmental'!E94","v":0},{"$f":"'F. Physical and Environmental'!F94","v":0},{"$f":"'F. Physical and Environmental'!G94","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H94","v":"11.1.1.f"},{"$f":"'F. Physical and Environmental'!I94","v":"Physical security perimeter"},null,"DS12.1","Site selection and layout","9.1.1","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A95","v":422},{"$f":"'F. Physical and Environmental'!J95","v":3},{"$f":"'F. Physical and Environmental'!K95","v":0},{"$f":"'F. Physical and Environmental'!Y95","v":0},{"$f":"'F. Physical and Environmental'!B95","v":"F.2.14.1"},{"$f":"'F. Physical and Environmental'!C95","v":"Are there alarm motion sensors monitoring the data center?"},{"$f":"'F. Physical and Environmental'!D95","v":0},{"$f":"'F. Physical and Environmental'!E95","v":0},{"$f":"'F. Physical and Environmental'!F95","v":0},{"$f":"'F. Physical and Environmental'!G95","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H95","v":"11.1.1.f"},{"$f":"'F. Physical and Environmental'!I95","v":"Physical security perimeter"},null,"DS12.1","Site selection and layout","9.1.1","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A96","v":2578},{"$f":"'F. Physical and Environmental'!J96","v":2},{"$f":"'F. Physical and Environmental'!K96","v":0},{"$f":"'F. Physical and Environmental'!Y96","v":0},{"$f":"'F. Physical and Environmental'!B96","v":"F.2.15"},{"$f":"'F. Physical and Environmental'!C96","v":"Is access to the Data center monitored with CCTV and the video stored for at least 90 days?"},{"$f":"'F. Physical and Environmental'!D96","v":0},{"$f":"'F. Physical and Environmental'!E96","v":0},{"$f":"'F. Physical and Environmental'!F96","v":0},{"$f":"'F. Physical and Environmental'!G96","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H96","v":"NA"},{"$f":"'F. Physical and Environmental'!I96","v":0},null,"DS12.1","Site selection and layout","9.1.1","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A97","v":430},{"$f":"'F. Physical and Environmental'!J97","v":2},{"$f":"'F. Physical and Environmental'!K97","v":0},{"$f":"'F. Physical and Environmental'!Y97","v":0},{"$f":"'F. Physical and Environmental'!B97","v":"F.2.16"},{"$f":"'F. Physical and Environmental'!C97","v":"Walls extending from true floor to true ceiling?"},{"$f":"'F. Physical and Environmental'!D97","v":0},{"$f":"'F. Physical and Environmental'!E97","v":0},{"$f":"'F. Physical and Environmental'!F97","v":0},{"$f":"'F. Physical and Environmental'!G97","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H97","v":"11.1.1.b"},{"$f":"'F. Physical and Environmental'!I97","v":"Physical security perimeter"},null,"DS5.7","Protection of security technology","N/A","N/A","DS12.4, DS12.5"]
[{"$f":"'F. Physical and Environmental'!A98","v":432},{"$f":"'F. Physical and Environmental'!J98","v":2},{"$f":"'F. Physical and Environmental'!K98","v":0},{"$f":"'F. Physical and Environmental'!Y98","v":0},{"$f":"'F. Physical and Environmental'!B98","v":"F.2.17"},{"$f":"'F. Physical and Environmental'!C98","v":"Windows or glass walls along the perimeter?"},{"$f":"'F. Physical and Environmental'!D98","v":0},{"$f":"'F. Physical and Environmental'!E98","v":0},{"$f":"'F. Physical and Environmental'!F98","v":0},{"$f":"'F. Physical and Environmental'!G98","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H98","v":"11.1.1.b"},{"$f":"'F. Physical and Environmental'!I98","v":"Physical security perimeter"},null,"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A99","v":457},{"$f":"'F. Physical and Environmental'!J99","v":2},{"$f":"'F. Physical and Environmental'!K99","v":0},{"$f":"'F. Physical and Environmental'!Y99","v":0},{"$f":"'F. Physical and Environmental'!B99","v":"F.2.18"},{"$f":"'F. Physical and Environmental'!C99","v":"Do the Scoped Systems and Data reside in a caged environment within a data center? If yes, is there a:"},{"$f":"'F. Physical and Environmental'!D99","v":0},{"$f":"'F. Physical and Environmental'!E99","v":0},{"$f":"'F. Physical and Environmental'!F99","v":0},{"$f":"'F. Physical and Environmental'!G99","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H99","v":"NA"},{"$f":"'F. Physical and Environmental'!I99","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A100","v":461},{"$f":"'F. Physical and Environmental'!J100","v":3},{"$f":"'F. Physical and Environmental'!K100","v":0},{"$f":"'F. Physical and Environmental'!Y100","v":0},{"$f":"'F. Physical and Environmental'!B100","v":"F.2.18.1"},{"$f":"'F. Physical and Environmental'!C100","v":"Lock requiring a key or PIN used at points of entry?"},{"$f":"'F. Physical and Environmental'!D100","v":0},{"$f":"'F. Physical and Environmental'!E100","v":0},{"$f":"'F. Physical and Environmental'!F100","v":0},{"$f":"'F. Physical and Environmental'!G100","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H100","v":"11.1.2"},{"$f":"'F. Physical and Environmental'!I100","v":"Physical entry controls"},null,"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A101","v":462},{"$f":"'F. Physical and Environmental'!J101","v":3},{"$f":"'F. Physical and Environmental'!K101","v":0},{"$f":"'F. Physical and Environmental'!Y101","v":0},{"$f":"'F. Physical and Environmental'!B101","v":"F.2.18.2"},{"$f":"'F. Physical and Environmental'!C101","v":"Process for requesting access?"},{"$f":"'F. Physical and Environmental'!D101","v":0},{"$f":"'F. Physical and Environmental'!E101","v":0},{"$f":"'F. Physical and Environmental'!F101","v":0},{"$f":"'F. Physical and Environmental'!G101","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H101","v":"9.1.1.g"},{"$f":"'F. Physical and Environmental'!I101","v":"Access control policy"},null,"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A102","v":463},{"$f":"'F. Physical and Environmental'!J102","v":4},{"$f":"'F. Physical and Environmental'!K102","v":0},{"$f":"'F. Physical and Environmental'!Y102","v":0},{"$f":"'F. Physical and Environmental'!B102","v":"F.2.18.2.1"},{"$f":"'F. Physical and Environmental'!C102","v":"Segregation of duties for granting and storage of access devices (badges, keys, etc.)?"},{"$f":"'F. Physical and Environmental'!D102","v":0},{"$f":"'F. Physical and Environmental'!E102","v":0},{"$f":"'F. Physical and Environmental'!F102","v":0},{"$f":"'F. Physical and Environmental'!G102","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H102","v":"9.1.1.f"},{"$f":"'F. Physical and Environmental'!I102","v":"Access control policy"},null,"PO2.1","Enterprise information architecture model","N/A","N/A","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'F. Physical and Environmental'!A103","v":465},{"$f":"'F. Physical and Environmental'!J103","v":3},{"$f":"'F. Physical and Environmental'!K103","v":0},{"$f":"'F. Physical and Environmental'!Y103","v":0},{"$f":"'F. Physical and Environmental'!B103","v":"F.2.18.3"},{"$f":"'F. Physical and Environmental'!C103","v":"List maintained of personnel with cards / keys to the caged environment?"},{"$f":"'F. Physical and Environmental'!D103","v":0},{"$f":"'F. Physical and Environmental'!E103","v":0},{"$f":"'F. Physical and Environmental'!F103","v":0},{"$f":"'F. Physical and Environmental'!G103","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H103","v":"11.1.1.c"},{"$f":"'F. Physical and Environmental'!I103","v":"Physical security perimeter"},null,"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A104","v":466},{"$f":"'F. Physical and Environmental'!J104","v":3},{"$f":"'F. Physical and Environmental'!K104","v":0},{"$f":"'F. Physical and Environmental'!Y104","v":0},{"$f":"'F. Physical and Environmental'!B104","v":"F.2.18.4"},{"$f":"'F. Physical and Environmental'!C104","v":"Process to report lost access cards / keys?"},{"$f":"'F. Physical and Environmental'!D104","v":0},{"$f":"'F. Physical and Environmental'!E104","v":0},{"$f":"'F. Physical and Environmental'!F104","v":0},{"$f":"'F. Physical and Environmental'!G104","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H104","v":"11.1.2.d"},{"$f":"'F. Physical and Environmental'!I104","v":"Physical entry controls"},null,"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A105","v":467},{"$f":"'F. Physical and Environmental'!J105","v":3},{"$f":"'F. Physical and Environmental'!K105","v":0},{"$f":"'F. Physical and Environmental'!Y105","v":0},{"$f":"'F. Physical and Environmental'!B105","v":"F.2.18.5"},{"$f":"'F. Physical and Environmental'!C105","v":"Process to review access to the cage at least every six months?"},{"$f":"'F. Physical and Environmental'!D105","v":0},{"$f":"'F. Physical and Environmental'!E105","v":0},{"$f":"'F. Physical and Environmental'!F105","v":0},{"$f":"'F. Physical and Environmental'!G105","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H105","v":"9.1.1.h                                       9.2.5"},{"$f":"'F. Physical and Environmental'!I105","v":"Access control policy,         Review of user access rights"},null,"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A106","v":469},{"$f":"'F. Physical and Environmental'!J106","v":3},{"$f":"'F. Physical and Environmental'!K106","v":0},{"$f":"'F. Physical and Environmental'!Y106","v":0},{"$f":"'F. Physical and Environmental'!B106","v":"F.2.18.6"},{"$f":"'F. Physical and Environmental'!C106","v":"Process to collect access equipment (badges, keys, change pin numbers, etc.) when a constituent is terminated or changes status and no longer requires access?"},{"$f":"'F. Physical and Environmental'!D106","v":0},{"$f":"'F. Physical and Environmental'!E106","v":0},{"$f":"'F. Physical and Environmental'!F106","v":0},{"$f":"'F. Physical and Environmental'!G106","v":"H.2 Revoke System and Physical Access"},{"$f":"'F. Physical and Environmental'!H106","v":"9.1.1.i"},{"$f":"'F. Physical and Environmental'!I106","v":"Access control policy"},null,"DS12.2","Physical security measures",9.3000000000000007,"N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A107","v":471},{"$f":"'F. Physical and Environmental'!J107","v":3},{"$f":"'F. Physical and Environmental'!K107","v":0},{"$f":"'F. Physical and Environmental'!Y107","v":0},{"$f":"'F. Physical and Environmental'!B107","v":"F.2.18.7"},{"$f":"'F. Physical and Environmental'!C107","v":"Are visitors permitted in the caged environment? If yes, are they:"},{"$f":"'F. Physical and Environmental'!D107","v":0},{"$f":"'F. Physical and Environmental'!E107","v":0},{"$f":"'F. Physical and Environmental'!F107","v":0},{"$f":"'F. Physical and Environmental'!G107","v":"F.2 Physical Security Controls – Scoped Systems and Data"},{"$f":"'F. Physical and Environmental'!H107","v":"11.1.2"},{"$f":"'F. Physical and Environmental'!I107","v":"Physical entry controls"},null,"DS12.2","Physical security measures","9.4.1","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A108","v":472},{"$f":"'F. Physical and Environmental'!J108","v":4},{"$f":"'F. Physical and Environmental'!K108","v":0},{"$f":"'F. Physical and Environmental'!Y108","v":0},{"$f":"'F. Physical and Environmental'!B108","v":"F.2.18.7.1"},{"$f":"'F. Physical and Environmental'!C108","v":"Required to sign in and out?"},{"$f":"'F. Physical and Environmental'!D108","v":0},{"$f":"'F. Physical and Environmental'!E108","v":0},{"$f":"'F. Physical and Environmental'!F108","v":0},{"$f":"'F. Physical and Environmental'!G108","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H108","v":"11.1.2.a"},{"$f":"'F. Physical and Environmental'!I108","v":"Physical entry controls"},null,"DS12.2","Physical security measures","9.4.4","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A109","v":473},{"$f":"'F. Physical and Environmental'!J109","v":4},{"$f":"'F. Physical and Environmental'!K109","v":0},{"$f":"'F. Physical and Environmental'!Y109","v":0},{"$f":"'F. Physical and Environmental'!B109","v":"F.2.18.7.2"},{"$f":"'F. Physical and Environmental'!C109","v":"Escorted?"},{"$f":"'F. Physical and Environmental'!D109","v":0},{"$f":"'F. Physical and Environmental'!E109","v":0},{"$f":"'F. Physical and Environmental'!F109","v":0},{"$f":"'F. Physical and Environmental'!G109","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H109","v":"11.1.2.a "},{"$f":"'F. Physical and Environmental'!I109","v":"Physical entry controls"},null,"DS12.2","Physical security measures","9.4.1","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A110","v":474},{"$f":"'F. Physical and Environmental'!J110","v":3},{"$f":"'F. Physical and Environmental'!K110","v":0},{"$f":"'F. Physical and Environmental'!Y110","v":0},{"$f":"'F. Physical and Environmental'!B110","v":"F.2.18.8"},{"$f":"'F. Physical and Environmental'!C110","v":"Monitored with CCTV and the video stored for at least 90 days?"},{"$f":"'F. Physical and Environmental'!D110","v":0},{"$f":"'F. Physical and Environmental'!E110","v":0},{"$f":"'F. Physical and Environmental'!F110","v":0},{"$f":"'F. Physical and Environmental'!G110","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H110","v":"NA"},{"$f":"'F. Physical and Environmental'!I110","v":0},null,"DS12.1","Site selection and layout","9.1.1","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A111","v":477},{"$f":"'F. Physical and Environmental'!J111","v":2},{"$f":"'F. Physical and Environmental'!K111","v":0},{"$f":"'F. Physical and Environmental'!Y111","v":0},{"$f":"'F. Physical and Environmental'!B111","v":"F.2.19"},{"$f":"'F. Physical and Environmental'!C111","v":"Do the Scoped Systems and Data reside in a locked cabinet? If yes, is there:"},{"$f":"'F. Physical and Environmental'!D111","v":0},{"$f":"'F. Physical and Environmental'!E111","v":0},{"$f":"'F. Physical and Environmental'!F111","v":0},{"$f":"'F. Physical and Environmental'!G111","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H111","v":"NA"},{"$f":"'F. Physical and Environmental'!I111","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A112","v":478},{"$f":"'F. Physical and Environmental'!J112","v":3},{"$f":"'F. Physical and Environmental'!K112","v":0},{"$f":"'F. Physical and Environmental'!Y112","v":0},{"$f":"'F. Physical and Environmental'!B112","v":"F.2.19.1"},{"$f":"'F. Physical and Environmental'!C112","v":"Shared cabinets?"},{"$f":"'F. Physical and Environmental'!D112","v":0},{"$f":"'F. Physical and Environmental'!E112","v":0},{"$f":"'F. Physical and Environmental'!F112","v":0},{"$f":"'F. Physical and Environmental'!G112","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H112","v":"NA"},{"$f":"'F. Physical and Environmental'!I112","v":0},null,"DS12.1","Site selection and layout","N/A","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A113","v":479},{"$f":"'F. Physical and Environmental'!J113","v":3},{"$f":"'F. Physical and Environmental'!K113","v":0},{"$f":"'F. Physical and Environmental'!Y113","v":0},{"$f":"'F. Physical and Environmental'!B113","v":"F.2.19.2"},{"$f":"'F. Physical and Environmental'!C113","v":"Restricted access and logs kept of all access?"},{"$f":"'F. Physical and Environmental'!D113","v":0},{"$f":"'F. Physical and Environmental'!E113","v":0},{"$f":"'F. Physical and Environmental'!F113","v":0},{"$f":"'F. Physical and Environmental'!G113","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H113","v":"11.1.2.c"},{"$f":"'F. Physical and Environmental'!I113","v":"Physical entry controls"},null,"DS12.1","Site selection and layout",9.3000000000000007,"N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A114","v":480},{"$f":"'F. Physical and Environmental'!J114","v":3},{"$f":"'F. Physical and Environmental'!K114","v":0},{"$f":"'F. Physical and Environmental'!Y114","v":0},{"$f":"'F. Physical and Environmental'!B114","v":"F.2.19.3"},{"$f":"'F. Physical and Environmental'!C114","v":"Access request procedures?"},{"$f":"'F. Physical and Environmental'!D114","v":0},{"$f":"'F. Physical and Environmental'!E114","v":0},{"$f":"'F. Physical and Environmental'!F114","v":0},{"$f":"'F. Physical and Environmental'!G114","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H114","v":"9.1.1.g"},{"$f":"'F. Physical and Environmental'!I114","v":"Access control policy"},null,"DS12.1","Site selection and layout",9.3000000000000007,"N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A115","v":481},{"$f":"'F. Physical and Environmental'!J115","v":3},{"$f":"'F. Physical and Environmental'!K115","v":0},{"$f":"'F. Physical and Environmental'!Y115","v":0},{"$f":"'F. Physical and Environmental'!B115","v":"F.2.19.4"},{"$f":"'F. Physical and Environmental'!C115","v":"Segregation of duties for issuing, approving access and storing devices (badges, keys, etc.)?"},{"$f":"'F. Physical and Environmental'!D115","v":0},{"$f":"'F. Physical and Environmental'!E115","v":0},{"$f":"'F. Physical and Environmental'!F115","v":0},{"$f":"'F. Physical and Environmental'!G115","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H115","v":"9.1.1.f"},{"$f":"'F. Physical and Environmental'!I115","v":"Access control policy"},null,"PO2.1","Enterprise information architecture model","N/A","N/A","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'F. Physical and Environmental'!A116","v":483},{"$f":"'F. Physical and Environmental'!J116","v":3},{"$f":"'F. Physical and Environmental'!K116","v":0},{"$f":"'F. Physical and Environmental'!Y116","v":0},{"$f":"'F. Physical and Environmental'!B116","v":"F.2.19.5"},{"$f":"'F. Physical and Environmental'!C116","v":"A list of personnel with cards / keys to the cabinet?"},{"$f":"'F. Physical and Environmental'!D116","v":0},{"$f":"'F. Physical and Environmental'!E116","v":0},{"$f":"'F. Physical and Environmental'!F116","v":0},{"$f":"'F. Physical and Environmental'!G116","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H116","v":"11.1.1.c"},{"$f":"'F. Physical and Environmental'!I116","v":"Physical security perimeter"},null,"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A117","v":484},{"$f":"'F. Physical and Environmental'!J117","v":3},{"$f":"'F. Physical and Environmental'!K117","v":0},{"$f":"'F. Physical and Environmental'!Y117","v":0},{"$f":"'F. Physical and Environmental'!B117","v":"F.2.19.6"},{"$f":"'F. Physical and Environmental'!C117","v":"A process to report lost access cards / keys?"},{"$f":"'F. Physical and Environmental'!D117","v":0},{"$f":"'F. Physical and Environmental'!E117","v":0},{"$f":"'F. Physical and Environmental'!F117","v":0},{"$f":"'F. Physical and Environmental'!G117","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H117","v":"11.1.2.d"},{"$f":"'F. Physical and Environmental'!I117","v":"Physical entry controls"},null,"DS12.2","Physical security measures","N/A","N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A118","v":485},{"$f":"'F. Physical and Environmental'!J118","v":3},{"$f":"'F. Physical and Environmental'!K118","v":0},{"$f":"'F. Physical and Environmental'!Y118","v":0},{"$f":"'F. Physical and Environmental'!B118","v":"F.2.19.7"},{"$f":"'F. Physical and Environmental'!C118","v":"Collection access equipment (badges, keys, change pin numbers, etc.) when a constituent is terminated or changes status and no longer requires access?"},{"$f":"'F. Physical and Environmental'!D118","v":0},{"$f":"'F. Physical and Environmental'!E118","v":0},{"$f":"'F. Physical and Environmental'!F118","v":0},{"$f":"'F. Physical and Environmental'!G118","v":"H.2 Revoke System and Physical Access"},{"$f":"'F. Physical and Environmental'!H118","v":"9.1.1.i"},{"$f":"'F. Physical and Environmental'!I118","v":"Access control policy"},null,"DS12.2","Physical security measures",9.3000000000000007,"N/A","DS12.2, DS12.3"]
[{"$f":"'F. Physical and Environmental'!A119","v":487},{"$f":"'F. Physical and Environmental'!J119","v":3},{"$f":"'F. Physical and Environmental'!K119","v":0},{"$f":"'F. Physical and Environmental'!Y119","v":0},{"$f":"'F. Physical and Environmental'!B119","v":"F.2.19.8"},{"$f":"'F. Physical and Environmental'!C119","v":"Cabinets monitored with CCTV and the video stored for at least 90 days?"},{"$f":"'F. Physical and Environmental'!D119","v":0},{"$f":"'F. Physical and Environmental'!E119","v":0},{"$f":"'F. Physical and Environmental'!F119","v":0},{"$f":"'F. Physical and Environmental'!G119","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H119","v":"NA"},{"$f":"'F. Physical and Environmental'!I119","v":0},null,"DS12.1","Site selection and layout","9.1.1","N/A","DS12.1, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A120","v":490},{"$f":"'F. Physical and Environmental'!J120","v":2},{"$f":"'F. Physical and Environmental'!K120","v":0},{"$f":"'F. Physical and Environmental'!Y120","v":0},{"$f":"'F. Physical and Environmental'!B120","v":"F.2.20"},{"$f":"'F. Physical and Environmental'!C120","v":"Is there a policy on using locking screensavers on unattended system displays or locks on consoles within the data center?"},{"$f":"'F. Physical and Environmental'!D120","v":0},{"$f":"'F. Physical and Environmental'!E120","v":0},{"$f":"'F. Physical and Environmental'!F120","v":0},{"$f":"'F. Physical and Environmental'!G120","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H120","v":"11.2.8                                       11.2.9"},{"$f":"'F. Physical and Environmental'!I120","v":"Unattended user equipment, Clear desk and clear screen policy"},null,"PO6.2","Enterprise IT risk and internal control framework","8.1.7","N/A","PO6.2, DS5.7"]
[{"$f":"'F. Physical and Environmental'!A121","v":491},{"$f":"'F. Physical and Environmental'!J121","v":2},{"$f":"'F. Physical and Environmental'!K121","v":0},{"$f":"'F. Physical and Environmental'!Y121","v":0},{"$f":"'F. Physical and Environmental'!B121","v":"F.2.21"},{"$f":"'F. Physical and Environmental'!C121","v":"Is there a procedure for equipment removal from the data center?"},{"$f":"'F. Physical and Environmental'!D121","v":0},{"$f":"'F. Physical and Environmental'!E121","v":0},{"$f":"'F. Physical and Environmental'!F121","v":0},{"$f":"'F. Physical and Environmental'!G121","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H121","v":"11.2.6"},{"$f":"'F. Physical and Environmental'!I121","v":"Security of equipment and assets off-premises"},null,"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, DS12.2"]
[{"$f":"'F. Physical and Environmental'!A122","v":526},{"$f":"'F. Physical and Environmental'!J122","v":2},{"$f":"'F. Physical and Environmental'!K122","v":1},{"$f":"'F. Physical and Environmental'!Y122","v":0},{"$f":"'F. Physical and Environmental'!B122","v":"F.2.22"},{"$f":"'F. Physical and Environmental'!C122","v":"Is there a preventive maintenance or current maintenance contracts for:"},{"$f":"'F. Physical and Environmental'!D122","v":0},{"$f":"'F. Physical and Environmental'!E122","v":0},{"$f":"'F. Physical and Environmental'!F122","v":0},{"$f":"'F. Physical and Environmental'!G122","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H122","v":"11.2.4"},{"$f":"'F. Physical and Environmental'!I122","v":"Equipment maintenance"},null,null,null,"N/A","OPS.1.7.1.8 OPS.2.12.D.7","N/A"]
[{"$f":"'F. Physical and Environmental'!A123","v":527},{"$f":"'F. Physical and Environmental'!J123","v":3},{"$f":"'F. Physical and Environmental'!K123","v":0},{"$f":"'F. Physical and Environmental'!Y123","v":0},{"$f":"'F. Physical and Environmental'!B123","v":"F.2.22.1"},{"$f":"'F. Physical and Environmental'!C123","v":"UPS system?"},{"$f":"'F. Physical and Environmental'!D123","v":0},{"$f":"'F. Physical and Environmental'!E123","v":0},{"$f":"'F. Physical and Environmental'!F123","v":0},{"$f":"'F. Physical and Environmental'!G123","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H123","v":"11.2.4"},{"$f":"'F. Physical and Environmental'!I123","v":"Equipment maintenance"},null,"AI3.3","Infrastructure maintenance","N/A","N/A","AI3.3, DS12.5, DS13.5"]
[{"$f":"'F. Physical and Environmental'!A124","v":528},{"$f":"'F. Physical and Environmental'!J124","v":3},{"$f":"'F. Physical and Environmental'!K124","v":0},{"$f":"'F. Physical and Environmental'!Y124","v":0},{"$f":"'F. Physical and Environmental'!B124","v":"F.2.22.2"},{"$f":"'F. Physical and Environmental'!C124","v":"Security system?"},{"$f":"'F. Physical and Environmental'!D124","v":0},{"$f":"'F. Physical and Environmental'!E124","v":0},{"$f":"'F. Physical and Environmental'!F124","v":0},{"$f":"'F. Physical and Environmental'!G124","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H124","v":"11.2.4"},{"$f":"'F. Physical and Environmental'!I124","v":"Equipment maintenance"},null,"AI3.3","Infrastructure maintenance","N/A","N/A","AI3.3, DS12.5, DS13.5"]
[{"$f":"'F. Physical and Environmental'!A125","v":529},{"$f":"'F. Physical and Environmental'!J125","v":3},{"$f":"'F. Physical and Environmental'!K125","v":0},{"$f":"'F. Physical and Environmental'!Y125","v":0},{"$f":"'F. Physical and Environmental'!B125","v":"F.2.22.3"},{"$f":"'F. Physical and Environmental'!C125","v":"Generator?"},{"$f":"'F. Physical and Environmental'!D125","v":0},{"$f":"'F. Physical and Environmental'!E125","v":0},{"$f":"'F. Physical and Environmental'!F125","v":0},{"$f":"'F. Physical and Environmental'!G125","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H125","v":"11.2.4"},{"$f":"'F. Physical and Environmental'!I125","v":"Equipment maintenance"},null,"AI3.3","Infrastructure maintenance","N/A","N/A","AI3.3, DS12.5, DS13.5"]
[{"$f":"'F. Physical and Environmental'!A126","v":530},{"$f":"'F. Physical and Environmental'!J126","v":3},{"$f":"'F. Physical and Environmental'!K126","v":0},{"$f":"'F. Physical and Environmental'!Y126","v":0},{"$f":"'F. Physical and Environmental'!B126","v":"F.2.22.4"},{"$f":"'F. Physical and Environmental'!C126","v":"Batteries?"},{"$f":"'F. Physical and Environmental'!D126","v":0},{"$f":"'F. Physical and Environmental'!E126","v":0},{"$f":"'F. Physical and Environmental'!F126","v":0},{"$f":"'F. Physical and Environmental'!G126","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H126","v":"11.2.4"},{"$f":"'F. Physical and Environmental'!I126","v":"Equipment maintenance"},null,"AI3.3","Infrastructure maintenance","N/A","N/A","AI3.3, DS12.5, DS13.5"]
[{"$f":"'F. Physical and Environmental'!A127","v":531},{"$f":"'F. Physical and Environmental'!J127","v":3},{"$f":"'F. Physical and Environmental'!K127","v":0},{"$f":"'F. Physical and Environmental'!Y127","v":0},{"$f":"'F. Physical and Environmental'!B127","v":"F.2.22.5"},{"$f":"'F. Physical and Environmental'!C127","v":"Monitored fire alarm?"},{"$f":"'F. Physical and Environmental'!D127","v":0},{"$f":"'F. Physical and Environmental'!E127","v":0},{"$f":"'F. Physical and Environmental'!F127","v":0},{"$f":"'F. Physical and Environmental'!G127","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H127","v":"11.2.4"},{"$f":"'F. Physical and Environmental'!I127","v":"Equipment maintenance"},null,"AI3.3","Infrastructure maintenance","N/A","N/A","AI3.3, DS12.5, DS13.5"]
[{"$f":"'F. Physical and Environmental'!A128","v":532},{"$f":"'F. Physical and Environmental'!J128","v":3},{"$f":"'F. Physical and Environmental'!K128","v":0},{"$f":"'F. Physical and Environmental'!Y128","v":0},{"$f":"'F. Physical and Environmental'!B128","v":"F.2.22.6"},{"$f":"'F. Physical and Environmental'!C128","v":"Fire suppression systems?"},{"$f":"'F. Physical and Environmental'!D128","v":0},{"$f":"'F. Physical and Environmental'!E128","v":0},{"$f":"'F. Physical and Environmental'!F128","v":0},{"$f":"'F. Physical and Environmental'!G128","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H128","v":"11.2.4"},{"$f":"'F. Physical and Environmental'!I128","v":"Equipment maintenance"},null,"AI3.3","Infrastructure maintenance","N/A","OPS.1.7.1.6 OPS.2.12.D.5","AI3.3, DS12.5, DS13.5"]
[{"$f":"'F. Physical and Environmental'!A129","v":533},{"$f":"'F. Physical and Environmental'!J129","v":3},{"$f":"'F. Physical and Environmental'!K129","v":0},{"$f":"'F. Physical and Environmental'!Y129","v":0},{"$f":"'F. Physical and Environmental'!B129","v":"F.2.22.7"},{"$f":"'F. Physical and Environmental'!C129","v":"HVAC?"},{"$f":"'F. Physical and Environmental'!D129","v":0},{"$f":"'F. Physical and Environmental'!E129","v":0},{"$f":"'F. Physical and Environmental'!F129","v":0},{"$f":"'F. Physical and Environmental'!G129","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H129","v":"11.2.4"},{"$f":"'F. Physical and Environmental'!I129","v":"Equipment maintenance"},null,"AI3.3","Infrastructure maintenance","N/A","N/A","AI3.3, DS12.5, DS13.5"]
[{"$f":"'F. Physical and Environmental'!A130","v":534},{"$f":"'F. Physical and Environmental'!J130","v":2},{"$f":"'F. Physical and Environmental'!K130","v":1},{"$f":"'F. Physical and Environmental'!Y130","v":0},{"$f":"'F. Physical and Environmental'!B130","v":"F.2.23"},{"$f":"'F. Physical and Environmental'!C130","v":"Are the following tested:"},{"$f":"'F. Physical and Environmental'!D130","v":0},{"$f":"'F. Physical and Environmental'!E130","v":0},{"$f":"'F. Physical and Environmental'!F130","v":0},{"$f":"'F. Physical and Environmental'!G130","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H130","v":"NA"},{"$f":"'F. Physical and Environmental'!I130","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A131","v":535},{"$f":"'F. Physical and Environmental'!J131","v":3},{"$f":"'F. Physical and Environmental'!K131","v":0},{"$f":"'F. Physical and Environmental'!Y131","v":0},{"$f":"'F. Physical and Environmental'!B131","v":"F.2.23.1"},{"$f":"'F. Physical and Environmental'!C131","v":"UPS system - annually?"},{"$f":"'F. Physical and Environmental'!D131","v":0},{"$f":"'F. Physical and Environmental'!E131","v":0},{"$f":"'F. Physical and Environmental'!F131","v":0},{"$f":"'F. Physical and Environmental'!G131","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H131","v":"NA"},{"$f":"'F. Physical and Environmental'!I131","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A132","v":536},{"$f":"'F. Physical and Environmental'!J132","v":3},{"$f":"'F. Physical and Environmental'!K132","v":0},{"$f":"'F. Physical and Environmental'!Y132","v":0},{"$f":"'F. Physical and Environmental'!B132","v":"F.2.23.2"},{"$f":"'F. Physical and Environmental'!C132","v":"Security alarm system - annually?"},{"$f":"'F. Physical and Environmental'!D132","v":0},{"$f":"'F. Physical and Environmental'!E132","v":0},{"$f":"'F. Physical and Environmental'!F132","v":0},{"$f":"'F. Physical and Environmental'!G132","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H132","v":"NA"},{"$f":"'F. Physical and Environmental'!I132","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A133","v":537},{"$f":"'F. Physical and Environmental'!J133","v":3},{"$f":"'F. Physical and Environmental'!K133","v":0},{"$f":"'F. Physical and Environmental'!Y133","v":0},{"$f":"'F. Physical and Environmental'!B133","v":"F.2.23.3"},{"$f":"'F. Physical and Environmental'!C133","v":"Fire alarms - annually?"},{"$f":"'F. Physical and Environmental'!D133","v":0},{"$f":"'F. Physical and Environmental'!E133","v":0},{"$f":"'F. Physical and Environmental'!F133","v":0},{"$f":"'F. Physical and Environmental'!G133","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H133","v":"NA"},{"$f":"'F. Physical and Environmental'!I133","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A134","v":538},{"$f":"'F. Physical and Environmental'!J134","v":3},{"$f":"'F. Physical and Environmental'!K134","v":0},{"$f":"'F. Physical and Environmental'!Y134","v":0},{"$f":"'F. Physical and Environmental'!B134","v":"F.2.23.4"},{"$f":"'F. Physical and Environmental'!C134","v":"Fire suppression system - annually?"},{"$f":"'F. Physical and Environmental'!D134","v":0},{"$f":"'F. Physical and Environmental'!E134","v":0},{"$f":"'F. Physical and Environmental'!F134","v":0},{"$f":"'F. Physical and Environmental'!G134","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H134","v":"NA"},{"$f":"'F. Physical and Environmental'!I134","v":0},null,null,null,"N/A","OPS.1.7.1.6 OPS.2.12.D.5","N/A"]
[{"$f":"'F. Physical and Environmental'!A135","v":539},{"$f":"'F. Physical and Environmental'!J135","v":3},{"$f":"'F. Physical and Environmental'!K135","v":0},{"$f":"'F. Physical and Environmental'!Y135","v":0},{"$f":"'F. Physical and Environmental'!B135","v":"F.2.23.5"},{"$f":"'F. Physical and Environmental'!C135","v":"Generators - monthly?"},{"$f":"'F. Physical and Environmental'!D135","v":0},{"$f":"'F. Physical and Environmental'!E135","v":0},{"$f":"'F. Physical and Environmental'!F135","v":0},{"$f":"'F. Physical and Environmental'!G135","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H135","v":"NA"},{"$f":"'F. Physical and Environmental'!I135","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A136","v":540},{"$f":"'F. Physical and Environmental'!J136","v":3},{"$f":"'F. Physical and Environmental'!K136","v":0},{"$f":"'F. Physical and Environmental'!Y136","v":0},{"$f":"'F. Physical and Environmental'!B136","v":"F.2.23.6"},{"$f":"'F. Physical and Environmental'!C136","v":"Generators full load tested - monthly?"},{"$f":"'F. Physical and Environmental'!D136","v":0},{"$f":"'F. Physical and Environmental'!E136","v":0},{"$f":"'F. Physical and Environmental'!F136","v":0},{"$f":"'F. Physical and Environmental'!G136","v":"F.2 Physical Security Controls – Target Data"},{"$f":"'F. Physical and Environmental'!H136","v":"NA"},{"$f":"'F. Physical and Environmental'!I136","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'F. Physical and Environmental'!A137","v":0},{"$f":"'F. Physical and Environmental'!J137","v":0},{"$f":"'F. Physical and Environmental'!K137","v":0},{"$f":"'F. Physical and Environmental'!Y137","v":0},{"$f":"'F. Physical and Environmental'!B137","v":0},{"$f":"'F. Physical and Environmental'!C137","v":0},{"$f":"'F. Physical and Environmental'!D137","v":0},{"$f":"'F. Physical and Environmental'!E137","v":0},{"$f":"'F. Physical and Environmental'!F137","v":0},{"$f":"'F. Physical and Environmental'!G137","v":0},{"$f":"'F. Physical and Environmental'!H137","v":0},{"$f":"'F. Physical and Environmental'!I137","v":0}]
[{"$f":"'F. Physical and Environmental'!A138","v":0},{"$f":"'F. Physical and Environmental'!J138","v":0},{"$f":"'F. Physical and Environmental'!K138","v":0},{"$f":"'F. Physical and Environmental'!Y138","v":0},{"$f":"'F. Physical and Environmental'!B138","v":0},{"$f":"'F. Physical and Environmental'!C138","v":0},{"$f":"'F. Physical and Environmental'!D138","v":0},{"$f":"'F. Physical and Environmental'!E138","v":0},{"$f":"'F. Physical and Environmental'!F138","v":0},{"$f":"'F. Physical and Environmental'!G138","v":0},{"$f":"'F. Physical and Environmental'!H138","v":0},{"$f":"'F. Physical and Environmental'!I138","v":0}]
[{"$f":"'G. Communications and Ops Mgmt'!B1","v":"G. Communications and Operations Management"},null,null,null,{"$f":"'G. Communications and Ops Mgmt'!B1","v":"G. Communications and Operations Management"}]
[{"$f":"'G. Communications and Ops Mgmt'!A5","v":2582},{"$f":"'G. Communications and Ops Mgmt'!J5","v":1},{"$f":"'G. Communications and Ops Mgmt'!K5","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y5","v":1},{"$f":"'G. Communications and Ops Mgmt'!B5","v":"G.1"},{"$f":"'G. Communications and Ops Mgmt'!C5","v":"Are management approved operating procedures utilized? If yes, are they:"},{"$f":"'G. Communications and Ops Mgmt'!D5","v":0},{"$f":"'G. Communications and Ops Mgmt'!E5","v":0},{"$f":"'G. Communications and Ops Mgmt'!F5","v":0},{"$f":"'G. Communications and Ops Mgmt'!G5","v":"G. Communications and Operations Management"},{"$f":"'G. Communications and Ops Mgmt'!H5","v":"12.1.1"},{"$f":"'G. Communications and Ops Mgmt'!I5","v":"Documented Operating Procedure"},null,"AI1.1","Definition and maintenance of business functional and technical requirements","N/A","MGMT.1.6.1.4 OPS.1.5 WPS.2.2.1.3.2 AUDIT.2.D.1.11","AI1.1, AI4.4, DS13.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A6","v":2583},{"$f":"'G. Communications and Ops Mgmt'!J6","v":2},{"$f":"'G. Communications and Ops Mgmt'!K6","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y6","v":0},{"$f":"'G. Communications and Ops Mgmt'!B6","v":"G.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C6","v":"Documented, maintained, and made available to all users?"},{"$f":"'G. Communications and Ops Mgmt'!D6","v":0},{"$f":"'G. Communications and Ops Mgmt'!E6","v":0},{"$f":"'G. Communications and Ops Mgmt'!F6","v":0},{"$f":"'G. Communications and Ops Mgmt'!G6","v":"G. Communications and Operations Management"},{"$f":"'G. Communications and Ops Mgmt'!H6","v":"12.1.1"},{"$f":"'G. Communications and Ops Mgmt'!I6","v":"Documented Operating Procedure"},null,"AI1.1","Definition and maintenance of business functional and technical requirements","N/A","OPS.1.4.4 AUDIT.2.D.1.3","AI1.1, AI4.4, DS13.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A7","v":816},{"$f":"'G. Communications and Ops Mgmt'!J7","v":1},{"$f":"'G. Communications and Ops Mgmt'!K7","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y7","v":1},{"$f":"'G. Communications and Ops Mgmt'!B7","v":"G.2"},{"$f":"'G. Communications and Ops Mgmt'!C7","v":"Is there an operational change management/change control policy or program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy? If yes, does it include:"},{"$f":"'G. Communications and Ops Mgmt'!D7","v":0},{"$f":"'G. Communications and Ops Mgmt'!E7","v":0},{"$f":"'G. Communications and Ops Mgmt'!F7","v":0},{"$f":"'G. Communications and Ops Mgmt'!G7","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!H7","v":"12.1.2"},{"$f":"'G. Communications and Ops Mgmt'!I7","v":"Change Management"},null,"AI6.1","Change standards and procedures",6.4,"IS.1.7.8 OPS.1.5.1.3","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A8","v":828},{"$f":"'G. Communications and Ops Mgmt'!J8","v":2},{"$f":"'G. Communications and Ops Mgmt'!K8","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y8","v":0},{"$f":"'G. Communications and Ops Mgmt'!B8","v":"G.2.1"},{"$f":"'G. Communications and Ops Mgmt'!C8","v":"Documentation of changes?"},{"$f":"'G. Communications and Ops Mgmt'!D8","v":0},{"$f":"'G. Communications and Ops Mgmt'!E8","v":0},{"$f":"'G. Communications and Ops Mgmt'!F8","v":0},{"$f":"'G. Communications and Ops Mgmt'!G8","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!H8","v":"12.1.2.a"},{"$f":"'G. Communications and Ops Mgmt'!I8","v":"Change Management"},null,"AI6.1","Change standards and procedures","6.4.5","D&A.1.7.1.3 D&A.1.7.1.5 D&A.1.10.1.1.3 D&A.1.10.1.1.5","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A9","v":823},{"$f":"'G. Communications and Ops Mgmt'!J9","v":2},{"$f":"'G. Communications and Ops Mgmt'!K9","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y9","v":0},{"$f":"'G. Communications and Ops Mgmt'!B9","v":"G.2.2"},{"$f":"'G. Communications and Ops Mgmt'!C9","v":"Request, review and approval of proposed changes?"},{"$f":"'G. Communications and Ops Mgmt'!D9","v":0},{"$f":"'G. Communications and Ops Mgmt'!E9","v":0},{"$f":"'G. Communications and Ops Mgmt'!F9","v":0},{"$f":"'G. Communications and Ops Mgmt'!G9","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!H9","v":"12.1.2.d"},{"$f":"'G. Communications and Ops Mgmt'!I9","v":"Change Management"},null,"AI6.1","Change standards and procedures","6.4.5.2","D&A.1.5.1.7 D&A.1.7.1.1 D&A.1.10.1.1.1","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A10","v":829},{"$f":"'G. Communications and Ops Mgmt'!J10","v":2},{"$f":"'G. Communications and Ops Mgmt'!K10","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y10","v":0},{"$f":"'G. Communications and Ops Mgmt'!B10","v":"G.2.3"},{"$f":"'G. Communications and Ops Mgmt'!C10","v":"Pre-implementation testing?"},{"$f":"'G. Communications and Ops Mgmt'!D10","v":0},{"$f":"'G. Communications and Ops Mgmt'!E10","v":0},{"$f":"'G. Communications and Ops Mgmt'!F10","v":0},{"$f":"'G. Communications and Ops Mgmt'!G10","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!H10","v":"12.1.2.b"},{"$f":"'G. Communications and Ops Mgmt'!I10","v":"Change Management"},null,"AI6.1","Change standards and procedures","6.4.5.3","D&A.1.7.1.2 D&A.1.10.1.1.2","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A11","v":830},{"$f":"'G. Communications and Ops Mgmt'!J11","v":2},{"$f":"'G. Communications and Ops Mgmt'!K11","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y11","v":0},{"$f":"'G. Communications and Ops Mgmt'!B11","v":"G.2.4"},{"$f":"'G. Communications and Ops Mgmt'!C11","v":"Post-implementation testing?"},{"$f":"'G. Communications and Ops Mgmt'!D11","v":0},{"$f":"'G. Communications and Ops Mgmt'!E11","v":0},{"$f":"'G. Communications and Ops Mgmt'!F11","v":0},{"$f":"'G. Communications and Ops Mgmt'!G11","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!H11","v":"12.1.2.b"},{"$f":"'G. Communications and Ops Mgmt'!I11","v":"Change Management"},null,"AI6.1","Change standards and procedures","6.4.5.3","D&A.1.7.1.2 D&A.1.10.1.1.2","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A12","v":824},{"$f":"'G. Communications and Ops Mgmt'!J12","v":2},{"$f":"'G. Communications and Ops Mgmt'!K12","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y12","v":0},{"$f":"'G. Communications and Ops Mgmt'!B12","v":"G.2.5"},{"$f":"'G. Communications and Ops Mgmt'!C12","v":"Review for potential security impact?"},{"$f":"'G. Communications and Ops Mgmt'!D12","v":0},{"$f":"'G. Communications and Ops Mgmt'!E12","v":0},{"$f":"'G. Communications and Ops Mgmt'!F12","v":0},{"$f":"'G. Communications and Ops Mgmt'!G12","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!H12","v":"12.1.2.c"},{"$f":"'G. Communications and Ops Mgmt'!I12","v":"Change Management"},null,"AI6.1","Change standards and procedures","6.4.5.1","N/A","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A13","v":826},{"$f":"'G. Communications and Ops Mgmt'!J13","v":2},{"$f":"'G. Communications and Ops Mgmt'!K13","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y13","v":0},{"$f":"'G. Communications and Ops Mgmt'!B13","v":"G.2.6"},{"$f":"'G. Communications and Ops Mgmt'!C13","v":"Review for potential operational impact?"},{"$f":"'G. Communications and Ops Mgmt'!D13","v":0},{"$f":"'G. Communications and Ops Mgmt'!E13","v":0},{"$f":"'G. Communications and Ops Mgmt'!F13","v":0},{"$f":"'G. Communications and Ops Mgmt'!G13","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!H13","v":"12.1.2.c"},{"$f":"'G. Communications and Ops Mgmt'!I13","v":"Change Management"},null,"AI6.1","Change standards and procedures","6.4.5.1","D&A.1.7.1.4","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A14","v":2593},{"$f":"'G. Communications and Ops Mgmt'!J14","v":2},{"$f":"'G. Communications and Ops Mgmt'!K14","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y14","v":0},{"$f":"'G. Communications and Ops Mgmt'!B14","v":"G.2.7"},{"$f":"'G. Communications and Ops Mgmt'!C14","v":"Communication of changes to all relevant constituents?"},{"$f":"'G. Communications and Ops Mgmt'!D14","v":0},{"$f":"'G. Communications and Ops Mgmt'!E14","v":0},{"$f":"'G. Communications and Ops Mgmt'!F14","v":0},{"$f":"'G. Communications and Ops Mgmt'!G14","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!H14","v":"12.1.2.f"},{"$f":"'G. Communications and Ops Mgmt'!I14","v":"Change Management"},null,"AI6.1","Change standards and procedures","N/A","D&A.1.7.1.6 D&A.1.10.1.1.6","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A15","v":831},{"$f":"'G. Communications and Ops Mgmt'!J15","v":2},{"$f":"'G. Communications and Ops Mgmt'!K15","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y15","v":0},{"$f":"'G. Communications and Ops Mgmt'!B15","v":"G.2.8"},{"$f":"'G. Communications and Ops Mgmt'!C15","v":"Rollback procedures?"},{"$f":"'G. Communications and Ops Mgmt'!D15","v":0},{"$f":"'G. Communications and Ops Mgmt'!E15","v":0},{"$f":"'G. Communications and Ops Mgmt'!F15","v":0},{"$f":"'G. Communications and Ops Mgmt'!G15","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!H15","v":"12.1.2.g"},{"$f":"'G. Communications and Ops Mgmt'!I15","v":"Change Management"},null,"AI6.1","Change standards and procedures","6.4.5.4","D&A.1.10.1.1.4 D&A.1.11.1.6","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A16","v":841},{"$f":"'G. Communications and Ops Mgmt'!J16","v":2},{"$f":"'G. Communications and Ops Mgmt'!K16","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y16","v":0},{"$f":"'G. Communications and Ops Mgmt'!B16","v":"G.2.9"},{"$f":"'G. Communications and Ops Mgmt'!C16","v":"Maintenance of change control logs?"},{"$f":"'G. Communications and Ops Mgmt'!D16","v":0},{"$f":"'G. Communications and Ops Mgmt'!E16","v":0},{"$f":"'G. Communications and Ops Mgmt'!F16","v":0},{"$f":"'G. Communications and Ops Mgmt'!G16","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!H16","v":"14.2.2.j"},{"$f":"'G. Communications and Ops Mgmt'!I16","v":"System change control procedures"},null,"AI6.1","Change standards and procedures","N/A","N/A","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A17","v":837},{"$f":"'G. Communications and Ops Mgmt'!J17","v":2},{"$f":"'G. Communications and Ops Mgmt'!K17","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y17","v":0},{"$f":"'G. Communications and Ops Mgmt'!B17","v":"G.2.10"},{"$f":"'G. Communications and Ops Mgmt'!C17","v":"Code reviewed by information security prior to the implementation of internally developed applications and / or application updates?"},{"$f":"'G. Communications and Ops Mgmt'!D17","v":0},{"$f":"'G. Communications and Ops Mgmt'!E17","v":0},{"$f":"'G. Communications and Ops Mgmt'!F17","v":0},{"$f":"'G. Communications and Ops Mgmt'!G17","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!H17","v":"14.2.2.e"},{"$f":"'G. Communications and Ops Mgmt'!I17","v":"System change control procedures"},null,"AI2.6","Major upgrades to existing systems","6.3.2","N/A","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'G. Communications and Ops Mgmt'!A18","v":839},{"$f":"'G. Communications and Ops Mgmt'!J18","v":2},{"$f":"'G. Communications and Ops Mgmt'!K18","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y18","v":0},{"$f":"'G. Communications and Ops Mgmt'!B18","v":"G.2.11"},{"$f":"'G. Communications and Ops Mgmt'!C18","v":"Is Information security's approval required prior to implementation changes?"},{"$f":"'G. Communications and Ops Mgmt'!D18","v":0},{"$f":"'G. Communications and Ops Mgmt'!E18","v":0},{"$f":"'G. Communications and Ops Mgmt'!F18","v":0},{"$f":"'G. Communications and Ops Mgmt'!G18","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!H18","v":"14.2.2.f"},{"$f":"'G. Communications and Ops Mgmt'!I18","v":"System change control procedures"},null,null,null,"6.4.5.2","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A19","v":832},{"$f":"'G. Communications and Ops Mgmt'!J19","v":2},{"$f":"'G. Communications and Ops Mgmt'!K19","v":1},{"$f":"'G. Communications and Ops Mgmt'!Y19","v":0},{"$f":"'G. Communications and Ops Mgmt'!B19","v":"G.2.12"},{"$f":"'G. Communications and Ops Mgmt'!C19","v":"Are the following changes to the production environment subject to the change control process:"},{"$f":"'G. Communications and Ops Mgmt'!D19","v":0},{"$f":"'G. Communications and Ops Mgmt'!E19","v":0},{"$f":"'G. Communications and Ops Mgmt'!F19","v":0},{"$f":"'G. Communications and Ops Mgmt'!G19","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!H19","v":"12.1.2                                      14.2.2"},{"$f":"'G. Communications and Ops Mgmt'!I19","v":"Change Management System change control procedures"},null,"AI6.1","Change standards and procedures","N/A","N/A","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A20","v":833},{"$f":"'G. Communications and Ops Mgmt'!J20","v":3},{"$f":"'G. Communications and Ops Mgmt'!K20","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y20","v":0},{"$f":"'G. Communications and Ops Mgmt'!B20","v":"G.2.12.1"},{"$f":"'G. Communications and Ops Mgmt'!C20","v":"Network?"},{"$f":"'G. Communications and Ops Mgmt'!D20","v":0},{"$f":"'G. Communications and Ops Mgmt'!E20","v":0},{"$f":"'G. Communications and Ops Mgmt'!F20","v":0},{"$f":"'G. Communications and Ops Mgmt'!G20","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!H20","v":"14.2.2"},{"$f":"'G. Communications and Ops Mgmt'!I20","v":"System change control procedures"},null,null,null,"N/A","IS.2.B.1.2 IS.2.B.2.1 IS.2.B.10.9","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A21","v":834},{"$f":"'G. Communications and Ops Mgmt'!J21","v":3},{"$f":"'G. Communications and Ops Mgmt'!K21","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y21","v":0},{"$f":"'G. Communications and Ops Mgmt'!B21","v":"G.2.12.2"},{"$f":"'G. Communications and Ops Mgmt'!C21","v":"Systems?"},{"$f":"'G. Communications and Ops Mgmt'!D21","v":0},{"$f":"'G. Communications and Ops Mgmt'!E21","v":0},{"$f":"'G. Communications and Ops Mgmt'!F21","v":0},{"$f":"'G. Communications and Ops Mgmt'!G21","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!H21","v":"14.2.2"},{"$f":"'G. Communications and Ops Mgmt'!I21","v":"System change control procedures"},null,"AI6.1","Change standards and procedures","N/A","N/A","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A22","v":835},{"$f":"'G. Communications and Ops Mgmt'!J22","v":3},{"$f":"'G. Communications and Ops Mgmt'!K22","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y22","v":0},{"$f":"'G. Communications and Ops Mgmt'!B22","v":"G.2.12.3"},{"$f":"'G. Communications and Ops Mgmt'!C22","v":"Application updates?"},{"$f":"'G. Communications and Ops Mgmt'!D22","v":0},{"$f":"'G. Communications and Ops Mgmt'!E22","v":0},{"$f":"'G. Communications and Ops Mgmt'!F22","v":0},{"$f":"'G. Communications and Ops Mgmt'!G22","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!H22","v":"14.2.2"},{"$f":"'G. Communications and Ops Mgmt'!I22","v":"System change control procedures"},null,"AI6.1","Change standards and procedures","N/A","N/A","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A23","v":836},{"$f":"'G. Communications and Ops Mgmt'!J23","v":3},{"$f":"'G. Communications and Ops Mgmt'!K23","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y23","v":0},{"$f":"'G. Communications and Ops Mgmt'!B23","v":"G.2.12.4"},{"$f":"'G. Communications and Ops Mgmt'!C23","v":"Code changes?"},{"$f":"'G. Communications and Ops Mgmt'!D23","v":0},{"$f":"'G. Communications and Ops Mgmt'!E23","v":0},{"$f":"'G. Communications and Ops Mgmt'!F23","v":0},{"$f":"'G. Communications and Ops Mgmt'!G23","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!H23","v":"14.2.2"},{"$f":"'G. Communications and Ops Mgmt'!I23","v":"System change control procedures"},null,"AI6.1","Change standards and procedures","N/A","N/A","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A24","v":838},{"$f":"'G. Communications and Ops Mgmt'!J24","v":2},{"$f":"'G. Communications and Ops Mgmt'!K24","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y24","v":0},{"$f":"'G. Communications and Ops Mgmt'!B24","v":"G.2.13"},{"$f":"'G. Communications and Ops Mgmt'!C24","v":"Is there a segregation of duties between those requesting, approving and implementing a change?"},{"$f":"'G. Communications and Ops Mgmt'!D24","v":0},{"$f":"'G. Communications and Ops Mgmt'!E24","v":0},{"$f":"'G. Communications and Ops Mgmt'!F24","v":0},{"$f":"'G. Communications and Ops Mgmt'!G24","v":"G.21 Change Control"},{"$f":"'G. Communications and Ops Mgmt'!H24","v":"6.1.2"},{"$f":"'G. Communications and Ops Mgmt'!I24","v":"Segregation of Duties"},null,"PO4.11","Segregation of duties","N/A","N/A","PO4.11, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A25","v":853},{"$f":"'G. Communications and Ops Mgmt'!J25","v":1},{"$f":"'G. Communications and Ops Mgmt'!K25","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y25","v":1},{"$f":"'G. Communications and Ops Mgmt'!B25","v":"G.3"},{"$f":"'G. Communications and Ops Mgmt'!C25","v":"Do Subcontractors have access to Scoped Systems and Data? (backup vendors, service providers, equipment support maintenance, software maintenance vendors, data recovery vendors, etc.)? If yes, is there:"},{"$f":"'G. Communications and Ops Mgmt'!D25","v":0},{"$f":"'G. Communications and Ops Mgmt'!E25","v":0},{"$f":"'G. Communications and Ops Mgmt'!F25","v":0},{"$f":"'G. Communications and Ops Mgmt'!G25","v":0},{"$f":"'G. Communications and Ops Mgmt'!H25","v":15},{"$f":"'G. Communications and Ops Mgmt'!I25","v":"Supplier relationships"},null,"DS1.1","Service level management framework",12.8,"IS.1.4.1.11 IS.1.5.1 O.1.3.1.1 O.1.3.3","DS1.1, DS1.2, DS1.3, DS2.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A26","v":3897},{"$f":"'G. Communications and Ops Mgmt'!J26","v":2},{"$f":"'G. Communications and Ops Mgmt'!K26","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y26","v":0},{"$f":"'G. Communications and Ops Mgmt'!B26","v":"G.3.1"},{"$f":"'G. Communications and Ops Mgmt'!C26","v":"Is there a documented subcontractor management process in place for the selection and oversight of third party vendors? If yes, does it include:"},{"$f":"'G. Communications and Ops Mgmt'!D26","v":0},{"$f":"'G. Communications and Ops Mgmt'!E26","v":0},{"$f":"'G. Communications and Ops Mgmt'!F26","v":0},{"$f":"'G. Communications and Ops Mgmt'!G26","v":"T.1 Subcontractor Selection and Management Process"},{"$f":"'G. Communications and Ops Mgmt'!H26","v":"15.1.1"},{"$f":"'G. Communications and Ops Mgmt'!I26","v":"Information security policy for supplier relationships"},null,"DS1.5","Monitoring and reporting of service level achievements","N/A","IS.1.4.1.11 IS.1.5.4 O.1.3.1.2 O.2.D.1","DS1.5, DS2.4, ME2.6"]
[{"$f":"'G. Communications and Ops Mgmt'!A27","v":3898},{"$f":"'G. Communications and Ops Mgmt'!J27","v":3},{"$f":"'G. Communications and Ops Mgmt'!K27","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y27","v":0},{"$f":"'G. Communications and Ops Mgmt'!B27","v":"G.3.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C27","v":"Approval by management?"},{"$f":"'G. Communications and Ops Mgmt'!D27","v":0},{"$f":"'G. Communications and Ops Mgmt'!E27","v":0},{"$f":"'G. Communications and Ops Mgmt'!F27","v":0},{"$f":"'G. Communications and Ops Mgmt'!G27","v":"T.1 Subcontractor Selection and Management Process"},{"$f":"'G. Communications and Ops Mgmt'!H27","v":"5.1.1"},{"$f":"'G. Communications and Ops Mgmt'!I27","v":"Policies on information security"},null,"PO4.14","Contracted staff policies and procedures","12.8.4","IS.1.5.1 IS.1.5.4 O.1.2.1 O.1.3.5 IS.2.J.2","PO4.14, DS2.1, DS2.3, DS5.4, DS5.9, DS5.11, DS12.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A28","v":3899},{"$f":"'G. Communications and Ops Mgmt'!J28","v":3},{"$f":"'G. Communications and Ops Mgmt'!K28","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y28","v":0},{"$f":"'G. Communications and Ops Mgmt'!B28","v":"G.3.1.2"},{"$f":"'G. Communications and Ops Mgmt'!C28","v":"Annual review?"},{"$f":"'G. Communications and Ops Mgmt'!D28","v":0},{"$f":"'G. Communications and Ops Mgmt'!E28","v":0},{"$f":"'G. Communications and Ops Mgmt'!F28","v":0},{"$f":"'G. Communications and Ops Mgmt'!G28","v":"T.1 Subcontractor Selection and Management Process"},{"$f":"'G. Communications and Ops Mgmt'!H28","v":"5.1.2"},{"$f":"'G. Communications and Ops Mgmt'!I28","v":"Review of the policies for information security"},null,"PO4.14","Contracted staff policies and procedures","N/A","IS.1.5.3","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"'G. Communications and Ops Mgmt'!A29","v":3900},{"$f":"'G. Communications and Ops Mgmt'!J29","v":3},{"$f":"'G. Communications and Ops Mgmt'!K29","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y29","v":0},{"$f":"'G. Communications and Ops Mgmt'!B29","v":"G.3.1.3"},{"$f":"'G. Communications and Ops Mgmt'!C29","v":"Review of the subcontractor's vendor management policy and procedures?"},{"$f":"'G. Communications and Ops Mgmt'!D29","v":0},{"$f":"'G. Communications and Ops Mgmt'!E29","v":0},{"$f":"'G. Communications and Ops Mgmt'!F29","v":0},{"$f":"'G. Communications and Ops Mgmt'!G29","v":"T.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!H29","v":"15.2.1.g"},{"$f":"'G. Communications and Ops Mgmt'!I29","v":"Monitoring and review of supplier services"},null,"DS1.5","Monitoring and reporting of service level achievements","N/A","N/A","DS1.5, DS2.2, DS2.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A30","v":3901},{"$f":"'G. Communications and Ops Mgmt'!J30","v":2},{"$f":"'G. Communications and Ops Mgmt'!K30","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y30","v":0},{"$f":"'G. Communications and Ops Mgmt'!B30","v":"G.3.2"},{"$f":"'G. Communications and Ops Mgmt'!C30","v":"Is there a process to identify and log subcontractor information security, privacy and/or data breach issues?"},{"$f":"'G. Communications and Ops Mgmt'!D30","v":0},{"$f":"'G. Communications and Ops Mgmt'!E30","v":0},{"$f":"'G. Communications and Ops Mgmt'!F30","v":0},{"$f":"'G. Communications and Ops Mgmt'!G30","v":"T.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!H30","v":"15.2.1.e"},{"$f":"'G. Communications and Ops Mgmt'!I30","v":"Monitoring and review of supplier services"},null,"DS3.1","Performance and capacity planning","N/A","E-BANK.1.4.3.1 RPS.1.1.5.3","DS3.1, DS3.2, DS3.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A31","v":3902},{"$f":"'G. Communications and Ops Mgmt'!J31","v":2},{"$f":"'G. Communications and Ops Mgmt'!K31","v":1},{"$f":"'G. Communications and Ops Mgmt'!Y31","v":0},{"$f":"'G. Communications and Ops Mgmt'!B31","v":"G.3.3"},{"$f":"'G. Communications and Ops Mgmt'!C31","v":"Do subcontractor's, as part of their vendor risk management program, include the following:"},{"$f":"'G. Communications and Ops Mgmt'!D31","v":0},{"$f":"'G. Communications and Ops Mgmt'!E31","v":0},{"$f":"'G. Communications and Ops Mgmt'!F31","v":0},{"$f":"'G. Communications and Ops Mgmt'!G31","v":0},{"$f":"'G. Communications and Ops Mgmt'!H31","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I31","v":0},null,"PO3.4","Technology standards","N/A","D&A.1.6.1.9","PO3.4, AI1.1, AI1.4, AI2.4, AI2.8, AI4.4, AI7.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A32","v":3903},{"$f":"'G. Communications and Ops Mgmt'!J32","v":3},{"$f":"'G. Communications and Ops Mgmt'!K32","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y32","v":0},{"$f":"'G. Communications and Ops Mgmt'!B32","v":"G.3.3.1"},{"$f":"'G. Communications and Ops Mgmt'!C32","v":"Comprehensive financial analysis?"},{"$f":"'G. Communications and Ops Mgmt'!D32","v":0},{"$f":"'G. Communications and Ops Mgmt'!E32","v":0},{"$f":"'G. Communications and Ops Mgmt'!F32","v":0},{"$f":"'G. Communications and Ops Mgmt'!G32","v":"T.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!H32","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I32","v":0},null,"PO3.4","Technology standards","N/A","D&A.1.6.1.9.2 OPS.1.5.1.1 RPS.1.1.5.3","PO3.4, AI1.1, AI1.4, AI2.4, AI2.8, AI4.4, AI7.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A33","v":3904},{"$f":"'G. Communications and Ops Mgmt'!J33","v":3},{"$f":"'G. Communications and Ops Mgmt'!K33","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y33","v":0},{"$f":"'G. Communications and Ops Mgmt'!B33","v":"G.3.3.2"},{"$f":"'G. Communications and Ops Mgmt'!C33","v":"Vendor reputational review?"},{"$f":"'G. Communications and Ops Mgmt'!D33","v":0},{"$f":"'G. Communications and Ops Mgmt'!E33","v":0},{"$f":"'G. Communications and Ops Mgmt'!F33","v":0},{"$f":"'G. Communications and Ops Mgmt'!G33","v":"T.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!H33","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I33","v":0},null,"PO3.4","Technology standards","N/A","N/A","PO3.4, AI1.1, AI1.4, AI2.4, AI2.8, AI4.4, AI7.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A34","v":3905},{"$f":"'G. Communications and Ops Mgmt'!J34","v":3},{"$f":"'G. Communications and Ops Mgmt'!K34","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y34","v":0},{"$f":"'G. Communications and Ops Mgmt'!B34","v":"G.3.3.3"},{"$f":"'G. Communications and Ops Mgmt'!C34","v":"Compliance checks (e.g., Office of Foreign Assets Controls (OFAC), etc.)?"},{"$f":"'G. Communications and Ops Mgmt'!D34","v":0},{"$f":"'G. Communications and Ops Mgmt'!E34","v":0},{"$f":"'G. Communications and Ops Mgmt'!F34","v":0},{"$f":"'G. Communications and Ops Mgmt'!G34","v":"T.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!H34","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I34","v":0},null,"PO3.4","Technology standards","N/A","D&A.1.6.1.10.4","PO3.4, AI1.1, AI1.4, AI2.4, AI2.8, AI4.4, AI7.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A35","v":3906},{"$f":"'G. Communications and Ops Mgmt'!J35","v":3},{"$f":"'G. Communications and Ops Mgmt'!K35","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y35","v":0},{"$f":"'G. Communications and Ops Mgmt'!B35","v":"G.3.3.4"},{"$f":"'G. Communications and Ops Mgmt'!C35","v":"Defined risk assessment and classification method for vendors?"},{"$f":"'G. Communications and Ops Mgmt'!D35","v":0},{"$f":"'G. Communications and Ops Mgmt'!E35","v":0},{"$f":"'G. Communications and Ops Mgmt'!F35","v":0},{"$f":"'G. Communications and Ops Mgmt'!G35","v":"T.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!H35","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I35","v":0},null,"PO3.4","Technology standards","N/A","D&A.1.6.1.9.1","PO3.4, AI1.1, AI1.4, AI2.4, AI2.8, AI4.4, AI7.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A36","v":3907},{"$f":"'G. Communications and Ops Mgmt'!J36","v":3},{"$f":"'G. Communications and Ops Mgmt'!K36","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y36","v":0},{"$f":"'G. Communications and Ops Mgmt'!B36","v":"G.3.3.5"},{"$f":"'G. Communications and Ops Mgmt'!C36","v":"Management of subcontractor risk, compliance and performance?"},{"$f":"'G. Communications and Ops Mgmt'!D36","v":0},{"$f":"'G. Communications and Ops Mgmt'!E36","v":0},{"$f":"'G. Communications and Ops Mgmt'!F36","v":0},{"$f":"'G. Communications and Ops Mgmt'!G36","v":"T.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!H36","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I36","v":0},null,"PO3.4","Technology standards","N/A","N/A","PO3.4, AI1.1, AI1.4, AI2.4, AI2.8, AI4.4, AI7.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A37","v":3908},{"$f":"'G. Communications and Ops Mgmt'!J37","v":3},{"$f":"'G. Communications and Ops Mgmt'!K37","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y37","v":0},{"$f":"'G. Communications and Ops Mgmt'!B37","v":"G.3.3.6"},{"$f":"'G. Communications and Ops Mgmt'!C37","v":"Ability and right to audit controls? "},{"$f":"'G. Communications and Ops Mgmt'!D37","v":0},{"$f":"'G. Communications and Ops Mgmt'!E37","v":0},{"$f":"'G. Communications and Ops Mgmt'!F37","v":0},{"$f":"'G. Communications and Ops Mgmt'!G37","v":"T.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!H37","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I37","v":0},null,"PO3.4","Technology standards","N/A","BCP.1.4.3.2","PO3.4, AI1.1, AI1.4, AI2.4, AI2.8, AI4.4, AI7.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A38","v":3909},{"$f":"'G. Communications and Ops Mgmt'!J38","v":3},{"$f":"'G. Communications and Ops Mgmt'!K38","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y38","v":0},{"$f":"'G. Communications and Ops Mgmt'!B38","v":"G.3.3.7"},{"$f":"'G. Communications and Ops Mgmt'!C38","v":"Notification of new or change in subcontractors?"},{"$f":"'G. Communications and Ops Mgmt'!D38","v":0},{"$f":"'G. Communications and Ops Mgmt'!E38","v":0},{"$f":"'G. Communications and Ops Mgmt'!F38","v":0},{"$f":"'G. Communications and Ops Mgmt'!G38","v":"T.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!H38","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I38","v":0},null,"PO3.4","Technology standards","N/A","N/A","PO3.4, AI1.1, AI1.4, AI2.4, AI2.8, AI4.4, AI7.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A39","v":3910},{"$f":"'G. Communications and Ops Mgmt'!J39","v":3},{"$f":"'G. Communications and Ops Mgmt'!K39","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y39","v":0},{"$f":"'G. Communications and Ops Mgmt'!B39","v":"G.3.3.8"},{"$f":"'G. Communications and Ops Mgmt'!C39","v":"Defined procedures for subcontractor management?"},{"$f":"'G. Communications and Ops Mgmt'!D39","v":0},{"$f":"'G. Communications and Ops Mgmt'!E39","v":0},{"$f":"'G. Communications and Ops Mgmt'!F39","v":0},{"$f":"'G. Communications and Ops Mgmt'!G39","v":"T.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!H39","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I39","v":0},null,"PO3.4","Technology standards","N/A","N/A","PO3.4, AI1.1, AI1.4, AI2.4, AI2.8, AI4.4, AI7.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A40","v":3911},{"$f":"'G. Communications and Ops Mgmt'!J40","v":3},{"$f":"'G. Communications and Ops Mgmt'!K40","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y40","v":0},{"$f":"'G. Communications and Ops Mgmt'!B40","v":"G.3.3.9"},{"$f":"'G. Communications and Ops Mgmt'!C40","v":"Oversight and Governance of program adherence?"},{"$f":"'G. Communications and Ops Mgmt'!D40","v":0},{"$f":"'G. Communications and Ops Mgmt'!E40","v":0},{"$f":"'G. Communications and Ops Mgmt'!F40","v":0},{"$f":"'G. Communications and Ops Mgmt'!G40","v":"T.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!H40","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I40","v":0},null,"PO4.11","Segregation of duties",5.0999999999999996,"IS.2.B.1 OPS.1.5.1.5 AUDIT.2.D.1.14","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A41","v":873},{"$f":"'G. Communications and Ops Mgmt'!J41","v":3},{"$f":"'G. Communications and Ops Mgmt'!K41","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y41","v":0},{"$f":"'G. Communications and Ops Mgmt'!B41","v":"G.3.3.10"},{"$f":"'G. Communications and Ops Mgmt'!C41","v":"Security review prior to engaging their services (logical, physical, other controls)?"},{"$f":"'G. Communications and Ops Mgmt'!D41","v":0},{"$f":"'G. Communications and Ops Mgmt'!E41","v":0},{"$f":"'G. Communications and Ops Mgmt'!F41","v":0},{"$f":"'G. Communications and Ops Mgmt'!G41","v":"T.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!H41","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I41","v":0},null,"DS5.5","Security testing, surveillance and monitoring","5.2.b","IS.2.B.10.10 WPS.1.2.1.1","DS5.5, DS5.7, ME2.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A42","v":874},{"$f":"'G. Communications and Ops Mgmt'!J42","v":3},{"$f":"'G. Communications and Ops Mgmt'!K42","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y42","v":0},{"$f":"'G. Communications and Ops Mgmt'!B42","v":"G.3.3.11"},{"$f":"'G. Communications and Ops Mgmt'!C42","v":"Security review at least annually?"},{"$f":"'G. Communications and Ops Mgmt'!D42","v":0},{"$f":"'G. Communications and Ops Mgmt'!E42","v":0},{"$f":"'G. Communications and Ops Mgmt'!F42","v":0},{"$f":"'G. Communications and Ops Mgmt'!G42","v":"T.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!H42","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I42","v":0},null,"DS5.10","Network security","N/A","IS.1.4.1.2.2 IS.2.B.9.1 IS.2.B.9.3","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A43","v":875},{"$f":"'G. Communications and Ops Mgmt'!J43","v":3},{"$f":"'G. Communications and Ops Mgmt'!K43","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y43","v":0},{"$f":"'G. Communications and Ops Mgmt'!B43","v":"G.3.3.12"},{"$f":"'G. Communications and Ops Mgmt'!C43","v":"Risk assessments or review?"},{"$f":"'G. Communications and Ops Mgmt'!D43","v":0},{"$f":"'G. Communications and Ops Mgmt'!E43","v":0},{"$f":"'G. Communications and Ops Mgmt'!F43","v":0},{"$f":"'G. Communications and Ops Mgmt'!G43","v":"T.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!H43","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I43","v":0},null,"DS5.10","Network security","N/A","IS.2.B.2.2 IS.2.B.10.4 IS.2.M.4.3","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A44","v":878},{"$f":"'G. Communications and Ops Mgmt'!J44","v":3},{"$f":"'G. Communications and Ops Mgmt'!K44","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y44","v":0},{"$f":"'G. Communications and Ops Mgmt'!B44","v":"G.3.3.13"},{"$f":"'G. Communications and Ops Mgmt'!C44","v":"Confidentiality and/or Non Disclosure Agreement requirements?"},{"$f":"'G. Communications and Ops Mgmt'!D44","v":0},{"$f":"'G. Communications and Ops Mgmt'!E44","v":0},{"$f":"'G. Communications and Ops Mgmt'!F44","v":0},{"$f":"'G. Communications and Ops Mgmt'!G44","v":"T.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!H44","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I44","v":0},null,"PO2.1","Enterprise information architecture model","N/A","IS.2.B.10.3","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A45","v":879},{"$f":"'G. Communications and Ops Mgmt'!J45","v":3},{"$f":"'G. Communications and Ops Mgmt'!K45","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y45","v":0},{"$f":"'G. Communications and Ops Mgmt'!B45","v":"G.3.3.14"},{"$f":"'G. Communications and Ops Mgmt'!C45","v":"Notification of changes affecting services rendered?"},{"$f":"'G. Communications and Ops Mgmt'!D45","v":0},{"$f":"'G. Communications and Ops Mgmt'!E45","v":0},{"$f":"'G. Communications and Ops Mgmt'!F45","v":0},{"$f":"'G. Communications and Ops Mgmt'!G45","v":"T.3 Documenting Information Security Assessments for Subcontractors"},{"$f":"'G. Communications and Ops Mgmt'!H45","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I45","v":0},null,"DS5.3","Identity management","N/A","IS.2.B.7 IS.2.B.10.2","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A46","v":895},{"$f":"'G. Communications and Ops Mgmt'!J46","v":1},{"$f":"'G. Communications and Ops Mgmt'!K46","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y46","v":1},{"$f":"'G. Communications and Ops Mgmt'!B46","v":"G.4"},{"$f":"'G. Communications and Ops Mgmt'!C46","v":"Is there an anti-virus/malware policy or program (workstations, servers, mobile devices) that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"'G. Communications and Ops Mgmt'!D46","v":0},{"$f":"'G. Communications and Ops Mgmt'!E46","v":0},{"$f":"'G. Communications and Ops Mgmt'!F46","v":0},{"$f":"'G. Communications and Ops Mgmt'!G46","v":"G.7 Virus Protection (Servers)\nG.8 Virus Protection (Workstations)"},{"$f":"'G. Communications and Ops Mgmt'!H46","v":"12.2.1"},{"$f":"'G. Communications and Ops Mgmt'!I46","v":"Controls Against Malware"},null,"PO4.11","Segregation of duties","N/A","IS.2.B.9.4 IS.2.M.5","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A47","v":912},{"$f":"'G. Communications and Ops Mgmt'!J47","v":2},{"$f":"'G. Communications and Ops Mgmt'!K47","v":1},{"$f":"'G. Communications and Ops Mgmt'!Y47","v":0},{"$f":"'G. Communications and Ops Mgmt'!B47","v":"G.4.1"},{"$f":"'G. Communications and Ops Mgmt'!C47","v":"What is the interval between the availability of a new signature update and its deployment:"},{"$f":"'G. Communications and Ops Mgmt'!D47","v":0},{"$f":"'G. Communications and Ops Mgmt'!E47","v":0},{"$f":"'G. Communications and Ops Mgmt'!F47","v":0},{"$f":"'G. Communications and Ops Mgmt'!G47","v":"G.1 Network Security – IDS / IPS Signature Updates"},{"$f":"'G. Communications and Ops Mgmt'!H47","v":"12.6.1"},{"$f":"'G. Communications and Ops Mgmt'!I47","v":"Management of technical vulnerabilities"},null,"PO4.11","Segregation of duties","N/A","IS.2.A.7 IS.2.B.12 IS.2.B.17.5","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A48","v":913},{"$f":"'G. Communications and Ops Mgmt'!J48","v":3},{"$f":"'G. Communications and Ops Mgmt'!K48","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y48","v":0},{"$f":"'G. Communications and Ops Mgmt'!B48","v":"G.4.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C48","v":"Hourly?"},{"$f":"'G. Communications and Ops Mgmt'!D48","v":0},{"$f":"'G. Communications and Ops Mgmt'!E48","v":0},{"$f":"'G. Communications and Ops Mgmt'!F48","v":0},{"$f":"'G. Communications and Ops Mgmt'!G48","v":"G.1 Network Security – IDS / IPS Signature Updates"},{"$f":"'G. Communications and Ops Mgmt'!H48","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I48","v":""},null,"AI2.3","Application control and auditability","9.5.1","N/A","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A49","v":914},{"$f":"'G. Communications and Ops Mgmt'!J49","v":3},{"$f":"'G. Communications and Ops Mgmt'!K49","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y49","v":0},{"$f":"'G. Communications and Ops Mgmt'!B49","v":"G.4.1.2"},{"$f":"'G. Communications and Ops Mgmt'!C49","v":"Daily?"},{"$f":"'G. Communications and Ops Mgmt'!D49","v":0},{"$f":"'G. Communications and Ops Mgmt'!E49","v":0},{"$f":"'G. Communications and Ops Mgmt'!F49","v":0},{"$f":"'G. Communications and Ops Mgmt'!G49","v":"G.1 Network Security – IDS / IPS Signature Updates"},{"$f":"'G. Communications and Ops Mgmt'!H49","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I49","v":""},null,"DS5.5","Security testing, surveillance and monitoring","N/A","N/A","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A50","v":915},{"$f":"'G. Communications and Ops Mgmt'!J50","v":3},{"$f":"'G. Communications and Ops Mgmt'!K50","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y50","v":0},{"$f":"'G. Communications and Ops Mgmt'!B50","v":"G.4.1.3"},{"$f":"'G. Communications and Ops Mgmt'!C50","v":"Weekly?"},{"$f":"'G. Communications and Ops Mgmt'!D50","v":0},{"$f":"'G. Communications and Ops Mgmt'!E50","v":0},{"$f":"'G. Communications and Ops Mgmt'!F50","v":0},{"$f":"'G. Communications and Ops Mgmt'!G50","v":"G.1 Network Security – IDS / IPS Signature Updates"},{"$f":"'G. Communications and Ops Mgmt'!H50","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I50","v":""},null,"DS5.5","Security testing, surveillance and monitoring","9.5.1","IS.2.M.1.1 IS.2.M.7","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A51","v":916},{"$f":"'G. Communications and Ops Mgmt'!J51","v":3},{"$f":"'G. Communications and Ops Mgmt'!K51","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y51","v":0},{"$f":"'G. Communications and Ops Mgmt'!B51","v":"G.4.1.4"},{"$f":"'G. Communications and Ops Mgmt'!C51","v":"Monthly?"},{"$f":"'G. Communications and Ops Mgmt'!D51","v":0},{"$f":"'G. Communications and Ops Mgmt'!E51","v":0},{"$f":"'G. Communications and Ops Mgmt'!F51","v":0},{"$f":"'G. Communications and Ops Mgmt'!G51","v":"G.1 Network Security – IDS / IPS Signature Updates"},{"$f":"'G. Communications and Ops Mgmt'!H51","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I51","v":""},null,"AI3.3","Infrastructure maintenance","9.6.2","IS.2.B.9.5 D&A.1.11.1.2","AI3.3, AI6.2, AI6.3, DS5.5, DS5.7, DS9.2"]
[{"$f":"'G. Communications and Ops Mgmt'!A52","v":922},{"$f":"'G. Communications and Ops Mgmt'!J52","v":1},{"$f":"'G. Communications and Ops Mgmt'!K52","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y52","v":1},{"$f":"'G. Communications and Ops Mgmt'!B52","v":"G.5"},{"$f":"'G. Communications and Ops Mgmt'!C52","v":"Are system backups of Scoped Systems and Data performed?"},{"$f":"'G. Communications and Ops Mgmt'!D52","v":0},{"$f":"'G. Communications and Ops Mgmt'!E52","v":0},{"$f":"'G. Communications and Ops Mgmt'!F52","v":0},{"$f":"'G. Communications and Ops Mgmt'!G52","v":"G.20 Backup Media Restoration"},{"$f":"'G. Communications and Ops Mgmt'!H52","v":"12.3.1"},{"$f":"'G. Communications and Ops Mgmt'!I52","v":"Information Back-Up"},null,"AI6.1","Change standards and procedures","9.6.2","IS.2.B.9.6","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A53","v":923},{"$f":"'G. Communications and Ops Mgmt'!J53","v":2},{"$f":"'G. Communications and Ops Mgmt'!K53","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y53","v":0},{"$f":"'G. Communications and Ops Mgmt'!B53","v":"G.5.1"},{"$f":"'G. Communications and Ops Mgmt'!C53","v":"Is there a policy or process for the backup of production data? If yes, does it include a requirement to:"},{"$f":"'G. Communications and Ops Mgmt'!D53","v":0},{"$f":"'G. Communications and Ops Mgmt'!E53","v":0},{"$f":"'G. Communications and Ops Mgmt'!F53","v":0},{"$f":"'G. Communications and Ops Mgmt'!G53","v":"G.20 Backup Media Restoration"},{"$f":"'G. Communications and Ops Mgmt'!H53","v":"12.3.1"},{"$f":"'G. Communications and Ops Mgmt'!I53","v":"Information Back-Up"},null,"DS5.7","Protection of security technology","9.6.2","N/A","DS5.7, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A54","v":2601},{"$f":"'G. Communications and Ops Mgmt'!J54","v":3},{"$f":"'G. Communications and Ops Mgmt'!K54","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y54","v":0},{"$f":"'G. Communications and Ops Mgmt'!B54","v":"G.5.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C54","v":"Store backups to avoid any damage from a disaster at the main site?"},{"$f":"'G. Communications and Ops Mgmt'!D54","v":0},{"$f":"'G. Communications and Ops Mgmt'!E54","v":0},{"$f":"'G. Communications and Ops Mgmt'!F54","v":0},{"$f":"'G. Communications and Ops Mgmt'!G54","v":"G.20 Backup Media Restoration"},{"$f":"'G. Communications and Ops Mgmt'!H54","v":"12.3.1.c"},{"$f":"'G. Communications and Ops Mgmt'!I54","v":"Information Back-Up"},null,"DS5.10","Network security","1.1.4, 1.2, 1.2.3","IS.2.B.2.3","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A55","v":2602},{"$f":"'G. Communications and Ops Mgmt'!J55","v":3},{"$f":"'G. Communications and Ops Mgmt'!K55","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y55","v":0},{"$f":"'G. Communications and Ops Mgmt'!B55","v":"G.5.1.2"},{"$f":"'G. Communications and Ops Mgmt'!C55","v":"Test backup media and restoration procedures at least annually?"},{"$f":"'G. Communications and Ops Mgmt'!D55","v":0},{"$f":"'G. Communications and Ops Mgmt'!E55","v":0},{"$f":"'G. Communications and Ops Mgmt'!F55","v":0},{"$f":"'G. Communications and Ops Mgmt'!G55","v":"G.20 Backup Media Restoration"},{"$f":"'G. Communications and Ops Mgmt'!H55","v":"12.3.1.e"},{"$f":"'G. Communications and Ops Mgmt'!I55","v":"Information Back-Up"},null,"DS5.7","Protection of security technology","1.2.3","AUDIT.2.D.1.17","DS5.7, DS5.9, DS5.11, DS9.2"]
[{"$f":"'G. Communications and Ops Mgmt'!A56","v":951},{"$f":"'G. Communications and Ops Mgmt'!J56","v":2},{"$f":"'G. Communications and Ops Mgmt'!K56","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y56","v":0},{"$f":"'G. Communications and Ops Mgmt'!B56","v":"G.5.2"},{"$f":"'G. Communications and Ops Mgmt'!C56","v":"Is backup media stored offsite? If yes, is there:"},{"$f":"'G. Communications and Ops Mgmt'!D56","v":0},{"$f":"'G. Communications and Ops Mgmt'!E56","v":0},{"$f":"'G. Communications and Ops Mgmt'!F56","v":0},{"$f":"'G. Communications and Ops Mgmt'!G56","v":"G.20 Backup Media Restoration"},{"$f":"'G. Communications and Ops Mgmt'!H56","v":"12.3.1.c"},{"$f":"'G. Communications and Ops Mgmt'!I56","v":"Information Back-Up"},null,"DS5.10","Network security",1.2,"IS.1.4.1.2.2","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A57","v":953},{"$f":"'G. Communications and Ops Mgmt'!J57","v":3},{"$f":"'G. Communications and Ops Mgmt'!K57","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y57","v":0},{"$f":"'G. Communications and Ops Mgmt'!B57","v":"G.5.2.1"},{"$f":"'G. Communications and Ops Mgmt'!C57","v":"Secure transport?"},{"$f":"'G. Communications and Ops Mgmt'!D57","v":0},{"$f":"'G. Communications and Ops Mgmt'!E57","v":0},{"$f":"'G. Communications and Ops Mgmt'!F57","v":0},{"$f":"'G. Communications and Ops Mgmt'!G57","v":"G.20 Backup Media Restoration"},{"$f":"'G. Communications and Ops Mgmt'!H57","v":"8.3.3"},{"$f":"'G. Communications and Ops Mgmt'!I57","v":"Physical media transfer"},null,"DS5.3","Identity management","N/A","N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A58","v":954},{"$f":"'G. Communications and Ops Mgmt'!J58","v":3},{"$f":"'G. Communications and Ops Mgmt'!K58","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y58","v":0},{"$f":"'G. Communications and Ops Mgmt'!B58","v":"G.5.2.2"},{"$f":"'G. Communications and Ops Mgmt'!C58","v":"Tracking shipments?"},{"$f":"'G. Communications and Ops Mgmt'!D58","v":0},{"$f":"'G. Communications and Ops Mgmt'!E58","v":0},{"$f":"'G. Communications and Ops Mgmt'!F58","v":0},{"$f":"'G. Communications and Ops Mgmt'!G58","v":"G.20 Backup Media Restoration"},{"$f":"'G. Communications and Ops Mgmt'!H58","v":"8.3.3.e"},{"$f":"'G. Communications and Ops Mgmt'!I58","v":"Exchange Agreements"},null,"DS5.3","Identity management","1.1.7","N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A59","v":955},{"$f":"'G. Communications and Ops Mgmt'!J59","v":3},{"$f":"'G. Communications and Ops Mgmt'!K59","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y59","v":0},{"$f":"'G. Communications and Ops Mgmt'!B59","v":"G.5.2.3"},{"$f":"'G. Communications and Ops Mgmt'!C59","v":"Verification of receipt?"},{"$f":"'G. Communications and Ops Mgmt'!D59","v":0},{"$f":"'G. Communications and Ops Mgmt'!E59","v":0},{"$f":"'G. Communications and Ops Mgmt'!F59","v":0},{"$f":"'G. Communications and Ops Mgmt'!G59","v":"G.20 Backup Media Restoration"},{"$f":"'G. Communications and Ops Mgmt'!H59","v":"8.3.3.e"},{"$f":"'G. Communications and Ops Mgmt'!I59","v":"Exchange Agreements"},null,"DS5.7","Protection of security technology",6.1,"IS.2.B.4","DS5.7, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A60","v":3688},{"$f":"'G. Communications and Ops Mgmt'!J60","v":1},{"$f":"'G. Communications and Ops Mgmt'!K60","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y60","v":1},{"$f":"'G. Communications and Ops Mgmt'!B60","v":"G.6"},{"$f":"'G. Communications and Ops Mgmt'!C60","v":"Are firewalls in use for both internal and external network connections?"},{"$f":"'G. Communications and Ops Mgmt'!D60","v":0},{"$f":"'G. Communications and Ops Mgmt'!E60","v":0},{"$f":"'G. Communications and Ops Mgmt'!F60","v":0},{"$f":"'G. Communications and Ops Mgmt'!G60","v":"G.2 Network Security – Firewall(s)"},{"$f":"'G. Communications and Ops Mgmt'!H60","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!I60","v":"Segregation in networks"},null,"PO6.2","Enterprise IT risk and internal control framework",6.1,"N/A","PO6.2, DS5.2, DS5.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A61","v":976},{"$f":"'G. Communications and Ops Mgmt'!J61","v":2},{"$f":"'G. Communications and Ops Mgmt'!K61","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y61","v":0},{"$f":"'G. Communications and Ops Mgmt'!B61","v":"G.6.1"},{"$f":"'G. Communications and Ops Mgmt'!C61","v":"Is every connection to an external network terminated at a firewall?"},{"$f":"'G. Communications and Ops Mgmt'!D61","v":0},{"$f":"'G. Communications and Ops Mgmt'!E61","v":0},{"$f":"'G. Communications and Ops Mgmt'!F61","v":0},{"$f":"'G. Communications and Ops Mgmt'!G61","v":"G.2 Network Security – Firewall(s)"},{"$f":"'G. Communications and Ops Mgmt'!H61","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!I61","v":"Segregation In Networks"},null,null,null,"N/A","AUDIT.2.D.1.14, E-BANK.1.4.1.3","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A62","v":3689},{"$f":"'G. Communications and Ops Mgmt'!J62","v":2},{"$f":"'G. Communications and Ops Mgmt'!K62","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y62","v":0},{"$f":"'G. Communications and Ops Mgmt'!B62","v":"G.6.2"},{"$f":"'G. Communications and Ops Mgmt'!C62","v":"Are firewalls used to segment internal networks?"},{"$f":"'G. Communications and Ops Mgmt'!D62","v":0},{"$f":"'G. Communications and Ops Mgmt'!E62","v":0},{"$f":"'G. Communications and Ops Mgmt'!F62","v":0},{"$f":"'G. Communications and Ops Mgmt'!G62","v":"G.2 Network Security – Firewall(s)"},{"$f":"'G. Communications and Ops Mgmt'!H62","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!I62","v":"Segregation In Networks"},null,null,null,6.1,"IS.2.B.5","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A63","v":3693},{"$f":"'G. Communications and Ops Mgmt'!J63","v":2},{"$f":"'G. Communications and Ops Mgmt'!K63","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y63","v":0},{"$f":"'G. Communications and Ops Mgmt'!B63","v":"G.6.3"},{"$f":"'G. Communications and Ops Mgmt'!C63","v":"Do the firewalls have any rules that permit 'any' network, sub network, host, protocol or port on any of the firewalls (internal or external)?"},{"$f":"'G. Communications and Ops Mgmt'!D63","v":0},{"$f":"'G. Communications and Ops Mgmt'!E63","v":0},{"$f":"'G. Communications and Ops Mgmt'!F63","v":0},{"$f":"'G. Communications and Ops Mgmt'!G63","v":"G.2 Network Security – Firewall(s)"},{"$f":"'G. Communications and Ops Mgmt'!H63","v":"9.1.1.f"},{"$f":"'G. Communications and Ops Mgmt'!I63","v":"Access control policy"},null,null,null,6.1,"N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A64","v":3705},{"$f":"'G. Communications and Ops Mgmt'!J64","v":2},{"$f":"'G. Communications and Ops Mgmt'!K64","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y64","v":0},{"$f":"'G. Communications and Ops Mgmt'!B64","v":"G.6.4"},{"$f":"'G. Communications and Ops Mgmt'!C64","v":"Are all firewall rules reviewed and updated at least quarterly to identify and remove any networks, sub networks, hosts, protocols or ports no longer in use?"},{"$f":"'G. Communications and Ops Mgmt'!D64","v":0},{"$f":"'G. Communications and Ops Mgmt'!E64","v":0},{"$f":"'G. Communications and Ops Mgmt'!F64","v":0},{"$f":"'G. Communications and Ops Mgmt'!G64","v":"G.2 Network Security – Firewall(s)"},{"$f":"'G. Communications and Ops Mgmt'!H64","v":"18.2.2"},{"$f":"'G. Communications and Ops Mgmt'!I64","v":"Compliance with security policies and standards"},null,"DS5.10","Network security",10.3,"N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A65","v":3706},{"$f":"'G. Communications and Ops Mgmt'!J65","v":1},{"$f":"'G. Communications and Ops Mgmt'!K65","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y65","v":1},{"$f":"'G. Communications and Ops Mgmt'!B65","v":"G.7"},{"$f":"'G. Communications and Ops Mgmt'!C65","v":"Are vulnerability assessments, scans or penetration tests on internal or external network connections performed at least annually? If yes, are they:"},{"$f":"'G. Communications and Ops Mgmt'!D65","v":0},{"$f":"'G. Communications and Ops Mgmt'!E65","v":0},{"$f":"'G. Communications and Ops Mgmt'!F65","v":0},{"$f":"'G. Communications and Ops Mgmt'!G65","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!H65","v":"12.6.1"},{"$f":"'G. Communications and Ops Mgmt'!I65","v":"Control of technical vulnerabilities"},null,"DS5.10","Network security",11.3,"N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A66","v":3710},{"$f":"'G. Communications and Ops Mgmt'!J66","v":2},{"$f":"'G. Communications and Ops Mgmt'!K66","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y66","v":0},{"$f":"'G. Communications and Ops Mgmt'!B66","v":"G.7.1"},{"$f":"'G. Communications and Ops Mgmt'!C66","v":"Performed by trained and experienced personnel?"},{"$f":"'G. Communications and Ops Mgmt'!D66","v":0},{"$f":"'G. Communications and Ops Mgmt'!E66","v":0},{"$f":"'G. Communications and Ops Mgmt'!F66","v":0},{"$f":"'G. Communications and Ops Mgmt'!G66","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!H66","v":"18.2.3"},{"$f":"'G. Communications and Ops Mgmt'!I66","v":"Technical compliance review"},null,"DS5.10","Network security",6.1,"N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A67","v":3912},{"$f":"'G. Communications and Ops Mgmt'!J67","v":2},{"$f":"'G. Communications and Ops Mgmt'!K67","v":1},{"$f":"'G. Communications and Ops Mgmt'!Y67","v":0},{"$f":"'G. Communications and Ops Mgmt'!B67","v":"G.7.2"},{"$f":"'G. Communications and Ops Mgmt'!C67","v":"For internal network connections:"},{"$f":"'G. Communications and Ops Mgmt'!D67","v":0},{"$f":"'G. Communications and Ops Mgmt'!E67","v":0},{"$f":"'G. Communications and Ops Mgmt'!F67","v":0},{"$f":"'G. Communications and Ops Mgmt'!G67","v":0},{"$f":"'G. Communications and Ops Mgmt'!H67","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I67","v":0},null,"DS5.10","Network security",10.3,"N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A68","v":3711},{"$f":"'G. Communications and Ops Mgmt'!J68","v":3},{"$f":"'G. Communications and Ops Mgmt'!K68","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y68","v":0},{"$f":"'G. Communications and Ops Mgmt'!B68","v":"G.7.2.1"},{"$f":"'G. Communications and Ops Mgmt'!C68","v":"Are vulnerability assessments or scans performed? If yes, are issues:"},{"$f":"'G. Communications and Ops Mgmt'!D68","v":0},{"$f":"'G. Communications and Ops Mgmt'!E68","v":0},{"$f":"'G. Communications and Ops Mgmt'!F68","v":0},{"$f":"'G. Communications and Ops Mgmt'!G68","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!H68","v":"12.6.1"},{"$f":"'G. Communications and Ops Mgmt'!I68","v":"Control of technical vulnerabilities"},null,null,null,null,"N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A69","v":3913},{"$f":"'G. Communications and Ops Mgmt'!J69","v":4},{"$f":"'G. Communications and Ops Mgmt'!K69","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y69","v":0},{"$f":"'G. Communications and Ops Mgmt'!B69","v":"G.7.2.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C69","v":"Risk ranked for importance to the system and the vulnerability identified?"},{"$f":"'G. Communications and Ops Mgmt'!D69","v":0},{"$f":"'G. Communications and Ops Mgmt'!E69","v":0},{"$f":"'G. Communications and Ops Mgmt'!F69","v":0},{"$f":"'G. Communications and Ops Mgmt'!G69","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!H69","v":"12.6.1.d"},{"$f":"'G. Communications and Ops Mgmt'!I69","v":"Control of technical vulnerabilities"},null,"DS5.7","Protection of security technology",6.1,"IS.1.4.1.2.2 IS.1.4.1.7 IS.1.7.7 IS.2.M.9.1 E-BANK.1.4.2.7","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A70","v":3716},{"$f":"'G. Communications and Ops Mgmt'!J70","v":4},{"$f":"'G. Communications and Ops Mgmt'!K70","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y70","v":0},{"$f":"'G. Communications and Ops Mgmt'!B70","v":"G.7.2.1.2"},{"$f":"'G. Communications and Ops Mgmt'!C70","v":"Documented and tracked to remediation?"},{"$f":"'G. Communications and Ops Mgmt'!D70","v":0},{"$f":"'G. Communications and Ops Mgmt'!E70","v":0},{"$f":"'G. Communications and Ops Mgmt'!F70","v":0},{"$f":"'G. Communications and Ops Mgmt'!G70","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!H70","v":"12.6.1.h"},{"$f":"'G. Communications and Ops Mgmt'!I70","v":"Control of technical vulnerabilities"},null,"DS5.9","Malicious software prevention, detection and correction",6.1,"N/A","DS 5.5, ME1.2, ME2.2, ME2.5, ME4.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A71","v":3721},{"$f":"'G. Communications and Ops Mgmt'!J71","v":3},{"$f":"'G. Communications and Ops Mgmt'!K71","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y71","v":0},{"$f":"'G. Communications and Ops Mgmt'!B71","v":"G.7.2.2"},{"$f":"'G. Communications and Ops Mgmt'!C71","v":"Are penetration tests performed? If yes, are issues:"},{"$f":"'G. Communications and Ops Mgmt'!D71","v":0},{"$f":"'G. Communications and Ops Mgmt'!E71","v":0},{"$f":"'G. Communications and Ops Mgmt'!F71","v":0},{"$f":"'G. Communications and Ops Mgmt'!G71","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!H71","v":"12.6.1"},{"$f":"'G. Communications and Ops Mgmt'!I71","v":"Control of technical vulnerabilities"},null,"PO4.11","Segregation of duties",10.3,"N/A","DS5.9"]
[{"$f":"'G. Communications and Ops Mgmt'!A72","v":3914},{"$f":"'G. Communications and Ops Mgmt'!J72","v":4},{"$f":"'G. Communications and Ops Mgmt'!K72","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y72","v":0},{"$f":"'G. Communications and Ops Mgmt'!B72","v":"G.7.2.2.1"},{"$f":"'G. Communications and Ops Mgmt'!C72","v":"Risk ranked for importance to the system and the vulnerability identified?"},{"$f":"'G. Communications and Ops Mgmt'!D72","v":0},{"$f":"'G. Communications and Ops Mgmt'!E72","v":0},{"$f":"'G. Communications and Ops Mgmt'!F72","v":0},{"$f":"'G. Communications and Ops Mgmt'!G72","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!H72","v":"12.6.1.d"},{"$f":"'G. Communications and Ops Mgmt'!I72","v":"Control of technical vulnerabilities"},null,"DS5.5","Security testing, surveillance and monitoring",11.3,"E-BANK.1.4.3.6","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A73","v":3725},{"$f":"'G. Communications and Ops Mgmt'!J73","v":4},{"$f":"'G. Communications and Ops Mgmt'!K73","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y73","v":0},{"$f":"'G. Communications and Ops Mgmt'!B73","v":"G.7.2.2.2"},{"$f":"'G. Communications and Ops Mgmt'!C73","v":"Documented and tracked to remediation?"},{"$f":"'G. Communications and Ops Mgmt'!D73","v":0},{"$f":"'G. Communications and Ops Mgmt'!E73","v":0},{"$f":"'G. Communications and Ops Mgmt'!F73","v":0},{"$f":"'G. Communications and Ops Mgmt'!G73","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!H73","v":"12.6.1.h"},{"$f":"'G. Communications and Ops Mgmt'!I73","v":"Control of technical vulnerabilities"},null,"DS5.7","Protection of security technology",6.1,"N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A74","v":3915},{"$f":"'G. Communications and Ops Mgmt'!J74","v":2},{"$f":"'G. Communications and Ops Mgmt'!K74","v":1},{"$f":"'G. Communications and Ops Mgmt'!Y74","v":0},{"$f":"'G. Communications and Ops Mgmt'!B74","v":"G.7.3"},{"$f":"'G. Communications and Ops Mgmt'!C74","v":"For external network connections:"},{"$f":"'G. Communications and Ops Mgmt'!D74","v":0},{"$f":"'G. Communications and Ops Mgmt'!E74","v":0},{"$f":"'G. Communications and Ops Mgmt'!F74","v":0},{"$f":"'G. Communications and Ops Mgmt'!G74","v":0},{"$f":"'G. Communications and Ops Mgmt'!H74","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I74","v":0},null,"DS5.10","Network security",10.3,"IS.2.B.17.4","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A75","v":3717},{"$f":"'G. Communications and Ops Mgmt'!J75","v":3},{"$f":"'G. Communications and Ops Mgmt'!K75","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y75","v":0},{"$f":"'G. Communications and Ops Mgmt'!B75","v":"G.7.3.1"},{"$f":"'G. Communications and Ops Mgmt'!C75","v":"Are vulnerability assessments or scans performed? If yes, are issues:"},{"$f":"'G. Communications and Ops Mgmt'!D75","v":0},{"$f":"'G. Communications and Ops Mgmt'!E75","v":0},{"$f":"'G. Communications and Ops Mgmt'!F75","v":0},{"$f":"'G. Communications and Ops Mgmt'!G75","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!H75","v":"12.6.1"},{"$f":"'G. Communications and Ops Mgmt'!I75","v":"Control of technical vulnerabilities"},null,"DS5.10","Network security","N/A","N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A76","v":3916},{"$f":"'G. Communications and Ops Mgmt'!J76","v":4},{"$f":"'G. Communications and Ops Mgmt'!K76","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y76","v":0},{"$f":"'G. Communications and Ops Mgmt'!B76","v":"G.7.3.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C76","v":"Risk ranked for importance to the system and the vulnerability identified?"},{"$f":"'G. Communications and Ops Mgmt'!D76","v":0},{"$f":"'G. Communications and Ops Mgmt'!E76","v":0},{"$f":"'G. Communications and Ops Mgmt'!F76","v":0},{"$f":"'G. Communications and Ops Mgmt'!G76","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!H76","v":"12.6.1.d"},{"$f":"'G. Communications and Ops Mgmt'!I76","v":"Control of technical vulnerabilities"},null,"PO2.3","Data classification scheme",7,"N/A","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A77","v":3720},{"$f":"'G. Communications and Ops Mgmt'!J77","v":4},{"$f":"'G. Communications and Ops Mgmt'!K77","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y77","v":0},{"$f":"'G. Communications and Ops Mgmt'!B77","v":"G.7.3.1.2"},{"$f":"'G. Communications and Ops Mgmt'!C77","v":"Documented and tracked to remediation?"},{"$f":"'G. Communications and Ops Mgmt'!D77","v":0},{"$f":"'G. Communications and Ops Mgmt'!E77","v":0},{"$f":"'G. Communications and Ops Mgmt'!F77","v":0},{"$f":"'G. Communications and Ops Mgmt'!G77","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!H77","v":"12.6.1.h"},{"$f":"'G. Communications and Ops Mgmt'!I77","v":"Control of technical vulnerabilities"},null,"PO3.1","Technological direction planning","N/A","N/A","PO2.3, PO6.2, DS11.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A78","v":3726},{"$f":"'G. Communications and Ops Mgmt'!J78","v":3},{"$f":"'G. Communications and Ops Mgmt'!K78","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y78","v":0},{"$f":"'G. Communications and Ops Mgmt'!B78","v":"G.7.3.2"},{"$f":"'G. Communications and Ops Mgmt'!C78","v":"Are penetration tests performed on external networks? If yes, are issues:"},{"$f":"'G. Communications and Ops Mgmt'!D78","v":0},{"$f":"'G. Communications and Ops Mgmt'!E78","v":0},{"$f":"'G. Communications and Ops Mgmt'!F78","v":0},{"$f":"'G. Communications and Ops Mgmt'!G78","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!H78","v":"12.6.1"},{"$f":"'G. Communications and Ops Mgmt'!I78","v":"Control of technical vulnerabilities"},null,"DS5.10","Network security",1.3,"N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A79","v":3917},{"$f":"'G. Communications and Ops Mgmt'!J79","v":4},{"$f":"'G. Communications and Ops Mgmt'!K79","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y79","v":0},{"$f":"'G. Communications and Ops Mgmt'!B79","v":"G.7.3.2.1"},{"$f":"'G. Communications and Ops Mgmt'!C79","v":"Risk ranked for importance to the system and the vulnerability identified?"},{"$f":"'G. Communications and Ops Mgmt'!D79","v":0},{"$f":"'G. Communications and Ops Mgmt'!E79","v":0},{"$f":"'G. Communications and Ops Mgmt'!F79","v":0},{"$f":"'G. Communications and Ops Mgmt'!G79","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!H79","v":"12.6.1.d"},{"$f":"'G. Communications and Ops Mgmt'!I79","v":"Control of technical vulnerabilities"},null,"DS5.10","Network security","1.2.1","IS.2.A.13","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A80","v":3728},{"$f":"'G. Communications and Ops Mgmt'!J80","v":4},{"$f":"'G. Communications and Ops Mgmt'!K80","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y80","v":0},{"$f":"'G. Communications and Ops Mgmt'!B80","v":"G.7.3.2.2"},{"$f":"'G. Communications and Ops Mgmt'!C80","v":"Documented and tracked to remediation?"},{"$f":"'G. Communications and Ops Mgmt'!D80","v":0},{"$f":"'G. Communications and Ops Mgmt'!E80","v":0},{"$f":"'G. Communications and Ops Mgmt'!F80","v":0},{"$f":"'G. Communications and Ops Mgmt'!G80","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"'G. Communications and Ops Mgmt'!H80","v":"12.6.1.h"},{"$f":"'G. Communications and Ops Mgmt'!I80","v":"Control of technical vulnerabilities"},null,null,null,7,"N/A","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A81","v":975},{"$f":"'G. Communications and Ops Mgmt'!J81","v":1},{"$f":"'G. Communications and Ops Mgmt'!K81","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y81","v":1},{"$f":"'G. Communications and Ops Mgmt'!B81","v":"G.8"},{"$f":"'G. Communications and Ops Mgmt'!C81","v":"Are there external network connections (Internet, extranet, etc.)? If yes, is there:"},{"$f":"'G. Communications and Ops Mgmt'!D81","v":0},{"$f":"'G. Communications and Ops Mgmt'!E81","v":0},{"$f":"'G. Communications and Ops Mgmt'!F81","v":0},{"$f":"'G. Communications and Ops Mgmt'!G81","v":0},{"$f":"'G. Communications and Ops Mgmt'!H81","v":"13.1.1"},{"$f":"'G. Communications and Ops Mgmt'!I81","v":"Network Controls"},null,null,null,"10.5.4","N/A","DS5.7, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A82","v":998},{"$f":"'G. Communications and Ops Mgmt'!J82","v":2},{"$f":"'G. Communications and Ops Mgmt'!K82","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y82","v":0},{"$f":"'G. Communications and Ops Mgmt'!B82","v":"G.8.1"},{"$f":"'G. Communications and Ops Mgmt'!C82","v":"Security and hardening standards for network devices (baseline configuration, patching, passwords, access control)?"},{"$f":"'G. Communications and Ops Mgmt'!D82","v":0},{"$f":"'G. Communications and Ops Mgmt'!E82","v":0},{"$f":"'G. Communications and Ops Mgmt'!F82","v":0},{"$f":"'G. Communications and Ops Mgmt'!G82","v":0},{"$f":"'G. Communications and Ops Mgmt'!H82","v":"13.1.1.c"},{"$f":"'G. Communications and Ops Mgmt'!I82","v":"Network Controls"},null,null,null,"10.2.4","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A83","v":1008},{"$f":"'G. Communications and Ops Mgmt'!J83","v":3},{"$f":"'G. Communications and Ops Mgmt'!K83","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y83","v":0},{"$f":"'G. Communications and Ops Mgmt'!B83","v":"G.8.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C83","v":"Regular review and/or monitoring of network devices for continued compliance to security requirements?"},{"$f":"'G. Communications and Ops Mgmt'!D83","v":0},{"$f":"'G. Communications and Ops Mgmt'!E83","v":0},{"$f":"'G. Communications and Ops Mgmt'!F83","v":0},{"$f":"'G. Communications and Ops Mgmt'!G83","v":0},{"$f":"'G. Communications and Ops Mgmt'!H83","v":"13.1.1.d                                  18.2.3"},{"$f":"'G. Communications and Ops Mgmt'!I83","v":"Network controls,                   Technical compliance review"},null,"PO3.1","Technological direction planning","10.2.6","IS.1.4.1.10 IS.2.E.2 IS.2.L.2.1 IS.2.L.2.1","PO2.3, DS11.2, DS11.3, DS11.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A84","v":977},{"$f":"'G. Communications and Ops Mgmt'!J84","v":2},{"$f":"'G. Communications and Ops Mgmt'!K84","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y84","v":0},{"$f":"'G. Communications and Ops Mgmt'!B84","v":"G.8.2"},{"$f":"'G. Communications and Ops Mgmt'!C84","v":"Are network devices configured to prevent communications from unapproved networks?"},{"$f":"'G. Communications and Ops Mgmt'!D84","v":0},{"$f":"'G. Communications and Ops Mgmt'!E84","v":0},{"$f":"'G. Communications and Ops Mgmt'!F84","v":0},{"$f":"'G. Communications and Ops Mgmt'!G84","v":"G.2 Network Security – Firewall(s)"},{"$f":"'G. Communications and Ops Mgmt'!H84","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!I84","v":"Segregation In Networks"},null,"PO2.3","Data classification scheme","10.5.5","IS.2.J.8 RPS.2.C.2.8","PO2.3, PO6.2, DS11.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A85","v":979},{"$f":"'G. Communications and Ops Mgmt'!J85","v":2},{"$f":"'G. Communications and Ops Mgmt'!K85","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y85","v":0},{"$f":"'G. Communications and Ops Mgmt'!B85","v":"G.8.3"},{"$f":"'G. Communications and Ops Mgmt'!C85","v":"Do network devices deny all access by default?"},{"$f":"'G. Communications and Ops Mgmt'!D85","v":0},{"$f":"'G. Communications and Ops Mgmt'!E85","v":0},{"$f":"'G. Communications and Ops Mgmt'!F85","v":0},{"$f":"'G. Communications and Ops Mgmt'!G85","v":0},{"$f":"'G. Communications and Ops Mgmt'!H85","v":"9.1.1"},{"$f":"'G. Communications and Ops Mgmt'!I85","v":"Access Control Policy"},null,"DS11.3","Media library management system","10.4.1","N/A","PO6, AI2, DS5"]
[{"$f":"'G. Communications and Ops Mgmt'!A86","v":980},{"$f":"'G. Communications and Ops Mgmt'!J86","v":2},{"$f":"'G. Communications and Ops Mgmt'!K86","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y86","v":0},{"$f":"'G. Communications and Ops Mgmt'!B86","v":"G.8.4"},{"$f":"'G. Communications and Ops Mgmt'!C86","v":"A process to request, approve, log, and review access to networks across network devices?"},{"$f":"'G. Communications and Ops Mgmt'!D86","v":0},{"$f":"'G. Communications and Ops Mgmt'!E86","v":0},{"$f":"'G. Communications and Ops Mgmt'!F86","v":0},{"$f":"'G. Communications and Ops Mgmt'!G86","v":0},{"$f":"'G. Communications and Ops Mgmt'!H86","v":"9.1.1.h"},{"$f":"'G. Communications and Ops Mgmt'!I86","v":"Policy on Use of Network Services"},null,"DS11.3","Media library management system","N/A","OPS.1.9.3 OPS.2.12.H.2","DS11.3, DS11.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A87","v":981},{"$f":"'G. Communications and Ops Mgmt'!J87","v":2},{"$f":"'G. Communications and Ops Mgmt'!K87","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y87","v":0},{"$f":"'G. Communications and Ops Mgmt'!B87","v":"G.8.5"},{"$f":"'G. Communications and Ops Mgmt'!C87","v":"Network traffic logged to support forensics? If yes, do logs contain:"},{"$f":"'G. Communications and Ops Mgmt'!D87","v":0},{"$f":"'G. Communications and Ops Mgmt'!E87","v":0},{"$f":"'G. Communications and Ops Mgmt'!F87","v":0},{"$f":"'G. Communications and Ops Mgmt'!G87","v":"G.6 Network Logging"},{"$f":"'G. Communications and Ops Mgmt'!H87","v":"13.1.1.d"},{"$f":"'G. Communications and Ops Mgmt'!I87","v":"Network Controls"},null,"DS11.4","Disposal","10.5.5","N/A","DS11.3, DS11.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A88","v":3865},{"$f":"'G. Communications and Ops Mgmt'!J88","v":3},{"$f":"'G. Communications and Ops Mgmt'!K88","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y88","v":0},{"$f":"'G. Communications and Ops Mgmt'!B88","v":"G.8.5.1"},{"$f":"'G. Communications and Ops Mgmt'!C88","v":"Failed login attempts?"},{"$f":"'G. Communications and Ops Mgmt'!D88","v":0},{"$f":"'G. Communications and Ops Mgmt'!E88","v":0},{"$f":"'G. Communications and Ops Mgmt'!F88","v":0},{"$f":"'G. Communications and Ops Mgmt'!G88","v":"G.6 Network Logging"},{"$f":"'G. Communications and Ops Mgmt'!H88","v":"13.1.1.d"},{"$f":"'G. Communications and Ops Mgmt'!I88","v":"Network Controls"},null,"DS11.3","Media library management system","10.5.2","N/A","DS11.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A89","v":3866},{"$f":"'G. Communications and Ops Mgmt'!J89","v":3},{"$f":"'G. Communications and Ops Mgmt'!K89","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y89","v":0},{"$f":"'G. Communications and Ops Mgmt'!B89","v":"G.8.5.2"},{"$f":"'G. Communications and Ops Mgmt'!C89","v":"Disabling of audit logs?"},{"$f":"'G. Communications and Ops Mgmt'!D89","v":0},{"$f":"'G. Communications and Ops Mgmt'!E89","v":0},{"$f":"'G. Communications and Ops Mgmt'!F89","v":0},{"$f":"'G. Communications and Ops Mgmt'!G89","v":"G.6 Network Logging"},{"$f":"'G. Communications and Ops Mgmt'!H89","v":"13.1.1.d"},{"$f":"'G. Communications and Ops Mgmt'!I89","v":"Network Controls"},null,null,null,"N/A","IS.1.4.1.10","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A90","v":3869},{"$f":"'G. Communications and Ops Mgmt'!J90","v":3},{"$f":"'G. Communications and Ops Mgmt'!K90","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y90","v":0},{"$f":"'G. Communications and Ops Mgmt'!B90","v":"G.8.5.3"},{"$f":"'G. Communications and Ops Mgmt'!C90","v":"Changes?"},{"$f":"'G. Communications and Ops Mgmt'!D90","v":0},{"$f":"'G. Communications and Ops Mgmt'!E90","v":0},{"$f":"'G. Communications and Ops Mgmt'!F90","v":0},{"$f":"'G. Communications and Ops Mgmt'!G90","v":"G.6 Network Logging"},{"$f":"'G. Communications and Ops Mgmt'!H90","v":"13.1.1.d"},{"$f":"'G. Communications and Ops Mgmt'!I90","v":"Network Controls"},null,"DS5.11","Exchange of sensitive data",6.2,"N/A","DS11.6"]
[{"$f":"'G. Communications and Ops Mgmt'!A91","v":3870},{"$f":"'G. Communications and Ops Mgmt'!J91","v":3},{"$f":"'G. Communications and Ops Mgmt'!K91","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y91","v":0},{"$f":"'G. Communications and Ops Mgmt'!B91","v":"G.8.5.4"},{"$f":"'G. Communications and Ops Mgmt'!C91","v":"Timestamps?"},{"$f":"'G. Communications and Ops Mgmt'!D91","v":0},{"$f":"'G. Communications and Ops Mgmt'!E91","v":0},{"$f":"'G. Communications and Ops Mgmt'!F91","v":0},{"$f":"'G. Communications and Ops Mgmt'!G91","v":"G.6 Network Logging"},{"$f":"'G. Communications and Ops Mgmt'!H91","v":"13.1.1.d"},{"$f":"'G. Communications and Ops Mgmt'!I91","v":"Network Controls"},null,null,null,6.4,"IS.2.B.15 IS.2.J.8 E-BANK.1.5.2.2 RPS.1.3.2.1 RPS.2.C.4","PO2.3, PO6.2, DS11.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A92","v":3871},{"$f":"'G. Communications and Ops Mgmt'!J92","v":3},{"$f":"'G. Communications and Ops Mgmt'!K92","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y92","v":0},{"$f":"'G. Communications and Ops Mgmt'!B92","v":"G.8.5.5"},{"$f":"'G. Communications and Ops Mgmt'!C92","v":"IP info?"},{"$f":"'G. Communications and Ops Mgmt'!D92","v":0},{"$f":"'G. Communications and Ops Mgmt'!E92","v":0},{"$f":"'G. Communications and Ops Mgmt'!F92","v":0},{"$f":"'G. Communications and Ops Mgmt'!G92","v":"G.6 Network Logging"},{"$f":"'G. Communications and Ops Mgmt'!H92","v":"13.1.1.d"},{"$f":"'G. Communications and Ops Mgmt'!I92","v":"Network Controls"},null,"PO2.3","Data classification scheme","1.1.1","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A93","v":3294},{"$f":"'G. Communications and Ops Mgmt'!J93","v":3},{"$f":"'G. Communications and Ops Mgmt'!K93","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y93","v":0},{"$f":"'G. Communications and Ops Mgmt'!B93","v":"G.8.5.6"},{"$f":"'G. Communications and Ops Mgmt'!C93","v":"In the event of a network device audit log failure, does the network device generate an alert and prevent further connections?"},{"$f":"'G. Communications and Ops Mgmt'!D93","v":0},{"$f":"'G. Communications and Ops Mgmt'!E93","v":0},{"$f":"'G. Communications and Ops Mgmt'!F93","v":0},{"$f":"'G. Communications and Ops Mgmt'!G93","v":0},{"$f":"'G. Communications and Ops Mgmt'!H93","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!I93","v":"Event logging"},null,"PO2.3","Data classification scheme","1.3.7","IS.2.B.19 E-BANK.1.4.2.6","PO2.3, PO6.2, DS11.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A94","v":1093},{"$f":"'G. Communications and Ops Mgmt'!J94","v":3},{"$f":"'G. Communications and Ops Mgmt'!K94","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y94","v":0},{"$f":"'G. Communications and Ops Mgmt'!B94","v":"G.8.5.7"},{"$f":"'G. Communications and Ops Mgmt'!C94","v":"Is the overwriting of audit logs disabled?"},{"$f":"'G. Communications and Ops Mgmt'!D94","v":0},{"$f":"'G. Communications and Ops Mgmt'!E94","v":0},{"$f":"'G. Communications and Ops Mgmt'!F94","v":0},{"$f":"'G. Communications and Ops Mgmt'!G94","v":0},{"$f":"'G. Communications and Ops Mgmt'!H94","v":"12.4.2.b"},{"$f":"'G. Communications and Ops Mgmt'!I94","v":"Protection of Log Information"},null,"PO2.3","Data classification scheme",9.1,"IS.2.L.1.3","PO2.3, PO6.2, DS11.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A95","v":993},{"$f":"'G. Communications and Ops Mgmt'!J95","v":3},{"$f":"'G. Communications and Ops Mgmt'!K95","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y95","v":0},{"$f":"'G. Communications and Ops Mgmt'!B95","v":"G.8.5.8"},{"$f":"'G. Communications and Ops Mgmt'!C95","v":"Are the logs from network devices aggregated to a central server?"},{"$f":"'G. Communications and Ops Mgmt'!D95","v":0},{"$f":"'G. Communications and Ops Mgmt'!E95","v":0},{"$f":"'G. Communications and Ops Mgmt'!F95","v":0},{"$f":"'G. Communications and Ops Mgmt'!G95","v":0},{"$f":"'G. Communications and Ops Mgmt'!H95","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!I95","v":"Protection of Log Information"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A96","v":994},{"$f":"'G. Communications and Ops Mgmt'!J96","v":2},{"$f":"'G. Communications and Ops Mgmt'!K96","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y96","v":0},{"$f":"'G. Communications and Ops Mgmt'!B96","v":"G.8.6"},{"$f":"'G. Communications and Ops Mgmt'!C96","v":"Are security patches reviewed and applied to network devices?"},{"$f":"'G. Communications and Ops Mgmt'!D96","v":0},{"$f":"'G. Communications and Ops Mgmt'!E96","v":0},{"$f":"'G. Communications and Ops Mgmt'!F96","v":0},{"$f":"'G. Communications and Ops Mgmt'!G96","v":0},{"$f":"'G. Communications and Ops Mgmt'!H96","v":"12.6.1.g"},{"$f":"'G. Communications and Ops Mgmt'!I96","v":"Management of technical vulnerabilities"},null,"PO2.3","Data classification scheme",1.3,"RPS.2.E.1.4 RPS.2.L.4","DS11.6"]
[{"$f":"'G. Communications and Ops Mgmt'!A97","v":995},{"$f":"'G. Communications and Ops Mgmt'!J97","v":2},{"$f":"'G. Communications and Ops Mgmt'!K97","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y97","v":0},{"$f":"'G. Communications and Ops Mgmt'!B97","v":"G.8.7"},{"$f":"'G. Communications and Ops Mgmt'!C97","v":"Is there an approval process prior to installing a network device?"},{"$f":"'G. Communications and Ops Mgmt'!D97","v":0},{"$f":"'G. Communications and Ops Mgmt'!E97","v":0},{"$f":"'G. Communications and Ops Mgmt'!F97","v":0},{"$f":"'G. Communications and Ops Mgmt'!G97","v":0},{"$f":"'G. Communications and Ops Mgmt'!H97","v":"12.1.2.d"},{"$f":"'G. Communications and Ops Mgmt'!I97","v":"Change Management"},null,null,null,"1.1.6","RPS.2.E.1.4 RPS.2.L.4","DS11.6"]
[{"$f":"'G. Communications and Ops Mgmt'!A98","v":997},{"$f":"'G. Communications and Ops Mgmt'!J98","v":2},{"$f":"'G. Communications and Ops Mgmt'!K98","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y98","v":0},{"$f":"'G. Communications and Ops Mgmt'!B98","v":"G.8.8"},{"$f":"'G. Communications and Ops Mgmt'!C98","v":"Is there an approval process for the ports allowed through the network devices?"},{"$f":"'G. Communications and Ops Mgmt'!D98","v":0},{"$f":"'G. Communications and Ops Mgmt'!E98","v":0},{"$f":"'G. Communications and Ops Mgmt'!F98","v":0},{"$f":"'G. Communications and Ops Mgmt'!G98","v":"G.19 Network Security – Authorized Network Traffic"},{"$f":"'G. Communications and Ops Mgmt'!H98","v":"13.1.2.c"},{"$f":"'G. Communications and Ops Mgmt'!I98","v":"Security of Network Services"},null,"PO2.3","Data classification scheme",7.1,"N/A","PO2.3, PO3.4, AI5.2, DS2.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A99","v":1010},{"$f":"'G. Communications and Ops Mgmt'!J99","v":2},{"$f":"'G. Communications and Ops Mgmt'!K99","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y99","v":0},{"$f":"'G. Communications and Ops Mgmt'!B99","v":"G.8.9"},{"$f":"'G. Communications and Ops Mgmt'!C99","v":"Are critical network segments isolated?"},{"$f":"'G. Communications and Ops Mgmt'!D99","v":0},{"$f":"'G. Communications and Ops Mgmt'!E99","v":0},{"$f":"'G. Communications and Ops Mgmt'!F99","v":0},{"$f":"'G. Communications and Ops Mgmt'!G99","v":"G.2 Network Security – Firewall(s)"},{"$f":"'G. Communications and Ops Mgmt'!H99","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!I99","v":"Segregation In Networks"},null,"PO2.3","Data classification scheme","N/A","N/A","PO2.3, PO6.2, DS11.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A100","v":1011},{"$f":"'G. Communications and Ops Mgmt'!J100","v":2},{"$f":"'G. Communications and Ops Mgmt'!K100","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y100","v":0},{"$f":"'G. Communications and Ops Mgmt'!B100","v":"G.8.10"},{"$f":"'G. Communications and Ops Mgmt'!C100","v":"Is there a process to prevent unauthorized devices from physically connecting to the internal network?"},{"$f":"'G. Communications and Ops Mgmt'!D100","v":0},{"$f":"'G. Communications and Ops Mgmt'!E100","v":0},{"$f":"'G. Communications and Ops Mgmt'!F100","v":0},{"$f":"'G. Communications and Ops Mgmt'!G100","v":0},{"$f":"'G. Communications and Ops Mgmt'!H100","v":"13.1.2"},{"$f":"'G. Communications and Ops Mgmt'!I100","v":"Security of Network Services"},null,"DS5.9","Malicious software prevention, detection and correction","1.1.7","N/A","PO2.3, PO6.2, DS11.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A101","v":1014},{"$f":"'G. Communications and Ops Mgmt'!J101","v":2},{"$f":"'G. Communications and Ops Mgmt'!K101","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y101","v":0},{"$f":"'G. Communications and Ops Mgmt'!B101","v":"G.8.11"},{"$f":"'G. Communications and Ops Mgmt'!C101","v":"Are internal systems required to pass through a content filtering proxy prior to accessing the Internet?"},{"$f":"'G. Communications and Ops Mgmt'!D101","v":0},{"$f":"'G. Communications and Ops Mgmt'!E101","v":0},{"$f":"'G. Communications and Ops Mgmt'!F101","v":0},{"$f":"'G. Communications and Ops Mgmt'!G101","v":0},{"$f":"'G. Communications and Ops Mgmt'!H101","v":"13.1.2"},{"$f":"'G. Communications and Ops Mgmt'!I101","v":"Security of Network Services"},null,null,null,"N/A","N/A","DS5.9"]
[{"$f":"'G. Communications and Ops Mgmt'!A102","v":1015},{"$f":"'G. Communications and Ops Mgmt'!J102","v":2},{"$f":"'G. Communications and Ops Mgmt'!K102","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y102","v":0},{"$f":"'G. Communications and Ops Mgmt'!B102","v":"G.8.12"},{"$f":"'G. Communications and Ops Mgmt'!C102","v":"Is there an approval process to allow extranet connections?"},{"$f":"'G. Communications and Ops Mgmt'!D102","v":0},{"$f":"'G. Communications and Ops Mgmt'!E102","v":0},{"$f":"'G. Communications and Ops Mgmt'!F102","v":0},{"$f":"'G. Communications and Ops Mgmt'!G102","v":0},{"$f":"'G. Communications and Ops Mgmt'!H102","v":"9.1.2.b"},{"$f":"'G. Communications and Ops Mgmt'!I102","v":"Access to networks and network services"},null,"DS5.7","Protection of security technology","N/A","IS.2.B.12","DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A103","v":1016},{"$f":"'G. Communications and Ops Mgmt'!J103","v":2},{"$f":"'G. Communications and Ops Mgmt'!K103","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y103","v":0},{"$f":"'G. Communications and Ops Mgmt'!B103","v":"G.8.13"},{"$f":"'G. Communications and Ops Mgmt'!C103","v":"Are insecure protocols used to access network devices e.g., telnet?"},{"$f":"'G. Communications and Ops Mgmt'!D103","v":0},{"$f":"'G. Communications and Ops Mgmt'!E103","v":0},{"$f":"'G. Communications and Ops Mgmt'!F103","v":0},{"$f":"'G. Communications and Ops Mgmt'!G103","v":"G.4 Network Management – Encrypted Authentication Credentials"},{"$f":"'G. Communications and Ops Mgmt'!H103","v":"9.1.2.d"},{"$f":"'G. Communications and Ops Mgmt'!I103","v":"Access to networks and network services"},null,"DS5.5","Security testing, surveillance and monitoring","N/A","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A104","v":2612},{"$f":"'G. Communications and Ops Mgmt'!J104","v":2},{"$f":"'G. Communications and Ops Mgmt'!K104","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y104","v":0},{"$f":"'G. Communications and Ops Mgmt'!B104","v":"G.8.14"},{"$f":"'G. Communications and Ops Mgmt'!C104","v":"Is access to diagnostic or maintenance ports on network devices restricted?"},{"$f":"'G. Communications and Ops Mgmt'!D104","v":0},{"$f":"'G. Communications and Ops Mgmt'!E104","v":0},{"$f":"'G. Communications and Ops Mgmt'!F104","v":0},{"$f":"'G. Communications and Ops Mgmt'!G104","v":"G.5 Externally Facing Open Administrative Ports"},{"$f":"'G. Communications and Ops Mgmt'!H104","v":"9.1.2.a"},{"$f":"'G. Communications and Ops Mgmt'!I104","v":"Access to networks and network services"},null,"PO4.8","Responsibility for risk, security and compliance",11.4,"IS.1.4.1.3.1 IS.2.C.1 OPS.1.5.1.5 E-BANK.1.4.2.5","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A105","v":1065},{"$f":"'G. Communications and Ops Mgmt'!J105","v":2},{"$f":"'G. Communications and Ops Mgmt'!K105","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y105","v":0},{"$f":"'G. Communications and Ops Mgmt'!B105","v":"G.8.15"},{"$f":"'G. Communications and Ops Mgmt'!C105","v":"Is there a separate network segment or endpoints for remote access?"},{"$f":"'G. Communications and Ops Mgmt'!D105","v":0},{"$f":"'G. Communications and Ops Mgmt'!E105","v":0},{"$f":"'G. Communications and Ops Mgmt'!F105","v":0},{"$f":"'G. Communications and Ops Mgmt'!G105","v":0},{"$f":"'G. Communications and Ops Mgmt'!H105","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!I105","v":"Segregation in networks"},null,"AI4.4","Knowledge transfer to operations and support staff",11.5,"IS.2.C.4","DS5.5, DS5.7, ME2.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A106","v":2947},{"$f":"'G. Communications and Ops Mgmt'!J106","v":2},{"$f":"'G. Communications and Ops Mgmt'!K106","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y106","v":0},{"$f":"'G. Communications and Ops Mgmt'!B106","v":"G.8.16"},{"$f":"'G. Communications and Ops Mgmt'!C106","v":"Are firewall rules and network access control lists regularly reviewed?"},{"$f":"'G. Communications and Ops Mgmt'!D106","v":0},{"$f":"'G. Communications and Ops Mgmt'!E106","v":0},{"$f":"'G. Communications and Ops Mgmt'!F106","v":0},{"$f":"'G. Communications and Ops Mgmt'!G106","v":0},{"$f":"'G. Communications and Ops Mgmt'!H106","v":"18.2.3"},{"$f":"'G. Communications and Ops Mgmt'!I106","v":"Technical Compliance review"},null,"PO6.2","Enterprise IT risk and internal control framework",6.2,"N/A","DS5.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A107","v":2614},{"$f":"'G. Communications and Ops Mgmt'!J107","v":2},{"$f":"'G. Communications and Ops Mgmt'!K107","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y107","v":0},{"$f":"'G. Communications and Ops Mgmt'!B107","v":"G.8.17"},{"$f":"'G. Communications and Ops Mgmt'!C107","v":"Is there a DMZ environment within the network that transmits, processes or stores Scoped Systems and Data? If yes, is it:"},{"$f":"'G. Communications and Ops Mgmt'!D107","v":0},{"$f":"'G. Communications and Ops Mgmt'!E107","v":0},{"$f":"'G. Communications and Ops Mgmt'!F107","v":0},{"$f":"'G. Communications and Ops Mgmt'!G107","v":0},{"$f":"'G. Communications and Ops Mgmt'!H107","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I107","v":""},null,"AI6.3","Emergency changes","12.5.5, 12.10.3","IS.2.C.5","PO6.2, DS5.2, DS5.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A108","v":1049},{"$f":"'G. Communications and Ops Mgmt'!J108","v":3},{"$f":"'G. Communications and Ops Mgmt'!K108","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y108","v":0},{"$f":"'G. Communications and Ops Mgmt'!B108","v":"G.8.17.1"},{"$f":"'G. Communications and Ops Mgmt'!C108","v":"Limited to only those servers that require access from the Internet?"},{"$f":"'G. Communications and Ops Mgmt'!D108","v":0},{"$f":"'G. Communications and Ops Mgmt'!E108","v":0},{"$f":"'G. Communications and Ops Mgmt'!F108","v":0},{"$f":"'G. Communications and Ops Mgmt'!G108","v":0},{"$f":"'G. Communications and Ops Mgmt'!H108","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!I108","v":"Segregation In Networks"},null,"AI6.3","Emergency changes","12.5.3","IS.2.C.5","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A109","v":1056},{"$f":"'G. Communications and Ops Mgmt'!J109","v":3},{"$f":"'G. Communications and Ops Mgmt'!K109","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y109","v":0},{"$f":"'G. Communications and Ops Mgmt'!B109","v":"G.8.17.2"},{"$f":"'G. Communications and Ops Mgmt'!C109","v":"Separated with DMZ segments for devices that initiate outbound traffic to the Internet?"},{"$f":"'G. Communications and Ops Mgmt'!D109","v":0},{"$f":"'G. Communications and Ops Mgmt'!E109","v":0},{"$f":"'G. Communications and Ops Mgmt'!F109","v":0},{"$f":"'G. Communications and Ops Mgmt'!G109","v":0},{"$f":"'G. Communications and Ops Mgmt'!H109","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!I109","v":"Segregation In Networks"},null,"DS5.5","Security testing, surveillance and monitoring","7.1.4","N/A","AI6.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A110","v":1068},{"$f":"'G. Communications and Ops Mgmt'!J110","v":2},{"$f":"'G. Communications and Ops Mgmt'!K110","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y110","v":0},{"$f":"'G. Communications and Ops Mgmt'!B110","v":"G.8.18"},{"$f":"'G. Communications and Ops Mgmt'!C110","v":"Is Intrusion Detection/Prevention System employed in all network zones? If yes, does it include:"},{"$f":"'G. Communications and Ops Mgmt'!D110","v":0},{"$f":"'G. Communications and Ops Mgmt'!E110","v":0},{"$f":"'G. Communications and Ops Mgmt'!F110","v":0},{"$f":"'G. Communications and Ops Mgmt'!G110","v":"G.3 Network Security – IDS / IPS Attributes"},{"$f":"'G. Communications and Ops Mgmt'!H110","v":"13.1.2"},{"$f":"'G. Communications and Ops Mgmt'!I110","v":"Security of Network Services"},null,"DS5.5","Security testing, surveillance and monitoring","N/A","IS.2.C.2","AI6.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A111","v":1075},{"$f":"'G. Communications and Ops Mgmt'!J111","v":3},{"$f":"'G. Communications and Ops Mgmt'!K111","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y111","v":0},{"$f":"'G. Communications and Ops Mgmt'!B111","v":"G.8.18.1"},{"$f":"'G. Communications and Ops Mgmt'!C111","v":"Configuration to generate alerts when incidents and values exceed predetermined thresholds?"},{"$f":"'G. Communications and Ops Mgmt'!D111","v":0},{"$f":"'G. Communications and Ops Mgmt'!E111","v":0},{"$f":"'G. Communications and Ops Mgmt'!F111","v":0},{"$f":"'G. Communications and Ops Mgmt'!G111","v":0},{"$f":"'G. Communications and Ops Mgmt'!H111","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!I111","v":"Event logging"},null,"AI2.3","Application control and auditability","N/A","IS.1.4.1.3.5 OPS.2.12.B AUDIT.2.D.1.7 E-BANK.1.4.3.5","DS 5.5, ME1.2, ME2.2, ME2.5, ME4.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A112","v":1076},{"$f":"'G. Communications and Ops Mgmt'!J112","v":3},{"$f":"'G. Communications and Ops Mgmt'!K112","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y112","v":0},{"$f":"'G. Communications and Ops Mgmt'!B112","v":"G.8.18.2"},{"$f":"'G. Communications and Ops Mgmt'!C112","v":"Regularly updated signatures based on new threats?"},{"$f":"'G. Communications and Ops Mgmt'!D112","v":0},{"$f":"'G. Communications and Ops Mgmt'!E112","v":0},{"$f":"'G. Communications and Ops Mgmt'!F112","v":0},{"$f":"'G. Communications and Ops Mgmt'!G112","v":"G.3 Network Security – IDS / IPS Attributes"},{"$f":"'G. Communications and Ops Mgmt'!H112","v":"13.6.1"},{"$f":"'G. Communications and Ops Mgmt'!I112","v":"Management of technical vulnerabilities"},null,"AI2.3","Application control and auditability","N/A","IS.2.A.7 IS.2.C.9 IS.2.M.9.2","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A113","v":1077},{"$f":"'G. Communications and Ops Mgmt'!J113","v":3},{"$f":"'G. Communications and Ops Mgmt'!K113","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y113","v":0},{"$f":"'G. Communications and Ops Mgmt'!B113","v":"G.8.18.3"},{"$f":"'G. Communications and Ops Mgmt'!C113","v":"System monitoring 24x7x365?"},{"$f":"'G. Communications and Ops Mgmt'!D113","v":0},{"$f":"'G. Communications and Ops Mgmt'!E113","v":0},{"$f":"'G. Communications and Ops Mgmt'!F113","v":0},{"$f":"'G. Communications and Ops Mgmt'!G113","v":0},{"$f":"'G. Communications and Ops Mgmt'!H113","v":"13.1.1.d"},{"$f":"'G. Communications and Ops Mgmt'!I113","v":"Network Controls"},null,null,null,"N/A","IS.2.C.9 OPS.2.12.B","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A114","v":1080},{"$f":"'G. Communications and Ops Mgmt'!J114","v":3},{"$f":"'G. Communications and Ops Mgmt'!K114","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y114","v":0},{"$f":"'G. Communications and Ops Mgmt'!B114","v":"G.8.18.4"},{"$f":"'G. Communications and Ops Mgmt'!C114","v":"Event feeds into the Incident Management process?"},{"$f":"'G. Communications and Ops Mgmt'!D114","v":0},{"$f":"'G. Communications and Ops Mgmt'!E114","v":0},{"$f":"'G. Communications and Ops Mgmt'!F114","v":0},{"$f":"'G. Communications and Ops Mgmt'!G114","v":0},{"$f":"'G. Communications and Ops Mgmt'!H114","v":"12.2.1.i"},{"$f":"'G. Communications and Ops Mgmt'!I114","v":"Controls against malware"},null,null,null,"N/A","N/A","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A115","v":1121},{"$f":"'G. Communications and Ops Mgmt'!J115","v":2},{"$f":"'G. Communications and Ops Mgmt'!K115","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y115","v":0},{"$f":"'G. Communications and Ops Mgmt'!B115","v":"G.8.19"},{"$f":"'G. Communications and Ops Mgmt'!C115","v":"Is approval required prior to connecting any outbound or inbound modem lines, cable modem lines, DSL phone lines or wireless access points to a desktop or other access point directly connected to the company-managed network?"},{"$f":"'G. Communications and Ops Mgmt'!D115","v":0},{"$f":"'G. Communications and Ops Mgmt'!E115","v":0},{"$f":"'G. Communications and Ops Mgmt'!F115","v":0},{"$f":"'G. Communications and Ops Mgmt'!G115","v":0},{"$f":"'G. Communications and Ops Mgmt'!H115","v":"9.1.2.b"},{"$f":"'G. Communications and Ops Mgmt'!I115","v":"Access to networks and network services"},null,null,null,"N/A","N/A","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A116","v":1095},{"$f":"'G. Communications and Ops Mgmt'!J116","v":1},{"$f":"'G. Communications and Ops Mgmt'!K116","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y116","v":1},{"$f":"'G. Communications and Ops Mgmt'!B116","v":"G.9"},{"$f":"'G. Communications and Ops Mgmt'!C116","v":"Is wireless networking technology used? Is yes, is there:"},{"$f":"'G. Communications and Ops Mgmt'!D116","v":0},{"$f":"'G. Communications and Ops Mgmt'!E116","v":0},{"$f":"'G. Communications and Ops Mgmt'!F116","v":0},{"$f":"'G. Communications and Ops Mgmt'!G116","v":"G.17 Unapproved Wireless Networks"},{"$f":"'G. Communications and Ops Mgmt'!H116","v":"13.1.1.c"},{"$f":"'G. Communications and Ops Mgmt'!I116","v":"Network Controls"},null,null,null,"N/A","IS.2.M.6","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A117","v":1096},{"$f":"'G. Communications and Ops Mgmt'!J117","v":2},{"$f":"'G. Communications and Ops Mgmt'!K117","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y117","v":0},{"$f":"'G. Communications and Ops Mgmt'!B117","v":"G.9.1"},{"$f":"'G. Communications and Ops Mgmt'!C117","v":"Approved and fully implemented wireless networking policy?"},{"$f":"'G. Communications and Ops Mgmt'!D117","v":0},{"$f":"'G. Communications and Ops Mgmt'!E117","v":0},{"$f":"'G. Communications and Ops Mgmt'!F117","v":0},{"$f":"'G. Communications and Ops Mgmt'!G117","v":"G.17 Unapproved Wireless Networks"},{"$f":"'G. Communications and Ops Mgmt'!H117","v":"13.1.1.a"},{"$f":"'G. Communications and Ops Mgmt'!I117","v":"Network Controls"},null,null,null,6.6,"N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A118","v":1107},{"$f":"'G. Communications and Ops Mgmt'!J118","v":2},{"$f":"'G. Communications and Ops Mgmt'!K118","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y118","v":0},{"$f":"'G. Communications and Ops Mgmt'!B118","v":"G.9.2"},{"$f":"'G. Communications and Ops Mgmt'!C118","v":"Two active network connections allowed at the same time (split-tunneling)?"},{"$f":"'G. Communications and Ops Mgmt'!D118","v":0},{"$f":"'G. Communications and Ops Mgmt'!E118","v":0},{"$f":"'G. Communications and Ops Mgmt'!F118","v":0},{"$f":"'G. Communications and Ops Mgmt'!G118","v":"G.17 Unapproved Wireless Networks"},{"$f":"'G. Communications and Ops Mgmt'!H118","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I118","v":""},null,null,null,"N/A","IS.2.A.4.4","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A119","v":1108},{"$f":"'G. Communications and Ops Mgmt'!J119","v":2},{"$f":"'G. Communications and Ops Mgmt'!K119","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y119","v":0},{"$f":"'G. Communications and Ops Mgmt'!B119","v":"G.9.3"},{"$f":"'G. Communications and Ops Mgmt'!C119","v":"Wireless connections authenticated using multi-factor authentication?"},{"$f":"'G. Communications and Ops Mgmt'!D119","v":0},{"$f":"'G. Communications and Ops Mgmt'!E119","v":0},{"$f":"'G. Communications and Ops Mgmt'!F119","v":0},{"$f":"'G. Communications and Ops Mgmt'!G119","v":"G.17 Unapproved Wireless Networks"},{"$f":"'G. Communications and Ops Mgmt'!H119","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!I119","v":"Segregation In Networks"},null,null,null,"8.2.1","IS.2.A.4.3 AUDIT.2.D.1.5 E-BANK.1.4.5.4 RPS.2.C.3","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A120","v":1111},{"$f":"'G. Communications and Ops Mgmt'!J120","v":2},{"$f":"'G. Communications and Ops Mgmt'!K120","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y120","v":0},{"$f":"'G. Communications and Ops Mgmt'!B120","v":"G.9.4"},{"$f":"'G. Communications and Ops Mgmt'!C120","v":"Encrypted using strong encryption (WPA2 or higher)?"},{"$f":"'G. Communications and Ops Mgmt'!D120","v":0},{"$f":"'G. Communications and Ops Mgmt'!E120","v":0},{"$f":"'G. Communications and Ops Mgmt'!F120","v":0},{"$f":"'G. Communications and Ops Mgmt'!G120","v":"G.18 Wireless Networks Encryption "},{"$f":"'G. Communications and Ops Mgmt'!H120","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!I120","v":"Segregation In Networks"},null,"DS5.3","Identity management",9.8000000000000007,"N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A121","v":1117},{"$f":"'G. Communications and Ops Mgmt'!J121","v":2},{"$f":"'G. Communications and Ops Mgmt'!K121","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y121","v":0},{"$f":"'G. Communications and Ops Mgmt'!B121","v":"G.9.5"},{"$f":"'G. Communications and Ops Mgmt'!C121","v":"Wireless access points SNMP community strings changed?"},{"$f":"'G. Communications and Ops Mgmt'!D121","v":0},{"$f":"'G. Communications and Ops Mgmt'!E121","v":0},{"$f":"'G. Communications and Ops Mgmt'!F121","v":0},{"$f":"'G. Communications and Ops Mgmt'!G121","v":0},{"$f":"'G. Communications and Ops Mgmt'!H121","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I121","v":0},null,"DS5.3","Identity management","9.7.1","IS.2.A.5.1","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A122","v":1118},{"$f":"'G. Communications and Ops Mgmt'!J122","v":2},{"$f":"'G. Communications and Ops Mgmt'!K122","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y122","v":0},{"$f":"'G. Communications and Ops Mgmt'!B122","v":"G.9.6"},{"$f":"'G. Communications and Ops Mgmt'!C122","v":"Quarterly scans for rogue wireless access points?"},{"$f":"'G. Communications and Ops Mgmt'!D122","v":0},{"$f":"'G. Communications and Ops Mgmt'!E122","v":0},{"$f":"'G. Communications and Ops Mgmt'!F122","v":0},{"$f":"'G. Communications and Ops Mgmt'!G122","v":0},{"$f":"'G. Communications and Ops Mgmt'!H122","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I122","v":""},null,"DS5.3","Identity management","9.8.2","IS.2.A.5 IS.2.A.5.2 AUDIT.2.D.1.5 E-BANK.1.4.5.11 RPS.2.C.3","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A123","v":3295},{"$f":"'G. Communications and Ops Mgmt'!J123","v":1},{"$f":"'G. Communications and Ops Mgmt'!K123","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y123","v":1},{"$f":"'G. Communications and Ops Mgmt'!B123","v":"G.10"},{"$f":"'G. Communications and Ops Mgmt'!C123","v":"Is there a removable media policy or program (CDs, DVDs, tapes, disk drives) that has been approved by management, communicated to appropriate constituents, and an owner to maintain and review the policy? If yes, is:"},{"$f":"'G. Communications and Ops Mgmt'!D123","v":0},{"$f":"'G. Communications and Ops Mgmt'!E123","v":0},{"$f":"'G. Communications and Ops Mgmt'!F123","v":0},{"$f":"'G. Communications and Ops Mgmt'!G123","v":"G.15 Physical Media Tracking"},{"$f":"'G. Communications and Ops Mgmt'!H123","v":"8.3.1"},{"$f":"'G. Communications and Ops Mgmt'!I123","v":"Management of Removable Media"},null,"DS5.3","Identity management","9.7.1","N/A","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A124","v":1872},{"$f":"'G. Communications and Ops Mgmt'!J124","v":2},{"$f":"'G. Communications and Ops Mgmt'!K124","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y124","v":0},{"$f":"'G. Communications and Ops Mgmt'!B124","v":"G.10.1"},{"$f":"'G. Communications and Ops Mgmt'!C124","v":"Data encrypted while stored?"},{"$f":"'G. Communications and Ops Mgmt'!D124","v":0},{"$f":"'G. Communications and Ops Mgmt'!E124","v":0},{"$f":"'G. Communications and Ops Mgmt'!F124","v":0},{"$f":"'G. Communications and Ops Mgmt'!G124","v":"G. 22 Data Security Policy - Encryption"},{"$f":"'G. Communications and Ops Mgmt'!H124","v":"10.1.1.c"},{"$f":"'G. Communications and Ops Mgmt'!I124","v":"Policy On The Use of Cryptographic Controls"},null,null,null,"4.1, 9.6","E-BANK.1.4.6.1","DS5.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A125","v":1137},{"$f":"'G. Communications and Ops Mgmt'!J125","v":2},{"$f":"'G. Communications and Ops Mgmt'!K125","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y125","v":0},{"$f":"'G. Communications and Ops Mgmt'!B125","v":"G.10.2"},{"$f":"'G. Communications and Ops Mgmt'!C125","v":"Sensitive data encrypted?"},{"$f":"'G. Communications and Ops Mgmt'!D125","v":0},{"$f":"'G. Communications and Ops Mgmt'!E125","v":0},{"$f":"'G. Communications and Ops Mgmt'!F125","v":0},{"$f":"'G. Communications and Ops Mgmt'!G125","v":"G. 22 Data Security Policy - Encryption"},{"$f":"'G. Communications and Ops Mgmt'!H125","v":"8.3.1.d                                    10.1.1.Section2a "},{"$f":"'G. Communications and Ops Mgmt'!I125","v":"Management of removable media,                                         Policy on The Use of Cryptographic Controls"},null,null,null,4.0999999999999996,"E-BANK.1.4.5.3","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A126","v":1138},{"$f":"'G. Communications and Ops Mgmt'!J126","v":2},{"$f":"'G. Communications and Ops Mgmt'!K126","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y126","v":0},{"$f":"'G. Communications and Ops Mgmt'!B126","v":"G.10.3"},{"$f":"'G. Communications and Ops Mgmt'!C126","v":"Is all media containing Scoped Systems and Data disposed of securely to prevent recovery? If yes, is it:"},{"$f":"'G. Communications and Ops Mgmt'!D126","v":0},{"$f":"'G. Communications and Ops Mgmt'!E126","v":0},{"$f":"'G. Communications and Ops Mgmt'!F126","v":0},{"$f":"'G. Communications and Ops Mgmt'!G126","v":"D.2 Asset Destruction"},{"$f":"'G. Communications and Ops Mgmt'!H126","v":"8.3.2"},{"$f":"'G. Communications and Ops Mgmt'!I126","v":"Disposal of Media"},null,"DS5.5","Security testing, surveillance and monitoring",4.3,"N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A127","v":1153},{"$f":"'G. Communications and Ops Mgmt'!J127","v":3},{"$f":"'G. Communications and Ops Mgmt'!K127","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y127","v":0},{"$f":"'G. Communications and Ops Mgmt'!B127","v":"G.10.3.1"},{"$f":"'G. Communications and Ops Mgmt'!C127","v":"Logged to maintain an audit trail?"},{"$f":"'G. Communications and Ops Mgmt'!D127","v":0},{"$f":"'G. Communications and Ops Mgmt'!E127","v":0},{"$f":"'G. Communications and Ops Mgmt'!F127","v":0},{"$f":"'G. Communications and Ops Mgmt'!G127","v":"D.2 Asset Destruction"},{"$f":"'G. Communications and Ops Mgmt'!H127","v":"8.3.2.e"},{"$f":"'G. Communications and Ops Mgmt'!I127","v":"Disposal of Media"},null,"PO4.8","Responsibility for risk, security and compliance","5.1.2","IS.1.4.1.3.1 IS.2.C.1 OPS.1.5.1.5 E-BANK.1.4.2.5","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A128","v":2624},{"$f":"'G. Communications and Ops Mgmt'!J128","v":3},{"$f":"'G. Communications and Ops Mgmt'!K128","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y128","v":0},{"$f":"'G. Communications and Ops Mgmt'!B128","v":"G.10.3.2"},{"$f":"'G. Communications and Ops Mgmt'!C128","v":"Made unrecoverable (wiped or overwritten) prior to asset reuse?"},{"$f":"'G. Communications and Ops Mgmt'!D128","v":0},{"$f":"'G. Communications and Ops Mgmt'!E128","v":0},{"$f":"'G. Communications and Ops Mgmt'!F128","v":0},{"$f":"'G. Communications and Ops Mgmt'!G128","v":0},{"$f":"'G. Communications and Ops Mgmt'!H128","v":"8.3.1.a                                     11.2.7 "},{"$f":"'G. Communications and Ops Mgmt'!I128","v":"Disposal of media,                   Secure disposal or re-use of equipment"},null,"AI4.4","Knowledge transfer to operations and support staff","N/A","IS.2.C.4","DS5.5, DS5.7, ME2.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A129","v":2950},{"$f":"'G. Communications and Ops Mgmt'!J129","v":3},{"$f":"'G. Communications and Ops Mgmt'!K129","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y129","v":0},{"$f":"'G. Communications and Ops Mgmt'!B129","v":"G.10.3.3"},{"$f":"'G. Communications and Ops Mgmt'!C129","v":"Inventoried at least quarterly?"},{"$f":"'G. Communications and Ops Mgmt'!D129","v":0},{"$f":"'G. Communications and Ops Mgmt'!E129","v":0},{"$f":"'G. Communications and Ops Mgmt'!F129","v":0},{"$f":"'G. Communications and Ops Mgmt'!G129","v":"D.1 Asset Accounting and Inventory"},{"$f":"'G. Communications and Ops Mgmt'!H129","v":"8.1.1 "},{"$f":"'G. Communications and Ops Mgmt'!I129","v":"Inventory of Assets"},null,null,null,"N/A","IS.2.C.3","AI3.3, AI6.2, AI6.3, DS5.5, DS5.7, DS9.2"]
[{"$f":"'G. Communications and Ops Mgmt'!A130","v":1208},{"$f":"'G. Communications and Ops Mgmt'!J130","v":1},{"$f":"'G. Communications and Ops Mgmt'!K130","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y130","v":1},{"$f":"'G. Communications and Ops Mgmt'!B130","v":"G.11"},{"$f":"'G. Communications and Ops Mgmt'!C130","v":"Is Scoped Data sent or received electronically or via physical media? If yes, is there:"},{"$f":"'G. Communications and Ops Mgmt'!D130","v":0},{"$f":"'G. Communications and Ops Mgmt'!E130","v":0},{"$f":"'G. Communications and Ops Mgmt'!F130","v":0},{"$f":"'G. Communications and Ops Mgmt'!G130","v":"G.4 Network Management – Encrypted Authentication Credentials"},{"$f":"'G. Communications and Ops Mgmt'!H130","v":"8.3.3"},{"$f":"'G. Communications and Ops Mgmt'!I130","v":"Physical Media in Transit"},null,"DS5.5","Security testing, surveillance and monitoring","N/A","IS.2.C.2","AI6.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A131","v":1871},{"$f":"'G. Communications and Ops Mgmt'!J131","v":2},{"$f":"'G. Communications and Ops Mgmt'!K131","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y131","v":0},{"$f":"'G. Communications and Ops Mgmt'!B131","v":"G.11.1"},{"$f":"'G. Communications and Ops Mgmt'!C131","v":"Encryption in transit while outside the network?"},{"$f":"'G. Communications and Ops Mgmt'!D131","v":0},{"$f":"'G. Communications and Ops Mgmt'!E131","v":0},{"$f":"'G. Communications and Ops Mgmt'!F131","v":0},{"$f":"'G. Communications and Ops Mgmt'!G131","v":"G.4 Network Management – Encrypted Authentication Credentials"},{"$f":"'G. Communications and Ops Mgmt'!H131","v":"13.2.1.f"},{"$f":"'G. Communications and Ops Mgmt'!I131","v":"Information Transfer Policies and Procedures"},null,"AI2.3","Application control and auditability","N/A","IS.1.4.1.3.5 OPS.2.12.B AUDIT.2.D.1.7 E-BANK.1.4.3.5","DS 5.5, ME1.2, ME2.2, ME2.5, ME4.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A132","v":1193},{"$f":"'G. Communications and Ops Mgmt'!J132","v":2},{"$f":"'G. Communications and Ops Mgmt'!K132","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y132","v":0},{"$f":"'G. Communications and Ops Mgmt'!B132","v":"G.11.2"},{"$f":"'G. Communications and Ops Mgmt'!C132","v":"Encryption in transit within the network?"},{"$f":"'G. Communications and Ops Mgmt'!D132","v":0},{"$f":"'G. Communications and Ops Mgmt'!E132","v":0},{"$f":"'G. Communications and Ops Mgmt'!F132","v":0},{"$f":"'G. Communications and Ops Mgmt'!G132","v":"G.4 Network Management – Encrypted Authentication Credentials"},{"$f":"'G. Communications and Ops Mgmt'!H132","v":"13.2.1.f"},{"$f":"'G. Communications and Ops Mgmt'!I132","v":"Information Transfer Policies and Procedures"},null,"AI2.3","Application control and auditability","9.6.2","IS.2.A.7 IS.2.C.9 IS.2.M.9.2","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A133","v":2629},{"$f":"'G. Communications and Ops Mgmt'!J133","v":2},{"$f":"'G. Communications and Ops Mgmt'!K133","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y133","v":0},{"$f":"'G. Communications and Ops Mgmt'!B133","v":"G.11.3"},{"$f":"'G. Communications and Ops Mgmt'!C133","v":"Protection against malicious code?"},{"$f":"'G. Communications and Ops Mgmt'!D133","v":0},{"$f":"'G. Communications and Ops Mgmt'!E133","v":0},{"$f":"'G. Communications and Ops Mgmt'!F133","v":0},{"$f":"'G. Communications and Ops Mgmt'!G133","v":0},{"$f":"'G. Communications and Ops Mgmt'!H133","v":"13.2.1.b"},{"$f":"'G. Communications and Ops Mgmt'!I133","v":"Information Transfer Policies and Procedures"},null,null,null,9.6,"IS.2.C.9 OPS.2.12.B","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A134","v":1177},{"$f":"'G. Communications and Ops Mgmt'!J134","v":2},{"$f":"'G. Communications and Ops Mgmt'!K134","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y134","v":0},{"$f":"'G. Communications and Ops Mgmt'!B134","v":"G.11.4"},{"$f":"'G. Communications and Ops Mgmt'!C134","v":"Confidentiality / integrity of data following any transmissions?"},{"$f":"'G. Communications and Ops Mgmt'!D134","v":0},{"$f":"'G. Communications and Ops Mgmt'!E134","v":0},{"$f":"'G. Communications and Ops Mgmt'!F134","v":0},{"$f":"'G. Communications and Ops Mgmt'!G134","v":"G.16 Security of Media in Transit"},{"$f":"'G. Communications and Ops Mgmt'!H134","v":"13.2.4"},{"$f":"'G. Communications and Ops Mgmt'!I134","v":"Confidentiality or Non-disclosure Agreements"},null,null,null,4.2,"N/A","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A135","v":1186},{"$f":"'G. Communications and Ops Mgmt'!J135","v":2},{"$f":"'G. Communications and Ops Mgmt'!K135","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y135","v":0},{"$f":"'G. Communications and Ops Mgmt'!B135","v":"G.11.5"},{"$f":"'G. Communications and Ops Mgmt'!C135","v":"Review and approval process for transmissions?"},{"$f":"'G. Communications and Ops Mgmt'!D135","v":0},{"$f":"'G. Communications and Ops Mgmt'!E135","v":0},{"$f":"'G. Communications and Ops Mgmt'!F135","v":0},{"$f":"'G. Communications and Ops Mgmt'!G135","v":"G.16 Security of Media in Transit"},{"$f":"'G. Communications and Ops Mgmt'!H135","v":"13.2.1"},{"$f":"'G. Communications and Ops Mgmt'!I135","v":"Information Transfer Policies and Procedures"},null,null,null,"N/A","N/A","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A136","v":2634},{"$f":"'G. Communications and Ops Mgmt'!J136","v":2},{"$f":"'G. Communications and Ops Mgmt'!K136","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y136","v":0},{"$f":"'G. Communications and Ops Mgmt'!B136","v":"G.11.6"},{"$f":"'G. Communications and Ops Mgmt'!C136","v":"Transport containers to protect against physical damage?"},{"$f":"'G. Communications and Ops Mgmt'!D136","v":0},{"$f":"'G. Communications and Ops Mgmt'!E136","v":0},{"$f":"'G. Communications and Ops Mgmt'!F136","v":0},{"$f":"'G. Communications and Ops Mgmt'!G136","v":"G.16 Security of Media in Transit"},{"$f":"'G. Communications and Ops Mgmt'!H136","v":"8.3.3.d"},{"$f":"'G. Communications and Ops Mgmt'!I136","v":"Physical Media in Transit"},null,null,null,10.4,"IS.2.M.6","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A137","v":2635},{"$f":"'G. Communications and Ops Mgmt'!J137","v":2},{"$f":"'G. Communications and Ops Mgmt'!K137","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y137","v":0},{"$f":"'G. Communications and Ops Mgmt'!B137","v":"G.11.7"},{"$f":"'G. Communications and Ops Mgmt'!C137","v":"Locked or tamper evident transport containers?"},{"$f":"'G. Communications and Ops Mgmt'!D137","v":0},{"$f":"'G. Communications and Ops Mgmt'!E137","v":0},{"$f":"'G. Communications and Ops Mgmt'!F137","v":0},{"$f":"'G. Communications and Ops Mgmt'!G137","v":"G.16 Security of Media in Transit"},{"$f":"'G. Communications and Ops Mgmt'!H137","v":"8.3.3.d"},{"$f":"'G. Communications and Ops Mgmt'!I137","v":"Physical Media in Transit"},null,null,null,"N/A","N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A138","v":1209},{"$f":"'G. Communications and Ops Mgmt'!J138","v":2},{"$f":"'G. Communications and Ops Mgmt'!K138","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y138","v":0},{"$f":"'G. Communications and Ops Mgmt'!B138","v":"G.11.8"},{"$f":"'G. Communications and Ops Mgmt'!C138","v":"Physical media tracking?"},{"$f":"'G. Communications and Ops Mgmt'!D138","v":0},{"$f":"'G. Communications and Ops Mgmt'!E138","v":0},{"$f":"'G. Communications and Ops Mgmt'!F138","v":0},{"$f":"'G. Communications and Ops Mgmt'!G138","v":"G.15 Physical Media Tracking"},{"$f":"'G. Communications and Ops Mgmt'!H138","v":"8.3.3.e"},{"$f":"'G. Communications and Ops Mgmt'!I138","v":"Physical Media in Transit"},null,null,null,"N/A","IS.2.A.4.4","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A139","v":1243},{"$f":"'G. Communications and Ops Mgmt'!J139","v":2},{"$f":"'G. Communications and Ops Mgmt'!K139","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y139","v":0},{"$f":"'G. Communications and Ops Mgmt'!B139","v":"G.11.9"},{"$f":"'G. Communications and Ops Mgmt'!C139","v":"Protection when transmitted through email?"},{"$f":"'G. Communications and Ops Mgmt'!D139","v":0},{"$f":"'G. Communications and Ops Mgmt'!E139","v":0},{"$f":"'G. Communications and Ops Mgmt'!F139","v":0},{"$f":"'G. Communications and Ops Mgmt'!G139","v":"G. 22 Data Security Policy - Encryption"},{"$f":"'G. Communications and Ops Mgmt'!H139","v":"13.2.3"},{"$f":"'G. Communications and Ops Mgmt'!I139","v":"Electronic Messaging"},null,null,null,"12.1.1","IS.2.A.4.3 AUDIT.2.D.1.5 E-BANK.1.4.5.4 RPS.2.C.3","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A140","v":1245},{"$f":"'G. Communications and Ops Mgmt'!J140","v":2},{"$f":"'G. Communications and Ops Mgmt'!K140","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y140","v":0},{"$f":"'G. Communications and Ops Mgmt'!B140","v":"G.11.10"},{"$f":"'G. Communications and Ops Mgmt'!C140","v":"Encryption when sent through email?"},{"$f":"'G. Communications and Ops Mgmt'!D140","v":0},{"$f":"'G. Communications and Ops Mgmt'!E140","v":0},{"$f":"'G. Communications and Ops Mgmt'!F140","v":0},{"$f":"'G. Communications and Ops Mgmt'!G140","v":"G. 22 Data Security Policy - Encryption"},{"$f":"'G. Communications and Ops Mgmt'!H140","v":"13.2.1.f"},{"$f":"'G. Communications and Ops Mgmt'!I140","v":"Information Transfer Policies and Procedures"},null,null,null,"N/A","N/A","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A141","v":1247},{"$f":"'G. Communications and Ops Mgmt'!J141","v":2},{"$f":"'G. Communications and Ops Mgmt'!K141","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y141","v":0},{"$f":"'G. Communications and Ops Mgmt'!B141","v":"G.11.11"},{"$f":"'G. Communications and Ops Mgmt'!C141","v":"Content filtering scans performed on incoming/outgoing email to enforce email policy?"},{"$f":"'G. Communications and Ops Mgmt'!D141","v":0},{"$f":"'G. Communications and Ops Mgmt'!E141","v":0},{"$f":"'G. Communications and Ops Mgmt'!F141","v":0},{"$f":"'G. Communications and Ops Mgmt'!G141","v":"G. 22 Data Security Policy - Encryption"},{"$f":"'G. Communications and Ops Mgmt'!H141","v":"12.2.1.d"},{"$f":"'G. Communications and Ops Mgmt'!I141","v":"Controls against malware"},null,"DS5.3","Identity management",8.3000000000000007,"N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A142","v":1272},{"$f":"'G. Communications and Ops Mgmt'!J142","v":1},{"$f":"'G. Communications and Ops Mgmt'!K142","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y142","v":0},{"$f":"'G. Communications and Ops Mgmt'!B142","v":"G.12"},{"$f":"'G. Communications and Ops Mgmt'!C142","v":"Do systems and network devices utilize a common time synchronization service?"},{"$f":"'G. Communications and Ops Mgmt'!D142","v":0},{"$f":"'G. Communications and Ops Mgmt'!E142","v":0},{"$f":"'G. Communications and Ops Mgmt'!F142","v":0},{"$f":"'G. Communications and Ops Mgmt'!G142","v":0},{"$f":"'G. Communications and Ops Mgmt'!H142","v":"12.4.4"},{"$f":"'G. Communications and Ops Mgmt'!I142","v":"Clock Synchronization"},null,"DS5.3","Identity management",8.3000000000000007,"N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A143","v":1281},{"$f":"'G. Communications and Ops Mgmt'!J143","v":1},{"$f":"'G. Communications and Ops Mgmt'!K143","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y143","v":0},{"$f":"'G. Communications and Ops Mgmt'!B143","v":"G.13"},{"$f":"'G. Communications and Ops Mgmt'!C143","v":"Are UNIX or Linux operating systems used for transmitting, processing or storing Scoped Data? If yes, is there:"},{"$f":"'G. Communications and Ops Mgmt'!D143","v":0},{"$f":"'G. Communications and Ops Mgmt'!E143","v":0},{"$f":"'G. Communications and Ops Mgmt'!F143","v":0},{"$f":"'G. Communications and Ops Mgmt'!G143","v":0},{"$f":"'G. Communications and Ops Mgmt'!H143","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I143","v":""},null,"DS5.3","Identity management","N/A","IS.2.A.5.1","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A144","v":1282},{"$f":"'G. Communications and Ops Mgmt'!J144","v":2},{"$f":"'G. Communications and Ops Mgmt'!K144","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y144","v":0},{"$f":"'G. Communications and Ops Mgmt'!B144","v":"G.13.1"},{"$f":"'G. Communications and Ops Mgmt'!C144","v":" UNIX hardening standards?"},{"$f":"'G. Communications and Ops Mgmt'!D144","v":0},{"$f":"'G. Communications and Ops Mgmt'!E144","v":0},{"$f":"'G. Communications and Ops Mgmt'!F144","v":0},{"$f":"'G. Communications and Ops Mgmt'!G144","v":"I.3 Secure System Hardening Standards"},{"$f":"'G. Communications and Ops Mgmt'!H144","v":"13.1.1.e"},{"$f":"'G. Communications and Ops Mgmt'!I144","v":"Network Controls"},null,null,null,"N/A","IS.2.A.5 IS.2.A.5.2 AUDIT.2.D.1.5 E-BANK.1.4.5.11 RPS.2.C.3","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A145","v":4115},{"$f":"'G. Communications and Ops Mgmt'!J145","v":3},{"$f":"'G. Communications and Ops Mgmt'!K145","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y145","v":0},{"$f":"'G. Communications and Ops Mgmt'!B145","v":"G.13.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C145","v":"Are the standards reviewed and/or updated at least monthly to ensure any security vulnerabilities are addressed?"},{"$f":"'G. Communications and Ops Mgmt'!D145","v":0},{"$f":"'G. Communications and Ops Mgmt'!E145","v":0},{"$f":"'G. Communications and Ops Mgmt'!F145","v":0},{"$f":"'G. Communications and Ops Mgmt'!G145","v":0},{"$f":"'G. Communications and Ops Mgmt'!H145","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I145","v":0}]
[{"$f":"'G. Communications and Ops Mgmt'!A146","v":1304},{"$f":"'G. Communications and Ops Mgmt'!J146","v":3},{"$f":"'G. Communications and Ops Mgmt'!K146","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y146","v":0},{"$f":"'G. Communications and Ops Mgmt'!B146","v":"G.13.1.2"},{"$f":"'G. Communications and Ops Mgmt'!C146","v":"Periodic monitoring for continued compliance to build standards and security requirements?"},{"$f":"'G. Communications and Ops Mgmt'!D146","v":0},{"$f":"'G. Communications and Ops Mgmt'!E146","v":0},{"$f":"'G. Communications and Ops Mgmt'!F146","v":0},{"$f":"'G. Communications and Ops Mgmt'!G146","v":0},{"$f":"'G. Communications and Ops Mgmt'!H146","v":"18.2.3"},{"$f":"'G. Communications and Ops Mgmt'!I146","v":"Technical Compliance Review"},null,null,null,10.6,"RPS.2.C.3","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A147","v":1292},{"$f":"'G. Communications and Ops Mgmt'!J147","v":2},{"$f":"'G. Communications and Ops Mgmt'!K147","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y147","v":0},{"$f":"'G. Communications and Ops Mgmt'!B147","v":"G.13.2"},{"$f":"'G. Communications and Ops Mgmt'!C147","v":"Are users required to ‘su’ or ‘sudo’ into root?"},{"$f":"'G. Communications and Ops Mgmt'!D147","v":0},{"$f":"'G. Communications and Ops Mgmt'!E147","v":0},{"$f":"'G. Communications and Ops Mgmt'!F147","v":0},{"$f":"'G. Communications and Ops Mgmt'!G147","v":0},{"$f":"'G. Communications and Ops Mgmt'!H147","v":"9.2.1"},{"$f":"'G. Communications and Ops Mgmt'!I147","v":"User Registration and De-registration"},null,null,null,10.3,"E-BANK.1.4.6.1","DS5.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A148","v":1294},{"$f":"'G. Communications and Ops Mgmt'!J148","v":2},{"$f":"'G. Communications and Ops Mgmt'!K148","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y148","v":0},{"$f":"'G. Communications and Ops Mgmt'!B148","v":"G.13.3"},{"$f":"'G. Communications and Ops Mgmt'!C148","v":"Does remote SU/root access require multi-factor authentication?"},{"$f":"'G. Communications and Ops Mgmt'!D148","v":0},{"$f":"'G. Communications and Ops Mgmt'!E148","v":0},{"$f":"'G. Communications and Ops Mgmt'!F148","v":0},{"$f":"'G. Communications and Ops Mgmt'!G148","v":0},{"$f":"'G. Communications and Ops Mgmt'!H148","v":"9.1.2"},{"$f":"'G. Communications and Ops Mgmt'!I148","v":"Access to Networks and Network Services"},null,null,null,10.7,"E-BANK.1.4.5.3","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A149","v":1301},{"$f":"'G. Communications and Ops Mgmt'!J149","v":2},{"$f":"'G. Communications and Ops Mgmt'!K149","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y149","v":0},{"$f":"'G. Communications and Ops Mgmt'!B149","v":"G.13.4"},{"$f":"'G. Communications and Ops Mgmt'!C149","v":"Are remote access tools that do not require authentication (e.g., rhost, shost) allowed?"},{"$f":"'G. Communications and Ops Mgmt'!D149","v":0},{"$f":"'G. Communications and Ops Mgmt'!E149","v":0},{"$f":"'G. Communications and Ops Mgmt'!F149","v":0},{"$f":"'G. Communications and Ops Mgmt'!G149","v":0},{"$f":"'G. Communications and Ops Mgmt'!H149","v":"9.1.2"},{"$f":"'G. Communications and Ops Mgmt'!I149","v":"Access to Networks and Network Services"},null,"PO4.8","Responsibility for risk, security and compliance","10.5.5","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A150","v":1302},{"$f":"'G. Communications and Ops Mgmt'!J150","v":2},{"$f":"'G. Communications and Ops Mgmt'!K150","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y150","v":0},{"$f":"'G. Communications and Ops Mgmt'!B150","v":"G.13.5"},{"$f":"'G. Communications and Ops Mgmt'!C150","v":"Is access to modify startup and shutdown scripts restricted to root-level users?"},{"$f":"'G. Communications and Ops Mgmt'!D150","v":0},{"$f":"'G. Communications and Ops Mgmt'!E150","v":0},{"$f":"'G. Communications and Ops Mgmt'!F150","v":0},{"$f":"'G. Communications and Ops Mgmt'!G150","v":0},{"$f":"'G. Communications and Ops Mgmt'!H150","v":"9.4.4.d"},{"$f":"'G. Communications and Ops Mgmt'!I150","v":"Use of Privileged Utility Programs"},null,"PO4.8","Responsibility for risk, security and compliance","10.5.4","N/A","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A151","v":1303},{"$f":"'G. Communications and Ops Mgmt'!J151","v":2},{"$f":"'G. Communications and Ops Mgmt'!K151","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y151","v":0},{"$f":"'G. Communications and Ops Mgmt'!B151","v":"G.13.6"},{"$f":"'G. Communications and Ops Mgmt'!C151","v":"Are all unnecessary/unused services turned off?"},{"$f":"'G. Communications and Ops Mgmt'!D151","v":0},{"$f":"'G. Communications and Ops Mgmt'!E151","v":0},{"$f":"'G. Communications and Ops Mgmt'!F151","v":0},{"$f":"'G. Communications and Ops Mgmt'!G151","v":0},{"$f":"'G. Communications and Ops Mgmt'!H151","v":"9.4.4.h"},{"$f":"'G. Communications and Ops Mgmt'!I151","v":"Use of Privileged Utility Programs"},null,"AI4.4","Knowledge transfer to operations and support staff","10.5.2","N/A","PO4.8, PO6.2, ME2.1, ME2.2, ME2.3, ME2.4, ME2.5, ME2.6, ME2.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A152","v":1314},{"$f":"'G. Communications and Ops Mgmt'!J152","v":2},{"$f":"'G. Communications and Ops Mgmt'!K152","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y152","v":0},{"$f":"'G. Communications and Ops Mgmt'!B152","v":"G.13.7"},{"$f":"'G. Communications and Ops Mgmt'!C152","v":"Are logs regularly reviewed using a specific methodology to uncover potential incidents?"},{"$f":"'G. Communications and Ops Mgmt'!D152","v":0},{"$f":"'G. Communications and Ops Mgmt'!E152","v":0},{"$f":"'G. Communications and Ops Mgmt'!F152","v":0},{"$f":"'G. Communications and Ops Mgmt'!G152","v":0},{"$f":"'G. Communications and Ops Mgmt'!H152","v":"9.4.4.f"},{"$f":"'G. Communications and Ops Mgmt'!I152","v":"Use of Privileged Utility Programs"},null,null,null,"8.2.3","N/A","PO2.3, PO6.2, DS11.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A153","v":1316},{"$f":"'G. Communications and Ops Mgmt'!J153","v":2},{"$f":"'G. Communications and Ops Mgmt'!K153","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y153","v":0},{"$f":"'G. Communications and Ops Mgmt'!B153","v":"G.13.8"},{"$f":"'G. Communications and Ops Mgmt'!C153","v":"Do operating system event logs contain sufficient detail to support incident investigation including failed login attempts?"},{"$f":"'G. Communications and Ops Mgmt'!D153","v":0},{"$f":"'G. Communications and Ops Mgmt'!E153","v":0},{"$f":"'G. Communications and Ops Mgmt'!F153","v":0},{"$f":"'G. Communications and Ops Mgmt'!G153","v":"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!H153","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!I153","v":"Event Logging"},null,null,null,"8.2.3","N/A","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A154","v":1307},{"$f":"'G. Communications and Ops Mgmt'!J154","v":2},{"$f":"'G. Communications and Ops Mgmt'!K154","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y154","v":0},{"$f":"'G. Communications and Ops Mgmt'!B154","v":"G.13.9"},{"$f":"'G. Communications and Ops Mgmt'!C154","v":"Are operating system logs retained for a minimum of one year?"},{"$f":"'G. Communications and Ops Mgmt'!D154","v":0},{"$f":"'G. Communications and Ops Mgmt'!E154","v":0},{"$f":"'G. Communications and Ops Mgmt'!F154","v":0},{"$f":"'G. Communications and Ops Mgmt'!G154","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!H154","v":"12.4.2 "},{"$f":"'G. Communications and Ops Mgmt'!I154","v":"Protection of Log Information"},null,"AI6.3","Emergency changes","8.2.4","N/A","AI6.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A155","v":1329},{"$f":"'G. Communications and Ops Mgmt'!J155","v":2},{"$f":"'G. Communications and Ops Mgmt'!K155","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y155","v":0},{"$f":"'G. Communications and Ops Mgmt'!B155","v":"G.13.10"},{"$f":"'G. Communications and Ops Mgmt'!C155","v":"In the event of an operating system audit log failure, does the system generate an alert?"},{"$f":"'G. Communications and Ops Mgmt'!D155","v":0},{"$f":"'G. Communications and Ops Mgmt'!E155","v":0},{"$f":"'G. Communications and Ops Mgmt'!F155","v":0},{"$f":"'G. Communications and Ops Mgmt'!G155","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!H155","v":"12.4.2 "},{"$f":"'G. Communications and Ops Mgmt'!I155","v":"Protection of Log Information"},null,"PO6.2","Enterprise IT risk and internal control framework","8.2.5","OPS.2.12.C","AI6.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A156","v":1333},{"$f":"'G. Communications and Ops Mgmt'!J156","v":2},{"$f":"'G. Communications and Ops Mgmt'!K156","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y156","v":0},{"$f":"'G. Communications and Ops Mgmt'!B156","v":"G.13.11"},{"$f":"'G. Communications and Ops Mgmt'!C156","v":"Are audit logs stored on alternate systems?"},{"$f":"'G. Communications and Ops Mgmt'!D156","v":0},{"$f":"'G. Communications and Ops Mgmt'!E156","v":0},{"$f":"'G. Communications and Ops Mgmt'!F156","v":0},{"$f":"'G. Communications and Ops Mgmt'!G156","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!H156","v":"12.4.2 "},{"$f":"'G. Communications and Ops Mgmt'!I156","v":"Protection of Log Information"},null,"DS5.5","Security testing, surveillance and monitoring","8.2.6","N/A","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A157","v":1334},{"$f":"'G. Communications and Ops Mgmt'!J157","v":2},{"$f":"'G. Communications and Ops Mgmt'!K157","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y157","v":0},{"$f":"'G. Communications and Ops Mgmt'!B157","v":"G.13.12"},{"$f":"'G. Communications and Ops Mgmt'!C157","v":"Are audit logs protected against modification, deletion, and/or inappropriate access?"},{"$f":"'G. Communications and Ops Mgmt'!D157","v":0},{"$f":"'G. Communications and Ops Mgmt'!E157","v":0},{"$f":"'G. Communications and Ops Mgmt'!F157","v":0},{"$f":"'G. Communications and Ops Mgmt'!G157","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!H157","v":"12.4.2 "},{"$f":"'G. Communications and Ops Mgmt'!I157","v":"Protection of Log Information"},null,"AI2.3","Application control and auditability","8.2.1","IS.1.4.1.3.5 OPS.2.12.B AUDIT.2.D.1.7 E-BANK.1.4.3.5","DS 5.5, ME1.2, ME2.2, ME2.5, ME4.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A158","v":1342},{"$f":"'G. Communications and Ops Mgmt'!J158","v":2},{"$f":"'G. Communications and Ops Mgmt'!K158","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y158","v":0},{"$f":"'G. Communications and Ops Mgmt'!B158","v":"G.13.13"},{"$f":"'G. Communications and Ops Mgmt'!C158","v":"Minimum password length at least eight characters?"},{"$f":"'G. Communications and Ops Mgmt'!D158","v":0},{"$f":"'G. Communications and Ops Mgmt'!E158","v":0},{"$f":"'G. Communications and Ops Mgmt'!F158","v":0},{"$f":"'G. Communications and Ops Mgmt'!G158","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H158","v":"9.3.1.d"},{"$f":"'G. Communications and Ops Mgmt'!I158","v":"Use of Secret Authentication Information"},null,"AI2.3","Application control and auditability",3.3,"IS.2.A.7 IS.2.C.9 IS.2.M.9.2","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A159","v":1348},{"$f":"'G. Communications and Ops Mgmt'!J159","v":2},{"$f":"'G. Communications and Ops Mgmt'!K159","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y159","v":0},{"$f":"'G. Communications and Ops Mgmt'!B159","v":"G.13.14"},{"$f":"'G. Communications and Ops Mgmt'!C159","v":"Complex passwords required?"},{"$f":"'G. Communications and Ops Mgmt'!D159","v":0},{"$f":"'G. Communications and Ops Mgmt'!E159","v":0},{"$f":"'G. Communications and Ops Mgmt'!F159","v":0},{"$f":"'G. Communications and Ops Mgmt'!G159","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H159","v":"9.3.1.d\n\n9.4.3.c"},{"$f":"'G. Communications and Ops Mgmt'!I159","v":"Use of Secret Authentication Information\nPassword Management System"},null,null,null,3.3,"IS.2.C.9 OPS.2.12.B","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A160","v":1353},{"$f":"'G. Communications and Ops Mgmt'!J160","v":2},{"$f":"'G. Communications and Ops Mgmt'!K160","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y160","v":0},{"$f":"'G. Communications and Ops Mgmt'!B160","v":"G.13.15"},{"$f":"'G. Communications and Ops Mgmt'!C160","v":"Minimum password expiration at least 90 days?"},{"$f":"'G. Communications and Ops Mgmt'!D160","v":0},{"$f":"'G. Communications and Ops Mgmt'!E160","v":0},{"$f":"'G. Communications and Ops Mgmt'!F160","v":0},{"$f":"'G. Communications and Ops Mgmt'!G160","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H160","v":"9.4.3.e"},{"$f":"'G. Communications and Ops Mgmt'!I160","v":"Password Management System"},null,null,null,"8.1.1","IS.2.M.6","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A161","v":1358},{"$f":"'G. Communications and Ops Mgmt'!J161","v":2},{"$f":"'G. Communications and Ops Mgmt'!K161","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y161","v":0},{"$f":"'G. Communications and Ops Mgmt'!B161","v":"G.13.16"},{"$f":"'G. Communications and Ops Mgmt'!C161","v":"Password history at least 12 before reuse?"},{"$f":"'G. Communications and Ops Mgmt'!D161","v":0},{"$f":"'G. Communications and Ops Mgmt'!E161","v":0},{"$f":"'G. Communications and Ops Mgmt'!F161","v":0},{"$f":"'G. Communications and Ops Mgmt'!G161","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H161","v":"9.4.3.f"},{"$f":"'G. Communications and Ops Mgmt'!I161","v":"Password Management System"},null,null,null,"8.1.6","N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A162","v":2636},{"$f":"'G. Communications and Ops Mgmt'!J162","v":2},{"$f":"'G. Communications and Ops Mgmt'!K162","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y162","v":0},{"$f":"'G. Communications and Ops Mgmt'!B162","v":"G.13.17"},{"$f":"'G. Communications and Ops Mgmt'!C162","v":"Initial password required to be changed at first logon?"},{"$f":"'G. Communications and Ops Mgmt'!D162","v":0},{"$f":"'G. Communications and Ops Mgmt'!E162","v":0},{"$f":"'G. Communications and Ops Mgmt'!F162","v":0},{"$f":"'G. Communications and Ops Mgmt'!G162","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H162","v":"9.4.3.d"},{"$f":"'G. Communications and Ops Mgmt'!I162","v":"Password Management System"},null,null,null,"N/A","IS.2.A.4.4","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A163","v":1378},{"$f":"'G. Communications and Ops Mgmt'!J163","v":2},{"$f":"'G. Communications and Ops Mgmt'!K163","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y163","v":0},{"$f":"'G. Communications and Ops Mgmt'!B163","v":"G.13.18"},{"$f":"'G. Communications and Ops Mgmt'!C163","v":"Passwords encrypted in transit?"},{"$f":"'G. Communications and Ops Mgmt'!D163","v":0},{"$f":"'G. Communications and Ops Mgmt'!E163","v":0},{"$f":"'G. Communications and Ops Mgmt'!F163","v":0},{"$f":"'G. Communications and Ops Mgmt'!G163","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H163","v":"9.4.3.i"},{"$f":"'G. Communications and Ops Mgmt'!I163","v":"Password Management System"},null,null,null,"N/A","IS.2.A.4.3 AUDIT.2.D.1.5 E-BANK.1.4.5.4 RPS.2.C.3","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A164","v":1379},{"$f":"'G. Communications and Ops Mgmt'!J164","v":2},{"$f":"'G. Communications and Ops Mgmt'!K164","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y164","v":0},{"$f":"'G. Communications and Ops Mgmt'!B164","v":"G.13.19"},{"$f":"'G. Communications and Ops Mgmt'!C164","v":"Passwords encrypted or hashed in storage?"},{"$f":"'G. Communications and Ops Mgmt'!D164","v":0},{"$f":"'G. Communications and Ops Mgmt'!E164","v":0},{"$f":"'G. Communications and Ops Mgmt'!F164","v":0},{"$f":"'G. Communications and Ops Mgmt'!G164","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H164","v":"9.4.3.i"},{"$f":"'G. Communications and Ops Mgmt'!I164","v":"Password Management System"},null,null,null,"N/A","N/A","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A165","v":1380},{"$f":"'G. Communications and Ops Mgmt'!J165","v":2},{"$f":"'G. Communications and Ops Mgmt'!K165","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y165","v":0},{"$f":"'G. Communications and Ops Mgmt'!B165","v":"G.13.20"},{"$f":"'G. Communications and Ops Mgmt'!C165","v":"Passwords displayed when entered into a system?"},{"$f":"'G. Communications and Ops Mgmt'!D165","v":0},{"$f":"'G. Communications and Ops Mgmt'!E165","v":0},{"$f":"'G. Communications and Ops Mgmt'!F165","v":0},{"$f":"'G. Communications and Ops Mgmt'!G165","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H165","v":"9.4.3.g"},{"$f":"'G. Communications and Ops Mgmt'!I165","v":"Password Management System"},null,null,null,12.1,"N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A166","v":1287},{"$f":"'G. Communications and Ops Mgmt'!J166","v":2},{"$f":"'G. Communications and Ops Mgmt'!K166","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y166","v":0},{"$f":"'G. Communications and Ops Mgmt'!B166","v":"G.13.21"},{"$f":"'G. Communications and Ops Mgmt'!C166","v":"User accounts associated to a unique individual?"},{"$f":"'G. Communications and Ops Mgmt'!D166","v":0},{"$f":"'G. Communications and Ops Mgmt'!E166","v":0},{"$f":"'G. Communications and Ops Mgmt'!F166","v":0},{"$f":"'G. Communications and Ops Mgmt'!G166","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H166","v":"9.4.3.a"},{"$f":"'G. Communications and Ops Mgmt'!I166","v":"Password Management System"},null,"DS5.3","Identity management","N/A","N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A167","v":1362},{"$f":"'G. Communications and Ops Mgmt'!J167","v":2},{"$f":"'G. Communications and Ops Mgmt'!K167","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y167","v":0},{"$f":"'G. Communications and Ops Mgmt'!B167","v":"G.13.22"},{"$f":"'G. Communications and Ops Mgmt'!C167","v":"Does the system lock an account when three to five invalid login attempts are made?"},{"$f":"'G. Communications and Ops Mgmt'!D167","v":0},{"$f":"'G. Communications and Ops Mgmt'!E167","v":0},{"$f":"'G. Communications and Ops Mgmt'!F167","v":0},{"$f":"'G. Communications and Ops Mgmt'!G167","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H167","v":"9.4.2"},{"$f":"'G. Communications and Ops Mgmt'!I167","v":"Secure Log-On Procedures"},null,"DS5.3","Identity management",10.6,"N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A168","v":1382},{"$f":"'G. Communications and Ops Mgmt'!J168","v":1},{"$f":"'G. Communications and Ops Mgmt'!K168","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y168","v":0},{"$f":"'G. Communications and Ops Mgmt'!B168","v":"G.14"},{"$f":"'G. Communications and Ops Mgmt'!C168","v":"Are Windows systems used to transmit, process or store Scoped Data? If yes, are there:"},{"$f":"'G. Communications and Ops Mgmt'!D168","v":0},{"$f":"'G. Communications and Ops Mgmt'!E168","v":0},{"$f":"'G. Communications and Ops Mgmt'!F168","v":0},{"$f":"'G. Communications and Ops Mgmt'!G168","v":0},{"$f":"'G. Communications and Ops Mgmt'!H168","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I168","v":""},null,"DS5.3","Identity management",10.3,"IS.2.A.5.1","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A169","v":1383},{"$f":"'G. Communications and Ops Mgmt'!J169","v":2},{"$f":"'G. Communications and Ops Mgmt'!K169","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y169","v":0},{"$f":"'G. Communications and Ops Mgmt'!B169","v":"G.14.1"},{"$f":"'G. Communications and Ops Mgmt'!C169","v":"Windows hardening standards?"},{"$f":"'G. Communications and Ops Mgmt'!D169","v":0},{"$f":"'G. Communications and Ops Mgmt'!E169","v":0},{"$f":"'G. Communications and Ops Mgmt'!F169","v":0},{"$f":"'G. Communications and Ops Mgmt'!G169","v":"I.3 Secure System Hardening Standards"},{"$f":"'G. Communications and Ops Mgmt'!H169","v":"13.1.1.e"},{"$f":"'G. Communications and Ops Mgmt'!I169","v":"Network Controls"},null,"DS5.3","Identity management",10.7,"IS.2.A.5 IS.2.A.5.2 AUDIT.2.D.1.5 E-BANK.1.4.5.11 RPS.2.C.3","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A170","v":4116},{"$f":"'G. Communications and Ops Mgmt'!J170","v":3},{"$f":"'G. Communications and Ops Mgmt'!K170","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y170","v":0},{"$f":"'G. Communications and Ops Mgmt'!B170","v":"G.14.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C170","v":"Are the standards reviewed and/or updated at least monthly to ensure any security vulnerabilities are addressed?"},{"$f":"'G. Communications and Ops Mgmt'!D170","v":0},{"$f":"'G. Communications and Ops Mgmt'!E170","v":0},{"$f":"'G. Communications and Ops Mgmt'!F170","v":0},{"$f":"'G. Communications and Ops Mgmt'!G170","v":0},{"$f":"'G. Communications and Ops Mgmt'!H170","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I170","v":0}]
[{"$f":"'G. Communications and Ops Mgmt'!A171","v":1441},{"$f":"'G. Communications and Ops Mgmt'!J171","v":3},{"$f":"'G. Communications and Ops Mgmt'!K171","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y171","v":0},{"$f":"'G. Communications and Ops Mgmt'!B171","v":"G.14.1.2"},{"$f":"'G. Communications and Ops Mgmt'!C171","v":"Standard builds/security compliance checks?"},{"$f":"'G. Communications and Ops Mgmt'!D171","v":0},{"$f":"'G. Communications and Ops Mgmt'!E171","v":0},{"$f":"'G. Communications and Ops Mgmt'!F171","v":0},{"$f":"'G. Communications and Ops Mgmt'!G171","v":0},{"$f":"'G. Communications and Ops Mgmt'!H171","v":"18.2.3"},{"$f":"'G. Communications and Ops Mgmt'!I171","v":"Technical Compliance Review"},null,"DS5.3","Identity management","10.5.5","RPS.2.C.3","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A172","v":1439},{"$f":"'G. Communications and Ops Mgmt'!J172","v":2},{"$f":"'G. Communications and Ops Mgmt'!K172","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y172","v":0},{"$f":"'G. Communications and Ops Mgmt'!B172","v":"G.14.2"},{"$f":"'G. Communications and Ops Mgmt'!C172","v":"Current patches?"},{"$f":"'G. Communications and Ops Mgmt'!D172","v":0},{"$f":"'G. Communications and Ops Mgmt'!E172","v":0},{"$f":"'G. Communications and Ops Mgmt'!F172","v":0},{"$f":"'G. Communications and Ops Mgmt'!G172","v":"I.4 System Patching"},{"$f":"'G. Communications and Ops Mgmt'!H172","v":"12.6.1.d"},{"$f":"'G. Communications and Ops Mgmt'!I172","v":"Control of Technical Vulnerabilities"},null,null,null,"10.5.4","E-BANK.1.4.6.1","DS5.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A173","v":1395},{"$f":"'G. Communications and Ops Mgmt'!J173","v":2},{"$f":"'G. Communications and Ops Mgmt'!K173","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y173","v":0},{"$f":"'G. Communications and Ops Mgmt'!B173","v":"G.14.3"},{"$f":"'G. Communications and Ops Mgmt'!C173","v":"Unnecessary/unused services turned off?"},{"$f":"'G. Communications and Ops Mgmt'!D173","v":0},{"$f":"'G. Communications and Ops Mgmt'!E173","v":0},{"$f":"'G. Communications and Ops Mgmt'!F173","v":0},{"$f":"'G. Communications and Ops Mgmt'!G173","v":0},{"$f":"'G. Communications and Ops Mgmt'!H173","v":"9.4.4.h"},{"$f":"'G. Communications and Ops Mgmt'!I173","v":"Use of Privileged Utility Programs"},null,null,null,"10.5.2","E-BANK.1.4.5.3","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A174","v":1451},{"$f":"'G. Communications and Ops Mgmt'!J174","v":2},{"$f":"'G. Communications and Ops Mgmt'!K174","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y174","v":0},{"$f":"'G. Communications and Ops Mgmt'!B174","v":"G.14.4"},{"$f":"'G. Communications and Ops Mgmt'!C174","v":"Regular log reviews using a specific methodology to uncover potential incidents?"},{"$f":"'G. Communications and Ops Mgmt'!D174","v":0},{"$f":"'G. Communications and Ops Mgmt'!E174","v":0},{"$f":"'G. Communications and Ops Mgmt'!F174","v":0},{"$f":"'G. Communications and Ops Mgmt'!G174","v":0},{"$f":"'G. Communications and Ops Mgmt'!H174","v":"9.4.4.f"},{"$f":"'G. Communications and Ops Mgmt'!I174","v":"Use of Privileged Utility Programs"},null,null,null,"8.2.3","N/A","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A175","v":1453},{"$f":"'G. Communications and Ops Mgmt'!J175","v":2},{"$f":"'G. Communications and Ops Mgmt'!K175","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y175","v":0},{"$f":"'G. Communications and Ops Mgmt'!B175","v":"G.14.5"},{"$f":"'G. Communications and Ops Mgmt'!C175","v":"Sufficient information in the logs to evaluate incidents?"},{"$f":"'G. Communications and Ops Mgmt'!D175","v":0},{"$f":"'G. Communications and Ops Mgmt'!E175","v":0},{"$f":"'G. Communications and Ops Mgmt'!F175","v":0},{"$f":"'G. Communications and Ops Mgmt'!G175","v":"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!H175","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!I175","v":"EventLlogging"},null,"DS5.5","Security testing, surveillance and monitoring","8.2.3","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A176","v":1444},{"$f":"'G. Communications and Ops Mgmt'!J176","v":2},{"$f":"'G. Communications and Ops Mgmt'!K176","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y176","v":0},{"$f":"'G. Communications and Ops Mgmt'!B176","v":"G.14.6"},{"$f":"'G. Communications and Ops Mgmt'!C176","v":"Logs retained for a minimum of one year?"},{"$f":"'G. Communications and Ops Mgmt'!D176","v":0},{"$f":"'G. Communications and Ops Mgmt'!E176","v":0},{"$f":"'G. Communications and Ops Mgmt'!F176","v":0},{"$f":"'G. Communications and Ops Mgmt'!G176","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!H176","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!I176","v":"Protection of Log Information"},null,"PO4.8","Responsibility for risk, security and compliance","8.2.4","N/A","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A177","v":1464},{"$f":"'G. Communications and Ops Mgmt'!J177","v":2},{"$f":"'G. Communications and Ops Mgmt'!K177","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y177","v":0},{"$f":"'G. Communications and Ops Mgmt'!B177","v":"G.14.7"},{"$f":"'G. Communications and Ops Mgmt'!C177","v":"System generated alerts in the event of an audit log failure?"},{"$f":"'G. Communications and Ops Mgmt'!D177","v":0},{"$f":"'G. Communications and Ops Mgmt'!E177","v":0},{"$f":"'G. Communications and Ops Mgmt'!F177","v":0},{"$f":"'G. Communications and Ops Mgmt'!G177","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!H177","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!I177","v":"Protection of Log Information"},null,"AI4.4","Knowledge transfer to operations and support staff","8.2.5","IS.2.C.4","DS5.5, DS5.7, ME2.5"]
[{"$f":"'G. Communications and Ops Mgmt'!A178","v":1468},{"$f":"'G. Communications and Ops Mgmt'!J178","v":2},{"$f":"'G. Communications and Ops Mgmt'!K178","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y178","v":0},{"$f":"'G. Communications and Ops Mgmt'!B178","v":"G.14.8"},{"$f":"'G. Communications and Ops Mgmt'!C178","v":"Audit logs stored on alternate systems?"},{"$f":"'G. Communications and Ops Mgmt'!D178","v":0},{"$f":"'G. Communications and Ops Mgmt'!E178","v":0},{"$f":"'G. Communications and Ops Mgmt'!F178","v":0},{"$f":"'G. Communications and Ops Mgmt'!G178","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!H178","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!I178","v":"Protection of Log Information"},null,"PO2.1","Enterprise information architecture model","8.2.6","N/A","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A179","v":1469},{"$f":"'G. Communications and Ops Mgmt'!J179","v":2},{"$f":"'G. Communications and Ops Mgmt'!K179","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y179","v":0},{"$f":"'G. Communications and Ops Mgmt'!B179","v":"G.14.9"},{"$f":"'G. Communications and Ops Mgmt'!C179","v":"Audit logs protected against modification, deletion, and/or inappropriate access?"},{"$f":"'G. Communications and Ops Mgmt'!D179","v":0},{"$f":"'G. Communications and Ops Mgmt'!E179","v":0},{"$f":"'G. Communications and Ops Mgmt'!F179","v":0},{"$f":"'G. Communications and Ops Mgmt'!G179","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!H179","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!I179","v":"Protection of Log Information"},null,"DS5.4","User account management",8.3000000000000007,"N/A","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A180","v":1396},{"$f":"'G. Communications and Ops Mgmt'!J180","v":2},{"$f":"'G. Communications and Ops Mgmt'!K180","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y180","v":0},{"$f":"'G. Communications and Ops Mgmt'!B180","v":"G.14.10"},{"$f":"'G. Communications and Ops Mgmt'!C180","v":"Minimum password length at least eight characters?"},{"$f":"'G. Communications and Ops Mgmt'!D180","v":0},{"$f":"'G. Communications and Ops Mgmt'!E180","v":0},{"$f":"'G. Communications and Ops Mgmt'!F180","v":0},{"$f":"'G. Communications and Ops Mgmt'!G180","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H180","v":"9.3.1.d"},{"$f":"'G. Communications and Ops Mgmt'!I180","v":"Use of Secret Authentication Information"},null,"DS5.4","User account management","8.2.1","N/A","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A181","v":1402},{"$f":"'G. Communications and Ops Mgmt'!J181","v":2},{"$f":"'G. Communications and Ops Mgmt'!K181","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y181","v":0},{"$f":"'G. Communications and Ops Mgmt'!B181","v":"G.14.11"},{"$f":"'G. Communications and Ops Mgmt'!C181","v":"Complex passwords required?"},{"$f":"'G. Communications and Ops Mgmt'!D181","v":0},{"$f":"'G. Communications and Ops Mgmt'!E181","v":0},{"$f":"'G. Communications and Ops Mgmt'!F181","v":0},{"$f":"'G. Communications and Ops Mgmt'!G181","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H181","v":"9.3.1.d\n\n9.4.3.c"},{"$f":"'G. Communications and Ops Mgmt'!I181","v":"Use of Secret Authentication Information\nPassword Management System"},null,"AI2.3","Application control and auditability",3.3,"IS.1.4.1.3.5 OPS.2.12.B AUDIT.2.D.1.7 E-BANK.1.4.3.5","DS 5.5, ME1.2, ME2.2, ME2.5, ME4.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A182","v":1407},{"$f":"'G. Communications and Ops Mgmt'!J182","v":2},{"$f":"'G. Communications and Ops Mgmt'!K182","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y182","v":0},{"$f":"'G. Communications and Ops Mgmt'!B182","v":"G.14.12"},{"$f":"'G. Communications and Ops Mgmt'!C182","v":"Minimum password expiration at least every 90 days?"},{"$f":"'G. Communications and Ops Mgmt'!D182","v":0},{"$f":"'G. Communications and Ops Mgmt'!E182","v":0},{"$f":"'G. Communications and Ops Mgmt'!F182","v":0},{"$f":"'G. Communications and Ops Mgmt'!G182","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H182","v":"9.4.3.e"},{"$f":"'G. Communications and Ops Mgmt'!I182","v":"Password Management System"},null,"AI2.3","Application control and auditability",3.3,"IS.2.A.7 IS.2.C.9 IS.2.M.9.2","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A183","v":1412},{"$f":"'G. Communications and Ops Mgmt'!J183","v":2},{"$f":"'G. Communications and Ops Mgmt'!K183","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y183","v":0},{"$f":"'G. Communications and Ops Mgmt'!B183","v":"G.14.13"},{"$f":"'G. Communications and Ops Mgmt'!C183","v":"Password history of 12 before reuse?"},{"$f":"'G. Communications and Ops Mgmt'!D183","v":0},{"$f":"'G. Communications and Ops Mgmt'!E183","v":0},{"$f":"'G. Communications and Ops Mgmt'!F183","v":0},{"$f":"'G. Communications and Ops Mgmt'!G183","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H183","v":"9.4.3.f"},{"$f":"'G. Communications and Ops Mgmt'!I183","v":"Password Management System"},null,null,null,"8.1.1","IS.2.C.9 OPS.2.12.B","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A184","v":2637},{"$f":"'G. Communications and Ops Mgmt'!J184","v":2},{"$f":"'G. Communications and Ops Mgmt'!K184","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y184","v":0},{"$f":"'G. Communications and Ops Mgmt'!B184","v":"G.14.14"},{"$f":"'G. Communications and Ops Mgmt'!C184","v":"Initial password required to be changed at first logon?"},{"$f":"'G. Communications and Ops Mgmt'!D184","v":0},{"$f":"'G. Communications and Ops Mgmt'!E184","v":0},{"$f":"'G. Communications and Ops Mgmt'!F184","v":0},{"$f":"'G. Communications and Ops Mgmt'!G184","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H184","v":"9.4.3.d"},{"$f":"'G. Communications and Ops Mgmt'!I184","v":"Password Management System"},null,null,null,"8.1.6","N/A","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A185","v":1431},{"$f":"'G. Communications and Ops Mgmt'!J185","v":2},{"$f":"'G. Communications and Ops Mgmt'!K185","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y185","v":0},{"$f":"'G. Communications and Ops Mgmt'!B185","v":"G.14.15"},{"$f":"'G. Communications and Ops Mgmt'!C185","v":"Can a PIN or secret question be a stand-alone method of authentication?"},{"$f":"'G. Communications and Ops Mgmt'!D185","v":0},{"$f":"'G. Communications and Ops Mgmt'!E185","v":0},{"$f":"'G. Communications and Ops Mgmt'!F185","v":0},{"$f":"'G. Communications and Ops Mgmt'!G185","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H185","v":"9.4.2"},{"$f":"'G. Communications and Ops Mgmt'!I185","v":"Secure Log-On Procedures"},null,null,null,"N/A","IS.2.M.6","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A186","v":1432},{"$f":"'G. Communications and Ops Mgmt'!J186","v":2},{"$f":"'G. Communications and Ops Mgmt'!K186","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y186","v":0},{"$f":"'G. Communications and Ops Mgmt'!B186","v":"G.14.16"},{"$f":"'G. Communications and Ops Mgmt'!C186","v":"Passwords encrypted in transit?"},{"$f":"'G. Communications and Ops Mgmt'!D186","v":0},{"$f":"'G. Communications and Ops Mgmt'!E186","v":0},{"$f":"'G. Communications and Ops Mgmt'!F186","v":0},{"$f":"'G. Communications and Ops Mgmt'!G186","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H186","v":"9.4.3.i"},{"$f":"'G. Communications and Ops Mgmt'!I186","v":"Password Management System"},null,null,null,12.1,"N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A187","v":1433},{"$f":"'G. Communications and Ops Mgmt'!J187","v":2},{"$f":"'G. Communications and Ops Mgmt'!K187","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y187","v":0},{"$f":"'G. Communications and Ops Mgmt'!B187","v":"G.14.17"},{"$f":"'G. Communications and Ops Mgmt'!C187","v":"Passwords encrypted or hashed in storage?"},{"$f":"'G. Communications and Ops Mgmt'!D187","v":0},{"$f":"'G. Communications and Ops Mgmt'!E187","v":0},{"$f":"'G. Communications and Ops Mgmt'!F187","v":0},{"$f":"'G. Communications and Ops Mgmt'!G187","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H187","v":"9.4.3.i"},{"$f":"'G. Communications and Ops Mgmt'!I187","v":"Password Management System"},null,null,null,"12.1.1","IS.2.A.4.4","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A188","v":1434},{"$f":"'G. Communications and Ops Mgmt'!J188","v":2},{"$f":"'G. Communications and Ops Mgmt'!K188","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y188","v":0},{"$f":"'G. Communications and Ops Mgmt'!B188","v":"G.14.18"},{"$f":"'G. Communications and Ops Mgmt'!C188","v":"Passwords displayed when entered into a system?"},{"$f":"'G. Communications and Ops Mgmt'!D188","v":0},{"$f":"'G. Communications and Ops Mgmt'!E188","v":0},{"$f":"'G. Communications and Ops Mgmt'!F188","v":0},{"$f":"'G. Communications and Ops Mgmt'!G188","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H188","v":"9.4.3.g"},{"$f":"'G. Communications and Ops Mgmt'!I188","v":"Password Management System"},null,null,null,4.0999999999999996,"IS.2.A.4.3 AUDIT.2.D.1.5 E-BANK.1.4.5.4 RPS.2.C.3","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A189","v":2638},{"$f":"'G. Communications and Ops Mgmt'!J189","v":2},{"$f":"'G. Communications and Ops Mgmt'!K189","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y189","v":0},{"$f":"'G. Communications and Ops Mgmt'!B189","v":"G.14.19"},{"$f":"'G. Communications and Ops Mgmt'!C189","v":"User accounts associated to a unique individual?"},{"$f":"'G. Communications and Ops Mgmt'!D189","v":0},{"$f":"'G. Communications and Ops Mgmt'!E189","v":0},{"$f":"'G. Communications and Ops Mgmt'!F189","v":0},{"$f":"'G. Communications and Ops Mgmt'!G189","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H189","v":"9.4.3.a"},{"$f":"'G. Communications and Ops Mgmt'!I189","v":"Password Management System"},null,null,null,8.1999999999999993,"N/A","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A190","v":1416},{"$f":"'G. Communications and Ops Mgmt'!J190","v":2},{"$f":"'G. Communications and Ops Mgmt'!K190","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y190","v":0},{"$f":"'G. Communications and Ops Mgmt'!B190","v":"G.14.20"},{"$f":"'G. Communications and Ops Mgmt'!C190","v":"Does the system lock an account when three to five invalid login attempts are made?"},{"$f":"'G. Communications and Ops Mgmt'!D190","v":0},{"$f":"'G. Communications and Ops Mgmt'!E190","v":0},{"$f":"'G. Communications and Ops Mgmt'!F190","v":0},{"$f":"'G. Communications and Ops Mgmt'!G190","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H190","v":"9.4.2"},{"$f":"'G. Communications and Ops Mgmt'!I190","v":"Secure Log-On Procedures"},null,"DS5.3","Identity management",2.2000000000000002,"N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A191","v":1478},{"$f":"'G. Communications and Ops Mgmt'!J191","v":1},{"$f":"'G. Communications and Ops Mgmt'!K191","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y191","v":0},{"$f":"'G. Communications and Ops Mgmt'!B191","v":"G.15"},{"$f":"'G. Communications and Ops Mgmt'!C191","v":"Is a mainframe used to transmit, process or store Scoped Systems and Data? If yes, are:"},{"$f":"'G. Communications and Ops Mgmt'!D191","v":0},{"$f":"'G. Communications and Ops Mgmt'!E191","v":0},{"$f":"'G. Communications and Ops Mgmt'!F191","v":0},{"$f":"'G. Communications and Ops Mgmt'!G191","v":0},{"$f":"'G. Communications and Ops Mgmt'!H191","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I191","v":""},null,"DS5.3","Identity management","N/A","N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A192","v":1503},{"$f":"'G. Communications and Ops Mgmt'!J192","v":2},{"$f":"'G. Communications and Ops Mgmt'!K192","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y192","v":0},{"$f":"'G. Communications and Ops Mgmt'!B192","v":"G.15.1"},{"$f":"'G. Communications and Ops Mgmt'!C192","v":"Mainframe security controls documented?"},{"$f":"'G. Communications and Ops Mgmt'!D192","v":0},{"$f":"'G. Communications and Ops Mgmt'!E192","v":0},{"$f":"'G. Communications and Ops Mgmt'!F192","v":0},{"$f":"'G. Communications and Ops Mgmt'!G192","v":0},{"$f":"'G. Communications and Ops Mgmt'!H192","v":"13.1.1.a"},{"$f":"'G. Communications and Ops Mgmt'!I192","v":"Network Controls"},null,"DS5.3","Identity management","N/A","IS.2.A.5.1","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A193","v":1504},{"$f":"'G. Communications and Ops Mgmt'!J193","v":3},{"$f":"'G. Communications and Ops Mgmt'!K193","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y193","v":0},{"$f":"'G. Communications and Ops Mgmt'!B193","v":"G.15.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C193","v":"Reviews performed to validate compliance with documented standards?"},{"$f":"'G. Communications and Ops Mgmt'!D193","v":0},{"$f":"'G. Communications and Ops Mgmt'!E193","v":0},{"$f":"'G. Communications and Ops Mgmt'!F193","v":0},{"$f":"'G. Communications and Ops Mgmt'!G193","v":0},{"$f":"'G. Communications and Ops Mgmt'!H193","v":"18.2.3"},{"$f":"'G. Communications and Ops Mgmt'!I193","v":"Technical Compliance Review"},null,"DS5.3","Identity management",10.6,"IS.2.A.5 IS.2.A.5.2 AUDIT.2.D.1.5 E-BANK.1.4.5.11 RPS.2.C.3","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A194","v":1489},{"$f":"'G. Communications and Ops Mgmt'!J194","v":2},{"$f":"'G. Communications and Ops Mgmt'!K194","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y194","v":0},{"$f":"'G. Communications and Ops Mgmt'!B194","v":"G.15.2"},{"$f":"'G. Communications and Ops Mgmt'!C194","v":"Transmission encrypted?"},{"$f":"'G. Communications and Ops Mgmt'!D194","v":0},{"$f":"'G. Communications and Ops Mgmt'!E194","v":0},{"$f":"'G. Communications and Ops Mgmt'!F194","v":0},{"$f":"'G. Communications and Ops Mgmt'!G194","v":0},{"$f":"'G. Communications and Ops Mgmt'!H194","v":"13.2.1.f"},{"$f":"'G. Communications and Ops Mgmt'!I194","v":"Information Transfer Policies and Procedures"},null,"DS5.3","Identity management","10.5.5","RPS.2.C.3","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A195","v":1492},{"$f":"'G. Communications and Ops Mgmt'!J195","v":2},{"$f":"'G. Communications and Ops Mgmt'!K195","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y195","v":0},{"$f":"'G. Communications and Ops Mgmt'!B195","v":"G.15.3"},{"$f":"'G. Communications and Ops Mgmt'!C195","v":"Authentication required for access to any transaction or database system?"},{"$f":"'G. Communications and Ops Mgmt'!D195","v":0},{"$f":"'G. Communications and Ops Mgmt'!E195","v":0},{"$f":"'G. Communications and Ops Mgmt'!F195","v":0},{"$f":"'G. Communications and Ops Mgmt'!G195","v":0},{"$f":"'G. Communications and Ops Mgmt'!H195","v":"9.4.2"},{"$f":"'G. Communications and Ops Mgmt'!I195","v":"Secure Log-On Procedures"},null,null,null,10.7,"E-BANK.1.4.6.1","DS5.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A196","v":1496},{"$f":"'G. Communications and Ops Mgmt'!J196","v":2},{"$f":"'G. Communications and Ops Mgmt'!K196","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y196","v":0},{"$f":"'G. Communications and Ops Mgmt'!B196","v":"G.15.4"},{"$f":"'G. Communications and Ops Mgmt'!C196","v":"Job scheduling systems secured to control the submission of production jobs?"},{"$f":"'G. Communications and Ops Mgmt'!D196","v":0},{"$f":"'G. Communications and Ops Mgmt'!E196","v":0},{"$f":"'G. Communications and Ops Mgmt'!F196","v":0},{"$f":"'G. Communications and Ops Mgmt'!G196","v":0},{"$f":"'G. Communications and Ops Mgmt'!H196","v":"9.4.4"},{"$f":"'G. Communications and Ops Mgmt'!I196","v":"Use of Privileged Utility Programs"},null,null,null,"10.5.2","E-BANK.1.4.5.3","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A197","v":1497},{"$f":"'G. Communications and Ops Mgmt'!J197","v":2},{"$f":"'G. Communications and Ops Mgmt'!K197","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y197","v":0},{"$f":"'G. Communications and Ops Mgmt'!B197","v":"G.15.5"},{"$f":"'G. Communications and Ops Mgmt'!C197","v":"Storage management personnel (tape operators) given privileged access to mainframe systems?"},{"$f":"'G. Communications and Ops Mgmt'!D197","v":0},{"$f":"'G. Communications and Ops Mgmt'!E197","v":0},{"$f":"'G. Communications and Ops Mgmt'!F197","v":0},{"$f":"'G. Communications and Ops Mgmt'!G197","v":0},{"$f":"'G. Communications and Ops Mgmt'!H197","v":"9.4.4"},{"$f":"'G. Communications and Ops Mgmt'!I197","v":"Use of Privileged Utility Programs"},null,"PO4.11","Segregation of duties","8.2.3","N/A","PO6.2, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A198","v":1502},{"$f":"'G. Communications and Ops Mgmt'!J198","v":2},{"$f":"'G. Communications and Ops Mgmt'!K198","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y198","v":0},{"$f":"'G. Communications and Ops Mgmt'!B198","v":"G.15.6"},{"$f":"'G. Communications and Ops Mgmt'!C198","v":"ESM (RACF) and inherent security configuration settings configured to support the access control standards and requirements?"},{"$f":"'G. Communications and Ops Mgmt'!D198","v":0},{"$f":"'G. Communications and Ops Mgmt'!E198","v":0},{"$f":"'G. Communications and Ops Mgmt'!F198","v":0},{"$f":"'G. Communications and Ops Mgmt'!G198","v":0},{"$f":"'G. Communications and Ops Mgmt'!H198","v":"13.1.1.f"},{"$f":"'G. Communications and Ops Mgmt'!I198","v":"Network Controls"},null,"DS5.5","Security testing, surveillance and monitoring","8.2.3","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A199","v":1513},{"$f":"'G. Communications and Ops Mgmt'!J199","v":2},{"$f":"'G. Communications and Ops Mgmt'!K199","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y199","v":0},{"$f":"'G. Communications and Ops Mgmt'!B199","v":"G.15.7"},{"$f":"'G. Communications and Ops Mgmt'!C199","v":"Regular review of logs using a specific methodology to uncover potential incidents?"},{"$f":"'G. Communications and Ops Mgmt'!D199","v":0},{"$f":"'G. Communications and Ops Mgmt'!E199","v":0},{"$f":"'G. Communications and Ops Mgmt'!F199","v":0},{"$f":"'G. Communications and Ops Mgmt'!G199","v":0},{"$f":"'G. Communications and Ops Mgmt'!H199","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!I199","v":"Event Logging"},null,"DS5.5","Security testing, surveillance and monitoring","8.2.4","N/A","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A200","v":1515},{"$f":"'G. Communications and Ops Mgmt'!J200","v":2},{"$f":"'G. Communications and Ops Mgmt'!K200","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y200","v":0},{"$f":"'G. Communications and Ops Mgmt'!B200","v":"G.15.8"},{"$f":"'G. Communications and Ops Mgmt'!C200","v":"System generated alerts in the event of an audit log failure?"},{"$f":"'G. Communications and Ops Mgmt'!D200","v":0},{"$f":"'G. Communications and Ops Mgmt'!E200","v":0},{"$f":"'G. Communications and Ops Mgmt'!F200","v":0},{"$f":"'G. Communications and Ops Mgmt'!G200","v":"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!H200","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!I200","v":"Protection of Log Information"},null,"AI2.3","Application control and auditability","8.2.5","IS.1.4.1.3.5 OPS.2.12.B AUDIT.2.D.1.7 E-BANK.1.4.3.5","DS 5.5, ME1.2, ME2.2, ME2.5, ME4.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A201","v":1506},{"$f":"'G. Communications and Ops Mgmt'!J201","v":2},{"$f":"'G. Communications and Ops Mgmt'!K201","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y201","v":0},{"$f":"'G. Communications and Ops Mgmt'!B201","v":"G.15.9"},{"$f":"'G. Communications and Ops Mgmt'!C201","v":"Logs retained for a minimum of one year?"},{"$f":"'G. Communications and Ops Mgmt'!D201","v":0},{"$f":"'G. Communications and Ops Mgmt'!E201","v":0},{"$f":"'G. Communications and Ops Mgmt'!F201","v":0},{"$f":"'G. Communications and Ops Mgmt'!G201","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!H201","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I201","v":0},null,"AI2.3","Application control and auditability","8.2.5","IS.2.A.7 IS.2.C.9 IS.2.M.9.2","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A202","v":1531},{"$f":"'G. Communications and Ops Mgmt'!J202","v":2},{"$f":"'G. Communications and Ops Mgmt'!K202","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y202","v":0},{"$f":"'G. Communications and Ops Mgmt'!B202","v":"G.15.10"},{"$f":"'G. Communications and Ops Mgmt'!C202","v":"Audit logs adequately protected against modification, deletion, and/or inappropriate access?"},{"$f":"'G. Communications and Ops Mgmt'!D202","v":0},{"$f":"'G. Communications and Ops Mgmt'!E202","v":0},{"$f":"'G. Communications and Ops Mgmt'!F202","v":0},{"$f":"'G. Communications and Ops Mgmt'!G202","v":"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!H202","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!I202","v":"Protection of Log Information"},null,null,null,"8.2.6","IS.2.C.9 OPS.2.12.B","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A203","v":1539},{"$f":"'G. Communications and Ops Mgmt'!J203","v":2},{"$f":"'G. Communications and Ops Mgmt'!K203","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y203","v":0},{"$f":"'G. Communications and Ops Mgmt'!B203","v":"G.15.11"},{"$f":"'G. Communications and Ops Mgmt'!C203","v":"Minimum password length at least eight characters?"},{"$f":"'G. Communications and Ops Mgmt'!D203","v":0},{"$f":"'G. Communications and Ops Mgmt'!E203","v":0},{"$f":"'G. Communications and Ops Mgmt'!F203","v":0},{"$f":"'G. Communications and Ops Mgmt'!G203","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H203","v":"9.3.1.d"},{"$f":"'G. Communications and Ops Mgmt'!I203","v":"Use of Secret Authentication Information"},null,null,null,8.3000000000000007,"N/A","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A204","v":1545},{"$f":"'G. Communications and Ops Mgmt'!J204","v":2},{"$f":"'G. Communications and Ops Mgmt'!K204","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y204","v":0},{"$f":"'G. Communications and Ops Mgmt'!B204","v":"G.15.12"},{"$f":"'G. Communications and Ops Mgmt'!C204","v":"Complex passwords required?"},{"$f":"'G. Communications and Ops Mgmt'!D204","v":0},{"$f":"'G. Communications and Ops Mgmt'!E204","v":0},{"$f":"'G. Communications and Ops Mgmt'!F204","v":0},{"$f":"'G. Communications and Ops Mgmt'!G204","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H204","v":"9.3.1.d                                     9.4.3.c"},{"$f":"'G. Communications and Ops Mgmt'!I204","v":"Use of Secret Authentication Information\nPassword Management System"},null,null,null,"8.2.1","IS.2.M.6","DS5.5, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A205","v":1550},{"$f":"'G. Communications and Ops Mgmt'!J205","v":2},{"$f":"'G. Communications and Ops Mgmt'!K205","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y205","v":0},{"$f":"'G. Communications and Ops Mgmt'!B205","v":"G.15.13"},{"$f":"'G. Communications and Ops Mgmt'!C205","v":"Minimum password expiration at least 90 days?"},{"$f":"'G. Communications and Ops Mgmt'!D205","v":0},{"$f":"'G. Communications and Ops Mgmt'!E205","v":0},{"$f":"'G. Communications and Ops Mgmt'!F205","v":0},{"$f":"'G. Communications and Ops Mgmt'!G205","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H205","v":"9.4.3.e"},{"$f":"'G. Communications and Ops Mgmt'!I205","v":"Password Management System"},null,null,null,3.3,"N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A206","v":1555},{"$f":"'G. Communications and Ops Mgmt'!J206","v":2},{"$f":"'G. Communications and Ops Mgmt'!K206","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y206","v":0},{"$f":"'G. Communications and Ops Mgmt'!B206","v":"G.15.14"},{"$f":"'G. Communications and Ops Mgmt'!C206","v":"Password history of 12 before reuse?"},{"$f":"'G. Communications and Ops Mgmt'!D206","v":0},{"$f":"'G. Communications and Ops Mgmt'!E206","v":0},{"$f":"'G. Communications and Ops Mgmt'!F206","v":0},{"$f":"'G. Communications and Ops Mgmt'!G206","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H206","v":"9.4.3.f"},{"$f":"'G. Communications and Ops Mgmt'!I206","v":"Password Management System"},null,null,null,3.3,"IS.2.A.4.4","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A207","v":1570},{"$f":"'G. Communications and Ops Mgmt'!J207","v":2},{"$f":"'G. Communications and Ops Mgmt'!K207","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y207","v":0},{"$f":"'G. Communications and Ops Mgmt'!B207","v":"G.15.15"},{"$f":"'G. Communications and Ops Mgmt'!C207","v":"Password minimum age?"},{"$f":"'G. Communications and Ops Mgmt'!D207","v":0},{"$f":"'G. Communications and Ops Mgmt'!E207","v":0},{"$f":"'G. Communications and Ops Mgmt'!F207","v":0},{"$f":"'G. Communications and Ops Mgmt'!G207","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H207","v":"9.4.3.e"},{"$f":"'G. Communications and Ops Mgmt'!I207","v":"Password Management System"},null,null,null,"8.1.1","IS.2.A.4.3 AUDIT.2.D.1.5 E-BANK.1.4.5.4 RPS.2.C.3","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A208","v":2639},{"$f":"'G. Communications and Ops Mgmt'!J208","v":2},{"$f":"'G. Communications and Ops Mgmt'!K208","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y208","v":0},{"$f":"'G. Communications and Ops Mgmt'!B208","v":"G.15.16"},{"$f":"'G. Communications and Ops Mgmt'!C208","v":"Initial password required to be changed at first logon?"},{"$f":"'G. Communications and Ops Mgmt'!D208","v":0},{"$f":"'G. Communications and Ops Mgmt'!E208","v":0},{"$f":"'G. Communications and Ops Mgmt'!F208","v":0},{"$f":"'G. Communications and Ops Mgmt'!G208","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H208","v":"9.4.3.d"},{"$f":"'G. Communications and Ops Mgmt'!I208","v":"Password Management System"},null,null,null,"8.1.6","N/A","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A209","v":1574},{"$f":"'G. Communications and Ops Mgmt'!J209","v":2},{"$f":"'G. Communications and Ops Mgmt'!K209","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y209","v":0},{"$f":"'G. Communications and Ops Mgmt'!B209","v":"G.15.17"},{"$f":"'G. Communications and Ops Mgmt'!C209","v":"Can a PIN or secret question be a stand alone method of authentication?"},{"$f":"'G. Communications and Ops Mgmt'!D209","v":0},{"$f":"'G. Communications and Ops Mgmt'!E209","v":0},{"$f":"'G. Communications and Ops Mgmt'!F209","v":0},{"$f":"'G. Communications and Ops Mgmt'!G209","v":0},{"$f":"'G. Communications and Ops Mgmt'!H209","v":"9.4.2 "},{"$f":"'G. Communications and Ops Mgmt'!I209","v":"Secure Log-On Procedures"},null,"DS5.3","Identity management","8.2.2","N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A210","v":1575},{"$f":"'G. Communications and Ops Mgmt'!J210","v":2},{"$f":"'G. Communications and Ops Mgmt'!K210","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y210","v":0},{"$f":"'G. Communications and Ops Mgmt'!B210","v":"G.15.18"},{"$f":"'G. Communications and Ops Mgmt'!C210","v":"Passwords encrypted in transit?"},{"$f":"'G. Communications and Ops Mgmt'!D210","v":0},{"$f":"'G. Communications and Ops Mgmt'!E210","v":0},{"$f":"'G. Communications and Ops Mgmt'!F210","v":0},{"$f":"'G. Communications and Ops Mgmt'!G210","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H210","v":"9.4.3.i"},{"$f":"'G. Communications and Ops Mgmt'!I210","v":"Password Management System"},null,"DS5.3","Identity management","N/A","N/A","PO6.2, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A211","v":1576},{"$f":"'G. Communications and Ops Mgmt'!J211","v":2},{"$f":"'G. Communications and Ops Mgmt'!K211","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y211","v":0},{"$f":"'G. Communications and Ops Mgmt'!B211","v":"G.15.19"},{"$f":"'G. Communications and Ops Mgmt'!C211","v":"Passwords encrypted or hashed in storage?"},{"$f":"'G. Communications and Ops Mgmt'!D211","v":0},{"$f":"'G. Communications and Ops Mgmt'!E211","v":0},{"$f":"'G. Communications and Ops Mgmt'!F211","v":0},{"$f":"'G. Communications and Ops Mgmt'!G211","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H211","v":"9.4.3.i"},{"$f":"'G. Communications and Ops Mgmt'!I211","v":"Password Management System"},null,"DS5.3","Identity management",12.1,"IS.2.A.5.1","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A212","v":1577},{"$f":"'G. Communications and Ops Mgmt'!J212","v":2},{"$f":"'G. Communications and Ops Mgmt'!K212","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y212","v":0},{"$f":"'G. Communications and Ops Mgmt'!B212","v":"G.15.20"},{"$f":"'G. Communications and Ops Mgmt'!C212","v":"Passwords displayed when entered into a system?"},{"$f":"'G. Communications and Ops Mgmt'!D212","v":0},{"$f":"'G. Communications and Ops Mgmt'!E212","v":0},{"$f":"'G. Communications and Ops Mgmt'!F212","v":0},{"$f":"'G. Communications and Ops Mgmt'!G212","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H212","v":"9.4.3.g"},{"$f":"'G. Communications and Ops Mgmt'!I212","v":"Password Management System"},null,"DS5.3","Identity management","12.1.1","IS.2.A.5 IS.2.A.5.2 AUDIT.2.D.1.5 E-BANK.1.4.5.11 RPS.2.C.3","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A213","v":2640},{"$f":"'G. Communications and Ops Mgmt'!J213","v":2},{"$f":"'G. Communications and Ops Mgmt'!K213","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y213","v":0},{"$f":"'G. Communications and Ops Mgmt'!B213","v":"G.15.21"},{"$f":"'G. Communications and Ops Mgmt'!C213","v":"User accounts associated to a unique individual?"},{"$f":"'G. Communications and Ops Mgmt'!D213","v":0},{"$f":"'G. Communications and Ops Mgmt'!E213","v":0},{"$f":"'G. Communications and Ops Mgmt'!F213","v":0},{"$f":"'G. Communications and Ops Mgmt'!G213","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H213","v":"9.4.3.a"},{"$f":"'G. Communications and Ops Mgmt'!I213","v":"Password Management System"},null,"DS5.3","Identity management","7.1.1","RPS.2.C.3","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A214","v":1559},{"$f":"'G. Communications and Ops Mgmt'!J214","v":2},{"$f":"'G. Communications and Ops Mgmt'!K214","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y214","v":0},{"$f":"'G. Communications and Ops Mgmt'!B214","v":"G.15.22"},{"$f":"'G. Communications and Ops Mgmt'!C214","v":"Does the system lock an account when three to five invalid login attempts are made?"},{"$f":"'G. Communications and Ops Mgmt'!D214","v":0},{"$f":"'G. Communications and Ops Mgmt'!E214","v":0},{"$f":"'G. Communications and Ops Mgmt'!F214","v":0},{"$f":"'G. Communications and Ops Mgmt'!G214","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H214","v":"9.4.2"},{"$f":"'G. Communications and Ops Mgmt'!I214","v":"Secure Log-On Procedures"},null,null,null,7.1,"IS.1.4.1.2.2 E-BANK.1.4.6.1","DS5.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A215","v":1564},{"$f":"'G. Communications and Ops Mgmt'!J215","v":2},{"$f":"'G. Communications and Ops Mgmt'!K215","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y215","v":0},{"$f":"'G. Communications and Ops Mgmt'!B215","v":"G.15.23"},{"$f":"'G. Communications and Ops Mgmt'!C215","v":"Administrator intervention required to unlock an account?"},{"$f":"'G. Communications and Ops Mgmt'!D215","v":0},{"$f":"'G. Communications and Ops Mgmt'!E215","v":0},{"$f":"'G. Communications and Ops Mgmt'!F215","v":0},{"$f":"'G. Communications and Ops Mgmt'!G215","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H215","v":"9.4.2"},{"$f":"'G. Communications and Ops Mgmt'!I215","v":"Secure Log-On Procedures"},null,null,null,"7.1.2","E-BANK.1.4.5.3","DS5.4, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A216","v":1579},{"$f":"'G. Communications and Ops Mgmt'!J216","v":1},{"$f":"'G. Communications and Ops Mgmt'!K216","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y216","v":0},{"$f":"'G. Communications and Ops Mgmt'!B216","v":"G.16"},{"$f":"'G. Communications and Ops Mgmt'!C216","v":"Is an AS400 used to transmit, process or store Scoped Systems and Data? If yes, are:"},{"$f":"'G. Communications and Ops Mgmt'!D216","v":0},{"$f":"'G. Communications and Ops Mgmt'!E216","v":0},{"$f":"'G. Communications and Ops Mgmt'!F216","v":0},{"$f":"'G. Communications and Ops Mgmt'!G216","v":0},{"$f":"'G. Communications and Ops Mgmt'!H216","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I216","v":""},null,"DS5.11","Exchange of sensitive data",10.6,"N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A217","v":2641},{"$f":"'G. Communications and Ops Mgmt'!J217","v":2},{"$f":"'G. Communications and Ops Mgmt'!K217","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y217","v":0},{"$f":"'G. Communications and Ops Mgmt'!B217","v":"G.16.1"},{"$f":"'G. Communications and Ops Mgmt'!C217","v":"Security controls documented?"},{"$f":"'G. Communications and Ops Mgmt'!D217","v":0},{"$f":"'G. Communications and Ops Mgmt'!E217","v":0},{"$f":"'G. Communications and Ops Mgmt'!F217","v":0},{"$f":"'G. Communications and Ops Mgmt'!G217","v":0},{"$f":"'G. Communications and Ops Mgmt'!H217","v":"13.1.1.a"},{"$f":"'G. Communications and Ops Mgmt'!I217","v":"Network Controls"},null,"DS5.11","Exchange of sensitive data",10.3,"N/A","AC4, AC6, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A218","v":1598},{"$f":"'G. Communications and Ops Mgmt'!J218","v":3},{"$f":"'G. Communications and Ops Mgmt'!K218","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y218","v":0},{"$f":"'G. Communications and Ops Mgmt'!B218","v":"G.16.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C218","v":"Systems periodically monitored to ensure continued compliance with the documented standards?"},{"$f":"'G. Communications and Ops Mgmt'!D218","v":0},{"$f":"'G. Communications and Ops Mgmt'!E218","v":0},{"$f":"'G. Communications and Ops Mgmt'!F218","v":0},{"$f":"'G. Communications and Ops Mgmt'!G218","v":0},{"$f":"'G. Communications and Ops Mgmt'!H218","v":"18.2.3"},{"$f":"'G. Communications and Ops Mgmt'!I218","v":"Technical Compliance Review"},null,"AC9","Data processing integrity",10.7,"N/A","AC4, AC6, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A219","v":1580},{"$f":"'G. Communications and Ops Mgmt'!J219","v":2},{"$f":"'G. Communications and Ops Mgmt'!K219","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y219","v":0},{"$f":"'G. Communications and Ops Mgmt'!B219","v":"G.16.2"},{"$f":"'G. Communications and Ops Mgmt'!C219","v":"Group profile assignments based on constituent role?"},{"$f":"'G. Communications and Ops Mgmt'!D219","v":0},{"$f":"'G. Communications and Ops Mgmt'!E219","v":0},{"$f":"'G. Communications and Ops Mgmt'!F219","v":0},{"$f":"'G. Communications and Ops Mgmt'!G219","v":0},{"$f":"'G. Communications and Ops Mgmt'!H219","v":"9.1.1.k"},{"$f":"'G. Communications and Ops Mgmt'!I219","v":"Access Control Policy"},null,null,null,"10.5.5","N/A","AC4, AC6, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A220","v":1581},{"$f":"'G. Communications and Ops Mgmt'!J220","v":2},{"$f":"'G. Communications and Ops Mgmt'!K220","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y220","v":0},{"$f":"'G. Communications and Ops Mgmt'!B220","v":"G.16.3"},{"$f":"'G. Communications and Ops Mgmt'!C220","v":"Group profile assignments approved?"},{"$f":"'G. Communications and Ops Mgmt'!D220","v":0},{"$f":"'G. Communications and Ops Mgmt'!E220","v":0},{"$f":"'G. Communications and Ops Mgmt'!F220","v":0},{"$f":"'G. Communications and Ops Mgmt'!G220","v":0},{"$f":"'G. Communications and Ops Mgmt'!H220","v":"9.1.1.g"},{"$f":"'G. Communications and Ops Mgmt'!I220","v":"Access Control Policy"},null,"PO2.3","Data classification scheme","10.2.5","N/A","AC3, AC4, AC5, AC6"]
[{"$f":"'G. Communications and Ops Mgmt'!A221","v":1582},{"$f":"'G. Communications and Ops Mgmt'!J221","v":2},{"$f":"'G. Communications and Ops Mgmt'!K221","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y221","v":0},{"$f":"'G. Communications and Ops Mgmt'!B221","v":"G.16.4"},{"$f":"'G. Communications and Ops Mgmt'!C221","v":"User profiles created with the principle of least privilege?"},{"$f":"'G. Communications and Ops Mgmt'!D221","v":0},{"$f":"'G. Communications and Ops Mgmt'!E221","v":0},{"$f":"'G. Communications and Ops Mgmt'!F221","v":0},{"$f":"'G. Communications and Ops Mgmt'!G221","v":0},{"$f":"'G. Communications and Ops Mgmt'!H221","v":"9.1.1.b"},{"$f":"'G. Communications and Ops Mgmt'!I221","v":"Access Control Policy"},null,"DS5.4","User account management","8.2.3","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A222","v":1607},{"$f":"'G. Communications and Ops Mgmt'!J222","v":2},{"$f":"'G. Communications and Ops Mgmt'!K222","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y222","v":0},{"$f":"'G. Communications and Ops Mgmt'!B222","v":"G.16.5"},{"$f":"'G. Communications and Ops Mgmt'!C222","v":"Logs regularly reviewed using a specific methodology to uncover potential incidents?"},{"$f":"'G. Communications and Ops Mgmt'!D222","v":0},{"$f":"'G. Communications and Ops Mgmt'!E222","v":0},{"$f":"'G. Communications and Ops Mgmt'!F222","v":0},{"$f":"'G. Communications and Ops Mgmt'!G222","v":"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!H222","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!I222","v":"Event Logging"},null,"PO2.3","Data classification scheme","8.2.3","N/A","PO2.3, PO3.4, AI5.2, DS2.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A223","v":1609},{"$f":"'G. Communications and Ops Mgmt'!J223","v":2},{"$f":"'G. Communications and Ops Mgmt'!K223","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y223","v":0},{"$f":"'G. Communications and Ops Mgmt'!B223","v":"G.16.6"},{"$f":"'G. Communications and Ops Mgmt'!C223","v":"Sufficient information in the logs to evaluate incidents?"},{"$f":"'G. Communications and Ops Mgmt'!D223","v":0},{"$f":"'G. Communications and Ops Mgmt'!E223","v":0},{"$f":"'G. Communications and Ops Mgmt'!F223","v":0},{"$f":"'G. Communications and Ops Mgmt'!G223","v":"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!H223","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!I223","v":"Event Logging"},null,null,null,"8.2.4","N/A","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A224","v":1600},{"$f":"'G. Communications and Ops Mgmt'!J224","v":2},{"$f":"'G. Communications and Ops Mgmt'!K224","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y224","v":0},{"$f":"'G. Communications and Ops Mgmt'!B224","v":"G.16.7"},{"$f":"'G. Communications and Ops Mgmt'!C224","v":"Logs retained for a minimum of one year?"},{"$f":"'G. Communications and Ops Mgmt'!D224","v":0},{"$f":"'G. Communications and Ops Mgmt'!E224","v":0},{"$f":"'G. Communications and Ops Mgmt'!F224","v":0},{"$f":"'G. Communications and Ops Mgmt'!G224","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!H224","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!I224","v":"Protection of Log Information"},null,"AI6.3","Emergency changes","8.2.5","N/A","PO2.3, PO6.2, DS11.1"]
[{"$f":"'G. Communications and Ops Mgmt'!A225","v":1620},{"$f":"'G. Communications and Ops Mgmt'!J225","v":2},{"$f":"'G. Communications and Ops Mgmt'!K225","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y225","v":0},{"$f":"'G. Communications and Ops Mgmt'!B225","v":"G.16.8"},{"$f":"'G. Communications and Ops Mgmt'!C225","v":"System generated alerts in the event of an audit log failure?"},{"$f":"'G. Communications and Ops Mgmt'!D225","v":0},{"$f":"'G. Communications and Ops Mgmt'!E225","v":0},{"$f":"'G. Communications and Ops Mgmt'!F225","v":0},{"$f":"'G. Communications and Ops Mgmt'!G225","v":"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!H225","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!I225","v":"Event Logging"},null,"AI2.3","Application control and auditability","8.2.6","N/A","AI6.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A226","v":1625},{"$f":"'G. Communications and Ops Mgmt'!J226","v":2},{"$f":"'G. Communications and Ops Mgmt'!K226","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y226","v":0},{"$f":"'G. Communications and Ops Mgmt'!B226","v":"G.16.9"},{"$f":"'G. Communications and Ops Mgmt'!C226","v":"Audit logs protected against modification, deletion, and/or inappropriate access?"},{"$f":"'G. Communications and Ops Mgmt'!D226","v":0},{"$f":"'G. Communications and Ops Mgmt'!E226","v":0},{"$f":"'G. Communications and Ops Mgmt'!F226","v":0},{"$f":"'G. Communications and Ops Mgmt'!G226","v":"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!H226","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!I226","v":"Protection of Log Information"},null,"AI6.3","Emergency changes",8.3000000000000007,"N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A227","v":1633},{"$f":"'G. Communications and Ops Mgmt'!J227","v":2},{"$f":"'G. Communications and Ops Mgmt'!K227","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y227","v":0},{"$f":"'G. Communications and Ops Mgmt'!B227","v":"G.16.10"},{"$f":"'G. Communications and Ops Mgmt'!C227","v":"Minimum password length at least eight characters:"},{"$f":"'G. Communications and Ops Mgmt'!D227","v":0},{"$f":"'G. Communications and Ops Mgmt'!E227","v":0},{"$f":"'G. Communications and Ops Mgmt'!F227","v":0},{"$f":"'G. Communications and Ops Mgmt'!G227","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H227","v":"9.3.1.d"},{"$f":"'G. Communications and Ops Mgmt'!I227","v":"Use of Secret Authentication Information"},null,"DS5.4","User account management","8.2.1","N/A","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A228","v":1639},{"$f":"'G. Communications and Ops Mgmt'!J228","v":2},{"$f":"'G. Communications and Ops Mgmt'!K228","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y228","v":0},{"$f":"'G. Communications and Ops Mgmt'!B228","v":"G.16.11"},{"$f":"'G. Communications and Ops Mgmt'!C228","v":"Complex passwords required?"},{"$f":"'G. Communications and Ops Mgmt'!D228","v":0},{"$f":"'G. Communications and Ops Mgmt'!E228","v":0},{"$f":"'G. Communications and Ops Mgmt'!F228","v":0},{"$f":"'G. Communications and Ops Mgmt'!G228","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H228","v":"9.3.1.d                                     9.4.3.c"},{"$f":"'G. Communications and Ops Mgmt'!I228","v":"Use of Secret Authentication Information\nPassword Management System"},null,null,null,3.3,"N/A","AI6.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A229","v":1644},{"$f":"'G. Communications and Ops Mgmt'!J229","v":2},{"$f":"'G. Communications and Ops Mgmt'!K229","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y229","v":0},{"$f":"'G. Communications and Ops Mgmt'!B229","v":"G.16.12"},{"$f":"'G. Communications and Ops Mgmt'!C229","v":"Minimum password expiration at least 90 days?"},{"$f":"'G. Communications and Ops Mgmt'!D229","v":0},{"$f":"'G. Communications and Ops Mgmt'!E229","v":0},{"$f":"'G. Communications and Ops Mgmt'!F229","v":0},{"$f":"'G. Communications and Ops Mgmt'!G229","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H229","v":"9.4.3.e"},{"$f":"'G. Communications and Ops Mgmt'!I229","v":"Password Management System"},null,null,null,3.3,"N/A","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A230","v":1649},{"$f":"'G. Communications and Ops Mgmt'!J230","v":2},{"$f":"'G. Communications and Ops Mgmt'!K230","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y230","v":0},{"$f":"'G. Communications and Ops Mgmt'!B230","v":"G.16.13"},{"$f":"'G. Communications and Ops Mgmt'!C230","v":"Password history of 12 before reuse?"},{"$f":"'G. Communications and Ops Mgmt'!D230","v":0},{"$f":"'G. Communications and Ops Mgmt'!E230","v":0},{"$f":"'G. Communications and Ops Mgmt'!F230","v":0},{"$f":"'G. Communications and Ops Mgmt'!G230","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H230","v":"9.4.3.f"},{"$f":"'G. Communications and Ops Mgmt'!I230","v":"Password Management System"},null,"AI2.3","Application control and auditability","8.1.1","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A231","v":2642},{"$f":"'G. Communications and Ops Mgmt'!J231","v":2},{"$f":"'G. Communications and Ops Mgmt'!K231","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y231","v":0},{"$f":"'G. Communications and Ops Mgmt'!B231","v":"G.16.14"},{"$f":"'G. Communications and Ops Mgmt'!C231","v":"Initial password required to be changed at first logon?"},{"$f":"'G. Communications and Ops Mgmt'!D231","v":0},{"$f":"'G. Communications and Ops Mgmt'!E231","v":0},{"$f":"'G. Communications and Ops Mgmt'!F231","v":0},{"$f":"'G. Communications and Ops Mgmt'!G231","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H231","v":"9.4.3.d"},{"$f":"'G. Communications and Ops Mgmt'!I231","v":"Password Management System"},null,"PO2.3","Data classification scheme","8.1.6","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A232","v":1668},{"$f":"'G. Communications and Ops Mgmt'!J232","v":2},{"$f":"'G. Communications and Ops Mgmt'!K232","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y232","v":0},{"$f":"'G. Communications and Ops Mgmt'!B232","v":"G.16.15"},{"$f":"'G. Communications and Ops Mgmt'!C232","v":"Can a PIN or secret question be a stand alone method of authentication?"},{"$f":"'G. Communications and Ops Mgmt'!D232","v":0},{"$f":"'G. Communications and Ops Mgmt'!E232","v":0},{"$f":"'G. Communications and Ops Mgmt'!F232","v":0},{"$f":"'G. Communications and Ops Mgmt'!G232","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H232","v":"9.4.2"},{"$f":"'G. Communications and Ops Mgmt'!I232","v":"Secure Log-On Procedures"},null,"DS5.4","User account management","N/A","N/A","AI2.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A233","v":1669},{"$f":"'G. Communications and Ops Mgmt'!J233","v":2},{"$f":"'G. Communications and Ops Mgmt'!K233","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y233","v":0},{"$f":"'G. Communications and Ops Mgmt'!B233","v":"G.16.16"},{"$f":"'G. Communications and Ops Mgmt'!C233","v":"Passwords encrypted in transit?"},{"$f":"'G. Communications and Ops Mgmt'!D233","v":0},{"$f":"'G. Communications and Ops Mgmt'!E233","v":0},{"$f":"'G. Communications and Ops Mgmt'!F233","v":0},{"$f":"'G. Communications and Ops Mgmt'!G233","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H233","v":"9.4.3.i"},{"$f":"'G. Communications and Ops Mgmt'!I233","v":"Password Management System"},null,null,null,"N/A","N/A","PO2.3, PO3.4, AI5.2, DS2.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A234","v":1670},{"$f":"'G. Communications and Ops Mgmt'!J234","v":2},{"$f":"'G. Communications and Ops Mgmt'!K234","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y234","v":0},{"$f":"'G. Communications and Ops Mgmt'!B234","v":"G.16.17"},{"$f":"'G. Communications and Ops Mgmt'!C234","v":"Passwords encrypted or hashed in storage?"},{"$f":"'G. Communications and Ops Mgmt'!D234","v":0},{"$f":"'G. Communications and Ops Mgmt'!E234","v":0},{"$f":"'G. Communications and Ops Mgmt'!F234","v":0},{"$f":"'G. Communications and Ops Mgmt'!G234","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H234","v":"9.4.3.i"},{"$f":"'G. Communications and Ops Mgmt'!I234","v":"Password Management System"},null,null,null,"7.2.2","N/A","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A235","v":1671},{"$f":"'G. Communications and Ops Mgmt'!J235","v":2},{"$f":"'G. Communications and Ops Mgmt'!K235","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y235","v":0},{"$f":"'G. Communications and Ops Mgmt'!B235","v":"G.16.18"},{"$f":"'G. Communications and Ops Mgmt'!C235","v":"Passwords displayed when entered into a system?"},{"$f":"'G. Communications and Ops Mgmt'!D235","v":0},{"$f":"'G. Communications and Ops Mgmt'!E235","v":0},{"$f":"'G. Communications and Ops Mgmt'!F235","v":0},{"$f":"'G. Communications and Ops Mgmt'!G235","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H235","v":"9.4.3.g"},{"$f":"'G. Communications and Ops Mgmt'!I235","v":"Password Management System"},null,null,null,"10.6.2","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A236","v":2643},{"$f":"'G. Communications and Ops Mgmt'!J236","v":2},{"$f":"'G. Communications and Ops Mgmt'!K236","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y236","v":0},{"$f":"'G. Communications and Ops Mgmt'!B236","v":"G.16.19"},{"$f":"'G. Communications and Ops Mgmt'!C236","v":"User accounts associated to a unique individual?"},{"$f":"'G. Communications and Ops Mgmt'!D236","v":0},{"$f":"'G. Communications and Ops Mgmt'!E236","v":0},{"$f":"'G. Communications and Ops Mgmt'!F236","v":0},{"$f":"'G. Communications and Ops Mgmt'!G236","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H236","v":"9.4.3.a"},{"$f":"'G. Communications and Ops Mgmt'!I236","v":"Password Management System"},null,"AI6.3","Emergency changes",10.3,"N/A","DS11.6"]
[{"$f":"'G. Communications and Ops Mgmt'!A237","v":1653},{"$f":"'G. Communications and Ops Mgmt'!J237","v":2},{"$f":"'G. Communications and Ops Mgmt'!K237","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y237","v":0},{"$f":"'G. Communications and Ops Mgmt'!B237","v":"G.16.20"},{"$f":"'G. Communications and Ops Mgmt'!C237","v":"Does the system lock an account when three to five invalid login attempts are made?"},{"$f":"'G. Communications and Ops Mgmt'!D237","v":0},{"$f":"'G. Communications and Ops Mgmt'!E237","v":0},{"$f":"'G. Communications and Ops Mgmt'!F237","v":0},{"$f":"'G. Communications and Ops Mgmt'!G237","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H237","v":"9.4.2"},{"$f":"'G. Communications and Ops Mgmt'!I237","v":"Secure Log-On Procedures"},null,"DS5.4","User account management",10.7,"N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A238","v":2644},{"$f":"'G. Communications and Ops Mgmt'!J238","v":2},{"$f":"'G. Communications and Ops Mgmt'!K238","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y238","v":0},{"$f":"'G. Communications and Ops Mgmt'!B238","v":"G.16.21"},{"$f":"'G. Communications and Ops Mgmt'!C238","v":"Users required to log off when the session is finished?"},{"$f":"'G. Communications and Ops Mgmt'!D238","v":0},{"$f":"'G. Communications and Ops Mgmt'!E238","v":0},{"$f":"'G. Communications and Ops Mgmt'!F238","v":0},{"$f":"'G. Communications and Ops Mgmt'!G238","v":0},{"$f":"'G. Communications and Ops Mgmt'!H238","v":"11.2.8.a"},{"$f":"'G. Communications and Ops Mgmt'!I238","v":"Unattended User Equipment"},null,null,null,"10.5.5","N/A","AI6.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A239","v":1672},{"$f":"'G. Communications and Ops Mgmt'!J239","v":1},{"$f":"'G. Communications and Ops Mgmt'!K239","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y239","v":0},{"$f":"'G. Communications and Ops Mgmt'!B239","v":"G.17"},{"$f":"'G. Communications and Ops Mgmt'!C239","v":"Is an Open VMS (VAX or Alpha) system used to transmit, process or store Scoped Systems and Data? If yes, are:"},{"$f":"'G. Communications and Ops Mgmt'!D239","v":0},{"$f":"'G. Communications and Ops Mgmt'!E239","v":0},{"$f":"'G. Communications and Ops Mgmt'!F239","v":0},{"$f":"'G. Communications and Ops Mgmt'!G239","v":0},{"$f":"'G. Communications and Ops Mgmt'!H239","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I239","v":""},null,"PO2.1","Enterprise information architecture model","10.5.2","N/A","DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A240","v":1679},{"$f":"'G. Communications and Ops Mgmt'!J240","v":2},{"$f":"'G. Communications and Ops Mgmt'!K240","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y240","v":0},{"$f":"'G. Communications and Ops Mgmt'!B240","v":"G.17.1"},{"$f":"'G. Communications and Ops Mgmt'!C240","v":"Administrative privilege restricted to those responsible for VMS administration?"},{"$f":"'G. Communications and Ops Mgmt'!D240","v":0},{"$f":"'G. Communications and Ops Mgmt'!E240","v":0},{"$f":"'G. Communications and Ops Mgmt'!F240","v":0},{"$f":"'G. Communications and Ops Mgmt'!G240","v":0},{"$f":"'G. Communications and Ops Mgmt'!H240","v":"9.4.4.c"},{"$f":"'G. Communications and Ops Mgmt'!I240","v":"Use of Privileged Utility Programs"},null,null,null,"8.2.3","N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A241","v":1705},{"$f":"'G. Communications and Ops Mgmt'!J241","v":2},{"$f":"'G. Communications and Ops Mgmt'!K241","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y241","v":0},{"$f":"'G. Communications and Ops Mgmt'!B241","v":"G.17.2"},{"$f":"'G. Communications and Ops Mgmt'!C241","v":"Logs regularly reviewed using a specific methodology to uncover potential incidents?"},{"$f":"'G. Communications and Ops Mgmt'!D241","v":0},{"$f":"'G. Communications and Ops Mgmt'!E241","v":0},{"$f":"'G. Communications and Ops Mgmt'!F241","v":0},{"$f":"'G. Communications and Ops Mgmt'!G241","v":0},{"$f":"'G. Communications and Ops Mgmt'!H241","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!I241","v":"Event Logging"},null,"PO4.11","Segregation of duties","8.2.3","IS.1.6.8 IS.2.A.1.2 IS.2.B.6 D&A.1.3.1.3 MGMT.1.2.1.4 OPS.1.5.3.3 OPS.2.12.H.3 FEDLINE.1.5.2.1 RPS.1.3.1.3","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A242","v":1707},{"$f":"'G. Communications and Ops Mgmt'!J242","v":2},{"$f":"'G. Communications and Ops Mgmt'!K242","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y242","v":0},{"$f":"'G. Communications and Ops Mgmt'!B242","v":"G.17.3"},{"$f":"'G. Communications and Ops Mgmt'!C242","v":"Sufficient information to investigate incidents including (failed login attempts)?"},{"$f":"'G. Communications and Ops Mgmt'!D242","v":0},{"$f":"'G. Communications and Ops Mgmt'!E242","v":0},{"$f":"'G. Communications and Ops Mgmt'!F242","v":0},{"$f":"'G. Communications and Ops Mgmt'!G242","v":"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!H242","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!I242","v":"Event Logging"},null,"DS5.10","Network security","8.2.4","IS.1.6.8 D&A.1.3.1.3","PO4.11, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A243","v":1698},{"$f":"'G. Communications and Ops Mgmt'!J243","v":2},{"$f":"'G. Communications and Ops Mgmt'!K243","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y243","v":0},{"$f":"'G. Communications and Ops Mgmt'!B243","v":"G.17.4"},{"$f":"'G. Communications and Ops Mgmt'!C243","v":"Logs retained for a minimum of one year?"},{"$f":"'G. Communications and Ops Mgmt'!D243","v":0},{"$f":"'G. Communications and Ops Mgmt'!E243","v":0},{"$f":"'G. Communications and Ops Mgmt'!F243","v":0},{"$f":"'G. Communications and Ops Mgmt'!G243","v":"G.11 Log Retention "},{"$f":"'G. Communications and Ops Mgmt'!H243","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!I243","v":"Protection of Log Information"},null,"PO4.11","Segregation of duties","8.2.5","IS.1.4.1.10, OPS.1.5.2.4","PO2.3, DS11.2, DS11.3, DS11.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A244","v":1718},{"$f":"'G. Communications and Ops Mgmt'!J244","v":2},{"$f":"'G. Communications and Ops Mgmt'!K244","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y244","v":0},{"$f":"'G. Communications and Ops Mgmt'!B244","v":"G.17.5"},{"$f":"'G. Communications and Ops Mgmt'!C244","v":"System generated alerts in the event of an audit log failure?"},{"$f":"'G. Communications and Ops Mgmt'!D244","v":0},{"$f":"'G. Communications and Ops Mgmt'!E244","v":0},{"$f":"'G. Communications and Ops Mgmt'!F244","v":0},{"$f":"'G. Communications and Ops Mgmt'!G244","v":"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!H244","v":"12.4.1"},{"$f":"'G. Communications and Ops Mgmt'!I244","v":"Event Logging"},null,"PO4.11","Segregation of duties","8.2.6","IS.2.M.8","PO4.11, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A245","v":1723},{"$f":"'G. Communications and Ops Mgmt'!J245","v":2},{"$f":"'G. Communications and Ops Mgmt'!K245","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y245","v":0},{"$f":"'G. Communications and Ops Mgmt'!B245","v":"G.17.6"},{"$f":"'G. Communications and Ops Mgmt'!C245","v":"Are audit logs protected against modification, deletion, and/or inappropriate access?"},{"$f":"'G. Communications and Ops Mgmt'!D245","v":0},{"$f":"'G. Communications and Ops Mgmt'!E245","v":0},{"$f":"'G. Communications and Ops Mgmt'!F245","v":0},{"$f":"'G. Communications and Ops Mgmt'!G245","v":"G.9 Administrative Activity Logging\nG.10 Log-on Activity Logging"},{"$f":"'G. Communications and Ops Mgmt'!H245","v":"12.4.2"},{"$f":"'G. Communications and Ops Mgmt'!I245","v":"Protection of Log Information"},null,"PO4.11","Segregation of duties",8.3000000000000007,"IS.1.6.8","PO4.11, DS5.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A246","v":1731},{"$f":"'G. Communications and Ops Mgmt'!J246","v":2},{"$f":"'G. Communications and Ops Mgmt'!K246","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y246","v":0},{"$f":"'G. Communications and Ops Mgmt'!B246","v":"G.17.7"},{"$f":"'G. Communications and Ops Mgmt'!C246","v":"Minimum password length at least eight characters?"},{"$f":"'G. Communications and Ops Mgmt'!D246","v":0},{"$f":"'G. Communications and Ops Mgmt'!E246","v":0},{"$f":"'G. Communications and Ops Mgmt'!F246","v":0},{"$f":"'G. Communications and Ops Mgmt'!G246","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H246","v":"9.3.1.d"},{"$f":"'G. Communications and Ops Mgmt'!I246","v":"Use of Secret Authentication Information"},null,"PO4.14","Contracted staff policies and procedures","8.2.1","IS.2.D.1","PO4.1, DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A247","v":1737},{"$f":"'G. Communications and Ops Mgmt'!J247","v":2},{"$f":"'G. Communications and Ops Mgmt'!K247","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y247","v":0},{"$f":"'G. Communications and Ops Mgmt'!B247","v":"G.17.8"},{"$f":"'G. Communications and Ops Mgmt'!C247","v":"Complex passwords required?"},{"$f":"'G. Communications and Ops Mgmt'!D247","v":0},{"$f":"'G. Communications and Ops Mgmt'!E247","v":0},{"$f":"'G. Communications and Ops Mgmt'!F247","v":0},{"$f":"'G. Communications and Ops Mgmt'!G247","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H247","v":"9.3.1.d                                     9.4.3.c"},{"$f":"'G. Communications and Ops Mgmt'!I247","v":"Use of Secret Authentication Information\nPassword Management System"},null,"PO4.14","Contracted staff policies and procedures",3.3,"N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A248","v":1742},{"$f":"'G. Communications and Ops Mgmt'!J248","v":2},{"$f":"'G. Communications and Ops Mgmt'!K248","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y248","v":0},{"$f":"'G. Communications and Ops Mgmt'!B248","v":"G.17.9"},{"$f":"'G. Communications and Ops Mgmt'!C248","v":"Minimum password expiration at least every 90 days?"},{"$f":"'G. Communications and Ops Mgmt'!D248","v":0},{"$f":"'G. Communications and Ops Mgmt'!E248","v":0},{"$f":"'G. Communications and Ops Mgmt'!F248","v":0},{"$f":"'G. Communications and Ops Mgmt'!G248","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H248","v":"9.4.3.e"},{"$f":"'G. Communications and Ops Mgmt'!I248","v":"Password Management System"},null,null,null,3.3,"N/A","PO4.14, PO6.2, DS9.2, DS9.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A249","v":1747},{"$f":"'G. Communications and Ops Mgmt'!J249","v":2},{"$f":"'G. Communications and Ops Mgmt'!K249","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y249","v":0},{"$f":"'G. Communications and Ops Mgmt'!B249","v":"G.17.10"},{"$f":"'G. Communications and Ops Mgmt'!C249","v":"Password history of 12 before reuse?"},{"$f":"'G. Communications and Ops Mgmt'!D249","v":0},{"$f":"'G. Communications and Ops Mgmt'!E249","v":0},{"$f":"'G. Communications and Ops Mgmt'!F249","v":0},{"$f":"'G. Communications and Ops Mgmt'!G249","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H249","v":"9.4.3.f"},{"$f":"'G. Communications and Ops Mgmt'!I249","v":"Password Management System"},null,"DS5.3","Identity management","8.1.1","N/A","PO4.14, PO6.2, DS9.2, DS9.3"]
[{"$f":"'G. Communications and Ops Mgmt'!A250","v":2646},{"$f":"'G. Communications and Ops Mgmt'!J250","v":2},{"$f":"'G. Communications and Ops Mgmt'!K250","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y250","v":0},{"$f":"'G. Communications and Ops Mgmt'!B250","v":"G.17.11"},{"$f":"'G. Communications and Ops Mgmt'!C250","v":"Initial password required to be changed at first logon?"},{"$f":"'G. Communications and Ops Mgmt'!D250","v":0},{"$f":"'G. Communications and Ops Mgmt'!E250","v":0},{"$f":"'G. Communications and Ops Mgmt'!F250","v":0},{"$f":"'G. Communications and Ops Mgmt'!G250","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H250","v":"9.4.3.d"},{"$f":"'G. Communications and Ops Mgmt'!I250","v":"Password Management System"},null,"DS5.9","Malicious software prevention, detection and correction","8.1.6","N/A","DS5.9, DS5.11"]
[{"$f":"'G. Communications and Ops Mgmt'!A251","v":1766},{"$f":"'G. Communications and Ops Mgmt'!J251","v":2},{"$f":"'G. Communications and Ops Mgmt'!K251","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y251","v":0},{"$f":"'G. Communications and Ops Mgmt'!B251","v":"G.17.12"},{"$f":"'G. Communications and Ops Mgmt'!C251","v":"Can a PIN or secret question be a stand alone method of authentication?"},{"$f":"'G. Communications and Ops Mgmt'!D251","v":0},{"$f":"'G. Communications and Ops Mgmt'!E251","v":0},{"$f":"'G. Communications and Ops Mgmt'!F251","v":0},{"$f":"'G. Communications and Ops Mgmt'!G251","v":0},{"$f":"'G. Communications and Ops Mgmt'!H251","v":"9.4.2"},{"$f":"'G. Communications and Ops Mgmt'!I251","v":"Secure Log-On Procedures"},null,"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","DS11.6"]
[{"$f":"'G. Communications and Ops Mgmt'!A252","v":1767},{"$f":"'G. Communications and Ops Mgmt'!J252","v":2},{"$f":"'G. Communications and Ops Mgmt'!K252","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y252","v":0},{"$f":"'G. Communications and Ops Mgmt'!B252","v":"G.17.13"},{"$f":"'G. Communications and Ops Mgmt'!C252","v":"Passwords encrypted in transit?"},{"$f":"'G. Communications and Ops Mgmt'!D252","v":0},{"$f":"'G. Communications and Ops Mgmt'!E252","v":0},{"$f":"'G. Communications and Ops Mgmt'!F252","v":0},{"$f":"'G. Communications and Ops Mgmt'!G252","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H252","v":"9.4.3.i"},{"$f":"'G. Communications and Ops Mgmt'!I252","v":"Password Management System"},null,"PO6.2","Enterprise IT risk and internal control framework","N/A","IS.2.B.10.6","DS5.9"]
[{"$f":"'G. Communications and Ops Mgmt'!A253","v":1768},{"$f":"'G. Communications and Ops Mgmt'!J253","v":2},{"$f":"'G. Communications and Ops Mgmt'!K253","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y253","v":0},{"$f":"'G. Communications and Ops Mgmt'!B253","v":"G.17.14"},{"$f":"'G. Communications and Ops Mgmt'!C253","v":"Passwords encrypted or hashed in storage?"},{"$f":"'G. Communications and Ops Mgmt'!D253","v":0},{"$f":"'G. Communications and Ops Mgmt'!E253","v":0},{"$f":"'G. Communications and Ops Mgmt'!F253","v":0},{"$f":"'G. Communications and Ops Mgmt'!G253","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H253","v":"9.4.3.i"},{"$f":"'G. Communications and Ops Mgmt'!I253","v":"Password Management System"},null,"PO6.2","Enterprise IT risk and internal control framework","4.1.1","N/A","PO6.2, DS5.2, DS5.3, DS5.7"]
[{"$f":"'G. Communications and Ops Mgmt'!A254","v":1769},{"$f":"'G. Communications and Ops Mgmt'!J254","v":2},{"$f":"'G. Communications and Ops Mgmt'!K254","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y254","v":0},{"$f":"'G. Communications and Ops Mgmt'!B254","v":"G.17.15"},{"$f":"'G. Communications and Ops Mgmt'!C254","v":"Passwords displayed when entered into a system?"},{"$f":"'G. Communications and Ops Mgmt'!D254","v":0},{"$f":"'G. Communications and Ops Mgmt'!E254","v":0},{"$f":"'G. Communications and Ops Mgmt'!F254","v":0},{"$f":"'G. Communications and Ops Mgmt'!G254","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H254","v":"9.4.3.g"},{"$f":"'G. Communications and Ops Mgmt'!I254","v":"Password Management System"},null,null,null,8.1999999999999993,"N/A","N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A255","v":2647},{"$f":"'G. Communications and Ops Mgmt'!J255","v":2},{"$f":"'G. Communications and Ops Mgmt'!K255","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y255","v":0},{"$f":"'G. Communications and Ops Mgmt'!B255","v":"G.17.16"},{"$f":"'G. Communications and Ops Mgmt'!C255","v":"User accounts associated to a unique individual?"},{"$f":"'G. Communications and Ops Mgmt'!D255","v":0},{"$f":"'G. Communications and Ops Mgmt'!E255","v":0},{"$f":"'G. Communications and Ops Mgmt'!F255","v":0},{"$f":"'G. Communications and Ops Mgmt'!G255","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H255","v":"9.4.3.a"},{"$f":"'G. Communications and Ops Mgmt'!I255","v":"Password Management System"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A256","v":1751},{"$f":"'G. Communications and Ops Mgmt'!J256","v":2},{"$f":"'G. Communications and Ops Mgmt'!K256","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y256","v":0},{"$f":"'G. Communications and Ops Mgmt'!B256","v":"G.17.17"},{"$f":"'G. Communications and Ops Mgmt'!C256","v":"Does the system lock an account when three to five invalid login attempts are made?"},{"$f":"'G. Communications and Ops Mgmt'!D256","v":0},{"$f":"'G. Communications and Ops Mgmt'!E256","v":0},{"$f":"'G. Communications and Ops Mgmt'!F256","v":0},{"$f":"'G. Communications and Ops Mgmt'!G256","v":"H.1 Password Controls"},{"$f":"'G. Communications and Ops Mgmt'!H256","v":"9.4.2"},{"$f":"'G. Communications and Ops Mgmt'!I256","v":"Secure Log-On Procedures"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A257","v":1770},{"$f":"'G. Communications and Ops Mgmt'!J257","v":1},{"$f":"'G. Communications and Ops Mgmt'!K257","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y257","v":1},{"$f":"'G. Communications and Ops Mgmt'!B257","v":"G.18"},{"$f":"'G. Communications and Ops Mgmt'!C257","v":"Are Web services provided? If yes, are:"},{"$f":"'G. Communications and Ops Mgmt'!D257","v":0},{"$f":"'G. Communications and Ops Mgmt'!E257","v":0},{"$f":"'G. Communications and Ops Mgmt'!F257","v":0},{"$f":"'G. Communications and Ops Mgmt'!G257","v":0},{"$f":"'G. Communications and Ops Mgmt'!H257","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I257","v":""},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A258","v":2649},{"$f":"'G. Communications and Ops Mgmt'!J258","v":2},{"$f":"'G. Communications and Ops Mgmt'!K258","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y258","v":0},{"$f":"'G. Communications and Ops Mgmt'!B258","v":"G.18.1"},{"$f":"'G. Communications and Ops Mgmt'!C258","v":"Electronic commerce web sites or applications used to transmit, process or store Scoped Systems and Data?"},{"$f":"'G. Communications and Ops Mgmt'!D258","v":0},{"$f":"'G. Communications and Ops Mgmt'!E258","v":0},{"$f":"'G. Communications and Ops Mgmt'!F258","v":0},{"$f":"'G. Communications and Ops Mgmt'!G258","v":"G.13 Website – Client Encryption"},{"$f":"'G. Communications and Ops Mgmt'!H258","v":"14.1.2"},{"$f":"'G. Communications and Ops Mgmt'!I258","v":"Securing Application Services on Public Networks"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A259","v":2650},{"$f":"'G. Communications and Ops Mgmt'!J259","v":3},{"$f":"'G. Communications and Ops Mgmt'!K259","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y259","v":0},{"$f":"'G. Communications and Ops Mgmt'!B259","v":"G.18.1.1"},{"$f":"'G. Communications and Ops Mgmt'!C259","v":"Cryptographic controls used for the electronic commerce application (SSL)?"},{"$f":"'G. Communications and Ops Mgmt'!D259","v":0},{"$f":"'G. Communications and Ops Mgmt'!E259","v":0},{"$f":"'G. Communications and Ops Mgmt'!F259","v":0},{"$f":"'G. Communications and Ops Mgmt'!G259","v":"G.13 Website – Client Encryption"},{"$f":"'G. Communications and Ops Mgmt'!H259","v":"14.1.2"},{"$f":"'G. Communications and Ops Mgmt'!I259","v":"Securing Application Services on Public Networks"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A260","v":2651},{"$f":"'G. Communications and Ops Mgmt'!J260","v":3},{"$f":"'G. Communications and Ops Mgmt'!K260","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y260","v":0},{"$f":"'G. Communications and Ops Mgmt'!B260","v":"G.18.1.2"},{"$f":"'G. Communications and Ops Mgmt'!C260","v":"Users required to authenticate to the application?"},{"$f":"'G. Communications and Ops Mgmt'!D260","v":0},{"$f":"'G. Communications and Ops Mgmt'!E260","v":0},{"$f":"'G. Communications and Ops Mgmt'!F260","v":0},{"$f":"'G. Communications and Ops Mgmt'!G260","v":"G.13 Website – Client Encryption"},{"$f":"'G. Communications and Ops Mgmt'!H260","v":"14.1.3"},{"$f":"'G. Communications and Ops Mgmt'!I260","v":"Protecting Application Services Transactions"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A261","v":2652},{"$f":"'G. Communications and Ops Mgmt'!J261","v":3},{"$f":"'G. Communications and Ops Mgmt'!K261","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y261","v":0},{"$f":"'G. Communications and Ops Mgmt'!B261","v":"G.18.1.3"},{"$f":"'G. Communications and Ops Mgmt'!C261","v":"Transaction details stored in the DMZ?"},{"$f":"'G. Communications and Ops Mgmt'!D261","v":0},{"$f":"'G. Communications and Ops Mgmt'!E261","v":0},{"$f":"'G. Communications and Ops Mgmt'!F261","v":0},{"$f":"'G. Communications and Ops Mgmt'!G261","v":0},{"$f":"'G. Communications and Ops Mgmt'!H261","v":"14.1.3.e"},{"$f":"'G. Communications and Ops Mgmt'!I261","v":"Protecting Application Services Transactions"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A262","v":1771},{"$f":"'G. Communications and Ops Mgmt'!J262","v":2},{"$f":"'G. Communications and Ops Mgmt'!K262","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y262","v":0},{"$f":"'G. Communications and Ops Mgmt'!B262","v":"G.18.2"},{"$f":"'G. Communications and Ops Mgmt'!C262","v":"Is Windows IIS for these Web services used? If yes, is:"},{"$f":"'G. Communications and Ops Mgmt'!D262","v":0},{"$f":"'G. Communications and Ops Mgmt'!E262","v":0},{"$f":"'G. Communications and Ops Mgmt'!F262","v":0},{"$f":"'G. Communications and Ops Mgmt'!G262","v":0},{"$f":"'G. Communications and Ops Mgmt'!H262","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I262","v":""},null,null,null,10.3]
[{"$f":"'G. Communications and Ops Mgmt'!A263","v":1772},{"$f":"'G. Communications and Ops Mgmt'!J263","v":3},{"$f":"'G. Communications and Ops Mgmt'!K263","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y263","v":0},{"$f":"'G. Communications and Ops Mgmt'!B263","v":"G.18.2.1"},{"$f":"'G. Communications and Ops Mgmt'!C263","v":"Anonymous access to FTP disabled?"},{"$f":"'G. Communications and Ops Mgmt'!D263","v":0},{"$f":"'G. Communications and Ops Mgmt'!E263","v":0},{"$f":"'G. Communications and Ops Mgmt'!F263","v":0},{"$f":"'G. Communications and Ops Mgmt'!G263","v":0},{"$f":"'G. Communications and Ops Mgmt'!H263","v":"13.2.2"},{"$f":"'G. Communications and Ops Mgmt'!I263","v":"Agreements on Information Transfer"},null,null,null,"6.3.1, 6.4.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A264","v":1773},{"$f":"'G. Communications and Ops Mgmt'!J264","v":3},{"$f":"'G. Communications and Ops Mgmt'!K264","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y264","v":0},{"$f":"'G. Communications and Ops Mgmt'!B264","v":"G.18.2.2"},{"$f":"'G. Communications and Ops Mgmt'!C264","v":"Membership to the IIS Administrators group restricted to those with web administration roles and responsibilities?"},{"$f":"'G. Communications and Ops Mgmt'!D264","v":0},{"$f":"'G. Communications and Ops Mgmt'!E264","v":0},{"$f":"'G. Communications and Ops Mgmt'!F264","v":0},{"$f":"'G. Communications and Ops Mgmt'!G264","v":0},{"$f":"'G. Communications and Ops Mgmt'!H264","v":"9.2.3.b"},{"$f":"'G. Communications and Ops Mgmt'!I264","v":"Management of Privileged Access Rights"},null,null,null,"7.1.2"]
[{"$f":"'G. Communications and Ops Mgmt'!A265","v":1774},{"$f":"'G. Communications and Ops Mgmt'!J265","v":3},{"$f":"'G. Communications and Ops Mgmt'!K265","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y265","v":0},{"$f":"'G. Communications and Ops Mgmt'!B265","v":"G.18.2.3"},{"$f":"'G. Communications and Ops Mgmt'!C265","v":"Dedicated virtual directory structure used for each website?"},{"$f":"'G. Communications and Ops Mgmt'!D265","v":0},{"$f":"'G. Communications and Ops Mgmt'!E265","v":0},{"$f":"'G. Communications and Ops Mgmt'!F265","v":0},{"$f":"'G. Communications and Ops Mgmt'!G265","v":0},{"$f":"'G. Communications and Ops Mgmt'!H265","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!I265","v":"Segregation In Networks"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A266","v":1776},{"$f":"'G. Communications and Ops Mgmt'!J266","v":3},{"$f":"'G. Communications and Ops Mgmt'!K266","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y266","v":0},{"$f":"'G. Communications and Ops Mgmt'!B266","v":"G.18.2.4"},{"$f":"'G. Communications and Ops Mgmt'!C266","v":"Unused services turned off on IIS servers?"},{"$f":"'G. Communications and Ops Mgmt'!D266","v":0},{"$f":"'G. Communications and Ops Mgmt'!E266","v":0},{"$f":"'G. Communications and Ops Mgmt'!F266","v":0},{"$f":"'G. Communications and Ops Mgmt'!G266","v":0},{"$f":"'G. Communications and Ops Mgmt'!H266","v":"9.4.4.h"},{"$f":"'G. Communications and Ops Mgmt'!I266","v":"Use of Privileged Utility Programs"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A267","v":1777},{"$f":"'G. Communications and Ops Mgmt'!J267","v":3},{"$f":"'G. Communications and Ops Mgmt'!K267","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y267","v":0},{"$f":"'G. Communications and Ops Mgmt'!B267","v":"G.18.2.5"},{"$f":"'G. Communications and Ops Mgmt'!C267","v":"Services running on standard ports?"},{"$f":"'G. Communications and Ops Mgmt'!D267","v":0},{"$f":"'G. Communications and Ops Mgmt'!E267","v":0},{"$f":"'G. Communications and Ops Mgmt'!F267","v":0},{"$f":"'G. Communications and Ops Mgmt'!G267","v":0},{"$f":"'G. Communications and Ops Mgmt'!H267","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I267","v":""},null,null,null,10.3]
[{"$f":"'G. Communications and Ops Mgmt'!A268","v":1778},{"$f":"'G. Communications and Ops Mgmt'!J268","v":3},{"$f":"'G. Communications and Ops Mgmt'!K268","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y268","v":0},{"$f":"'G. Communications and Ops Mgmt'!B268","v":"G.18.2.6"},{"$f":"'G. Communications and Ops Mgmt'!C268","v":"Logging configured to support incident investigation?"},{"$f":"'G. Communications and Ops Mgmt'!D268","v":0},{"$f":"'G. Communications and Ops Mgmt'!E268","v":0},{"$f":"'G. Communications and Ops Mgmt'!F268","v":0},{"$f":"'G. Communications and Ops Mgmt'!G268","v":0},{"$f":"'G. Communications and Ops Mgmt'!H268","v":12.4},{"$f":"'G. Communications and Ops Mgmt'!I268","v":"Logging and Monitoring"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A269","v":1779},{"$f":"'G. Communications and Ops Mgmt'!J269","v":3},{"$f":"'G. Communications and Ops Mgmt'!K269","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y269","v":0},{"$f":"'G. Communications and Ops Mgmt'!B269","v":"G.18.2.7"},{"$f":"'G. Communications and Ops Mgmt'!C269","v":"Sample applications and scripts removed?"},{"$f":"'G. Communications and Ops Mgmt'!D269","v":0},{"$f":"'G. Communications and Ops Mgmt'!E269","v":0},{"$f":"'G. Communications and Ops Mgmt'!F269","v":0},{"$f":"'G. Communications and Ops Mgmt'!G269","v":0},{"$f":"'G. Communications and Ops Mgmt'!H269","v":"9.4.4.h"},{"$f":"'G. Communications and Ops Mgmt'!I269","v":"Use of Privileged Utility Programs"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A270","v":1780},{"$f":"'G. Communications and Ops Mgmt'!J270","v":3},{"$f":"'G. Communications and Ops Mgmt'!K270","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y270","v":0},{"$f":"'G. Communications and Ops Mgmt'!B270","v":"G.18.2.8"},{"$f":"'G. Communications and Ops Mgmt'!C270","v":"Least privilege used when setting IIS content permissions?"},{"$f":"'G. Communications and Ops Mgmt'!D270","v":0},{"$f":"'G. Communications and Ops Mgmt'!E270","v":0},{"$f":"'G. Communications and Ops Mgmt'!F270","v":0},{"$f":"'G. Communications and Ops Mgmt'!G270","v":0},{"$f":"'G. Communications and Ops Mgmt'!H270","v":"9.1.1"},{"$f":"'G. Communications and Ops Mgmt'!I270","v":"Access Control Policy"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A271","v":1781},{"$f":"'G. Communications and Ops Mgmt'!J271","v":3},{"$f":"'G. Communications and Ops Mgmt'!K271","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y271","v":0},{"$f":"'G. Communications and Ops Mgmt'!B271","v":"G.18.2.9"},{"$f":"'G. Communications and Ops Mgmt'!C271","v":"Content folder on the same drive as the operating system?"},{"$f":"'G. Communications and Ops Mgmt'!D271","v":0},{"$f":"'G. Communications and Ops Mgmt'!E271","v":0},{"$f":"'G. Communications and Ops Mgmt'!F271","v":0},{"$f":"'G. Communications and Ops Mgmt'!G271","v":0},{"$f":"'G. Communications and Ops Mgmt'!H271","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I271","v":""},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A272","v":1782},{"$f":"'G. Communications and Ops Mgmt'!J272","v":2},{"$f":"'G. Communications and Ops Mgmt'!K272","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y272","v":0},{"$f":"'G. Communications and Ops Mgmt'!B272","v":"G.18.3"},{"$f":"'G. Communications and Ops Mgmt'!C272","v":"Is Apache used for these Web services? If yes, is:"},{"$f":"'G. Communications and Ops Mgmt'!D272","v":0},{"$f":"'G. Communications and Ops Mgmt'!E272","v":0},{"$f":"'G. Communications and Ops Mgmt'!F272","v":0},{"$f":"'G. Communications and Ops Mgmt'!G272","v":0},{"$f":"'G. Communications and Ops Mgmt'!H272","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I272","v":""},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A273","v":1783},{"$f":"'G. Communications and Ops Mgmt'!J273","v":3},{"$f":"'G. Communications and Ops Mgmt'!K273","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y273","v":0},{"$f":"'G. Communications and Ops Mgmt'!B273","v":"G.18.3.1"},{"$f":"'G. Communications and Ops Mgmt'!C273","v":"Logging configured to support incident investigation?"},{"$f":"'G. Communications and Ops Mgmt'!D273","v":0},{"$f":"'G. Communications and Ops Mgmt'!E273","v":0},{"$f":"'G. Communications and Ops Mgmt'!F273","v":0},{"$f":"'G. Communications and Ops Mgmt'!G273","v":0},{"$f":"'G. Communications and Ops Mgmt'!H273","v":12.4},{"$f":"'G. Communications and Ops Mgmt'!I273","v":"Logging and Monitoring"},null,null,null,"6.3.1, 6.4.4"]
[{"$f":"'G. Communications and Ops Mgmt'!A274","v":1784},{"$f":"'G. Communications and Ops Mgmt'!J274","v":3},{"$f":"'G. Communications and Ops Mgmt'!K274","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y274","v":0},{"$f":"'G. Communications and Ops Mgmt'!B274","v":"G.18.3.2"},{"$f":"'G. Communications and Ops Mgmt'!C274","v":"Anonymous access to FTP disabled?"},{"$f":"'G. Communications and Ops Mgmt'!D274","v":0},{"$f":"'G. Communications and Ops Mgmt'!E274","v":0},{"$f":"'G. Communications and Ops Mgmt'!F274","v":0},{"$f":"'G. Communications and Ops Mgmt'!G274","v":0},{"$f":"'G. Communications and Ops Mgmt'!H274","v":"13.2.2"},{"$f":"'G. Communications and Ops Mgmt'!I274","v":"Agreements on Information Transfer"},null,null,null,"7.1.2"]
[{"$f":"'G. Communications and Ops Mgmt'!A275","v":1785},{"$f":"'G. Communications and Ops Mgmt'!J275","v":3},{"$f":"'G. Communications and Ops Mgmt'!K275","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y275","v":0},{"$f":"'G. Communications and Ops Mgmt'!B275","v":"G.18.3.3"},{"$f":"'G. Communications and Ops Mgmt'!C275","v":"Membership to the Apache group restricted to those with web administration roles and responsibilities?"},{"$f":"'G. Communications and Ops Mgmt'!D275","v":0},{"$f":"'G. Communications and Ops Mgmt'!E275","v":0},{"$f":"'G. Communications and Ops Mgmt'!F275","v":0},{"$f":"'G. Communications and Ops Mgmt'!G275","v":0},{"$f":"'G. Communications and Ops Mgmt'!H275","v":"9.2.3.b"},{"$f":"'G. Communications and Ops Mgmt'!I275","v":"Management of Privileged Access Rights"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A276","v":1786},{"$f":"'G. Communications and Ops Mgmt'!J276","v":3},{"$f":"'G. Communications and Ops Mgmt'!K276","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y276","v":0},{"$f":"'G. Communications and Ops Mgmt'!B276","v":"G.18.3.4"},{"$f":"'G. Communications and Ops Mgmt'!C276","v":"Dedicated virtual directory structure used for each website?"},{"$f":"'G. Communications and Ops Mgmt'!D276","v":0},{"$f":"'G. Communications and Ops Mgmt'!E276","v":0},{"$f":"'G. Communications and Ops Mgmt'!F276","v":0},{"$f":"'G. Communications and Ops Mgmt'!G276","v":0},{"$f":"'G. Communications and Ops Mgmt'!H276","v":"13.1.3"},{"$f":"'G. Communications and Ops Mgmt'!I276","v":"Segregation In Networks"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A277","v":1787},{"$f":"'G. Communications and Ops Mgmt'!J277","v":3},{"$f":"'G. Communications and Ops Mgmt'!K277","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y277","v":0},{"$f":"'G. Communications and Ops Mgmt'!B277","v":"G.18.3.5"},{"$f":"'G. Communications and Ops Mgmt'!C277","v":"Configuration options restricted to authorized users?"},{"$f":"'G. Communications and Ops Mgmt'!D277","v":0},{"$f":"'G. Communications and Ops Mgmt'!E277","v":0},{"$f":"'G. Communications and Ops Mgmt'!F277","v":0},{"$f":"'G. Communications and Ops Mgmt'!G277","v":0},{"$f":"'G. Communications and Ops Mgmt'!H277","v":"9.1.1"},{"$f":"'G. Communications and Ops Mgmt'!I277","v":"Access Control Policy"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A278","v":1788},{"$f":"'G. Communications and Ops Mgmt'!J278","v":3},{"$f":"'G. Communications and Ops Mgmt'!K278","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y278","v":0},{"$f":"'G. Communications and Ops Mgmt'!B278","v":"G.18.3.6"},{"$f":"'G. Communications and Ops Mgmt'!C278","v":"Services run on standard ports?"},{"$f":"'G. Communications and Ops Mgmt'!D278","v":0},{"$f":"'G. Communications and Ops Mgmt'!E278","v":0},{"$f":"'G. Communications and Ops Mgmt'!F278","v":0},{"$f":"'G. Communications and Ops Mgmt'!G278","v":0},{"$f":"'G. Communications and Ops Mgmt'!H278","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I278","v":""},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A279","v":1789},{"$f":"'G. Communications and Ops Mgmt'!J279","v":3},{"$f":"'G. Communications and Ops Mgmt'!K279","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y279","v":0},{"$f":"'G. Communications and Ops Mgmt'!B279","v":"G.18.3.7"},{"$f":"'G. Communications and Ops Mgmt'!C279","v":"Sample applications and scripts removed?"},{"$f":"'G. Communications and Ops Mgmt'!D279","v":0},{"$f":"'G. Communications and Ops Mgmt'!E279","v":0},{"$f":"'G. Communications and Ops Mgmt'!F279","v":0},{"$f":"'G. Communications and Ops Mgmt'!G279","v":0},{"$f":"'G. Communications and Ops Mgmt'!H279","v":"9.4.4.h"},{"$f":"'G. Communications and Ops Mgmt'!I279","v":"Use of Privileged Utility Programs"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A280","v":1790},{"$f":"'G. Communications and Ops Mgmt'!J280","v":3},{"$f":"'G. Communications and Ops Mgmt'!K280","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y280","v":0},{"$f":"'G. Communications and Ops Mgmt'!B280","v":"G.18.3.8"},{"$f":"'G. Communications and Ops Mgmt'!C280","v":"Least privilege used when setting permissions?"},{"$f":"'G. Communications and Ops Mgmt'!D280","v":0},{"$f":"'G. Communications and Ops Mgmt'!E280","v":0},{"$f":"'G. Communications and Ops Mgmt'!F280","v":0},{"$f":"'G. Communications and Ops Mgmt'!G280","v":"H.3 Logical Access Authorization"},{"$f":"'G. Communications and Ops Mgmt'!H280","v":"9.1.1"},{"$f":"'G. Communications and Ops Mgmt'!I280","v":"Access Control Policy"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A281","v":1791},{"$f":"'G. Communications and Ops Mgmt'!J281","v":1},{"$f":"'G. Communications and Ops Mgmt'!K281","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y281","v":0},{"$f":"'G. Communications and Ops Mgmt'!B281","v":"G.19"},{"$f":"'G. Communications and Ops Mgmt'!C281","v":"Are desktop computers used to transmit, process or store Scoped Systems and Data. If yes, is:"},{"$f":"'G. Communications and Ops Mgmt'!D281","v":0},{"$f":"'G. Communications and Ops Mgmt'!E281","v":0},{"$f":"'G. Communications and Ops Mgmt'!F281","v":0},{"$f":"'G. Communications and Ops Mgmt'!G281","v":0},{"$f":"'G. Communications and Ops Mgmt'!H281","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I281","v":""},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A282","v":842},{"$f":"'G. Communications and Ops Mgmt'!J282","v":2},{"$f":"'G. Communications and Ops Mgmt'!K282","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y282","v":0},{"$f":"'G. Communications and Ops Mgmt'!B282","v":"G.19.1"},{"$f":"'G. Communications and Ops Mgmt'!C282","v":"Segregation of duties for granting access and approving access?"},{"$f":"'G. Communications and Ops Mgmt'!D282","v":0},{"$f":"'G. Communications and Ops Mgmt'!E282","v":0},{"$f":"'G. Communications and Ops Mgmt'!F282","v":0},{"$f":"'G. Communications and Ops Mgmt'!G282","v":0},{"$f":"'G. Communications and Ops Mgmt'!H282","v":"9.1.1.f"},{"$f":"'G. Communications and Ops Mgmt'!I282","v":"Access Control Policy"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A283","v":845},{"$f":"'G. Communications and Ops Mgmt'!J283","v":2},{"$f":"'G. Communications and Ops Mgmt'!K283","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y283","v":0},{"$f":"'G. Communications and Ops Mgmt'!B283","v":"G.19.2"},{"$f":"'G. Communications and Ops Mgmt'!C283","v":"Segregation of duties for approving and implementing access requests?"},{"$f":"'G. Communications and Ops Mgmt'!D283","v":0},{"$f":"'G. Communications and Ops Mgmt'!E283","v":0},{"$f":"'G. Communications and Ops Mgmt'!F283","v":0},{"$f":"'G. Communications and Ops Mgmt'!G283","v":0},{"$f":"'G. Communications and Ops Mgmt'!H283","v":"6.1.2 "},{"$f":"'G. Communications and Ops Mgmt'!I283","v":"Segregation of Duties"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A284","v":2954},{"$f":"'G. Communications and Ops Mgmt'!J284","v":2},{"$f":"'G. Communications and Ops Mgmt'!K284","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y284","v":0},{"$f":"'G. Communications and Ops Mgmt'!B284","v":"G.19.3"},{"$f":"'G. Communications and Ops Mgmt'!C284","v":"User able to use removable media (floppy disk, recordable CD, USB drive) without detection?"},{"$f":"'G. Communications and Ops Mgmt'!D284","v":0},{"$f":"'G. Communications and Ops Mgmt'!E284","v":0},{"$f":"'G. Communications and Ops Mgmt'!F284","v":0},{"$f":"'G. Communications and Ops Mgmt'!G284","v":0},{"$f":"'G. Communications and Ops Mgmt'!H284","v":"8.3.1.b"},{"$f":"'G. Communications and Ops Mgmt'!I284","v":"Management of Removable Media"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A285","v":843},{"$f":"'G. Communications and Ops Mgmt'!J285","v":2},{"$f":"'G. Communications and Ops Mgmt'!K285","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y285","v":0},{"$f":"'G. Communications and Ops Mgmt'!B285","v":"G.19.4"},{"$f":"'G. Communications and Ops Mgmt'!C285","v":"User of a system also responsible for reviewing its security audit logs?"},{"$f":"'G. Communications and Ops Mgmt'!D285","v":0},{"$f":"'G. Communications and Ops Mgmt'!E285","v":0},{"$f":"'G. Communications and Ops Mgmt'!F285","v":0},{"$f":"'G. Communications and Ops Mgmt'!G285","v":0},{"$f":"'G. Communications and Ops Mgmt'!H285","v":"6.1.2 "},{"$f":"'G. Communications and Ops Mgmt'!I285","v":"Segregation of Duties"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A286","v":844},{"$f":"'G. Communications and Ops Mgmt'!J286","v":2},{"$f":"'G. Communications and Ops Mgmt'!K286","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y286","v":0},{"$f":"'G. Communications and Ops Mgmt'!B286","v":"G.19.5"},{"$f":"'G. Communications and Ops Mgmt'!C286","v":"Segregation of duties to prevent the user of a system from modifying or deleting its security audit logs?"},{"$f":"'G. Communications and Ops Mgmt'!D286","v":0},{"$f":"'G. Communications and Ops Mgmt'!E286","v":0},{"$f":"'G. Communications and Ops Mgmt'!F286","v":0},{"$f":"'G. Communications and Ops Mgmt'!G286","v":0},{"$f":"'G. Communications and Ops Mgmt'!H286","v":"6.1.2 "},{"$f":"'G. Communications and Ops Mgmt'!I286","v":"Segregation of Duties"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A287","v":1792},{"$f":"'G. Communications and Ops Mgmt'!J287","v":2},{"$f":"'G. Communications and Ops Mgmt'!K287","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y287","v":0},{"$f":"'G. Communications and Ops Mgmt'!B287","v":"G.19.6"},{"$f":"'G. Communications and Ops Mgmt'!C287","v":"Standard operating environment required?"},{"$f":"'G. Communications and Ops Mgmt'!D287","v":0},{"$f":"'G. Communications and Ops Mgmt'!E287","v":0},{"$f":"'G. Communications and Ops Mgmt'!F287","v":0},{"$f":"'G. Communications and Ops Mgmt'!G287","v":0},{"$f":"'G. Communications and Ops Mgmt'!H287","v":"13.1.1.e"},{"$f":"'G. Communications and Ops Mgmt'!I287","v":"Network Controls"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A288","v":1013},{"$f":"'G. Communications and Ops Mgmt'!J288","v":2},{"$f":"'G. Communications and Ops Mgmt'!K288","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y288","v":0},{"$f":"'G. Communications and Ops Mgmt'!B288","v":"G.19.7"},{"$f":"'G. Communications and Ops Mgmt'!C288","v":"Content filtering proxy used prior to accessing the Internet?"},{"$f":"'G. Communications and Ops Mgmt'!D288","v":0},{"$f":"'G. Communications and Ops Mgmt'!E288","v":0},{"$f":"'G. Communications and Ops Mgmt'!F288","v":0},{"$f":"'G. Communications and Ops Mgmt'!G288","v":0},{"$f":"'G. Communications and Ops Mgmt'!H288","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I288","v":"Network Routing Control"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A289","v":1793},{"$f":"'G. Communications and Ops Mgmt'!J289","v":2},{"$f":"'G. Communications and Ops Mgmt'!K289","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y289","v":0},{"$f":"'G. Communications and Ops Mgmt'!B289","v":"G.19.8"},{"$f":"'G. Communications and Ops Mgmt'!C289","v":"Security approval required prior to implementing non-standard operating equipment?"},{"$f":"'G. Communications and Ops Mgmt'!D289","v":0},{"$f":"'G. Communications and Ops Mgmt'!E289","v":0},{"$f":"'G. Communications and Ops Mgmt'!F289","v":0},{"$f":"'G. Communications and Ops Mgmt'!G289","v":0},{"$f":"'G. Communications and Ops Mgmt'!H289","v":"13.1.1"},{"$f":"'G. Communications and Ops Mgmt'!I289","v":"Network Controls"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A290","v":1794},{"$f":"'G. Communications and Ops Mgmt'!J290","v":2},{"$f":"'G. Communications and Ops Mgmt'!K290","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y290","v":0},{"$f":"'G. Communications and Ops Mgmt'!B290","v":"G.19.9"},{"$f":"'G. Communications and Ops Mgmt'!C290","v":"Security approval required prior to implementing freeware or shareware applications?"},{"$f":"'G. Communications and Ops Mgmt'!D290","v":0},{"$f":"'G. Communications and Ops Mgmt'!E290","v":0},{"$f":"'G. Communications and Ops Mgmt'!F290","v":0},{"$f":"'G. Communications and Ops Mgmt'!G290","v":0},{"$f":"'G. Communications and Ops Mgmt'!H290","v":"13.1.1"},{"$f":"'G. Communications and Ops Mgmt'!I290","v":"Network Controls"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A291","v":1797},{"$f":"'G. Communications and Ops Mgmt'!J291","v":2},{"$f":"'G. Communications and Ops Mgmt'!K291","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y291","v":0},{"$f":"'G. Communications and Ops Mgmt'!B291","v":"G.19.10"},{"$f":"'G. Communications and Ops Mgmt'!C291","v":"Non-company managed PCs used to connect to the company network?"},{"$f":"'G. Communications and Ops Mgmt'!D291","v":0},{"$f":"'G. Communications and Ops Mgmt'!E291","v":0},{"$f":"'G. Communications and Ops Mgmt'!F291","v":0},{"$f":"'G. Communications and Ops Mgmt'!G291","v":0},{"$f":"'G. Communications and Ops Mgmt'!H291","v":"NA"},{"$f":"'G. Communications and Ops Mgmt'!I291","v":""},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A292","v":1803},{"$f":"'G. Communications and Ops Mgmt'!J292","v":2},{"$f":"'G. Communications and Ops Mgmt'!K292","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y292","v":0},{"$f":"'G. Communications and Ops Mgmt'!B292","v":"G.19.11"},{"$f":"'G. Communications and Ops Mgmt'!C292","v":"Installation of software on company-owned equipment (workstations, mobile devices) restricted to administrators?"},{"$f":"'G. Communications and Ops Mgmt'!D292","v":0},{"$f":"'G. Communications and Ops Mgmt'!E292","v":0},{"$f":"'G. Communications and Ops Mgmt'!F292","v":0},{"$f":"'G. Communications and Ops Mgmt'!G292","v":0},{"$f":"'G. Communications and Ops Mgmt'!H292","v":"13.1.1"},{"$f":"'G. Communications and Ops Mgmt'!I292","v":"Network Controls"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A293","v":1805},{"$f":"'G. Communications and Ops Mgmt'!J293","v":2},{"$f":"'G. Communications and Ops Mgmt'!K293","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y293","v":0},{"$f":"'G. Communications and Ops Mgmt'!B293","v":"G.19.12"},{"$f":"'G. Communications and Ops Mgmt'!C293","v":"Users permitted to execute mobile code?"},{"$f":"'G. Communications and Ops Mgmt'!D293","v":0},{"$f":"'G. Communications and Ops Mgmt'!E293","v":0},{"$f":"'G. Communications and Ops Mgmt'!F293","v":0},{"$f":"'G. Communications and Ops Mgmt'!G293","v":0},{"$f":"'G. Communications and Ops Mgmt'!H293","v":"12.2.1"},{"$f":"'G. Communications and Ops Mgmt'!I293","v":"Controls Against Malware"},null,null,null,"N/A"]
[{"$f":"'G. Communications and Ops Mgmt'!A294","v":0},{"$f":"'G. Communications and Ops Mgmt'!J294","v":0},{"$f":"'G. Communications and Ops Mgmt'!K294","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y294","v":0},{"$f":"'G. Communications and Ops Mgmt'!B294","v":0},{"$f":"'G. Communications and Ops Mgmt'!C294","v":0},{"$f":"'G. Communications and Ops Mgmt'!D294","v":0},{"$f":"'G. Communications and Ops Mgmt'!E294","v":0},{"$f":"'G. Communications and Ops Mgmt'!F294","v":0},{"$f":"'G. Communications and Ops Mgmt'!G294","v":0},{"$f":"'G. Communications and Ops Mgmt'!H294","v":0},{"$f":"'G. Communications and Ops Mgmt'!I294","v":0}]
[{"$f":"'G. Communications and Ops Mgmt'!A295","v":0},{"$f":"'G. Communications and Ops Mgmt'!J295","v":0},{"$f":"'G. Communications and Ops Mgmt'!K295","v":0},{"$f":"'G. Communications and Ops Mgmt'!Y295","v":0},{"$f":"'G. Communications and Ops Mgmt'!B295","v":0},{"$f":"'G. Communications and Ops Mgmt'!C295","v":0},{"$f":"'G. Communications and Ops Mgmt'!D295","v":0},{"$f":"'G. Communications and Ops Mgmt'!E295","v":0},{"$f":"'G. Communications and Ops Mgmt'!F295","v":0},{"$f":"'G. Communications and Ops Mgmt'!G295","v":0},{"$f":"'G. Communications and Ops Mgmt'!H295","v":0},{"$f":"'G. Communications and Ops Mgmt'!I295","v":0}]
[{"$f":"'H. Access Control'!B1","v":"H. Access Control"},null,null,null,{"$f":"'H. Access Control'!B1","v":"H. Access Control"}]
[{"$f":"'H. Access Control'!A5","v":1998},{"$f":"'H. Access Control'!J5","v":1},{"$f":"'H. Access Control'!K5","v":0},{"$f":"'H. Access Control'!Y5","v":1},{"$f":"'H. Access Control'!B5","v":"H.1"},{"$f":"'H. Access Control'!C5","v":"Are electronic systems used to transmit, process or store Scoped Systems and Data?"},{"$f":"'H. Access Control'!D5","v":0},{"$f":"'H. Access Control'!E5","v":0},{"$f":"'H. Access Control'!F5","v":0},{"$f":"'H. Access Control'!G5","v":0},{"$f":"'H. Access Control'!H5","v":"NA"},{"$f":"'H. Access Control'!I5","v":""},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'H. Access Control'!A6","v":1903},{"$f":"'H. Access Control'!J6","v":2},{"$f":"'H. Access Control'!K6","v":0},{"$f":"'H. Access Control'!Y6","v":0},{"$f":"'H. Access Control'!B6","v":"H.1.1"},{"$f":"'H. Access Control'!C6","v":"Is there an access control policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"'H. Access Control'!D6","v":0},{"$f":"'H. Access Control'!E6","v":0},{"$f":"'H. Access Control'!F6","v":0},{"$f":"'H. Access Control'!G6","v":"H. Access Control"},{"$f":"'H. Access Control'!H6","v":"9.1.1"},{"$f":"'H. Access Control'!I6","v":"Access control policy"},null,"PO2.1","Enterprise information architecture model",7.3,"IS.1.4.1.1 IS.2.A.1 IS.2.G.4 OPS.1.5.1.2 E-BANK.1.4.2.9","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'H. Access Control'!A7","v":1908},{"$f":"'H. Access Control'!J7","v":2},{"$f":"'H. Access Control'!K7","v":0},{"$f":"'H. Access Control'!Y7","v":0},{"$f":"'H. Access Control'!B7","v":"H.1.2"},{"$f":"'H. Access Control'!C7","v":"Does access control on applications, operating systems, databases, and network devices ensure users have least privilege?"},{"$f":"'H. Access Control'!D7","v":0},{"$f":"'H. Access Control'!E7","v":0},{"$f":"'H. Access Control'!F7","v":0},{"$f":"'H. Access Control'!G7","v":0},{"$f":"'H. Access Control'!H7","v":"9.1.1.b"},{"$f":"'H. Access Control'!I7","v":"Access control policy"},null,"PO2.1","Enterprise information architecture model",7.2,"IS.1.4.1.3.2 IS.1.4.1.3.3 IS.2.A.1.1 IS.2.A.2.2 IS.2.B.8","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'H. Access Control'!A8","v":1911},{"$f":"'H. Access Control'!J8","v":1},{"$f":"'H. Access Control'!K8","v":0},{"$f":"'H. Access Control'!Y8","v":1},{"$f":"'H. Access Control'!B8","v":"H.2"},{"$f":"'H. Access Control'!C8","v":"Are unique user IDs used for access?"},{"$f":"'H. Access Control'!D8","v":0},{"$f":"'H. Access Control'!E8","v":0},{"$f":"'H. Access Control'!F8","v":0},{"$f":"'H. Access Control'!G8","v":"H.1 Password Controls"},{"$f":"'H. Access Control'!H8","v":"9.2.1.a"},{"$f":"'H. Access Control'!I8","v":"User registration and de-registration"},null,"DS5.4","User account management","8.1.1","IS.2.A.2.1 IS.2.A.2.3 IS.2.A.4.7&\" \"&","DS5.4"]
[{"$f":"'H. Access Control'!A9","v":1913},{"$f":"'H. Access Control'!J9","v":2},{"$f":"'H. Access Control'!K9","v":0},{"$f":"'H. Access Control'!Y9","v":0},{"$f":"'H. Access Control'!B9","v":"H.2.1"},{"$f":"'H. Access Control'!C9","v":"Can a user ID contain personal information (SSN, access level, admin of the user)?"},{"$f":"'H. Access Control'!D9","v":0},{"$f":"'H. Access Control'!E9","v":0},{"$f":"'H. Access Control'!F9","v":0},{"$f":"'H. Access Control'!G9","v":0},{"$f":"'H. Access Control'!H9","v":"9.4.3.c"},{"$f":"'H. Access Control'!I9","v":"Password Management System"},null,null,null,"8.2.1","E-BANK.1.4.5.13","N/A"]
[{"$f":"'H. Access Control'!A10","v":3205},{"$f":"'H. Access Control'!J10","v":2},{"$f":"'H. Access Control'!K10","v":0},{"$f":"'H. Access Control'!Y10","v":0},{"$f":"'H. Access Control'!B10","v":"H.2.2"},{"$f":"'H. Access Control'!C10","v":"Is an inactive user ID deleted or disabled within 90 days?"},{"$f":"'H. Access Control'!D10","v":0},{"$f":"'H. Access Control'!E10","v":0},{"$f":"'H. Access Control'!F10","v":0},{"$f":"'H. Access Control'!G10","v":"H.4 Inactive Accounts"},{"$f":"'H. Access Control'!H10","v":"9.2.6"},{"$f":"'H. Access Control'!I10","v":"Removal or adjustment of access rights"},null,null,null,"8.1.4","IS.2.A.5.1","N/A"]
[{"$f":"'H. Access Control'!A11","v":1915},{"$f":"'H. Access Control'!J11","v":2},{"$f":"'H. Access Control'!K11","v":0},{"$f":"'H. Access Control'!Y11","v":0},{"$f":"'H. Access Control'!B11","v":"H.2.3"},{"$f":"'H. Access Control'!C11","v":"Can a user ID be shared?"},{"$f":"'H. Access Control'!D11","v":0},{"$f":"'H. Access Control'!E11","v":0},{"$f":"'H. Access Control'!F11","v":0},{"$f":"'H. Access Control'!G11","v":0},{"$f":"'H. Access Control'!H11","v":"9.3.1.e"},{"$f":"'H. Access Control'!I11","v":"Use of secret authentication information"},null,"DS5.4","User account management",8.5,"N/A","DS5.4"]
[{"$f":"'H. Access Control'!A12","v":1916},{"$f":"'H. Access Control'!J12","v":2},{"$f":"'H. Access Control'!K12","v":0},{"$f":"'H. Access Control'!Y12","v":0},{"$f":"'H. Access Control'!B12","v":"H.2.4"},{"$f":"'H. Access Control'!C12","v":"Is there a process to grant and approve access to systems transmitting, processing or storing Scoped Systems and Data?"},{"$f":"'H. Access Control'!D12","v":0},{"$f":"'H. Access Control'!E12","v":0},{"$f":"'H. Access Control'!F12","v":0},{"$f":"'H. Access Control'!G12","v":"H.3 Logical Access Authorization"},{"$f":"'H. Access Control'!H12","v":"9.1.2.b"},{"$f":"'H. Access Control'!I12","v":"Access to networks and network services"},null,"DS5.4","User account management","8.1.2","IS.2.C.6 AUDIT.2.D.1.13 AUDIT.2.D.1.15","DS5.4"]
[{"$f":"'H. Access Control'!A13","v":3206},{"$f":"'H. Access Control'!J13","v":3},{"$f":"'H. Access Control'!K13","v":0},{"$f":"'H. Access Control'!Y13","v":0},{"$f":"'H. Access Control'!B13","v":"H.2.4.1"},{"$f":"'H. Access Control'!C13","v":"Does access to electronic systems include a formal request and management approval?"},{"$f":"'H. Access Control'!D13","v":0},{"$f":"'H. Access Control'!E13","v":0},{"$f":"'H. Access Control'!F13","v":0},{"$f":"'H. Access Control'!G13","v":"H.3 Logical Access Authorization"},{"$f":"'H. Access Control'!H13","v":"9.1.2.b"},{"$f":"'H. Access Control'!I13","v":"Access to networks and network services"},null,"DS5.4","User account management","8.1.2","IS.2.C.6 AUDIT.2.D.1.13 AUDIT.2.D.1.15","DS5.4"]
[{"$f":"'H. Access Control'!A14","v":1922},{"$f":"'H. Access Control'!J14","v":3},{"$f":"'H. Access Control'!K14","v":0},{"$f":"'H. Access Control'!Y14","v":0},{"$f":"'H. Access Control'!B14","v":"H.2.4.2"},{"$f":"'H. Access Control'!C14","v":"Are approved requests for granting access logged, archived and maintained?"},{"$f":"'H. Access Control'!D14","v":0},{"$f":"'H. Access Control'!E14","v":0},{"$f":"'H. Access Control'!F14","v":0},{"$f":"'H. Access Control'!G14","v":0},{"$f":"'H. Access Control'!H14","v":"9.2.5.e"},{"$f":"'H. Access Control'!I14","v":"Review of User Access Rights"},null,"DS5.4","User account management","8.1.2","N/A","DS5.4"]
[{"$f":"'H. Access Control'!A15","v":1939},{"$f":"'H. Access Control'!J15","v":2},{"$f":"'H. Access Control'!K15","v":1},{"$f":"'H. Access Control'!Y15","v":0},{"$f":"'H. Access Control'!B15","v":"H.2.5"},{"$f":"'H. Access Control'!C15","v":"Is system access limited by:"},{"$f":"'H. Access Control'!D15","v":0},{"$f":"'H. Access Control'!E15","v":0},{"$f":"'H. Access Control'!F15","v":0},{"$f":"'H. Access Control'!G15","v":0},{"$f":"'H. Access Control'!H15","v":"9.4.1"},{"$f":"'H. Access Control'!I15","v":"Information access restriction"},null,"DS5.4","User account management",7.1,"N/A","DS5.4"]
[{"$f":"'H. Access Control'!A16","v":1940},{"$f":"'H. Access Control'!J16","v":3},{"$f":"'H. Access Control'!K16","v":0},{"$f":"'H. Access Control'!Y16","v":0},{"$f":"'H. Access Control'!B16","v":"H.2.5.1"},{"$f":"'H. Access Control'!C16","v":"Time of day?"},{"$f":"'H. Access Control'!D16","v":0},{"$f":"'H. Access Control'!E16","v":0},{"$f":"'H. Access Control'!F16","v":0},{"$f":"'H. Access Control'!G16","v":0},{"$f":"'H. Access Control'!H16","v":"NA"},{"$f":"'H. Access Control'!I16","v":0},null,"DS5.3","Identity management","N/A","WPS.2.9.4.2","DS5.7"]
[{"$f":"'H. Access Control'!A17","v":1943},{"$f":"'H. Access Control'!J17","v":3},{"$f":"'H. Access Control'!K17","v":0},{"$f":"'H. Access Control'!Y17","v":0},{"$f":"'H. Access Control'!B17","v":"H.2.5.2"},{"$f":"'H. Access Control'!C17","v":"Physical location?"},{"$f":"'H. Access Control'!D17","v":0},{"$f":"'H. Access Control'!E17","v":0},{"$f":"'H. Access Control'!F17","v":0},{"$f":"'H. Access Control'!G17","v":0},{"$f":"'H. Access Control'!H17","v":"NA"},{"$f":"'H. Access Control'!I17","v":""},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'H. Access Control'!A18","v":1945},{"$f":"'H. Access Control'!J18","v":3},{"$f":"'H. Access Control'!K18","v":0},{"$f":"'H. Access Control'!Y18","v":0},{"$f":"'H. Access Control'!B18","v":"H.2.5.3"},{"$f":"'H. Access Control'!C18","v":"Network subnet?"},{"$f":"'H. Access Control'!D18","v":0},{"$f":"'H. Access Control'!E18","v":0},{"$f":"'H. Access Control'!F18","v":0},{"$f":"'H. Access Control'!G18","v":0},{"$f":"'H. Access Control'!H18","v":"NA"},{"$f":"'H. Access Control'!I18","v":""},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'H. Access Control'!A19","v":3207},{"$f":"'H. Access Control'!J19","v":2},{"$f":"'H. Access Control'!K19","v":0},{"$f":"'H. Access Control'!Y19","v":0},{"$f":"'H. Access Control'!B19","v":"H.2.6"},{"$f":"'H. Access Control'!C19","v":"Are user access rights reviewed at least quarterly?"},{"$f":"'H. Access Control'!D19","v":0},{"$f":"'H. Access Control'!E19","v":0},{"$f":"'H. Access Control'!F19","v":0},{"$f":"'H. Access Control'!G19","v":"H.9 Monitoring of All System Access Rights"},{"$f":"'H. Access Control'!H19","v":"9.2.5.a"},{"$f":"'H. Access Control'!I19","v":"Review of User Access Rights"},null,"DS5.4","User account management","10.6.2","IS.2.A.5","DS5.4"]
[{"$f":"'H. Access Control'!A20","v":2654},{"$f":"'H. Access Control'!J20","v":2},{"$f":"'H. Access Control'!K20","v":0},{"$f":"'H. Access Control'!Y20","v":0},{"$f":"'H. Access Control'!B20","v":"H.2.7"},{"$f":"'H. Access Control'!C20","v":"Are access rights reviewed when a constituent changes roles?"},{"$f":"'H. Access Control'!D20","v":0},{"$f":"'H. Access Control'!E20","v":0},{"$f":"'H. Access Control'!F20","v":0},{"$f":"'H. Access Control'!G20","v":"H.9 Monitoring of All System Access Rights"},{"$f":"'H. Access Control'!H20","v":"9.2.5.b"},{"$f":"'H. Access Control'!I20","v":"Review of User Access Rights"},null,"DS5.4","User account management","N/A","IS.2.A.5.2","DS5.4"]
[{"$f":"'H. Access Control'!A21","v":2655},{"$f":"'H. Access Control'!J21","v":2},{"$f":"'H. Access Control'!K21","v":0},{"$f":"'H. Access Control'!Y21","v":0},{"$f":"'H. Access Control'!B21","v":"H.2.8"},{"$f":"'H. Access Control'!C21","v":"Are reviews of privileged systems conducted to ensure unauthorized privileges have not been obtained?"},{"$f":"'H. Access Control'!D21","v":0},{"$f":"'H. Access Control'!E21","v":0},{"$f":"'H. Access Control'!F21","v":0},{"$f":"'H. Access Control'!G21","v":"H.8 Admin, Superuser and Group Accounts"},{"$f":"'H. Access Control'!H21","v":"9.2.5.d"},{"$f":"'H. Access Control'!I21","v":"Review of User Access Rights"},null,"DS5.4","User account management","12.5.5","IS.2.A.1.3","DS5.4"]
[{"$f":"'H. Access Control'!A22","v":3208},{"$f":"'H. Access Control'!J22","v":2},{"$f":"'H. Access Control'!K22","v":0},{"$f":"'H. Access Control'!Y22","v":0},{"$f":"'H. Access Control'!B22","v":"H.2.9"},{"$f":"'H. Access Control'!C22","v":"Are privileged user access rights reviewed at least quarterly?"},{"$f":"'H. Access Control'!D22","v":0},{"$f":"'H. Access Control'!E22","v":0},{"$f":"'H. Access Control'!F22","v":0},{"$f":"'H. Access Control'!G22","v":"H.8 Admin, Superuser and Group Accounts"},{"$f":"'H. Access Control'!H22","v":"9.2.5.c"},{"$f":"'H. Access Control'!I22","v":"Review of User Access Rights"},null,"DS5.4","User account management","N/A","IS.2.A.4","DS5.4"]
[{"$f":"'H. Access Control'!A23","v":2656},{"$f":"'H. Access Control'!J23","v":2},{"$f":"'H. Access Control'!K23","v":0},{"$f":"'H. Access Control'!Y23","v":0},{"$f":"'H. Access Control'!B23","v":"H.2.10"},{"$f":"'H. Access Control'!C23","v":"Are changes to privileged user access rights logged?"},{"$f":"'H. Access Control'!D23","v":0},{"$f":"'H. Access Control'!E23","v":0},{"$f":"'H. Access Control'!F23","v":0},{"$f":"'H. Access Control'!G23","v":"H.8 Admin, Superuser and Group Accounts"},{"$f":"'H. Access Control'!H23","v":"9.2.5.e"},{"$f":"'H. Access Control'!I23","v":"Review of User Access Rights"},null,"DS5.4","User account management",6.4,"IS.2.A.2","DS5.4"]
[{"$f":"'H. Access Control'!A24","v":3209},{"$f":"'H. Access Control'!J24","v":2},{"$f":"'H. Access Control'!K24","v":0},{"$f":"'H. Access Control'!Y24","v":0},{"$f":"'H. Access Control'!B24","v":"H.2.11"},{"$f":"'H. Access Control'!C24","v":"Are there logon banners for all electronic systems access?"},{"$f":"'H. Access Control'!D24","v":0},{"$f":"'H. Access Control'!E24","v":0},{"$f":"'H. Access Control'!F24","v":0},{"$f":"'H. Access Control'!G24","v":"L.1 Presence of Log-on Banners"},{"$f":"'H. Access Control'!H24","v":"9.4.2.b"},{"$f":"'H. Access Control'!I24","v":"Secure Log-On Procedures"},null,"DS5.3","Identity management","N/A","IS.2.A.8 IS.2.B.16 IS.2.C.11 IS.2.G.6","DS5.4, DS5.7"]
[{"$f":"'H. Access Control'!A25","v":2006},{"$f":"'H. Access Control'!J25","v":2},{"$f":"'H. Access Control'!K25","v":0},{"$f":"'H. Access Control'!Y25","v":0},{"$f":"'H. Access Control'!B25","v":"H.2.12"},{"$f":"'H. Access Control'!C25","v":"Upon logon failure, does the error message describe the cause of the failure to the user (Invalid password, invalid user ID, etc.)?"},{"$f":"'H. Access Control'!D25","v":0},{"$f":"'H. Access Control'!E25","v":0},{"$f":"'H. Access Control'!F25","v":0},{"$f":"'H. Access Control'!G25","v":0},{"$f":"'H. Access Control'!H25","v":"9.4.2.d"},{"$f":"'H. Access Control'!I25","v":"Secure Log-On Procedures"},null,"DS5.3","Identity management","N/A","IS.2.A.8","DS5.4, DS5.7"]
[{"$f":"'H. Access Control'!A26","v":2007},{"$f":"'H. Access Control'!J26","v":2},{"$f":"'H. Access Control'!K26","v":0},{"$f":"'H. Access Control'!Y26","v":0},{"$f":"'H. Access Control'!B26","v":"H.2.13"},{"$f":"'H. Access Control'!C26","v":"Upon successful logon, does a message indicate the last time of successful logon?"},{"$f":"'H. Access Control'!D26","v":0},{"$f":"'H. Access Control'!E26","v":0},{"$f":"'H. Access Control'!F26","v":0},{"$f":"'H. Access Control'!G26","v":0},{"$f":"'H. Access Control'!H26","v":"9.4.2.h"},{"$f":"'H. Access Control'!I26","v":"Secure Log-On Procedures"},null,"DS5.3","Identity management","N/A","N/A","DS5.4, DS5.7"]
[{"$f":"'H. Access Control'!A27","v":1910},{"$f":"'H. Access Control'!J27","v":2},{"$f":"'H. Access Control'!K27","v":0},{"$f":"'H. Access Control'!Y27","v":0},{"$f":"'H. Access Control'!B27","v":"H.2.14"},{"$f":"'H. Access Control'!C27","v":"Is multi-factor authentication deployed for “high-risk” environments?"},{"$f":"'H. Access Control'!D27","v":0},{"$f":"'H. Access Control'!E27","v":0},{"$f":"'H. Access Control'!F27","v":0},{"$f":"'H. Access Control'!G27","v":"H.7 Restrictions and Multifactor Authentication"},{"$f":"'H. Access Control'!H27","v":"9.1.2.e"},{"$f":"'H. Access Control'!I27","v":"Access to networks and network services"},null,"DS5.3","Identity management",8.3000000000000007,"IS.2.A.4.5 E-BANK.1.4.4.1","DS5.3"]
[{"$f":"'H. Access Control'!A28","v":1912},{"$f":"'H. Access Control'!J28","v":2},{"$f":"'H. Access Control'!K28","v":0},{"$f":"'H. Access Control'!Y28","v":0},{"$f":"'H. Access Control'!B28","v":"H.2.15"},{"$f":"'H. Access Control'!C28","v":"Do all users have a unique user ID when accessing applications?"},{"$f":"'H. Access Control'!D28","v":0},{"$f":"'H. Access Control'!E28","v":0},{"$f":"'H. Access Control'!F28","v":0},{"$f":"'H. Access Control'!G28","v":0},{"$f":"'H. Access Control'!H28","v":"9.2.1.a"},{"$f":"'H. Access Control'!I28","v":"User registration and de-registration"},null,"DS5.3","Identity management","8.1.1","E-BANK.1.4.6.1","DS5.3"]
[{"$f":"'H. Access Control'!A29","v":2657},{"$f":"'H. Access Control'!J29","v":2},{"$f":"'H. Access Control'!K29","v":0},{"$f":"'H. Access Control'!Y29","v":0},{"$f":"'H. Access Control'!B29","v":"H.2.16"},{"$f":"'H. Access Control'!C29","v":"Is the use of system utilities restricted to authorized users only?"},{"$f":"'H. Access Control'!D29","v":0},{"$f":"'H. Access Control'!E29","v":0},{"$f":"'H. Access Control'!F29","v":0},{"$f":"'H. Access Control'!G29","v":0},{"$f":"'H. Access Control'!H29","v":"9.4.4"},{"$f":"'H. Access Control'!I29","v":"Use of privileged utility programs"},null,"AI6.3","Emergency changes","N/A","IS.2.A.1.4 IS.2.C.7","AI6.3, DS5.7"]
[{"$f":"'H. Access Control'!A30","v":3210},{"$f":"'H. Access Control'!J30","v":2},{"$f":"'H. Access Control'!K30","v":0},{"$f":"'H. Access Control'!Y30","v":0},{"$f":"'H. Access Control'!B30","v":"H.2.17"},{"$f":"'H. Access Control'!C30","v":"Do inactive workstation lock within 15 minutes?"},{"$f":"'H. Access Control'!D30","v":0},{"$f":"'H. Access Control'!E30","v":0},{"$f":"'H. Access Control'!F30","v":0},{"$f":"'H. Access Control'!G30","v":"H.5 Controls for Unattended Systems"},{"$f":"'H. Access Control'!H30","v":"9.4.2.k"},{"$f":"'H. Access Control'!I30","v":"Secure Log-On Procedures"},null,"DS5.3","Identity management","8.1.8","IS.2.D.6","DS5.7"]
[{"$f":"'H. Access Control'!A31","v":3211},{"$f":"'H. Access Control'!J31","v":2},{"$f":"'H. Access Control'!K31","v":0},{"$f":"'H. Access Control'!Y31","v":0},{"$f":"'H. Access Control'!B31","v":"H.2.18"},{"$f":"'H. Access Control'!C31","v":"Do inactive sessions timeout within 15 minutes?"},{"$f":"'H. Access Control'!D31","v":0},{"$f":"'H. Access Control'!E31","v":0},{"$f":"'H. Access Control'!F31","v":0},{"$f":"'H. Access Control'!G31","v":"H.5 Controls for Unattended Systems"},{"$f":"'H. Access Control'!H31","v":"9.4.2.k"},{"$f":"'H. Access Control'!I31","v":"Secure Log-On Procedures"},null,"DS5.3","Identity management","8.1.6","IS.2.D.6 WPS.2.9.4.1 RPS.2.C.3","DS5.7"]
[{"$f":"'H. Access Control'!A32","v":1948},{"$f":"'H. Access Control'!J32","v":1},{"$f":"'H. Access Control'!K32","v":0},{"$f":"'H. Access Control'!Y32","v":1},{"$f":"'H. Access Control'!B32","v":"H.3"},{"$f":"'H. Access Control'!C32","v":"Are passwords required to access systems transmitting, processing or storing Scoped Systems and Data?"},{"$f":"'H. Access Control'!D32","v":0},{"$f":"'H. Access Control'!E32","v":0},{"$f":"'H. Access Control'!F32","v":0},{"$f":"'H. Access Control'!G32","v":"H.1 Password Controls"},{"$f":"'H. Access Control'!H32","v":"9.4.3"},{"$f":"'H. Access Control'!I32","v":"Password Management System"},null,"DS5.3","Identity management",8.1,"N/A","DS5.3"]
[{"$f":"'H. Access Control'!A33","v":1949},{"$f":"'H. Access Control'!J33","v":2},{"$f":"'H. Access Control'!K33","v":0},{"$f":"'H. Access Control'!Y33","v":0},{"$f":"'H. Access Control'!B33","v":"H.3.1"},{"$f":"'H. Access Control'!C33","v":"Is there a password policy for systems that transmit, process or store Scoped Systems and Data that has been approved by management and communicated to appropriate constituents? If yes, does it include:"},{"$f":"'H. Access Control'!D33","v":0},{"$f":"'H. Access Control'!E33","v":0},{"$f":"'H. Access Control'!F33","v":0},{"$f":"'H. Access Control'!G33","v":"H. Access Control"},{"$f":"'H. Access Control'!H33","v":"9.4.3"},{"$f":"'H. Access Control'!I33","v":"Password Management System"},null,"DS5.3","Identity management",8.1,"IS.2.A.14","DS5.3"]
[{"$f":"'H. Access Control'!A34","v":2661},{"$f":"'H. Access Control'!J34","v":3},{"$f":"'H. Access Control'!K34","v":0},{"$f":"'H. Access Control'!Y34","v":0},{"$f":"'H. Access Control'!B34","v":"H.3.1.1"},{"$f":"'H. Access Control'!C34","v":"Keep passwords confidential?"},{"$f":"'H. Access Control'!D34","v":0},{"$f":"'H. Access Control'!E34","v":0},{"$f":"'H. Access Control'!F34","v":0},{"$f":"'H. Access Control'!G34","v":"H. Access Control"},{"$f":"'H. Access Control'!H34","v":"9.3.1.a"},{"$f":"'H. Access Control'!I34","v":"User responsibilities"},null,"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, DS5.4"]
[{"$f":"'H. Access Control'!A35","v":2662},{"$f":"'H. Access Control'!J35","v":3},{"$f":"'H. Access Control'!K35","v":0},{"$f":"'H. Access Control'!Y35","v":0},{"$f":"'H. Access Control'!B35","v":"H.3.1.2"},{"$f":"'H. Access Control'!C35","v":"Not keep a record of passwords (paper, software file or handheld device)?"},{"$f":"'H. Access Control'!D35","v":0},{"$f":"'H. Access Control'!E35","v":0},{"$f":"'H. Access Control'!F35","v":0},{"$f":"'H. Access Control'!G35","v":"H. Access Control"},{"$f":"'H. Access Control'!H35","v":"9.3.1.b"},{"$f":"'H. Access Control'!I35","v":"User responsibilities"},null,"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, DS5.4"]
[{"$f":"'H. Access Control'!A36","v":1977},{"$f":"'H. Access Control'!J36","v":3},{"$f":"'H. Access Control'!K36","v":0},{"$f":"'H. Access Control'!Y36","v":0},{"$f":"'H. Access Control'!B36","v":"H.3.1.3"},{"$f":"'H. Access Control'!C36","v":"Change passwords when there is an indication of possible system or password compromise?"},{"$f":"'H. Access Control'!D36","v":0},{"$f":"'H. Access Control'!E36","v":0},{"$f":"'H. Access Control'!F36","v":0},{"$f":"'H. Access Control'!G36","v":"H. Access Control"},{"$f":"'H. Access Control'!H36","v":"9.3.1.c"},{"$f":"'H. Access Control'!I36","v":"User responsibilities"},null,"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, DS5.4"]
[{"$f":"'H. Access Control'!A37","v":1978},{"$f":"'H. Access Control'!J37","v":3},{"$f":"'H. Access Control'!K37","v":0},{"$f":"'H. Access Control'!Y37","v":0},{"$f":"'H. Access Control'!B37","v":"H.3.1.4"},{"$f":"'H. Access Control'!C37","v":"Change passwords at regular intervals?"},{"$f":"'H. Access Control'!D37","v":0},{"$f":"'H. Access Control'!E37","v":0},{"$f":"'H. Access Control'!F37","v":0},{"$f":"'H. Access Control'!G37","v":"H. Access Control"},{"$f":"'H. Access Control'!H37","v":"9.4.3.e"},{"$f":"'H. Access Control'!I37","v":"Password Management System"},null,"PO6.2","Enterprise IT risk and internal control framework","8.2.4","IS.2.A.4.3 E-BANK.1.4.5.5 RPS.2.C.3","PO6.2, DS5.4"]
[{"$f":"'H. Access Control'!A38","v":2663},{"$f":"'H. Access Control'!J38","v":3},{"$f":"'H. Access Control'!K38","v":0},{"$f":"'H. Access Control'!Y38","v":0},{"$f":"'H. Access Control'!B38","v":"H.3.1.5"},{"$f":"'H. Access Control'!C38","v":"Change temporary passwords at first logon?"},{"$f":"'H. Access Control'!D38","v":0},{"$f":"'H. Access Control'!E38","v":0},{"$f":"'H. Access Control'!F38","v":0},{"$f":"'H. Access Control'!G38","v":"H. Access Control"},{"$f":"'H. Access Control'!H38","v":"9.4.3.d"},{"$f":"'H. Access Control'!I38","v":"Password Management System"},null,"PO6.2","Enterprise IT risk and internal control framework","8.2.6","E-BANK.1.4.5.9","PO6.2, DS5.4"]
[{"$f":"'H. Access Control'!A39","v":1979},{"$f":"'H. Access Control'!J39","v":3},{"$f":"'H. Access Control'!K39","v":0},{"$f":"'H. Access Control'!Y39","v":0},{"$f":"'H. Access Control'!B39","v":"H.3.1.6"},{"$f":"'H. Access Control'!C39","v":"Not include passwords in automated logon processes? (stored in a macro or function key)?"},{"$f":"'H. Access Control'!D39","v":0},{"$f":"'H. Access Control'!E39","v":0},{"$f":"'H. Access Control'!F39","v":0},{"$f":"'H. Access Control'!G39","v":"H. Access Control"},{"$f":"'H. Access Control'!H39","v":"9.3.1.f"},{"$f":"'H. Access Control'!I39","v":"User responsibilities"},null,"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, DS5.4"]
[{"$f":"'H. Access Control'!A40","v":1981},{"$f":"'H. Access Control'!J40","v":3},{"$f":"'H. Access Control'!K40","v":0},{"$f":"'H. Access Control'!Y40","v":0},{"$f":"'H. Access Control'!B40","v":"H.3.1.7"},{"$f":"'H. Access Control'!C40","v":"Terminate or secure active sessions when finished?"},{"$f":"'H. Access Control'!D40","v":0},{"$f":"'H. Access Control'!E40","v":0},{"$f":"'H. Access Control'!F40","v":0},{"$f":"'H. Access Control'!G40","v":"H. Access Control"},{"$f":"'H. Access Control'!H40","v":"11.2.8.a"},{"$f":"'H. Access Control'!I40","v":"Unattended User Equipment"},null,"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, DS5.7"]
[{"$f":"'H. Access Control'!A41","v":2664},{"$f":"'H. Access Control'!J41","v":3},{"$f":"'H. Access Control'!K41","v":0},{"$f":"'H. Access Control'!Y41","v":0},{"$f":"'H. Access Control'!B41","v":"H.3.1.8"},{"$f":"'H. Access Control'!C41","v":"Logoff terminals, PC or servers when the session is finished?"},{"$f":"'H. Access Control'!D41","v":0},{"$f":"'H. Access Control'!E41","v":0},{"$f":"'H. Access Control'!F41","v":0},{"$f":"'H. Access Control'!G41","v":"H. Access Control"},{"$f":"'H. Access Control'!H41","v":"11.2.8.b"},{"$f":"'H. Access Control'!I41","v":"Unattended User Equipment"},null,"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, DS5.7"]
[{"$f":"'H. Access Control'!A42","v":1980},{"$f":"'H. Access Control'!J42","v":3},{"$f":"'H. Access Control'!K42","v":0},{"$f":"'H. Access Control'!Y42","v":0},{"$f":"'H. Access Control'!B42","v":"H.3.1.9"},{"$f":"'H. Access Control'!C42","v":"Lock (using key lock or equivalent control) when systems are unattended?"},{"$f":"'H. Access Control'!D42","v":0},{"$f":"'H. Access Control'!E42","v":0},{"$f":"'H. Access Control'!F42","v":0},{"$f":"'H. Access Control'!G42","v":"H. Access Control"},{"$f":"'H. Access Control'!H42","v":"11.2.8.c"},{"$f":"'H. Access Control'!I42","v":"Unattended User Equipment"},null,"PO6.2","Enterprise IT risk and internal control framework","N/A","N/A","PO6.2, DS5.7"]
[{"$f":"'H. Access Control'!A43","v":1974},{"$f":"'H. Access Control'!J43","v":3},{"$f":"'H. Access Control'!K43","v":0},{"$f":"'H. Access Control'!Y43","v":0},{"$f":"'H. Access Control'!B43","v":"H.3.1.10"},{"$f":"'H. Access Control'!C43","v":"Prohibit users from sharing passwords?"},{"$f":"'H. Access Control'!D43","v":0},{"$f":"'H. Access Control'!E43","v":0},{"$f":"'H. Access Control'!F43","v":0},{"$f":"'H. Access Control'!G43","v":"H. Access Control"},{"$f":"'H. Access Control'!H43","v":"9.3.1.g"},{"$f":"'H. Access Control'!I43","v":"User responsibilities"},null,"DS5.3","Identity management","N/A","IS.2.A.4.1","DS5.3"]
[{"$f":"'H. Access Control'!A44","v":1975},{"$f":"'H. Access Control'!J44","v":2},{"$f":"'H. Access Control'!K44","v":0},{"$f":"'H. Access Control'!Y44","v":0},{"$f":"'H. Access Control'!B44","v":"H.3.2"},{"$f":"'H. Access Control'!C44","v":"Are strong passwords required on systems transmitting, processing storing Scoped Systems and Data?"},{"$f":"'H. Access Control'!D44","v":0},{"$f":"'H. Access Control'!E44","v":0},{"$f":"'H. Access Control'!F44","v":0},{"$f":"'H. Access Control'!G44","v":"H.1 Password Controls"},{"$f":"'H. Access Control'!H44","v":"9.3.1.d,                                    9.4.3.c"},{"$f":"'H. Access Control'!I44","v":"Use of secret authentication information,                                    Password management system"},null,"DS5.3","Identity management","8.2.3","IS.2.A.4.4 RPS.1.2.2.2 RPS.2.C.2.4","DS5.3"]
[{"$f":"'H. Access Control'!A45","v":2008},{"$f":"'H. Access Control'!J45","v":2},{"$f":"'H. Access Control'!K45","v":0},{"$f":"'H. Access Control'!Y45","v":0},{"$f":"'H. Access Control'!B45","v":"H.3.3"},{"$f":"'H. Access Control'!C45","v":"Are password files and application system data stored in different file systems?"},{"$f":"'H. Access Control'!D45","v":0},{"$f":"'H. Access Control'!E45","v":0},{"$f":"'H. Access Control'!F45","v":0},{"$f":"'H. Access Control'!G45","v":"H.1 Password Controls"},{"$f":"'H. Access Control'!H45","v":"9.4.3.h"},{"$f":"'H. Access Control'!I45","v":"Password Management System"},null,"DS5.3","Identity management","N/A","IS.2.A.6","DS5.4"]
[{"$f":"'H. Access Control'!A46","v":3212},{"$f":"'H. Access Control'!J46","v":2},{"$f":"'H. Access Control'!K46","v":0},{"$f":"'H. Access Control'!Y46","v":0},{"$f":"'H. Access Control'!B46","v":"H.3.4"},{"$f":"'H. Access Control'!C46","v":"Are user ID and passwords communicated/distributed via separate media (e-mail and phone)?"},{"$f":"'H. Access Control'!D46","v":0},{"$f":"'H. Access Control'!E46","v":0},{"$f":"'H. Access Control'!F46","v":0},{"$f":"'H. Access Control'!G46","v":"H.1 Password Controls"},{"$f":"'H. Access Control'!H46","v":"9.2.4.d "},{"$f":"'H. Access Control'!I46","v":"Management of secret authentication information for users"},null,null,null,"N/A","IS.2.A.2.6 E-BANK.1.4.5.7","N/A"]
[{"$f":"'H. Access Control'!A47","v":1964},{"$f":"'H. Access Control'!J47","v":2},{"$f":"'H. Access Control'!K47","v":0},{"$f":"'H. Access Control'!Y47","v":0},{"$f":"'H. Access Control'!B47","v":"H.3.5"},{"$f":"'H. Access Control'!C47","v":"Are new constituents issued random initial single use passwords?"},{"$f":"'H. Access Control'!D47","v":0},{"$f":"'H. Access Control'!E47","v":0},{"$f":"'H. Access Control'!F47","v":0},{"$f":"'H. Access Control'!G47","v":"H.1 Password Controls"},{"$f":"'H. Access Control'!H47","v":"9.4.3.b"},{"$f":"'H. Access Control'!I47","v":"Password Management System"},null,"DS5.3","Identity management","8.2.6","N/A","DS5.3"]
[{"$f":"'H. Access Control'!A48","v":3213},{"$f":"'H. Access Control'!J48","v":2},{"$f":"'H. Access Control'!K48","v":0},{"$f":"'H. Access Control'!Y48","v":0},{"$f":"'H. Access Control'!B48","v":"H.3.6"},{"$f":"'H. Access Control'!C48","v":"Do temporary passwords expire within 10 days?"},{"$f":"'H. Access Control'!D48","v":0},{"$f":"'H. Access Control'!E48","v":0},{"$f":"'H. Access Control'!F48","v":0},{"$f":"'H. Access Control'!G48","v":"H.1 Password Controls"},{"$f":"'H. Access Control'!H48","v":"NA"},{"$f":"'H. Access Control'!I48","v":0},null,null,null,"N/A","IS.2.A.5.1","N/A"]
[{"$f":"'H. Access Control'!A49","v":3214},{"$f":"'H. Access Control'!J49","v":2},{"$f":"'H. Access Control'!K49","v":0},{"$f":"'H. Access Control'!Y49","v":0},{"$f":"'H. Access Control'!B49","v":"H.3.7"},{"$f":"'H. Access Control'!C49","v":"Is a user’s identity verified prior to resetting a password?"},{"$f":"'H. Access Control'!D49","v":0},{"$f":"'H. Access Control'!E49","v":0},{"$f":"'H. Access Control'!F49","v":0},{"$f":"'H. Access Control'!G49","v":"H.1 Password Controls"},{"$f":"'H. Access Control'!H49","v":"9.2.4.c"},{"$f":"'H. Access Control'!I49","v":"Management of secret authentication information for users"},null,"DS5.3","Identity management","8.2.2","N/A","DS5.3"]
[{"$f":"'H. Access Control'!A50","v":2659},{"$f":"'H. Access Control'!J50","v":2},{"$f":"'H. Access Control'!K50","v":0},{"$f":"'H. Access Control'!Y50","v":0},{"$f":"'H. Access Control'!B50","v":"H.3.8"},{"$f":"'H. Access Control'!C50","v":"Are vendor default passwords removed, disabled or changed prior to placing the device or system into production?"},{"$f":"'H. Access Control'!D50","v":0},{"$f":"'H. Access Control'!E50","v":0},{"$f":"'H. Access Control'!F50","v":0},{"$f":"'H. Access Control'!G50","v":"H.1 Password Controls"},{"$f":"'H. Access Control'!H50","v":"9.2.4.g"},{"$f":"'H. Access Control'!I50","v":"Management of secret authentication information for users"},null,"DS5.3","Identity management","6.3.1","IS.2.A.1","DS5.3"]
[{"$f":"'H. Access Control'!A51","v":2971},{"$f":"'H. Access Control'!J51","v":2},{"$f":"'H. Access Control'!K51","v":0},{"$f":"'H. Access Control'!Y51","v":0},{"$f":"'H. Access Control'!B51","v":"H.3.9"},{"$f":"'H. Access Control'!C51","v":"Is password reset authority restricted to authorized persons and/or an automated password reset tool?"},{"$f":"'H. Access Control'!D51","v":0},{"$f":"'H. Access Control'!E51","v":0},{"$f":"'H. Access Control'!F51","v":0},{"$f":"'H. Access Control'!G51","v":"H.1 Password Controls"},{"$f":"'H. Access Control'!H51","v":"9.3.1.f"},{"$f":"'H. Access Control'!I51","v":"User responsibilities"},null,null,null,"N/A","RPS.2.B.7","DS5.3"]
[{"$f":"'H. Access Control'!A52","v":2028},{"$f":"'H. Access Control'!J52","v":1},{"$f":"'H. Access Control'!K52","v":0},{"$f":"'H. Access Control'!Y52","v":1},{"$f":"'H. Access Control'!B52","v":"H.4"},{"$f":"'H. Access Control'!C52","v":"Is remote access permitted?"},{"$f":"'H. Access Control'!D52","v":0},{"$f":"'H. Access Control'!E52","v":0},{"$f":"'H. Access Control'!F52","v":0},{"$f":"'H. Access Control'!G52","v":0},{"$f":"'H. Access Control'!H52","v":6.2},{"$f":"'H. Access Control'!I52","v":"Mobile devices and teleworking"},null,null,null,"N/A","N/A","AI1.2, AI2.4, DS5.7, DS5.10, DS5.11"]
[{"$f":"'H. Access Control'!A53","v":3215},{"$f":"'H. Access Control'!J53","v":2},{"$f":"'H. Access Control'!K53","v":0},{"$f":"'H. Access Control'!Y53","v":0},{"$f":"'H. Access Control'!B53","v":"H.4.1"},{"$f":"'H. Access Control'!C53","v":"Is there a remote access policy for systems transmitting, processing and storing Scoped Systems and Data that has been approved by management and communicated to appropriate constituents?"},{"$f":"'H. Access Control'!D53","v":0},{"$f":"'H. Access Control'!E53","v":0},{"$f":"'H. Access Control'!F53","v":0},{"$f":"'H. Access Control'!G53","v":0},{"$f":"'H. Access Control'!H53","v":"6.2.1                                        6.2.2"},{"$f":"'H. Access Control'!I53","v":"Mobile device policy,                  Teleworking"},null,"PO6.2","Enterprise IT risk and internal control framework","12.3.2","BCP.1.4.3.7 IS.2.B.3","PO6.2, DS5.2, DS5.3, DS5.7"]
[{"$f":"'H. Access Control'!A54","v":2972},{"$f":"'H. Access Control'!J54","v":2},{"$f":"'H. Access Control'!K54","v":0},{"$f":"'H. Access Control'!Y54","v":0},{"$f":"'H. Access Control'!B54","v":"H.4.2"},{"$f":"'H. Access Control'!C54","v":"Is split tunneling or bridged internet connections allowed by policy and/or technical control?"},{"$f":"'H. Access Control'!D54","v":0},{"$f":"'H. Access Control'!E54","v":0},{"$f":"'H. Access Control'!F54","v":0},{"$f":"'H. Access Control'!G54","v":0},{"$f":"'H. Access Control'!H54","v":"NA"},{"$f":"'H. Access Control'!I54","v":""},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'H. Access Control'!A55","v":3216},{"$f":"'H. Access Control'!J55","v":2},{"$f":"'H. Access Control'!K55","v":0},{"$f":"'H. Access Control'!Y55","v":0},{"$f":"'H. Access Control'!B55","v":"H.4.3"},{"$f":"'H. Access Control'!C55","v":"Is only company owned equipment permitted to connect remotely?"},{"$f":"'H. Access Control'!D55","v":0},{"$f":"'H. Access Control'!E55","v":0},{"$f":"'H. Access Control'!F55","v":0},{"$f":"'H. Access Control'!G55","v":0},{"$f":"'H. Access Control'!H55","v":"6.2.1                                        6.2.2 "},{"$f":"'H. Access Control'!I55","v":"Mobile device policy,                  Teleworking"},null,"DS5.9","Malicious software prevention, detection and correction","N/A","N/A","DS5.9, DS5.11"]
[{"$f":"'H. Access Control'!A56","v":3217},{"$f":"'H. Access Control'!J56","v":2},{"$f":"'H. Access Control'!K56","v":0},{"$f":"'H. Access Control'!Y56","v":0},{"$f":"'H. Access Control'!B56","v":"H.4.4"},{"$f":"'H. Access Control'!C56","v":"Is remote desktop technology (Citrix) used to access the network remotely?"},{"$f":"'H. Access Control'!D56","v":0},{"$f":"'H. Access Control'!E56","v":0},{"$f":"'H. Access Control'!F56","v":0},{"$f":"'H. Access Control'!G56","v":0},{"$f":"'H. Access Control'!H56","v":"6.2.2.d"},{"$f":"'H. Access Control'!I56","v":"Teleworking"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'H. Access Control'!A57","v":3218},{"$f":"'H. Access Control'!J57","v":2},{"$f":"'H. Access Control'!K57","v":0},{"$f":"'H. Access Control'!Y57","v":0},{"$f":"'H. Access Control'!B57","v":"H.4.5"},{"$f":"'H. Access Control'!C57","v":"Are remote users prevented from copying data to remote devices?"},{"$f":"'H. Access Control'!D57","v":0},{"$f":"'H. Access Control'!E57","v":0},{"$f":"'H. Access Control'!F57","v":0},{"$f":"'H. Access Control'!G57","v":0},{"$f":"'H. Access Control'!H57","v":"6.2.2.d"},{"$f":"'H. Access Control'!I57","v":"Teleworking"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'H. Access Control'!A58","v":2964},{"$f":"'H. Access Control'!J58","v":2},{"$f":"'H. Access Control'!K58","v":0},{"$f":"'H. Access Control'!Y58","v":0},{"$f":"'H. Access Control'!B58","v":"H.4.6"},{"$f":"'H. Access Control'!C58","v":"Are encrypted communications required for all remote connections?"},{"$f":"'H. Access Control'!D58","v":0},{"$f":"'H. Access Control'!E58","v":0},{"$f":"'H. Access Control'!F58","v":0},{"$f":"'H. Access Control'!G58","v":0},{"$f":"'H. Access Control'!H58","v":"10.1.1.c"},{"$f":"'H. Access Control'!I58","v":"Policy on the use of cryptographic controls"},null,null,null,"N/A","IS.2.B.15","PO6, AI2, DS5"]
[{"$f":"'H. Access Control'!A59","v":2048},{"$f":"'H. Access Control'!J59","v":2},{"$f":"'H. Access Control'!K59","v":0},{"$f":"'H. Access Control'!Y59","v":0},{"$f":"'H. Access Control'!B59","v":"H.4.7"},{"$f":"'H. Access Control'!C59","v":"Is multi-factor authentication required for remote access?"},{"$f":"'H. Access Control'!D59","v":0},{"$f":"'H. Access Control'!E59","v":0},{"$f":"'H. Access Control'!F59","v":0},{"$f":"'H. Access Control'!G59","v":"H.7 Restrictions and Multifactor Authentication"},{"$f":"'H. Access Control'!H59","v":"9.1.2.d"},{"$f":"'H. Access Control'!I59","v":"Access to networks and network services"},null,"PO6.2","Enterprise IT risk and internal control framework",8.3000000000000007,"IS.2.A.13 IS.2.B.17.3","PO6.2, DS5.2, DS5.3, DS5.7"]
[{"$f":"'H. Access Control'!A60","v":0},{"$f":"'H. Access Control'!J60","v":0},{"$f":"'H. Access Control'!K60","v":0},{"$f":"'H. Access Control'!Y60","v":0},{"$f":"'H. Access Control'!B60","v":0},{"$f":"'H. Access Control'!C60","v":0},{"$f":"'H. Access Control'!D60","v":0},{"$f":"'H. Access Control'!E60","v":0},{"$f":"'H. Access Control'!F60","v":0},{"$f":"'H. Access Control'!G60","v":0},{"$f":"'H. Access Control'!H60","v":0},{"$f":"'H. Access Control'!I60","v":0}]
[]
[{"$f":"'I. Info Sys AD&M'!B1","v":"I. Information Systems Acquisition Development & Maintenance"},null,null,null,{"$f":"'I. Info Sys AD&M'!B1","v":"I. Information Systems Acquisition Development & Maintenance"}]
[{"$f":"'I. Info Sys AD&M'!A5","v":2665},{"$f":"'I. Info Sys AD&M'!J5","v":1},{"$f":"'I. Info Sys AD&M'!K5","v":0},{"$f":"'I. Info Sys AD&M'!Y5","v":1},{"$f":"'I. Info Sys AD&M'!B5","v":"I.1"},{"$f":"'I. Info Sys AD&M'!C5","v":"Are business information systems used to transmit, process or store Scoped Systems and Data? If yes, are:"},{"$f":"'I. Info Sys AD&M'!D5","v":0},{"$f":"'I. Info Sys AD&M'!E5","v":0},{"$f":"'I. Info Sys AD&M'!F5","v":0},{"$f":"'I. Info Sys AD&M'!G5","v":0},{"$f":"'I. Info Sys AD&M'!H5","v":14.1},{"$f":"'I. Info Sys AD&M'!I5","v":"Security requirements of information systems"},null,"AI1.2","Risk analysis report","N/A","N/A","AI1.2, AI2.4, AI3.2"]
[{"$f":"'I. Info Sys AD&M'!A6","v":2666},{"$f":"'I. Info Sys AD&M'!J6","v":2},{"$f":"'I. Info Sys AD&M'!K6","v":0},{"$f":"'I. Info Sys AD&M'!Y6","v":0},{"$f":"'I. Info Sys AD&M'!B6","v":"I.1.1"},{"$f":"'I. Info Sys AD&M'!C6","v":"Security requirements documented?"},{"$f":"'I. Info Sys AD&M'!D6","v":0},{"$f":"'I. Info Sys AD&M'!E6","v":0},{"$f":"'I. Info Sys AD&M'!F6","v":0},{"$f":"'I. Info Sys AD&M'!G6","v":"I.5 Procedure: b.1"},{"$f":"'I. Info Sys AD&M'!H6","v":"14.1.1 "},{"$f":"'I. Info Sys AD&M'!I6","v":"Information security requirements analysis and specification"},null,"AI1.2","Risk analysis report",12.1,"N/A","AI1.2, AI2.4, AI3.2"]
[{"$f":"'I. Info Sys AD&M'!A7","v":1795},{"$f":"'I. Info Sys AD&M'!J7","v":2},{"$f":"'I. Info Sys AD&M'!K7","v":0},{"$f":"'I. Info Sys AD&M'!Y7","v":0},{"$f":"'I. Info Sys AD&M'!B7","v":"I.1.2"},{"$f":"'I. Info Sys AD&M'!C7","v":"Information security reviews conducted and approved for the use or installation of open source software (Linux, Apache, etc.)?"},{"$f":"'I. Info Sys AD&M'!D7","v":0},{"$f":"'I. Info Sys AD&M'!E7","v":0},{"$f":"'I. Info Sys AD&M'!F7","v":0},{"$f":"'I. Info Sys AD&M'!G7","v":"I.5 Procedure: b.1"},{"$f":"'I. Info Sys AD&M'!H7","v":"14.1.1 "},{"$f":"'I. Info Sys AD&M'!I7","v":"Information security requirements analysis and specification"},null,"AI1.2","Risk analysis report","12.1.1","N/A","AI1.2, AI2.4, AI3.2"]
[{"$f":"'I. Info Sys AD&M'!A8","v":2058},{"$f":"'I. Info Sys AD&M'!J8","v":1},{"$f":"'I. Info Sys AD&M'!K8","v":0},{"$f":"'I. Info Sys AD&M'!Y8","v":1},{"$f":"'I. Info Sys AD&M'!B8","v":"I.2"},{"$f":"'I. Info Sys AD&M'!C8","v":"Is application development performed? If yes, does it provide:"},{"$f":"'I. Info Sys AD&M'!D8","v":0},{"$f":"'I. Info Sys AD&M'!E8","v":0},{"$f":"'I. Info Sys AD&M'!F8","v":0},{"$f":"'I. Info Sys AD&M'!G8","v":0},{"$f":"'I. Info Sys AD&M'!H8","v":"14.2.1"},{"$f":"'I. Info Sys AD&M'!I8","v":"Secure development policy"},null,"N/A",0,"N/A","N/A","AI2.4, AI7.4, AI7.6, DS11.3, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A9","v":2198},{"$f":"'I. Info Sys AD&M'!J9","v":2},{"$f":"'I. Info Sys AD&M'!K9","v":0},{"$f":"'I. Info Sys AD&M'!Y9","v":0},{"$f":"'I. Info Sys AD&M'!B9","v":"I.2.1"},{"$f":"'I. Info Sys AD&M'!C9","v":"Independent security evaluation or certification?"},{"$f":"'I. Info Sys AD&M'!D9","v":0},{"$f":"'I. Info Sys AD&M'!E9","v":0},{"$f":"'I. Info Sys AD&M'!F9","v":0},{"$f":"'I. Info Sys AD&M'!G9","v":0},{"$f":"'I. Info Sys AD&M'!H9","v":"NA"},{"$f":"'I. Info Sys AD&M'!I9","v":0},null,"N/A",0,"N/A","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A10","v":2111},{"$f":"'I. Info Sys AD&M'!J10","v":2},{"$f":"'I. Info Sys AD&M'!K10","v":0},{"$f":"'I. Info Sys AD&M'!Y10","v":0},{"$f":"'I. Info Sys AD&M'!B10","v":"I.2.2"},{"$f":"'I. Info Sys AD&M'!C10","v":"Formal application methodology (OWASP)?"},{"$f":"'I. Info Sys AD&M'!D10","v":0},{"$f":"'I. Info Sys AD&M'!E10","v":0},{"$f":"'I. Info Sys AD&M'!F10","v":0},{"$f":"'I. Info Sys AD&M'!G10","v":"I.2 Secure Systems Development Life Cycle (SDLC) code reviews"},{"$f":"'I. Info Sys AD&M'!H10","v":"14.2.1 "},{"$f":"'I. Info Sys AD&M'!I10","v":"Secure development policy"},null,"N/A",0,"N/A","IS.2.A.9 D&A.1.5.1.9","N/A"]
[{"$f":"'I. Info Sys AD&M'!A11","v":2125},{"$f":"'I. Info Sys AD&M'!J11","v":2},{"$f":"'I. Info Sys AD&M'!K11","v":0},{"$f":"'I. Info Sys AD&M'!Y11","v":0},{"$f":"'I. Info Sys AD&M'!B11","v":"I.2.3"},{"$f":"'I. Info Sys AD&M'!C11","v":"An authenticated and maintained state for every data transaction?"},{"$f":"'I. Info Sys AD&M'!D11","v":0},{"$f":"'I. Info Sys AD&M'!E11","v":0},{"$f":"'I. Info Sys AD&M'!F11","v":0},{"$f":"'I. Info Sys AD&M'!G11","v":0},{"$f":"'I. Info Sys AD&M'!H11","v":"14.1.3.b.1"},{"$f":"'I. Info Sys AD&M'!I11","v":"Protecting application services transactions"},null,"DS5.3","Identity management","4.1.1","IS.2.G.5","DS5.7"]
[{"$f":"'I. Info Sys AD&M'!A12","v":2126},{"$f":"'I. Info Sys AD&M'!J12","v":2},{"$f":"'I. Info Sys AD&M'!K12","v":0},{"$f":"'I. Info Sys AD&M'!Y12","v":0},{"$f":"'I. Info Sys AD&M'!B12","v":"I.2.4"},{"$f":"'I. Info Sys AD&M'!C12","v":"A means for secure session management?"},{"$f":"'I. Info Sys AD&M'!D12","v":0},{"$f":"'I. Info Sys AD&M'!E12","v":0},{"$f":"'I. Info Sys AD&M'!F12","v":0},{"$f":"'I. Info Sys AD&M'!G12","v":0},{"$f":"'I. Info Sys AD&M'!H12","v":"14.1.3.d"},{"$f":"'I. Info Sys AD&M'!I12","v":"Protecting application services transactions"},null,"DS5.3","Identity management","4.1.1","N/A","DS5.7"]
[{"$f":"'I. Info Sys AD&M'!A13","v":2129},{"$f":"'I. Info Sys AD&M'!J13","v":2},{"$f":"'I. Info Sys AD&M'!K13","v":0},{"$f":"'I. Info Sys AD&M'!Y13","v":0},{"$f":"'I. Info Sys AD&M'!B13","v":"I.2.5"},{"$f":"'I. Info Sys AD&M'!C13","v":"Comprehensive secure error handling?"},{"$f":"'I. Info Sys AD&M'!D13","v":0},{"$f":"'I. Info Sys AD&M'!E13","v":0},{"$f":"'I. Info Sys AD&M'!F13","v":0},{"$f":"'I. Info Sys AD&M'!G13","v":0},{"$f":"'I. Info Sys AD&M'!H13","v":"14.2.5 "},{"$f":"'I. Info Sys AD&M'!I13","v":"Secure system engineering principles"},null,"AI2.3","Application control and auditability","6.5.5","N/A","AI2.3"]
[{"$f":"'I. Info Sys AD&M'!A14","v":1269},{"$f":"'I. Info Sys AD&M'!J14","v":2},{"$f":"'I. Info Sys AD&M'!K14","v":0},{"$f":"'I. Info Sys AD&M'!Y14","v":0},{"$f":"'I. Info Sys AD&M'!B14","v":"I.2.6"},{"$f":"'I. Info Sys AD&M'!C14","v":"Audit log failures and generate an alert?"},{"$f":"'I. Info Sys AD&M'!D14","v":0},{"$f":"'I. Info Sys AD&M'!E14","v":0},{"$f":"'I. Info Sys AD&M'!F14","v":0},{"$f":"'I. Info Sys AD&M'!G14","v":0},{"$f":"'I. Info Sys AD&M'!H14","v":"12.4.1"},{"$f":"'I. Info Sys AD&M'!I14","v":"Event logging"},null,"AI2.3","Application control and auditability","10.5.5","N/A","AI2.3, DS5.7"]
[{"$f":"'I. Info Sys AD&M'!A15","v":2182},{"$f":"'I. Info Sys AD&M'!J15","v":2},{"$f":"'I. Info Sys AD&M'!K15","v":0},{"$f":"'I. Info Sys AD&M'!Y15","v":0},{"$f":"'I. Info Sys AD&M'!B15","v":"I.2.7"},{"$f":"'I. Info Sys AD&M'!C15","v":"Development, test, and staging environment separate from the production environment? If so how are they separated:"},{"$f":"'I. Info Sys AD&M'!D15","v":0},{"$f":"'I. Info Sys AD&M'!E15","v":0},{"$f":"'I. Info Sys AD&M'!F15","v":0},{"$f":"'I. Info Sys AD&M'!G15","v":0},{"$f":"'I. Info Sys AD&M'!H15","v":"12.1.4"},{"$f":"'I. Info Sys AD&M'!I15","v":"Separation of development, testing and operational environments"},null,"N/A",0,"6.4.1","D&A.1.9.1.6.4","N/A"]
[{"$f":"'I. Info Sys AD&M'!A16","v":849},{"$f":"'I. Info Sys AD&M'!J16","v":3},{"$f":"'I. Info Sys AD&M'!K16","v":0},{"$f":"'I. Info Sys AD&M'!Y16","v":0},{"$f":"'I. Info Sys AD&M'!B16","v":"I.2.7.1"},{"$f":"'I. Info Sys AD&M'!C16","v":"Logically?"},{"$f":"'I. Info Sys AD&M'!D16","v":0},{"$f":"'I. Info Sys AD&M'!E16","v":0},{"$f":"'I. Info Sys AD&M'!F16","v":0},{"$f":"'I. Info Sys AD&M'!G16","v":0},{"$f":"'I. Info Sys AD&M'!H16","v":"12.1.4"},{"$f":"'I. Info Sys AD&M'!I16","v":"Separation of development, testing and operational environments"},null,"N/A",0,"N/A","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A17","v":850},{"$f":"'I. Info Sys AD&M'!J17","v":3},{"$f":"'I. Info Sys AD&M'!K17","v":0},{"$f":"'I. Info Sys AD&M'!Y17","v":0},{"$f":"'I. Info Sys AD&M'!B17","v":"I.2.7.2"},{"$f":"'I. Info Sys AD&M'!C17","v":"Physically?"},{"$f":"'I. Info Sys AD&M'!D17","v":0},{"$f":"'I. Info Sys AD&M'!E17","v":0},{"$f":"'I. Info Sys AD&M'!F17","v":0},{"$f":"'I. Info Sys AD&M'!G17","v":0},{"$f":"'I. Info Sys AD&M'!H17","v":"12.1.4"},{"$f":"'I. Info Sys AD&M'!I17","v":"Separation of development, testing and operational environments"},null,"N/A",0,"N/A","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A18","v":852},{"$f":"'I. Info Sys AD&M'!J18","v":3},{"$f":"'I. Info Sys AD&M'!K18","v":0},{"$f":"'I. Info Sys AD&M'!Y18","v":0},{"$f":"'I. Info Sys AD&M'!B18","v":"I.2.7.3"},{"$f":"'I. Info Sys AD&M'!C18","v":"No segregation?"},{"$f":"'I. Info Sys AD&M'!D18","v":0},{"$f":"'I. Info Sys AD&M'!E18","v":0},{"$f":"'I. Info Sys AD&M'!F18","v":0},{"$f":"'I. Info Sys AD&M'!G18","v":0},{"$f":"'I. Info Sys AD&M'!H18","v":"12.1.4"},{"$f":"'I. Info Sys AD&M'!I18","v":"Separation of development, testing and operational environments"},null,"N/A",0,"N/A","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A19","v":2059},{"$f":"'I. Info Sys AD&M'!J19","v":2},{"$f":"'I. Info Sys AD&M'!K19","v":0},{"$f":"'I. Info Sys AD&M'!Y19","v":1},{"$f":"'I. Info Sys AD&M'!B19","v":"I.2.8"},{"$f":"'I. Info Sys AD&M'!C19","v":"Is there a formal Software Development Life Cycle (SDLC) process? If yes, does it include:"},{"$f":"'I. Info Sys AD&M'!D19","v":0},{"$f":"'I. Info Sys AD&M'!E19","v":0},{"$f":"'I. Info Sys AD&M'!F19","v":0},{"$f":"'I. Info Sys AD&M'!G19","v":"I.7 Application Security SDLC Phases"},{"$f":"'I. Info Sys AD&M'!H19","v":"14.2.1 "},{"$f":"'I. Info Sys AD&M'!I19","v":"Secure development policy"},null,"N/A",0,"N/A","IS.1.4.1.8 MGMT.1.6.1.3","AI2.4, AI7.4, AI7.6, DS11.3, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A20","v":2098},{"$f":"'I. Info Sys AD&M'!J20","v":3},{"$f":"'I. Info Sys AD&M'!K20","v":0},{"$f":"'I. Info Sys AD&M'!Y20","v":0},{"$f":"'I. Info Sys AD&M'!B20","v":"I.2.8.1"},{"$f":"'I. Info Sys AD&M'!C20","v":"Peer code review, integration testing, and acceptance testing?"},{"$f":"'I. Info Sys AD&M'!D20","v":0},{"$f":"'I. Info Sys AD&M'!E20","v":0},{"$f":"'I. Info Sys AD&M'!F20","v":0},{"$f":"'I. Info Sys AD&M'!G20","v":0},{"$f":"'I. Info Sys AD&M'!H20","v":"14.2.2 "},{"$f":"'I. Info Sys AD&M'!I20","v":"System change control procedures"},null,"AI2.6","Major upgrades to existing systems","6.3.2, 6.4.5.3","IS.2.H.2 IS.2.H.8 IS.2.H.9.1 D&A.1.5.1.4","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A21","v":847},{"$f":"'I. Info Sys AD&M'!J21","v":3},{"$f":"'I. Info Sys AD&M'!K21","v":0},{"$f":"'I. Info Sys AD&M'!Y21","v":0},{"$f":"'I. Info Sys AD&M'!B21","v":"I.2.8.2"},{"$f":"'I. Info Sys AD&M'!C21","v":"Separate source code repositories for production and non-production?"},{"$f":"'I. Info Sys AD&M'!D21","v":0},{"$f":"'I. Info Sys AD&M'!E21","v":0},{"$f":"'I. Info Sys AD&M'!F21","v":0},{"$f":"'I. Info Sys AD&M'!G21","v":0},{"$f":"'I. Info Sys AD&M'!H21","v":"9.4.5 "},{"$f":"'I. Info Sys AD&M'!I21","v":"Access control to program source code"},null,"AI2.4","Application security and availability","6.4.1","N/A","AI2.4, AI7.4, AI7.6, DS11.3, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A22","v":2668},{"$f":"'I. Info Sys AD&M'!J22","v":2},{"$f":"'I. Info Sys AD&M'!K22","v":0},{"$f":"'I. Info Sys AD&M'!Y22","v":0},{"$f":"'I. Info Sys AD&M'!B22","v":"I.2.9"},{"$f":"'I. Info Sys AD&M'!C22","v":"Do IT support personnel have access to program source libraries?"},{"$f":"'I. Info Sys AD&M'!D22","v":0},{"$f":"'I. Info Sys AD&M'!E22","v":0},{"$f":"'I. Info Sys AD&M'!F22","v":0},{"$f":"'I. Info Sys AD&M'!G22","v":0},{"$f":"'I. Info Sys AD&M'!H22","v":"9.4.5.c"},{"$f":"'I. Info Sys AD&M'!I22","v":"Access control to program source code"},null,"AI2.4","Application security and availability","6.4.2","IS.2.G.1","AI2.4, AI7.4, AI7.6, DS11.3, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A23","v":2669},{"$f":"'I. Info Sys AD&M'!J23","v":2},{"$f":"'I. Info Sys AD&M'!K23","v":0},{"$f":"'I. Info Sys AD&M'!Y23","v":0},{"$f":"'I. Info Sys AD&M'!B23","v":"I.2.10"},{"$f":"'I. Info Sys AD&M'!C23","v":"Is all access to program source libraries logged?"},{"$f":"'I. Info Sys AD&M'!D23","v":0},{"$f":"'I. Info Sys AD&M'!E23","v":0},{"$f":"'I. Info Sys AD&M'!F23","v":0},{"$f":"'I. Info Sys AD&M'!G23","v":0},{"$f":"'I. Info Sys AD&M'!H23","v":"9.4.5.f"},{"$f":"'I. Info Sys AD&M'!I23","v":"Access control to program source code"},null,"AI2.4","Application security and availability",10.1,"IS.2.H.7","AI2.4, AI7.4, AI7.6, DS11.3, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A24","v":2670},{"$f":"'I. Info Sys AD&M'!J24","v":2},{"$f":"'I. Info Sys AD&M'!K24","v":0},{"$f":"'I. Info Sys AD&M'!Y24","v":0},{"$f":"'I. Info Sys AD&M'!B24","v":"I.2.11"},{"$f":"'I. Info Sys AD&M'!C24","v":"Are change control procedures required for all changes to the production environment?"},{"$f":"'I. Info Sys AD&M'!D24","v":0},{"$f":"'I. Info Sys AD&M'!E24","v":0},{"$f":"'I. Info Sys AD&M'!F24","v":0},{"$f":"'I. Info Sys AD&M'!G24","v":"G.21 Change Control"},{"$f":"'I. Info Sys AD&M'!H24","v":"9.4.5.g"},{"$f":"'I. Info Sys AD&M'!I24","v":"Access control to program source code"},null,"AI2.4","Application security and availability",6.4,"IS.1.7.8 D&A.1.5.1.10 D&A.1.6.1.12","AI2.4, AI7.4, AI7.6, DS11.3, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A25","v":2144},{"$f":"'I. Info Sys AD&M'!J25","v":2},{"$f":"'I. Info Sys AD&M'!K25","v":0},{"$f":"'I. Info Sys AD&M'!Y25","v":0},{"$f":"'I. Info Sys AD&M'!B25","v":"I.2.12"},{"$f":"'I. Info Sys AD&M'!C25","v":"Do applications provide granular and comprehensive logging?"},{"$f":"'I. Info Sys AD&M'!D25","v":0},{"$f":"'I. Info Sys AD&M'!E25","v":0},{"$f":"'I. Info Sys AD&M'!F25","v":0},{"$f":"'I. Info Sys AD&M'!G25","v":0},{"$f":"'I. Info Sys AD&M'!H25","v":"12.4.1"},{"$f":"'I. Info Sys AD&M'!I25","v":"Event logging"},null,"AI2.3","Application control and auditability","N/A","IS.2.G.7 IS.2.L.4","AI2.3, DS5.7"]
[{"$f":"'I. Info Sys AD&M'!A26","v":2070},{"$f":"'I. Info Sys AD&M'!J26","v":2},{"$f":"'I. Info Sys AD&M'!K26","v":0},{"$f":"'I. Info Sys AD&M'!Y26","v":0},{"$f":"'I. Info Sys AD&M'!B26","v":"I.2.13"},{"$f":"'I. Info Sys AD&M'!C26","v":"Are application sessions set to time out within 15 minutes or less?"},{"$f":"'I. Info Sys AD&M'!D26","v":0},{"$f":"'I. Info Sys AD&M'!E26","v":0},{"$f":"'I. Info Sys AD&M'!F26","v":0},{"$f":"'I. Info Sys AD&M'!G26","v":"H.5 Controls for Unattended Systems"},{"$f":"'I. Info Sys AD&M'!H26","v":"9.4.2.k"},{"$f":"'I. Info Sys AD&M'!I26","v":"Secure log-on procedures"},null,"DS5.3","Identity management","8.1.8","N/A","DS5.7"]
[{"$f":"'I. Info Sys AD&M'!A27","v":2153},{"$f":"'I. Info Sys AD&M'!J27","v":2},{"$f":"'I. Info Sys AD&M'!K27","v":0},{"$f":"'I. Info Sys AD&M'!Y27","v":0},{"$f":"'I. Info Sys AD&M'!B27","v":"I.2.14"},{"$f":"'I. Info Sys AD&M'!C27","v":"Is application development third party / outsourced developers onshore?"},{"$f":"'I. Info Sys AD&M'!D27","v":0},{"$f":"'I. Info Sys AD&M'!E27","v":0},{"$f":"'I. Info Sys AD&M'!F27","v":0},{"$f":"'I. Info Sys AD&M'!G27","v":0},{"$f":"'I. Info Sys AD&M'!H27","v":"14.2.7 "},{"$f":"'I. Info Sys AD&M'!I27","v":"Outsourced development"},null,"PO8.3","Development and acquisition standards","N/A","N/A","PO8.3, AI2.7, AI5.2, DS2.4, PO8"]
[{"$f":"'I. Info Sys AD&M'!A28","v":2154},{"$f":"'I. Info Sys AD&M'!J28","v":2},{"$f":"'I. Info Sys AD&M'!K28","v":0},{"$f":"'I. Info Sys AD&M'!Y28","v":0},{"$f":"'I. Info Sys AD&M'!B28","v":"I.2.15"},{"$f":"'I. Info Sys AD&M'!C28","v":"Is application development third party / outsourced developers offshore?"},{"$f":"'I. Info Sys AD&M'!D28","v":0},{"$f":"'I. Info Sys AD&M'!E28","v":0},{"$f":"'I. Info Sys AD&M'!F28","v":0},{"$f":"'I. Info Sys AD&M'!G28","v":0},{"$f":"'I. Info Sys AD&M'!H28","v":"14.2.7 "},{"$f":"'I. Info Sys AD&M'!I28","v":"Outsourced development"},null,"PO8.3","Development and acquisition standards","N/A","N/A","PO8.3, AI2.7, AI5.2, DS2.4, PO8"]
[{"$f":"'I. Info Sys AD&M'!A29","v":2155},{"$f":"'I. Info Sys AD&M'!J29","v":2},{"$f":"'I. Info Sys AD&M'!K29","v":0},{"$f":"'I. Info Sys AD&M'!Y29","v":0},{"$f":"'I. Info Sys AD&M'!B29","v":"I.2.16"},{"$f":"'I. Info Sys AD&M'!C29","v":"Are there access controls to protect source code and test data?"},{"$f":"'I. Info Sys AD&M'!D29","v":0},{"$f":"'I. Info Sys AD&M'!E29","v":0},{"$f":"'I. Info Sys AD&M'!F29","v":0},{"$f":"'I. Info Sys AD&M'!G29","v":0},{"$f":"'I. Info Sys AD&M'!H29","v":"9.4.5 "},{"$f":"'I. Info Sys AD&M'!I29","v":"Access control to program source code"},null,"AI2.4","Application security and availability","6.4.1.b","N/A","AI2.4, AI7.4, AI7.6, DS11.3, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A30","v":2160},{"$f":"'I. Info Sys AD&M'!J30","v":2},{"$f":"'I. Info Sys AD&M'!K30","v":0},{"$f":"'I. Info Sys AD&M'!Y30","v":0},{"$f":"'I. Info Sys AD&M'!B30","v":"I.2.17"},{"$f":"'I. Info Sys AD&M'!C30","v":"Does the version management system provide segregation of code, data and environments?"},{"$f":"'I. Info Sys AD&M'!D30","v":0},{"$f":"'I. Info Sys AD&M'!E30","v":0},{"$f":"'I. Info Sys AD&M'!F30","v":0},{"$f":"'I. Info Sys AD&M'!G30","v":0},{"$f":"'I. Info Sys AD&M'!H30","v":"9.4.5 "},{"$f":"'I. Info Sys AD&M'!I30","v":"Access control to program source code"},null,"N/A",0,"6.4.1.a","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A31","v":2164},{"$f":"'I. Info Sys AD&M'!J31","v":2},{"$f":"'I. Info Sys AD&M'!K31","v":0},{"$f":"'I. Info Sys AD&M'!Y31","v":0},{"$f":"'I. Info Sys AD&M'!B31","v":"I.2.18"},{"$f":"'I. Info Sys AD&M'!C31","v":"Do changes to applications or application code go through a risk assessment including application testing?"},{"$f":"'I. Info Sys AD&M'!D31","v":0},{"$f":"'I. Info Sys AD&M'!E31","v":0},{"$f":"'I. Info Sys AD&M'!F31","v":0},{"$f":"'I. Info Sys AD&M'!G31","v":0},{"$f":"'I. Info Sys AD&M'!H31","v":"14.2.2                                       14.2.4.a"},{"$f":"'I. Info Sys AD&M'!I31","v":"System change control procedures,                                Restrictions on changes to software packages"},null,"AI2.6","Major upgrades to existing systems",6.4,"N/A","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A32","v":2169},{"$f":"'I. Info Sys AD&M'!J32","v":2},{"$f":"'I. Info Sys AD&M'!K32","v":0},{"$f":"'I. Info Sys AD&M'!Y32","v":0},{"$f":"'I. Info Sys AD&M'!B32","v":"I.2.19"},{"$f":"'I. Info Sys AD&M'!C32","v":"Is Scoped Systems and Data ever used in the test, development, or QA environments? If yes, is:"},{"$f":"'I. Info Sys AD&M'!D32","v":0},{"$f":"'I. Info Sys AD&M'!E32","v":0},{"$f":"'I. Info Sys AD&M'!F32","v":0},{"$f":"'I. Info Sys AD&M'!G32","v":0},{"$f":"'I. Info Sys AD&M'!H32","v":"14.3.1 "},{"$f":"'I. Info Sys AD&M'!I32","v":"Protection of test data"},null,"AI3.3","Infrastructure maintenance","6.4.3","N/A","AI3.3, DS2.4, DS9.1, DS9.2, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A33","v":2672},{"$f":"'I. Info Sys AD&M'!J33","v":3},{"$f":"'I. Info Sys AD&M'!K33","v":0},{"$f":"'I. Info Sys AD&M'!Y33","v":0},{"$f":"'I. Info Sys AD&M'!B33","v":"I.2.19.1"},{"$f":"'I. Info Sys AD&M'!C33","v":"Authorization required when production data is copied to the test environment?"},{"$f":"'I. Info Sys AD&M'!D33","v":0},{"$f":"'I. Info Sys AD&M'!E33","v":0},{"$f":"'I. Info Sys AD&M'!F33","v":0},{"$f":"'I. Info Sys AD&M'!G33","v":"I.7 Application Security SDLC Phases"},{"$f":"'I. Info Sys AD&M'!H33","v":"14.3.1.b"},{"$f":"'I. Info Sys AD&M'!I33","v":"Protection of test data"},null,"AI3.3","Infrastructure maintenance","N/A","N/A","AI3.3, DS2.4, DS9.1, DS9.2, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A34","v":2171},{"$f":"'I. Info Sys AD&M'!J34","v":3},{"$f":"'I. Info Sys AD&M'!K34","v":0},{"$f":"'I. Info Sys AD&M'!Y34","v":0},{"$f":"'I. Info Sys AD&M'!B34","v":"I.2.19.2"},{"$f":"'I. Info Sys AD&M'!C34","v":"Test data destroyed following the testing phase?"},{"$f":"'I. Info Sys AD&M'!D34","v":0},{"$f":"'I. Info Sys AD&M'!E34","v":0},{"$f":"'I. Info Sys AD&M'!F34","v":0},{"$f":"'I. Info Sys AD&M'!G34","v":0},{"$f":"'I. Info Sys AD&M'!H34","v":"14.3.1.c"},{"$f":"'I. Info Sys AD&M'!I34","v":"Protection of test data"},null,"AI3.3","Infrastructure maintenance","6.3.1","N/A","AI3.3, DS2.4, DS9.1, DS9.2, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A35","v":2170},{"$f":"'I. Info Sys AD&M'!J35","v":3},{"$f":"'I. Info Sys AD&M'!K35","v":0},{"$f":"'I. Info Sys AD&M'!Y35","v":0},{"$f":"'I. Info Sys AD&M'!B35","v":"I.2.19.3"},{"$f":"'I. Info Sys AD&M'!C35","v":"Test data masked or obfuscated during the testing phase?"},{"$f":"'I. Info Sys AD&M'!D35","v":0},{"$f":"'I. Info Sys AD&M'!E35","v":0},{"$f":"'I. Info Sys AD&M'!F35","v":0},{"$f":"'I. Info Sys AD&M'!G35","v":0},{"$f":"'I. Info Sys AD&M'!H35","v":"14.3.1"},{"$f":"'I. Info Sys AD&M'!I35","v":"Protection of test data"},null,"AI3.3","Infrastructure maintenance","N/A","N/A","AI3.3, DS2.4, DS9.1, DS9.2, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A36","v":2673},{"$f":"'I. Info Sys AD&M'!J36","v":3},{"$f":"'I. Info Sys AD&M'!K36","v":0},{"$f":"'I. Info Sys AD&M'!Y36","v":0},{"$f":"'I. Info Sys AD&M'!B36","v":"I.2.19.4"},{"$f":"'I. Info Sys AD&M'!C36","v":"Copying to the test environment logged?"},{"$f":"'I. Info Sys AD&M'!D36","v":0},{"$f":"'I. Info Sys AD&M'!E36","v":0},{"$f":"'I. Info Sys AD&M'!F36","v":0},{"$f":"'I. Info Sys AD&M'!G36","v":0},{"$f":"'I. Info Sys AD&M'!H36","v":"14.3.1.d"},{"$f":"'I. Info Sys AD&M'!I36","v":"Protection of test data"},null,"AI3.3","Infrastructure maintenance","N/A","N/A","AI3.3, DS2.4, DS9.1, DS9.2, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A37","v":2019},{"$f":"'I. Info Sys AD&M'!J37","v":2},{"$f":"'I. Info Sys AD&M'!K37","v":0},{"$f":"'I. Info Sys AD&M'!Y37","v":0},{"$f":"'I. Info Sys AD&M'!B37","v":"I.2.20"},{"$f":"'I. Info Sys AD&M'!C37","v":"Are developers permitted to:"},{"$f":"'I. Info Sys AD&M'!D37","v":0},{"$f":"'I. Info Sys AD&M'!E37","v":0},{"$f":"'I. Info Sys AD&M'!F37","v":0},{"$f":"'I. Info Sys AD&M'!G37","v":0},{"$f":"'I. Info Sys AD&M'!H37","v":"14.2.1"},{"$f":"'I. Info Sys AD&M'!I37","v":"Secure development policy"},null,"N/A",0,"N/A","N/A","DS5.7"]
[{"$f":"'I. Info Sys AD&M'!A38","v":2020},{"$f":"'I. Info Sys AD&M'!J38","v":3},{"$f":"'I. Info Sys AD&M'!K38","v":0},{"$f":"'I. Info Sys AD&M'!Y38","v":0},{"$f":"'I. Info Sys AD&M'!B38","v":"I.2.20.1"},{"$f":"'I. Info Sys AD&M'!C38","v":"Access production environments, including read only access?"},{"$f":"'I. Info Sys AD&M'!D38","v":0},{"$f":"'I. Info Sys AD&M'!E38","v":0},{"$f":"'I. Info Sys AD&M'!F38","v":0},{"$f":"'I. Info Sys AD&M'!G38","v":0},{"$f":"'I. Info Sys AD&M'!H38","v":"14.2.1.b"},{"$f":"'I. Info Sys AD&M'!I38","v":"Secure development policy"},null,"AI2.4","Application security and availability",7.1,"N/A","AI2.4, AI7.4, AI7.6, DS11.3, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A39","v":1909},{"$f":"'I. Info Sys AD&M'!J39","v":3},{"$f":"'I. Info Sys AD&M'!K39","v":0},{"$f":"'I. Info Sys AD&M'!Y39","v":0},{"$f":"'I. Info Sys AD&M'!B39","v":"I.2.20.2"},{"$f":"'I. Info Sys AD&M'!C39","v":"Access systems and applications based on established profiles that define responsibilities or job functions?"},{"$f":"'I. Info Sys AD&M'!D39","v":0},{"$f":"'I. Info Sys AD&M'!E39","v":0},{"$f":"'I. Info Sys AD&M'!F39","v":0},{"$f":"'I. Info Sys AD&M'!G39","v":0},{"$f":"'I. Info Sys AD&M'!H39","v":"9.1.1"},{"$f":"'I. Info Sys AD&M'!I39","v":"Access Control Policy"},null,"PO2.1","Enterprise information architecture model",7.1,"IS.2.L.3 E-BANK.1.5.1","PO2.2, PO2.3, PO6.2, DS5.2, DS5.3, DS5.4"]
[{"$f":"'I. Info Sys AD&M'!A40","v":2027},{"$f":"'I. Info Sys AD&M'!J40","v":3},{"$f":"'I. Info Sys AD&M'!K40","v":0},{"$f":"'I. Info Sys AD&M'!Y40","v":0},{"$f":"'I. Info Sys AD&M'!B40","v":"I.2.20.3"},{"$f":"'I. Info Sys AD&M'!C40","v":"Request or obtain access outside an established role (emergency access)?"},{"$f":"'I. Info Sys AD&M'!D40","v":0},{"$f":"'I. Info Sys AD&M'!E40","v":0},{"$f":"'I. Info Sys AD&M'!F40","v":0},{"$f":"'I. Info Sys AD&M'!G40","v":0},{"$f":"'I. Info Sys AD&M'!H40","v":"9.2.3.b"},{"$f":"'I. Info Sys AD&M'!I40","v":"Management of privileged access rights"},null,"DS5.4","User account management","N/A","N/A","DS5.4"]
[{"$f":"'I. Info Sys AD&M'!A41","v":2970},{"$f":"'I. Info Sys AD&M'!J41","v":2},{"$f":"'I. Info Sys AD&M'!K41","v":0},{"$f":"'I. Info Sys AD&M'!Y41","v":0},{"$f":"'I. Info Sys AD&M'!B41","v":"I.2.21"},{"$f":"'I. Info Sys AD&M'!C41","v":"Are system, vendor, or service accounts disallowed for normal operations and monitored for usage?"},{"$f":"'I. Info Sys AD&M'!D41","v":0},{"$f":"'I. Info Sys AD&M'!E41","v":0},{"$f":"'I. Info Sys AD&M'!F41","v":0},{"$f":"'I. Info Sys AD&M'!G41","v":0},{"$f":"'I. Info Sys AD&M'!H41","v":"NA"},{"$f":"'I. Info Sys AD&M'!I41","v":0},null,"N/A",0,"N/A","WPS.2.9.2.5","N/A"]
[{"$f":"'I. Info Sys AD&M'!A42","v":2674},{"$f":"'I. Info Sys AD&M'!J42","v":2},{"$f":"'I. Info Sys AD&M'!K42","v":0},{"$f":"'I. Info Sys AD&M'!Y42","v":0},{"$f":"'I. Info Sys AD&M'!B42","v":"I.2.22"},{"$f":"'I. Info Sys AD&M'!C42","v":"Are access control procedures the same for both the test and production environment?"},{"$f":"'I. Info Sys AD&M'!D42","v":0},{"$f":"'I. Info Sys AD&M'!E42","v":0},{"$f":"'I. Info Sys AD&M'!F42","v":0},{"$f":"'I. Info Sys AD&M'!G42","v":"H.5 Controls for Unattended Systems"},{"$f":"'I. Info Sys AD&M'!H42","v":"14.3.1.a"},{"$f":"'I. Info Sys AD&M'!I42","v":"Protection of test data"},null,"AI3.3","Infrastructure maintenance","6.4.2","D&A.1.10.1.4.1 WPS.2.9.5.3","AI3.3, DS2.4, DS9.1, DS9.2, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A43","v":2172},{"$f":"'I. Info Sys AD&M'!J43","v":2},{"$f":"'I. Info Sys AD&M'!K43","v":0},{"$f":"'I. Info Sys AD&M'!Y43","v":0},{"$f":"'I. Info Sys AD&M'!B43","v":"I.2.23"},{"$f":"'I. Info Sys AD&M'!C43","v":"Prior to implementation, do applications go through a risk assessment and approval by security?"},{"$f":"'I. Info Sys AD&M'!D43","v":0},{"$f":"'I. Info Sys AD&M'!E43","v":0},{"$f":"'I. Info Sys AD&M'!F43","v":0},{"$f":"'I. Info Sys AD&M'!G43","v":"I.7 Application Security SDLC Phases\nI.8 Security Review of Internal and External Applications"},{"$f":"'I. Info Sys AD&M'!H43","v":"14.2.2                                       14.2.4.a"},{"$f":"'I. Info Sys AD&M'!I43","v":"System change control procedures,                                Restrictions on changes to software packages"},null,"AI2.6","Major upgrades to existing systems","6.4.5.3","IS.2.H.8.1","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A44","v":2177},{"$f":"'I. Info Sys AD&M'!J44","v":2},{"$f":"'I. Info Sys AD&M'!K44","v":0},{"$f":"'I. Info Sys AD&M'!Y44","v":0},{"$f":"'I. Info Sys AD&M'!B44","v":"I.2.24"},{"$f":"'I. Info Sys AD&M'!C44","v":"Is Internet facing software and infrastructure tested prior to implementation? If yes, does the testing include:"},{"$f":"'I. Info Sys AD&M'!D44","v":0},{"$f":"'I. Info Sys AD&M'!E44","v":0},{"$f":"'I. Info Sys AD&M'!F44","v":0},{"$f":"'I. Info Sys AD&M'!G44","v":"I.6 Application Security Vulnerability Assessment and Remediation"},{"$f":"'I. Info Sys AD&M'!H44","v":"14.1.1"},{"$f":"'I. Info Sys AD&M'!I44","v":"Information security requirements analysis and specification"},null,"PO6.4","Policy rollout",6.6,"IS.2.H.8.3","PO6.4, DS5.5, ME2.2, ME2.5, ME4.7"]
[{"$f":"'I. Info Sys AD&M'!A45","v":2179},{"$f":"'I. Info Sys AD&M'!J45","v":3},{"$f":"'I. Info Sys AD&M'!K45","v":0},{"$f":"'I. Info Sys AD&M'!Y45","v":0},{"$f":"'I. Info Sys AD&M'!B45","v":"I.2.24.1"},{"$f":"'I. Info Sys AD&M'!C45","v":"Issue tracking and resolution?"},{"$f":"'I. Info Sys AD&M'!D45","v":0},{"$f":"'I. Info Sys AD&M'!E45","v":0},{"$f":"'I. Info Sys AD&M'!F45","v":0},{"$f":"'I. Info Sys AD&M'!G45","v":0},{"$f":"'I. Info Sys AD&M'!H45","v":"14.1.1"},{"$f":"'I. Info Sys AD&M'!I45","v":"Information security requirements analysis and specification"},null,"PO6.4","Policy rollout",6.6,"D&A.1.9.1.5","PO6.4, DS5.5, ME2.2, ME2.5, ME4.7"]
[{"$f":"'I. Info Sys AD&M'!A46","v":2180},{"$f":"'I. Info Sys AD&M'!J46","v":3},{"$f":"'I. Info Sys AD&M'!K46","v":0},{"$f":"'I. Info Sys AD&M'!Y46","v":0},{"$f":"'I. Info Sys AD&M'!B46","v":"I.2.24.2"},{"$f":"'I. Info Sys AD&M'!C46","v":"Metrics on software defects and release incidents?"},{"$f":"'I. Info Sys AD&M'!D46","v":0},{"$f":"'I. Info Sys AD&M'!E46","v":0},{"$f":"'I. Info Sys AD&M'!F46","v":0},{"$f":"'I. Info Sys AD&M'!G46","v":0},{"$f":"'I. Info Sys AD&M'!H46","v":"14.1.1"},{"$f":"'I. Info Sys AD&M'!I46","v":"Information security requirements analysis and specification"},null,"PO6.4","Policy rollout","N/A","D&A.1.9.1.4","PO6.4, DS5.5, ME2.2, ME2.5, ME4.7"]
[{"$f":"'I. Info Sys AD&M'!A47","v":2204},{"$f":"'I. Info Sys AD&M'!J47","v":2},{"$f":"'I. Info Sys AD&M'!K47","v":0},{"$f":"'I. Info Sys AD&M'!Y47","v":0},{"$f":"'I. Info Sys AD&M'!B47","v":"I.2.25"},{"$f":"'I. Info Sys AD&M'!C47","v":"Is there a documented change management / change control process? If yes, does it include:"},{"$f":"'I. Info Sys AD&M'!D47","v":0},{"$f":"'I. Info Sys AD&M'!E47","v":0},{"$f":"'I. Info Sys AD&M'!F47","v":0},{"$f":"'I. Info Sys AD&M'!G47","v":"G.21 Change Control"},{"$f":"'I. Info Sys AD&M'!H47","v":"14.2.2 "},{"$f":"'I. Info Sys AD&M'!I47","v":"System change control procedures"},null,"AI2.6","Major upgrades to existing systems",6.4,"IS.2.H.6","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A48","v":2206},{"$f":"'I. Info Sys AD&M'!J48","v":3},{"$f":"'I. Info Sys AD&M'!K48","v":0},{"$f":"'I. Info Sys AD&M'!Y48","v":0},{"$f":"'I. Info Sys AD&M'!B48","v":"I.2.25.1"},{"$f":"'I. Info Sys AD&M'!C48","v":"Testing prior to deployment?"},{"$f":"'I. Info Sys AD&M'!D48","v":0},{"$f":"'I. Info Sys AD&M'!E48","v":0},{"$f":"'I. Info Sys AD&M'!F48","v":0},{"$f":"'I. Info Sys AD&M'!G48","v":"I.7 Application Security SDLC Phases"},{"$f":"'I. Info Sys AD&M'!H48","v":"12.5.1.c "},{"$f":"'I. Info Sys AD&M'!I48","v":"Installation of software on operational systems"},null,"DS5.7","Protection of security technology",6.1,"N/A","DS5.7, DS9.1"]
[{"$f":"'I. Info Sys AD&M'!A49","v":2207},{"$f":"'I. Info Sys AD&M'!J49","v":3},{"$f":"'I. Info Sys AD&M'!K49","v":0},{"$f":"'I. Info Sys AD&M'!Y49","v":0},{"$f":"'I. Info Sys AD&M'!B49","v":"I.2.25.2"},{"$f":"'I. Info Sys AD&M'!C49","v":"Management approval prior to deployment?"},{"$f":"'I. Info Sys AD&M'!D49","v":0},{"$f":"'I. Info Sys AD&M'!E49","v":0},{"$f":"'I. Info Sys AD&M'!F49","v":0},{"$f":"'I. Info Sys AD&M'!G49","v":"I.8 Security Review of Internal and External Applications"},{"$f":"'I. Info Sys AD&M'!H49","v":"12.5.1.a                                    14.2.2.f "},{"$f":"'I. Info Sys AD&M'!I49","v":"Installation of software on operational systems                              System change control procedures"},null,"AI2.6","Major upgrades to existing systems","6.3.2","N/A","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A50","v":2208},{"$f":"'I. Info Sys AD&M'!J50","v":3},{"$f":"'I. Info Sys AD&M'!K50","v":0},{"$f":"'I. Info Sys AD&M'!Y50","v":0},{"$f":"'I. Info Sys AD&M'!B50","v":"I.2.25.3"},{"$f":"'I. Info Sys AD&M'!C50","v":"Establishment of restart points?"},{"$f":"'I. Info Sys AD&M'!D50","v":0},{"$f":"'I. Info Sys AD&M'!E50","v":0},{"$f":"'I. Info Sys AD&M'!F50","v":0},{"$f":"'I. Info Sys AD&M'!G50","v":0},{"$f":"'I. Info Sys AD&M'!H50","v":"12.5.1.e"},{"$f":"'I. Info Sys AD&M'!I50","v":"Control Of Operational Software"},null,"DS5.7","Protection of security technology","N/A","N/A","DS5.7, DS9.1"]
[{"$f":"'I. Info Sys AD&M'!A51","v":2209},{"$f":"'I. Info Sys AD&M'!J51","v":3},{"$f":"'I. Info Sys AD&M'!K51","v":0},{"$f":"'I. Info Sys AD&M'!Y51","v":0},{"$f":"'I. Info Sys AD&M'!B51","v":"I.2.25.4"},{"$f":"'I. Info Sys AD&M'!C51","v":"Management approval for changes?"},{"$f":"'I. Info Sys AD&M'!D51","v":0},{"$f":"'I. Info Sys AD&M'!E51","v":0},{"$f":"'I. Info Sys AD&M'!F51","v":0},{"$f":"'I. Info Sys AD&M'!G51","v":0},{"$f":"'I. Info Sys AD&M'!H51","v":"14.2.2.f"},{"$f":"'I. Info Sys AD&M'!I51","v":"System change control procedures"},null,"AI2.6","Major upgrades to existing systems","6.3.2","N/A","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A52","v":2675},{"$f":"'I. Info Sys AD&M'!J52","v":3},{"$f":"'I. Info Sys AD&M'!K52","v":0},{"$f":"'I. Info Sys AD&M'!Y52","v":0},{"$f":"'I. Info Sys AD&M'!B52","v":"I.2.25.5"},{"$f":"'I. Info Sys AD&M'!C52","v":"Requirements for the transfer of software from development to production?"},{"$f":"'I. Info Sys AD&M'!D52","v":0},{"$f":"'I. Info Sys AD&M'!E52","v":0},{"$f":"'I. Info Sys AD&M'!F52","v":0},{"$f":"'I. Info Sys AD&M'!G52","v":0},{"$f":"'I. Info Sys AD&M'!H52","v":"12.1.4.a "},{"$f":"'I. Info Sys AD&M'!I52","v":"Separation of development, testing and operational environments"},null,"N/A",0,"N/A","D&A.1.10.1.2","DS5.9"]
[{"$f":"'I. Info Sys AD&M'!A53","v":2210},{"$f":"'I. Info Sys AD&M'!J53","v":3},{"$f":"'I. Info Sys AD&M'!K53","v":0},{"$f":"'I. Info Sys AD&M'!Y53","v":0},{"$f":"'I. Info Sys AD&M'!B53","v":"I.2.25.6"},{"$f":"'I. Info Sys AD&M'!C53","v":"Review of code changes by information security?"},{"$f":"'I. Info Sys AD&M'!D53","v":0},{"$f":"'I. Info Sys AD&M'!E53","v":0},{"$f":"'I. Info Sys AD&M'!F53","v":0},{"$f":"'I. Info Sys AD&M'!G53","v":"I.2 Secure Systems Development Life Cycle (SDLC) code reviews"},{"$f":"'I. Info Sys AD&M'!H53","v":"12.5.1.c "},{"$f":"'I. Info Sys AD&M'!I53","v":"Installation of software on operational systems"},null,"DS5.7","Protection of security technology","N/A","N/A","DS5.7, DS9.1"]
[{"$f":"'I. Info Sys AD&M'!A54","v":2676},{"$f":"'I. Info Sys AD&M'!J54","v":3},{"$f":"'I. Info Sys AD&M'!K54","v":0},{"$f":"'I. Info Sys AD&M'!Y54","v":0},{"$f":"'I. Info Sys AD&M'!B54","v":"I.2.25.7"},{"$f":"'I. Info Sys AD&M'!C54","v":"Stakeholder communication and/or approvals?"},{"$f":"'I. Info Sys AD&M'!D54","v":0},{"$f":"'I. Info Sys AD&M'!E54","v":0},{"$f":"'I. Info Sys AD&M'!F54","v":0},{"$f":"'I. Info Sys AD&M'!G54","v":"G.21 Change Control"},{"$f":"'I. Info Sys AD&M'!H54","v":"14.2.2.f"},{"$f":"'I. Info Sys AD&M'!I54","v":"System change control procedures"},null,"AI2.6","Major upgrades to existing systems","N/A","N/A","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A55","v":2677},{"$f":"'I. Info Sys AD&M'!J55","v":3},{"$f":"'I. Info Sys AD&M'!K55","v":0},{"$f":"'I. Info Sys AD&M'!Y55","v":0},{"$f":"'I. Info Sys AD&M'!B55","v":"I.2.25.8"},{"$f":"'I. Info Sys AD&M'!C55","v":"A list of individuals authorized to approve changes?"},{"$f":"'I. Info Sys AD&M'!D55","v":0},{"$f":"'I. Info Sys AD&M'!E55","v":0},{"$f":"'I. Info Sys AD&M'!F55","v":0},{"$f":"'I. Info Sys AD&M'!G55","v":"G.21 Change Control"},{"$f":"'I. Info Sys AD&M'!H55","v":"14.2.2.a"},{"$f":"'I. Info Sys AD&M'!I55","v":"System change control procedures"},null,"AI2.6","Major upgrades to existing systems","N/A","D&A.1.5.1.11","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A56","v":2678},{"$f":"'I. Info Sys AD&M'!J56","v":3},{"$f":"'I. Info Sys AD&M'!K56","v":0},{"$f":"'I. Info Sys AD&M'!Y56","v":0},{"$f":"'I. Info Sys AD&M'!B56","v":"I.2.25.9"},{"$f":"'I. Info Sys AD&M'!C56","v":"An impact assessment to review all affected systems and applications?"},{"$f":"'I. Info Sys AD&M'!D56","v":0},{"$f":"'I. Info Sys AD&M'!E56","v":0},{"$f":"'I. Info Sys AD&M'!F56","v":0},{"$f":"'I. Info Sys AD&M'!G56","v":"I.6 Application Security Vulnerability Assessment and Remediation\nI.13 Privacy Impact Analysis"},{"$f":"'I. Info Sys AD&M'!H56","v":"14.2.2.e"},{"$f":"'I. Info Sys AD&M'!I56","v":"System change control procedures"},null,"AI2.6","Major upgrades to existing systems","6.4.5.1","D&A.1.5.1.12","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A57","v":2679},{"$f":"'I. Info Sys AD&M'!J57","v":3},{"$f":"'I. Info Sys AD&M'!K57","v":0},{"$f":"'I. Info Sys AD&M'!Y57","v":0},{"$f":"'I. Info Sys AD&M'!B57","v":"I.2.25.10"},{"$f":"'I. Info Sys AD&M'!C57","v":"Documentation for all system changes?"},{"$f":"'I. Info Sys AD&M'!D57","v":0},{"$f":"'I. Info Sys AD&M'!E57","v":0},{"$f":"'I. Info Sys AD&M'!F57","v":0},{"$f":"'I. Info Sys AD&M'!G57","v":"G.21 Change Control"},{"$f":"'I. Info Sys AD&M'!H57","v":"14.2.2.h"},{"$f":"'I. Info Sys AD&M'!I57","v":"System change control procedures"},null,"AI2.6","Major upgrades to existing systems",6.4,"N/A","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A58","v":2680},{"$f":"'I. Info Sys AD&M'!J58","v":3},{"$f":"'I. Info Sys AD&M'!K58","v":0},{"$f":"'I. Info Sys AD&M'!Y58","v":0},{"$f":"'I. Info Sys AD&M'!B58","v":"I.2.25.11"},{"$f":"'I. Info Sys AD&M'!C58","v":"Version control for all software?"},{"$f":"'I. Info Sys AD&M'!D58","v":0},{"$f":"'I. Info Sys AD&M'!E58","v":0},{"$f":"'I. Info Sys AD&M'!F58","v":0},{"$f":"'I. Info Sys AD&M'!G58","v":0},{"$f":"'I. Info Sys AD&M'!H58","v":"14.2.2.i"},{"$f":"'I. Info Sys AD&M'!I58","v":"System change control procedures"},null,"AI2.6","Major upgrades to existing systems","N/A","D&A.1.10.1.5","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A59","v":2681},{"$f":"'I. Info Sys AD&M'!J59","v":3},{"$f":"'I. Info Sys AD&M'!K59","v":0},{"$f":"'I. Info Sys AD&M'!Y59","v":0},{"$f":"'I. Info Sys AD&M'!B59","v":"I.2.25.12"},{"$f":"'I. Info Sys AD&M'!C59","v":"Logging of all change requests?"},{"$f":"'I. Info Sys AD&M'!D59","v":0},{"$f":"'I. Info Sys AD&M'!E59","v":0},{"$f":"'I. Info Sys AD&M'!F59","v":0},{"$f":"'I. Info Sys AD&M'!G59","v":"G.21 Change Control"},{"$f":"'I. Info Sys AD&M'!H59","v":"14.2.2.j"},{"$f":"'I. Info Sys AD&M'!I59","v":"System change control procedures"},null,"AI2.6","Major upgrades to existing systems","N/A","D&A.1.12.4.1","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A60","v":2682},{"$f":"'I. Info Sys AD&M'!J60","v":3},{"$f":"'I. Info Sys AD&M'!K60","v":0},{"$f":"'I. Info Sys AD&M'!Y60","v":0},{"$f":"'I. Info Sys AD&M'!B60","v":"I.2.25.13"},{"$f":"'I. Info Sys AD&M'!C60","v":"Changes only take place during specified and agreed upon times (green zone)?"},{"$f":"'I. Info Sys AD&M'!D60","v":0},{"$f":"'I. Info Sys AD&M'!E60","v":0},{"$f":"'I. Info Sys AD&M'!F60","v":0},{"$f":"'I. Info Sys AD&M'!G60","v":"G.21 Change Control"},{"$f":"'I. Info Sys AD&M'!H60","v":"14.2.2.l"},{"$f":"'I. Info Sys AD&M'!I60","v":"System change control procedures"},null,"AI2.6","Major upgrades to existing systems","N/A","N/A","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A61","v":2212},{"$f":"'I. Info Sys AD&M'!J61","v":3},{"$f":"'I. Info Sys AD&M'!K61","v":0},{"$f":"'I. Info Sys AD&M'!Y61","v":0},{"$f":"'I. Info Sys AD&M'!B61","v":"I.2.25.14"},{"$f":"'I. Info Sys AD&M'!C61","v":"Modifications and changes to software are strictly controlled?"},{"$f":"'I. Info Sys AD&M'!D61","v":0},{"$f":"'I. Info Sys AD&M'!E61","v":0},{"$f":"'I. Info Sys AD&M'!F61","v":0},{"$f":"'I. Info Sys AD&M'!G61","v":"G.21 Change Control"},{"$f":"'I. Info Sys AD&M'!H61","v":"14.2.2.e"},{"$f":"'I. Info Sys AD&M'!I61","v":"System change control procedures"},null,"AI2.6","Major upgrades to existing systems",6.4,"N/A","AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"'I. Info Sys AD&M'!A62","v":2683},{"$f":"'I. Info Sys AD&M'!J62","v":2},{"$f":"'I. Info Sys AD&M'!K62","v":0},{"$f":"'I. Info Sys AD&M'!Y62","v":0},{"$f":"'I. Info Sys AD&M'!B62","v":"I.2.26"},{"$f":"'I. Info Sys AD&M'!C62","v":"Are audit logs maintained and reviewed for all program library updates?"},{"$f":"'I. Info Sys AD&M'!D62","v":0},{"$f":"'I. Info Sys AD&M'!E62","v":0},{"$f":"'I. Info Sys AD&M'!F62","v":0},{"$f":"'I. Info Sys AD&M'!G62","v":0},{"$f":"'I. Info Sys AD&M'!H62","v":"12.5.1.f "},{"$f":"'I. Info Sys AD&M'!I62","v":"Installation of software on operational systems"},null,"DS5.7","Protection of security technology","10.6.2","D&A.1.7.1.7 D&A.1.10.1.4 D&A.1.10.1.4.2","DS5.7, DS9.1"]
[{"$f":"'I. Info Sys AD&M'!A63","v":2684},{"$f":"'I. Info Sys AD&M'!J63","v":2},{"$f":"'I. Info Sys AD&M'!K63","v":0},{"$f":"'I. Info Sys AD&M'!Y63","v":0},{"$f":"'I. Info Sys AD&M'!B63","v":"I.2.27"},{"$f":"'I. Info Sys AD&M'!C63","v":"Are compilers, editors or other development tools present in the production environment?"},{"$f":"'I. Info Sys AD&M'!D63","v":0},{"$f":"'I. Info Sys AD&M'!E63","v":0},{"$f":"'I. Info Sys AD&M'!F63","v":0},{"$f":"'I. Info Sys AD&M'!G63","v":0},{"$f":"'I. Info Sys AD&M'!H63","v":"12.1.4.e"},{"$f":"'I. Info Sys AD&M'!I63","v":"Separation of development, testing and operational environments"},null,"PO4.11","Segregation of duties","N/A","D&A.1.7.1.8 D&A.1.10.1.3","PO4.11, AI3.4, AI7.4"]
[{"$f":"'I. Info Sys AD&M'!A64","v":2872},{"$f":"'I. Info Sys AD&M'!J64","v":1},{"$f":"'I. Info Sys AD&M'!K64","v":0},{"$f":"'I. Info Sys AD&M'!Y64","v":0},{"$f":"'I. Info Sys AD&M'!B64","v":"I.3"},{"$f":"'I. Info Sys AD&M'!C64","v":"Are criteria for accepting new information systems, upgrades, and new versions established? If yes, do they include:"},{"$f":"'I. Info Sys AD&M'!D64","v":0},{"$f":"'I. Info Sys AD&M'!E64","v":0},{"$f":"'I. Info Sys AD&M'!F64","v":0},{"$f":"'I. Info Sys AD&M'!G64","v":0},{"$f":"'I. Info Sys AD&M'!H64","v":"12.1.3                                      14.2.9"},{"$f":"'I. Info Sys AD&M'!I64","v":"Capacity management, System acceptance"},null,"DS4.9","Offsite backup storage","N/A","BCP.1.4.1.2","DS4.9, DS11.2, DS11.5, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A65","v":2874},{"$f":"'I. Info Sys AD&M'!J65","v":2},{"$f":"'I. Info Sys AD&M'!K65","v":0},{"$f":"'I. Info Sys AD&M'!Y65","v":0},{"$f":"'I. Info Sys AD&M'!B65","v":"I.3.1"},{"$f":"'I. Info Sys AD&M'!C65","v":"Performance and computer capacity requirements?"},{"$f":"'I. Info Sys AD&M'!D65","v":0},{"$f":"'I. Info Sys AD&M'!E65","v":0},{"$f":"'I. Info Sys AD&M'!F65","v":0},{"$f":"'I. Info Sys AD&M'!G65","v":0},{"$f":"'I. Info Sys AD&M'!H65","v":"12.1.3"},{"$f":"'I. Info Sys AD&M'!I65","v":"Capacity management"},null,"DS4.9","Offsite backup storage","N/A","IS.2.I.1","DS4.9, DS11.2, DS11.5, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A66","v":2875},{"$f":"'I. Info Sys AD&M'!J66","v":2},{"$f":"'I. Info Sys AD&M'!K66","v":0},{"$f":"'I. Info Sys AD&M'!Y66","v":0},{"$f":"'I. Info Sys AD&M'!B66","v":"I.3.2"},{"$f":"'I. Info Sys AD&M'!C66","v":"Error recovery and restart procedures?"},{"$f":"'I. Info Sys AD&M'!D66","v":0},{"$f":"'I. Info Sys AD&M'!E66","v":0},{"$f":"'I. Info Sys AD&M'!F66","v":0},{"$f":"'I. Info Sys AD&M'!G66","v":0},{"$f":"'I. Info Sys AD&M'!H66","v":"12.1.1.h"},{"$f":"'I. Info Sys AD&M'!I66","v":"Documented operating procedures"},null,"DS4.9","Offsite backup storage","N/A","BCP.1.4.1.3 BCP.1.4.3.4","DS4.9, DS11.2, DS11.5, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A67","v":2876},{"$f":"'I. Info Sys AD&M'!J67","v":2},{"$f":"'I. Info Sys AD&M'!K67","v":0},{"$f":"'I. Info Sys AD&M'!Y67","v":0},{"$f":"'I. Info Sys AD&M'!B67","v":"I.3.3"},{"$f":"'I. Info Sys AD&M'!C67","v":"Preparation and testing of operating procedures?"},{"$f":"'I. Info Sys AD&M'!D67","v":0},{"$f":"'I. Info Sys AD&M'!E67","v":0},{"$f":"'I. Info Sys AD&M'!F67","v":0},{"$f":"'I. Info Sys AD&M'!G67","v":0},{"$f":"'I. Info Sys AD&M'!H67","v":"14.2.2"},{"$f":"'I. Info Sys AD&M'!I67","v":"System change control procedures"},null,"DS4.9","Offsite backup storage","N/A","N/A","DS4.9, DS11.2, DS11.5, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A68","v":2877},{"$f":"'I. Info Sys AD&M'!J68","v":2},{"$f":"'I. Info Sys AD&M'!K68","v":0},{"$f":"'I. Info Sys AD&M'!Y68","v":0},{"$f":"'I. Info Sys AD&M'!B68","v":"I.3.4"},{"$f":"'I. Info Sys AD&M'!C68","v":"Agreed set of security controls?"},{"$f":"'I. Info Sys AD&M'!D68","v":0},{"$f":"'I. Info Sys AD&M'!E68","v":0},{"$f":"'I. Info Sys AD&M'!F68","v":0},{"$f":"'I. Info Sys AD&M'!G68","v":0},{"$f":"'I. Info Sys AD&M'!H68","v":"14.2.9"},{"$f":"'I. Info Sys AD&M'!I68","v":"System acceptance testing"},null,"DS4.9","Offsite backup storage","N/A","BCP.1.4.2.5","DS4.9, DS11.2, DS11.5, DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A69","v":2878},{"$f":"'I. Info Sys AD&M'!J69","v":2},{"$f":"'I. Info Sys AD&M'!K69","v":0},{"$f":"'I. Info Sys AD&M'!Y69","v":0},{"$f":"'I. Info Sys AD&M'!B69","v":"I.3.5"},{"$f":"'I. Info Sys AD&M'!C69","v":"Effective manual procedures?"},{"$f":"'I. Info Sys AD&M'!D69","v":0},{"$f":"'I. Info Sys AD&M'!E69","v":0},{"$f":"'I. Info Sys AD&M'!F69","v":0},{"$f":"'I. Info Sys AD&M'!G69","v":0},{"$f":"'I. Info Sys AD&M'!H69","v":"NA"},{"$f":"'I. Info Sys AD&M'!I69","v":0},null,"DS5.11","Exchange of sensitive data","N/A","N/A","DS11.6"]
[{"$f":"'I. Info Sys AD&M'!A70","v":2879},{"$f":"'I. Info Sys AD&M'!J70","v":2},{"$f":"'I. Info Sys AD&M'!K70","v":0},{"$f":"'I. Info Sys AD&M'!Y70","v":0},{"$f":"'I. Info Sys AD&M'!B70","v":"I.3.6"},{"$f":"'I. Info Sys AD&M'!C70","v":"Business continuity arrangements?"},{"$f":"'I. Info Sys AD&M'!D70","v":0},{"$f":"'I. Info Sys AD&M'!E70","v":0},{"$f":"'I. Info Sys AD&M'!F70","v":0},{"$f":"'I. Info Sys AD&M'!G70","v":0},{"$f":"'I. Info Sys AD&M'!H70","v":"14.2.3.c"},{"$f":"'I. Info Sys AD&M'!I70","v":"Technical review of applications after operating platform changes"},null,"PO2.3","Data classification scheme","N/A","N/A","PO2.3, PO3.4, AI5.2, DS2.3"]
[{"$f":"'I. Info Sys AD&M'!A71","v":2880},{"$f":"'I. Info Sys AD&M'!J71","v":2},{"$f":"'I. Info Sys AD&M'!K71","v":0},{"$f":"'I. Info Sys AD&M'!Y71","v":0},{"$f":"'I. Info Sys AD&M'!B71","v":"I.3.7"},{"$f":"'I. Info Sys AD&M'!C71","v":"Evidence that new system will not adversely affect existing systems, particularly at peak processing times, such as month end?"},{"$f":"'I. Info Sys AD&M'!D71","v":0},{"$f":"'I. Info Sys AD&M'!E71","v":0},{"$f":"'I. Info Sys AD&M'!F71","v":0},{"$f":"'I. Info Sys AD&M'!G71","v":0},{"$f":"'I. Info Sys AD&M'!H71","v":"14.2.3.a"},{"$f":"'I. Info Sys AD&M'!I71","v":"Technical review of applications after operating platform changes"},null,"PO2.3","Data classification scheme","N/A","N/A","PO2.3, PO3.4, AI5.2, DS2.3"]
[{"$f":"'I. Info Sys AD&M'!A72","v":2881},{"$f":"'I. Info Sys AD&M'!J72","v":2},{"$f":"'I. Info Sys AD&M'!K72","v":0},{"$f":"'I. Info Sys AD&M'!Y72","v":0},{"$f":"'I. Info Sys AD&M'!B72","v":"I.3.8"},{"$f":"'I. Info Sys AD&M'!C72","v":"Evidence of the effect on the overall security of the respondent?"},{"$f":"'I. Info Sys AD&M'!D72","v":0},{"$f":"'I. Info Sys AD&M'!E72","v":0},{"$f":"'I. Info Sys AD&M'!F72","v":0},{"$f":"'I. Info Sys AD&M'!G72","v":0},{"$f":"'I. Info Sys AD&M'!H72","v":"14.2.2.c"},{"$f":"'I. Info Sys AD&M'!I72","v":"System change control procedures"},null,"N/A",0,"N/A","IS.1.2.3 OPS.1.4.2 OPS.1.4.3 E-BANK.1.4.2.4","N/A"]
[{"$f":"'I. Info Sys AD&M'!A73","v":2595},{"$f":"'I. Info Sys AD&M'!J73","v":1},{"$f":"'I. Info Sys AD&M'!K73","v":0},{"$f":"'I. Info Sys AD&M'!Y73","v":0},{"$f":"'I. Info Sys AD&M'!B73","v":"I.4"},{"$f":"'I. Info Sys AD&M'!C73","v":"Are system resources reviewed to ensure adequate capacity is maintained?"},{"$f":"'I. Info Sys AD&M'!D73","v":0},{"$f":"'I. Info Sys AD&M'!E73","v":0},{"$f":"'I. Info Sys AD&M'!F73","v":0},{"$f":"'I. Info Sys AD&M'!G73","v":0},{"$f":"'I. Info Sys AD&M'!H73","v":"12.1.3"},{"$f":"'I. Info Sys AD&M'!I73","v":"Capacity Management"},null,"N/A",0,"N/A","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A74","v":2213},{"$f":"'I. Info Sys AD&M'!J74","v":1},{"$f":"'I. Info Sys AD&M'!K74","v":0},{"$f":"'I. Info Sys AD&M'!Y74","v":1},{"$f":"'I. Info Sys AD&M'!B74","v":"I.5"},{"$f":"'I. Info Sys AD&M'!C74","v":"Are systems and applications patched? If yes, does it include:"},{"$f":"'I. Info Sys AD&M'!D74","v":0},{"$f":"'I. Info Sys AD&M'!E74","v":0},{"$f":"'I. Info Sys AD&M'!F74","v":0},{"$f":"'I. Info Sys AD&M'!G74","v":"I.4 System Patching"},{"$f":"'I. Info Sys AD&M'!H74","v":"12.6.1 "},{"$f":"'I. Info Sys AD&M'!I74","v":"Management of technical vulnerabilities"},null,"AI3.3","Infrastructure maintenance",6.2,"D&A.1.11","AI3.3, AI6.2, AI6.3, DS5.5, DS5.7, DS9.2"]
[{"$f":"'I. Info Sys AD&M'!A75","v":2215},{"$f":"'I. Info Sys AD&M'!J75","v":2},{"$f":"'I. Info Sys AD&M'!K75","v":0},{"$f":"'I. Info Sys AD&M'!Y75","v":0},{"$f":"'I. Info Sys AD&M'!B75","v":"I.5.1"},{"$f":"'I. Info Sys AD&M'!C75","v":"Testing of patches, service packs, and hot fixes prior to installation?"},{"$f":"'I. Info Sys AD&M'!D75","v":0},{"$f":"'I. Info Sys AD&M'!E75","v":0},{"$f":"'I. Info Sys AD&M'!F75","v":0},{"$f":"'I. Info Sys AD&M'!G75","v":"I.4 System Patching"},{"$f":"'I. Info Sys AD&M'!H75","v":"12.6.1.g"},{"$f":"'I. Info Sys AD&M'!I75","v":"Management of technical vulnerabilities"},null,"AI3.3","Infrastructure maintenance","6.4.5","D&A.1.11.1.5","AI3.3, AI6.2, AI6.3, DS5.5, DS5.7, DS9.2"]
[{"$f":"'I. Info Sys AD&M'!A76","v":2217},{"$f":"'I. Info Sys AD&M'!J76","v":2},{"$f":"'I. Info Sys AD&M'!K76","v":0},{"$f":"'I. Info Sys AD&M'!Y76","v":0},{"$f":"'I. Info Sys AD&M'!B76","v":"I.5.2"},{"$f":"'I. Info Sys AD&M'!C76","v":"Evaluation and prioritize vulnerabilities?"},{"$f":"'I. Info Sys AD&M'!D76","v":0},{"$f":"'I. Info Sys AD&M'!E76","v":0},{"$f":"'I. Info Sys AD&M'!F76","v":0},{"$f":"'I. Info Sys AD&M'!G76","v":"I.6 Application Security Vulnerability Assessment and Remediation"},{"$f":"'I. Info Sys AD&M'!H76","v":"12.6.1.f"},{"$f":"'I. Info Sys AD&M'!I76","v":"Management of technical vulnerabilities"},null,"AI3.3","Infrastructure maintenance",6.1,"IS.1.6.9 D&A.1.11.1.3","AI3.3, AI6.2, AI6.3, DS5.5, DS5.7, DS9.2"]
[{"$f":"'I. Info Sys AD&M'!A77","v":2686},{"$f":"'I. Info Sys AD&M'!J77","v":2},{"$f":"'I. Info Sys AD&M'!K77","v":0},{"$f":"'I. Info Sys AD&M'!Y77","v":0},{"$f":"'I. Info Sys AD&M'!B77","v":"I.5.3"},{"$f":"'I. Info Sys AD&M'!C77","v":"Logging?"},{"$f":"'I. Info Sys AD&M'!D77","v":0},{"$f":"'I. Info Sys AD&M'!E77","v":0},{"$f":"'I. Info Sys AD&M'!F77","v":0},{"$f":"'I. Info Sys AD&M'!G77","v":0},{"$f":"'I. Info Sys AD&M'!H77","v":"12.6.1.h"},{"$f":"'I. Info Sys AD&M'!I77","v":"Management of technical vulnerabilities"},null,"AI3.3","Infrastructure maintenance","N/A","D&A.1.11.1.8","AI3.3, AI6.2, AI6.3, DS5.5, DS5.7, DS9.2"]
[{"$f":"'I. Info Sys AD&M'!A78","v":2687},{"$f":"'I. Info Sys AD&M'!J78","v":2},{"$f":"'I. Info Sys AD&M'!K78","v":0},{"$f":"'I. Info Sys AD&M'!Y78","v":0},{"$f":"'I. Info Sys AD&M'!B78","v":"I.5.4"},{"$f":"'I. Info Sys AD&M'!C78","v":"Priority patching of high-risk systems first?"},{"$f":"'I. Info Sys AD&M'!D78","v":0},{"$f":"'I. Info Sys AD&M'!E78","v":0},{"$f":"'I. Info Sys AD&M'!F78","v":0},{"$f":"'I. Info Sys AD&M'!G78","v":"I.4 System Patching"},{"$f":"'I. Info Sys AD&M'!H78","v":"12.6.1.j"},{"$f":"'I. Info Sys AD&M'!I78","v":"Management of technical vulnerabilities"},null,"AI3.3","Infrastructure maintenance",6.2,"N/A","AI3.3, AI6.2, AI6.3, DS5.5, DS5.7, DS9.2"]
[{"$f":"'I. Info Sys AD&M'!A79","v":2216},{"$f":"'I. Info Sys AD&M'!J79","v":2},{"$f":"'I. Info Sys AD&M'!K79","v":0},{"$f":"'I. Info Sys AD&M'!Y79","v":0},{"$f":"'I. Info Sys AD&M'!B79","v":"I.5.5"},{"$f":"'I. Info Sys AD&M'!C79","v":"Are third party alert services used to keep up to date with the latest vulnerabilities?"},{"$f":"'I. Info Sys AD&M'!D79","v":0},{"$f":"'I. Info Sys AD&M'!E79","v":0},{"$f":"'I. Info Sys AD&M'!F79","v":0},{"$f":"'I. Info Sys AD&M'!G79","v":0},{"$f":"'I. Info Sys AD&M'!H79","v":"12.6.1.b"},{"$f":"'I. Info Sys AD&M'!I79","v":"Management of technical vulnerabilities"},null,"AI3.3","Infrastructure maintenance","N/A","N/A","AI3.3, AI6.2, AI6.3, DS5.5, DS5.7, DS9.2"]
[{"$f":"'I. Info Sys AD&M'!A80","v":2230},{"$f":"'I. Info Sys AD&M'!J80","v":1},{"$f":"'I. Info Sys AD&M'!K80","v":0},{"$f":"'I. Info Sys AD&M'!Y80","v":1},{"$f":"'I. Info Sys AD&M'!B80","v":"I.6"},{"$f":"'I. Info Sys AD&M'!C80","v":"Is a web site supported, hosted or maintained that has access to Scoped Systems and Data? If yes, is there:"},{"$f":"'I. Info Sys AD&M'!D80","v":0},{"$f":"'I. Info Sys AD&M'!E80","v":0},{"$f":"'I. Info Sys AD&M'!F80","v":0},{"$f":"'I. Info Sys AD&M'!G80","v":0},{"$f":"'I. Info Sys AD&M'!H80","v":"NA"},{"$f":"'I. Info Sys AD&M'!I80","v":0},null,"N/A",0,"N/A","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A81","v":2231},{"$f":"'I. Info Sys AD&M'!J81","v":2},{"$f":"'I. Info Sys AD&M'!K81","v":0},{"$f":"'I. Info Sys AD&M'!Y81","v":0},{"$f":"'I. Info Sys AD&M'!B81","v":"I.6.1"},{"$f":"'I. Info Sys AD&M'!C81","v":"Regular penetration tests executed against web-based applications?"},{"$f":"'I. Info Sys AD&M'!D81","v":0},{"$f":"'I. Info Sys AD&M'!E81","v":0},{"$f":"'I. Info Sys AD&M'!F81","v":0},{"$f":"'I. Info Sys AD&M'!G81","v":"I.1 Application Vulnerability Assessments/Ethical Hacking"},{"$f":"'I. Info Sys AD&M'!H81","v":"18.2.3 "},{"$f":"'I. Info Sys AD&M'!I81","v":"Technical compliance review"},null,"DS5.5","Security testing, surveillance and monitoring",11.3,"E-BANK.1.4.8.3 E-BANK.1.1.1.8.4","DS5.5, DS5.7, ME2.5"]
[{"$f":"'I. Info Sys AD&M'!A82","v":2076},{"$f":"'I. Info Sys AD&M'!J82","v":2},{"$f":"'I. Info Sys AD&M'!K82","v":0},{"$f":"'I. Info Sys AD&M'!Y82","v":0},{"$f":"'I. Info Sys AD&M'!B82","v":"I.6.2"},{"$f":"'I. Info Sys AD&M'!C82","v":"Physical separation of server components (web, application, database)?"},{"$f":"'I. Info Sys AD&M'!D82","v":0},{"$f":"'I. Info Sys AD&M'!E82","v":0},{"$f":"'I. Info Sys AD&M'!F82","v":0},{"$f":"'I. Info Sys AD&M'!G82","v":0},{"$f":"'I. Info Sys AD&M'!H82","v":"13.1.3 "},{"$f":"'I. Info Sys AD&M'!I82","v":"Segregation in networks"},null,"DS5.3","Identity management","2.2.1","N/A","DS5.4"]
[{"$f":"'I. Info Sys AD&M'!A83","v":2081},{"$f":"'I. Info Sys AD&M'!J83","v":2},{"$f":"'I. Info Sys AD&M'!K83","v":0},{"$f":"'I. Info Sys AD&M'!Y83","v":0},{"$f":"'I. Info Sys AD&M'!B83","v":"I.6.3"},{"$f":"'I. Info Sys AD&M'!C83","v":"Web applications configured to follow best practices or security guidelines (OWASP)?"},{"$f":"'I. Info Sys AD&M'!D83","v":0},{"$f":"'I. Info Sys AD&M'!E83","v":0},{"$f":"'I. Info Sys AD&M'!F83","v":0},{"$f":"'I. Info Sys AD&M'!G83","v":0},{"$f":"'I. Info Sys AD&M'!H83","v":"13.1.1"},{"$f":"'I. Info Sys AD&M'!I83","v":"Network Controls"},null,"N/A",0,"N/A","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A84","v":2109},{"$f":"'I. Info Sys AD&M'!J84","v":2},{"$f":"'I. Info Sys AD&M'!K84","v":0},{"$f":"'I. Info Sys AD&M'!Y84","v":0},{"$f":"'I. Info Sys AD&M'!B84","v":"I.6.4"},{"$f":"'I. Info Sys AD&M'!C84","v":"Data input into applications validated for accuracy?"},{"$f":"'I. Info Sys AD&M'!D84","v":0},{"$f":"'I. Info Sys AD&M'!E84","v":0},{"$f":"'I. Info Sys AD&M'!F84","v":0},{"$f":"'I. Info Sys AD&M'!G84","v":0},{"$f":"'I. Info Sys AD&M'!H84","v":"14.2.1"},{"$f":"'I. Info Sys AD&M'!I84","v":"Securing application services on public networks"},null,"AI2.3","Application control and auditability","N/A","IS.2.G.2","AI2.3"]
[{"$f":"'I. Info Sys AD&M'!A85","v":2110},{"$f":"'I. Info Sys AD&M'!J85","v":2},{"$f":"'I. Info Sys AD&M'!K85","v":0},{"$f":"'I. Info Sys AD&M'!Y85","v":0},{"$f":"'I. Info Sys AD&M'!B85","v":"I.6.5"},{"$f":"'I. Info Sys AD&M'!C85","v":"Validation checks include cross site scripting and SQL injections?"},{"$f":"'I. Info Sys AD&M'!D85","v":0},{"$f":"'I. Info Sys AD&M'!E85","v":0},{"$f":"'I. Info Sys AD&M'!F85","v":0},{"$f":"'I. Info Sys AD&M'!G85","v":0},{"$f":"'I. Info Sys AD&M'!H85","v":"14.2.1"},{"$f":"'I. Info Sys AD&M'!I85","v":"Securing application services on public networks"},null,"AI2.3","Application control and auditability","6.5.7","N/A","AI2.3"]
[{"$f":"'I. Info Sys AD&M'!A86","v":2225},{"$f":"'I. Info Sys AD&M'!J86","v":1},{"$f":"'I. Info Sys AD&M'!K86","v":0},{"$f":"'I. Info Sys AD&M'!Y86","v":1},{"$f":"'I. Info Sys AD&M'!B86","v":"I.7"},{"$f":"'I. Info Sys AD&M'!C86","v":"Are vulnerability tests (internal/external) performed on all applications at least annually? If yes, are there:"},{"$f":"'I. Info Sys AD&M'!D86","v":0},{"$f":"'I. Info Sys AD&M'!E86","v":0},{"$f":"'I. Info Sys AD&M'!F86","v":0},{"$f":"'I. Info Sys AD&M'!G86","v":"I.1 Application Vulnerability Assessments/Ethical Hacking"},{"$f":"'I. Info Sys AD&M'!H86","v":"18.2.3"},{"$f":"'I. Info Sys AD&M'!I86","v":"Technical compliance review"},null,"DS5.5","Security testing, surveillance and monitoring",11.2,"IS.2.M.10.3 E-BANK.1.2.5.2 E-BANK.1.1.1.8.3","DS5.5, DS5.7, ME2.5"]
[{"$f":"'I. Info Sys AD&M'!A87","v":2220},{"$f":"'I. Info Sys AD&M'!J87","v":2},{"$f":"'I. Info Sys AD&M'!K87","v":0},{"$f":"'I. Info Sys AD&M'!Y87","v":0},{"$f":"'I. Info Sys AD&M'!B87","v":"I.7.1"},{"$f":"'I. Info Sys AD&M'!C87","v":"Results tracked, remediated and reported to management?"},{"$f":"'I. Info Sys AD&M'!D87","v":0},{"$f":"'I. Info Sys AD&M'!E87","v":0},{"$f":"'I. Info Sys AD&M'!F87","v":0},{"$f":"'I. Info Sys AD&M'!G87","v":0},{"$f":"'I. Info Sys AD&M'!H87","v":"18.2.2"},{"$f":"'I. Info Sys AD&M'!I87","v":"Compliance With Security Policies And Standards"},null,"PO4.8","Responsibility for risk, security and compliance",11.2,"N/A","PO4.8, PO6.2, ME2.1, ME2.2, ME2.3, ME2.4, ME2.5, ME2.6, ME2.7"]
[{"$f":"'I. Info Sys AD&M'!A88","v":2233},{"$f":"'I. Info Sys AD&M'!J88","v":2},{"$f":"'I. Info Sys AD&M'!K88","v":0},{"$f":"'I. Info Sys AD&M'!Y88","v":0},{"$f":"'I. Info Sys AD&M'!B88","v":"I.7.2"},{"$f":"'I. Info Sys AD&M'!C88","v":"Processes to manage threat and vulnerability assessment tools and the data they collect?"},{"$f":"'I. Info Sys AD&M'!D88","v":0},{"$f":"'I. Info Sys AD&M'!E88","v":0},{"$f":"'I. Info Sys AD&M'!F88","v":0},{"$f":"'I. Info Sys AD&M'!G88","v":"I.5 Application Security Program Governance"},{"$f":"'I. Info Sys AD&M'!H88","v":"12.6.1"},{"$f":"'I. Info Sys AD&M'!I88","v":"Management of technical vulnerabilities"},null,"AI2.3","Application control and auditability",11.2,"N/A","AI2.3, AI2.4, DS5.7"]
[{"$f":"'I. Info Sys AD&M'!A89","v":1806},{"$f":"'I. Info Sys AD&M'!J89","v":1},{"$f":"'I. Info Sys AD&M'!K89","v":0},{"$f":"'I. Info Sys AD&M'!Y89","v":1},{"$f":"'I. Info Sys AD&M'!B89","v":"I.8"},{"$f":"'I. Info Sys AD&M'!C89","v":"Are encryption tools managed and maintained for Scoped Data? If yes, is there:"},{"$f":"'I. Info Sys AD&M'!D89","v":0},{"$f":"'I. Info Sys AD&M'!E89","v":0},{"$f":"'I. Info Sys AD&M'!F89","v":0},{"$f":"'I. Info Sys AD&M'!G89","v":"G.22 Data Security Policy - Encryption"},{"$f":"'I. Info Sys AD&M'!H89","v":10.1},{"$f":"'I. Info Sys AD&M'!I89","v":"Cryptographic controls"},null,"N/A",0,3.6,"WPS.2.5","N/A"]
[{"$f":"'I. Info Sys AD&M'!A90","v":1807},{"$f":"'I. Info Sys AD&M'!J90","v":2},{"$f":"'I. Info Sys AD&M'!K90","v":0},{"$f":"'I. Info Sys AD&M'!Y90","v":0},{"$f":"'I. Info Sys AD&M'!B90","v":"I.8.1"},{"$f":"'I. Info Sys AD&M'!C90","v":"An encryption policy?"},{"$f":"'I. Info Sys AD&M'!D90","v":0},{"$f":"'I. Info Sys AD&M'!E90","v":0},{"$f":"'I. Info Sys AD&M'!F90","v":0},{"$f":"'I. Info Sys AD&M'!G90","v":"G.22 Data Security Policy - Encryption"},{"$f":"'I. Info Sys AD&M'!H90","v":"10.1.1"},{"$f":"'I. Info Sys AD&M'!I90","v":"Policy On The Use Of Cryptographic Controls"},null,"PO6.2","Enterprise IT risk and internal control framework",4.3,"N/A","PO6, AI2, DS5"]
[{"$f":"'I. Info Sys AD&M'!A91","v":1813},{"$f":"'I. Info Sys AD&M'!J91","v":2},{"$f":"'I. Info Sys AD&M'!K91","v":0},{"$f":"'I. Info Sys AD&M'!Y91","v":0},{"$f":"'I. Info Sys AD&M'!B91","v":"I.8.2"},{"$f":"'I. Info Sys AD&M'!C91","v":"Encryption in storage / at rest?"},{"$f":"'I. Info Sys AD&M'!D91","v":0},{"$f":"'I. Info Sys AD&M'!E91","v":0},{"$f":"'I. Info Sys AD&M'!F91","v":0},{"$f":"'I. Info Sys AD&M'!G91","v":"G.22 Data Security Policy - Encryption"},{"$f":"'I. Info Sys AD&M'!H91","v":"10.1.1 Section 2.a"},{"$f":"'I. Info Sys AD&M'!I91","v":"Policy On The Use Of Cryptographic Controls"},null,"N/A",0,"3.5, 3.5.2","OPS.1.6.1 RPS.2.C.2.8","PO2.3, PO6.2, DS11.1"]
[{"$f":"'I. Info Sys AD&M'!A92","v":3219},{"$f":"'I. Info Sys AD&M'!J92","v":2},{"$f":"'I. Info Sys AD&M'!K92","v":0},{"$f":"'I. Info Sys AD&M'!Y92","v":0},{"$f":"'I. Info Sys AD&M'!B92","v":"I.8.3"},{"$f":"'I. Info Sys AD&M'!C92","v":"Clear text data ever visible by anyone, including system administrators?"},{"$f":"'I. Info Sys AD&M'!D92","v":0},{"$f":"'I. Info Sys AD&M'!E92","v":0},{"$f":"'I. Info Sys AD&M'!F92","v":0},{"$f":"'I. Info Sys AD&M'!G92","v":0},{"$f":"'I. Info Sys AD&M'!H92","v":"NA"},{"$f":"'I. Info Sys AD&M'!I92","v":0},null,"N/A",0,"3.3, 3.4","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A93","v":1814},{"$f":"'I. Info Sys AD&M'!J93","v":2},{"$f":"'I. Info Sys AD&M'!K93","v":0},{"$f":"'I. Info Sys AD&M'!Y93","v":0},{"$f":"'I. Info Sys AD&M'!B93","v":"I.8.4"},{"$f":"'I. Info Sys AD&M'!C93","v":"Centralized key management system?"},{"$f":"'I. Info Sys AD&M'!D93","v":0},{"$f":"'I. Info Sys AD&M'!E93","v":0},{"$f":"'I. Info Sys AD&M'!F93","v":0},{"$f":"'I. Info Sys AD&M'!G93","v":"G.22 Data Security Policy - Encryption"},{"$f":"'I. Info Sys AD&M'!H93","v":"10.1.2"},{"$f":"'I. Info Sys AD&M'!I93","v":"Key Management"},null,"DS5.8","Cryptographic key management","N/A","N/A","DS5"]
[{"$f":"'I. Info Sys AD&M'!A94","v":1815},{"$f":"'I. Info Sys AD&M'!J94","v":2},{"$f":"'I. Info Sys AD&M'!K94","v":0},{"$f":"'I. Info Sys AD&M'!Y94","v":0},{"$f":"'I. Info Sys AD&M'!B94","v":"I.8.5"},{"$f":"'I. Info Sys AD&M'!C94","v":"Encryption keys encrypted at rest and when transmitted?"},{"$f":"'I. Info Sys AD&M'!D94","v":0},{"$f":"'I. Info Sys AD&M'!E94","v":0},{"$f":"'I. Info Sys AD&M'!F94","v":0},{"$f":"'I. Info Sys AD&M'!G94","v":"G.22 Data Security Policy - Encryption"},{"$f":"'I. Info Sys AD&M'!H94","v":"10.1.2"},{"$f":"'I. Info Sys AD&M'!I94","v":"Key Management"},null,"N/A",0,"3.6.2, 3.6.3","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A95","v":1902},{"$f":"'I. Info Sys AD&M'!J95","v":2},{"$f":"'I. Info Sys AD&M'!K95","v":0},{"$f":"'I. Info Sys AD&M'!Y95","v":0},{"$f":"'I. Info Sys AD&M'!B95","v":"I.8.6"},{"$f":"'I. Info Sys AD&M'!C95","v":"Segregation of duties between key management duties and normal operational duties?"},{"$f":"'I. Info Sys AD&M'!D95","v":0},{"$f":"'I. Info Sys AD&M'!E95","v":0},{"$f":"'I. Info Sys AD&M'!F95","v":0},{"$f":"'I. Info Sys AD&M'!G95","v":0},{"$f":"'I. Info Sys AD&M'!H95","v":"6.1.2"},{"$f":"'I. Info Sys AD&M'!I95","v":"Segregation Of Duties"},null,"PO4.11","Segregation of duties","N/A","IS.1.6.8 MGMT.1.2.1.3 RPS.1.3.1.3","PO4.11, DS5.4"]
[{"$f":"'I. Info Sys AD&M'!A96","v":1865},{"$f":"'I. Info Sys AD&M'!J96","v":2},{"$f":"'I. Info Sys AD&M'!K96","v":0},{"$f":"'I. Info Sys AD&M'!Y96","v":0},{"$f":"'I. Info Sys AD&M'!B96","v":"I.8.7"},{"$f":"'I. Info Sys AD&M'!C96","v":"Key/certificate sharing between production and non-production?"},{"$f":"'I. Info Sys AD&M'!D96","v":0},{"$f":"'I. Info Sys AD&M'!E96","v":0},{"$f":"'I. Info Sys AD&M'!F96","v":0},{"$f":"'I. Info Sys AD&M'!G96","v":0},{"$f":"'I. Info Sys AD&M'!H96","v":"12.1.4.g"},{"$f":"'I. Info Sys AD&M'!I96","v":"Separation Of Development, Test, And Operational Facilities"},null,"PO4.11","Segregation of duties","N/A","N/A","PO4.11, AI3.4, AI7.4"]
[{"$f":"'I. Info Sys AD&M'!A97","v":1866},{"$f":"'I. Info Sys AD&M'!J97","v":2},{"$f":"'I. Info Sys AD&M'!K97","v":0},{"$f":"'I. Info Sys AD&M'!Y97","v":0},{"$f":"'I. Info Sys AD&M'!B97","v":"I.8.8"},{"$f":"'I. Info Sys AD&M'!C97","v":"Default certificates provided by vendors replaced with proprietary certificates?"},{"$f":"'I. Info Sys AD&M'!D97","v":0},{"$f":"'I. Info Sys AD&M'!E97","v":0},{"$f":"'I. Info Sys AD&M'!F97","v":0},{"$f":"'I. Info Sys AD&M'!G97","v":0},{"$f":"'I. Info Sys AD&M'!H97","v":"10.1.2.e"},{"$f":"'I. Info Sys AD&M'!I97","v":"Key Management"},null,"DS5.3","Identity management","2.1.1","IS.2.A.1","DS5.3"]
[{"$f":"'I. Info Sys AD&M'!A98","v":1859},{"$f":"'I. Info Sys AD&M'!J98","v":2},{"$f":"'I. Info Sys AD&M'!K98","v":0},{"$f":"'I. Info Sys AD&M'!Y98","v":0},{"$f":"'I. Info Sys AD&M'!B98","v":"I.8.9"},{"$f":"'I. Info Sys AD&M'!C98","v":"Segregation of access to both parts of an asymmetric key?"},{"$f":"'I. Info Sys AD&M'!D98","v":0},{"$f":"'I. Info Sys AD&M'!E98","v":0},{"$f":"'I. Info Sys AD&M'!F98","v":0},{"$f":"'I. Info Sys AD&M'!G98","v":0},{"$f":"'I. Info Sys AD&M'!H98","v":"10.1.2.d"},{"$f":"'I. Info Sys AD&M'!I98","v":"Key Management"},null,"DS5.8","Cryptographic key management","N/A","IS.2.K.3.4","DS5"]
[{"$f":"'I. Info Sys AD&M'!A99","v":1860},{"$f":"'I. Info Sys AD&M'!J99","v":2},{"$f":"'I. Info Sys AD&M'!K99","v":0},{"$f":"'I. Info Sys AD&M'!Y99","v":0},{"$f":"'I. Info Sys AD&M'!B99","v":"I.8.10"},{"$f":"'I. Info Sys AD&M'!C99","v":"Asymmetric encryption key length a minimum of 2048 bit?"},{"$f":"'I. Info Sys AD&M'!D99","v":0},{"$f":"'I. Info Sys AD&M'!E99","v":0},{"$f":"'I. Info Sys AD&M'!F99","v":0},{"$f":"'I. Info Sys AD&M'!G99","v":0},{"$f":"'I. Info Sys AD&M'!H99","v":"NA"},{"$f":"'I. Info Sys AD&M'!I99","v":0},null,"N/A",0,"N/A","N/A","N/A"]
[{"$f":"'I. Info Sys AD&M'!A100","v":0},{"$f":"'I. Info Sys AD&M'!J100","v":0},{"$f":"'I. Info Sys AD&M'!K100","v":0},{"$f":"'I. Info Sys AD&M'!Y100","v":0},{"$f":"'I. Info Sys AD&M'!B100","v":0},{"$f":"'I. Info Sys AD&M'!C100","v":0},{"$f":"'I. Info Sys AD&M'!D100","v":0},{"$f":"'I. Info Sys AD&M'!E100","v":0},{"$f":"'I. Info Sys AD&M'!F100","v":0},{"$f":"'I. Info Sys AD&M'!G100","v":0},{"$f":"'I. Info Sys AD&M'!H100","v":0},{"$f":"'I. Info Sys AD&M'!I100","v":0}]
[{"$f":"'I. Info Sys AD&M'!A101","v":0},{"$f":"'I. Info Sys AD&M'!J101","v":0},{"$f":"'I. Info Sys AD&M'!K101","v":0},{"$f":"'I. Info Sys AD&M'!Y101","v":0},{"$f":"'I. Info Sys AD&M'!B101","v":0},{"$f":"'I. Info Sys AD&M'!C101","v":0},{"$f":"'I. Info Sys AD&M'!D101","v":0},{"$f":"'I. Info Sys AD&M'!E101","v":0},{"$f":"'I. Info Sys AD&M'!F101","v":0},{"$f":"'I. Info Sys AD&M'!G101","v":0},{"$f":"'I. Info Sys AD&M'!H101","v":0},{"$f":"'I. Info Sys AD&M'!I101","v":0}]
[{"$f":"'J. Incident Event & Comm Mgmt'!B1","v":"J. Incident Event and Communications Management"},null,null,null,{"$f":"'J. Incident Event & Comm Mgmt'!B1","v":"J. Incident Event and Communications Management"}]
[{"$f":"'J. Incident Event & Comm Mgmt'!A5","v":2241},{"$f":"'J. Incident Event & Comm Mgmt'!J5","v":1},{"$f":"'J. Incident Event & Comm Mgmt'!K5","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y5","v":1},{"$f":"'J. Incident Event & Comm Mgmt'!B5","v":"J.1"},{"$f":"'J. Incident Event & Comm Mgmt'!C5","v":"Is there an Incident Management program?"},{"$f":"'J. Incident Event & Comm Mgmt'!D5","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E5","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F5","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G5","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!H5","v":16},{"$f":"'J. Incident Event & Comm Mgmt'!I5","v":" Information security incident management"},null,null,null,"N/A","IS.2.M.13 OPS.1.5.1.9 OPS.1.10","N/A"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A6","v":2698},{"$f":"'J. Incident Event & Comm Mgmt'!J6","v":2},{"$f":"'J. Incident Event & Comm Mgmt'!K6","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y6","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B6","v":"J.1.1"},{"$f":"'J. Incident Event & Comm Mgmt'!C6","v":"Is there a documented policy for incident management that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"'J. Incident Event & Comm Mgmt'!D6","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E6","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F6","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G6","v":"J.1 Information Security / Information Technology Incident Management - Policy and Procedures Content"},{"$f":"'J. Incident Event & Comm Mgmt'!H6","v":"16.1.1 "},{"$f":"'J. Incident Event & Comm Mgmt'!I6","v":"Responsibilities and procedures"},null,"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A7","v":2246},{"$f":"'J. Incident Event & Comm Mgmt'!J7","v":2},{"$f":"'J. Incident Event & Comm Mgmt'!K7","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y7","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B7","v":"J.1.2"},{"$f":"'J. Incident Event & Comm Mgmt'!C7","v":"Is there a formal Incident Response Plan. If yes, does it include:"},{"$f":"'J. Incident Event & Comm Mgmt'!D7","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E7","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F7","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G7","v":"J. Incident Event and Communications Management"},{"$f":"'J. Incident Event & Comm Mgmt'!H7","v":"16.1.1.a.1"},{"$f":"'J. Incident Event & Comm Mgmt'!I7","v":"Responsibilities and procedures"},null,"PO9.3","Event identification","N/A","IS.1.6.5 E-BANK.1.4.7.3","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A8","v":2274},{"$f":"'J. Incident Event & Comm Mgmt'!J8","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!K8","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y8","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B8","v":"J.1.2.1"},{"$f":"'J. Incident Event & Comm Mgmt'!C8","v":"Reporting procedure for an information security event?"},{"$f":"'J. Incident Event & Comm Mgmt'!D8","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E8","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F8","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G8","v":"J.3 Incident Response Communication"},{"$f":"'J. Incident Event & Comm Mgmt'!H8","v":"16.1.1.a.2"},{"$f":"'J. Incident Event & Comm Mgmt'!I8","v":"Responsibilities and procedures"},null,"PO9.3","Event identification","12.5.3","IS.1.7.9 OPS.1.10.1.2 OPS.2.12.F.3 E-BANK.1.4.7.1","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A9","v":2699},{"$f":"'J. Incident Event & Comm Mgmt'!J9","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!K9","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y9","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B9","v":"J.1.2.2"},{"$f":"'J. Incident Event & Comm Mgmt'!C9","v":"Escalation procedure?"},{"$f":"'J. Incident Event & Comm Mgmt'!D9","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E9","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F9","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G9","v":"J.1 Procedure: b.6"},{"$f":"'J. Incident Event & Comm Mgmt'!H9","v":"16.1.1.a.6"},{"$f":"'J. Incident Event & Comm Mgmt'!I9","v":"Responsibilities and procedures"},null,"PO9.3","Event identification","N/A","IS.2.M.13.3","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A10","v":2276},{"$f":"'J. Incident Event & Comm Mgmt'!J10","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!K10","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y10","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B10","v":"J.1.2.3"},{"$f":"'J. Incident Event & Comm Mgmt'!C10","v":"An Incident / Event Response team with defined roles and response related qualifications available 24x7x365?"},{"$f":"'J. Incident Event & Comm Mgmt'!D10","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E10","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F10","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G10","v":"J.1 Procedure: b.2"},{"$f":"'J. Incident Event & Comm Mgmt'!H10","v":"16.1.5 "},{"$f":"'J. Incident Event & Comm Mgmt'!I10","v":"Response to information security incidents"},null,"PO9.3","Event identification",12.5,"IS.2.M.14 IS.2.M.20","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A11","v":2280},{"$f":"'J. Incident Event & Comm Mgmt'!J11","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!K11","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y11","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B11","v":"J.1.2.4"},{"$f":"'J. Incident Event & Comm Mgmt'!C11","v":"Procedures to collect and maintain a chain of custody for evidence during incident investigation?"},{"$f":"'J. Incident Event & Comm Mgmt'!D11","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E11","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F11","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G11","v":"J.7 Information Security / Information Technology Incident Management - Incident Documentation"},{"$f":"'J. Incident Event & Comm Mgmt'!H11","v":"16.1.7"},{"$f":"'J. Incident Event & Comm Mgmt'!I11","v":"Collection of Evidence"},null,"AI2.3","Application control and auditability","N/A","IS.1.6.6","AI2.3, DS5.6, DS5.7, DS8.2, DS8.3, DS8.4"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A12","v":2702},{"$f":"'J. Incident Event & Comm Mgmt'!J12","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!K12","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y12","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B12","v":"J.1.2.5"},{"$f":"'J. Incident Event & Comm Mgmt'!C12","v":"Feedback process to ensure those reporting information security events are notified of the results after the issue has been dealt with and closed?"},{"$f":"'J. Incident Event & Comm Mgmt'!D12","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E12","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F12","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G12","v":"J.3 Incident Response Communication"},{"$f":"'J. Incident Event & Comm Mgmt'!H12","v":"16.1.1.c.4"},{"$f":"'J. Incident Event & Comm Mgmt'!I12","v":"Responsibilities and procedures"},null,"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A13","v":2703},{"$f":"'J. Incident Event & Comm Mgmt'!J13","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!K13","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y13","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B13","v":"J.1.2.6"},{"$f":"'J. Incident Event & Comm Mgmt'!C13","v":"Event reporting mechanism to support the reporting action, and to list all necessary actions in case of an information security event?"},{"$f":"'J. Incident Event & Comm Mgmt'!D13","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E13","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F13","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G13","v":"J.7 Information Security / Information Technology Incident Management - Incident Documentation"},{"$f":"'J. Incident Event & Comm Mgmt'!H13","v":"16.1.1.a.2"},{"$f":"'J. Incident Event & Comm Mgmt'!I13","v":"Responsibilities and procedures"},null,"PO9.3","Event identification",10.3,"E-BANK.1.4.7.4","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A14","v":2704},{"$f":"'J. Incident Event & Comm Mgmt'!J14","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!K14","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y14","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B14","v":"J.1.2.7"},{"$f":"'J. Incident Event & Comm Mgmt'!C14","v":"Actions to be taken in the event of an information security event?"},{"$f":"'J. Incident Event & Comm Mgmt'!D14","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E14","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F14","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G14","v":"J.1 procedure b.5"},{"$f":"'J. Incident Event & Comm Mgmt'!H14","v":"16.1.1.c.1"},{"$f":"'J. Incident Event & Comm Mgmt'!I14","v":"Responsibilities and procedures"},null,"PO9.3","Event identification","12.5.3","IS.1.6.11.1","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A15","v":2705},{"$f":"'J. Incident Event & Comm Mgmt'!J15","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!K15","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y15","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B15","v":"J.1.2.8"},{"$f":"'J. Incident Event & Comm Mgmt'!C15","v":"Formal disciplinary process for dealing with those who commit a security breach?"},{"$f":"'J. Incident Event & Comm Mgmt'!D15","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E15","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F15","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G15","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!H15","v":"16.1.1.c.3"},{"$f":"'J. Incident Event & Comm Mgmt'!I15","v":"Responsibilities and procedures"},null,"PO9.3","Event identification","N/A","IS.2.F.6","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A16","v":2273},{"$f":"'J. Incident Event & Comm Mgmt'!J16","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!K16","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y16","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B16","v":"J.1.2.9"},{"$f":"'J. Incident Event & Comm Mgmt'!C16","v":"Process for assessing and executing client and third party notification requirements (legal, regulatory, and contractual)?"},{"$f":"'J. Incident Event & Comm Mgmt'!D16","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E16","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F16","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G16","v":"J.3 Incident Response Communication"},{"$f":"'J. Incident Event & Comm Mgmt'!H16","v":"16.1.1.b.3"},{"$f":"'J. Incident Event & Comm Mgmt'!I16","v":"Responsibilities and procedures"},null,"PO9.3","Event identification","12.10.1","IS.1.6.11.2 IS.1.6.11.3 IS.2.M.21.3","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A17","v":2275},{"$f":"'J. Incident Event & Comm Mgmt'!J17","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!K17","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y17","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B17","v":"J.1.2.10"},{"$f":"'J. Incident Event & Comm Mgmt'!C17","v":"Postmortem to include root cause analysis and remediation plan, provided to leadership?"},{"$f":"'J. Incident Event & Comm Mgmt'!D17","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E17","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F17","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G17","v":"J.6  Information Security / Information Technology Incident Management - Analysis\nJ.7 Information Security / Information Technology Incident Management - Incident Documentation"},{"$f":"'J. Incident Event & Comm Mgmt'!H17","v":"16.1.5 "},{"$f":"'J. Incident Event & Comm Mgmt'!I17","v":"Response to information security incidents"},null,"PO9.3","Event identification","12.10.1","N/A","PO9.3, DS5.5, DS5.6, DS5.7, DS8.2, DS8.3"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A18","v":2249},{"$f":"'J. Incident Event & Comm Mgmt'!J18","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!K18","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y18","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B18","v":"J.1.2.11"},{"$f":"'J. Incident Event & Comm Mgmt'!C18","v":"Is there an identification of incident process? If yes, does it include:"},{"$f":"'J. Incident Event & Comm Mgmt'!D18","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E18","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F18","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G18","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H18","v":"16.1.1.a.5"},{"$f":"'J. Incident Event & Comm Mgmt'!I18","v":"Responsibilities and procedures"},null,null,null,"12.5.2","N/A","N/A"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A19","v":2266},{"$f":"'J. Incident Event & Comm Mgmt'!J19","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!K19","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y19","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B19","v":"J.1.2.11.1"},{"$f":"'J. Incident Event & Comm Mgmt'!C19","v":"Unauthorized physical access?"},{"$f":"'J. Incident Event & Comm Mgmt'!D19","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E19","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F19","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G19","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H19","v":"16.1.2.e"},{"$f":"'J. Incident Event & Comm Mgmt'!I19","v":"Reporting information security events"},null,"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A20","v":2259},{"$f":"'J. Incident Event & Comm Mgmt'!J20","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!K20","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y20","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B20","v":"J.1.2.11.2"},{"$f":"'J. Incident Event & Comm Mgmt'!C20","v":"Information system failure or loss of service?"},{"$f":"'J. Incident Event & Comm Mgmt'!D20","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E20","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F20","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G20","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H20","v":"16.1.2.g"},{"$f":"'J. Incident Event & Comm Mgmt'!I20","v":"Reporting information security events"},null,"PO6.1","IT policy and control environment","N/A","OPS.1.10.2.1","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A21","v":2264},{"$f":"'J. Incident Event & Comm Mgmt'!J21","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!K21","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y21","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B21","v":"J.1.2.11.3"},{"$f":"'J. Incident Event & Comm Mgmt'!C21","v":"Malware activity (anti-virus, worms, Trojans)?"},{"$f":"'J. Incident Event & Comm Mgmt'!D21","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E21","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F21","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G21","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H21","v":"16.1.2.h"},{"$f":"'J. Incident Event & Comm Mgmt'!I21","v":"Reporting information security events"},null,"PO6.1","IT policy and control environment","N/A","IS.2.M.9.2.5","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A22","v":2260},{"$f":"'J. Incident Event & Comm Mgmt'!J22","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!K22","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y22","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B22","v":"J.1.2.11.4"},{"$f":"'J. Incident Event & Comm Mgmt'!C22","v":"Denial of service?"},{"$f":"'J. Incident Event & Comm Mgmt'!D22","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E22","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F22","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G22","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H22","v":"16.1.2.f"},{"$f":"'J. Incident Event & Comm Mgmt'!I22","v":"Reporting information security events"},null,"PO6.1","IT policy and control environment","N/A","N/A","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A23","v":2707},{"$f":"'J. Incident Event & Comm Mgmt'!J23","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!K23","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y23","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B23","v":"J.1.2.11.5"},{"$f":"'J. Incident Event & Comm Mgmt'!C23","v":"Errors resulting from incomplete or inaccurate business data?"},{"$f":"'J. Incident Event & Comm Mgmt'!D23","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E23","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F23","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G23","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H23","v":"16.1.2.b"},{"$f":"'J. Incident Event & Comm Mgmt'!I23","v":"Reporting information security events"},null,"PO6.1","IT policy and control environment","N/A","OPS.1.10.2.2 E-BANK.1.4.3.7","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A24","v":2262},{"$f":"'J. Incident Event & Comm Mgmt'!J24","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!K24","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y24","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B24","v":"J.1.2.11.6"},{"$f":"'J. Incident Event & Comm Mgmt'!C24","v":"Breach or loss of confidentiality?"},{"$f":"'J. Incident Event & Comm Mgmt'!D24","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E24","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F24","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G24","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H24","v":"16.1.2.b"},{"$f":"'J. Incident Event & Comm Mgmt'!I24","v":"Reporting information security events"},null,"PO6.1","IT policy and control environment","N/A","N/A","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A25","v":2261},{"$f":"'J. Incident Event & Comm Mgmt'!J25","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!K25","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y25","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B25","v":"J.1.2.11.7"},{"$f":"'J. Incident Event & Comm Mgmt'!C25","v":"System exploit?"},{"$f":"'J. Incident Event & Comm Mgmt'!D25","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E25","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F25","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G25","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H25","v":"16.1.2.f"},{"$f":"'J. Incident Event & Comm Mgmt'!I25","v":"Reporting information security events"},null,"PO6.1","IT policy and control environment","N/A","N/A","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A26","v":2267},{"$f":"'J. Incident Event & Comm Mgmt'!J26","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!K26","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y26","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B26","v":"J.1.2.11.8"},{"$f":"'J. Incident Event & Comm Mgmt'!C26","v":"Unauthorized logical access or use of system resources?"},{"$f":"'J. Incident Event & Comm Mgmt'!D26","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E26","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F26","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G26","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H26","v":"16.1.2.h"},{"$f":"'J. Incident Event & Comm Mgmt'!I26","v":"Reporting information security events"},null,"PO6.1","IT policy and control environment","N/A","OPS.1.10.2.3","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A27","v":2251},{"$f":"'J. Incident Event & Comm Mgmt'!J27","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!K27","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y27","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B27","v":"J.1.2.11.9"},{"$f":"'J. Incident Event & Comm Mgmt'!C27","v":"Containment?"},{"$f":"'J. Incident Event & Comm Mgmt'!D27","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E27","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F27","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G27","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H27","v":"NA"},{"$f":"'J. Incident Event & Comm Mgmt'!I27","v":0},null,"PO6.1","IT policy and control environment","N/A","N/A","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A28","v":2256},{"$f":"'J. Incident Event & Comm Mgmt'!J28","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!K28","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y28","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B28","v":"J.1.2.11.10"},{"$f":"'J. Incident Event & Comm Mgmt'!C28","v":"Remediation?"},{"$f":"'J. Incident Event & Comm Mgmt'!D28","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E28","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F28","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G28","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H28","v":"16.1.5.f "},{"$f":"'J. Incident Event & Comm Mgmt'!I28","v":"Response to information security incidents"},null,"PO6.1","IT policy and control environment","N/A","IS.2.M.19","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A29","v":2250},{"$f":"'J. Incident Event & Comm Mgmt'!J29","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!K29","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y29","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B29","v":"J.1.2.11.11"},{"$f":"'J. Incident Event & Comm Mgmt'!C29","v":"Notification of stakeholders?"},{"$f":"'J. Incident Event & Comm Mgmt'!D29","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E29","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F29","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G29","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H29","v":"16.1.1.a.6"},{"$f":"'J. Incident Event & Comm Mgmt'!I29","v":"Responsibilities and procedures"},null,"PO6.1","IT policy and control environment","N/A","N/A","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A30","v":2253},{"$f":"'J. Incident Event & Comm Mgmt'!J30","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!K30","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y30","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B30","v":"J.1.2.11.12"},{"$f":"'J. Incident Event & Comm Mgmt'!C30","v":"Tracking?"},{"$f":"'J. Incident Event & Comm Mgmt'!D30","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E30","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F30","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G30","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H30","v":"16.1.1.a.2"},{"$f":"'J. Incident Event & Comm Mgmt'!I30","v":"Responsibilities and procedures"},null,null,null,"N/A","IS.2.M.18","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A31","v":2254},{"$f":"'J. Incident Event & Comm Mgmt'!J31","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!K31","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y31","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B31","v":"J.1.2.11.13"},{"$f":"'J. Incident Event & Comm Mgmt'!C31","v":"Repair?"},{"$f":"'J. Incident Event & Comm Mgmt'!D31","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E31","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F31","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G31","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H31","v":"16.1.5.g"},{"$f":"'J. Incident Event & Comm Mgmt'!I31","v":"Response to information security incidents"},null,null,null,"N/A","N/A","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A32","v":2255},{"$f":"'J. Incident Event & Comm Mgmt'!J32","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!K32","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y32","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B32","v":"J.1.2.11.14"},{"$f":"'J. Incident Event & Comm Mgmt'!C32","v":"Recovery?"},{"$f":"'J. Incident Event & Comm Mgmt'!D32","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E32","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F32","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G32","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H32","v":"16.1.1.a.6"},{"$f":"'J. Incident Event & Comm Mgmt'!I32","v":"Responsibilities and procedures"},null,null,null,"N/A","N/A","PO6.1, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A33","v":2257},{"$f":"'J. Incident Event & Comm Mgmt'!J33","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!K33","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y33","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B33","v":"J.1.2.11.15"},{"$f":"'J. Incident Event & Comm Mgmt'!C33","v":"Feedback and lessons learned?"},{"$f":"'J. Incident Event & Comm Mgmt'!D33","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E33","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F33","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G33","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H33","v":"16.1.6 "},{"$f":"'J. Incident Event & Comm Mgmt'!I33","v":"Learning from information security incidents"},null,"PO5.4","Cost management","N/A","IS.2.M.14.6","PO5.4, AI4.4, DS8.4, DS8.5, DS10.1, DS10.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A34","v":3046},{"$f":"'J. Incident Event & Comm Mgmt'!J34","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!K34","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y34","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B34","v":"J.1.2.11.16"},{"$f":"'J. Incident Event & Comm Mgmt'!C34","v":"Unique, specific, applicable data breach notification requirements, including timing of notification (HIPAA/HITECH, state breach laws, client contracts)?"},{"$f":"'J. Incident Event & Comm Mgmt'!D34","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E34","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F34","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G34","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!H34","v":"16.1.1.a.6"},{"$f":"'J. Incident Event & Comm Mgmt'!I34","v":"Responsibilities and procedures"},null,null,null,"N/A","E-BANK.1.4.7.3","PO6.2, DS5.4"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A35","v":2708},{"$f":"'J. Incident Event & Comm Mgmt'!J35","v":4},{"$f":"'J. Incident Event & Comm Mgmt'!K35","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y35","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B35","v":"J.1.2.11.17"},{"$f":"'J. Incident Event & Comm Mgmt'!C35","v":"Annual testing of the procedures?"},{"$f":"'J. Incident Event & Comm Mgmt'!D35","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E35","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F35","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G35","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!H35","v":"16.1.6 "},{"$f":"'J. Incident Event & Comm Mgmt'!I35","v":"Learning from information security incidents"},null,"PO5.4","Cost management","12.10.2","OPS.2.12.F","PO5.4, AI4.4, DS8.4, DS8.5, DS10.1, DS10.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A36","v":2709},{"$f":"'J. Incident Event & Comm Mgmt'!J36","v":2},{"$f":"'J. Incident Event & Comm Mgmt'!K36","v":1},{"$f":"'J. Incident Event & Comm Mgmt'!Y36","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B36","v":"J.1.3"},{"$f":"'J. Incident Event & Comm Mgmt'!C36","v":"Are the following considered Information Security events:"},{"$f":"'J. Incident Event & Comm Mgmt'!D36","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E36","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F36","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G36","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H36","v":"16.1.2"},{"$f":"'J. Incident Event & Comm Mgmt'!I36","v":"Reporting information security events"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A37","v":2710},{"$f":"'J. Incident Event & Comm Mgmt'!J37","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!K37","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y37","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B37","v":"J.1.3.1"},{"$f":"'J. Incident Event & Comm Mgmt'!C37","v":"Loss of service (equipment or facility)?"},{"$f":"'J. Incident Event & Comm Mgmt'!D37","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E37","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F37","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G37","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H37","v":"16.1.2.f"},{"$f":"'J. Incident Event & Comm Mgmt'!I37","v":"Reporting information security events"},null,"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A38","v":2711},{"$f":"'J. Incident Event & Comm Mgmt'!J38","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!K38","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y38","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B38","v":"J.1.3.2"},{"$f":"'J. Incident Event & Comm Mgmt'!C38","v":"System malfunction or overload?"},{"$f":"'J. Incident Event & Comm Mgmt'!D38","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E38","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F38","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G38","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H38","v":"16.1.2.g"},{"$f":"'J. Incident Event & Comm Mgmt'!I38","v":"Reporting information security events"},null,"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A39","v":2712},{"$f":"'J. Incident Event & Comm Mgmt'!J39","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!K39","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y39","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B39","v":"J.1.3.3"},{"$f":"'J. Incident Event & Comm Mgmt'!C39","v":"Human error?"},{"$f":"'J. Incident Event & Comm Mgmt'!D39","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E39","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F39","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G39","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H39","v":"16.1.2.c"},{"$f":"'J. Incident Event & Comm Mgmt'!I39","v":"Reporting information security events"},null,"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A40","v":2713},{"$f":"'J. Incident Event & Comm Mgmt'!J40","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!K40","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y40","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B40","v":"J.1.3.4"},{"$f":"'J. Incident Event & Comm Mgmt'!C40","v":"Non-compliance with policy or guidelines?"},{"$f":"'J. Incident Event & Comm Mgmt'!D40","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E40","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F40","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G40","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H40","v":"16.1.2.d"},{"$f":"'J. Incident Event & Comm Mgmt'!I40","v":"Reporting information security events"},null,"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A41","v":2714},{"$f":"'J. Incident Event & Comm Mgmt'!J41","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!K41","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y41","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B41","v":"J.1.3.5"},{"$f":"'J. Incident Event & Comm Mgmt'!C41","v":"Breach of physical security arrangement?"},{"$f":"'J. Incident Event & Comm Mgmt'!D41","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E41","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F41","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G41","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H41","v":"16.1.2.e"},{"$f":"'J. Incident Event & Comm Mgmt'!I41","v":"Reporting information security events"},null,"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A42","v":2715},{"$f":"'J. Incident Event & Comm Mgmt'!J42","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!K42","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y42","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B42","v":"J.1.3.6"},{"$f":"'J. Incident Event & Comm Mgmt'!C42","v":"Uncontrolled system change?"},{"$f":"'J. Incident Event & Comm Mgmt'!D42","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E42","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F42","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G42","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H42","v":"16.1.2.f"},{"$f":"'J. Incident Event & Comm Mgmt'!I42","v":"Reporting information security events"},null,"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A43","v":2716},{"$f":"'J. Incident Event & Comm Mgmt'!J43","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!K43","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y43","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B43","v":"J.1.3.7"},{"$f":"'J. Incident Event & Comm Mgmt'!C43","v":"Malfunction of software or hardware?"},{"$f":"'J. Incident Event & Comm Mgmt'!D43","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E43","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F43","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G43","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H43","v":"16.1.2.g"},{"$f":"'J. Incident Event & Comm Mgmt'!I43","v":"Reporting information security events"},null,"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A44","v":2272},{"$f":"'J. Incident Event & Comm Mgmt'!J44","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!K44","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y44","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B44","v":"J.1.3.8"},{"$f":"'J. Incident Event & Comm Mgmt'!C44","v":"Access violation?"},{"$f":"'J. Incident Event & Comm Mgmt'!D44","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E44","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F44","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G44","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H44","v":"16.1.2.h"},{"$f":"'J. Incident Event & Comm Mgmt'!I44","v":"Reporting information security events"},null,"PO9.3","Event identification","N/A","N/A","PO9.3, DS5.6, DS8.2"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A45","v":2265},{"$f":"'J. Incident Event & Comm Mgmt'!J45","v":3},{"$f":"'J. Incident Event & Comm Mgmt'!K45","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y45","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B45","v":"J.1.3.9"},{"$f":"'J. Incident Event & Comm Mgmt'!C45","v":"Physical asset loss or theft?"},{"$f":"'J. Incident Event & Comm Mgmt'!D45","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E45","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F45","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G45","v":"J.5  Information Security / Information Technology Incident Management - Detection"},{"$f":"'J. Incident Event & Comm Mgmt'!H45","v":"16.1.2.a"},{"$f":"'J. Incident Event & Comm Mgmt'!I45","v":"Reporting information security events"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'J. Incident Event & Comm Mgmt'!A46","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!J46","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!K46","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!Y46","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!B46","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!C46","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!D46","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!E46","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!F46","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!G46","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!H46","v":0},{"$f":"'J. Incident Event & Comm Mgmt'!I46","v":0}]
[]
[{"$f":"'K. Business Resiliency'!B1","v":"K. Business Resiliency"},null,null,null,{"$f":"'K. Business Resiliency'!B1","v":"K. Business Resiliency"}]
[{"$f":"'K. Business Resiliency'!A5","v":2719},{"$f":"'K. Business Resiliency'!J5","v":1},{"$f":"'K. Business Resiliency'!K5","v":0},{"$f":"'K. Business Resiliency'!Y5","v":1},{"$f":"'K. Business Resiliency'!B5","v":"K.1"},{"$f":"'K. Business Resiliency'!C5","v":"Is there an established Business Resiliency program that has been approved by management and communicated to appropriate constituents? If yes, does it include:"},{"$f":"'K. Business Resiliency'!D5","v":0},{"$f":"'K. Business Resiliency'!E5","v":0},{"$f":"'K. Business Resiliency'!F5","v":0},{"$f":"'K. Business Resiliency'!G5","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H5","v":5.2},{"$f":"'K. Business Resiliency'!I5","v":"Management Commitment"},null,null,null,"N/A","AUDIT.2.F.2.3","N/A"]
[{"$f":"'K. Business Resiliency'!A6","v":4014},{"$f":"'K. Business Resiliency'!J6","v":2},{"$f":"'K. Business Resiliency'!K6","v":0},{"$f":"'K. Business Resiliency'!Y6","v":0},{"$f":"'K. Business Resiliency'!B6","v":"K.1.1"},{"$f":"'K. Business Resiliency'!C6","v":"An individual program owner?"},{"$f":"'K. Business Resiliency'!D6","v":0},{"$f":"'K. Business Resiliency'!E6","v":0},{"$f":"'K. Business Resiliency'!F6","v":0},{"$f":"'K. Business Resiliency'!G6","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H6","v":5.2},{"$f":"'K. Business Resiliency'!I6","v":"Management Commitment"},null,null,null,"N/A","BCP.1.10.3","N/A"]
[{"$f":"'K. Business Resiliency'!A7","v":2281},{"$f":"'K. Business Resiliency'!J7","v":2},{"$f":"'K. Business Resiliency'!K7","v":0},{"$f":"'K. Business Resiliency'!Y7","v":0},{"$f":"'K. Business Resiliency'!B7","v":"K.1.2"},{"$f":"'K. Business Resiliency'!C7","v":"Is there a documented policy(ies) addressing Business Continuity and Disaster Recovery? If yes, does it include:"},{"$f":"'K. Business Resiliency'!D7","v":0},{"$f":"'K. Business Resiliency'!E7","v":0},{"$f":"'K. Business Resiliency'!F7","v":0},{"$f":"'K. Business Resiliency'!G7","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H7","v":5.2},{"$f":"'K. Business Resiliency'!I7","v":"Management Commitment"},null,"PO6.1","IT policy and control environment","N/A","RPS.1.3.3.1","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"'K. Business Resiliency'!A8","v":4015},{"$f":"'K. Business Resiliency'!J8","v":3},{"$f":"'K. Business Resiliency'!K8","v":0},{"$f":"'K. Business Resiliency'!Y8","v":0},{"$f":"'K. Business Resiliency'!B8","v":"K.1.2.1"},{"$f":"'K. Business Resiliency'!C8","v":"Approved by executive management?"},{"$f":"'K. Business Resiliency'!D8","v":0},{"$f":"'K. Business Resiliency'!E8","v":0},{"$f":"'K. Business Resiliency'!F8","v":0},{"$f":"'K. Business Resiliency'!G8","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H8","v":5.2},{"$f":"'K. Business Resiliency'!I8","v":"Management Commitment"},null,null,null,"N/A","BCP.1.4.7.2","N/A"]
[{"$f":"'K. Business Resiliency'!A9","v":4016},{"$f":"'K. Business Resiliency'!J9","v":3},{"$f":"'K. Business Resiliency'!K9","v":0},{"$f":"'K. Business Resiliency'!Y9","v":0},{"$f":"'K. Business Resiliency'!B9","v":"K.1.2.2"},{"$f":"'K. Business Resiliency'!C9","v":"Communicated to appropriate constituents?"},{"$f":"'K. Business Resiliency'!D9","v":0},{"$f":"'K. Business Resiliency'!E9","v":0},{"$f":"'K. Business Resiliency'!F9","v":0},{"$f":"'K. Business Resiliency'!G9","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H9","v":5.3},{"$f":"'K. Business Resiliency'!I9","v":"Policy"},null,null,null,"N/A","BCP.1.4.1.1.2 BCP.2.2.1.2","N/A"]
[{"$f":"'K. Business Resiliency'!A10","v":4017},{"$f":"'K. Business Resiliency'!J10","v":3},{"$f":"'K. Business Resiliency'!K10","v":0},{"$f":"'K. Business Resiliency'!Y10","v":0},{"$f":"'K. Business Resiliency'!B10","v":"K.1.2.3"},{"$f":"'K. Business Resiliency'!C10","v":"Has an owner been assigned to maintain and review the policy?"},{"$f":"'K. Business Resiliency'!D10","v":0},{"$f":"'K. Business Resiliency'!E10","v":0},{"$f":"'K. Business Resiliency'!F10","v":0},{"$f":"'K. Business Resiliency'!G10","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H10","v":5.2},{"$f":"'K. Business Resiliency'!I10","v":"Management Commitment"},null,"DS4.1","IT continuity framework","N/A","N/A","DS4.1, DS8.1, DS8.3"]
[{"$f":"'K. Business Resiliency'!A11","v":2341},{"$f":"'K. Business Resiliency'!J11","v":2},{"$f":"'K. Business Resiliency'!K11","v":0},{"$f":"'K. Business Resiliency'!Y11","v":0},{"$f":"'K. Business Resiliency'!B11","v":"K.1.3"},{"$f":"'K. Business Resiliency'!C11","v":"Is there a formal annual (or more frequent) executive management review of the Business Continuity program? If yes, do it include:"},{"$f":"'K. Business Resiliency'!D11","v":0},{"$f":"'K. Business Resiliency'!E11","v":0},{"$f":"'K. Business Resiliency'!F11","v":0},{"$f":"'K. Business Resiliency'!G11","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H11","v":9.3000000000000007},{"$f":"'K. Business Resiliency'!I11","v":"Management Review"},null,"DS4.1","IT continuity framework","N/A","BCP.1.5.1.4.4 OPS.1.10.1.1","DS4.1, DS8.1, DS8.3"]
[{"$f":"'K. Business Resiliency'!A12","v":4018},{"$f":"'K. Business Resiliency'!J12","v":3},{"$f":"'K. Business Resiliency'!K12","v":0},{"$f":"'K. Business Resiliency'!Y12","v":0},{"$f":"'K. Business Resiliency'!B12","v":"K.1.3.1"},{"$f":"'K. Business Resiliency'!C12","v":"Adequacy of resources including people, technology, facilities, and funding?"},{"$f":"'K. Business Resiliency'!D12","v":0},{"$f":"'K. Business Resiliency'!E12","v":0},{"$f":"'K. Business Resiliency'!F12","v":0},{"$f":"'K. Business Resiliency'!G12","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H12","v":9.3000000000000007},{"$f":"'K. Business Resiliency'!I12","v":"Management Review"},null,"DS4.1","IT continuity framework","N/A","BCP.1.2.4","DS4.1, DS8.1, DS8.3"]
[{"$f":"'K. Business Resiliency'!A13","v":4019},{"$f":"'K. Business Resiliency'!J13","v":3},{"$f":"'K. Business Resiliency'!K13","v":0},{"$f":"'K. Business Resiliency'!Y13","v":0},{"$f":"'K. Business Resiliency'!B13","v":"K.1.3.2"},{"$f":"'K. Business Resiliency'!C13","v":"Reporting of key program activity and value metrics?"},{"$f":"'K. Business Resiliency'!D13","v":0},{"$f":"'K. Business Resiliency'!E13","v":0},{"$f":"'K. Business Resiliency'!F13","v":0},{"$f":"'K. Business Resiliency'!G13","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H13","v":9.3000000000000007},{"$f":"'K. Business Resiliency'!I13","v":"Management Review"},null,"DS4.1","IT continuity framework","N/A","BCP.1.4.3.8 BCP.1.4.4 BCP.1.4.6.2","DS4.1, DS8.1, DS8.3"]
[{"$f":"'K. Business Resiliency'!A14","v":4020},{"$f":"'K. Business Resiliency'!J14","v":3},{"$f":"'K. Business Resiliency'!K14","v":0},{"$f":"'K. Business Resiliency'!Y14","v":0},{"$f":"'K. Business Resiliency'!B14","v":"K.1.3.3"},{"$f":"'K. Business Resiliency'!C14","v":"Results of Business Continuity Program audits and reviews, including those of key suppliers and partners where appropriate?"},{"$f":"'K. Business Resiliency'!D14","v":0},{"$f":"'K. Business Resiliency'!E14","v":0},{"$f":"'K. Business Resiliency'!F14","v":0},{"$f":"'K. Business Resiliency'!G14","v":"K.7  Exercising"},{"$f":"'K. Business Resiliency'!H14","v":9.3000000000000007},{"$f":"'K. Business Resiliency'!I14","v":"Management Review"},null,"DS4.1","IT continuity framework","N/A","BCP.1.5.1.4.2","DS4.1, DS8.1, DS8.3"]
[{"$f":"'K. Business Resiliency'!A15","v":4021},{"$f":"'K. Business Resiliency'!J15","v":3},{"$f":"'K. Business Resiliency'!K15","v":0},{"$f":"'K. Business Resiliency'!Y15","v":0},{"$f":"'K. Business Resiliency'!B15","v":"K.1.3.4"},{"$f":"'K. Business Resiliency'!C15","v":"Results of exercising and testing?"},{"$f":"'K. Business Resiliency'!D15","v":0},{"$f":"'K. Business Resiliency'!E15","v":0},{"$f":"'K. Business Resiliency'!F15","v":0},{"$f":"'K. Business Resiliency'!G15","v":"K.7  Exercising"},{"$f":"'K. Business Resiliency'!H15","v":9.3000000000000007},{"$f":"'K. Business Resiliency'!I15","v":"Management Review"},null,null,null,"N/A","BCP.1.4.3.3","N/A"]
[{"$f":"'K. Business Resiliency'!A16","v":4022},{"$f":"'K. Business Resiliency'!J16","v":3},{"$f":"'K. Business Resiliency'!K16","v":0},{"$f":"'K. Business Resiliency'!Y16","v":0},{"$f":"'K. Business Resiliency'!B16","v":"K.1.3.5"},{"$f":"'K. Business Resiliency'!C16","v":"Risks or issues not adequately addressed in any previous risk assessments?"},{"$f":"'K. Business Resiliency'!D16","v":0},{"$f":"'K. Business Resiliency'!E16","v":0},{"$f":"'K. Business Resiliency'!F16","v":0},{"$f":"'K. Business Resiliency'!G16","v":"K.7  Exercising"},{"$f":"'K. Business Resiliency'!H16","v":9.3000000000000007},{"$f":"'K. Business Resiliency'!I16","v":"Management Review"},null,"PO3.1","Technological direction planning","N/A","BCP.1.4.1.3.4 BCP.1.5.1.4.6 BCP.1.10.7 BCP.1.5.1.3.1","PO3.1, PO9.1, PO9.2, DS4.1, DS4.3, DS4.8, DS8.3"]
[{"$f":"'K. Business Resiliency'!A17","v":4023},{"$f":"'K. Business Resiliency'!J17","v":3},{"$f":"'K. Business Resiliency'!K17","v":0},{"$f":"'K. Business Resiliency'!Y17","v":0},{"$f":"'K. Business Resiliency'!B17","v":"K.1.3.6"},{"$f":"'K. Business Resiliency'!C17","v":"Lessons learned and actions arising from disruptive incidents?"},{"$f":"'K. Business Resiliency'!D17","v":0},{"$f":"'K. Business Resiliency'!E17","v":0},{"$f":"'K. Business Resiliency'!F17","v":0},{"$f":"'K. Business Resiliency'!G17","v":"K.7  Exercising"},{"$f":"'K. Business Resiliency'!H17","v":9.3000000000000007},{"$f":"'K. Business Resiliency'!I17","v":"Management Review"},null,"PO3.1","Technological direction planning","N/A","BCP.1.6.5","PO3.1, PO9.1, PO9.2, DS4.1, DS4.3, DS4.8, DS8.3"]
[{"$f":"'K. Business Resiliency'!A18","v":4024},{"$f":"'K. Business Resiliency'!J18","v":3},{"$f":"'K. Business Resiliency'!K18","v":0},{"$f":"'K. Business Resiliency'!Y18","v":0},{"$f":"'K. Business Resiliency'!B18","v":"K.1.3.7"},{"$f":"'K. Business Resiliency'!C18","v":"A defined and documented Business Resiliency life-cycle that includes Business Impact Analysis, Risk Assessment, Strategy and Plan Development, and Exercising/Testing?"},{"$f":"'K. Business Resiliency'!D18","v":0},{"$f":"'K. Business Resiliency'!E18","v":0},{"$f":"'K. Business Resiliency'!F18","v":0},{"$f":"'K. Business Resiliency'!G18","v":"K Business Resiliency Management"},{"$f":"'K. Business Resiliency'!H18","v":"0\n8.2"},{"$f":"'K. Business Resiliency'!I18","v":"Introduction\r\nBusiness impact analysis and risk assessment"},null,"DS4.2","IT continuity plans","N/A","AUDIT.2.D.1.16","DS4.2, DS4.8"]
[{"$f":"'K. Business Resiliency'!A19","v":2287},{"$f":"'K. Business Resiliency'!J19","v":2},{"$f":"'K. Business Resiliency'!K19","v":0},{"$f":"'K. Business Resiliency'!Y19","v":0},{"$f":"'K. Business Resiliency'!B19","v":"K.1.4"},{"$f":"'K. Business Resiliency'!C19","v":"Has an independent third party evaluated the Business Resiliency Program within the past 12 months?"},{"$f":"'K. Business Resiliency'!D19","v":0},{"$f":"'K. Business Resiliency'!E19","v":0},{"$f":"'K. Business Resiliency'!F19","v":0},{"$f":"'K. Business Resiliency'!G19","v":"NA"},{"$f":"'K. Business Resiliency'!H19","v":9.1999999999999993},{"$f":"'K. Business Resiliency'!I19","v":"Internal Audit"},null,null,null,"N/A","BCP.1.5.1.4.7 BCP.1.5.1.3.2","N/A"]
[{"$f":"'K. Business Resiliency'!A20","v":2293},{"$f":"'K. Business Resiliency'!J20","v":2},{"$f":"'K. Business Resiliency'!K20","v":0},{"$f":"'K. Business Resiliency'!Y20","v":0},{"$f":"'K. Business Resiliency'!B20","v":"K.1.5"},{"$f":"'K. Business Resiliency'!C20","v":"Are awareness and education activities for all personnel assigned to a defined role in a plan, response/recovery management procedures, or overall program management?"},{"$f":"'K. Business Resiliency'!D20","v":0},{"$f":"'K. Business Resiliency'!E20","v":0},{"$f":"'K. Business Resiliency'!F20","v":0},{"$f":"'K. Business Resiliency'!G20","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H20","v":7.3},{"$f":"'K. Business Resiliency'!I20","v":"Awareness"},null,"DS4.1","IT continuity framework","N/A","BCP.1.4.1.6 WPS.1.2.3.2 WPS.2.10.1.5","DS4.1, DS8.1, DS8.3"]
[{"$f":"'K. Business Resiliency'!A21","v":4025},{"$f":"'K. Business Resiliency'!J21","v":2},{"$f":"'K. Business Resiliency'!K21","v":0},{"$f":"'K. Business Resiliency'!Y21","v":0},{"$f":"'K. Business Resiliency'!B21","v":"K.1.6"},{"$f":"'K. Business Resiliency'!C21","v":"Has senior management determined the desired competencies for the person(s) working within the Business Resiliency program? If yes, do they:"},{"$f":"'K. Business Resiliency'!D21","v":0},{"$f":"'K. Business Resiliency'!E21","v":0},{"$f":"'K. Business Resiliency'!F21","v":0},{"$f":"'K. Business Resiliency'!G21","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H21","v":7.2},{"$f":"'K. Business Resiliency'!I21","v":"Competence"},null,null,null,"N/A","BCP.1.4.3.9 BCP.1.5.1.3.2 AUDIT.2.F.1.7","N/A"]
[{"$f":"'K. Business Resiliency'!A22","v":4026},{"$f":"'K. Business Resiliency'!J22","v":3},{"$f":"'K. Business Resiliency'!K22","v":0},{"$f":"'K. Business Resiliency'!Y22","v":0},{"$f":"'K. Business Resiliency'!B22","v":"K.1.6.1"},{"$f":"'K. Business Resiliency'!C22","v":"Have appropriate actions been taken to ensure that person(s) working under the Business Resiliency program have or acquire the desired competencies?"},{"$f":"'K. Business Resiliency'!D22","v":0},{"$f":"'K. Business Resiliency'!E22","v":0},{"$f":"'K. Business Resiliency'!F22","v":0},{"$f":"'K. Business Resiliency'!G22","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H22","v":7.2},{"$f":"'K. Business Resiliency'!I22","v":"Competence"},null,"DS4.2","IT continuity plans","N/A","BCP.1.3.4 BCP.1.5.1.2 BCP.1.9","DS4.2, DS4.8"]
[{"$f":"'K. Business Resiliency'!A23","v":4027},{"$f":"'K. Business Resiliency'!J23","v":2},{"$f":"'K. Business Resiliency'!K23","v":0},{"$f":"'K. Business Resiliency'!Y23","v":0},{"$f":"'K. Business Resiliency'!B23","v":"K.1.7"},{"$f":"'K. Business Resiliency'!C23","v":"Have formal documentation and reference information relevant to the Business Resiliency program and procedures been created? If yes, are they:"},{"$f":"'K. Business Resiliency'!D23","v":0},{"$f":"'K. Business Resiliency'!E23","v":0},{"$f":"'K. Business Resiliency'!F23","v":0},{"$f":"'K. Business Resiliency'!G23","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H23","v":7.5},{"$f":"'K. Business Resiliency'!I23","v":"Documented information"},null,"DS4.1","IT continuity framework","N/A","O.2.B.2.7","DS4.1, DS8.1, DS8.3"]
[{"$f":"'K. Business Resiliency'!A24","v":4028},{"$f":"'K. Business Resiliency'!J24","v":3},{"$f":"'K. Business Resiliency'!K24","v":0},{"$f":"'K. Business Resiliency'!Y24","v":0},{"$f":"'K. Business Resiliency'!B24","v":"K.1.7.1"},{"$f":"'K. Business Resiliency'!C24","v":"Controlled to ensure its availability when and where it is needed?"},{"$f":"'K. Business Resiliency'!D24","v":0},{"$f":"'K. Business Resiliency'!E24","v":0},{"$f":"'K. Business Resiliency'!F24","v":0},{"$f":"'K. Business Resiliency'!G24","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H24","v":"7.5.3"},{"$f":"'K. Business Resiliency'!I24","v":"Control of documented information"},null,"DS4.1","IT continuity framework","N/A","BCP.1.5.1.3.2","DS4.1, DS8.1, DS8.3"]
[{"$f":"'K. Business Resiliency'!A25","v":4029},{"$f":"'K. Business Resiliency'!J25","v":3},{"$f":"'K. Business Resiliency'!K25","v":0},{"$f":"'K. Business Resiliency'!Y25","v":0},{"$f":"'K. Business Resiliency'!B25","v":"K.1.7.2"},{"$f":"'K. Business Resiliency'!C25","v":"Controlled to ensure it is adequately protected from loss of confidentiality, improper use, or loss of integrity?"},{"$f":"'K. Business Resiliency'!D25","v":0},{"$f":"'K. Business Resiliency'!E25","v":0},{"$f":"'K. Business Resiliency'!F25","v":0},{"$f":"'K. Business Resiliency'!G25","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H25","v":"7.5.3"},{"$f":"'K. Business Resiliency'!I25","v":"Control of documented information"},null,"DS4.2","IT continuity plans","N/A","BCP.1.9.1 BCP.1.9.2 BCP.1.9.3","DS4.2, DS4.8"]
[{"$f":"'K. Business Resiliency'!A26","v":4030},{"$f":"'K. Business Resiliency'!J26","v":3},{"$f":"'K. Business Resiliency'!K26","v":0},{"$f":"'K. Business Resiliency'!Y26","v":0},{"$f":"'K. Business Resiliency'!B26","v":"K.1.7.3"},{"$f":"'K. Business Resiliency'!C26","v":"Managed to assure control of changes and understanding of versions and changes?"},{"$f":"'K. Business Resiliency'!D26","v":0},{"$f":"'K. Business Resiliency'!E26","v":0},{"$f":"'K. Business Resiliency'!F26","v":0},{"$f":"'K. Business Resiliency'!G26","v":"K.6 Maintenance and Continuous Improvement "},{"$f":"'K. Business Resiliency'!H26","v":"7.5.3"},{"$f":"'K. Business Resiliency'!I26","v":"Control of documented information"},null,"DS4.2","IT continuity plans","N/A","BCP.1.10 O.2.B.2.7 E-BANK.1.3.3.5","DS4.2, DS4.8"]
[{"$f":"'K. Business Resiliency'!A27","v":4031},{"$f":"'K. Business Resiliency'!J27","v":3},{"$f":"'K. Business Resiliency'!K27","v":0},{"$f":"'K. Business Resiliency'!Y27","v":0},{"$f":"'K. Business Resiliency'!B27","v":"K.1.7.4"},{"$f":"'K. Business Resiliency'!C27","v":"Protected against compromise, unauthorized modification or deletion?"},{"$f":"'K. Business Resiliency'!D27","v":0},{"$f":"'K. Business Resiliency'!E27","v":0},{"$f":"'K. Business Resiliency'!F27","v":0},{"$f":"'K. Business Resiliency'!G27","v":"K.6 Maintenance and Continuous Improvement "},{"$f":"'K. Business Resiliency'!H27","v":"7.5.3"},{"$f":"'K. Business Resiliency'!I27","v":"Control of documented information"},null,"DS4.2","IT continuity plans","N/A","BCP.1.6.6 E-BANK.1.3.3.4","DS4.2, DS4.8"]
[{"$f":"'K. Business Resiliency'!A28","v":2765},{"$f":"'K. Business Resiliency'!J28","v":2},{"$f":"'K. Business Resiliency'!K28","v":0},{"$f":"'K. Business Resiliency'!Y28","v":0},{"$f":"'K. Business Resiliency'!B28","v":"K.1.8"},{"$f":"'K. Business Resiliency'!C28","v":"Do the products and/or services specified in the scope of this assessment fall within the scope of the Business Resiliency program? If yes do they:"},{"$f":"'K. Business Resiliency'!D28","v":0},{"$f":"'K. Business Resiliency'!E28","v":0},{"$f":"'K. Business Resiliency'!F28","v":0},{"$f":"'K. Business Resiliency'!G28","v":"K.2 Business Impact Analysis"},{"$f":"'K. Business Resiliency'!H28","v":"4.3.2"},{"$f":"'K. Business Resiliency'!I28","v":"Scope of the BCMS"},null,null,null,"N/A","BCP.1.2.5","N/A"]
[{"$f":"'K. Business Resiliency'!A29","v":4032},{"$f":"'K. Business Resiliency'!J29","v":3},{"$f":"'K. Business Resiliency'!K29","v":0},{"$f":"'K. Business Resiliency'!Y29","v":0},{"$f":"'K. Business Resiliency'!B29","v":"K.1.8.1"},{"$f":"'K. Business Resiliency'!C29","v":"Include recovery priority/ranking/tier for these products and/or services, in the contractual performance/service level terms?"},{"$f":"'K. Business Resiliency'!D29","v":0},{"$f":"'K. Business Resiliency'!E29","v":0},{"$f":"'K. Business Resiliency'!F29","v":0},{"$f":"'K. Business Resiliency'!G29","v":"K.2 Business Impact Analysis"},{"$f":"'K. Business Resiliency'!H29","v":"4.3.2"},{"$f":"'K. Business Resiliency'!I29","v":"Scope of the BCMS"},null,"PO3.1","Technological direction planning","N/A","BCP.1.10.3 BCP.1.10.2 BCP.2.2.1 BCP.2.2.1.7 WPS.2.10.1.2 RPS.2.E.1.6 RPS.2.L.1","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[{"$f":"'K. Business Resiliency'!A30","v":4033},{"$f":"'K. Business Resiliency'!J30","v":3},{"$f":"'K. Business Resiliency'!K30","v":0},{"$f":"'K. Business Resiliency'!Y30","v":0},{"$f":"'K. Business Resiliency'!B30","v":"K.1.8.2"},{"$f":"'K. Business Resiliency'!C30","v":"Fall into the highest possible recovery priority/ranking/tier specified within your Business Resiliency program?"},{"$f":"'K. Business Resiliency'!D30","v":0},{"$f":"'K. Business Resiliency'!E30","v":0},{"$f":"'K. Business Resiliency'!F30","v":0},{"$f":"'K. Business Resiliency'!G30","v":"K.2 Business Impact Analysis"},{"$f":"'K. Business Resiliency'!H30","v":"4.3.2"},{"$f":"'K. Business Resiliency'!I30","v":"Scope of the BCMS"},null,null,null,"N/A","BCP.2.2.2 BCP.2.2.2.1 BCP.2.2.1.4","N/A"]
[{"$f":"'K. Business Resiliency'!A31","v":4034},{"$f":"'K. Business Resiliency'!J31","v":3},{"$f":"'K. Business Resiliency'!K31","v":0},{"$f":"'K. Business Resiliency'!Y31","v":0},{"$f":"'K. Business Resiliency'!B31","v":"K.1.8.3"},{"$f":"'K. Business Resiliency'!C31","v":"Include specific recovery objectives/requirements defined for those products and/or services?"},{"$f":"'K. Business Resiliency'!D31","v":0},{"$f":"'K. Business Resiliency'!E31","v":0},{"$f":"'K. Business Resiliency'!F31","v":0},{"$f":"'K. Business Resiliency'!G31","v":"K.2 Business Impact Analysis"},{"$f":"'K. Business Resiliency'!H31","v":"4.3.2"},{"$f":"'K. Business Resiliency'!I31","v":"Scope of the BCMS"},null,"PO3.1","Technological direction planning","N/A","N/A","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[{"$f":"'K. Business Resiliency'!A32","v":2329},{"$f":"'K. Business Resiliency'!J32","v":1},{"$f":"'K. Business Resiliency'!K32","v":0},{"$f":"'K. Business Resiliency'!Y32","v":1},{"$f":"'K. Business Resiliency'!B32","v":"K.2"},{"$f":"'K. Business Resiliency'!C32","v":"Has a Business Impact Analysis been conducted? If yes, does it include:"},{"$f":"'K. Business Resiliency'!D32","v":0},{"$f":"'K. Business Resiliency'!E32","v":0},{"$f":"'K. Business Resiliency'!F32","v":0},{"$f":"'K. Business Resiliency'!G32","v":"K.2 Business Impact Analysis"},{"$f":"'K. Business Resiliency'!H32","v":"8.2.2"},{"$f":"'K. Business Resiliency'!I32","v":"Business impact analysis"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'K. Business Resiliency'!A33","v":4035},{"$f":"'K. Business Resiliency'!J33","v":2},{"$f":"'K. Business Resiliency'!K33","v":0},{"$f":"'K. Business Resiliency'!Y33","v":0},{"$f":"'K. Business Resiliency'!B33","v":"K.2.1"},{"$f":"'K. Business Resiliency'!C33","v":"Validation and/or refresh at least annually? "},{"$f":"'K. Business Resiliency'!D33","v":0},{"$f":"'K. Business Resiliency'!E33","v":0},{"$f":"'K. Business Resiliency'!F33","v":0},{"$f":"'K. Business Resiliency'!G33","v":"K.2 Business Impact Analysis"},{"$f":"'K. Business Resiliency'!H33","v":"8.2.2"},{"$f":"'K. Business Resiliency'!I33","v":"Business impact analysis"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'K. Business Resiliency'!A34","v":2334},{"$f":"'K. Business Resiliency'!J34","v":2},{"$f":"'K. Business Resiliency'!K34","v":0},{"$f":"'K. Business Resiliency'!Y34","v":0},{"$f":"'K. Business Resiliency'!B34","v":"K.2.2"},{"$f":"'K. Business Resiliency'!C34","v":"Business Activity or Business Process Criticality (high, medium, low or numerical rating) that distinguishes the relative importance of each activity or process?"},{"$f":"'K. Business Resiliency'!D34","v":0},{"$f":"'K. Business Resiliency'!E34","v":0},{"$f":"'K. Business Resiliency'!F34","v":0},{"$f":"'K. Business Resiliency'!G34","v":"K.2 Business Impact Analysis"},{"$f":"'K. Business Resiliency'!H34","v":"8.2.2"},{"$f":"'K. Business Resiliency'!I34","v":"Business impact analysis"},null,"PO3.1","Technological direction planning","N/A","N/A","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[{"$f":"'K. Business Resiliency'!A35","v":2299},{"$f":"'K. Business Resiliency'!J35","v":2},{"$f":"'K. Business Resiliency'!K35","v":0},{"$f":"'K. Business Resiliency'!Y35","v":0},{"$f":"'K. Business Resiliency'!B35","v":"K.2.3"},{"$f":"'K. Business Resiliency'!C35","v":"Identification of applications, data, equipment, facilities, personnel, supplies and paper documents necessary for recovery?"},{"$f":"'K. Business Resiliency'!D35","v":0},{"$f":"'K. Business Resiliency'!E35","v":0},{"$f":"'K. Business Resiliency'!F35","v":0},{"$f":"'K. Business Resiliency'!G35","v":"K.2 Business Impact Analysis\nK.3 Risk Assessment"},{"$f":"'K. Business Resiliency'!H35","v":"?"},{"$f":"'K. Business Resiliency'!I35","v":"addressed by 27031"},null,null,null,"N/A","BCP.2.1.2.1","N/A"]
[{"$f":"'K. Business Resiliency'!A36","v":2338},{"$f":"'K. Business Resiliency'!J36","v":2},{"$f":"'K. Business Resiliency'!K36","v":0},{"$f":"'K. Business Resiliency'!Y36","v":0},{"$f":"'K. Business Resiliency'!B36","v":"K.2.4"},{"$f":"'K. Business Resiliency'!C36","v":"Maximum Acceptable Outage / Maximum Tolerable Period of Disruption for each Business Activity or Business Process?"},{"$f":"'K. Business Resiliency'!D36","v":0},{"$f":"'K. Business Resiliency'!E36","v":0},{"$f":"'K. Business Resiliency'!F36","v":0},{"$f":"'K. Business Resiliency'!G36","v":"K.2 Business Impact Analysis"},{"$f":"'K. Business Resiliency'!H36","v":"8.2.2"},{"$f":"'K. Business Resiliency'!I36","v":"Business impact analysis"},null,null,null,"N/A","BCP.2.1.2.1","N/A"]
[{"$f":"'K. Business Resiliency'!A37","v":2335},{"$f":"'K. Business Resiliency'!J37","v":2},{"$f":"'K. Business Resiliency'!K37","v":0},{"$f":"'K. Business Resiliency'!Y37","v":0},{"$f":"'K. Business Resiliency'!B37","v":"K.2.5"},{"$f":"'K. Business Resiliency'!C37","v":"Recovery Time Objectives for all essential application systems, network services, and other resources?"},{"$f":"'K. Business Resiliency'!D37","v":0},{"$f":"'K. Business Resiliency'!E37","v":0},{"$f":"'K. Business Resiliency'!F37","v":0},{"$f":"'K. Business Resiliency'!G37","v":"K.2 Business Impact Analysis"},{"$f":"'K. Business Resiliency'!H37","v":"8.2.2"},{"$f":"'K. Business Resiliency'!I37","v":"Business impact analysis"},null,"PO3.1","Technological direction planning","N/A","BCP.2.1.3 BCP.2.1.3.1 BCP.2.1.3.2 BCP.2.1.3.3","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[{"$f":"'K. Business Resiliency'!A38","v":2337},{"$f":"'K. Business Resiliency'!J38","v":2},{"$f":"'K. Business Resiliency'!K38","v":0},{"$f":"'K. Business Resiliency'!Y38","v":0},{"$f":"'K. Business Resiliency'!B38","v":"K.2.6"},{"$f":"'K. Business Resiliency'!C38","v":"Recovery Point Objective for all essential application systems?"},{"$f":"'K. Business Resiliency'!D38","v":0},{"$f":"'K. Business Resiliency'!E38","v":0},{"$f":"'K. Business Resiliency'!F38","v":0},{"$f":"'K. Business Resiliency'!G38","v":"K.2 Business Impact Analysis"},{"$f":"'K. Business Resiliency'!H38","v":"8.2.2"},{"$f":"'K. Business Resiliency'!I38","v":"Business impact analysis"},null,"PO3.1","Technological direction planning","N/A","N/A","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[{"$f":"'K. Business Resiliency'!A39","v":2760},{"$f":"'K. Business Resiliency'!J39","v":2},{"$f":"'K. Business Resiliency'!K39","v":0},{"$f":"'K. Business Resiliency'!Y39","v":0},{"$f":"'K. Business Resiliency'!B39","v":"K.2.7"},{"$f":"'K. Business Resiliency'!C39","v":"Impact to clients/customers?"},{"$f":"'K. Business Resiliency'!D39","v":0},{"$f":"'K. Business Resiliency'!E39","v":0},{"$f":"'K. Business Resiliency'!F39","v":0},{"$f":"'K. Business Resiliency'!G39","v":"K.2 Business Impact Analysis"},{"$f":"'K. Business Resiliency'!H39","v":"8.2.2"},{"$f":"'K. Business Resiliency'!I39","v":"Business impact analysis"},null,"PO9.1","IT and business risk management alignment management process","N/A","BCP.1.10.3","PO9.1, PO9.2, PO9.4, DS4.1, DS4.3"]
[{"$f":"'K. Business Resiliency'!A40","v":4036},{"$f":"'K. Business Resiliency'!J40","v":2},{"$f":"'K. Business Resiliency'!K40","v":0},{"$f":"'K. Business Resiliency'!Y40","v":0},{"$f":"'K. Business Resiliency'!B40","v":"K.2.8"},{"$f":"'K. Business Resiliency'!C40","v":"Capacity to address needs/expectations of all clients/customers?"},{"$f":"'K. Business Resiliency'!D40","v":0},{"$f":"'K. Business Resiliency'!E40","v":0},{"$f":"'K. Business Resiliency'!F40","v":0},{"$f":"'K. Business Resiliency'!G40","v":"K.2 Business Impact Analysis"},{"$f":"'K. Business Resiliency'!H40","v":"N/A"},{"$f":"'K. Business Resiliency'!I40","v":0},"Strategic Considerations - Third Party Management. Lines 134-135","PO3.1","Technological direction planning","N/A","BCP.2.1.2.1","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[{"$f":"'K. Business Resiliency'!A41","v":4037},{"$f":"'K. Business Resiliency'!J41","v":2},{"$f":"'K. Business Resiliency'!K41","v":0},{"$f":"'K. Business Resiliency'!Y41","v":0},{"$f":"'K. Business Resiliency'!B41","v":"K.2.9"},{"$f":"'K. Business Resiliency'!C41","v":"Identification of the recovery requirements for information security and the continuity of information security management?"},{"$f":"'K. Business Resiliency'!D41","v":0},{"$f":"'K. Business Resiliency'!E41","v":0},{"$f":"'K. Business Resiliency'!F41","v":0},{"$f":"'K. Business Resiliency'!G41","v":"K.2 Business Impact Analysis"},{"$f":"'K. Business Resiliency'!H41","v":"N/A"},{"$f":"'K. Business Resiliency'!I41","v":0},null,"PO3.1","Technological direction planning","N/A","RPS.2.N.13.2.2","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[{"$f":"'K. Business Resiliency'!A42","v":4038},{"$f":"'K. Business Resiliency'!J42","v":1},{"$f":"'K. Business Resiliency'!K42","v":0},{"$f":"'K. Business Resiliency'!Y42","v":1},{"$f":"'K. Business Resiliency'!B42","v":"K.3"},{"$f":"'K. Business Resiliency'!C42","v":"Is there a formal process focused on identifying and addressing risks of disruptive incidents to the organization? If yes, does it include:"},{"$f":"'K. Business Resiliency'!D42","v":0},{"$f":"'K. Business Resiliency'!E42","v":0},{"$f":"'K. Business Resiliency'!F42","v":0},{"$f":"'K. Business Resiliency'!G42","v":"K.3 Risk Assessment"},{"$f":"'K. Business Resiliency'!H42","v":"8.2.3"},{"$f":"'K. Business Resiliency'!I42","v":"Risk assessment"},null,"PO3.1","Technological direction planning","N/A","BCP.1.10.10","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[{"$f":"'K. Business Resiliency'!A43","v":4039},{"$f":"'K. Business Resiliency'!J43","v":2},{"$f":"'K. Business Resiliency'!K43","v":0},{"$f":"'K. Business Resiliency'!Y43","v":0},{"$f":"'K. Business Resiliency'!B43","v":"K.3.1"},{"$f":"'K. Business Resiliency'!C43","v":"Identifying risks associated with disruptions to systems, information, people, third parties, and facilities?"},{"$f":"'K. Business Resiliency'!D43","v":0},{"$f":"'K. Business Resiliency'!E43","v":0},{"$f":"'K. Business Resiliency'!F43","v":0},{"$f":"'K. Business Resiliency'!G43","v":"K.3 Risk Assessment"},{"$f":"'K. Business Resiliency'!H43","v":"8.2.3"},{"$f":"'K. Business Resiliency'!I43","v":"Risk assessment"},null,"PO3.1","Technological direction planning","N/A","BCP.2.1.1.7","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[{"$f":"'K. Business Resiliency'!A44","v":4040},{"$f":"'K. Business Resiliency'!J44","v":2},{"$f":"'K. Business Resiliency'!K44","v":0},{"$f":"'K. Business Resiliency'!Y44","v":0},{"$f":"'K. Business Resiliency'!B44","v":"K.3.2"},{"$f":"'K. Business Resiliency'!C44","v":"Analysis of risks identified and determination of those requiring treatments?"},{"$f":"'K. Business Resiliency'!D44","v":0},{"$f":"'K. Business Resiliency'!E44","v":0},{"$f":"'K. Business Resiliency'!F44","v":0},{"$f":"'K. Business Resiliency'!G44","v":"K.3 Risk Assessment"},{"$f":"'K. Business Resiliency'!H44","v":"8.2.3"},{"$f":"'K. Business Resiliency'!I44","v":"Risk assessment"},null,"PO9.1","IT and business risk management alignment management process","N/A","BCP.1.8.1","PO9.1, PO9.2, PO9.4, DS4.1, DS4.3"]
[{"$f":"'K. Business Resiliency'!A45","v":4041},{"$f":"'K. Business Resiliency'!J45","v":2},{"$f":"'K. Business Resiliency'!K45","v":0},{"$f":"'K. Business Resiliency'!Y45","v":0},{"$f":"'K. Business Resiliency'!B45","v":"K.3.3"},{"$f":"'K. Business Resiliency'!C45","v":"Taking action on approved treatments?"},{"$f":"'K. Business Resiliency'!D45","v":0},{"$f":"'K. Business Resiliency'!E45","v":0},{"$f":"'K. Business Resiliency'!F45","v":0},{"$f":"'K. Business Resiliency'!G45","v":"K.3 Risk Assessment"},{"$f":"'K. Business Resiliency'!H45","v":"8.2.3"},{"$f":"'K. Business Resiliency'!I45","v":"Risk assessment"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'K. Business Resiliency'!A46","v":4042},{"$f":"'K. Business Resiliency'!J46","v":1},{"$f":"'K. Business Resiliency'!K46","v":0},{"$f":"'K. Business Resiliency'!Y46","v":1},{"$f":"'K. Business Resiliency'!B46","v":"K.4"},{"$f":"'K. Business Resiliency'!C46","v":"Are specific response and recovery strategies defined for the prioritized activities? If yes, does it include:"},{"$f":"'K. Business Resiliency'!D46","v":0},{"$f":"'K. Business Resiliency'!E46","v":0},{"$f":"'K. Business Resiliency'!F46","v":0},{"$f":"'K. Business Resiliency'!G46","v":"K.4 Response and Recovery Strategy"},{"$f":"'K. Business Resiliency'!H46","v":"8.3.1"},{"$f":"'K. Business Resiliency'!I46","v":"Determination and selection"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'K. Business Resiliency'!A47","v":4043},{"$f":"'K. Business Resiliency'!J47","v":2},{"$f":"'K. Business Resiliency'!K47","v":0},{"$f":"'K. Business Resiliency'!Y47","v":0},{"$f":"'K. Business Resiliency'!B47","v":"K.4.1"},{"$f":"'K. Business Resiliency'!C47","v":"The resource dependencies associated with each prioritized activity? If yes, does they include:"},{"$f":"'K. Business Resiliency'!D47","v":0},{"$f":"'K. Business Resiliency'!E47","v":0},{"$f":"'K. Business Resiliency'!F47","v":0},{"$f":"'K. Business Resiliency'!G47","v":"K.4 Response and Recovery Strategy"},{"$f":"'K. Business Resiliency'!H47","v":"8.3.2"},{"$f":"'K. Business Resiliency'!I47","v":"Establishing resource requirements"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'K. Business Resiliency'!A48","v":4044},{"$f":"'K. Business Resiliency'!J48","v":3},{"$f":"'K. Business Resiliency'!K48","v":0},{"$f":"'K. Business Resiliency'!Y48","v":0},{"$f":"'K. Business Resiliency'!B48","v":"K.4.1.1"},{"$f":"'K. Business Resiliency'!C48","v":"Personnel (40% or more)?"},{"$f":"'K. Business Resiliency'!D48","v":0},{"$f":"'K. Business Resiliency'!E48","v":0},{"$f":"'K. Business Resiliency'!F48","v":0},{"$f":"'K. Business Resiliency'!G48","v":"K.4 Response and Recovery Strategy"},{"$f":"'K. Business Resiliency'!H48","v":"8.3.2"},{"$f":"'K. Business Resiliency'!I48","v":"Establishing resource requirements"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'K. Business Resiliency'!A49","v":4045},{"$f":"'K. Business Resiliency'!J49","v":3},{"$f":"'K. Business Resiliency'!K49","v":0},{"$f":"'K. Business Resiliency'!Y49","v":0},{"$f":"'K. Business Resiliency'!B49","v":"K.4.1.2"},{"$f":"'K. Business Resiliency'!C49","v":"Information and data?"},{"$f":"'K. Business Resiliency'!D49","v":0},{"$f":"'K. Business Resiliency'!E49","v":0},{"$f":"'K. Business Resiliency'!F49","v":0},{"$f":"'K. Business Resiliency'!G49","v":"K.4 Response and Recovery Strategy"},{"$f":"'K. Business Resiliency'!H49","v":"8.3.2"},{"$f":"'K. Business Resiliency'!I49","v":"Establishing resource requirements"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'K. Business Resiliency'!A50","v":4046},{"$f":"'K. Business Resiliency'!J50","v":3},{"$f":"'K. Business Resiliency'!K50","v":0},{"$f":"'K. Business Resiliency'!Y50","v":0},{"$f":"'K. Business Resiliency'!B50","v":"K.4.1.3"},{"$f":"'K. Business Resiliency'!C50","v":"Information and communication technology?"},{"$f":"'K. Business Resiliency'!D50","v":0},{"$f":"'K. Business Resiliency'!E50","v":0},{"$f":"'K. Business Resiliency'!F50","v":0},{"$f":"'K. Business Resiliency'!G50","v":"K.4 Response and Recovery Strategy"},{"$f":"'K. Business Resiliency'!H50","v":"8.3.2"},{"$f":"'K. Business Resiliency'!I50","v":"Establishing resource requirements"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'K. Business Resiliency'!A51","v":4047},{"$f":"'K. Business Resiliency'!J51","v":3},{"$f":"'K. Business Resiliency'!K51","v":0},{"$f":"'K. Business Resiliency'!Y51","v":0},{"$f":"'K. Business Resiliency'!B51","v":"K.4.1.4"},{"$f":"'K. Business Resiliency'!C51","v":"Work places/buildings?"},{"$f":"'K. Business Resiliency'!D51","v":0},{"$f":"'K. Business Resiliency'!E51","v":0},{"$f":"'K. Business Resiliency'!F51","v":0},{"$f":"'K. Business Resiliency'!G51","v":"K.4 Response and Recovery Strategy"},{"$f":"'K. Business Resiliency'!H51","v":"8.3.2"},{"$f":"'K. Business Resiliency'!I51","v":"Establishing resource requirements"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'K. Business Resiliency'!A52","v":4048},{"$f":"'K. Business Resiliency'!J52","v":3},{"$f":"'K. Business Resiliency'!K52","v":0},{"$f":"'K. Business Resiliency'!Y52","v":0},{"$f":"'K. Business Resiliency'!B52","v":"K.4.1.5"},{"$f":"'K. Business Resiliency'!C52","v":"Third party services (e.g. partners and suppliers)?"},{"$f":"'K. Business Resiliency'!D52","v":0},{"$f":"'K. Business Resiliency'!E52","v":0},{"$f":"'K. Business Resiliency'!F52","v":0},{"$f":"'K. Business Resiliency'!G52","v":"K.4 Response and Recovery Strategy"},{"$f":"'K. Business Resiliency'!H52","v":"8.3.2"},{"$f":"'K. Business Resiliency'!I52","v":"Establishing resource requirements"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'K. Business Resiliency'!A53","v":4049},{"$f":"'K. Business Resiliency'!J53","v":1},{"$f":"'K. Business Resiliency'!K53","v":0},{"$f":"'K. Business Resiliency'!Y53","v":1},{"$f":"'K. Business Resiliency'!B53","v":"K.5"},{"$f":"'K. Business Resiliency'!C53","v":"Are formal business continuity procedures developed and documented? If yes, do they Include:"},{"$f":"'K. Business Resiliency'!D53","v":0},{"$f":"'K. Business Resiliency'!E53","v":0},{"$f":"'K. Business Resiliency'!F53","v":0},{"$f":"'K. Business Resiliency'!G53","v":"K.5 Business Activity Level Recovery Planning"},{"$f":"'K. Business Resiliency'!H53","v":8.4},{"$f":"'K. Business Resiliency'!I53","v":"Establish and implement business continuity procedures"},null,null,null,"N/A","BCP.1.8.3.5","N/A"]
[{"$f":"'K. Business Resiliency'!A54","v":4050},{"$f":"'K. Business Resiliency'!J54","v":2},{"$f":"'K. Business Resiliency'!K54","v":0},{"$f":"'K. Business Resiliency'!Y54","v":0},{"$f":"'K. Business Resiliency'!B54","v":"K.5.1"},{"$f":"'K. Business Resiliency'!C54","v":"Specific actions to be taken in response to a disruptive event?"},{"$f":"'K. Business Resiliency'!D54","v":0},{"$f":"'K. Business Resiliency'!E54","v":0},{"$f":"'K. Business Resiliency'!F54","v":0},{"$f":"'K. Business Resiliency'!G54","v":"K.5 Business Activity Level Recovery Planning"},{"$f":"'K. Business Resiliency'!H54","v":8.4},{"$f":"'K. Business Resiliency'!I54","v":"Establish and implement business continuity procedures"},null,null,null,"N/A","BCP.1.8.11","N/A"]
[{"$f":"'K. Business Resiliency'!A55","v":4051},{"$f":"'K. Business Resiliency'!J55","v":2},{"$f":"'K. Business Resiliency'!K55","v":0},{"$f":"'K. Business Resiliency'!Y55","v":0},{"$f":"'K. Business Resiliency'!B55","v":"K.5.2"},{"$f":"'K. Business Resiliency'!C55","v":"Key impacts including the unavailability of critical resource dependencies?"},{"$f":"'K. Business Resiliency'!D55","v":0},{"$f":"'K. Business Resiliency'!E55","v":0},{"$f":"'K. Business Resiliency'!F55","v":0},{"$f":"'K. Business Resiliency'!G55","v":"K.5 Business Activity Level Recovery Planning"},{"$f":"'K. Business Resiliency'!H55","v":8.4},{"$f":"'K. Business Resiliency'!I55","v":"Establish and implement business continuity procedures"},null,null,null,"N/A","BCP.1.8.7","N/A"]
[{"$f":"'K. Business Resiliency'!A56","v":4052},{"$f":"'K. Business Resiliency'!J56","v":2},{"$f":"'K. Business Resiliency'!K56","v":0},{"$f":"'K. Business Resiliency'!Y56","v":0},{"$f":"'K. Business Resiliency'!B56","v":"K.5.3"},{"$f":"'K. Business Resiliency'!C56","v":"The continuity of Information security activities and processes (e.g. intrusion detection, vulnerability management, log collection)?"},{"$f":"'K. Business Resiliency'!D56","v":0},{"$f":"'K. Business Resiliency'!E56","v":0},{"$f":"'K. Business Resiliency'!F56","v":0},{"$f":"'K. Business Resiliency'!G56","v":"K.5 Business Activity Level Recovery Planning"},{"$f":"'K. Business Resiliency'!H56","v":"N/A"},{"$f":"'K. Business Resiliency'!I56","v":0},null,"PO9.1","IT and business risk management alignment management process","N/A","BCP.1.8.4","PO9.1, PO9.2, PO9.4, DS4.1, DS4.3"]
[{"$f":"'K. Business Resiliency'!A57","v":4053},{"$f":"'K. Business Resiliency'!J57","v":2},{"$f":"'K. Business Resiliency'!K57","v":0},{"$f":"'K. Business Resiliency'!Y57","v":0},{"$f":"'K. Business Resiliency'!B57","v":"K.5.4"},{"$f":"'K. Business Resiliency'!C57","v":"The continuity of IT operations activities and processes (e.g. network operations, data center operations, help desk)?"},{"$f":"'K. Business Resiliency'!D57","v":0},{"$f":"'K. Business Resiliency'!E57","v":0},{"$f":"'K. Business Resiliency'!F57","v":0},{"$f":"'K. Business Resiliency'!G57","v":"K.5 Business Activity Level Recovery Planning"},{"$f":"'K. Business Resiliency'!H57","v":"N/A"},{"$f":"'K. Business Resiliency'!I57","v":0},null,"PO9.1","IT and business risk management alignment management process","N/A","BCP.1.3","PO9.1, PO9.2, PO9.4, DS4.1, DS4.3"]
[{"$f":"'K. Business Resiliency'!A58","v":4054},{"$f":"'K. Business Resiliency'!J58","v":1},{"$f":"'K. Business Resiliency'!K58","v":0},{"$f":"'K. Business Resiliency'!Y58","v":1},{"$f":"'K. Business Resiliency'!B58","v":"K.6"},{"$f":"'K. Business Resiliency'!C58","v":"Has senior management assigned the responsibility for the overall management of the response and recovery efforts? If yes, does it include:"},{"$f":"'K. Business Resiliency'!D58","v":0},{"$f":"'K. Business Resiliency'!E58","v":0},{"$f":"'K. Business Resiliency'!F58","v":0},{"$f":"'K. Business Resiliency'!G58","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H58","v":"N/A"},{"$f":"'K. Business Resiliency'!I58","v":0},null,"PO3.1","Technological direction planning","N/A","BCP.1.3.2 BCP.1.5.1.1","PO3.1, PO9.1, PO9.2, DS4.1, DS4.3, DS4.8, DS8.3"]
[{"$f":"'K. Business Resiliency'!A59","v":2342},{"$f":"'K. Business Resiliency'!J59","v":2},{"$f":"'K. Business Resiliency'!K59","v":0},{"$f":"'K. Business Resiliency'!Y59","v":0},{"$f":"'K. Business Resiliency'!B59","v":"K.6.1"},{"$f":"'K. Business Resiliency'!C59","v":"Virtual or physical command center where management can meet, organize, and manage emergency operations in a secure setting?"},{"$f":"'K. Business Resiliency'!D59","v":0},{"$f":"'K. Business Resiliency'!E59","v":0},{"$f":"'K. Business Resiliency'!F59","v":0},{"$f":"'K. Business Resiliency'!G59","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H59","v":"8.4.3"},{"$f":"'K. Business Resiliency'!I59","v":"Warning and communication"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'K. Business Resiliency'!A60","v":2289},{"$f":"'K. Business Resiliency'!J60","v":2},{"$f":"'K. Business Resiliency'!K60","v":0},{"$f":"'K. Business Resiliency'!Y60","v":0},{"$f":"'K. Business Resiliency'!B60","v":"K.6.2"},{"$f":"'K. Business Resiliency'!C60","v":"Conditions for activating the plan(s), and the associated roles and responsibilities?"},{"$f":"'K. Business Resiliency'!D60","v":0},{"$f":"'K. Business Resiliency'!E60","v":0},{"$f":"'K. Business Resiliency'!F60","v":0},{"$f":"'K. Business Resiliency'!G60","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H60","v":"8.4.2"},{"$f":"'K. Business Resiliency'!I60","v":"Incident response structure"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'K. Business Resiliency'!A61","v":2292},{"$f":"'K. Business Resiliency'!J61","v":2},{"$f":"'K. Business Resiliency'!K61","v":0},{"$f":"'K. Business Resiliency'!Y61","v":0},{"$f":"'K. Business Resiliency'!B61","v":"K.6.3"},{"$f":"'K. Business Resiliency'!C61","v":"Maintenance schedule to review, revise and test the recovery management plan?"},{"$f":"'K. Business Resiliency'!D61","v":0},{"$f":"'K. Business Resiliency'!E61","v":0},{"$f":"'K. Business Resiliency'!F61","v":0},{"$f":"'K. Business Resiliency'!G61","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H61","v":"8.4.1"},{"$f":"'K. Business Resiliency'!I61","v":"Establish and implement business continuity procedures "},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'K. Business Resiliency'!A62","v":2294},{"$f":"'K. Business Resiliency'!J62","v":2},{"$f":"'K. Business Resiliency'!K62","v":0},{"$f":"'K. Business Resiliency'!Y62","v":0},{"$f":"'K. Business Resiliency'!B62","v":"K.6.4"},{"$f":"'K. Business Resiliency'!C62","v":"Roles and responsibilities for those who invoke and execute the plan?"},{"$f":"'K. Business Resiliency'!D62","v":0},{"$f":"'K. Business Resiliency'!E62","v":0},{"$f":"'K. Business Resiliency'!F62","v":0},{"$f":"'K. Business Resiliency'!G62","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H62","v":"8.4.4"},{"$f":"'K. Business Resiliency'!I62","v":"Business continuity plans"},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'K. Business Resiliency'!A63","v":2303},{"$f":"'K. Business Resiliency'!J63","v":2},{"$f":"'K. Business Resiliency'!K63","v":0},{"$f":"'K. Business Resiliency'!Y63","v":0},{"$f":"'K. Business Resiliency'!B63","v":"K.6.5"},{"$f":"'K. Business Resiliency'!C63","v":"Alternate and diverse means of communications in the event standard communication channels are unavailable?"},{"$f":"'K. Business Resiliency'!D63","v":0},{"$f":"'K. Business Resiliency'!E63","v":0},{"$f":"'K. Business Resiliency'!F63","v":0},{"$f":"'K. Business Resiliency'!G63","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H63","v":7.4},{"$f":"'K. Business Resiliency'!I63","v":"Communication"},null,"PO3.1","Technological direction planning","N/A","BCP.1.4.3.10 MGMT.1.3.8","PO3.1, PO9.1, PO9.2, DS4.1, DS4.3, DS4.8, DS8.3"]
[{"$f":"'K. Business Resiliency'!A64","v":2725},{"$f":"'K. Business Resiliency'!J64","v":2},{"$f":"'K. Business Resiliency'!K64","v":0},{"$f":"'K. Business Resiliency'!Y64","v":0},{"$f":"'K. Business Resiliency'!B64","v":"K.6.6"},{"$f":"'K. Business Resiliency'!C64","v":"Interaction with the media during an event?"},{"$f":"'K. Business Resiliency'!D64","v":0},{"$f":"'K. Business Resiliency'!E64","v":0},{"$f":"'K. Business Resiliency'!F64","v":0},{"$f":"'K. Business Resiliency'!G64","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H64","v":"8.4.2\n8.4.4"},{"$f":"'K. Business Resiliency'!I64","v":"Incident response structure\r\nBusiness Continuity Plans"},null,"PO3.1","Technological direction planning","N/A","N/A","PO3.1, PO9.1, PO9.2, DS4.1, DS4.3, DS4.8, DS8.3"]
[{"$f":"'K. Business Resiliency'!A65","v":2726},{"$f":"'K. Business Resiliency'!J65","v":2},{"$f":"'K. Business Resiliency'!K65","v":0},{"$f":"'K. Business Resiliency'!Y65","v":0},{"$f":"'K. Business Resiliency'!B65","v":"K.6.7"},{"$f":"'K. Business Resiliency'!C65","v":"Resumption procedures to return to normal business operations?"},{"$f":"'K. Business Resiliency'!D65","v":0},{"$f":"'K. Business Resiliency'!E65","v":0},{"$f":"'K. Business Resiliency'!F65","v":0},{"$f":"'K. Business Resiliency'!G65","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H65","v":"8.4.5"},{"$f":"'K. Business Resiliency'!I65","v":"Recovery"}]
[{"$f":"'K. Business Resiliency'!A66","v":2728},{"$f":"'K. Business Resiliency'!J66","v":2},{"$f":"'K. Business Resiliency'!K66","v":0},{"$f":"'K. Business Resiliency'!Y66","v":0},{"$f":"'K. Business Resiliency'!B66","v":"K.6.8"},{"$f":"'K. Business Resiliency'!C66","v":"Notification and escalation to clients?"},{"$f":"'K. Business Resiliency'!D66","v":0},{"$f":"'K. Business Resiliency'!E66","v":0},{"$f":"'K. Business Resiliency'!F66","v":0},{"$f":"'K. Business Resiliency'!G66","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H66","v":"8.4.2"},{"$f":"'K. Business Resiliency'!I66","v":"Incident response structure"}]
[{"$f":"'K. Business Resiliency'!A67","v":2286},{"$f":"'K. Business Resiliency'!J67","v":1},{"$f":"'K. Business Resiliency'!K67","v":0},{"$f":"'K. Business Resiliency'!Y67","v":1},{"$f":"'K. Business Resiliency'!B67","v":"K.7"},{"$f":"'K. Business Resiliency'!C67","v":"Is there a periodic (at least annual) review of your Business Resiliency Program? If yes, does it include:"},{"$f":"'K. Business Resiliency'!D67","v":0},{"$f":"'K. Business Resiliency'!E67","v":0},{"$f":"'K. Business Resiliency'!F67","v":0},{"$f":"'K. Business Resiliency'!G67","v":"K.7  Exercising"},{"$f":"'K. Business Resiliency'!H67","v":"8.4.1"},{"$f":"'K. Business Resiliency'!I67","v":"Establish and implement business continuity procedures"}]
[{"$f":"'K. Business Resiliency'!A68","v":4055},{"$f":"'K. Business Resiliency'!J68","v":2},{"$f":"'K. Business Resiliency'!K68","v":0},{"$f":"'K. Business Resiliency'!Y68","v":0},{"$f":"'K. Business Resiliency'!B68","v":"K.7.1"},{"$f":"'K. Business Resiliency'!C68","v":"Updates to the procedures as necessary after the review?"},{"$f":"'K. Business Resiliency'!D68","v":0},{"$f":"'K. Business Resiliency'!E68","v":0},{"$f":"'K. Business Resiliency'!F68","v":0},{"$f":"'K. Business Resiliency'!G68","v":"K.6 Maintenance and Continuous Improvement\nK.7  Exercising"},{"$f":"'K. Business Resiliency'!H68","v":"8.4.1"},{"$f":"'K. Business Resiliency'!I68","v":"Establish and implement business continuity procedures"}]
[{"$f":"'K. Business Resiliency'!A69","v":4056},{"$f":"'K. Business Resiliency'!J69","v":2},{"$f":"'K. Business Resiliency'!K69","v":0},{"$f":"'K. Business Resiliency'!Y69","v":0},{"$f":"'K. Business Resiliency'!B69","v":"K.7.2"},{"$f":"'K. Business Resiliency'!C69","v":"Changes in business activities, dependencies and related recovery objectives?"},{"$f":"'K. Business Resiliency'!D69","v":0},{"$f":"'K. Business Resiliency'!E69","v":0},{"$f":"'K. Business Resiliency'!F69","v":0},{"$f":"'K. Business Resiliency'!G69","v":"K.6 Maintenance and Continuous Improvement"},{"$f":"'K. Business Resiliency'!H69","v":"8.4.1"},{"$f":"'K. Business Resiliency'!I69","v":"Establish and implement business continuity procedures"}]
[{"$f":"'K. Business Resiliency'!A70","v":4057},{"$f":"'K. Business Resiliency'!J70","v":2},{"$f":"'K. Business Resiliency'!K70","v":0},{"$f":"'K. Business Resiliency'!Y70","v":0},{"$f":"'K. Business Resiliency'!B70","v":"K.7.3"},{"$f":"'K. Business Resiliency'!C70","v":"Changes in organizational structure and personnel changes?"},{"$f":"'K. Business Resiliency'!D70","v":0},{"$f":"'K. Business Resiliency'!E70","v":0},{"$f":"'K. Business Resiliency'!F70","v":0},{"$f":"'K. Business Resiliency'!G70","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H70","v":"N/A"},{"$f":"'K. Business Resiliency'!I70","v":0}]
[{"$f":"'K. Business Resiliency'!A71","v":4058},{"$f":"'K. Business Resiliency'!J71","v":2},{"$f":"'K. Business Resiliency'!K71","v":0},{"$f":"'K. Business Resiliency'!Y71","v":0},{"$f":"'K. Business Resiliency'!B71","v":"K.7.4"},{"$f":"'K. Business Resiliency'!C71","v":"Emerging threats and identified new risks?"},{"$f":"'K. Business Resiliency'!D71","v":0},{"$f":"'K. Business Resiliency'!E71","v":0},{"$f":"'K. Business Resiliency'!F71","v":0},{"$f":"'K. Business Resiliency'!G71","v":"K.2 Business Impact Analysis"},{"$f":"'K. Business Resiliency'!H71","v":"N/A"},{"$f":"'K. Business Resiliency'!I71","v":0}]
[{"$f":"'K. Business Resiliency'!A72","v":4059},{"$f":"'K. Business Resiliency'!J72","v":2},{"$f":"'K. Business Resiliency'!K72","v":0},{"$f":"'K. Business Resiliency'!Y72","v":0},{"$f":"'K. Business Resiliency'!B72","v":"K.7.5"},{"$f":"'K. Business Resiliency'!C72","v":"Warning and communication procedures and capabilities?"},{"$f":"'K. Business Resiliency'!D72","v":0},{"$f":"'K. Business Resiliency'!E72","v":0},{"$f":"'K. Business Resiliency'!F72","v":0},{"$f":"'K. Business Resiliency'!G72","v":"K.1 Business Resiliency Governance"},{"$f":"'K. Business Resiliency'!H72","v":"8.4.3"},{"$f":"'K. Business Resiliency'!I72","v":"Warning and communication"}]
[{"$f":"'K. Business Resiliency'!A73","v":2298},{"$f":"'K. Business Resiliency'!J73","v":2},{"$f":"'K. Business Resiliency'!K73","v":0},{"$f":"'K. Business Resiliency'!Y73","v":0},{"$f":"'K. Business Resiliency'!B73","v":"K.7.6"},{"$f":"'K. Business Resiliency'!C73","v":"Environment changes are replicated to contingency environments e.g., hardware, software, etc.?"},{"$f":"'K. Business Resiliency'!D73","v":0},{"$f":"'K. Business Resiliency'!E73","v":0},{"$f":"'K. Business Resiliency'!F73","v":0},{"$f":"'K. Business Resiliency'!G73","v":"K.6 Maintenance and Continuous Improvement"},{"$f":"'K. Business Resiliency'!H73","v":"?"},{"$f":"'K. Business Resiliency'!I73","v":"addressed by 27031"}]
[{"$f":"'K. Business Resiliency'!A74","v":2300},{"$f":"'K. Business Resiliency'!J74","v":2},{"$f":"'K. Business Resiliency'!K74","v":0},{"$f":"'K. Business Resiliency'!Y74","v":0},{"$f":"'K. Business Resiliency'!B74","v":"K.7.7"},{"$f":"'K. Business Resiliency'!C74","v":"Updates from the inventory of IT and telecom assets?"},{"$f":"'K. Business Resiliency'!D74","v":0},{"$f":"'K. Business Resiliency'!E74","v":0},{"$f":"'K. Business Resiliency'!F74","v":0},{"$f":"'K. Business Resiliency'!G74","v":"K.6 Maintenance and Continuous Improvement"},{"$f":"'K. Business Resiliency'!H74","v":"?"},{"$f":"'K. Business Resiliency'!I74","v":"addressed by 27031"}]
[{"$f":"'K. Business Resiliency'!A75","v":2729},{"$f":"'K. Business Resiliency'!J75","v":1},{"$f":"'K. Business Resiliency'!K75","v":0},{"$f":"'K. Business Resiliency'!Y75","v":1},{"$f":"'K. Business Resiliency'!B75","v":"K.8"},{"$f":"'K. Business Resiliency'!C75","v":"Are there any dependencies on critical third party service providers? If so, have:"},{"$f":"'K. Business Resiliency'!D75","v":0},{"$f":"'K. Business Resiliency'!E75","v":0},{"$f":"'K. Business Resiliency'!F75","v":0},{"$f":"'K. Business Resiliency'!G75","v":"K.2 Business Impact Analysis"},{"$f":"'K. Business Resiliency'!H75","v":"8.1\n8.3\n8.3.1\n8.44"},{"$f":"'K. Business Resiliency'!I75","v":"Operational Planning and Control\r\nBusiness continuity strategy\r\nDetermination and selection\r\nBusiness continuity plans"},"Strategic Considerations - Third Party Management. Line 124"]
[{"$f":"'K. Business Resiliency'!A76","v":2308},{"$f":"'K. Business Resiliency'!J76","v":2},{"$f":"'K. Business Resiliency'!K76","v":0},{"$f":"'K. Business Resiliency'!Y76","v":0},{"$f":"'K. Business Resiliency'!B76","v":"K.8.1"},{"$f":"'K. Business Resiliency'!C76","v":"Contact information for key service provider personnel been documented?"},{"$f":"'K. Business Resiliency'!D76","v":0},{"$f":"'K. Business Resiliency'!E76","v":0},{"$f":"'K. Business Resiliency'!F76","v":0},{"$f":"'K. Business Resiliency'!G76","v":"K.1 Business Resiliency Governance\nK.2 Business Impact Analysis"},{"$f":"'K. Business Resiliency'!H76","v":"N/A"},{"$f":"'K. Business Resiliency'!I76","v":0}]
[{"$f":"'K. Business Resiliency'!A77","v":4060},{"$f":"'K. Business Resiliency'!J77","v":3},{"$f":"'K. Business Resiliency'!K77","v":0},{"$f":"'K. Business Resiliency'!Y77","v":0},{"$f":"'K. Business Resiliency'!B77","v":"K.8.1.1"},{"$f":"'K. Business Resiliency'!C77","v":"Is the contact information reviewed and updated at least annually?"},{"$f":"'K. Business Resiliency'!D77","v":0},{"$f":"'K. Business Resiliency'!E77","v":0},{"$f":"'K. Business Resiliency'!F77","v":0},{"$f":"'K. Business Resiliency'!G77","v":"K.1 Business Resiliency Governance\nK.2 Business Impact Analysis"},{"$f":"'K. Business Resiliency'!H77","v":"N/A"},{"$f":"'K. Business Resiliency'!I77","v":0}]
[{"$f":"'K. Business Resiliency'!A78","v":2295},{"$f":"'K. Business Resiliency'!J78","v":2},{"$f":"'K. Business Resiliency'!K78","v":0},{"$f":"'K. Business Resiliency'!Y78","v":0},{"$f":"'K. Business Resiliency'!B78","v":"K.8.2"},{"$f":"'K. Business Resiliency'!C78","v":"Notification and escalation protocols been established?"},{"$f":"'K. Business Resiliency'!D78","v":0},{"$f":"'K. Business Resiliency'!E78","v":0},{"$f":"'K. Business Resiliency'!F78","v":0},{"$f":"'K. Business Resiliency'!G78","v":"K.1 Business Resiliency Governance\nK.2 Business Impact Analysis"},{"$f":"'K. Business Resiliency'!H78","v":"8.4.3"},{"$f":"'K. Business Resiliency'!I78","v":"Warning and communication"}]
[{"$f":"'K. Business Resiliency'!A79","v":2730},{"$f":"'K. Business Resiliency'!J79","v":2},{"$f":"'K. Business Resiliency'!K79","v":0},{"$f":"'K. Business Resiliency'!Y79","v":0},{"$f":"'K. Business Resiliency'!B79","v":"K.8.3"},{"$f":"'K. Business Resiliency'!C79","v":"Communication in the event of a disruption that impacts the delivery of their products and services?"},{"$f":"'K. Business Resiliency'!D79","v":0},{"$f":"'K. Business Resiliency'!E79","v":0},{"$f":"'K. Business Resiliency'!F79","v":0},{"$f":"'K. Business Resiliency'!G79","v":"K.1 Business Resiliency Governance\nK.2 Business Impact Analysis"},{"$f":"'K. Business Resiliency'!H79","v":7.4},{"$f":"'K. Business Resiliency'!I79","v":"Communication"}]
[{"$f":"'K. Business Resiliency'!A80","v":2731},{"$f":"'K. Business Resiliency'!J80","v":2},{"$f":"'K. Business Resiliency'!K80","v":0},{"$f":"'K. Business Resiliency'!Y80","v":0},{"$f":"'K. Business Resiliency'!B80","v":"K.8.4"},{"$f":"'K. Business Resiliency'!C80","v":"Processes been implemented to notify the service provider when their Business Resiliency Procedures are modified?"},{"$f":"'K. Business Resiliency'!D80","v":0},{"$f":"'K. Business Resiliency'!E80","v":0},{"$f":"'K. Business Resiliency'!F80","v":0},{"$f":"'K. Business Resiliency'!G80","v":"K.1 Business Resiliency Governance\nK.2 Business Impact Analysis"},{"$f":"'K. Business Resiliency'!H80","v":"N/A"},{"$f":"'K. Business Resiliency'!I80","v":0}]
[{"$f":"'K. Business Resiliency'!A81","v":2343},{"$f":"'K. Business Resiliency'!J81","v":1},{"$f":"'K. Business Resiliency'!K81","v":0},{"$f":"'K. Business Resiliency'!Y81","v":1},{"$f":"'K. Business Resiliency'!B81","v":"K.9"},{"$f":"'K. Business Resiliency'!C81","v":"Is there a formal, documented exercise and testing program in place? If yes, does it include:"},{"$f":"'K. Business Resiliency'!D81","v":0},{"$f":"'K. Business Resiliency'!E81","v":0},{"$f":"'K. Business Resiliency'!F81","v":0},{"$f":"'K. Business Resiliency'!G81","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H81","v":8.5},{"$f":"'K. Business Resiliency'!I81","v":"Exercising and testing"},"Testing with Third Party TSPs lines 236-237"]
[{"$f":"'K. Business Resiliency'!A82","v":2346},{"$f":"'K. Business Resiliency'!J82","v":2},{"$f":"'K. Business Resiliency'!K82","v":0},{"$f":"'K. Business Resiliency'!Y82","v":0},{"$f":"'K. Business Resiliency'!B82","v":"K.9.1"},{"$f":"'K. Business Resiliency'!C82","v":"Specific IT Disaster Recovery exercises and tests that address the unavailability of specific resources? If yes, are the following included:"},{"$f":"'K. Business Resiliency'!D82","v":0},{"$f":"'K. Business Resiliency'!E82","v":0},{"$f":"'K. Business Resiliency'!F82","v":0},{"$f":"'K. Business Resiliency'!G82","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H82","v":8.5},{"$f":"'K. Business Resiliency'!I82","v":"Exercising and testing"},"Background and Purpose Testing with Third Party TSPs lines 22 & 232"]
[{"$f":"'K. Business Resiliency'!A83","v":4061},{"$f":"'K. Business Resiliency'!J83","v":3},{"$f":"'K. Business Resiliency'!K83","v":0},{"$f":"'K. Business Resiliency'!Y83","v":0},{"$f":"'K. Business Resiliency'!B83","v":"K.9.1.1"},{"$f":"'K. Business Resiliency'!C83","v":"Production data center(s)?"},{"$f":"'K. Business Resiliency'!D83","v":0},{"$f":"'K. Business Resiliency'!E83","v":0},{"$f":"'K. Business Resiliency'!F83","v":0},{"$f":"'K. Business Resiliency'!G83","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H83","v":"N/A"},{"$f":"'K. Business Resiliency'!I83","v":0},"Background and Purpose Testing with Third Party TSPs lines 22 & 232"]
[{"$f":"'K. Business Resiliency'!A84","v":4062},{"$f":"'K. Business Resiliency'!J84","v":3},{"$f":"'K. Business Resiliency'!K84","v":0},{"$f":"'K. Business Resiliency'!Y84","v":0},{"$f":"'K. Business Resiliency'!B84","v":"K.9.1.2"},{"$f":"'K. Business Resiliency'!C84","v":"Data stores?"},{"$f":"'K. Business Resiliency'!D84","v":0},{"$f":"'K. Business Resiliency'!E84","v":0},{"$f":"'K. Business Resiliency'!F84","v":0},{"$f":"'K. Business Resiliency'!G84","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H84","v":"N/A"},{"$f":"'K. Business Resiliency'!I84","v":0},"Background and Purpose Testing with Third Party TSPs lines 22 & 232"]
[{"$f":"'K. Business Resiliency'!A85","v":4063},{"$f":"'K. Business Resiliency'!J85","v":3},{"$f":"'K. Business Resiliency'!K85","v":0},{"$f":"'K. Business Resiliency'!Y85","v":0},{"$f":"'K. Business Resiliency'!B85","v":"K.9.1.3"},{"$f":"'K. Business Resiliency'!C85","v":"Recovery supporting personnel (40% or more)?"},{"$f":"'K. Business Resiliency'!D85","v":0},{"$f":"'K. Business Resiliency'!E85","v":0},{"$f":"'K. Business Resiliency'!F85","v":0},{"$f":"'K. Business Resiliency'!G85","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H85","v":"N/A"},{"$f":"'K. Business Resiliency'!I85","v":0},"Background and Purpose Testing with Third Party TSPs lines 22 & 232"]
[{"$f":"'K. Business Resiliency'!A86","v":4064},{"$f":"'K. Business Resiliency'!J86","v":3},{"$f":"'K. Business Resiliency'!K86","v":0},{"$f":"'K. Business Resiliency'!Y86","v":0},{"$f":"'K. Business Resiliency'!B86","v":"K.9.1.4"},{"$f":"'K. Business Resiliency'!C86","v":"Network?"},{"$f":"'K. Business Resiliency'!D86","v":0},{"$f":"'K. Business Resiliency'!E86","v":0},{"$f":"'K. Business Resiliency'!F86","v":0},{"$f":"'K. Business Resiliency'!G86","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H86","v":"N/A"},{"$f":"'K. Business Resiliency'!I86","v":0},"Background and Purpose Testing with Third Party TSPs lines 22 & 232"]
[{"$f":"'K. Business Resiliency'!A87","v":4065},{"$f":"'K. Business Resiliency'!J87","v":2},{"$f":"'K. Business Resiliency'!K87","v":0},{"$f":"'K. Business Resiliency'!Y87","v":0},{"$f":"'K. Business Resiliency'!B87","v":"K.9.2"},{"$f":"'K. Business Resiliency'!C87","v":"Specific business activity exercises and tests that address the unavailability of specific resources i.e., realistic scenarios? If yes, does it include:"},{"$f":"'K. Business Resiliency'!D87","v":0},{"$f":"'K. Business Resiliency'!E87","v":0},{"$f":"'K. Business Resiliency'!F87","v":0},{"$f":"'K. Business Resiliency'!G87","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H87","v":8.5},{"$f":"'K. Business Resiliency'!I87","v":"Exercising and testing"},"Background and Purpose Testing with Third Party TSPs - Testing Scenarios  lines 19-22, 232, and 251-252"]
[{"$f":"'K. Business Resiliency'!A88","v":4066},{"$f":"'K. Business Resiliency'!J88","v":3},{"$f":"'K. Business Resiliency'!K88","v":0},{"$f":"'K. Business Resiliency'!Y88","v":0},{"$f":"'K. Business Resiliency'!B88","v":"K.9.2.1"},{"$f":"'K. Business Resiliency'!C88","v":"Information and communication technology?"},{"$f":"'K. Business Resiliency'!D88","v":0},{"$f":"'K. Business Resiliency'!E88","v":0},{"$f":"'K. Business Resiliency'!F88","v":0},{"$f":"'K. Business Resiliency'!G88","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H88","v":"N/A"},{"$f":"'K. Business Resiliency'!I88","v":0},"Background and Purpose Testing with Third Party TSPs lines 22 & 232"]
[{"$f":"'K. Business Resiliency'!A89","v":4067},{"$f":"'K. Business Resiliency'!J89","v":3},{"$f":"'K. Business Resiliency'!K89","v":0},{"$f":"'K. Business Resiliency'!Y89","v":0},{"$f":"'K. Business Resiliency'!B89","v":"K.9.2.2"},{"$f":"'K. Business Resiliency'!C89","v":"Network due to dedicated denial of service / cyber attacks?"},{"$f":"'K. Business Resiliency'!D89","v":0},{"$f":"'K. Business Resiliency'!E89","v":0},{"$f":"'K. Business Resiliency'!F89","v":0},{"$f":"'K. Business Resiliency'!G89","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H89","v":"N/A"},{"$f":"'K. Business Resiliency'!I89","v":0},"Background and Purpose Testing with Third Party TSPs lines 22 & 232"]
[{"$f":"'K. Business Resiliency'!A90","v":4068},{"$f":"'K. Business Resiliency'!J90","v":3},{"$f":"'K. Business Resiliency'!K90","v":0},{"$f":"'K. Business Resiliency'!Y90","v":0},{"$f":"'K. Business Resiliency'!B90","v":"K.9.2.3"},{"$f":"'K. Business Resiliency'!C90","v":"Work places/buildings?"},{"$f":"'K. Business Resiliency'!D90","v":0},{"$f":"'K. Business Resiliency'!E90","v":0},{"$f":"'K. Business Resiliency'!F90","v":0},{"$f":"'K. Business Resiliency'!G90","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H90","v":"N/A"},{"$f":"'K. Business Resiliency'!I90","v":0},"Background and Purpose Testing with Third Party TSPs lines 22 & 232"]
[{"$f":"'K. Business Resiliency'!A91","v":4069},{"$f":"'K. Business Resiliency'!J91","v":3},{"$f":"'K. Business Resiliency'!K91","v":0},{"$f":"'K. Business Resiliency'!Y91","v":0},{"$f":"'K. Business Resiliency'!B91","v":"K.9.2.4"},{"$f":"'K. Business Resiliency'!C91","v":"Personnel?"},{"$f":"'K. Business Resiliency'!D91","v":0},{"$f":"'K. Business Resiliency'!E91","v":0},{"$f":"'K. Business Resiliency'!F91","v":0},{"$f":"'K. Business Resiliency'!G91","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H91","v":"N/A"},{"$f":"'K. Business Resiliency'!I91","v":0},"Background and Purpose Testing with Third Party TSPs lines 22 & 232"]
[{"$f":"'K. Business Resiliency'!A92","v":4070},{"$f":"'K. Business Resiliency'!J92","v":3},{"$f":"'K. Business Resiliency'!K92","v":0},{"$f":"'K. Business Resiliency'!Y92","v":0},{"$f":"'K. Business Resiliency'!B92","v":"K.9.2.5"},{"$f":"'K. Business Resiliency'!C92","v":"Third party services (e.g. partners and suppliers)?"},{"$f":"'K. Business Resiliency'!D92","v":0},{"$f":"'K. Business Resiliency'!E92","v":0},{"$f":"'K. Business Resiliency'!F92","v":0},{"$f":"'K. Business Resiliency'!G92","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H92","v":"N/A"},{"$f":"'K. Business Resiliency'!I92","v":0},"Background and Purpose Testing with Third Party TSPs lines 22 & 232"]
[{"$f":"'K. Business Resiliency'!A93","v":4071},{"$f":"'K. Business Resiliency'!J93","v":2},{"$f":"'K. Business Resiliency'!K93","v":0},{"$f":"'K. Business Resiliency'!Y93","v":0},{"$f":"'K. Business Resiliency'!B93","v":"K.9.3"},{"$f":"'K. Business Resiliency'!C93","v":"Are measurable recovery objectives defined for each exercise and test? If yes, do they include:"},{"$f":"'K. Business Resiliency'!D93","v":0},{"$f":"'K. Business Resiliency'!E93","v":0},{"$f":"'K. Business Resiliency'!F93","v":0},{"$f":"'K. Business Resiliency'!G93","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H93","v":8.5},{"$f":"'K. Business Resiliency'!I93","v":"Exercising and testing"},"Testing with Third Party TSPs line 212"]
[{"$f":"'K. Business Resiliency'!A94","v":4072},{"$f":"'K. Business Resiliency'!J94","v":3},{"$f":"'K. Business Resiliency'!K94","v":0},{"$f":"'K. Business Resiliency'!Y94","v":0},{"$f":"'K. Business Resiliency'!B94","v":"K.9.3.1"},{"$f":"'K. Business Resiliency'!C94","v":"Recovery Time Objectives for all essential application systems, network services, and other resources?"},{"$f":"'K. Business Resiliency'!D94","v":0},{"$f":"'K. Business Resiliency'!E94","v":0},{"$f":"'K. Business Resiliency'!F94","v":0},{"$f":"'K. Business Resiliency'!G94","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H94","v":"N/A"},{"$f":"'K. Business Resiliency'!I94","v":0},"Testing with Third Party TSPs line 212"]
[{"$f":"'K. Business Resiliency'!A95","v":4073},{"$f":"'K. Business Resiliency'!J95","v":3},{"$f":"'K. Business Resiliency'!K95","v":0},{"$f":"'K. Business Resiliency'!Y95","v":0},{"$f":"'K. Business Resiliency'!B95","v":"K.9.3.2"},{"$f":"'K. Business Resiliency'!C95","v":"Recovery Point Objective for all essential application systems?"},{"$f":"'K. Business Resiliency'!D95","v":0},{"$f":"'K. Business Resiliency'!E95","v":0},{"$f":"'K. Business Resiliency'!F95","v":0},{"$f":"'K. Business Resiliency'!G95","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H95","v":"N/A"},{"$f":"'K. Business Resiliency'!I95","v":0},"Testing with Third Party TSPs line 212"]
[{"$f":"'K. Business Resiliency'!A96","v":4074},{"$f":"'K. Business Resiliency'!J96","v":2},{"$f":"'K. Business Resiliency'!K96","v":0},{"$f":"'K. Business Resiliency'!Y96","v":0},{"$f":"'K. Business Resiliency'!B96","v":"K.9.4"},{"$f":"'K. Business Resiliency'!C96","v":"Are the recovery objective attainment results and the issues identified evaluated with improvement actions identified and acted upon?"},{"$f":"'K. Business Resiliency'!D96","v":0},{"$f":"'K. Business Resiliency'!E96","v":0},{"$f":"'K. Business Resiliency'!F96","v":0},{"$f":"'K. Business Resiliency'!G96","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H96","v":8.5},{"$f":"'K. Business Resiliency'!I96","v":"Exercising and testing"},"Testing with Third Party TSPs line 244-245"]
[{"$f":"'K. Business Resiliency'!A97","v":4075},{"$f":"'K. Business Resiliency'!J97","v":2},{"$f":"'K. Business Resiliency'!K97","v":0},{"$f":"'K. Business Resiliency'!Y97","v":0},{"$f":"'K. Business Resiliency'!B97","v":"K.9.5"},{"$f":"'K. Business Resiliency'!C97","v":"Is the exercise and testing schedule reviewed and enhanced when there are significant changes within the organization or to the environment in which it operates?"},{"$f":"'K. Business Resiliency'!D97","v":0},{"$f":"'K. Business Resiliency'!E97","v":0},{"$f":"'K. Business Resiliency'!F97","v":0},{"$f":"'K. Business Resiliency'!G97","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H97","v":8.5},{"$f":"'K. Business Resiliency'!I97","v":"Exercising and testing"}]
[{"$f":"'K. Business Resiliency'!A98","v":2779},{"$f":"'K. Business Resiliency'!J98","v":2},{"$f":"'K. Business Resiliency'!K98","v":0},{"$f":"'K. Business Resiliency'!Y98","v":0},{"$f":"'K. Business Resiliency'!B98","v":"K.9.6"},{"$f":"'K. Business Resiliency'!C98","v":"Is there an annual schedule of planned Business Resiliency exercises and tests? If yes, do they include:"},{"$f":"'K. Business Resiliency'!D98","v":0},{"$f":"'K. Business Resiliency'!E98","v":0},{"$f":"'K. Business Resiliency'!F98","v":0},{"$f":"'K. Business Resiliency'!G98","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H98","v":"?"},{"$f":"'K. Business Resiliency'!I98","v":"addressed by 27031"},"Testing with Third Party TSPs line 241-242"]
[{"$f":"'K. Business Resiliency'!A99","v":2351},{"$f":"'K. Business Resiliency'!J99","v":3},{"$f":"'K. Business Resiliency'!K99","v":0},{"$f":"'K. Business Resiliency'!Y99","v":0},{"$f":"'K. Business Resiliency'!B99","v":"K.9.6.1"},{"$f":"'K. Business Resiliency'!C99","v":"Evacuation drills?"},{"$f":"'K. Business Resiliency'!D99","v":0},{"$f":"'K. Business Resiliency'!E99","v":0},{"$f":"'K. Business Resiliency'!F99","v":0},{"$f":"'K. Business Resiliency'!G99","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H99","v":"N/A"},{"$f":"'K. Business Resiliency'!I99","v":0}]
[{"$f":"'K. Business Resiliency'!A100","v":2352},{"$f":"'K. Business Resiliency'!J100","v":3},{"$f":"'K. Business Resiliency'!K100","v":0},{"$f":"'K. Business Resiliency'!Y100","v":0},{"$f":"'K. Business Resiliency'!B100","v":"K.9.6.2"},{"$f":"'K. Business Resiliency'!C100","v":"Notification procedure and mechanism tests?"},{"$f":"'K. Business Resiliency'!D100","v":0},{"$f":"'K. Business Resiliency'!E100","v":0},{"$f":"'K. Business Resiliency'!F100","v":0},{"$f":"'K. Business Resiliency'!G100","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H100","v":"N/A"},{"$f":"'K. Business Resiliency'!I100","v":0},"Testing Scenarios lines255-256"]
[{"$f":"'K. Business Resiliency'!A101","v":2353},{"$f":"'K. Business Resiliency'!J101","v":3},{"$f":"'K. Business Resiliency'!K101","v":0},{"$f":"'K. Business Resiliency'!Y101","v":0},{"$f":"'K. Business Resiliency'!B101","v":"K.9.6.3"},{"$f":"'K. Business Resiliency'!C101","v":"Tabletop exercises?"},{"$f":"'K. Business Resiliency'!D101","v":0},{"$f":"'K. Business Resiliency'!E101","v":0},{"$f":"'K. Business Resiliency'!F101","v":0},{"$f":"'K. Business Resiliency'!G101","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H101","v":"N/A"},{"$f":"'K. Business Resiliency'!I101","v":0}]
[{"$f":"'K. Business Resiliency'!A102","v":2354},{"$f":"'K. Business Resiliency'!J102","v":3},{"$f":"'K. Business Resiliency'!K102","v":0},{"$f":"'K. Business Resiliency'!Y102","v":0},{"$f":"'K. Business Resiliency'!B102","v":"K.9.6.4"},{"$f":"'K. Business Resiliency'!C102","v":"Application recovery tests?"},{"$f":"'K. Business Resiliency'!D102","v":0},{"$f":"'K. Business Resiliency'!E102","v":0},{"$f":"'K. Business Resiliency'!F102","v":0},{"$f":"'K. Business Resiliency'!G102","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H102","v":"N/A"},{"$f":"'K. Business Resiliency'!I102","v":0}]
[{"$f":"'K. Business Resiliency'!A103","v":2355},{"$f":"'K. Business Resiliency'!J103","v":3},{"$f":"'K. Business Resiliency'!K103","v":0},{"$f":"'K. Business Resiliency'!Y103","v":0},{"$f":"'K. Business Resiliency'!B103","v":"K.9.6.5"},{"$f":"'K. Business Resiliency'!C103","v":"Remote access tests?"},{"$f":"'K. Business Resiliency'!D103","v":0},{"$f":"'K. Business Resiliency'!E103","v":0},{"$f":"'K. Business Resiliency'!F103","v":0},{"$f":"'K. Business Resiliency'!G103","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H103","v":"N/A"},{"$f":"'K. Business Resiliency'!I103","v":0}]
[{"$f":"'K. Business Resiliency'!A104","v":2357},{"$f":"'K. Business Resiliency'!J104","v":3},{"$f":"'K. Business Resiliency'!K104","v":0},{"$f":"'K. Business Resiliency'!Y104","v":0},{"$f":"'K. Business Resiliency'!B104","v":"K.9.6.6"},{"$f":"'K. Business Resiliency'!C104","v":"Full scale exercises / end-to-end?"},{"$f":"'K. Business Resiliency'!D104","v":0},{"$f":"'K. Business Resiliency'!E104","v":0},{"$f":"'K. Business Resiliency'!F104","v":0},{"$f":"'K. Business Resiliency'!G104","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H104","v":"N/A"},{"$f":"'K. Business Resiliency'!I104","v":0},"Testing with Third Party TSPs line 247"]
[{"$f":"'K. Business Resiliency'!A105","v":4076},{"$f":"'K. Business Resiliency'!J105","v":3},{"$f":"'K. Business Resiliency'!K105","v":0},{"$f":"'K. Business Resiliency'!Y105","v":0},{"$f":"'K. Business Resiliency'!B105","v":"K.9.6.7"},{"$f":"'K. Business Resiliency'!C105","v":"Production transaction processing?"},{"$f":"'K. Business Resiliency'!D105","v":0},{"$f":"'K. Business Resiliency'!E105","v":0},{"$f":"'K. Business Resiliency'!F105","v":0},{"$f":"'K. Business Resiliency'!G105","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H105","v":"N/A"},{"$f":"'K. Business Resiliency'!I105","v":0},"Testing Complexity Strategic Considerations - Testing with TSPs lines 282 and 313"]
[{"$f":"'K. Business Resiliency'!A106","v":4077},{"$f":"'K. Business Resiliency'!J106","v":3},{"$f":"'K. Business Resiliency'!K106","v":0},{"$f":"'K. Business Resiliency'!Y106","v":0},{"$f":"'K. Business Resiliency'!B106","v":"K.9.6.8"},{"$f":"'K. Business Resiliency'!C106","v":"Typical business volumes / full capacity?"},{"$f":"'K. Business Resiliency'!D106","v":0},{"$f":"'K. Business Resiliency'!E106","v":0},{"$f":"'K. Business Resiliency'!F106","v":0},{"$f":"'K. Business Resiliency'!G106","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H106","v":"N/A"},{"$f":"'K. Business Resiliency'!I106","v":0},"Strategic Considerations - Testing with TSPs lines 313 and 315"]
[{"$f":"'K. Business Resiliency'!A107","v":2762},{"$f":"'K. Business Resiliency'!J107","v":3},{"$f":"'K. Business Resiliency'!K107","v":0},{"$f":"'K. Business Resiliency'!Y107","v":0},{"$f":"'K. Business Resiliency'!B107","v":"K.9.6.9"},{"$f":"'K. Business Resiliency'!C107","v":"Business relocation test?"},{"$f":"'K. Business Resiliency'!D107","v":0},{"$f":"'K. Business Resiliency'!E107","v":0},{"$f":"'K. Business Resiliency'!F107","v":0},{"$f":"'K. Business Resiliency'!G107","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H107","v":"N/A"},{"$f":"'K. Business Resiliency'!I107","v":0},"Testing Scenarios lines256-257"]
[{"$f":"'K. Business Resiliency'!A108","v":2763},{"$f":"'K. Business Resiliency'!J108","v":3},{"$f":"'K. Business Resiliency'!K108","v":0},{"$f":"'K. Business Resiliency'!Y108","v":0},{"$f":"'K. Business Resiliency'!B108","v":"K.9.6.10"},{"$f":"'K. Business Resiliency'!C108","v":"Data center failover test?"},{"$f":"'K. Business Resiliency'!D108","v":0},{"$f":"'K. Business Resiliency'!E108","v":0},{"$f":"'K. Business Resiliency'!F108","v":0},{"$f":"'K. Business Resiliency'!G108","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H108","v":"N/A"},{"$f":"'K. Business Resiliency'!I108","v":0},"Testing Scenarios lines256-257"]
[{"$f":"'K. Business Resiliency'!A109","v":2764},{"$f":"'K. Business Resiliency'!J109","v":3},{"$f":"'K. Business Resiliency'!K109","v":0},{"$f":"'K. Business Resiliency'!Y109","v":0},{"$f":"'K. Business Resiliency'!B109","v":"K.9.6.11"},{"$f":"'K. Business Resiliency'!C109","v":"Critical service providers included in testing?"},{"$f":"'K. Business Resiliency'!D109","v":0},{"$f":"'K. Business Resiliency'!E109","v":0},{"$f":"'K. Business Resiliency'!F109","v":0},{"$f":"'K. Business Resiliency'!G109","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H109","v":8.5},{"$f":"'K. Business Resiliency'!I109","v":"Exercising and testing"}]
[{"$f":"'K. Business Resiliency'!A110","v":2356},{"$f":"'K. Business Resiliency'!J110","v":3},{"$f":"'K. Business Resiliency'!K110","v":0},{"$f":"'K. Business Resiliency'!Y110","v":0},{"$f":"'K. Business Resiliency'!B110","v":"K.9.6.12"},{"$f":"'K. Business Resiliency'!C110","v":"Recovery site tests?"},{"$f":"'K. Business Resiliency'!D110","v":0},{"$f":"'K. Business Resiliency'!E110","v":0},{"$f":"'K. Business Resiliency'!F110","v":0},{"$f":"'K. Business Resiliency'!G110","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H110","v":"N/A"},{"$f":"'K. Business Resiliency'!I110","v":0}]
[{"$f":"'K. Business Resiliency'!A111","v":2348},{"$f":"'K. Business Resiliency'!J111","v":3},{"$f":"'K. Business Resiliency'!K111","v":0},{"$f":"'K. Business Resiliency'!Y111","v":0},{"$f":"'K. Business Resiliency'!B111","v":"K.9.6.13"},{"$f":"'K. Business Resiliency'!C111","v":"Assessment of the ability to retrieve vital records?"},{"$f":"'K. Business Resiliency'!D111","v":0},{"$f":"'K. Business Resiliency'!E111","v":0},{"$f":"'K. Business Resiliency'!F111","v":0},{"$f":"'K. Business Resiliency'!G111","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H111","v":"N/A"},{"$f":"'K. Business Resiliency'!I111","v":0}]
[{"$f":"'K. Business Resiliency'!A112","v":4078},{"$f":"'K. Business Resiliency'!J112","v":3},{"$f":"'K. Business Resiliency'!K112","v":0},{"$f":"'K. Business Resiliency'!Y112","v":0},{"$f":"'K. Business Resiliency'!B112","v":"K.9.6.14"},{"$f":"'K. Business Resiliency'!C112","v":"Recovery and continuity of information security controls that may be impacted by a Disaster Recovery event?"},{"$f":"'K. Business Resiliency'!D112","v":0},{"$f":"'K. Business Resiliency'!E112","v":0},{"$f":"'K. Business Resiliency'!F112","v":0},{"$f":"'K. Business Resiliency'!G112","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H112","v":"N/A"},{"$f":"'K. Business Resiliency'!I112","v":0}]
[{"$f":"'K. Business Resiliency'!A113","v":4079},{"$f":"'K. Business Resiliency'!J113","v":3},{"$f":"'K. Business Resiliency'!K113","v":0},{"$f":"'K. Business Resiliency'!Y113","v":0},{"$f":"'K. Business Resiliency'!B113","v":"K.9.6.15"},{"$f":"'K. Business Resiliency'!C113","v":"Recovery and continuity of information security operational processes and controls that may be impacted by a by a non-Disaster Recovery event (e.g. loss of physical work place, reduction in available IS personnel)?"},{"$f":"'K. Business Resiliency'!D113","v":0},{"$f":"'K. Business Resiliency'!E113","v":0},{"$f":"'K. Business Resiliency'!F113","v":0},{"$f":"'K. Business Resiliency'!G113","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H113","v":"N/A"},{"$f":"'K. Business Resiliency'!I113","v":0}]
[{"$f":"'K. Business Resiliency'!A114","v":4080},{"$f":"'K. Business Resiliency'!J114","v":3},{"$f":"'K. Business Resiliency'!K114","v":0},{"$f":"'K. Business Resiliency'!Y114","v":0},{"$f":"'K. Business Resiliency'!B114","v":"K.9.6.16"},{"$f":"'K. Business Resiliency'!C114","v":"Recovery and continuity of IT operational processes and controls that may be impacted by a by a non-Disaster Recovery event (e.g. loss of physical work place, reduction in available IT operations personnel)?"},{"$f":"'K. Business Resiliency'!D114","v":0},{"$f":"'K. Business Resiliency'!E114","v":0},{"$f":"'K. Business Resiliency'!F114","v":0},{"$f":"'K. Business Resiliency'!G114","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H114","v":"?"},{"$f":"'K. Business Resiliency'!I114","v":"addressed by 27031"}]
[{"$f":"'K. Business Resiliency'!A115","v":4081},{"$f":"'K. Business Resiliency'!J115","v":2},{"$f":"'K. Business Resiliency'!K115","v":0},{"$f":"'K. Business Resiliency'!Y115","v":0},{"$f":"'K. Business Resiliency'!B115","v":"K.9.7"},{"$f":"'K. Business Resiliency'!C115","v":"Do planned exercises strive to increase the effectiveness of exercise scenarios over time?"},{"$f":"'K. Business Resiliency'!D115","v":0},{"$f":"'K. Business Resiliency'!E115","v":0},{"$f":"'K. Business Resiliency'!F115","v":0},{"$f":"'K. Business Resiliency'!G115","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H115","v":"N/A"},{"$f":"'K. Business Resiliency'!I115","v":0},"Strategic Considerations - Testing with TSPs line 286"]
[{"$f":"'K. Business Resiliency'!A116","v":4082},{"$f":"'K. Business Resiliency'!J116","v":2},{"$f":"'K. Business Resiliency'!K116","v":0},{"$f":"'K. Business Resiliency'!Y116","v":0},{"$f":"'K. Business Resiliency'!B116","v":"K.9.8"},{"$f":"'K. Business Resiliency'!C116","v":"Are the results of exercises conducted internally shared with customers?"},{"$f":"'K. Business Resiliency'!D116","v":0},{"$f":"'K. Business Resiliency'!E116","v":0},{"$f":"'K. Business Resiliency'!F116","v":0},{"$f":"'K. Business Resiliency'!G116","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H116","v":"N/A"},{"$f":"'K. Business Resiliency'!I116","v":0},"Testing with Third Party TSPs lines 234-235\nStrategic Considerations - Testing with TSPs lines 319-320"]
[{"$f":"'K. Business Resiliency'!A117","v":4083},{"$f":"'K. Business Resiliency'!J117","v":2},{"$f":"'K. Business Resiliency'!K117","v":0},{"$f":"'K. Business Resiliency'!Y117","v":0},{"$f":"'K. Business Resiliency'!B117","v":"K.9.9"},{"$f":"'K. Business Resiliency'!C117","v":"Are joint exercises conducted with customers?"},{"$f":"'K. Business Resiliency'!D117","v":0},{"$f":"'K. Business Resiliency'!E117","v":0},{"$f":"'K. Business Resiliency'!F117","v":0},{"$f":"'K. Business Resiliency'!G117","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H117","v":"N/A"},{"$f":"'K. Business Resiliency'!I117","v":0},"Testing with Third Party TSPs lines 217-219\nStrategic Considerations - Testing with TSPs lines 322-323"]
[{"$f":"'K. Business Resiliency'!A118","v":4084},{"$f":"'K. Business Resiliency'!J118","v":2},{"$f":"'K. Business Resiliency'!K118","v":0},{"$f":"'K. Business Resiliency'!Y118","v":0},{"$f":"'K. Business Resiliency'!B118","v":"K.9.10"},{"$f":"'K. Business Resiliency'!C118","v":"Is there an established exercise scenario addressing cyber resilience? If yes, does it include:"},{"$f":"'K. Business Resiliency'!D118","v":0},{"$f":"'K. Business Resiliency'!E118","v":0},{"$f":"'K. Business Resiliency'!F118","v":0},{"$f":"'K. Business Resiliency'!G118","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H118","v":"N/A"},{"$f":"'K. Business Resiliency'!I118","v":0},"Cyber Resilience lines 332-333"]
[{"$f":"'K. Business Resiliency'!A119","v":4085},{"$f":"'K. Business Resiliency'!J119","v":3},{"$f":"'K. Business Resiliency'!K119","v":0},{"$f":"'K. Business Resiliency'!Y119","v":0},{"$f":"'K. Business Resiliency'!B119","v":"K.9.10.1"},{"$f":"'K. Business Resiliency'!C119","v":"Malware?"},{"$f":"'K. Business Resiliency'!D119","v":0},{"$f":"'K. Business Resiliency'!E119","v":0},{"$f":"'K. Business Resiliency'!F119","v":0},{"$f":"'K. Business Resiliency'!G119","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H119","v":"N/A"},{"$f":"'K. Business Resiliency'!I119","v":0},"Cyber Resilience line 336"]
[{"$f":"'K. Business Resiliency'!A120","v":4086},{"$f":"'K. Business Resiliency'!J120","v":3},{"$f":"'K. Business Resiliency'!K120","v":0},{"$f":"'K. Business Resiliency'!Y120","v":0},{"$f":"'K. Business Resiliency'!B120","v":"K.9.10.2"},{"$f":"'K. Business Resiliency'!C120","v":"Insider Threats?"},{"$f":"'K. Business Resiliency'!D120","v":0},{"$f":"'K. Business Resiliency'!E120","v":0},{"$f":"'K. Business Resiliency'!F120","v":0},{"$f":"'K. Business Resiliency'!G120","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H120","v":"N/A"},{"$f":"'K. Business Resiliency'!I120","v":0},"Cyber Resilience line 348"]
[{"$f":"'K. Business Resiliency'!A121","v":4087},{"$f":"'K. Business Resiliency'!J121","v":3},{"$f":"'K. Business Resiliency'!K121","v":0},{"$f":"'K. Business Resiliency'!Y121","v":0},{"$f":"'K. Business Resiliency'!B121","v":"K.9.10.3"},{"$f":"'K. Business Resiliency'!C121","v":"Data or Systems Destruction and Corruption?"},{"$f":"'K. Business Resiliency'!D121","v":0},{"$f":"'K. Business Resiliency'!E121","v":0},{"$f":"'K. Business Resiliency'!F121","v":0},{"$f":"'K. Business Resiliency'!G121","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H121","v":"N/A"},{"$f":"'K. Business Resiliency'!I121","v":0},"Cyber Resilience line 355"]
[{"$f":"'K. Business Resiliency'!A122","v":4088},{"$f":"'K. Business Resiliency'!J122","v":3},{"$f":"'K. Business Resiliency'!K122","v":0},{"$f":"'K. Business Resiliency'!Y122","v":0},{"$f":"'K. Business Resiliency'!B122","v":"K.9.10.4"},{"$f":"'K. Business Resiliency'!C122","v":"Communications Infrastructure Disruption?"},{"$f":"'K. Business Resiliency'!D122","v":0},{"$f":"'K. Business Resiliency'!E122","v":0},{"$f":"'K. Business Resiliency'!F122","v":0},{"$f":"'K. Business Resiliency'!G122","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H122","v":"N/A"},{"$f":"'K. Business Resiliency'!I122","v":0},"Cyber Resilience line 398"]
[{"$f":"'K. Business Resiliency'!A123","v":4089},{"$f":"'K. Business Resiliency'!J123","v":3},{"$f":"'K. Business Resiliency'!K123","v":0},{"$f":"'K. Business Resiliency'!Y123","v":0},{"$f":"'K. Business Resiliency'!B123","v":"K.9.10.5"},{"$f":"'K. Business Resiliency'!C123","v":"Simultaneous Attack?"},{"$f":"'K. Business Resiliency'!D123","v":0},{"$f":"'K. Business Resiliency'!E123","v":0},{"$f":"'K. Business Resiliency'!F123","v":0},{"$f":"'K. Business Resiliency'!G123","v":"K.7 Exercising"},{"$f":"'K. Business Resiliency'!H123","v":"N/A"},{"$f":"'K. Business Resiliency'!I123","v":0},"Cyber Resilience line 412"]
[{"$f":"'K. Business Resiliency'!A124","v":2305},{"$f":"'K. Business Resiliency'!J124","v":1},{"$f":"'K. Business Resiliency'!K124","v":0},{"$f":"'K. Business Resiliency'!Y124","v":1},{"$f":"'K. Business Resiliency'!B124","v":"K.10"},{"$f":"'K. Business Resiliency'!C124","v":"Is there an Influenza Pandemic / Infectious Disease Outbreak Plan? If yes, does it include:"},{"$f":"'K. Business Resiliency'!D124","v":0},{"$f":"'K. Business Resiliency'!E124","v":0},{"$f":"'K. Business Resiliency'!F124","v":0},{"$f":"'K. Business Resiliency'!G124","v":"K.8 Infectious Disease Planning"},{"$f":"'K. Business Resiliency'!H124","v":"N/A"},{"$f":"'K. Business Resiliency'!I124","v":0}]
[{"$f":"'K. Business Resiliency'!A125","v":2751},{"$f":"'K. Business Resiliency'!J125","v":2},{"$f":"'K. Business Resiliency'!K125","v":0},{"$f":"'K. Business Resiliency'!Y125","v":0},{"$f":"'K. Business Resiliency'!B125","v":"K.10.1"},{"$f":"'K. Business Resiliency'!C125","v":"Trigger points for activating proactive and reactive elements of the plan?"},{"$f":"'K. Business Resiliency'!D125","v":0},{"$f":"'K. Business Resiliency'!E125","v":0},{"$f":"'K. Business Resiliency'!F125","v":0},{"$f":"'K. Business Resiliency'!G125","v":"K.8 Infectious Disease Planning"},{"$f":"'K. Business Resiliency'!H125","v":"N/A"},{"$f":"'K. Business Resiliency'!I125","v":0}]
[{"$f":"'K. Business Resiliency'!A126","v":2747},{"$f":"'K. Business Resiliency'!J126","v":2},{"$f":"'K. Business Resiliency'!K126","v":0},{"$f":"'K. Business Resiliency'!Y126","v":0},{"$f":"'K. Business Resiliency'!B126","v":"K.10.2"},{"$f":"'K. Business Resiliency'!C126","v":"A defined exercise regime aligned with the response strategies and procedures within the plan?"},{"$f":"'K. Business Resiliency'!D126","v":0},{"$f":"'K. Business Resiliency'!E126","v":0},{"$f":"'K. Business Resiliency'!F126","v":0},{"$f":"'K. Business Resiliency'!G126","v":"K.8 Infectious Disease Planning"},{"$f":"'K. Business Resiliency'!H126","v":"N/A"},{"$f":"'K. Business Resiliency'!I126","v":0}]
[{"$f":"'K. Business Resiliency'!A127","v":2748},{"$f":"'K. Business Resiliency'!J127","v":2},{"$f":"'K. Business Resiliency'!K127","v":0},{"$f":"'K. Business Resiliency'!Y127","v":0},{"$f":"'K. Business Resiliency'!B127","v":"K.10.3"},{"$f":"'K. Business Resiliency'!C127","v":"Verification of critical service provider pandemic / infectious disease procedures?"},{"$f":"'K. Business Resiliency'!D127","v":0},{"$f":"'K. Business Resiliency'!E127","v":0},{"$f":"'K. Business Resiliency'!F127","v":0},{"$f":"'K. Business Resiliency'!G127","v":"K.8 Infectious Disease Planning"},{"$f":"'K. Business Resiliency'!H127","v":"N/A"},{"$f":"'K. Business Resiliency'!I127","v":0}]
[{"$f":"'K. Business Resiliency'!A128","v":2749},{"$f":"'K. Business Resiliency'!J128","v":2},{"$f":"'K. Business Resiliency'!K128","v":0},{"$f":"'K. Business Resiliency'!Y128","v":0},{"$f":"'K. Business Resiliency'!B128","v":"K.10.4"},{"$f":"'K. Business Resiliency'!C128","v":"Have the business impacts resulting from a pandemic event been identified in the Business Impact Analysis or any threat or risk related assessments?"},{"$f":"'K. Business Resiliency'!D128","v":0},{"$f":"'K. Business Resiliency'!E128","v":0},{"$f":"'K. Business Resiliency'!F128","v":0},{"$f":"'K. Business Resiliency'!G128","v":"K.8 Infectious Disease Planning"},{"$f":"'K. Business Resiliency'!H128","v":"N/A"},{"$f":"'K. Business Resiliency'!I128","v":0}]
[{"$f":"'K. Business Resiliency'!A129","v":2752},{"$f":"'K. Business Resiliency'!J129","v":2},{"$f":"'K. Business Resiliency'!K129","v":0},{"$f":"'K. Business Resiliency'!Y129","v":0},{"$f":"'K. Business Resiliency'!B129","v":"K.10.5"},{"$f":"'K. Business Resiliency'!C129","v":"Travel and visitor restrictions?"},{"$f":"'K. Business Resiliency'!D129","v":0},{"$f":"'K. Business Resiliency'!E129","v":0},{"$f":"'K. Business Resiliency'!F129","v":0},{"$f":"'K. Business Resiliency'!G129","v":"K.8 Infectious Disease Planning"},{"$f":"'K. Business Resiliency'!H129","v":"N/A"},{"$f":"'K. Business Resiliency'!I129","v":0}]
[{"$f":"'K. Business Resiliency'!A130","v":2753},{"$f":"'K. Business Resiliency'!J130","v":2},{"$f":"'K. Business Resiliency'!K130","v":0},{"$f":"'K. Business Resiliency'!Y130","v":0},{"$f":"'K. Business Resiliency'!B130","v":"K.10.6"},{"$f":"'K. Business Resiliency'!C130","v":"Cleaning and disinfecting protocols?"},{"$f":"'K. Business Resiliency'!D130","v":0},{"$f":"'K. Business Resiliency'!E130","v":0},{"$f":"'K. Business Resiliency'!F130","v":0},{"$f":"'K. Business Resiliency'!G130","v":"K.8 Infectious Disease Planning"},{"$f":"'K. Business Resiliency'!H130","v":"N/A"},{"$f":"'K. Business Resiliency'!I130","v":0}]
[{"$f":"'K. Business Resiliency'!A131","v":2754},{"$f":"'K. Business Resiliency'!J131","v":2},{"$f":"'K. Business Resiliency'!K131","v":0},{"$f":"'K. Business Resiliency'!Y131","v":0},{"$f":"'K. Business Resiliency'!B131","v":"K.10.7"},{"$f":"'K. Business Resiliency'!C131","v":"Situation-specific HR policies and procedures?"},{"$f":"'K. Business Resiliency'!D131","v":0},{"$f":"'K. Business Resiliency'!E131","v":0},{"$f":"'K. Business Resiliency'!F131","v":0},{"$f":"'K. Business Resiliency'!G131","v":"K.8 Infectious Disease Planning"},{"$f":"'K. Business Resiliency'!H131","v":"N/A"},{"$f":"'K. Business Resiliency'!I131","v":0}]
[{"$f":"'K. Business Resiliency'!A132","v":2755},{"$f":"'K. Business Resiliency'!J132","v":2},{"$f":"'K. Business Resiliency'!K132","v":0},{"$f":"'K. Business Resiliency'!Y132","v":0},{"$f":"'K. Business Resiliency'!B132","v":"K.10.8"},{"$f":"'K. Business Resiliency'!C132","v":"Social Distancing criteria / techniques (e.g. work from home, reduction of on-site work force)?"},{"$f":"'K. Business Resiliency'!D132","v":0},{"$f":"'K. Business Resiliency'!E132","v":0},{"$f":"'K. Business Resiliency'!F132","v":0},{"$f":"'K. Business Resiliency'!G132","v":"K.8 Infectious Disease Planning"},{"$f":"'K. Business Resiliency'!H132","v":"N/A"},{"$f":"'K. Business Resiliency'!I132","v":0}]
[{"$f":"'K. Business Resiliency'!A133","v":2756},{"$f":"'K. Business Resiliency'!J133","v":2},{"$f":"'K. Business Resiliency'!K133","v":0},{"$f":"'K. Business Resiliency'!Y133","v":0},{"$f":"'K. Business Resiliency'!B133","v":"K.10.9"},{"$f":"'K. Business Resiliency'!C133","v":"Personal protective equipment for personnel (e.g. face masks)?"},{"$f":"'K. Business Resiliency'!D133","v":0},{"$f":"'K. Business Resiliency'!E133","v":0},{"$f":"'K. Business Resiliency'!F133","v":0},{"$f":"'K. Business Resiliency'!G133","v":"K.8 Infectious Disease Planning"},{"$f":"'K. Business Resiliency'!H133","v":"N/A"},{"$f":"'K. Business Resiliency'!I133","v":0}]
[{"$f":"'K. Business Resiliency'!A134","v":2757},{"$f":"'K. Business Resiliency'!J134","v":2},{"$f":"'K. Business Resiliency'!K134","v":0},{"$f":"'K. Business Resiliency'!Y134","v":0},{"$f":"'K. Business Resiliency'!B134","v":"K.10.10"},{"$f":"'K. Business Resiliency'!C134","v":"Special food handling in cafeterias?"},{"$f":"'K. Business Resiliency'!D134","v":0},{"$f":"'K. Business Resiliency'!E134","v":0},{"$f":"'K. Business Resiliency'!F134","v":0},{"$f":"'K. Business Resiliency'!G134","v":"K.8 Infectious Disease Planning"},{"$f":"'K. Business Resiliency'!H134","v":"N/A"},{"$f":"'K. Business Resiliency'!I134","v":0}]
[{"$f":"'K. Business Resiliency'!A135","v":2743},{"$f":"'K. Business Resiliency'!J135","v":2},{"$f":"'K. Business Resiliency'!K135","v":0},{"$f":"'K. Business Resiliency'!Y135","v":0},{"$f":"'K. Business Resiliency'!B135","v":"K.10.11"},{"$f":"'K. Business Resiliency'!C135","v":"Annual review and update?"},{"$f":"'K. Business Resiliency'!D135","v":0},{"$f":"'K. Business Resiliency'!E135","v":0},{"$f":"'K. Business Resiliency'!F135","v":0},{"$f":"'K. Business Resiliency'!G135","v":"K.8 Infectious Disease Planning"},{"$f":"'K. Business Resiliency'!H135","v":"N/A"},{"$f":"'K. Business Resiliency'!I135","v":0}]
[{"$f":"'K. Business Resiliency'!A136","v":2365},{"$f":"'K. Business Resiliency'!J136","v":1},{"$f":"'K. Business Resiliency'!K136","v":0},{"$f":"'K. Business Resiliency'!Y136","v":1},{"$f":"'K. Business Resiliency'!B136","v":"K.11"},{"$f":"'K. Business Resiliency'!C136","v":"Is there insurance coverage for business interruptions or general services interruption? If yes, are there:"},{"$f":"'K. Business Resiliency'!D136","v":0},{"$f":"'K. Business Resiliency'!E136","v":0},{"$f":"'K. Business Resiliency'!F136","v":0},{"$f":"'K. Business Resiliency'!G136","v":"K.9 Business Insurance"},{"$f":"'K. Business Resiliency'!H136","v":"N/A"},{"$f":"'K. Business Resiliency'!I136","v":0}]
[{"$f":"'K. Business Resiliency'!A137","v":2366},{"$f":"'K. Business Resiliency'!J137","v":2},{"$f":"'K. Business Resiliency'!K137","v":0},{"$f":"'K. Business Resiliency'!Y137","v":0},{"$f":"'K. Business Resiliency'!B137","v":"K.11.1"},{"$f":"'K. Business Resiliency'!C137","v":"Limitations based on the cause of the interruption?"},{"$f":"'K. Business Resiliency'!D137","v":0},{"$f":"'K. Business Resiliency'!E137","v":0},{"$f":"'K. Business Resiliency'!F137","v":0},{"$f":"'K. Business Resiliency'!G137","v":"K.9 Business Insurance"},{"$f":"'K. Business Resiliency'!H137","v":"N/A"},{"$f":"'K. Business Resiliency'!I137","v":0}]
[{"$f":"'K. Business Resiliency'!A138","v":2367},{"$f":"'K. Business Resiliency'!J138","v":2},{"$f":"'K. Business Resiliency'!K138","v":0},{"$f":"'K. Business Resiliency'!Y138","v":0},{"$f":"'K. Business Resiliency'!B138","v":"K.11.2"},{"$f":"'K. Business Resiliency'!C138","v":"Insurance coverage for products and services provided to clients?"},{"$f":"'K. Business Resiliency'!D138","v":0},{"$f":"'K. Business Resiliency'!E138","v":0},{"$f":"'K. Business Resiliency'!F138","v":0},{"$f":"'K. Business Resiliency'!G138","v":"K.9 Business Insurance"},{"$f":"'K. Business Resiliency'!H138","v":"N/A"},{"$f":"'K. Business Resiliency'!I138","v":0}]
[{"$f":"'K. Business Resiliency'!A139","v":0},{"$f":"'K. Business Resiliency'!J139","v":0},{"$f":"'K. Business Resiliency'!K139","v":0},{"$f":"'K. Business Resiliency'!Y139","v":0},{"$f":"'K. Business Resiliency'!B139","v":0},{"$f":"'K. Business Resiliency'!C139","v":0},{"$f":"'K. Business Resiliency'!D139","v":0},{"$f":"'K. Business Resiliency'!E139","v":0},{"$f":"'K. Business Resiliency'!F139","v":0},{"$f":"'K. Business Resiliency'!G139","v":0},{"$f":"'K. Business Resiliency'!H139","v":0},{"$f":"'K. Business Resiliency'!I139","v":0}]
[{"$f":"'K. Business Resiliency'!A140","v":0},{"$f":"'K. Business Resiliency'!J140","v":0},{"$f":"'K. Business Resiliency'!K140","v":0},{"$f":"'K. Business Resiliency'!Y140","v":0},{"$f":"'K. Business Resiliency'!B140","v":0},{"$f":"'K. Business Resiliency'!C140","v":0},{"$f":"'K. Business Resiliency'!D140","v":0},{"$f":"'K. Business Resiliency'!E140","v":0},{"$f":"'K. Business Resiliency'!F140","v":0},{"$f":"'K. Business Resiliency'!G140","v":0},{"$f":"'K. Business Resiliency'!H140","v":0},{"$f":"'K. Business Resiliency'!I140","v":0}]
[{"$f":"'L. Compliance'!B1","v":"L. Compliance"},null,null,null,{"$f":"'L. Compliance'!B1","v":"L. Compliance"}]
[{"$f":"'L. Compliance'!A5","v":2826},{"$f":"'L. Compliance'!J5","v":1},{"$f":"'L. Compliance'!K5","v":0},{"$f":"'L. Compliance'!Y5","v":1},{"$f":"'L. Compliance'!B5","v":"L.1"},{"$f":"'L. Compliance'!C5","v":"Is there an internal audit, risk management, or compliance department, or other management oversight unit with responsibility for identifying and tracking resolution of outstanding regulatory issues?"},{"$f":"'L. Compliance'!D5","v":0},{"$f":"'L. Compliance'!E5","v":0},{"$f":"'L. Compliance'!F5","v":0},{"$f":"'L. Compliance'!G5","v":"L.3 Monitoring and Reporting - Compliance Requirement Identification"},{"$f":"'L. Compliance'!H5","v":"18.1.1 "},{"$f":"'L. Compliance'!I5","v":"Identification of applicable legislation and contractual requirements"},null,"PO4.4","Organisational placement of the IT function","N/A","MGMT.1.2.1.15.2 RPS.1.4.3","PO4.4, PO4.5, PO4.6, PO4.8, PO4.10, PO6.5, DS5.1, DS5.2, DS5.3"]
[{"$f":"'L. Compliance'!A6","v":4122},{"$f":"'L. Compliance'!J6","v":2},{"$f":"'L. Compliance'!K6","v":0},{"$f":"'L. Compliance'!Y6","v":0},{"$f":"'L. Compliance'!B6","v":"L.1.1"},{"$f":"'L. Compliance'!C6","v":"Does the audit function have independence from the lines of business?"},{"$f":"'L. Compliance'!D6","v":0},{"$f":"'L. Compliance'!E6","v":0},{"$f":"'L. Compliance'!F6","v":0},{"$f":"'L. Compliance'!G6","v":0},{"$f":"'L. Compliance'!H6","v":"NA"},{"$f":"'L. Compliance'!I6","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A7","v":2376},{"$f":"'L. Compliance'!J7","v":2},{"$f":"'L. Compliance'!K7","v":0},{"$f":"'L. Compliance'!Y7","v":0},{"$f":"'L. Compliance'!B7","v":"L.1.2"},{"$f":"'L. Compliance'!C7","v":"Are audits performed to ensure compliance with any legal, regulatory, or industry requirements?"},{"$f":"'L. Compliance'!D7","v":0},{"$f":"'L. Compliance'!E7","v":0},{"$f":"'L. Compliance'!F7","v":0},{"$f":"'L. Compliance'!G7","v":0},{"$f":"'L. Compliance'!H7","v":"NA"},{"$f":"'L. Compliance'!I7","v":""},null,null,null,"N/A","RPS.1.2.1.4","N/A"]
[{"$f":"'L. Compliance'!A8","v":4123},{"$f":"'L. Compliance'!J8","v":2},{"$f":"'L. Compliance'!K8","v":0},{"$f":"'L. Compliance'!Y8","v":0},{"$f":"'L. Compliance'!B8","v":"L.1.3"},{"$f":"'L. Compliance'!C8","v":"Are there staff dedicated to compliance and risk responsibilities?"},{"$f":"'L. Compliance'!D8","v":0},{"$f":"'L. Compliance'!E8","v":0},{"$f":"'L. Compliance'!F8","v":0},{"$f":"'L. Compliance'!G8","v":0},{"$f":"'L. Compliance'!H8","v":"NA"},{"$f":"'L. Compliance'!I8","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A9","v":4124},{"$f":"'L. Compliance'!J9","v":2},{"$f":"'L. Compliance'!K9","v":0},{"$f":"'L. Compliance'!Y9","v":0},{"$f":"'L. Compliance'!B9","v":"L.1.4"},{"$f":"'L. Compliance'!C9","v":"Is training to employees on legislative and regulatory requirements provided and updated on a regular basis?"},{"$f":"'L. Compliance'!D9","v":0},{"$f":"'L. Compliance'!E9","v":0},{"$f":"'L. Compliance'!F9","v":0},{"$f":"'L. Compliance'!G9","v":0},{"$f":"'L. Compliance'!H9","v":"NA"},{"$f":"'L. Compliance'!I9","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A10","v":4125},{"$f":"'L. Compliance'!J10","v":2},{"$f":"'L. Compliance'!K10","v":0},{"$f":"'L. Compliance'!Y10","v":0},{"$f":"'L. Compliance'!B10","v":"L.1.5"},{"$f":"'L. Compliance'!C10","v":"Are management reporting or reporting to government agencies maintained in accordance with applicable law?"},{"$f":"'L. Compliance'!D10","v":0},{"$f":"'L. Compliance'!E10","v":0},{"$f":"'L. Compliance'!F10","v":0},{"$f":"'L. Compliance'!G10","v":"L.3 Monitoring and Reporting - Compliance Requirement Identification"},{"$f":"'L. Compliance'!H10","v":"NA"},{"$f":"'L. Compliance'!I10","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A11","v":4126},{"$f":"'L. Compliance'!J11","v":1},{"$f":"'L. Compliance'!K11","v":0},{"$f":"'L. Compliance'!Y11","v":1},{"$f":"'L. Compliance'!B11","v":"L.2"},{"$f":"'L. Compliance'!C11","v":"Are there policies and procedures to ensure compliance with applicable legislative, regulatory and contractual requirements to address intellectual property rights on business processes or information technology software products?"},{"$f":"'L. Compliance'!D11","v":0},{"$f":"'L. Compliance'!E11","v":0},{"$f":"'L. Compliance'!F11","v":0},{"$f":"'L. Compliance'!G11","v":"L.4 Monitoring and Reporting - Compliance "},{"$f":"'L. Compliance'!H11","v":"NA"},{"$f":"'L. Compliance'!I11","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A12","v":2837},{"$f":"'L. Compliance'!J12","v":1},{"$f":"'L. Compliance'!K12","v":0},{"$f":"'L. Compliance'!Y12","v":1},{"$f":"'L. Compliance'!B12","v":"L.3"},{"$f":"'L. Compliance'!C12","v":"Is there a records retention policy covering paper & electronic records, including email in support of applicable regulations, standards and contractual requirements?"},{"$f":"'L. Compliance'!D12","v":0},{"$f":"'L. Compliance'!E12","v":0},{"$f":"'L. Compliance'!F12","v":0},{"$f":"'L. Compliance'!G12","v":0},{"$f":"'L. Compliance'!H12","v":"18.1.3 "},{"$f":"'L. Compliance'!I12","v":"Protection of records"},null,"PO4.8","Responsibility for risk, security and compliance","N/A","N/A","PO4.8, DS11.2"]
[{"$f":"'L. Compliance'!A13","v":4127},{"$f":"'L. Compliance'!J13","v":1},{"$f":"'L. Compliance'!K13","v":0},{"$f":"'L. Compliance'!Y13","v":1},{"$f":"'L. Compliance'!B13","v":"L.4"},{"$f":"'L. Compliance'!C13","v":"Is licensing maintained in all jurisdictions where the business is or where licensing is required?"},{"$f":"'L. Compliance'!D13","v":0},{"$f":"'L. Compliance'!E13","v":0},{"$f":"'L. Compliance'!F13","v":0},{"$f":"'L. Compliance'!G13","v":0},{"$f":"'L. Compliance'!H13","v":"NA"},{"$f":"'L. Compliance'!I13","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A14","v":3733},{"$f":"'L. Compliance'!J14","v":1},{"$f":"'L. Compliance'!K14","v":0},{"$f":"'L. Compliance'!Y14","v":1},{"$f":"'L. Compliance'!B14","v":"L.5"},{"$f":"'L. Compliance'!C14","v":"Is there an internal compliance and ethics program to ensure professional ethics and business practices are implemented?"},{"$f":"'L. Compliance'!D14","v":0},{"$f":"'L. Compliance'!E14","v":0},{"$f":"'L. Compliance'!F14","v":0},{"$f":"'L. Compliance'!G14","v":"A.4 Professional Ethics and Business Practices"},{"$f":"'L. Compliance'!H14","v":"NA"},{"$f":"'L. Compliance'!I14","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A15","v":4128},{"$f":"'L. Compliance'!J15","v":2},{"$f":"'L. Compliance'!K15","v":0},{"$f":"'L. Compliance'!Y15","v":0},{"$f":"'L. Compliance'!B15","v":"L.5.1"},{"$f":"'L. Compliance'!C15","v":"Is there an official whistleblowing policy and/or procedure to report compliance issues? "},{"$f":"'L. Compliance'!D15","v":0},{"$f":"'L. Compliance'!E15","v":0},{"$f":"'L. Compliance'!F15","v":0},{"$f":"'L. Compliance'!G15","v":"A.4 Professional Ethics and Business Practices"},{"$f":"'L. Compliance'!H15","v":"NA"},{"$f":"'L. Compliance'!I15","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A16","v":4129},{"$f":"'L. Compliance'!J16","v":2},{"$f":"'L. Compliance'!K16","v":0},{"$f":"'L. Compliance'!Y16","v":0},{"$f":"'L. Compliance'!B16","v":"L.5.2"},{"$f":"'L. Compliance'!C16","v":"Are there policies and procedures to address bribery, corruption or the prohibition of providing monetary offers to government officials, corporate representatives?"},{"$f":"'L. Compliance'!D16","v":0},{"$f":"'L. Compliance'!E16","v":0},{"$f":"'L. Compliance'!F16","v":0},{"$f":"'L. Compliance'!G16","v":"A.4 Professional Ethics and Business Practices"},{"$f":"'L. Compliance'!H16","v":"NA"},{"$f":"'L. Compliance'!I16","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A17","v":4130},{"$f":"'L. Compliance'!J17","v":2},{"$f":"'L. Compliance'!K17","v":0},{"$f":"'L. Compliance'!Y17","v":0},{"$f":"'L. Compliance'!B17","v":"L.5.3"},{"$f":"'L. Compliance'!C17","v":"Are there policies and procedures for corporate governance and public responsibility?"},{"$f":"'L. Compliance'!D17","v":0},{"$f":"'L. Compliance'!E17","v":0},{"$f":"'L. Compliance'!F17","v":0},{"$f":"'L. Compliance'!G17","v":"A.4 Professional Ethics and Business Practices"},{"$f":"'L. Compliance'!H17","v":"NA"},{"$f":"'L. Compliance'!I17","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A18","v":4131},{"$f":"'L. Compliance'!J18","v":2},{"$f":"'L. Compliance'!K18","v":0},{"$f":"'L. Compliance'!Y18","v":0},{"$f":"'L. Compliance'!B18","v":"L.5.4"},{"$f":"'L. Compliance'!C18","v":"Are there policies and procedures to maintain compliance with international requirements for trade and export?"},{"$f":"'L. Compliance'!D18","v":0},{"$f":"'L. Compliance'!E18","v":0},{"$f":"'L. Compliance'!F18","v":0},{"$f":"'L. Compliance'!G18","v":"A.4 Professional Ethics and Business Practices"},{"$f":"'L. Compliance'!H18","v":"NA"},{"$f":"'L. Compliance'!I18","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A19","v":4132},{"$f":"'L. Compliance'!J19","v":2},{"$f":"'L. Compliance'!K19","v":0},{"$f":"'L. Compliance'!Y19","v":0},{"$f":"'L. Compliance'!B19","v":"L.5.5"},{"$f":"'L. Compliance'!C19","v":"Are there policies and procedures to address internal/external due diligence of business partners and business initiatives?"},{"$f":"'L. Compliance'!D19","v":0},{"$f":"'L. Compliance'!E19","v":0},{"$f":"'L. Compliance'!F19","v":0},{"$f":"'L. Compliance'!G19","v":"A.4 Professional Ethics and Business Practices"},{"$f":"'L. Compliance'!H19","v":"NA"},{"$f":"'L. Compliance'!I19","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A20","v":4133},{"$f":"'L. Compliance'!J20","v":2},{"$f":"'L. Compliance'!K20","v":0},{"$f":"'L. Compliance'!Y20","v":0},{"$f":"'L. Compliance'!B20","v":"L.5.6"},{"$f":"'L. Compliance'!C20","v":"Are there defined monitoring and oversight functions for suspected fraud instances or fraud investigation?"},{"$f":"'L. Compliance'!D20","v":0},{"$f":"'L. Compliance'!E20","v":0},{"$f":"'L. Compliance'!F20","v":0},{"$f":"'L. Compliance'!G20","v":"A.4 Professional Ethics and Business Practices"},{"$f":"'L. Compliance'!H20","v":"NA"},{"$f":"'L. Compliance'!I20","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A21","v":4134},{"$f":"'L. Compliance'!J21","v":2},{"$f":"'L. Compliance'!K21","v":0},{"$f":"'L. Compliance'!Y21","v":0},{"$f":"'L. Compliance'!B21","v":"L.5.7"},{"$f":"'L. Compliance'!C21","v":"Are there mechanisms in place to notify client for suspected or actual fraudulent activity?"},{"$f":"'L. Compliance'!D21","v":0},{"$f":"'L. Compliance'!E21","v":0},{"$f":"'L. Compliance'!F21","v":0},{"$f":"'L. Compliance'!G21","v":"A.4 Professional Ethics and Business Practices"},{"$f":"'L. Compliance'!H21","v":"NA"},{"$f":"'L. Compliance'!I21","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A22","v":4135},{"$f":"'L. Compliance'!J22","v":1},{"$f":"'L. Compliance'!K22","v":0},{"$f":"'L. Compliance'!Y22","v":1},{"$f":"'L. Compliance'!B22","v":"L.6"},{"$f":"'L. Compliance'!C22","v":"Are marketing or selling activities conducted directly to Client's customers? If yes is/are there:"},{"$f":"'L. Compliance'!D22","v":0},{"$f":"'L. Compliance'!E22","v":0},{"$f":"'L. Compliance'!F22","v":0},{"$f":"'L. Compliance'!G22","v":0},{"$f":"'L. Compliance'!H22","v":"NA"},{"$f":"'L. Compliance'!I22","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A23","v":4157},{"$f":"'L. Compliance'!J23","v":2},{"$f":"'L. Compliance'!K23","v":0},{"$f":"'L. Compliance'!Y23","v":0},{"$f":"'L. Compliance'!B23","v":"L.6.1"},{"$f":"'L. Compliance'!C23","v":"A formal consumer protection compliance program?"},{"$f":"'L. Compliance'!D23","v":0},{"$f":"'L. Compliance'!E23","v":0},{"$f":"'L. Compliance'!F23","v":0},{"$f":"'L. Compliance'!G23","v":0},{"$f":"'L. Compliance'!H23","v":"NA"},{"$f":"'L. Compliance'!I23","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A24","v":4136},{"$f":"'L. Compliance'!J24","v":2},{"$f":"'L. Compliance'!K24","v":0},{"$f":"'L. Compliance'!Y24","v":0},{"$f":"'L. Compliance'!B24","v":"L.6.2"},{"$f":"'L. Compliance'!C24","v":"Training conducted for employees or agents with customer contact on consumer protection compliance responsibilities?"},{"$f":"'L. Compliance'!D24","v":0},{"$f":"'L. Compliance'!E24","v":0},{"$f":"'L. Compliance'!F24","v":0},{"$f":"'L. Compliance'!G24","v":0},{"$f":"'L. Compliance'!H24","v":"NA"},{"$f":"'L. Compliance'!I24","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A25","v":4137},{"$f":"'L. Compliance'!J25","v":2},{"$f":"'L. Compliance'!K25","v":0},{"$f":"'L. Compliance'!Y25","v":0},{"$f":"'L. Compliance'!B25","v":"L.6.3"},{"$f":"'L. Compliance'!C25","v":"Processes in place to review call center scripts or call monitoring to identify compliance issues?"},{"$f":"'L. Compliance'!D25","v":0},{"$f":"'L. Compliance'!E25","v":0},{"$f":"'L. Compliance'!F25","v":0},{"$f":"'L. Compliance'!G25","v":0},{"$f":"'L. Compliance'!H25","v":"NA"},{"$f":"'L. Compliance'!I25","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A26","v":4138},{"$f":"'L. Compliance'!J26","v":2},{"$f":"'L. Compliance'!K26","v":0},{"$f":"'L. Compliance'!Y26","v":0},{"$f":"'L. Compliance'!B26","v":"L.6.4"},{"$f":"'L. Compliance'!C26","v":"An incentive or compensation program for employees or agents directly related to consumer cross-sell or up-sell? If yes describe"},{"$f":"'L. Compliance'!D26","v":0},{"$f":"'L. Compliance'!E26","v":0},{"$f":"'L. Compliance'!F26","v":0},{"$f":"'L. Compliance'!G26","v":0},{"$f":"'L. Compliance'!H26","v":"NA"},{"$f":"'L. Compliance'!I26","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A27","v":4139},{"$f":"'L. Compliance'!J27","v":2},{"$f":"'L. Compliance'!K27","v":0},{"$f":"'L. Compliance'!Y27","v":0},{"$f":"'L. Compliance'!B27","v":"L.6.5"},{"$f":"'L. Compliance'!C27","v":"Training conducted for employees or agents with customer interaction on compliant marketing practices?"},{"$f":"'L. Compliance'!D27","v":0},{"$f":"'L. Compliance'!E27","v":0},{"$f":"'L. Compliance'!F27","v":0},{"$f":"'L. Compliance'!G27","v":0},{"$f":"'L. Compliance'!H27","v":"NA"},{"$f":"'L. Compliance'!I27","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A28","v":4140},{"$f":"'L. Compliance'!J28","v":2},{"$f":"'L. Compliance'!K28","v":0},{"$f":"'L. Compliance'!Y28","v":0},{"$f":"'L. Compliance'!B28","v":"L.6.6"},{"$f":"'L. Compliance'!C28","v":"Policies and procedures to ensure compliance with applicable laws and regulations including Unfair, Deceptive, or Abusive Acts or Practices? "},{"$f":"'L. Compliance'!D28","v":0},{"$f":"'L. Compliance'!E28","v":0},{"$f":"'L. Compliance'!F28","v":0},{"$f":"'L. Compliance'!G28","v":0},{"$f":"'L. Compliance'!H28","v":"NA"},{"$f":"'L. Compliance'!I28","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A29","v":4141},{"$f":"'L. Compliance'!J29","v":1},{"$f":"'L. Compliance'!K29","v":0},{"$f":"'L. Compliance'!Y29","v":1},{"$f":"'L. Compliance'!B29","v":"L.7"},{"$f":"'L. Compliance'!C29","v":"Are there direct interactions with your client's customers? If yes, is/are there:"},{"$f":"'L. Compliance'!D29","v":0},{"$f":"'L. Compliance'!E29","v":0},{"$f":"'L. Compliance'!F29","v":0},{"$f":"'L. Compliance'!G29","v":0},{"$f":"'L. Compliance'!H29","v":"NA"},{"$f":"'L. Compliance'!I29","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A30","v":4156},{"$f":"'L. Compliance'!J30","v":2},{"$f":"'L. Compliance'!K30","v":0},{"$f":"'L. Compliance'!Y30","v":0},{"$f":"'L. Compliance'!B30","v":"L.7.1"},{"$f":"'L. Compliance'!C30","v":"A formalized complaint management function, including reporting within the organization?"},{"$f":"'L. Compliance'!D30","v":0},{"$f":"'L. Compliance'!E30","v":0},{"$f":"'L. Compliance'!F30","v":0},{"$f":"'L. Compliance'!G30","v":0},{"$f":"'L. Compliance'!H30","v":0},{"$f":"'L. Compliance'!I30","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A31","v":4142},{"$f":"'L. Compliance'!J31","v":2},{"$f":"'L. Compliance'!K31","v":0},{"$f":"'L. Compliance'!Y31","v":0},{"$f":"'L. Compliance'!B31","v":"L.7.2"},{"$f":"'L. Compliance'!C31","v":"A process to provide periodic summary reports regarding types and resolution of complaints?"},{"$f":"'L. Compliance'!D31","v":0},{"$f":"'L. Compliance'!E31","v":0},{"$f":"'L. Compliance'!F31","v":0},{"$f":"'L. Compliance'!G31","v":0},{"$f":"'L. Compliance'!H31","v":"NA"},{"$f":"'L. Compliance'!I31","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A32","v":4143},{"$f":"'L. Compliance'!J32","v":2},{"$f":"'L. Compliance'!K32","v":0},{"$f":"'L. Compliance'!Y32","v":0},{"$f":"'L. Compliance'!B32","v":"L.7.3"},{"$f":"'L. Compliance'!C32","v":"A process to receive and respond to complaints or request from government agencies, including states attorney generals?"},{"$f":"'L. Compliance'!D32","v":0},{"$f":"'L. Compliance'!E32","v":0},{"$f":"'L. Compliance'!F32","v":0},{"$f":"'L. Compliance'!G32","v":0},{"$f":"'L. Compliance'!H32","v":"NA"},{"$f":"'L. Compliance'!I32","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A33","v":4144},{"$f":"'L. Compliance'!J33","v":2},{"$f":"'L. Compliance'!K33","v":0},{"$f":"'L. Compliance'!Y33","v":0},{"$f":"'L. Compliance'!B33","v":"L.7.4"},{"$f":"'L. Compliance'!C33","v":"Calls recorded for telemarketing purposes or collections purposes?"},{"$f":"'L. Compliance'!D33","v":0},{"$f":"'L. Compliance'!E33","v":0},{"$f":"'L. Compliance'!F33","v":0},{"$f":"'L. Compliance'!G33","v":0},{"$f":"'L. Compliance'!H33","v":"NA"},{"$f":"'L. Compliance'!I33","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A34","v":4145},{"$f":"'L. Compliance'!J34","v":2},{"$f":"'L. Compliance'!K34","v":0},{"$f":"'L. Compliance'!Y34","v":0},{"$f":"'L. Compliance'!B34","v":"L.7.5"},{"$f":"'L. Compliance'!C34","v":"Records retained for consumer complaints?"},{"$f":"'L. Compliance'!D34","v":0},{"$f":"'L. Compliance'!E34","v":0},{"$f":"'L. Compliance'!F34","v":0},{"$f":"'L. Compliance'!G34","v":0},{"$f":"'L. Compliance'!H34","v":"NA"},{"$f":"'L. Compliance'!I34","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A35","v":4146},{"$f":"'L. Compliance'!J35","v":2},{"$f":"'L. Compliance'!K35","v":0},{"$f":"'L. Compliance'!Y35","v":0},{"$f":"'L. Compliance'!B35","v":"L.7.6"},{"$f":"'L. Compliance'!C35","v":"An escalation process to address complaints to management and the client? "},{"$f":"'L. Compliance'!D35","v":0},{"$f":"'L. Compliance'!E35","v":0},{"$f":"'L. Compliance'!F35","v":0},{"$f":"'L. Compliance'!G35","v":0},{"$f":"'L. Compliance'!H35","v":"NA"},{"$f":"'L. Compliance'!I35","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A36","v":4147},{"$f":"'L. Compliance'!J36","v":1},{"$f":"'L. Compliance'!K36","v":0},{"$f":"'L. Compliance'!Y36","v":1},{"$f":"'L. Compliance'!B36","v":"L.8"},{"$f":"'L. Compliance'!C36","v":"Are policies and procedures maintained for enabling compliance with applicable legal, regulatory, statutory, or contractual obligations related to any information security requirements? "},{"$f":"'L. Compliance'!D36","v":0},{"$f":"'L. Compliance'!E36","v":0},{"$f":"'L. Compliance'!F36","v":0},{"$f":"'L. Compliance'!G36","v":0},{"$f":"'L. Compliance'!H36","v":"NA"},{"$f":"'L. Compliance'!I36","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A37","v":4148},{"$f":"'L. Compliance'!J37","v":2},{"$f":"'L. Compliance'!K37","v":0},{"$f":"'L. Compliance'!Y37","v":0},{"$f":"'L. Compliance'!B37","v":"L.8.1"},{"$f":"'L. Compliance'!C37","v":"Are procedures maintained for compliance with log-on banners to inform users of restrictions to access of data?"},{"$f":"'L. Compliance'!D37","v":0},{"$f":"'L. Compliance'!E37","v":0},{"$f":"'L. Compliance'!F37","v":0},{"$f":"'L. Compliance'!G37","v":"L.1 Presence of Log-on Banners"},{"$f":"'L. Compliance'!H37","v":"NA"},{"$f":"'L. Compliance'!I37","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A38","v":4149},{"$f":"'L. Compliance'!J38","v":2},{"$f":"'L. Compliance'!K38","v":0},{"$f":"'L. Compliance'!Y38","v":0},{"$f":"'L. Compliance'!B38","v":"L.8.2"},{"$f":"'L. Compliance'!C38","v":"Are vulnerability testing and remediation processes maintained to meet information security requirements in accordance with applicable law or industry standards?"},{"$f":"'L. Compliance'!D38","v":0},{"$f":"'L. Compliance'!E38","v":0},{"$f":"'L. Compliance'!F38","v":0},{"$f":"'L. Compliance'!G38","v":"L.2 Technical Compliance Checking - Vulnerability Testing and Remediation"},{"$f":"'L. Compliance'!H38","v":"NA"},{"$f":"'L. Compliance'!I38","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A39","v":4150},{"$f":"'L. Compliance'!J39","v":2},{"$f":"'L. Compliance'!K39","v":0},{"$f":"'L. Compliance'!Y39","v":0},{"$f":"'L. Compliance'!B39","v":"L.8.3"},{"$f":"'L. Compliance'!C39","v":"Are web site(s) maintained or hosted for the purpose of advertising, offering or managing or servicing accounts, products or services to client?"},{"$f":"'L. Compliance'!D39","v":0},{"$f":"'L. Compliance'!E39","v":0},{"$f":"'L. Compliance'!F39","v":0},{"$f":"'L. Compliance'!G39","v":0},{"$f":"'L. Compliance'!H39","v":"NA"},{"$f":"'L. Compliance'!I39","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A40","v":4151},{"$f":"'L. Compliance'!J40","v":1},{"$f":"'L. Compliance'!K40","v":0},{"$f":"'L. Compliance'!Y40","v":1},{"$f":"'L. Compliance'!B40","v":"L.9"},{"$f":"'L. Compliance'!C40","v":"Is there a formalized governance process to identify and assess changes that could significantly affect the system of internal controls for security, confidentiality and availability?"},{"$f":"'L. Compliance'!D40","v":0},{"$f":"'L. Compliance'!E40","v":0},{"$f":"'L. Compliance'!F40","v":0},{"$f":"'L. Compliance'!G40","v":"L.3 Monitoring and Reporting - Compliance Requirement Identification"},{"$f":"'L. Compliance'!H40","v":"NA"},{"$f":"'L. Compliance'!I40","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A41","v":4152},{"$f":"'L. Compliance'!J41","v":2},{"$f":"'L. Compliance'!K41","v":0},{"$f":"'L. Compliance'!Y41","v":0},{"$f":"'L. Compliance'!B41","v":"L.9.1"},{"$f":"'L. Compliance'!C41","v":"Is there a formalized process for receiving, monitoring and where necessary implementing regulatory alerts?"},{"$f":"'L. Compliance'!D41","v":0},{"$f":"'L. Compliance'!E41","v":0},{"$f":"'L. Compliance'!F41","v":0},{"$f":"'L. Compliance'!G41","v":"L.3 Monitoring and Reporting - Compliance Requirement Identification"},{"$f":"'L. Compliance'!H41","v":"NA"},{"$f":"'L. Compliance'!I41","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A42","v":4153},{"$f":"'L. Compliance'!J42","v":2},{"$f":"'L. Compliance'!K42","v":0},{"$f":"'L. Compliance'!Y42","v":0},{"$f":"'L. Compliance'!B42","v":"L.9.2"},{"$f":"'L. Compliance'!C42","v":"Are regulatory tracking reports maintained?"},{"$f":"'L. Compliance'!D42","v":0},{"$f":"'L. Compliance'!E42","v":0},{"$f":"'L. Compliance'!F42","v":0},{"$f":"'L. Compliance'!G42","v":"L.3 Monitoring and Reporting - Compliance Requirement Identification"},{"$f":"'L. Compliance'!H42","v":"NA"},{"$f":"'L. Compliance'!I42","v":0},null,null,null,"N/A","N/A","N/A"]
[{"$f":"'L. Compliance'!A43","v":4154},{"$f":"'L. Compliance'!J43","v":1},{"$f":"'L. Compliance'!K43","v":0},{"$f":"'L. Compliance'!Y43","v":1},{"$f":"'L. Compliance'!B43","v":"L.10"},{"$f":"'L. Compliance'!C43","v":"Are accounts opened, transactions initiated or other account initiation activity applying payments, taking payments, transferring funds, etc. through either electronic, telephonic, written or in-person requests made on behalf of your client's?"},{"$f":"'L. Compliance'!D43","v":0},{"$f":"'L. Compliance'!E43","v":0},{"$f":"'L. Compliance'!F43","v":0},{"$f":"'L. Compliance'!G43","v":0},{"$f":"'L. Compliance'!H43","v":"NA"},{"$f":"'L. Compliance'!I43","v":0}]
[{"$f":"'L. Compliance'!A44","v":4155},{"$f":"'L. Compliance'!J44","v":2},{"$f":"'L. Compliance'!K44","v":0},{"$f":"'L. Compliance'!Y44","v":0},{"$f":"'L. Compliance'!B44","v":"L.10.1"},{"$f":"'L. Compliance'!C44","v":"Are customer account activities monitored for unusual or suspicious activity?"},{"$f":"'L. Compliance'!D44","v":0},{"$f":"'L. Compliance'!E44","v":0},{"$f":"'L. Compliance'!F44","v":0},{"$f":"'L. Compliance'!G44","v":0},{"$f":"'L. Compliance'!H44","v":"NA"},{"$f":"'L. Compliance'!I44","v":0}]
[{"$f":"'M. Mobile'!B1","v":"M. Mobile"},null,null,null,{"$f":"'M. Mobile'!B1","v":"M. Mobile"}]
[{"$f":"'M. Mobile'!A5","v":4090},{"$f":"'M. Mobile'!J5","v":1},{"$f":"'M. Mobile'!K5","v":0},{"$f":"'M. Mobile'!L5","v":1},{"$f":"'M. Mobile'!B5","v":"M.1"},{"$f":"'M. Mobile'!C5","v":"Are constituents allowed to utilize mobile devices within your environment? If yes, which of the following functions are allowed:"},{"$f":"'M. Mobile'!D5","v":0},{"$f":"'M. Mobile'!E5","v":0},{"$f":"'M. Mobile'!F5","v":0},{"$f":"'M. Mobile'!G5","v":0},{"$f":"'M. Mobile'!H5","v":0},{"$f":"'M. Mobile'!I5","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A6","v":4091},{"$f":"'M. Mobile'!J6","v":2},{"$f":"'M. Mobile'!K6","v":0},{"$f":"'M. Mobile'!L6","v":1},{"$f":"'M. Mobile'!B6","v":"M.1.1"},{"$f":"'M. Mobile'!C6","v":"View Scoped Data?"},{"$f":"'M. Mobile'!D6","v":0},{"$f":"'M. Mobile'!E6","v":0},{"$f":"'M. Mobile'!F6","v":0},{"$f":"'M. Mobile'!G6","v":0},{"$f":"'M. Mobile'!H6","v":0},{"$f":"'M. Mobile'!I6","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A7","v":4092},{"$f":"'M. Mobile'!J7","v":2},{"$f":"'M. Mobile'!K7","v":0},{"$f":"'M. Mobile'!L7","v":1},{"$f":"'M. Mobile'!B7","v":"M.1.2"},{"$f":"'M. Mobile'!C7","v":"Process Scoped Data?"},{"$f":"'M. Mobile'!D7","v":0},{"$f":"'M. Mobile'!E7","v":0},{"$f":"'M. Mobile'!F7","v":0},{"$f":"'M. Mobile'!G7","v":0},{"$f":"'M. Mobile'!H7","v":0},{"$f":"'M. Mobile'!I7","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A8","v":4093},{"$f":"'M. Mobile'!J8","v":2},{"$f":"'M. Mobile'!K8","v":0},{"$f":"'M. Mobile'!L8","v":1},{"$f":"'M. Mobile'!B8","v":"M.1.3"},{"$f":"'M. Mobile'!C8","v":"Delete Scoped Data?"},{"$f":"'M. Mobile'!D8","v":0},{"$f":"'M. Mobile'!E8","v":0},{"$f":"'M. Mobile'!F8","v":0},{"$f":"'M. Mobile'!G8","v":0},{"$f":"'M. Mobile'!H8","v":0},{"$f":"'M. Mobile'!I8","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A9","v":4094},{"$f":"'M. Mobile'!J9","v":2},{"$f":"'M. Mobile'!K9","v":0},{"$f":"'M. Mobile'!L9","v":1},{"$f":"'M. Mobile'!B9","v":"M.1.4"},{"$f":"'M. Mobile'!C9","v":"Store Scoped Data?"},{"$f":"'M. Mobile'!D9","v":0},{"$f":"'M. Mobile'!E9","v":0},{"$f":"'M. Mobile'!F9","v":0},{"$f":"'M. Mobile'!G9","v":0},{"$f":"'M. Mobile'!H9","v":0},{"$f":"'M. Mobile'!I9","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A10","v":3759},{"$f":"'M. Mobile'!J10","v":1},{"$f":"'M. Mobile'!K10","v":1},{"$f":"'M. Mobile'!L10","v":2},{"$f":"'M. Mobile'!B10","v":"M.2"},{"$f":"'M. Mobile'!C10","v":"Are mobile devices allowed to connect to the following:"},{"$f":"'M. Mobile'!D10","v":0},{"$f":"'M. Mobile'!E10","v":0},{"$f":"'M. Mobile'!F10","v":0},{"$f":"'M. Mobile'!G10","v":0},{"$f":"'M. Mobile'!H10","v":"6.2.1"},{"$f":"'M. Mobile'!I10","v":"Mobile device policy"},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A11","v":4095},{"$f":"'M. Mobile'!J11","v":2},{"$f":"'M. Mobile'!K11","v":0},{"$f":"'M. Mobile'!L11","v":2},{"$f":"'M. Mobile'!B11","v":"M.2.1"},{"$f":"'M. Mobile'!C11","v":"Email?"},{"$f":"'M. Mobile'!D11","v":0},{"$f":"'M. Mobile'!E11","v":0},{"$f":"'M. Mobile'!F11","v":0},{"$f":"'M. Mobile'!G11","v":0},{"$f":"'M. Mobile'!H11","v":0},{"$f":"'M. Mobile'!I11","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A12","v":4096},{"$f":"'M. Mobile'!J12","v":2},{"$f":"'M. Mobile'!K12","v":0},{"$f":"'M. Mobile'!L12","v":2},{"$f":"'M. Mobile'!B12","v":"M.2.2"},{"$f":"'M. Mobile'!C12","v":"Scoped Systems and Data?"},{"$f":"'M. Mobile'!D12","v":0},{"$f":"'M. Mobile'!E12","v":0},{"$f":"'M. Mobile'!F12","v":0},{"$f":"'M. Mobile'!G12","v":0},{"$f":"'M. Mobile'!H12","v":0},{"$f":"'M. Mobile'!I12","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A13","v":4097},{"$f":"'M. Mobile'!J13","v":1},{"$f":"'M. Mobile'!K13","v":0},{"$f":"'M. Mobile'!L13","v":3},{"$f":"'M. Mobile'!B13","v":"M.3"},{"$f":"'M. Mobile'!C13","v":"Is there a mobile device management program in place that has been approved by management and communicated to appropriate constituents?"},{"$f":"'M. Mobile'!D13","v":0},{"$f":"'M. Mobile'!E13","v":0},{"$f":"'M. Mobile'!F13","v":0},{"$f":"'M. Mobile'!G13","v":0},{"$f":"'M. Mobile'!H13","v":0},{"$f":"'M. Mobile'!I13","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A14","v":3762},{"$f":"'M. Mobile'!J14","v":2},{"$f":"'M. Mobile'!K14","v":0},{"$f":"'M. Mobile'!L14","v":3},{"$f":"'M. Mobile'!B14","v":"M.3.1"},{"$f":"'M. Mobile'!C14","v":"Are all mobile devices evaluated as part of the IT Risk Management program?"},{"$f":"'M. Mobile'!D14","v":0},{"$f":"'M. Mobile'!E14","v":0},{"$f":"'M. Mobile'!F14","v":0},{"$f":"'M. Mobile'!G14","v":0},{"$f":"'M. Mobile'!H14","v":"NA"},{"$f":"'M. Mobile'!I14","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A15","v":3763},{"$f":"'M. Mobile'!J15","v":2},{"$f":"'M. Mobile'!K15","v":1},{"$f":"'M. Mobile'!L15","v":3},{"$f":"'M. Mobile'!B15","v":"M.3.2"},{"$f":"'M. Mobile'!C15","v":"Are any of the following mobile device ownership models supported:"},{"$f":"'M. Mobile'!D15","v":0},{"$f":"'M. Mobile'!E15","v":0},{"$f":"'M. Mobile'!F15","v":0},{"$f":"'M. Mobile'!G15","v":0},{"$f":"'M. Mobile'!H15","v":"6.2.1"},{"$f":"'M. Mobile'!I15","v":"Mobile device policy"},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A16","v":3764},{"$f":"'M. Mobile'!J16","v":3},{"$f":"'M. Mobile'!K16","v":0},{"$f":"'M. Mobile'!L16","v":3},{"$f":"'M. Mobile'!B16","v":"M.3.2.1"},{"$f":"'M. Mobile'!C16","v":"Respondent owned and managed mobile devices? (COPE, CL)"},{"$f":"'M. Mobile'!D16","v":0},{"$f":"'M. Mobile'!E16","v":0},{"$f":"'M. Mobile'!F16","v":0},{"$f":"'M. Mobile'!G16","v":0},{"$f":"'M. Mobile'!H16","v":"6.2.1"},{"$f":"'M. Mobile'!I16","v":"Mobile device policy"},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A17","v":3765},{"$f":"'M. Mobile'!J17","v":3},{"$f":"'M. Mobile'!K17","v":0},{"$f":"'M. Mobile'!L17","v":3},{"$f":"'M. Mobile'!B17","v":"M.3.2.2"},{"$f":"'M. Mobile'!C17","v":"Constituent owned (BYOD) and respondent un-managed mobile devices?"},{"$f":"'M. Mobile'!D17","v":0},{"$f":"'M. Mobile'!E17","v":0},{"$f":"'M. Mobile'!F17","v":0},{"$f":"'M. Mobile'!G17","v":0},{"$f":"'M. Mobile'!H17","v":"6.2.1"},{"$f":"'M. Mobile'!I17","v":"Mobile device policy"},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A18","v":3766},{"$f":"'M. Mobile'!J18","v":3},{"$f":"'M. Mobile'!K18","v":0},{"$f":"'M. Mobile'!L18","v":3},{"$f":"'M. Mobile'!B18","v":"M.3.2.3"},{"$f":"'M. Mobile'!C18","v":"Constituent owned (BYOD) and respondent managed mobile devices?"},{"$f":"'M. Mobile'!D18","v":0},{"$f":"'M. Mobile'!E18","v":0},{"$f":"'M. Mobile'!F18","v":0},{"$f":"'M. Mobile'!G18","v":0},{"$f":"'M. Mobile'!H18","v":"6.2.1"},{"$f":"'M. Mobile'!I18","v":"Mobile device policy"},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A19","v":4098},{"$f":"'M. Mobile'!J19","v":2},{"$f":"'M. Mobile'!K19","v":0},{"$f":"'M. Mobile'!L19","v":3},{"$f":"'M. Mobile'!B19","v":"M.3.3"},{"$f":"'M. Mobile'!C19","v":"Is there a Mobile Device Management solution in place?"},{"$f":"'M. Mobile'!D19","v":0},{"$f":"'M. Mobile'!E19","v":0},{"$f":"'M. Mobile'!F19","v":0},{"$f":"'M. Mobile'!G19","v":0},{"$f":"'M. Mobile'!H19","v":0},{"$f":"'M. Mobile'!I19","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A20","v":3773},{"$f":"'M. Mobile'!J20","v":2},{"$f":"'M. Mobile'!K20","v":0},{"$f":"'M. Mobile'!L20","v":3},{"$f":"'M. Mobile'!B20","v":"M.3.4"},{"$f":"'M. Mobile'!C20","v":"Prior to device on-boarding are constituents required to sign an legal agreement which details the obligations and rights related to mobile devices? If yes, does it include:"},{"$f":"'M. Mobile'!D20","v":0},{"$f":"'M. Mobile'!E20","v":0},{"$f":"'M. Mobile'!F20","v":0},{"$f":"'M. Mobile'!G20","v":0},{"$f":"'M. Mobile'!H20","v":"6.2.1.Section 2.b"},{"$f":"'M. Mobile'!I20","v":"Mobile device policy"},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A21","v":3774},{"$f":"'M. Mobile'!J21","v":3},{"$f":"'M. Mobile'!K21","v":0},{"$f":"'M. Mobile'!L21","v":3},{"$f":"'M. Mobile'!B21","v":"M.3.4.1"},{"$f":"'M. Mobile'!C21","v":"Owner of data on the mobile device?"},{"$f":"'M. Mobile'!D21","v":0},{"$f":"'M. Mobile'!E21","v":0},{"$f":"'M. Mobile'!F21","v":0},{"$f":"'M. Mobile'!G21","v":0},{"$f":"'M. Mobile'!H21","v":"6.2.1.Section 2.b"},{"$f":"'M. Mobile'!I21","v":"Mobile device policy"},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A22","v":3775},{"$f":"'M. Mobile'!J22","v":3},{"$f":"'M. Mobile'!K22","v":0},{"$f":"'M. Mobile'!L22","v":3},{"$f":"'M. Mobile'!B22","v":"M.3.4.2"},{"$f":"'M. Mobile'!C22","v":"User's responsibility in ensuring the security of the mobile device?"},{"$f":"'M. Mobile'!D22","v":0},{"$f":"'M. Mobile'!E22","v":0},{"$f":"'M. Mobile'!F22","v":0},{"$f":"'M. Mobile'!G22","v":0},{"$f":"'M. Mobile'!H22","v":"6.2.1"},{"$f":"'M. Mobile'!I22","v":"Mobile device policy"},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A23","v":4099},{"$f":"'M. Mobile'!J23","v":3},{"$f":"'M. Mobile'!K23","v":0},{"$f":"'M. Mobile'!L23","v":3},{"$f":"'M. Mobile'!B23","v":"M.3.4.3"},{"$f":"'M. Mobile'!C23","v":"Security requirements for Scoped Systems and Data will override user's personal use?"},{"$f":"'M. Mobile'!D23","v":0},{"$f":"'M. Mobile'!E23","v":0},{"$f":"'M. Mobile'!F23","v":0},{"$f":"'M. Mobile'!G23","v":0},{"$f":"'M. Mobile'!H23","v":0},{"$f":"'M. Mobile'!I23","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A24","v":3782},{"$f":"'M. Mobile'!J24","v":3},{"$f":"'M. Mobile'!K24","v":0},{"$f":"'M. Mobile'!L24","v":3},{"$f":"'M. Mobile'!B24","v":"M.3.4.4"},{"$f":"'M. Mobile'!C24","v":"Support roles and responsibilities"},{"$f":"'M. Mobile'!D24","v":0},{"$f":"'M. Mobile'!E24","v":0},{"$f":"'M. Mobile'!F24","v":0},{"$f":"'M. Mobile'!G24","v":0},{"$f":"'M. Mobile'!H24","v":"NA"},{"$f":"'M. Mobile'!I24","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A25","v":3778},{"$f":"'M. Mobile'!J25","v":2},{"$f":"'M. Mobile'!K25","v":1},{"$f":"'M. Mobile'!L25","v":3},{"$f":"'M. Mobile'!B25","v":"M.3.5"},{"$f":"'M. Mobile'!C25","v":"In the event of a data compromise investigation, have procedures been implemented to do the following:"},{"$f":"'M. Mobile'!D25","v":0},{"$f":"'M. Mobile'!E25","v":0},{"$f":"'M. Mobile'!F25","v":0},{"$f":"'M. Mobile'!G25","v":0},{"$f":"'M. Mobile'!H25","v":"NA"},{"$f":"'M. Mobile'!I25","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A26","v":3779},{"$f":"'M. Mobile'!J26","v":3},{"$f":"'M. Mobile'!K26","v":0},{"$f":"'M. Mobile'!L26","v":3},{"$f":"'M. Mobile'!B26","v":"M.3.5.1"},{"$f":"'M. Mobile'!C26","v":"Remotely wipe the mobile device?"},{"$f":"'M. Mobile'!D26","v":0},{"$f":"'M. Mobile'!E26","v":0},{"$f":"'M. Mobile'!F26","v":0},{"$f":"'M. Mobile'!G26","v":0},{"$f":"'M. Mobile'!H26","v":"NA"},{"$f":"'M. Mobile'!I26","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A27","v":3780},{"$f":"'M. Mobile'!J27","v":3},{"$f":"'M. Mobile'!K27","v":0},{"$f":"'M. Mobile'!L27","v":3},{"$f":"'M. Mobile'!B27","v":"M.3.5.2"},{"$f":"'M. Mobile'!C27","v":"Remotely access Scoped Data on the mobile?"},{"$f":"'M. Mobile'!D27","v":0},{"$f":"'M. Mobile'!E27","v":0},{"$f":"'M. Mobile'!F27","v":0},{"$f":"'M. Mobile'!G27","v":0},{"$f":"'M. Mobile'!H27","v":"NA"},{"$f":"'M. Mobile'!I27","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A28","v":3781},{"$f":"'M. Mobile'!J28","v":3},{"$f":"'M. Mobile'!K28","v":0},{"$f":"'M. Mobile'!L28","v":3},{"$f":"'M. Mobile'!B28","v":"M.3.5.3"},{"$f":"'M. Mobile'!C28","v":"Physically access Scoped Data on the mobile device?"},{"$f":"'M. Mobile'!D28","v":0},{"$f":"'M. Mobile'!E28","v":0},{"$f":"'M. Mobile'!F28","v":0},{"$f":"'M. Mobile'!G28","v":0},{"$f":"'M. Mobile'!H28","v":"NA"},{"$f":"'M. Mobile'!I28","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A29","v":4111},{"$f":"'M. Mobile'!J29","v":3},{"$f":"'M. Mobile'!K29","v":0},{"$f":"'M. Mobile'!L29","v":3},{"$f":"'M. Mobile'!B29","v":"M.3.5.4"},{"$f":"'M. Mobile'!C29","v":"Perform a forensic analysis on the mobile device?"},{"$f":"'M. Mobile'!D29","v":0},{"$f":"'M. Mobile'!E29","v":0},{"$f":"'M. Mobile'!F29","v":0},{"$f":"'M. Mobile'!G29","v":0},{"$f":"'M. Mobile'!H29","v":"NA"},{"$f":"'M. Mobile'!I29","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A30","v":3783},{"$f":"'M. Mobile'!J30","v":2},{"$f":"'M. Mobile'!K30","v":0},{"$f":"'M. Mobile'!L30","v":3},{"$f":"'M. Mobile'!B30","v":"M.3.6"},{"$f":"'M. Mobile'!C30","v":"Is there an approved process to support the mobile device lifecycle? If yes, does it include:"},{"$f":"'M. Mobile'!D30","v":0},{"$f":"'M. Mobile'!E30","v":0},{"$f":"'M. Mobile'!F30","v":0},{"$f":"'M. Mobile'!G30","v":0},{"$f":"'M. Mobile'!H30","v":"6.2.1.a"},{"$f":"'M. Mobile'!I30","v":"Mobile device policy"},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A31","v":3784},{"$f":"'M. Mobile'!J31","v":3},{"$f":"'M. Mobile'!K31","v":0},{"$f":"'M. Mobile'!L31","v":3},{"$f":"'M. Mobile'!B31","v":"M.3.6.1"},{"$f":"'M. Mobile'!C31","v":"On-boarding mobile devices?"},{"$f":"'M. Mobile'!D31","v":0},{"$f":"'M. Mobile'!E31","v":0},{"$f":"'M. Mobile'!F31","v":0},{"$f":"'M. Mobile'!G31","v":0},{"$f":"'M. Mobile'!H31","v":"6.2.1.a"},{"$f":"'M. Mobile'!I31","v":"Mobile device policy"},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A32","v":3785},{"$f":"'M. Mobile'!J32","v":3},{"$f":"'M. Mobile'!K32","v":0},{"$f":"'M. Mobile'!L32","v":3},{"$f":"'M. Mobile'!B32","v":"M.3.6.2"},{"$f":"'M. Mobile'!C32","v":"Off-boarding mobile devices?"},{"$f":"'M. Mobile'!D32","v":0},{"$f":"'M. Mobile'!E32","v":0},{"$f":"'M. Mobile'!F32","v":0},{"$f":"'M. Mobile'!G32","v":0},{"$f":"'M. Mobile'!H32","v":"6.2.1.a"},{"$f":"'M. Mobile'!I32","v":"Mobile device policy"},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A33","v":3786},{"$f":"'M. Mobile'!J33","v":3},{"$f":"'M. Mobile'!K33","v":0},{"$f":"'M. Mobile'!L33","v":3},{"$f":"'M. Mobile'!B33","v":"M.3.6.3"},{"$f":"'M. Mobile'!C33","v":"Asset Tracking against the mobile devices each constituent is permitted to connect with?"},{"$f":"'M. Mobile'!D33","v":0},{"$f":"'M. Mobile'!E33","v":0},{"$f":"'M. Mobile'!F33","v":0},{"$f":"'M. Mobile'!G33","v":0},{"$f":"'M. Mobile'!H33","v":"NA"},{"$f":"'M. Mobile'!I33","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A34","v":3787},{"$f":"'M. Mobile'!J34","v":2},{"$f":"'M. Mobile'!K34","v":0},{"$f":"'M. Mobile'!L34","v":3},{"$f":"'M. Mobile'!B34","v":"M.3.7"},{"$f":"'M. Mobile'!C34","v":"Is there an approved process for IT to off-board mobile devices when a constituent terminates, or requests to on-board a new mobile device? If yes, does it:"},{"$f":"'M. Mobile'!D34","v":0},{"$f":"'M. Mobile'!E34","v":0},{"$f":"'M. Mobile'!F34","v":0},{"$f":"'M. Mobile'!G34","v":0},{"$f":"'M. Mobile'!H34","v":"NA"},{"$f":"'M. Mobile'!I34","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A35","v":3788},{"$f":"'M. Mobile'!J35","v":3},{"$f":"'M. Mobile'!K35","v":0},{"$f":"'M. Mobile'!L35","v":3},{"$f":"'M. Mobile'!B35","v":"M.3.7.1"},{"$f":"'M. Mobile'!C35","v":"Identify if the constituent has any legacy devices accessing Scoped Systems and Data?"},{"$f":"'M. Mobile'!D35","v":0},{"$f":"'M. Mobile'!E35","v":0},{"$f":"'M. Mobile'!F35","v":0},{"$f":"'M. Mobile'!G35","v":0},{"$f":"'M. Mobile'!H35","v":"NA"},{"$f":"'M. Mobile'!I35","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A36","v":3789},{"$f":"'M. Mobile'!J36","v":3},{"$f":"'M. Mobile'!K36","v":0},{"$f":"'M. Mobile'!L36","v":3},{"$f":"'M. Mobile'!B36","v":"M.3.7.2"},{"$f":"'M. Mobile'!C36","v":"Confirm that Scoped Data, respondent settings and accounts have been removed from the legacy mobile device?"},{"$f":"'M. Mobile'!D36","v":0},{"$f":"'M. Mobile'!E36","v":0},{"$f":"'M. Mobile'!F36","v":0},{"$f":"'M. Mobile'!G36","v":0},{"$f":"'M. Mobile'!H36","v":"NA"},{"$f":"'M. Mobile'!I36","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A37","v":4100},{"$f":"'M. Mobile'!J37","v":2},{"$f":"'M. Mobile'!K37","v":0},{"$f":"'M. Mobile'!L37","v":3},{"$f":"'M. Mobile'!B37","v":"M.3.8"},{"$f":"'M. Mobile'!C37","v":"Is the identity management system (directory services) integrated with mobile infrastructure to support people joining/leaving/changing roles in the enterprise?"},{"$f":"'M. Mobile'!D37","v":0},{"$f":"'M. Mobile'!E37","v":0},{"$f":"'M. Mobile'!F37","v":0},{"$f":"'M. Mobile'!G37","v":0},{"$f":"'M. Mobile'!H37","v":0},{"$f":"'M. Mobile'!I37","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A38","v":4101},{"$f":"'M. Mobile'!J38","v":2},{"$f":"'M. Mobile'!K38","v":0},{"$f":"'M. Mobile'!L38","v":3},{"$f":"'M. Mobile'!B38","v":"M.3.9"},{"$f":"'M. Mobile'!C38","v":"Is Mobile Device Management subject to an internal or external audit?"},{"$f":"'M. Mobile'!D38","v":0},{"$f":"'M. Mobile'!E38","v":0},{"$f":"'M. Mobile'!F38","v":0},{"$f":"'M. Mobile'!G38","v":0},{"$f":"'M. Mobile'!H38","v":0},{"$f":"'M. Mobile'!I38","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A39","v":3823},{"$f":"'M. Mobile'!J39","v":2},{"$f":"'M. Mobile'!K39","v":0},{"$f":"'M. Mobile'!L39","v":3},{"$f":"'M. Mobile'!B39","v":"M.3.10"},{"$f":"'M. Mobile'!C39","v":"Are there approved mobile operating system versions permitted to connect to the respondent's environment? "},{"$f":"'M. Mobile'!D39","v":0},{"$f":"'M. Mobile'!E39","v":0},{"$f":"'M. Mobile'!F39","v":0},{"$f":"'M. Mobile'!G39","v":0},{"$f":"'M. Mobile'!H39","v":"6.2.1"},{"$f":"'M. Mobile'!I39","v":"Mobile device policy"},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A40","v":3824},{"$f":"'M. Mobile'!J40","v":3},{"$f":"'M. Mobile'!K40","v":0},{"$f":"'M. Mobile'!L40","v":3},{"$f":"'M. Mobile'!B40","v":"M.3.10.1"},{"$f":"'M. Mobile'!C40","v":"Are mobile operating system versions that are deemed end of life permitted to connect to Scoped Systems and Data?"},{"$f":"'M. Mobile'!D40","v":0},{"$f":"'M. Mobile'!E40","v":0},{"$f":"'M. Mobile'!F40","v":0},{"$f":"'M. Mobile'!G40","v":0},{"$f":"'M. Mobile'!H40","v":"6.2.1"},{"$f":"'M. Mobile'!I40","v":"Mobile device policy"},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A41","v":3825},{"$f":"'M. Mobile'!J41","v":2},{"$f":"'M. Mobile'!K41","v":0},{"$f":"'M. Mobile'!L41","v":3},{"$f":"'M. Mobile'!B41","v":"M.3.11"},{"$f":"'M. Mobile'!C41","v":"Are constituents permitted to create and activate mobile hotspots? (Bring Your Own Network, BYON)."},{"$f":"'M. Mobile'!D41","v":0},{"$f":"'M. Mobile'!E41","v":0},{"$f":"'M. Mobile'!F41","v":0},{"$f":"'M. Mobile'!G41","v":0},{"$f":"'M. Mobile'!H41","v":"6.2.1"},{"$f":"'M. Mobile'!I41","v":"Mobile device policy"},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A42","v":3826},{"$f":"'M. Mobile'!J42","v":2},{"$f":"'M. Mobile'!K42","v":0},{"$f":"'M. Mobile'!L42","v":3},{"$f":"'M. Mobile'!B42","v":"M.3.12"},{"$f":"'M. Mobile'!C42","v":"Are mobile applications that access Scoped Systems and Data developed?"},{"$f":"'M. Mobile'!D42","v":0},{"$f":"'M. Mobile'!E42","v":0},{"$f":"'M. Mobile'!F42","v":0},{"$f":"'M. Mobile'!G42","v":0},{"$f":"'M. Mobile'!H42","v":"NA"},{"$f":"'M. Mobile'!I42","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A43","v":3829},{"$f":"'M. Mobile'!J43","v":3},{"$f":"'M. Mobile'!K43","v":0},{"$f":"'M. Mobile'!L43","v":3},{"$f":"'M. Mobile'!B43","v":"M.3.12.1"},{"$f":"'M. Mobile'!C43","v":"Are any actions performed by the application to Scoped Systems or Data? If yes, what are they:"},{"$f":"'M. Mobile'!D43","v":0},{"$f":"'M. Mobile'!E43","v":0},{"$f":"'M. Mobile'!F43","v":0},{"$f":"'M. Mobile'!G43","v":0},{"$f":"'M. Mobile'!H43","v":"NA"},{"$f":"'M. Mobile'!I43","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A44","v":3830},{"$f":"'M. Mobile'!J44","v":4},{"$f":"'M. Mobile'!K44","v":0},{"$f":"'M. Mobile'!L44","v":3},{"$f":"'M. Mobile'!B44","v":"M.3.12.1.1"},{"$f":"'M. Mobile'!C44","v":"Access?"},{"$f":"'M. Mobile'!D44","v":0},{"$f":"'M. Mobile'!E44","v":0},{"$f":"'M. Mobile'!F44","v":0},{"$f":"'M. Mobile'!G44","v":0},{"$f":"'M. Mobile'!H44","v":"NA"},{"$f":"'M. Mobile'!I44","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A45","v":3831},{"$f":"'M. Mobile'!J45","v":4},{"$f":"'M. Mobile'!K45","v":0},{"$f":"'M. Mobile'!L45","v":3},{"$f":"'M. Mobile'!B45","v":"M.3.12.1.2"},{"$f":"'M. Mobile'!C45","v":"Process?"},{"$f":"'M. Mobile'!D45","v":0},{"$f":"'M. Mobile'!E45","v":0},{"$f":"'M. Mobile'!F45","v":0},{"$f":"'M. Mobile'!G45","v":0},{"$f":"'M. Mobile'!H45","v":"NA"},{"$f":"'M. Mobile'!I45","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A46","v":3832},{"$f":"'M. Mobile'!J46","v":4},{"$f":"'M. Mobile'!K46","v":0},{"$f":"'M. Mobile'!L46","v":3},{"$f":"'M. Mobile'!B46","v":"M.3.12.1.3"},{"$f":"'M. Mobile'!C46","v":"Transmit?"},{"$f":"'M. Mobile'!D46","v":0},{"$f":"'M. Mobile'!E46","v":0},{"$f":"'M. Mobile'!F46","v":0},{"$f":"'M. Mobile'!G46","v":0},{"$f":"'M. Mobile'!H46","v":"NA"},{"$f":"'M. Mobile'!I46","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A47","v":3833},{"$f":"'M. Mobile'!J47","v":4},{"$f":"'M. Mobile'!K47","v":0},{"$f":"'M. Mobile'!L47","v":3},{"$f":"'M. Mobile'!B47","v":"M.3.12.1.4"},{"$f":"'M. Mobile'!C47","v":"Store locally?"},{"$f":"'M. Mobile'!D47","v":0},{"$f":"'M. Mobile'!E47","v":0},{"$f":"'M. Mobile'!F47","v":0},{"$f":"'M. Mobile'!G47","v":0},{"$f":"'M. Mobile'!H47","v":"NA"},{"$f":"'M. Mobile'!I47","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A48","v":4102},{"$f":"'M. Mobile'!J48","v":2},{"$f":"'M. Mobile'!K48","v":0},{"$f":"'M. Mobile'!L48","v":3},{"$f":"'M. Mobile'!B48","v":"M.3.13"},{"$f":"'M. Mobile'!C48","v":"Is Dynamic code analysis performed (including fuzzing)? "},{"$f":"'M. Mobile'!D48","v":0},{"$f":"'M. Mobile'!E48","v":0},{"$f":"'M. Mobile'!F48","v":0},{"$f":"'M. Mobile'!G48","v":0},{"$f":"'M. Mobile'!H48","v":0},{"$f":"'M. Mobile'!I48","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A49","v":4103},{"$f":"'M. Mobile'!J49","v":2},{"$f":"'M. Mobile'!K49","v":0},{"$f":"'M. Mobile'!L49","v":3},{"$f":"'M. Mobile'!B49","v":"M.3.14"},{"$f":"'M. Mobile'!C49","v":"Is there a standard mobile development framework?"},{"$f":"'M. Mobile'!D49","v":0},{"$f":"'M. Mobile'!E49","v":0},{"$f":"'M. Mobile'!F49","v":0},{"$f":"'M. Mobile'!G49","v":0},{"$f":"'M. Mobile'!H49","v":0},{"$f":"'M. Mobile'!I49","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A50","v":4104},{"$f":"'M. Mobile'!J50","v":2},{"$f":"'M. Mobile'!K50","v":0},{"$f":"'M. Mobile'!L50","v":3},{"$f":"'M. Mobile'!B50","v":"M.3.15"},{"$f":"'M. Mobile'!C50","v":"Is threat modeling performed as part of the Mobile SDLC process?"},{"$f":"'M. Mobile'!D50","v":0},{"$f":"'M. Mobile'!E50","v":0},{"$f":"'M. Mobile'!F50","v":0},{"$f":"'M. Mobile'!G50","v":0},{"$f":"'M. Mobile'!H50","v":0},{"$f":"'M. Mobile'!I50","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A51","v":4105},{"$f":"'M. Mobile'!J51","v":2},{"$f":"'M. Mobile'!K51","v":0},{"$f":"'M. Mobile'!L51","v":3},{"$f":"'M. Mobile'!B51","v":"M.3.16"},{"$f":"'M. Mobile'!C51","v":"Are anti-tamper or code obfuscation employed for mobile apps?"},{"$f":"'M. Mobile'!D51","v":0},{"$f":"'M. Mobile'!E51","v":0},{"$f":"'M. Mobile'!F51","v":0},{"$f":"'M. Mobile'!G51","v":0},{"$f":"'M. Mobile'!H51","v":0},{"$f":"'M. Mobile'!I51","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A52","v":4106},{"$f":"'M. Mobile'!J52","v":2},{"$f":"'M. Mobile'!K52","v":0},{"$f":"'M. Mobile'!L52","v":3},{"$f":"'M. Mobile'!B52","v":"M.3.17"},{"$f":"'M. Mobile'!C52","v":"Is certificate or public pinning implemented?"},{"$f":"'M. Mobile'!D52","v":0},{"$f":"'M. Mobile'!E52","v":0},{"$f":"'M. Mobile'!F52","v":0},{"$f":"'M. Mobile'!G52","v":0},{"$f":"'M. Mobile'!H52","v":0},{"$f":"'M. Mobile'!I52","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A53","v":4107},{"$f":"'M. Mobile'!J53","v":2},{"$f":"'M. Mobile'!K53","v":0},{"$f":"'M. Mobile'!L53","v":3},{"$f":"'M. Mobile'!B53","v":"M.3.18"},{"$f":"'M. Mobile'!C53","v":"Do push notifications contain only \"public\" information? "},{"$f":"'M. Mobile'!D53","v":0},{"$f":"'M. Mobile'!E53","v":0},{"$f":"'M. Mobile'!F53","v":0},{"$f":"'M. Mobile'!G53","v":0},{"$f":"'M. Mobile'!H53","v":0},{"$f":"'M. Mobile'!I53","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A54","v":4108},{"$f":"'M. Mobile'!J54","v":2},{"$f":"'M. Mobile'!K54","v":0},{"$f":"'M. Mobile'!L54","v":3},{"$f":"'M. Mobile'!B54","v":"M.3.19"},{"$f":"'M. Mobile'!C54","v":"Are biometrics used?"},{"$f":"'M. Mobile'!D54","v":0},{"$f":"'M. Mobile'!E54","v":0},{"$f":"'M. Mobile'!F54","v":0},{"$f":"'M. Mobile'!G54","v":0},{"$f":"'M. Mobile'!H54","v":0},{"$f":"'M. Mobile'!I54","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A55","v":4109},{"$f":"'M. Mobile'!J55","v":3},{"$f":"'M. Mobile'!K55","v":0},{"$f":"'M. Mobile'!L55","v":3},{"$f":"'M. Mobile'!B55","v":"M.3.19.1"},{"$f":"'M. Mobile'!C55","v":" Is biometric data secure/protect to ensure only appropriate use?"},{"$f":"'M. Mobile'!D55","v":0},{"$f":"'M. Mobile'!E55","v":0},{"$f":"'M. Mobile'!F55","v":0},{"$f":"'M. Mobile'!G55","v":0},{"$f":"'M. Mobile'!H55","v":0},{"$f":"'M. Mobile'!I55","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A56","v":4110},{"$f":"'M. Mobile'!J56","v":2},{"$f":"'M. Mobile'!K56","v":0},{"$f":"'M. Mobile'!L56","v":3},{"$f":"'M. Mobile'!B56","v":"M.3.20"},{"$f":"'M. Mobile'!C56","v":"Are risk-based authentication or fraud detection/prevention capability used?"},{"$f":"'M. Mobile'!D56","v":0},{"$f":"'M. Mobile'!E56","v":0},{"$f":"'M. Mobile'!F56","v":0},{"$f":"'M. Mobile'!G56","v":0},{"$f":"'M. Mobile'!H56","v":0},{"$f":"'M. Mobile'!I56","v":0},null,null,null,"N/A"]
[{"$f":"'M. Mobile'!A119","v":0},{"$f":"'M. Mobile'!J119","v":0},{"$f":"'M. Mobile'!K119","v":0},{"$f":"'M. Mobile'!L119","v":0},{"$f":"'M. Mobile'!B119","v":0},{"$f":"'M. Mobile'!C119","v":0},{"$f":"'M. Mobile'!D119","v":0},{"$f":"'M. Mobile'!E119","v":0},{"$f":"'M. Mobile'!F119","v":0},{"$f":"'M. Mobile'!G119","v":0},{"$f":"'M. Mobile'!H119","v":0},{"$f":"'M. Mobile'!I119","v":0}]
[]
[{"$f":"'P. Privacy'!B1","v":"P. Privacy"},null,null,null,{"$f":"'P. Privacy'!B1","v":"P. Privacy"}]
[{"$f":"'P. Privacy'!A5","v":3687},{"$f":"'P. Privacy'!J5","v":1},{"$f":"'P. Privacy'!K5","v":0},{"$f":"'P. Privacy'!Y5","v":1},{"$f":"'P. Privacy'!B5","v":"P.1"},{"$f":"'P. Privacy'!C5","v":"Is Scoped Data transmitted, processed, or stored that can be classified as non-public information (NPI), personally identifiable information (PII), or sensitive customer financial information? If yes, describe and list types of data:"},{"$f":"'P. Privacy'!D5","v":0},{"$f":"'P. Privacy'!E5","v":0},{"$f":"'P. Privacy'!F5","v":0},{"$f":"'P. Privacy'!G5","v":0},{"$f":"'P. Privacy'!H5","v":"8.2.1"},{"$f":"'P. Privacy'!I5","v":"Classification of Information"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A6","v":3221},{"$f":"'P. Privacy'!J6","v":2},{"$f":"'P. Privacy'!K6","v":0},{"$f":"'P. Privacy'!Y6","v":0},{"$f":"'P. Privacy'!B6","v":"P.1.1"},{"$f":"'P. Privacy'!C6","v":"Is there a documented data protection program with administrative, technical, and physical safeguards for the protection of Scoped Data?"},{"$f":"'P. Privacy'!D6","v":0},{"$f":"'P. Privacy'!E6","v":0},{"$f":"'P. Privacy'!F6","v":0},{"$f":"'P. Privacy'!G6","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"'P. Privacy'!H6","v":"NA"},{"$f":"'P. Privacy'!I6","v":0},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A7","v":3234},{"$f":"'P. Privacy'!J7","v":2},{"$f":"'P. Privacy'!K7","v":0},{"$f":"'P. Privacy'!Y7","v":1},{"$f":"'P. Privacy'!B7","v":"P.1.2"},{"$f":"'P. Privacy'!C7","v":"Is a response program maintained that includes policies and procedures to address privacy incidents, unauthorized disclosure, unauthorized access or breach of Scoped Data?"},{"$f":"'P. Privacy'!D7","v":0},{"$f":"'P. Privacy'!E7","v":0},{"$f":"'P. Privacy'!F7","v":0},{"$f":"'P. Privacy'!G7","v":"P.8 Privacy Event Notification and Response Management"},{"$f":"'P. Privacy'!H7","v":16.100000000000001},{"$f":"'P. Privacy'!I7","v":"Management of information security incidents and improvements"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A8","v":3690},{"$f":"'P. Privacy'!J8","v":2},{"$f":"'P. Privacy'!K8","v":0},{"$f":"'P. Privacy'!Y8","v":0},{"$f":"'P. Privacy'!B8","v":"P.1.3"},{"$f":"'P. Privacy'!C8","v":"Do agreements with third parties who have access to Scoped Data, address confidentiality, audit, security, and privacy, including but not limited to incident response, ongoing monitoring, data sharing and secure disposal of Scoped Data?"},{"$f":"'P. Privacy'!D8","v":0},{"$f":"'P. Privacy'!E8","v":0},{"$f":"'P. Privacy'!F8","v":0},{"$f":"'P. Privacy'!G8","v":"P.4 Privacy Third Party Agreements"},{"$f":"'P. Privacy'!H8","v":"15.1.2 "},{"$f":"'P. Privacy'!I8","v":"Addressing security within supplier agreements"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A9","v":3691},{"$f":"'P. Privacy'!J9","v":2},{"$f":"'P. Privacy'!K9","v":0},{"$f":"'P. Privacy'!Y9","v":0},{"$f":"'P. Privacy'!B9","v":"P.1.4"},{"$f":"'P. Privacy'!C9","v":"Are processes maintained to ensure the proper disposal of Scoped Data? If yes, describe."},{"$f":"'P. Privacy'!D9","v":0},{"$f":"'P. Privacy'!E9","v":0},{"$f":"'P. Privacy'!F9","v":0},{"$f":"'P. Privacy'!G9","v":0},{"$f":"'P. Privacy'!H9","v":"8.3.2 "},{"$f":"'P. Privacy'!I9","v":"Disposal of media"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A10","v":3692},{"$f":"'P. Privacy'!J10","v":2},{"$f":"'P. Privacy'!K10","v":0},{"$f":"'P. Privacy'!Y10","v":0},{"$f":"'P. Privacy'!B10","v":"P.1.5"},{"$f":"'P. Privacy'!C10","v":"Is there a process to limit or prevent the sharing of Scoped Data with affiliates unless authorized?"},{"$f":"'P. Privacy'!D10","v":0},{"$f":"'P. Privacy'!E10","v":0},{"$f":"'P. Privacy'!F10","v":0},{"$f":"'P. Privacy'!G10","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"'P. Privacy'!H10","v":"8.2.3 "},{"$f":"'P. Privacy'!I10","v":"Handling of assets"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A11","v":3284},{"$f":"'P. Privacy'!J11","v":2},{"$f":"'P. Privacy'!K11","v":0},{"$f":"'P. Privacy'!Y11","v":0},{"$f":"'P. Privacy'!B11","v":"P.1.6"},{"$f":"'P. Privacy'!C11","v":"Is there a process to provide notification as required by regulatory authorities or law enforcement, to address incidents of unauthorized access or breach of Scoped Data?"},{"$f":"'P. Privacy'!D11","v":0},{"$f":"'P. Privacy'!E11","v":0},{"$f":"'P. Privacy'!F11","v":0},{"$f":"'P. Privacy'!G11","v":"P.8 Privacy Event Notification and Response Management"},{"$f":"'P. Privacy'!H11","v":"16.1.2 "},{"$f":"'P. Privacy'!I11","v":"Reporting information security events"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A12","v":3857},{"$f":"'P. Privacy'!J12","v":2},{"$f":"'P. Privacy'!K12","v":0},{"$f":"'P. Privacy'!Y12","v":0},{"$f":"'P. Privacy'!B12","v":"P.1.7"},{"$f":"'P. Privacy'!C12","v":"For services provided on behalf of client that include direct interaction with client's customers are processes in place to log and report privacy complaints?"},{"$f":"'P. Privacy'!D12","v":0},{"$f":"'P. Privacy'!E12","v":0},{"$f":"'P. Privacy'!F12","v":0},{"$f":"'P. Privacy'!G12","v":"P.4 Privacy Third Party Agreements"},{"$f":"'P. Privacy'!H12","v":"NA"},{"$f":"'P. Privacy'!I12","v":0},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A13","v":3694},{"$f":"'P. Privacy'!J13","v":1},{"$f":"'P. Privacy'!K13","v":0},{"$f":"'P. Privacy'!Y13","v":1},{"$f":"'P. Privacy'!B13","v":"P.2"},{"$f":"'P. Privacy'!C13","v":"Is Scoped Data transmitted, processed, or stored that can be classified as Protected Health Information (PHI), electronic health records, or personal health records of a covered entity? If yes, identify the classifications."},{"$f":"'P. Privacy'!D13","v":0},{"$f":"'P. Privacy'!E13","v":0},{"$f":"'P. Privacy'!F13","v":0},{"$f":"'P. Privacy'!G13","v":0},{"$f":"'P. Privacy'!H13","v":"8.2.1"},{"$f":"'P. Privacy'!I13","v":"Classification of Information"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A14","v":3858},{"$f":"'P. Privacy'!J14","v":2},{"$f":"'P. Privacy'!K14","v":0},{"$f":"'P. Privacy'!Y14","v":0},{"$f":"'P. Privacy'!B14","v":"P.2.1"},{"$f":"'P. Privacy'!C14","v":" Is PHI accessed, transmitted, processed or stored?"},{"$f":"'P. Privacy'!D14","v":0},{"$f":"'P. Privacy'!E14","v":0},{"$f":"'P. Privacy'!F14","v":0},{"$f":"'P. Privacy'!G14","v":0},{"$f":"'P. Privacy'!H14","v":"NA"},{"$f":"'P. Privacy'!I14","v":0},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A15","v":3696},{"$f":"'P. Privacy'!J15","v":2},{"$f":"'P. Privacy'!K15","v":0},{"$f":"'P. Privacy'!Y15","v":0},{"$f":"'P. Privacy'!B15","v":"P.2.2"},{"$f":"'P. Privacy'!C15","v":"Are there documented policies and procedures to detect and report unauthorized acquisition, use, or disclosure of PHI? If yes, describe."},{"$f":"'P. Privacy'!D15","v":0},{"$f":"'P. Privacy'!E15","v":0},{"$f":"'P. Privacy'!F15","v":0},{"$f":"'P. Privacy'!G15","v":"P.8 Privacy Event Notification and Response Management"},{"$f":"'P. Privacy'!H15","v":"16.1.2 "},{"$f":"'P. Privacy'!I15","v":"Reporting information security events"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A16","v":3697},{"$f":"'P. Privacy'!J16","v":2},{"$f":"'P. Privacy'!K16","v":0},{"$f":"'P. Privacy'!Y16","v":0},{"$f":"'P. Privacy'!B16","v":"P.2.3"},{"$f":"'P. Privacy'!C16","v":"Are there contractual provisions, and control mechanisms to ensure that privacy and security obligations of the respondent extend to the respondents suppliers, vendors, or subcontractors?"},{"$f":"'P. Privacy'!D16","v":0},{"$f":"'P. Privacy'!E16","v":0},{"$f":"'P. Privacy'!F16","v":0},{"$f":"'P. Privacy'!G16","v":"P.4 Privacy Third Party Agreements"},{"$f":"'P. Privacy'!H16","v":"15.1.2 "},{"$f":"'P. Privacy'!I16","v":"Addressing security within supplier agreements"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A17","v":3698},{"$f":"'P. Privacy'!J17","v":2},{"$f":"'P. Privacy'!K17","v":0},{"$f":"'P. Privacy'!Y17","v":0},{"$f":"'P. Privacy'!B17","v":"P.2.4"},{"$f":"'P. Privacy'!C17","v":"Are there documented procedures for availability of access to PHI data or designated record set maintained by the respondent?"},{"$f":"'P. Privacy'!D17","v":0},{"$f":"'P. Privacy'!E17","v":0},{"$f":"'P. Privacy'!F17","v":0},{"$f":"'P. Privacy'!G17","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"'P. Privacy'!H17","v":"8.2.3 "},{"$f":"'P. Privacy'!I17","v":"Handling of assets"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A18","v":3699},{"$f":"'P. Privacy'!J18","v":2},{"$f":"'P. Privacy'!K18","v":0},{"$f":"'P. Privacy'!Y18","v":0},{"$f":"'P. Privacy'!B18","v":"P.2.5"},{"$f":"'P. Privacy'!C18","v":"Are there documented procedures to enable the ability to reasonably amend PHI maintained by the respondent upon request?"},{"$f":"'P. Privacy'!D18","v":0},{"$f":"'P. Privacy'!E18","v":0},{"$f":"'P. Privacy'!F18","v":0},{"$f":"'P. Privacy'!G18","v":"P.4 Privacy Third Party Agreements"},{"$f":"'P. Privacy'!H18","v":"NA"},{"$f":"'P. Privacy'!I18","v":0},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A19","v":3700},{"$f":"'P. Privacy'!J19","v":2},{"$f":"'P. Privacy'!K19","v":0},{"$f":"'P. Privacy'!Y19","v":0},{"$f":"'P. Privacy'!B19","v":"P.2.6"},{"$f":"'P. Privacy'!C19","v":"Are there logs or records of disclosures of PHI that can be provided upon request?"},{"$f":"'P. Privacy'!D19","v":0},{"$f":"'P. Privacy'!E19","v":0},{"$f":"'P. Privacy'!F19","v":0},{"$f":"'P. Privacy'!G19","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'P. Privacy'!H19","v":"8.2.3.b"},{"$f":"'P. Privacy'!I19","v":"Handling of assets"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A20","v":3701},{"$f":"'P. Privacy'!J20","v":2},{"$f":"'P. Privacy'!K20","v":0},{"$f":"'P. Privacy'!Y20","v":1},{"$f":"'P. Privacy'!B20","v":"P.2.7"},{"$f":"'P. Privacy'!C20","v":"Is a business associate contract in place to address obligations for the privacy and security requirements for the services provided?"},{"$f":"'P. Privacy'!D20","v":0},{"$f":"'P. Privacy'!E20","v":0},{"$f":"'P. Privacy'!F20","v":0},{"$f":"'P. Privacy'!G20","v":"P.4 Privacy Third Party Agreements"},{"$f":"'P. Privacy'!H20","v":"15.1.2 "},{"$f":"'P. Privacy'!I20","v":"Addressing security within supplier agreements"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A21","v":3702},{"$f":"'P. Privacy'!J21","v":2},{"$f":"'P. Privacy'!K21","v":0},{"$f":"'P. Privacy'!Y21","v":0},{"$f":"'P. Privacy'!B21","v":"P.2.8"},{"$f":"'P. Privacy'!C21","v":"Are there training logs for employees with access to client PHI to meet the privacy and security obligations required by HIPAA? If yes, describe."},{"$f":"'P. Privacy'!D21","v":0},{"$f":"'P. Privacy'!E21","v":0},{"$f":"'P. Privacy'!F21","v":0},{"$f":"'P. Privacy'!G21","v":"P.7 Privacy Awareness"},{"$f":"'P. Privacy'!H21","v":"7.2.2 "},{"$f":"'P. Privacy'!I21","v":"Information security awareness, education and training"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A22","v":3703},{"$f":"'P. Privacy'!J22","v":2},{"$f":"'P. Privacy'!K22","v":0},{"$f":"'P. Privacy'!Y22","v":0},{"$f":"'P. Privacy'!B22","v":"P.2.9"},{"$f":"'P. Privacy'!C22","v":"Is there a documented process to provide notification as required by regulatory authorities or law enforcement, to address incidents of unauthorized access or breach of protected health information?"},{"$f":"'P. Privacy'!D22","v":0},{"$f":"'P. Privacy'!E22","v":0},{"$f":"'P. Privacy'!F22","v":0},{"$f":"'P. Privacy'!G22","v":"P.8 Privacy Event Notification and Response Management"},{"$f":"'P. Privacy'!H22","v":"16.1.1.b.3 "},{"$f":"'P. Privacy'!I22","v":"Responsibilities and procedures"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A23","v":3704},{"$f":"'P. Privacy'!J23","v":1},{"$f":"'P. Privacy'!K23","v":0},{"$f":"'P. Privacy'!Y23","v":1},{"$f":"'P. Privacy'!B23","v":"P.3"},{"$f":"'P. Privacy'!C23","v":"For Scoped Data, is personal information about individuals transmitted to or received from countries outside the United States? If yes, list the countries."},{"$f":"'P. Privacy'!D23","v":0},{"$f":"'P. Privacy'!E23","v":0},{"$f":"'P. Privacy'!F23","v":0},{"$f":"'P. Privacy'!G23","v":0},{"$f":"'P. Privacy'!H23","v":"NA"},{"$f":"'P. Privacy'!I23","v":0},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A24","v":3859},{"$f":"'P. Privacy'!J24","v":2},{"$f":"'P. Privacy'!K24","v":0},{"$f":"'P. Privacy'!Y24","v":0},{"$f":"'P. Privacy'!B24","v":"P.3.1"},{"$f":"'P. Privacy'!C24","v":"Is information directly collected and used about individuals?"},{"$f":"'P. Privacy'!D24","v":0},{"$f":"'P. Privacy'!E24","v":0},{"$f":"'P. Privacy'!F24","v":0},{"$f":"'P. Privacy'!G24","v":0},{"$f":"'P. Privacy'!H24","v":"NA"},{"$f":"'P. Privacy'!I24","v":0},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A25","v":3239},{"$f":"'P. Privacy'!J25","v":2},{"$f":"'P. Privacy'!K25","v":0},{"$f":"'P. Privacy'!Y25","v":0},{"$f":"'P. Privacy'!B25","v":"P.3.2"},{"$f":"'P. Privacy'!C25","v":"Are notices provided when information is directly collected from an individual? If yes, describe."},{"$f":"'P. Privacy'!D25","v":0},{"$f":"'P. Privacy'!E25","v":0},{"$f":"'P. Privacy'!F25","v":0},{"$f":"'P. Privacy'!G25","v":"P.2 Privacy Policy and Privacy Notices"},{"$f":"'P. Privacy'!H25","v":"NA"},{"$f":"'P. Privacy'!I25","v":0},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A26","v":3707},{"$f":"'P. Privacy'!J26","v":2},{"$f":"'P. Privacy'!K26","v":0},{"$f":"'P. Privacy'!Y26","v":0},{"$f":"'P. Privacy'!B26","v":"P.3.3"},{"$f":"'P. Privacy'!C26","v":"Are there documented operating procedures regarding limiting personal data collection and use?"},{"$f":"'P. Privacy'!D26","v":0},{"$f":"'P. Privacy'!E26","v":0},{"$f":"'P. Privacy'!F26","v":0},{"$f":"'P. Privacy'!G26","v":0},{"$f":"'P. Privacy'!H26","v":"8.2.3 "},{"$f":"'P. Privacy'!I26","v":"Handling of assets"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A27","v":3708},{"$f":"'P. Privacy'!J27","v":2},{"$f":"'P. Privacy'!K27","v":0},{"$f":"'P. Privacy'!Y27","v":0},{"$f":"'P. Privacy'!B27","v":"P.3.4"},{"$f":"'P. Privacy'!C27","v":"Are there operating procedures for onward transfer of customer information? If yes, describe."},{"$f":"'P. Privacy'!D27","v":0},{"$f":"'P. Privacy'!E27","v":0},{"$f":"'P. Privacy'!F27","v":0},{"$f":"'P. Privacy'!G27","v":0},{"$f":"'P. Privacy'!H27","v":"13.2.1"},{"$f":"'P. Privacy'!I27","v":"Information transfer policies and procedures"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A28","v":3709},{"$f":"'P. Privacy'!J28","v":2},{"$f":"'P. Privacy'!K28","v":0},{"$f":"'P. Privacy'!Y28","v":0},{"$f":"'P. Privacy'!B28","v":"P.3.5"},{"$f":"'P. Privacy'!C28","v":"Is Safe Harbor status maintained with the Department of Commerce with respect to the data protection applicable to the European Union?"},{"$f":"'P. Privacy'!D28","v":0},{"$f":"'P. Privacy'!E28","v":0},{"$f":"'P. Privacy'!F28","v":0},{"$f":"'P. Privacy'!G28","v":"P.5 Legal Authorizations"},{"$f":"'P. Privacy'!H28","v":"NA"},{"$f":"'P. Privacy'!I28","v":0},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A29","v":3254},{"$f":"'P. Privacy'!J29","v":2},{"$f":"'P. Privacy'!K29","v":0},{"$f":"'P. Privacy'!Y29","v":0},{"$f":"'P. Privacy'!B29","v":"P.3.6"},{"$f":"'P. Privacy'!C29","v":"If customer data is directly collected from individuals, does the customer have the ability to opt out? "},{"$f":"'P. Privacy'!D29","v":0},{"$f":"'P. Privacy'!E29","v":0},{"$f":"'P. Privacy'!F29","v":0},{"$f":"'P. Privacy'!G29","v":0},{"$f":"'P. Privacy'!H29","v":"NA"},{"$f":"'P. Privacy'!I29","v":0},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A30","v":3263},{"$f":"'P. Privacy'!J30","v":2},{"$f":"'P. Privacy'!K30","v":0},{"$f":"'P. Privacy'!Y30","v":0},{"$f":"'P. Privacy'!B30","v":"P.3.7"},{"$f":"'P. Privacy'!C30","v":"If customer data of individuals is retained, are there processes and procedures to enable individuals to access, correct, amend, or delete inaccurate information?"},{"$f":"'P. Privacy'!D30","v":0},{"$f":"'P. Privacy'!E30","v":0},{"$f":"'P. Privacy'!F30","v":0},{"$f":"'P. Privacy'!G30","v":0},{"$f":"'P. Privacy'!H30","v":"8.2.3 "},{"$f":"'P. Privacy'!I30","v":"Handling of assets"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A31","v":3228},{"$f":"'P. Privacy'!J31","v":2},{"$f":"'P. Privacy'!K31","v":0},{"$f":"'P. Privacy'!Y31","v":1},{"$f":"'P. Privacy'!B31","v":"P.3.8"},{"$f":"'P. Privacy'!C31","v":"Is there privacy awareness training provided to constituents regarding their obligation to data protection?"},{"$f":"'P. Privacy'!D31","v":0},{"$f":"'P. Privacy'!E31","v":0},{"$f":"'P. Privacy'!F31","v":0},{"$f":"'P. Privacy'!G31","v":"P.7 Privacy Awareness"},{"$f":"'P. Privacy'!H31","v":"7.2.2 "},{"$f":"'P. Privacy'!I31","v":"Information security awareness, education and training"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A32","v":3713},{"$f":"'P. Privacy'!J32","v":2},{"$f":"'P. Privacy'!K32","v":0},{"$f":"'P. Privacy'!Y32","v":0},{"$f":"'P. Privacy'!B32","v":"P.3.9"},{"$f":"'P. Privacy'!C32","v":"Are there documented procedures for cross border data flows of customer data to the US from other countries. If yes, list the countries:"},{"$f":"'P. Privacy'!D32","v":0},{"$f":"'P. Privacy'!E32","v":0},{"$f":"'P. Privacy'!F32","v":0},{"$f":"'P. Privacy'!G32","v":"P.2 Privacy Policy and Privacy Notices"},{"$f":"'P. Privacy'!H32","v":"NA"},{"$f":"'P. Privacy'!I32","v":0},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A33","v":3714},{"$f":"'P. Privacy'!J33","v":2},{"$f":"'P. Privacy'!K33","v":0},{"$f":"'P. Privacy'!Y33","v":0},{"$f":"'P. Privacy'!B33","v":"P.3.10"},{"$f":"'P. Privacy'!C33","v":"Is there a documented response program with policies and procedures to address privacy incidents, unauthorized disclosure, unauthorized access or breach of Scoped Data?"},{"$f":"'P. Privacy'!D33","v":0},{"$f":"'P. Privacy'!E33","v":0},{"$f":"'P. Privacy'!F33","v":0},{"$f":"'P. Privacy'!G33","v":"P.8 Privacy Event Notification and Response Management"},{"$f":"'P. Privacy'!H33","v":"16.1.1 "},{"$f":"'P. Privacy'!I33","v":"Responsibilities and procedures"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A34","v":3715},{"$f":"'P. Privacy'!J34","v":1},{"$f":"'P. Privacy'!K34","v":0},{"$f":"'P. Privacy'!Y34","v":1},{"$f":"'P. Privacy'!B34","v":"P.4"},{"$f":"'P. Privacy'!C34","v":"Is personal information disclosed to or retained by third parties? If yes, describe."},{"$f":"'P. Privacy'!D34","v":0},{"$f":"'P. Privacy'!E34","v":0},{"$f":"'P. Privacy'!F34","v":0},{"$f":"'P. Privacy'!G34","v":0},{"$f":"'P. Privacy'!H34","v":15},{"$f":"'P. Privacy'!I34","v":"Supplier Relationships"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A35","v":3270},{"$f":"'P. Privacy'!J35","v":2},{"$f":"'P. Privacy'!K35","v":0},{"$f":"'P. Privacy'!Y35","v":1},{"$f":"'P. Privacy'!B35","v":"P.4.1"},{"$f":"'P. Privacy'!C35","v":"Are there contractual controls to ensure that personal information shared with third parties is limited to defined parameters for access, use and disclosure? If yes, describe. If no, explain reason."},{"$f":"'P. Privacy'!D35","v":0},{"$f":"'P. Privacy'!E35","v":0},{"$f":"'P. Privacy'!F35","v":0},{"$f":"'P. Privacy'!G35","v":"P.4 Privacy Third Party Agreements"},{"$f":"'P. Privacy'!H35","v":"15.1.2 "},{"$f":"'P. Privacy'!I35","v":"Addressing security within supplier agreements"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A36","v":3269},{"$f":"'P. Privacy'!J36","v":2},{"$f":"'P. Privacy'!K36","v":0},{"$f":"'P. Privacy'!Y36","v":1},{"$f":"'P. Privacy'!B36","v":"P.4.2"},{"$f":"'P. Privacy'!C36","v":"Is personal information accessed, disclosed, processed, transmitted or retained with third parties outside the US? If yes, describe and list the countries."},{"$f":"'P. Privacy'!D36","v":0},{"$f":"'P. Privacy'!E36","v":0},{"$f":"'P. Privacy'!F36","v":0},{"$f":"'P. Privacy'!G36","v":0},{"$f":"'P. Privacy'!H36","v":15},{"$f":"'P. Privacy'!I36","v":"Supplier Relationships"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A37","v":3718},{"$f":"'P. Privacy'!J37","v":1},{"$f":"'P. Privacy'!K37","v":0},{"$f":"'P. Privacy'!Y37","v":1},{"$f":"'P. Privacy'!B37","v":"P.5"},{"$f":"'P. Privacy'!C37","v":"Is there a documented privacy policy or procedures for the protection of information transmitted, processed, or maintained on behalf of the client?"},{"$f":"'P. Privacy'!D37","v":0},{"$f":"'P. Privacy'!E37","v":0},{"$f":"'P. Privacy'!F37","v":0},{"$f":"'P. Privacy'!G37","v":"P.2 Privacy Policy and Privacy Notices"},{"$f":"'P. Privacy'!H37","v":"15.1.1"},{"$f":"'P. Privacy'!I37","v":"Information security policy for supplier relationships"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A38","v":3224},{"$f":"'P. Privacy'!J38","v":2},{"$f":"'P. Privacy'!K38","v":0},{"$f":"'P. Privacy'!Y38","v":0},{"$f":"'P. Privacy'!B38","v":"P.5.1"},{"$f":"'P. Privacy'!C38","v":"Are privacy policies and procedures reviewed and revised at least annually? "},{"$f":"'P. Privacy'!D38","v":0},{"$f":"'P. Privacy'!E38","v":0},{"$f":"'P. Privacy'!F38","v":0},{"$f":"'P. Privacy'!G38","v":"P.3 Privacy Organization and Program Maintenance"},{"$f":"'P. Privacy'!H38","v":"15.1.1.e"},{"$f":"'P. Privacy'!I38","v":"Information security policy for supplier relationships"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A39","v":3225},{"$f":"'P. Privacy'!J39","v":1},{"$f":"'P. Privacy'!K39","v":0},{"$f":"'P. Privacy'!Y39","v":1},{"$f":"'P. Privacy'!B39","v":"P.6"},{"$f":"'P. Privacy'!C39","v":"Are there regular privacy risk assessments conducted? If yes, provide frequency and scope. If no, explain reason."},{"$f":"'P. Privacy'!D39","v":0},{"$f":"'P. Privacy'!E39","v":0},{"$f":"'P. Privacy'!F39","v":0},{"$f":"'P. Privacy'!G39","v":"P.3 Privacy Organization and Program Maintenance"},{"$f":"'P. Privacy'!H39","v":"15.1.3.i "},{"$f":"'P. Privacy'!I39","v":"Information and communication technology supply chain"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A40","v":3226},{"$f":"'P. Privacy'!J40","v":2},{"$f":"'P. Privacy'!K40","v":0},{"$f":"'P. Privacy'!Y40","v":0},{"$f":"'P. Privacy'!B40","v":"P.6.1"},{"$f":"'P. Privacy'!C40","v":"Are identified privacy risks and associated mitigation plans formally documented and reviewed by management?"},{"$f":"'P. Privacy'!D40","v":0},{"$f":"'P. Privacy'!E40","v":0},{"$f":"'P. Privacy'!F40","v":0},{"$f":"'P. Privacy'!G40","v":"P.3 Privacy Organization and Program Maintenance"},{"$f":"'P. Privacy'!H40","v":"15.1.1.l"},{"$f":"'P. Privacy'!I40","v":"Information security policy for supplier relationships"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A41","v":3227},{"$f":"'P. Privacy'!J41","v":2},{"$f":"'P. Privacy'!K41","v":0},{"$f":"'P. Privacy'!Y41","v":0},{"$f":"'P. Privacy'!B41","v":"P.6.2"},{"$f":"'P. Privacy'!C41","v":"Are reasonable resources (in time and money) allocated to mitigating identified privacy risks?"},{"$f":"'P. Privacy'!D41","v":0},{"$f":"'P. Privacy'!E41","v":0},{"$f":"'P. Privacy'!F41","v":0},{"$f":"'P. Privacy'!G41","v":0},{"$f":"'P. Privacy'!H41","v":"NA"},{"$f":"'P. Privacy'!I41","v":0},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A42","v":3723},{"$f":"'P. Privacy'!J42","v":1},{"$f":"'P. Privacy'!K42","v":0},{"$f":"'P. Privacy'!Y42","v":1},{"$f":"'P. Privacy'!B42","v":"P.7"},{"$f":"'P. Privacy'!C42","v":"Is there a data classification retention program that identifies the data types that require additional management and governance?"},{"$f":"'P. Privacy'!D42","v":0},{"$f":"'P. Privacy'!E42","v":0},{"$f":"'P. Privacy'!F42","v":0},{"$f":"'P. Privacy'!G42","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'P. Privacy'!H42","v":8.1999999999999993},{"$f":"'P. Privacy'!I42","v":"Information Classification"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A43","v":3724},{"$f":"'P. Privacy'!J43","v":2},{"$f":"'P. Privacy'!K43","v":0},{"$f":"'P. Privacy'!Y43","v":1},{"$f":"'P. Privacy'!B43","v":"P.7.1"},{"$f":"'P. Privacy'!C43","v":"Are there documented policies, procedures, and controls to limit access based on need to know or minimum necessary for constituents? If yes, describe."},{"$f":"'P. Privacy'!D43","v":0},{"$f":"'P. Privacy'!E43","v":0},{"$f":"'P. Privacy'!F43","v":0},{"$f":"'P. Privacy'!G43","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"'P. Privacy'!H43","v":"9.1.1.b"},{"$f":"'P. Privacy'!I43","v":"Access control policy"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A44","v":3235},{"$f":"'P. Privacy'!J44","v":1},{"$f":"'P. Privacy'!K44","v":0},{"$f":"'P. Privacy'!Y44","v":0},{"$f":"'P. Privacy'!B44","v":"P.8"},{"$f":"'P. Privacy'!C44","v":"Is personal information collected directly from individuals? If yes, describe."},{"$f":"'P. Privacy'!D44","v":0},{"$f":"'P. Privacy'!E44","v":0},{"$f":"'P. Privacy'!F44","v":0},{"$f":"'P. Privacy'!G44","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"'P. Privacy'!H44","v":"NA"},{"$f":"'P. Privacy'!I44","v":0},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A45","v":3236},{"$f":"'P. Privacy'!J45","v":1},{"$f":"'P. Privacy'!K45","v":0},{"$f":"'P. Privacy'!Y45","v":0},{"$f":"'P. Privacy'!B45","v":"P.9"},{"$f":"'P. Privacy'!C45","v":"Are controls in place to ensure that the collection of personal information is limited?"},{"$f":"'P. Privacy'!D45","v":0},{"$f":"'P. Privacy'!E45","v":0},{"$f":"'P. Privacy'!F45","v":0},{"$f":"'P. Privacy'!G45","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"'P. Privacy'!H45","v":"8.2.3"},{"$f":"'P. Privacy'!I45","v":"Handling of assets"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A46","v":3237},{"$f":"'P. Privacy'!J46","v":1},{"$f":"'P. Privacy'!K46","v":0},{"$f":"'P. Privacy'!Y46","v":0},{"$f":"'P. Privacy'!B46","v":"P.10"},{"$f":"'P. Privacy'!C46","v":"Are controls in place to ensure that the collection and usage of personal information is limited and in compliance with applicable law?"},{"$f":"'P. Privacy'!D46","v":0},{"$f":"'P. Privacy'!E46","v":0},{"$f":"'P. Privacy'!F46","v":0},{"$f":"'P. Privacy'!G46","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"'P. Privacy'!H46","v":"8.2.3"},{"$f":"'P. Privacy'!I46","v":"Handling of assets"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A47","v":3860},{"$f":"'P. Privacy'!J47","v":2},{"$f":"'P. Privacy'!K47","v":0},{"$f":"'P. Privacy'!Y47","v":0},{"$f":"'P. Privacy'!B47","v":"P.10.1"},{"$f":"'P. Privacy'!C47","v":"Are there enforcement mechanisms in place to address complaints, disputes, and recourse for violations of privacy compliance?"},{"$f":"'P. Privacy'!D47","v":0},{"$f":"'P. Privacy'!E47","v":0},{"$f":"'P. Privacy'!F47","v":0},{"$f":"'P. Privacy'!G47","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"'P. Privacy'!H47","v":"NA"},{"$f":"'P. Privacy'!I47","v":0},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A48","v":3729},{"$f":"'P. Privacy'!J48","v":1},{"$f":"'P. Privacy'!K48","v":0},{"$f":"'P. Privacy'!Y48","v":1},{"$f":"'P. Privacy'!B48","v":"P.11"},{"$f":"'P. Privacy'!C48","v":" Are transactions for covered accounts accessed, modified, or processed, including address changes and discrepancies? If yes, describe."},{"$f":"'P. Privacy'!D48","v":0},{"$f":"'P. Privacy'!E48","v":0},{"$f":"'P. Privacy'!F48","v":0},{"$f":"'P. Privacy'!G48","v":0},{"$f":"'P. Privacy'!H48","v":"NA"},{"$f":"'P. Privacy'!I48","v":0},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A49","v":3730},{"$f":"'P. Privacy'!J49","v":2},{"$f":"'P. Privacy'!K49","v":0},{"$f":"'P. Privacy'!Y49","v":0},{"$f":"'P. Privacy'!B49","v":"P.11.1"},{"$f":"'P. Privacy'!C49","v":"Is there a documented identify theft prevention program approved by management in place to detect, prevent, and mitigate identify theft?"},{"$f":"'P. Privacy'!D49","v":0},{"$f":"'P. Privacy'!E49","v":0},{"$f":"'P. Privacy'!F49","v":0},{"$f":"'P. Privacy'!G49","v":0},{"$f":"'P. Privacy'!H49","v":"NA"},{"$f":"'P. Privacy'!I49","v":0},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A50","v":3731},{"$f":"'P. Privacy'!J50","v":2},{"$f":"'P. Privacy'!K50","v":0},{"$f":"'P. Privacy'!Y50","v":0},{"$f":"'P. Privacy'!B50","v":"P.11.2"},{"$f":"'P. Privacy'!C50","v":"Are there documented policies and procedures for identifying and responding to relevant red flags on covered accounts, including address changes and discrepancies?"},{"$f":"'P. Privacy'!D50","v":0},{"$f":"'P. Privacy'!E50","v":0},{"$f":"'P. Privacy'!F50","v":0},{"$f":"'P. Privacy'!G50","v":0},{"$f":"'P. Privacy'!H50","v":"NA"},{"$f":"'P. Privacy'!I50","v":0},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A51","v":3861},{"$f":"'P. Privacy'!J51","v":2},{"$f":"'P. Privacy'!K51","v":0},{"$f":"'P. Privacy'!Y51","v":0},{"$f":"'P. Privacy'!B51","v":"P.11.3"},{"$f":"'P. Privacy'!C51","v":"Is customer data transmitted, processed, or stored that can be classified as consumer report information provided by a consumer reporting agency?"},{"$f":"'P. Privacy'!D51","v":0},{"$f":"'P. Privacy'!E51","v":0},{"$f":"'P. Privacy'!F51","v":0},{"$f":"'P. Privacy'!G51","v":0},{"$f":"'P. Privacy'!H51","v":8.1999999999999993},{"$f":"'P. Privacy'!I51","v":"Information Classification"},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A52","v":3862},{"$f":"'P. Privacy'!J52","v":1},{"$f":"'P. Privacy'!K52","v":0},{"$f":"'P. Privacy'!Y52","v":0},{"$f":"'P. Privacy'!B52","v":"P.12"},{"$f":"'P. Privacy'!C52","v":"Is there a compliance risk management system that addresses the quality and accuracy of reported consumer data?"},{"$f":"'P. Privacy'!D52","v":0},{"$f":"'P. Privacy'!E52","v":0},{"$f":"'P. Privacy'!F52","v":0},{"$f":"'P. Privacy'!G52","v":0},{"$f":"'P. Privacy'!H52","v":"NA"},{"$f":"'P. Privacy'!I52","v":0},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A53","v":3863},{"$f":"'P. Privacy'!J53","v":2},{"$f":"'P. Privacy'!K53","v":0},{"$f":"'P. Privacy'!Y53","v":0},{"$f":"'P. Privacy'!B53","v":"P.12.1"},{"$f":"'P. Privacy'!C53","v":"Is there a compliance risk management system that addresses the quality of assembling and maintaining the data?"},{"$f":"'P. Privacy'!D53","v":0},{"$f":"'P. Privacy'!E53","v":0},{"$f":"'P. Privacy'!F53","v":0},{"$f":"'P. Privacy'!G53","v":0},{"$f":"'P. Privacy'!H53","v":"NA"},{"$f":"'P. Privacy'!I53","v":0},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A54","v":3864},{"$f":"'P. Privacy'!J54","v":2},{"$f":"'P. Privacy'!K54","v":0},{"$f":"'P. Privacy'!Y54","v":0},{"$f":"'P. Privacy'!B54","v":"P.12.2"},{"$f":"'P. Privacy'!C54","v":"Is there a mechanism in place for resolving consumer disputes?"},{"$f":"'P. Privacy'!D54","v":0},{"$f":"'P. Privacy'!E54","v":0},{"$f":"'P. Privacy'!F54","v":0},{"$f":"'P. Privacy'!G54","v":0},{"$f":"'P. Privacy'!H54","v":"NA"},{"$f":"'P. Privacy'!I54","v":0},null,null,null,"N/A"]
[{"$f":"'P. Privacy'!A55","v":0},{"$f":"'P. Privacy'!J55","v":0},{"$f":"'P. Privacy'!K55","v":0},{"$f":"'P. Privacy'!Y55","v":0},{"$f":"'P. Privacy'!B55","v":0},{"$f":"'P. Privacy'!C55","v":0},{"$f":"'P. Privacy'!D55","v":0},{"$f":"'P. Privacy'!E55","v":0},{"$f":"'P. Privacy'!F55","v":0},{"$f":"'P. Privacy'!G55","v":0},{"$f":"'P. Privacy'!H55","v":0},{"$f":"'P. Privacy'!I55","v":0}]
[{"$f":"'P. Privacy'!A56","v":0},{"$f":"'P. Privacy'!J56","v":0},{"$f":"'P. Privacy'!K56","v":0},{"$f":"'P. Privacy'!Y56","v":0},{"$f":"'P. Privacy'!B56","v":0},{"$f":"'P. Privacy'!C56","v":0},{"$f":"'P. Privacy'!D56","v":0},{"$f":"'P. Privacy'!E56","v":0},{"$f":"'P. Privacy'!F56","v":0},{"$f":"'P. Privacy'!G56","v":0},{"$f":"'P. Privacy'!H56","v":0},{"$f":"'P. Privacy'!I56","v":0}]
[{"$f":"'Q. Software Security'!B1","v":"Q. Software Application Security"},null,null,null,{"$f":"'Q. Software Security'!B1","v":"Q. Software Application Security"}]
[{"$f":"'Q. Software Security'!A5","v":3919},{"$f":"'Q. Software Security'!J5","v":1},{"$f":"'Q. Software Security'!K5","v":0},{"$f":"'Q. Software Security'!Y5","v":1},{"$f":"'Q. Software Security'!B5","v":"Q.1"},{"$f":"'Q. Software Security'!C5","v":"Is Software provided? "},{"$f":"'Q. Software Security'!D5","v":0},{"$f":"'Q. Software Security'!E5","v":0},{"$f":"'Q. Software Security'!F5","v":0},{"$f":"'Q. Software Security'!G5","v":"Q. Software Application Security"},{"$f":"'Q. Software Security'!H5","v":"NA"},{"$f":"'Q. Software Security'!I5","v":0},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A6","v":3920},{"$f":"'Q. Software Security'!J6","v":2},{"$f":"'Q. Software Security'!K6","v":0},{"$f":"'Q. Software Security'!Y6","v":1},{"$f":"'Q. Software Security'!B6","v":"Q.1.1"},{"$f":"'Q. Software Security'!C6","v":"Is there a secure software development lifecycle policy (including mobile software applications) that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"'Q. Software Security'!D6","v":0},{"$f":"'Q. Software Security'!E6","v":0},{"$f":"'Q. Software Security'!F6","v":0},{"$f":"'Q. Software Security'!G6","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!H6","v":"14.2.1 "},{"$f":"'Q. Software Security'!I6","v":"Secure development policy"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A7","v":3921},{"$f":"'Q. Software Security'!J7","v":3},{"$f":"'Q. Software Security'!K7","v":0},{"$f":"'Q. Software Security'!Y7","v":0},{"$f":"'Q. Software Security'!B7","v":"Q.1.1.1"},{"$f":"'Q. Software Security'!C7","v":"Has the policy been reviewed in the last 12 months? If yes, did it include:"},{"$f":"'Q. Software Security'!D7","v":0},{"$f":"'Q. Software Security'!E7","v":0},{"$f":"'Q. Software Security'!F7","v":0},{"$f":"'Q. Software Security'!G7","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!H7","v":"5.1.2"},{"$f":"'Q. Software Security'!I7","v":"Review of policies for information security"},null,null,null,"12.1.1"]
[{"$f":"'Q. Software Security'!A8","v":3922},{"$f":"'Q. Software Security'!J8","v":4},{"$f":"'Q. Software Security'!K8","v":0},{"$f":"'Q. Software Security'!Y8","v":0},{"$f":"'Q. Software Security'!B8","v":"Q.1.1.1.1"},{"$f":"'Q. Software Security'!C8","v":"Feedback from interested parties?"},{"$f":"'Q. Software Security'!D8","v":0},{"$f":"'Q. Software Security'!E8","v":0},{"$f":"'Q. Software Security'!F8","v":0},{"$f":"'Q. Software Security'!G8","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!H8","v":"5.1.2"},{"$f":"'Q. Software Security'!I8","v":"Review of policies for information security"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A9","v":3923},{"$f":"'Q. Software Security'!J9","v":4},{"$f":"'Q. Software Security'!K9","v":0},{"$f":"'Q. Software Security'!Y9","v":0},{"$f":"'Q. Software Security'!B9","v":"Q.1.1.1.2"},{"$f":"'Q. Software Security'!C9","v":"Results of independent reviews?"},{"$f":"'Q. Software Security'!D9","v":0},{"$f":"'Q. Software Security'!E9","v":0},{"$f":"'Q. Software Security'!F9","v":0},{"$f":"'Q. Software Security'!G9","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!H9","v":"5.1.2"},{"$f":"'Q. Software Security'!I9","v":"Review of policies for information security"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A10","v":3924},{"$f":"'Q. Software Security'!J10","v":4},{"$f":"'Q. Software Security'!K10","v":0},{"$f":"'Q. Software Security'!Y10","v":0},{"$f":"'Q. Software Security'!B10","v":"Q.1.1.1.3"},{"$f":"'Q. Software Security'!C10","v":"Policy compliance?"},{"$f":"'Q. Software Security'!D10","v":0},{"$f":"'Q. Software Security'!E10","v":0},{"$f":"'Q. Software Security'!F10","v":0},{"$f":"'Q. Software Security'!G10","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!H10","v":"5.1.2"},{"$f":"'Q. Software Security'!I10","v":"Review of policies for information security"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A11","v":3925},{"$f":"'Q. Software Security'!J11","v":4},{"$f":"'Q. Software Security'!K11","v":0},{"$f":"'Q. Software Security'!Y11","v":0},{"$f":"'Q. Software Security'!B11","v":"Q.1.1.1.4"},{"$f":"'Q. Software Security'!C11","v":"Changes that could affect the approach to managing information security?"},{"$f":"'Q. Software Security'!D11","v":0},{"$f":"'Q. Software Security'!E11","v":0},{"$f":"'Q. Software Security'!F11","v":0},{"$f":"'Q. Software Security'!G11","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!H11","v":"5.1.2"},{"$f":"'Q. Software Security'!I11","v":"Review of policies for information security"},null,null,null,6.4]
[{"$f":"'Q. Software Security'!A12","v":3926},{"$f":"'Q. Software Security'!J12","v":4},{"$f":"'Q. Software Security'!K12","v":0},{"$f":"'Q. Software Security'!Y12","v":0},{"$f":"'Q. Software Security'!B12","v":"Q.1.1.1.5"},{"$f":"'Q. Software Security'!C12","v":"Reported information security incidents?"},{"$f":"'Q. Software Security'!D12","v":0},{"$f":"'Q. Software Security'!E12","v":0},{"$f":"'Q. Software Security'!F12","v":0},{"$f":"'Q. Software Security'!G12","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!H12","v":"5.1.2"},{"$f":"'Q. Software Security'!I12","v":"Review of policies for information security"},null,null,null,"12.10.1"]
[{"$f":"'Q. Software Security'!A13","v":3927},{"$f":"'Q. Software Security'!J13","v":4},{"$f":"'Q. Software Security'!K13","v":0},{"$f":"'Q. Software Security'!Y13","v":0},{"$f":"'Q. Software Security'!B13","v":"Q.1.1.1.6"},{"$f":"'Q. Software Security'!C13","v":"Recommendations provided by relevant authorities?"},{"$f":"'Q. Software Security'!D13","v":0},{"$f":"'Q. Software Security'!E13","v":0},{"$f":"'Q. Software Security'!F13","v":0},{"$f":"'Q. Software Security'!G13","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!H13","v":"5.1.2"},{"$f":"'Q. Software Security'!I13","v":"Review of policies for information security"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A14","v":3928},{"$f":"'Q. Software Security'!J14","v":4},{"$f":"'Q. Software Security'!K14","v":0},{"$f":"'Q. Software Security'!Y14","v":0},{"$f":"'Q. Software Security'!B14","v":"Q.1.1.1.7"},{"$f":"'Q. Software Security'!C14","v":"Records management?"},{"$f":"'Q. Software Security'!D14","v":0},{"$f":"'Q. Software Security'!E14","v":0},{"$f":"'Q. Software Security'!F14","v":0},{"$f":"'Q. Software Security'!G14","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!H14","v":"5.1.2"},{"$f":"'Q. Software Security'!I14","v":"Review of policies for information security"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A15","v":3929},{"$f":"'Q. Software Security'!J15","v":3},{"$f":"'Q. Software Security'!K15","v":0},{"$f":"'Q. Software Security'!Y15","v":0},{"$f":"'Q. Software Security'!B15","v":"Q.1.1.2"},{"$f":"'Q. Software Security'!C15","v":"Is there a process to approve exceptions to the policy? "},{"$f":"'Q. Software Security'!D15","v":0},{"$f":"'Q. Software Security'!E15","v":0},{"$f":"'Q. Software Security'!F15","v":0},{"$f":"'Q. Software Security'!G15","v":0},{"$f":"'Q. Software Security'!H15","v":"5.1.2"},{"$f":"'Q. Software Security'!I15","v":"Review of policies for information security"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A16","v":3930},{"$f":"'Q. Software Security'!J16","v":4},{"$f":"'Q. Software Security'!K16","v":0},{"$f":"'Q. Software Security'!Y16","v":0},{"$f":"'Q. Software Security'!B16","v":"Q.1.1.2.1"},{"$f":"'Q. Software Security'!C16","v":"Does security own the approval process?"},{"$f":"'Q. Software Security'!D16","v":0},{"$f":"'Q. Software Security'!E16","v":0},{"$f":"'Q. Software Security'!F16","v":0},{"$f":"'Q. Software Security'!G16","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!H16","v":"5.1.2"},{"$f":"'Q. Software Security'!I16","v":"Review of policies for information security"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A17","v":3931},{"$f":"'Q. Software Security'!J17","v":3},{"$f":"'Q. Software Security'!K17","v":0},{"$f":"'Q. Software Security'!Y17","v":0},{"$f":"'Q. Software Security'!B17","v":"Q.1.1.3"},{"$f":"'Q. Software Security'!C17","v":"Is the SDLC policy communicated? If yes, to:"},{"$f":"'Q. Software Security'!D17","v":0},{"$f":"'Q. Software Security'!E17","v":0},{"$f":"'Q. Software Security'!F17","v":0},{"$f":"'Q. Software Security'!G17","v":0},{"$f":"'Q. Software Security'!H17","v":"NA"},{"$f":"'Q. Software Security'!I17","v":0},null,null,null,6.3]
[{"$f":"'Q. Software Security'!A18","v":3932},{"$f":"'Q. Software Security'!J18","v":4},{"$f":"'Q. Software Security'!K18","v":0},{"$f":"'Q. Software Security'!Y18","v":0},{"$f":"'Q. Software Security'!B18","v":"Q.1.1.3.1"},{"$f":"'Q. Software Security'!C18","v":"Full time constituents?"},{"$f":"'Q. Software Security'!D18","v":0},{"$f":"'Q. Software Security'!E18","v":0},{"$f":"'Q. Software Security'!F18","v":0},{"$f":"'Q. Software Security'!G18","v":0},{"$f":"'Q. Software Security'!H18","v":"NA"},{"$f":"'Q. Software Security'!I18","v":0},null,null,null,6.7]
[{"$f":"'Q. Software Security'!A19","v":3933},{"$f":"'Q. Software Security'!J19","v":4},{"$f":"'Q. Software Security'!K19","v":0},{"$f":"'Q. Software Security'!Y19","v":0},{"$f":"'Q. Software Security'!B19","v":"Q.1.1.3.2"},{"$f":"'Q. Software Security'!C19","v":"Part time constituents?"},{"$f":"'Q. Software Security'!D19","v":0},{"$f":"'Q. Software Security'!E19","v":0},{"$f":"'Q. Software Security'!F19","v":0},{"$f":"'Q. Software Security'!G19","v":0},{"$f":"'Q. Software Security'!H19","v":"NA"},{"$f":"'Q. Software Security'!I19","v":0},null,null,null,6.7]
[{"$f":"'Q. Software Security'!A20","v":3934},{"$f":"'Q. Software Security'!J20","v":4},{"$f":"'Q. Software Security'!K20","v":0},{"$f":"'Q. Software Security'!Y20","v":0},{"$f":"'Q. Software Security'!B20","v":"Q.1.1.3.3"},{"$f":"'Q. Software Security'!C20","v":"Contractors?"},{"$f":"'Q. Software Security'!D20","v":0},{"$f":"'Q. Software Security'!E20","v":0},{"$f":"'Q. Software Security'!F20","v":0},{"$f":"'Q. Software Security'!G20","v":0},{"$f":"'Q. Software Security'!H20","v":"NA"},{"$f":"'Q. Software Security'!I20","v":0},null,null,null,6.7]
[{"$f":"'Q. Software Security'!A21","v":3935},{"$f":"'Q. Software Security'!J21","v":4},{"$f":"'Q. Software Security'!K21","v":0},{"$f":"'Q. Software Security'!Y21","v":0},{"$f":"'Q. Software Security'!B21","v":"Q.1.1.3.4"},{"$f":"'Q. Software Security'!C21","v":"Temporary workers?"},{"$f":"'Q. Software Security'!D21","v":0},{"$f":"'Q. Software Security'!E21","v":0},{"$f":"'Q. Software Security'!F21","v":0},{"$f":"'Q. Software Security'!G21","v":0},{"$f":"'Q. Software Security'!H21","v":"NA"},{"$f":"'Q. Software Security'!I21","v":0},null,null,null,6.7]
[{"$f":"'Q. Software Security'!A22","v":3936},{"$f":"'Q. Software Security'!J22","v":2},{"$f":"'Q. Software Security'!K22","v":0},{"$f":"'Q. Software Security'!Y22","v":0},{"$f":"'Q. Software Security'!B22","v":"Q.1.2"},{"$f":"'Q. Software Security'!C22","v":"Is a secure code review performed? If yes, what is the frequency:"},{"$f":"'Q. Software Security'!D22","v":0},{"$f":"'Q. Software Security'!E22","v":0},{"$f":"'Q. Software Security'!F22","v":0},{"$f":"'Q. Software Security'!G22","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!H22","v":"14.2.1 "},{"$f":"'Q. Software Security'!I22","v":"Secure development policy"},null,null,null,"6.3.2"]
[{"$f":"'Q. Software Security'!A23","v":3937},{"$f":"'Q. Software Security'!J23","v":3},{"$f":"'Q. Software Security'!K23","v":0},{"$f":"'Q. Software Security'!Y23","v":0},{"$f":"'Q. Software Security'!B23","v":"Q.1.2.1"},{"$f":"'Q. Software Security'!C23","v":"As developed?"},{"$f":"'Q. Software Security'!D23","v":0},{"$f":"'Q. Software Security'!E23","v":0},{"$f":"'Q. Software Security'!F23","v":0},{"$f":"'Q. Software Security'!G23","v":0},{"$f":"'Q. Software Security'!H23","v":"NA"},{"$f":"'Q. Software Security'!I23","v":0},null,null,null,"6.3.2"]
[{"$f":"'Q. Software Security'!A24","v":3938},{"$f":"'Q. Software Security'!J24","v":3},{"$f":"'Q. Software Security'!K24","v":0},{"$f":"'Q. Software Security'!Y24","v":0},{"$f":"'Q. Software Security'!B24","v":"Q.1.2.2"},{"$f":"'Q. Software Security'!C24","v":"Monthly?"},{"$f":"'Q. Software Security'!D24","v":0},{"$f":"'Q. Software Security'!E24","v":0},{"$f":"'Q. Software Security'!F24","v":0},{"$f":"'Q. Software Security'!G24","v":0},{"$f":"'Q. Software Security'!H24","v":"NA"},{"$f":"'Q. Software Security'!I24","v":0},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A25","v":3939},{"$f":"'Q. Software Security'!J25","v":3},{"$f":"'Q. Software Security'!K25","v":0},{"$f":"'Q. Software Security'!Y25","v":0},{"$f":"'Q. Software Security'!B25","v":"Q.1.2.3"},{"$f":"'Q. Software Security'!C25","v":"Quarterly?"},{"$f":"'Q. Software Security'!D25","v":0},{"$f":"'Q. Software Security'!E25","v":0},{"$f":"'Q. Software Security'!F25","v":0},{"$f":"'Q. Software Security'!G25","v":0},{"$f":"'Q. Software Security'!H25","v":"NA"},{"$f":"'Q. Software Security'!I25","v":0},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A26","v":3940},{"$f":"'Q. Software Security'!J26","v":3},{"$f":"'Q. Software Security'!K26","v":0},{"$f":"'Q. Software Security'!Y26","v":0},{"$f":"'Q. Software Security'!B26","v":"Q.1.2.4"},{"$f":"'Q. Software Security'!C26","v":"Annually?"},{"$f":"'Q. Software Security'!D26","v":0},{"$f":"'Q. Software Security'!E26","v":0},{"$f":"'Q. Software Security'!F26","v":0},{"$f":"'Q. Software Security'!G26","v":0},{"$f":"'Q. Software Security'!H26","v":"NA"},{"$f":"'Q. Software Security'!I26","v":0},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A27","v":3941},{"$f":"'Q. Software Security'!J27","v":3},{"$f":"'Q. Software Security'!K27","v":0},{"$f":"'Q. Software Security'!Y27","v":0},{"$f":"'Q. Software Security'!B27","v":"Q.1.2.5"},{"$f":"'Q. Software Security'!C27","v":"Other?"},{"$f":"'Q. Software Security'!D27","v":0},{"$f":"'Q. Software Security'!E27","v":0},{"$f":"'Q. Software Security'!F27","v":0},{"$f":"'Q. Software Security'!G27","v":0},{"$f":"'Q. Software Security'!H27","v":"NA"},{"$f":"'Q. Software Security'!I27","v":0},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A28","v":3942},{"$f":"'Q. Software Security'!J28","v":3},{"$f":"'Q. Software Security'!K28","v":0},{"$f":"'Q. Software Security'!Y28","v":0},{"$f":"'Q. Software Security'!B28","v":"Q.1.2.6"},{"$f":"'Q. Software Security'!C28","v":"Third party review?"},{"$f":"'Q. Software Security'!D28","v":0},{"$f":"'Q. Software Security'!E28","v":0},{"$f":"'Q. Software Security'!F28","v":0},{"$f":"'Q. Software Security'!G28","v":0},{"$f":"'Q. Software Security'!H28","v":"NA"},{"$f":"'Q. Software Security'!I28","v":0},null,null,null,"6.3.2"]
[{"$f":"'Q. Software Security'!A29","v":3943},{"$f":"'Q. Software Security'!J29","v":2},{"$f":"'Q. Software Security'!K29","v":0},{"$f":"'Q. Software Security'!Y29","v":0},{"$f":"'Q. Software Security'!B29","v":"Q.1.3"},{"$f":"'Q. Software Security'!C29","v":"Are applications given ratings that reflect the types of data accessed (e.g., high, medium low)?"},{"$f":"'Q. Software Security'!D29","v":0},{"$f":"'Q. Software Security'!E29","v":0},{"$f":"'Q. Software Security'!F29","v":0},{"$f":"'Q. Software Security'!G29","v":"Q. 3 Risk Classification"},{"$f":"'Q. Software Security'!H29","v":"14.1.1 "},{"$f":"'Q. Software Security'!I29","v":"Information security requirements analysis and specification"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A30","v":3944},{"$f":"'Q. Software Security'!J30","v":2},{"$f":"'Q. Software Security'!K30","v":0},{"$f":"'Q. Software Security'!Y30","v":0},{"$f":"'Q. Software Security'!B30","v":"Q.1.4"},{"$f":"'Q. Software Security'!C30","v":"Are the risks from internal and external sources clearly understood based on risk exposure?"},{"$f":"'Q. Software Security'!D30","v":0},{"$f":"'Q. Software Security'!E30","v":0},{"$f":"'Q. Software Security'!F30","v":0},{"$f":"'Q. Software Security'!G30","v":"Q. 3 Risk Classification"},{"$f":"'Q. Software Security'!H30","v":"14.1.1 "},{"$f":"'Q. Software Security'!I30","v":"Information security requirements analysis and specification"},null,null,null,12.2]
[{"$f":"'Q. Software Security'!A31","v":3945},{"$f":"'Q. Software Security'!J31","v":2},{"$f":"'Q. Software Security'!K31","v":0},{"$f":"'Q. Software Security'!Y31","v":0},{"$f":"'Q. Software Security'!B31","v":"Q.1.5"},{"$f":"'Q. Software Security'!C31","v":"Is there a Software Security Group responsible for application security?"},{"$f":"'Q. Software Security'!D31","v":0},{"$f":"'Q. Software Security'!E31","v":0},{"$f":"'Q. Software Security'!F31","v":0},{"$f":"'Q. Software Security'!G31","v":0},{"$f":"'Q. Software Security'!H31","v":"14.2.8"},{"$f":"'Q. Software Security'!I31","v":"Software testing"},null,null,null,12.5]
[{"$f":"'Q. Software Security'!A32","v":3946},{"$f":"'Q. Software Security'!J32","v":2},{"$f":"'Q. Software Security'!K32","v":0},{"$f":"'Q. Software Security'!Y32","v":0},{"$f":"'Q. Software Security'!B32","v":"Q.1.6"},{"$f":"'Q. Software Security'!C32","v":"Is a security architecture risk analysis performed when new platforms are designed? If yes, does it include:"},{"$f":"'Q. Software Security'!D32","v":0},{"$f":"'Q. Software Security'!E32","v":0},{"$f":"'Q. Software Security'!F32","v":0},{"$f":"'Q. Software Security'!G32","v":"Q.4 Secure Architectural Design Standards"},{"$f":"'Q. Software Security'!H32","v":"14.1.1 "},{"$f":"'Q. Software Security'!I32","v":"Information security requirements analysis and specification"},null,null,null,6.1]
[{"$f":"'Q. Software Security'!A33","v":3947},{"$f":"'Q. Software Security'!J33","v":3},{"$f":"'Q. Software Security'!K33","v":0},{"$f":"'Q. Software Security'!Y33","v":0},{"$f":"'Q. Software Security'!B33","v":"Q.1.6.1"},{"$f":"'Q. Software Security'!C33","v":"Security feature review i.e., authentication, access controls, use of cryptography, etc.?"},{"$f":"'Q. Software Security'!D33","v":0},{"$f":"'Q. Software Security'!E33","v":0},{"$f":"'Q. Software Security'!F33","v":0},{"$f":"'Q. Software Security'!G33","v":"Q.4 Secure Architectural Design Standards"},{"$f":"'Q. Software Security'!H33","v":"14.1.1 "},{"$f":"'Q. Software Security'!I33","v":"Information security requirements analysis and specification"},null,null,null,6.1]
[{"$f":"'Q. Software Security'!A34","v":3948},{"$f":"'Q. Software Security'!J34","v":3},{"$f":"'Q. Software Security'!K34","v":0},{"$f":"'Q. Software Security'!Y34","v":0},{"$f":"'Q. Software Security'!B34","v":"Q.1.6.2"},{"$f":"'Q. Software Security'!C34","v":"Security architecture design review for high risk applications?"},{"$f":"'Q. Software Security'!D34","v":0},{"$f":"'Q. Software Security'!E34","v":0},{"$f":"'Q. Software Security'!F34","v":0},{"$f":"'Q. Software Security'!G34","v":"Q.4 Secure Architectural Design Standards"},{"$f":"'Q. Software Security'!H34","v":"14.1.1 "},{"$f":"'Q. Software Security'!I34","v":"Information security requirements analysis and specification"},null,null,null,6.3]
[{"$f":"'Q. Software Security'!A35","v":3949},{"$f":"'Q. Software Security'!J35","v":3},{"$f":"'Q. Software Security'!K35","v":0},{"$f":"'Q. Software Security'!Y35","v":0},{"$f":"'Q. Software Security'!B35","v":"Q.1.6.3"},{"$f":"'Q. Software Security'!C35","v":"Threat modeling into the business requirements/design process of the SDLC?"},{"$f":"'Q. Software Security'!D35","v":0},{"$f":"'Q. Software Security'!E35","v":0},{"$f":"'Q. Software Security'!F35","v":0},{"$f":"'Q. Software Security'!G35","v":"Q.4 Secure Architectural Design Standards"},{"$f":"'Q. Software Security'!H35","v":"14.2.9"},{"$f":"'Q. Software Security'!I35","v":"System acceptance testing"},null,null,null,6.1]
[{"$f":"'Q. Software Security'!A36","v":3950},{"$f":"'Q. Software Security'!J36","v":3},{"$f":"'Q. Software Security'!K36","v":0},{"$f":"'Q. Software Security'!Y36","v":0},{"$f":"'Q. Software Security'!B36","v":"Q.1.6.4"},{"$f":"'Q. Software Security'!C36","v":"Review when major changes are introduced into applications?"},{"$f":"'Q. Software Security'!D36","v":0},{"$f":"'Q. Software Security'!E36","v":0},{"$f":"'Q. Software Security'!F36","v":0},{"$f":"'Q. Software Security'!G36","v":0},{"$f":"'Q. Software Security'!H36","v":"14.2.2"},{"$f":"'Q. Software Security'!I36","v":"System change control procedures"},null,null,null,6.4]
[{"$f":"'Q. Software Security'!A37","v":3951},{"$f":"'Q. Software Security'!J37","v":2},{"$f":"'Q. Software Security'!K37","v":0},{"$f":"'Q. Software Security'!Y37","v":0},{"$f":"'Q. Software Security'!B37","v":"Q.1.7"},{"$f":"'Q. Software Security'!C37","v":"Is there a secure application development life cycle process? If yes, does it include:"},{"$f":"'Q. Software Security'!D37","v":0},{"$f":"'Q. Software Security'!E37","v":0},{"$f":"'Q. Software Security'!F37","v":0},{"$f":"'Q. Software Security'!G37","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!H37","v":"14.2.1"},{"$f":"'Q. Software Security'!I37","v":"Secure development policy"},null,null,null,6.3]
[{"$f":"'Q. Software Security'!A38","v":3952},{"$f":"'Q. Software Security'!J38","v":3},{"$f":"'Q. Software Security'!K38","v":0},{"$f":"'Q. Software Security'!Y38","v":0},{"$f":"'Q. Software Security'!B38","v":"Q.1.7.1"},{"$f":"'Q. Software Security'!C38","v":"Common vulnerabilities/bugs that need to be eliminated?"},{"$f":"'Q. Software Security'!D38","v":0},{"$f":"'Q. Software Security'!E38","v":0},{"$f":"'Q. Software Security'!F38","v":0},{"$f":"'Q. Software Security'!G38","v":0},{"$f":"'Q. Software Security'!H38","v":"14.2.1"},{"$f":"'Q. Software Security'!I38","v":"Secure development policy"},null,null,null,"6.1, 6.5"]
[{"$f":"'Q. Software Security'!A39","v":3953},{"$f":"'Q. Software Security'!J39","v":3},{"$f":"'Q. Software Security'!K39","v":0},{"$f":"'Q. Software Security'!Y39","v":0},{"$f":"'Q. Software Security'!B39","v":"Q.1.7.2"},{"$f":"'Q. Software Security'!C39","v":"Secure code reviews against the entire code base in the development phase?"},{"$f":"'Q. Software Security'!D39","v":0},{"$f":"'Q. Software Security'!E39","v":0},{"$f":"'Q. Software Security'!F39","v":0},{"$f":"'Q. Software Security'!G39","v":"Q.5 Secure Code Review"},{"$f":"'Q. Software Security'!H39","v":14.2},{"$f":"'Q. Software Security'!I39","v":"Security in development and support processes"},null,null,null,"6.3.2"]
[{"$f":"'Q. Software Security'!A40","v":3954},{"$f":"'Q. Software Security'!J40","v":3},{"$f":"'Q. Software Security'!K40","v":0},{"$f":"'Q. Software Security'!Y40","v":0},{"$f":"'Q. Software Security'!B40","v":"Q.1.7.3"},{"$f":"'Q. Software Security'!C40","v":"Review by qualified individual?"},{"$f":"'Q. Software Security'!D40","v":0},{"$f":"'Q. Software Security'!E40","v":0},{"$f":"'Q. Software Security'!F40","v":0},{"$f":"'Q. Software Security'!G40","v":"Q.5 Secure Code Review"},{"$f":"'Q. Software Security'!H40","v":"14.2.1.g"},{"$f":"'Q. Software Security'!I40","v":"Secure development policy"},null,null,null,"6.3.2"]
[{"$f":"'Q. Software Security'!A41","v":3955},{"$f":"'Q. Software Security'!J41","v":3},{"$f":"'Q. Software Security'!K41","v":0},{"$f":"'Q. Software Security'!Y41","v":0},{"$f":"'Q. Software Security'!B41","v":"Q.1.7.4"},{"$f":"'Q. Software Security'!C41","v":"Use of automated code review tools?"},{"$f":"'Q. Software Security'!D41","v":0},{"$f":"'Q. Software Security'!E41","v":0},{"$f":"'Q. Software Security'!F41","v":0},{"$f":"'Q. Software Security'!G41","v":"Q.5 Secure Code Review"},{"$f":"'Q. Software Security'!H41","v":"14.2.9"},{"$f":"'Q. Software Security'!I41","v":"System acceptance testing"},null,null,null,"6.3.2"]
[{"$f":"'Q. Software Security'!A42","v":3956},{"$f":"'Q. Software Security'!J42","v":3},{"$f":"'Q. Software Security'!K42","v":0},{"$f":"'Q. Software Security'!Y42","v":0},{"$f":"'Q. Software Security'!B42","v":"Q.1.7.5"},{"$f":"'Q. Software Security'!C42","v":"Remediation of findings?"},{"$f":"'Q. Software Security'!D42","v":0},{"$f":"'Q. Software Security'!E42","v":0},{"$f":"'Q. Software Security'!F42","v":0},{"$f":"'Q. Software Security'!G42","v":"Q.5 Secure Code Review"},{"$f":"'Q. Software Security'!H42","v":"14.2.9"},{"$f":"'Q. Software Security'!I42","v":"System acceptance testing"},null,null,null,"6.3.2"]
[{"$f":"'Q. Software Security'!A43","v":3957},{"$f":"'Q. Software Security'!J43","v":3},{"$f":"'Q. Software Security'!K43","v":0},{"$f":"'Q. Software Security'!Y43","v":0},{"$f":"'Q. Software Security'!B43","v":"Q.1.7.6"},{"$f":"'Q. Software Security'!C43","v":"Formal software security training for developers?"},{"$f":"'Q. Software Security'!D43","v":0},{"$f":"'Q. Software Security'!E43","v":0},{"$f":"'Q. Software Security'!F43","v":0},{"$f":"'Q. Software Security'!G43","v":0},{"$f":"'Q. Software Security'!H43","v":"7.2.2"},{"$f":"'Q. Software Security'!I43","v":" Information security awareness, education and training"},null,null,null,6.5]
[{"$f":"'Q. Software Security'!A44","v":3958},{"$f":"'Q. Software Security'!J44","v":3},{"$f":"'Q. Software Security'!K44","v":0},{"$f":"'Q. Software Security'!Y44","v":0},{"$f":"'Q. Software Security'!B44","v":"Q.1.7.7"},{"$f":"'Q. Software Security'!C44","v":"Security experts that work with developers for every application?"},{"$f":"'Q. Software Security'!D44","v":0},{"$f":"'Q. Software Security'!E44","v":0},{"$f":"'Q. Software Security'!F44","v":0},{"$f":"'Q. Software Security'!G44","v":0},{"$f":"'Q. Software Security'!H44","v":"14.2.5 "},{"$f":"'Q. Software Security'!I44","v":"Secure system engineering principles"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A45","v":3959},{"$f":"'Q. Software Security'!J45","v":3},{"$f":"'Q. Software Security'!K45","v":0},{"$f":"'Q. Software Security'!Y45","v":0},{"$f":"'Q. Software Security'!B45","v":"Q.1.7.8"},{"$f":"'Q. Software Security'!C45","v":"Outsourcing development? If yes, describe:"},{"$f":"'Q. Software Security'!D45","v":0},{"$f":"'Q. Software Security'!E45","v":0},{"$f":"'Q. Software Security'!F45","v":0},{"$f":"'Q. Software Security'!G45","v":0},{"$f":"'Q. Software Security'!H45","v":"14.2.7"},{"$f":"'Q. Software Security'!I45","v":"Outsourced development"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A46","v":3960},{"$f":"'Q. Software Security'!J46","v":3},{"$f":"'Q. Software Security'!K46","v":0},{"$f":"'Q. Software Security'!Y46","v":0},{"$f":"'Q. Software Security'!B46","v":"Q.1.7.9"},{"$f":"'Q. Software Security'!C46","v":"All developers subject to the SDLC?"},{"$f":"'Q. Software Security'!D46","v":0},{"$f":"'Q. Software Security'!E46","v":0},{"$f":"'Q. Software Security'!F46","v":0},{"$f":"'Q. Software Security'!G46","v":0},{"$f":"'Q. Software Security'!H46","v":"14.2.7.b"},{"$f":"'Q. Software Security'!I46","v":"Outsourced development"},null,null,null,"6.3.b"]
[{"$f":"'Q. Software Security'!A47","v":3961},{"$f":"'Q. Software Security'!J47","v":3},{"$f":"'Q. Software Security'!K47","v":0},{"$f":"'Q. Software Security'!Y47","v":0},{"$f":"'Q. Software Security'!B47","v":"Q.1.7.10"},{"$f":"'Q. Software Security'!C47","v":"Identification of security defects documented and communicated with development to prevent reoccurrence?"},{"$f":"'Q. Software Security'!D47","v":0},{"$f":"'Q. Software Security'!E47","v":0},{"$f":"'Q. Software Security'!F47","v":0},{"$f":"'Q. Software Security'!G47","v":"Q.5 Secure Code Review"},{"$f":"'Q. Software Security'!H47","v":"14.2.7.c"},{"$f":"'Q. Software Security'!I47","v":"Outsourced development"},null,null,null,"12.5.3"]
[{"$f":"'Q. Software Security'!A48","v":3962},{"$f":"'Q. Software Security'!J48","v":2},{"$f":"'Q. Software Security'!K48","v":0},{"$f":"'Q. Software Security'!Y48","v":0},{"$f":"'Q. Software Security'!B48","v":"Q.1.8"},{"$f":"'Q. Software Security'!C48","v":"Is there a QA and/or UAT process? If yes does it include:"},{"$f":"'Q. Software Security'!D48","v":0},{"$f":"'Q. Software Security'!E48","v":0},{"$f":"'Q. Software Security'!F48","v":0},{"$f":"'Q. Software Security'!G48","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!H48","v":"NA"},{"$f":"'Q. Software Security'!I48","v":0},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A49","v":3963},{"$f":"'Q. Software Security'!J49","v":3},{"$f":"'Q. Software Security'!K49","v":0},{"$f":"'Q. Software Security'!Y49","v":0},{"$f":"'Q. Software Security'!B49","v":"Q.1.8.1"},{"$f":"'Q. Software Security'!C49","v":"Edge/boundary value condition testing? "},{"$f":"'Q. Software Security'!D49","v":0},{"$f":"'Q. Software Security'!E49","v":0},{"$f":"'Q. Software Security'!F49","v":0},{"$f":"'Q. Software Security'!G49","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!H49","v":"NA"},{"$f":"'Q. Software Security'!I49","v":0},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A50","v":3964},{"$f":"'Q. Software Security'!J50","v":3},{"$f":"'Q. Software Security'!K50","v":0},{"$f":"'Q. Software Security'!Y50","v":0},{"$f":"'Q. Software Security'!B50","v":"Q.1.8.2"},{"$f":"'Q. Software Security'!C50","v":"Testing procedures to determine whether security features are effective? If yes, are they:"},{"$f":"'Q. Software Security'!D50","v":0},{"$f":"'Q. Software Security'!E50","v":0},{"$f":"'Q. Software Security'!F50","v":0},{"$f":"'Q. Software Security'!G50","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!H50","v":"14.2.8"},{"$f":"'Q. Software Security'!I50","v":"System security testing"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A51","v":3965},{"$f":"'Q. Software Security'!J51","v":4},{"$f":"'Q. Software Security'!K51","v":0},{"$f":"'Q. Software Security'!Y51","v":0},{"$f":"'Q. Software Security'!B51","v":"Q.1.8.2.1"},{"$f":"'Q. Software Security'!C51","v":"Derived by obtaining a list of security features by the architecture group?"},{"$f":"'Q. Software Security'!D51","v":0},{"$f":"'Q. Software Security'!E51","v":0},{"$f":"'Q. Software Security'!F51","v":0},{"$f":"'Q. Software Security'!G51","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!H51","v":"14.2.5"},{"$f":"'Q. Software Security'!I51","v":"Secure system engineering principles"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A52","v":3966},{"$f":"'Q. Software Security'!J52","v":3},{"$f":"'Q. Software Security'!K52","v":0},{"$f":"'Q. Software Security'!Y52","v":0},{"$f":"'Q. Software Security'!B52","v":"Q.1.8.3"},{"$f":"'Q. Software Security'!C52","v":"Dynamic scanning against web based applications while in the Q/A phase? If no, is there a:"},{"$f":"'Q. Software Security'!D52","v":0},{"$f":"'Q. Software Security'!E52","v":0},{"$f":"'Q. Software Security'!F52","v":0},{"$f":"'Q. Software Security'!G52","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!H52","v":"14.2.9"},{"$f":"'Q. Software Security'!I52","v":"System acceptance testing"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A53","v":3967},{"$f":"'Q. Software Security'!J53","v":4},{"$f":"'Q. Software Security'!K53","v":0},{"$f":"'Q. Software Security'!Y53","v":0},{"$f":"'Q. Software Security'!B53","v":"Q.1.8.3.1"},{"$f":"'Q. Software Security'!C53","v":"Form of black box testing or scripts specific to abuse cases that are used? "},{"$f":"'Q. Software Security'!D53","v":0},{"$f":"'Q. Software Security'!E53","v":0},{"$f":"'Q. Software Security'!F53","v":0},{"$f":"'Q. Software Security'!G53","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!H53","v":"NA"},{"$f":"'Q. Software Security'!I53","v":0},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A54","v":3968},{"$f":"'Q. Software Security'!J54","v":3},{"$f":"'Q. Software Security'!K54","v":0},{"$f":"'Q. Software Security'!Y54","v":0},{"$f":"'Q. Software Security'!B54","v":"Q.1.8.4"},{"$f":"'Q. Software Security'!C54","v":"Remediation of security vulnerabilities identified?"},{"$f":"'Q. Software Security'!D54","v":0},{"$f":"'Q. Software Security'!E54","v":0},{"$f":"'Q. Software Security'!F54","v":0},{"$f":"'Q. Software Security'!G54","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!H54","v":"14.2.9"},{"$f":"'Q. Software Security'!I54","v":"System acceptance testing"},null,null,null,"12.5.2"]
[{"$f":"'Q. Software Security'!A55","v":3969},{"$f":"'Q. Software Security'!J55","v":3},{"$f":"'Q. Software Security'!K55","v":0},{"$f":"'Q. Software Security'!Y55","v":0},{"$f":"'Q. Software Security'!B55","v":"Q.1.8.5"},{"$f":"'Q. Software Security'!C55","v":"Fuzz testing (e.g., small #'s, large #'s, negative values, binary sequences, command line inputs, random values, etc.}?"},{"$f":"'Q. Software Security'!D55","v":0},{"$f":"'Q. Software Security'!E55","v":0},{"$f":"'Q. Software Security'!F55","v":0},{"$f":"'Q. Software Security'!G55","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!H55","v":"NA"},{"$f":"'Q. Software Security'!I55","v":0},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A56","v":3970},{"$f":"'Q. Software Security'!J56","v":2},{"$f":"'Q. Software Security'!K56","v":0},{"$f":"'Q. Software Security'!Y56","v":0},{"$f":"'Q. Software Security'!B56","v":"Q.1.9"},{"$f":"'Q. Software Security'!C56","v":"Is each release subject to a full secure code review?"},{"$f":"'Q. Software Security'!D56","v":0},{"$f":"'Q. Software Security'!E56","v":0},{"$f":"'Q. Software Security'!F56","v":0},{"$f":"'Q. Software Security'!G56","v":"Q.5 Secure Code Review"},{"$f":"'Q. Software Security'!H56","v":"14.2.1"},{"$f":"'Q. Software Security'!I56","v":"Secure development policy"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A57","v":3971},{"$f":"'Q. Software Security'!J57","v":2},{"$f":"'Q. Software Security'!K57","v":0},{"$f":"'Q. Software Security'!Y57","v":0},{"$f":"'Q. Software Security'!B57","v":"Q.1.10"},{"$f":"'Q. Software Security'!C57","v":"Are penetration tests performed? If yes, are they:"},{"$f":"'Q. Software Security'!D57","v":0},{"$f":"'Q. Software Security'!E57","v":0},{"$f":"'Q. Software Security'!F57","v":0},{"$f":"'Q. Software Security'!G57","v":0},{"$f":"'Q. Software Security'!H57","v":"14.2.9"},{"$f":"'Q. Software Security'!I57","v":"System acceptance testing"},null,null,null,11.3]
[{"$f":"'Q. Software Security'!A58","v":3972},{"$f":"'Q. Software Security'!J58","v":3},{"$f":"'Q. Software Security'!K58","v":0},{"$f":"'Q. Software Security'!Y58","v":0},{"$f":"'Q. Software Security'!B58","v":"Q.1.10.1"},{"$f":"'Q. Software Security'!C58","v":"Performed by a 3rd party?"},{"$f":"'Q. Software Security'!D58","v":0},{"$f":"'Q. Software Security'!E58","v":0},{"$f":"'Q. Software Security'!F58","v":0},{"$f":"'Q. Software Security'!G58","v":0},{"$f":"'Q. Software Security'!H58","v":"14.2.9"},{"$f":"'Q. Software Security'!I58","v":"System acceptance testing"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A59","v":3973},{"$f":"'Q. Software Security'!J59","v":3},{"$f":"'Q. Software Security'!K59","v":0},{"$f":"'Q. Software Security'!Y59","v":0},{"$f":"'Q. Software Security'!B59","v":"Q.1.10.2"},{"$f":"'Q. Software Security'!C59","v":"Internal Penetration Testers? If yes, are they:"},{"$f":"'Q. Software Security'!D59","v":0},{"$f":"'Q. Software Security'!E59","v":0},{"$f":"'Q. Software Security'!F59","v":0},{"$f":"'Q. Software Security'!G59","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!H59","v":"14.2.9"},{"$f":"'Q. Software Security'!I59","v":"System acceptance testing"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A60","v":3974},{"$f":"'Q. Software Security'!J60","v":4},{"$f":"'Q. Software Security'!K60","v":0},{"$f":"'Q. Software Security'!Y60","v":0},{"$f":"'Q. Software Security'!B60","v":"Q.1.10.2.1"},{"$f":"'Q. Software Security'!C60","v":" Part of the development group?"},{"$f":"'Q. Software Security'!D60","v":0},{"$f":"'Q. Software Security'!E60","v":0},{"$f":"'Q. Software Security'!F60","v":0},{"$f":"'Q. Software Security'!G60","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!H60","v":"14.2.9"},{"$f":"'Q. Software Security'!I60","v":"System acceptance testing"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A61","v":3975},{"$f":"'Q. Software Security'!J61","v":3},{"$f":"'Q. Software Security'!K61","v":0},{"$f":"'Q. Software Security'!Y61","v":0},{"$f":"'Q. Software Security'!B61","v":"Q.1.10.3"},{"$f":"'Q. Software Security'!C61","v":"Consistently use the same approach (e.g., tools, methods, time spent, etc.)?"},{"$f":"'Q. Software Security'!D61","v":0},{"$f":"'Q. Software Security'!E61","v":0},{"$f":"'Q. Software Security'!F61","v":0},{"$f":"'Q. Software Security'!G61","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!H61","v":"14.2.9"},{"$f":"'Q. Software Security'!I61","v":"System acceptance testing"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A62","v":3976},{"$f":"'Q. Software Security'!J62","v":3},{"$f":"'Q. Software Security'!K62","v":0},{"$f":"'Q. Software Security'!Y62","v":0},{"$f":"'Q. Software Security'!B62","v":"Q.1.10.4"},{"$f":"'Q. Software Security'!C62","v":"Performed on a set frequently? If yes, describe"},{"$f":"'Q. Software Security'!D62","v":0},{"$f":"'Q. Software Security'!E62","v":0},{"$f":"'Q. Software Security'!F62","v":0},{"$f":"'Q. Software Security'!G62","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!H62","v":"NA"},{"$f":"'Q. Software Security'!I62","v":0},null,null,null,11.3]
[{"$f":"'Q. Software Security'!A63","v":3977},{"$f":"'Q. Software Security'!J63","v":3},{"$f":"'Q. Software Security'!K63","v":0},{"$f":"'Q. Software Security'!Y63","v":0},{"$f":"'Q. Software Security'!B63","v":"Q.1.10.5"},{"$f":"'Q. Software Security'!C63","v":"Issues remediated?"},{"$f":"'Q. Software Security'!D63","v":0},{"$f":"'Q. Software Security'!E63","v":0},{"$f":"'Q. Software Security'!F63","v":0},{"$f":"'Q. Software Security'!G63","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!H63","v":"14.2.9"},{"$f":"'Q. Software Security'!I63","v":"System acceptance testing"},null,null,null,11.3]
[{"$f":"'Q. Software Security'!A64","v":3978},{"$f":"'Q. Software Security'!J64","v":3},{"$f":"'Q. Software Security'!K64","v":0},{"$f":"'Q. Software Security'!Y64","v":0},{"$f":"'Q. Software Security'!B64","v":"Q.1.10.6"},{"$f":"'Q. Software Security'!C64","v":"Conducted on the complete production version, not just the components"},{"$f":"'Q. Software Security'!D64","v":0},{"$f":"'Q. Software Security'!E64","v":0},{"$f":"'Q. Software Security'!F64","v":0},{"$f":"'Q. Software Security'!G64","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!H64","v":"14.2.9"},{"$f":"'Q. Software Security'!I64","v":"System acceptance testing"},null,null,null,11.3]
[{"$f":"'Q. Software Security'!A65","v":3979},{"$f":"'Q. Software Security'!J65","v":3},{"$f":"'Q. Software Security'!K65","v":0},{"$f":"'Q. Software Security'!Y65","v":0},{"$f":"'Q. Software Security'!B65","v":"Q.1.10.7"},{"$f":"'Q. Software Security'!C65","v":"Any un-remediated Penetration Test issues in the application under review?"},{"$f":"'Q. Software Security'!D65","v":0},{"$f":"'Q. Software Security'!E65","v":0},{"$f":"'Q. Software Security'!F65","v":0},{"$f":"'Q. Software Security'!G65","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!H65","v":"NA"},{"$f":"'Q. Software Security'!I65","v":0},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A66","v":3980},{"$f":"'Q. Software Security'!J66","v":3},{"$f":"'Q. Software Security'!K66","v":0},{"$f":"'Q. Software Security'!Y66","v":0},{"$f":"'Q. Software Security'!B66","v":"Q.1.10.8"},{"$f":"'Q. Software Security'!C66","v":"Authenticated when a Penetration Test is performed?"},{"$f":"'Q. Software Security'!D66","v":0},{"$f":"'Q. Software Security'!E66","v":0},{"$f":"'Q. Software Security'!F66","v":0},{"$f":"'Q. Software Security'!G66","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!H66","v":"NA"},{"$f":"'Q. Software Security'!I66","v":0},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A67","v":3981},{"$f":"'Q. Software Security'!J67","v":3},{"$f":"'Q. Software Security'!K67","v":0},{"$f":"'Q. Software Security'!Y67","v":0},{"$f":"'Q. Software Security'!B67","v":"Q.1.10.9"},{"$f":"'Q. Software Security'!C67","v":"Performed in the production environment?"},{"$f":"'Q. Software Security'!D67","v":0},{"$f":"'Q. Software Security'!E67","v":0},{"$f":"'Q. Software Security'!F67","v":0},{"$f":"'Q. Software Security'!G67","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!H67","v":"14.2.9"},{"$f":"'Q. Software Security'!I67","v":"System acceptance testing"},null,null,null,"11.3.1"]
[{"$f":"'Q. Software Security'!A68","v":3982},{"$f":"'Q. Software Security'!J68","v":2},{"$f":"'Q. Software Security'!K68","v":0},{"$f":"'Q. Software Security'!Y68","v":0},{"$f":"'Q. Software Security'!B68","v":"Q.1.11"},{"$f":"'Q. Software Security'!C68","v":"Are discovered vulnerabilities communicated to developers? If yes, explain"},{"$f":"'Q. Software Security'!D68","v":0},{"$f":"'Q. Software Security'!E68","v":0},{"$f":"'Q. Software Security'!F68","v":0},{"$f":"'Q. Software Security'!G68","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!H68","v":"14.2.6"},{"$f":"'Q. Software Security'!I68","v":"Secure development environment"},null,null,null,"12.5.2"]
[{"$f":"'Q. Software Security'!A69","v":3983},{"$f":"'Q. Software Security'!J69","v":2},{"$f":"'Q. Software Security'!K69","v":0},{"$f":"'Q. Software Security'!Y69","v":0},{"$f":"'Q. Software Security'!B69","v":"Q.1.12"},{"$f":"'Q. Software Security'!C69","v":"Does the Software Security Group interface with the Incident Response group or function? If yes, are:"},{"$f":"'Q. Software Security'!D69","v":0},{"$f":"'Q. Software Security'!E69","v":0},{"$f":"'Q. Software Security'!F69","v":0},{"$f":"'Q. Software Security'!G69","v":0},{"$f":"'Q. Software Security'!H69","v":"12.6.1.k"},{"$f":"'Q. Software Security'!I69","v":"Management of Technical vulnerabilities"},null,null,null,"12.5.3"]
[{"$f":"'Q. Software Security'!A70","v":3984},{"$f":"'Q. Software Security'!J70","v":3},{"$f":"'Q. Software Security'!K70","v":0},{"$f":"'Q. Software Security'!Y70","v":0},{"$f":"'Q. Software Security'!B70","v":"Q.1.12.1"},{"$f":"'Q. Software Security'!C70","v":"Vulnerabilities identified by the Incident Response group provided to the Software Security Group?"},{"$f":"'Q. Software Security'!D70","v":0},{"$f":"'Q. Software Security'!E70","v":0},{"$f":"'Q. Software Security'!F70","v":0},{"$f":"'Q. Software Security'!G70","v":0},{"$f":"'Q. Software Security'!H70","v":"12.6.1.k"},{"$f":"'Q. Software Security'!I70","v":"Management of Technical vulnerabilities"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A71","v":3985},{"$f":"'Q. Software Security'!J71","v":2},{"$f":"'Q. Software Security'!K71","v":0},{"$f":"'Q. Software Security'!Y71","v":0},{"$f":"'Q. Software Security'!B71","v":"Q.1.13"},{"$f":"'Q. Software Security'!C71","v":"Does the incident response process include steps to identify root/cause and prevent reoccurrence?"},{"$f":"'Q. Software Security'!D71","v":0},{"$f":"'Q. Software Security'!E71","v":0},{"$f":"'Q. Software Security'!F71","v":0},{"$f":"'Q. Software Security'!G71","v":0},{"$f":"'Q. Software Security'!H71","v":"16.1.1.a.2"},{"$f":"'Q. Software Security'!I71","v":"Responsibilities and procedures"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A72","v":3986},{"$f":"'Q. Software Security'!J72","v":2},{"$f":"'Q. Software Security'!K72","v":0},{"$f":"'Q. Software Security'!Y72","v":0},{"$f":"'Q. Software Security'!B72","v":"Q.1.14"},{"$f":"'Q. Software Security'!C72","v":"Are hosted production applications monitored for vulnerabilities?"},{"$f":"'Q. Software Security'!D72","v":0},{"$f":"'Q. Software Security'!E72","v":0},{"$f":"'Q. Software Security'!F72","v":0},{"$f":"'Q. Software Security'!G72","v":0},{"$f":"'Q. Software Security'!H72","v":14.1},{"$f":"'Q. Software Security'!I72","v":"Security requirements of information systems"},null,null,null,"12.8.4"]
[{"$f":"'Q. Software Security'!A73","v":3987},{"$f":"'Q. Software Security'!J73","v":2},{"$f":"'Q. Software Security'!K73","v":0},{"$f":"'Q. Software Security'!Y73","v":0},{"$f":"'Q. Software Security'!B73","v":"Q.1.15"},{"$f":"'Q. Software Security'!C73","v":"Are third party code reviews performed prior to release into production?"},{"$f":"'Q. Software Security'!D73","v":0},{"$f":"'Q. Software Security'!E73","v":0},{"$f":"'Q. Software Security'!F73","v":0},{"$f":"'Q. Software Security'!G73","v":0},{"$f":"'Q. Software Security'!H73","v":"NA"},{"$f":"'Q. Software Security'!I73","v":0},null,null,null,"6.3.2"]
[{"$f":"'Q. Software Security'!A74","v":3988},{"$f":"'Q. Software Security'!J74","v":2},{"$f":"'Q. Software Security'!K74","v":0},{"$f":"'Q. Software Security'!Y74","v":0},{"$f":"'Q. Software Security'!B74","v":"Q.1.16"},{"$f":"'Q. Software Security'!C74","v":"Is there a Change or Configuration Management policy or program? If yes, does it include:"},{"$f":"'Q. Software Security'!D74","v":0},{"$f":"'Q. Software Security'!E74","v":0},{"$f":"'Q. Software Security'!F74","v":0},{"$f":"'Q. Software Security'!G74","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'Q. Software Security'!H74","v":"12.1.2"},{"$f":"'Q. Software Security'!I74","v":"Change management"},null,null,null,6.4]
[{"$f":"'Q. Software Security'!A75","v":3989},{"$f":"'Q. Software Security'!J75","v":3},{"$f":"'Q. Software Security'!K75","v":0},{"$f":"'Q. Software Security'!Y75","v":0},{"$f":"'Q. Software Security'!B75","v":"Q.1.16.1"},{"$f":"'Q. Software Security'!C75","v":"Vulnerability Management to ensure code has been properly analyzed?"},{"$f":"'Q. Software Security'!D75","v":0},{"$f":"'Q. Software Security'!E75","v":0},{"$f":"'Q. Software Security'!F75","v":0},{"$f":"'Q. Software Security'!G75","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!H75","v":"12.1.2.c"},{"$f":"'Q. Software Security'!I75","v":"Change management"},null,null,null,"11.2.1"]
[{"$f":"'Q. Software Security'!A76","v":3990},{"$f":"'Q. Software Security'!J76","v":2},{"$f":"'Q. Software Security'!K76","v":0},{"$f":"'Q. Software Security'!Y76","v":0},{"$f":"'Q. Software Security'!B76","v":"Q.1.17"},{"$f":"'Q. Software Security'!C76","v":"Are applications analyzed on a regular basis to determine their vulnerability against recent attacks?"},{"$f":"'Q. Software Security'!D76","v":0},{"$f":"'Q. Software Security'!E76","v":0},{"$f":"'Q. Software Security'!F76","v":0},{"$f":"'Q. Software Security'!G76","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!H76","v":"12.2.1"},{"$f":"'Q. Software Security'!I76","v":"Controls against malware"},null,null,null,"11.2.2"]
[{"$f":"'Q. Software Security'!A77","v":3991},{"$f":"'Q. Software Security'!J77","v":2},{"$f":"'Q. Software Security'!K77","v":0},{"$f":"'Q. Software Security'!Y77","v":0},{"$f":"'Q. Software Security'!B77","v":"Q.1.18"},{"$f":"'Q. Software Security'!C77","v":"Are any vulnerabilities identified in production fed through the same mechanisms used to track and remediate results from Penetration Tests?"},{"$f":"'Q. Software Security'!D77","v":0},{"$f":"'Q. Software Security'!E77","v":0},{"$f":"'Q. Software Security'!F77","v":0},{"$f":"'Q. Software Security'!G77","v":"Q.7 QA_UAT Process"},{"$f":"'Q. Software Security'!H77","v":"12.2.1"},{"$f":"'Q. Software Security'!I77","v":"Controls against malware"},null,null,null,"N/A"]
[{"$f":"'Q. Software Security'!A78","v":4117},{"$f":"'Q. Software Security'!J78","v":2},{"$f":"'Q. Software Security'!K78","v":0},{"$f":"'Q. Software Security'!Y78","v":0},{"$f":"'Q. Software Security'!B78","v":"Q.1.19"},{"$f":"'Q. Software Security'!C78","v":"Are library modules used in the development of the application? If yes, are they:"},{"$f":"'Q. Software Security'!D78","v":0},{"$f":"'Q. Software Security'!E78","v":0},{"$f":"'Q. Software Security'!F78","v":0},{"$f":"'Q. Software Security'!G78","v":0},{"$f":"'Q. Software Security'!H78","v":"NA"},{"$f":"'Q. Software Security'!I78","v":0}]
[{"$f":"'Q. Software Security'!A79","v":4118},{"$f":"'Q. Software Security'!J79","v":3},{"$f":"'Q. Software Security'!K79","v":0},{"$f":"'Q. Software Security'!Y79","v":0},{"$f":"'Q. Software Security'!B79","v":"Q.1.19.1"},{"$f":"'Q. Software Security'!C79","v":"Inventoried?"},{"$f":"'Q. Software Security'!D79","v":0},{"$f":"'Q. Software Security'!E79","v":0},{"$f":"'Q. Software Security'!F79","v":0},{"$f":"'Q. Software Security'!G79","v":0},{"$f":"'Q. Software Security'!H79","v":"NA"},{"$f":"'Q. Software Security'!I79","v":0}]
[{"$f":"'Q. Software Security'!A80","v":4119},{"$f":"'Q. Software Security'!J80","v":3},{"$f":"'Q. Software Security'!K80","v":0},{"$f":"'Q. Software Security'!Y80","v":0},{"$f":"'Q. Software Security'!B80","v":"Q.1.19.2"},{"$f":"'Q. Software Security'!C80","v":"Identified as to which application the libraries or modules are used in?"},{"$f":"'Q. Software Security'!D80","v":0},{"$f":"'Q. Software Security'!E80","v":0},{"$f":"'Q. Software Security'!F80","v":0},{"$f":"'Q. Software Security'!G80","v":0},{"$f":"'Q. Software Security'!H80","v":"NA"},{"$f":"'Q. Software Security'!I80","v":0}]
[{"$f":"'Q. Software Security'!A81","v":4120},{"$f":"'Q. Software Security'!J81","v":3},{"$f":"'Q. Software Security'!K81","v":0},{"$f":"'Q. Software Security'!Y81","v":0},{"$f":"'Q. Software Security'!B81","v":"Q.1.19.3"},{"$f":"'Q. Software Security'!C81","v":"Version reviewed at least every 6 months?"},{"$f":"'Q. Software Security'!D81","v":0},{"$f":"'Q. Software Security'!E81","v":0},{"$f":"'Q. Software Security'!F81","v":0},{"$f":"'Q. Software Security'!G81","v":0},{"$f":"'Q. Software Security'!H81","v":"NA"},{"$f":"'Q. Software Security'!I81","v":0}]
[{"$f":"'Q. Software Security'!A82","v":4121},{"$f":"'Q. Software Security'!J82","v":3},{"$f":"'Q. Software Security'!K82","v":0},{"$f":"'Q. Software Security'!Y82","v":0},{"$f":"'Q. Software Security'!B82","v":"Q.1.19.4"},{"$f":"'Q. Software Security'!C82","v":"Open source?"},{"$f":"'Q. Software Security'!D82","v":0},{"$f":"'Q. Software Security'!E82","v":0},{"$f":"'Q. Software Security'!F82","v":0},{"$f":"'Q. Software Security'!G82","v":0},{"$f":"'Q. Software Security'!H82","v":"NA"},{"$f":"'Q. Software Security'!I82","v":0}]
[{"$f":"'Q. Software Security'!A83","v":0},{"$f":"'Q. Software Security'!J83","v":0},{"$f":"'Q. Software Security'!K83","v":0},{"$f":"'Q. Software Security'!Y83","v":0},{"$f":"'Q. Software Security'!B83","v":0},{"$f":"'Q. Software Security'!C83","v":0},{"$f":"'Q. Software Security'!D83","v":0},{"$f":"'Q. Software Security'!E83","v":0},{"$f":"'Q. Software Security'!F83","v":0},{"$f":"'Q. Software Security'!G83","v":0},{"$f":"'Q. Software Security'!H83","v":0},{"$f":"'Q. Software Security'!I83","v":0}]
[{"$f":"'Q. Software Security'!A84","v":0},{"$f":"'Q. Software Security'!J84","v":0},{"$f":"'Q. Software Security'!K84","v":0},{"$f":"'Q. Software Security'!Y84","v":0},{"$f":"'Q. Software Security'!B84","v":0},{"$f":"'Q. Software Security'!C84","v":0},{"$f":"'Q. Software Security'!D84","v":0},{"$f":"'Q. Software Security'!E84","v":0},{"$f":"'Q. Software Security'!F84","v":0},{"$f":"'Q. Software Security'!G84","v":0},{"$f":"'Q. Software Security'!H84","v":0},{"$f":"'Q. Software Security'!I84","v":0}]
[{"$f":"'V. Cloud Security'!B1","v":"V. Cloud Security"},null,null,null,{"$f":"'V. Cloud Security'!B1","v":"V. Cloud Security"}]
[{"$f":"'V. Cloud Security'!A5","v":3304},{"$f":"'V. Cloud Security'!L5","v":1},{"$f":"'V. Cloud Security'!M5","v":0},{"$f":"'V. Cloud Security'!AA5","v":1},{"$f":"'V. Cloud Security'!B5","v":"V.1"},{"$f":"'V. Cloud Security'!C5","v":"Are Cloud Services provided? If yes, what service model is provided (select all that apply):"},{"$f":"'V. Cloud Security'!D5","v":0},{"$f":"'V. Cloud Security'!E5","v":0},{"$f":"'V. Cloud Security'!F5","v":0},{"$f":"'V. Cloud Security'!I5","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!J5","v":4.3},{"$f":"'V. Cloud Security'!K5","v":"Determining the scope of the information management system"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB5","v":"WP.1.A.1, WP.1.A.2"}]
[{"$f":"'V. Cloud Security'!A6","v":3305},{"$f":"'V. Cloud Security'!L6","v":2},{"$f":"'V. Cloud Security'!M6","v":0},{"$f":"'V. Cloud Security'!AA6","v":1},{"$f":"'V. Cloud Security'!B6","v":"V.1.1"},{"$f":"'V. Cloud Security'!C6","v":"Software as a Service (SaaS)?"},{"$f":"'V. Cloud Security'!D6","v":0},{"$f":"'V. Cloud Security'!E6","v":0},{"$f":"'V. Cloud Security'!F6","v":0},{"$f":"'V. Cloud Security'!I6","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!J6","v":"NA"},{"$f":"'V. Cloud Security'!K6","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB6","v":"WP.1.A.1, WP.1.A.2"}]
[{"$f":"'V. Cloud Security'!A7","v":3306},{"$f":"'V. Cloud Security'!L7","v":2},{"$f":"'V. Cloud Security'!M7","v":0},{"$f":"'V. Cloud Security'!AA7","v":1},{"$f":"'V. Cloud Security'!B7","v":"V.1.2"},{"$f":"'V. Cloud Security'!C7","v":"Platform as a Service (PaaS)?"},{"$f":"'V. Cloud Security'!D7","v":0},{"$f":"'V. Cloud Security'!E7","v":0},{"$f":"'V. Cloud Security'!F7","v":0},{"$f":"'V. Cloud Security'!I7","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!J7","v":"NA"},{"$f":"'V. Cloud Security'!K7","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB7","v":"WP.1.A.1, WP.1.A.2"}]
[{"$f":"'V. Cloud Security'!A8","v":3307},{"$f":"'V. Cloud Security'!L8","v":2},{"$f":"'V. Cloud Security'!M8","v":0},{"$f":"'V. Cloud Security'!AA8","v":1},{"$f":"'V. Cloud Security'!B8","v":"V.1.3"},{"$f":"'V. Cloud Security'!C8","v":"Infrastructure as a Service (IaaS)?"},{"$f":"'V. Cloud Security'!D8","v":0},{"$f":"'V. Cloud Security'!E8","v":0},{"$f":"'V. Cloud Security'!F8","v":0},{"$f":"'V. Cloud Security'!I8","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!J8","v":"NA"},{"$f":"'V. Cloud Security'!K8","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB8","v":"WP.1.A.1, WP.1.A.2"}]
[{"$f":"'V. Cloud Security'!A9","v":3308},{"$f":"'V. Cloud Security'!L9","v":2},{"$f":"'V. Cloud Security'!M9","v":1},{"$f":"'V. Cloud Security'!AA9","v":0},{"$f":"'V. Cloud Security'!B9","v":"V.1.4"},{"$f":"'V. Cloud Security'!C9","v":"What deployment models are provided (select all that apply):"},{"$f":"'V. Cloud Security'!D9","v":0},{"$f":"'V. Cloud Security'!E9","v":0},{"$f":"'V. Cloud Security'!F9","v":0},{"$f":"'V. Cloud Security'!I9","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!J9","v":4.3},{"$f":"'V. Cloud Security'!K9","v":"Determining the scope of the information management system"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB9","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A10","v":3309},{"$f":"'V. Cloud Security'!L10","v":3},{"$f":"'V. Cloud Security'!M10","v":0},{"$f":"'V. Cloud Security'!AA10","v":1},{"$f":"'V. Cloud Security'!B10","v":"V.1.4.1"},{"$f":"'V. Cloud Security'!C10","v":"Private cloud?"},{"$f":"'V. Cloud Security'!D10","v":0},{"$f":"'V. Cloud Security'!E10","v":0},{"$f":"'V. Cloud Security'!F10","v":0},{"$f":"'V. Cloud Security'!I10","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!J10","v":"NA"},{"$f":"'V. Cloud Security'!K10","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB10","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A11","v":3310},{"$f":"'V. Cloud Security'!L11","v":3},{"$f":"'V. Cloud Security'!M11","v":0},{"$f":"'V. Cloud Security'!AA11","v":1},{"$f":"'V. Cloud Security'!B11","v":"V.1.4.2"},{"$f":"'V. Cloud Security'!C11","v":"Public cloud?"},{"$f":"'V. Cloud Security'!D11","v":0},{"$f":"'V. Cloud Security'!E11","v":0},{"$f":"'V. Cloud Security'!F11","v":0},{"$f":"'V. Cloud Security'!I11","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!J11","v":"NA"},{"$f":"'V. Cloud Security'!K11","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB11","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A12","v":3311},{"$f":"'V. Cloud Security'!L12","v":3},{"$f":"'V. Cloud Security'!M12","v":0},{"$f":"'V. Cloud Security'!AA12","v":1},{"$f":"'V. Cloud Security'!B12","v":"V.1.4.3"},{"$f":"'V. Cloud Security'!C12","v":"Community cloud?"},{"$f":"'V. Cloud Security'!D12","v":0},{"$f":"'V. Cloud Security'!E12","v":0},{"$f":"'V. Cloud Security'!F12","v":0},{"$f":"'V. Cloud Security'!I12","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!J12","v":"NA"},{"$f":"'V. Cloud Security'!K12","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB12","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A13","v":3312},{"$f":"'V. Cloud Security'!L13","v":3},{"$f":"'V. Cloud Security'!M13","v":0},{"$f":"'V. Cloud Security'!AA13","v":1},{"$f":"'V. Cloud Security'!B13","v":"V.1.4.4"},{"$f":"'V. Cloud Security'!C13","v":"Hybrid cloud?"},{"$f":"'V. Cloud Security'!D13","v":0},{"$f":"'V. Cloud Security'!E13","v":0},{"$f":"'V. Cloud Security'!F13","v":0},{"$f":"'V. Cloud Security'!I13","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!J13","v":"NA"},{"$f":"'V. Cloud Security'!K13","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB13","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A14","v":3313},{"$f":"'V. Cloud Security'!L14","v":2},{"$f":"'V. Cloud Security'!M14","v":1},{"$f":"'V. Cloud Security'!AA14","v":0},{"$f":"'V. Cloud Security'!B14","v":"V.1.5"},{"$f":"'V. Cloud Security'!C14","v":"Where is the cloud infrastructure hosted:"},{"$f":"'V. Cloud Security'!D14","v":0},{"$f":"'V. Cloud Security'!E14","v":0},{"$f":"'V. Cloud Security'!F14","v":0},{"$f":"'V. Cloud Security'!I14","v":0},{"$f":"'V. Cloud Security'!J14","v":4.3},{"$f":"'V. Cloud Security'!K14","v":"Determining the scope of the information management system"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB14","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A15","v":3314},{"$f":"'V. Cloud Security'!L15","v":3},{"$f":"'V. Cloud Security'!M15","v":0},{"$f":"'V. Cloud Security'!AA15","v":0},{"$f":"'V. Cloud Security'!B15","v":"V.1.5.1"},{"$f":"'V. Cloud Security'!C15","v":"Data center: single tenancy?"},{"$f":"'V. Cloud Security'!D15","v":0},{"$f":"'V. Cloud Security'!E15","v":0},{"$f":"'V. Cloud Security'!F15","v":0},{"$f":"'V. Cloud Security'!I15","v":0},{"$f":"'V. Cloud Security'!J15","v":"NA"},{"$f":"'V. Cloud Security'!K15","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB15","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A16","v":3315},{"$f":"'V. Cloud Security'!L16","v":3},{"$f":"'V. Cloud Security'!M16","v":0},{"$f":"'V. Cloud Security'!AA16","v":0},{"$f":"'V. Cloud Security'!B16","v":"V.1.5.2"},{"$f":"'V. Cloud Security'!C16","v":"Co-location: dedicated server?"},{"$f":"'V. Cloud Security'!D16","v":0},{"$f":"'V. Cloud Security'!E16","v":0},{"$f":"'V. Cloud Security'!F16","v":0},{"$f":"'V. Cloud Security'!I16","v":0},{"$f":"'V. Cloud Security'!J16","v":"NA"},{"$f":"'V. Cloud Security'!K16","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB16","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A17","v":3686},{"$f":"'V. Cloud Security'!L17","v":3},{"$f":"'V. Cloud Security'!M17","v":0},{"$f":"'V. Cloud Security'!AA17","v":0},{"$f":"'V. Cloud Security'!B17","v":"V.1.5.3"},{"$f":"'V. Cloud Security'!C17","v":"Co-location: shared server?"},{"$f":"'V. Cloud Security'!D17","v":0},{"$f":"'V. Cloud Security'!E17","v":0},{"$f":"'V. Cloud Security'!F17","v":0},{"$f":"'V. Cloud Security'!I17","v":0},{"$f":"'V. Cloud Security'!J17","v":"NA"},{"$f":"'V. Cloud Security'!K17","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB17","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A18","v":3316},{"$f":"'V. Cloud Security'!L18","v":3},{"$f":"'V. Cloud Security'!M18","v":0},{"$f":"'V. Cloud Security'!AA18","v":0},{"$f":"'V. Cloud Security'!B18","v":"V.1.5.4"},{"$f":"'V. Cloud Security'!C18","v":"Co-location: dedicated cabinet?"},{"$f":"'V. Cloud Security'!D18","v":0},{"$f":"'V. Cloud Security'!E18","v":0},{"$f":"'V. Cloud Security'!F18","v":0},{"$f":"'V. Cloud Security'!I18","v":0},{"$f":"'V. Cloud Security'!J18","v":"NA"},{"$f":"'V. Cloud Security'!K18","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB18","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A19","v":3317},{"$f":"'V. Cloud Security'!L19","v":3},{"$f":"'V. Cloud Security'!M19","v":0},{"$f":"'V. Cloud Security'!AA19","v":0},{"$f":"'V. Cloud Security'!B19","v":"V.1.5.5"},{"$f":"'V. Cloud Security'!C19","v":"Co-location: shared cabinet?"},{"$f":"'V. Cloud Security'!D19","v":0},{"$f":"'V. Cloud Security'!E19","v":0},{"$f":"'V. Cloud Security'!F19","v":0},{"$f":"'V. Cloud Security'!I19","v":0},{"$f":"'V. Cloud Security'!J19","v":"NA"},{"$f":"'V. Cloud Security'!K19","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB19","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A20","v":3318},{"$f":"'V. Cloud Security'!L20","v":3},{"$f":"'V. Cloud Security'!M20","v":0},{"$f":"'V. Cloud Security'!AA20","v":0},{"$f":"'V. Cloud Security'!B20","v":"V.1.5.6"},{"$f":"'V. Cloud Security'!C20","v":"Co-location: dedicated cage?"},{"$f":"'V. Cloud Security'!D20","v":0},{"$f":"'V. Cloud Security'!E20","v":0},{"$f":"'V. Cloud Security'!F20","v":0},{"$f":"'V. Cloud Security'!I20","v":0},{"$f":"'V. Cloud Security'!J20","v":"NA"},{"$f":"'V. Cloud Security'!K20","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB20","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A21","v":3319},{"$f":"'V. Cloud Security'!L21","v":3},{"$f":"'V. Cloud Security'!M21","v":0},{"$f":"'V. Cloud Security'!AA21","v":0},{"$f":"'V. Cloud Security'!B21","v":"V.1.5.7"},{"$f":"'V. Cloud Security'!C21","v":"Co-location: shared cage?"},{"$f":"'V. Cloud Security'!D21","v":0},{"$f":"'V. Cloud Security'!E21","v":0},{"$f":"'V. Cloud Security'!F21","v":0},{"$f":"'V. Cloud Security'!I21","v":0},{"$f":"'V. Cloud Security'!J21","v":"NA"},{"$f":"'V. Cloud Security'!K21","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB21","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A22","v":3320},{"$f":"'V. Cloud Security'!L22","v":3},{"$f":"'V. Cloud Security'!M22","v":0},{"$f":"'V. Cloud Security'!AA22","v":0},{"$f":"'V. Cloud Security'!B22","v":"V.1.5.8"},{"$f":"'V. Cloud Security'!C22","v":"Cloud provider: (e.g., AWS)?"},{"$f":"'V. Cloud Security'!D22","v":0},{"$f":"'V. Cloud Security'!E22","v":0},{"$f":"'V. Cloud Security'!F22","v":0},{"$f":"'V. Cloud Security'!I22","v":0},{"$f":"'V. Cloud Security'!J22","v":"NA"},{"$f":"'V. Cloud Security'!K22","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB22","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A23","v":3321},{"$f":"'V. Cloud Security'!L23","v":2},{"$f":"'V. Cloud Security'!M23","v":1},{"$f":"'V. Cloud Security'!AA23","v":0},{"$f":"'V. Cloud Security'!B23","v":"V.1.6"},{"$f":"'V. Cloud Security'!C23","v":"What legal jurisdiction does data reside (select all that apply):"},{"$f":"'V. Cloud Security'!D23","v":0},{"$f":"'V. Cloud Security'!E23","v":0},{"$f":"'V. Cloud Security'!F23","v":0},{"$f":"'V. Cloud Security'!I23","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'V. Cloud Security'!J23","v":"18.1.1 "},{"$f":"'V. Cloud Security'!K23","v":"Identification of applicable legislation and contractual requirements"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB23","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A24","v":3322},{"$f":"'V. Cloud Security'!L24","v":3},{"$f":"'V. Cloud Security'!M24","v":0},{"$f":"'V. Cloud Security'!AA24","v":0},{"$f":"'V. Cloud Security'!B24","v":"V.1.6.1"},{"$f":"'V. Cloud Security'!C24","v":"USA?"},{"$f":"'V. Cloud Security'!D24","v":0},{"$f":"'V. Cloud Security'!E24","v":0},{"$f":"'V. Cloud Security'!F24","v":0},{"$f":"'V. Cloud Security'!I24","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'V. Cloud Security'!J24","v":"NA"},{"$f":"'V. Cloud Security'!K24","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB24","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A25","v":3323},{"$f":"'V. Cloud Security'!L25","v":3},{"$f":"'V. Cloud Security'!M25","v":0},{"$f":"'V. Cloud Security'!AA25","v":0},{"$f":"'V. Cloud Security'!B25","v":"V.1.6.2"},{"$f":"'V. Cloud Security'!C25","v":"Canada?"},{"$f":"'V. Cloud Security'!D25","v":0},{"$f":"'V. Cloud Security'!E25","v":0},{"$f":"'V. Cloud Security'!F25","v":0},{"$f":"'V. Cloud Security'!I25","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'V. Cloud Security'!J25","v":"NA"},{"$f":"'V. Cloud Security'!K25","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB25","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A26","v":3324},{"$f":"'V. Cloud Security'!L26","v":3},{"$f":"'V. Cloud Security'!M26","v":0},{"$f":"'V. Cloud Security'!AA26","v":0},{"$f":"'V. Cloud Security'!B26","v":"V.1.6.3"},{"$f":"'V. Cloud Security'!C26","v":"Asia?"},{"$f":"'V. Cloud Security'!D26","v":0},{"$f":"'V. Cloud Security'!E26","v":0},{"$f":"'V. Cloud Security'!F26","v":0},{"$f":"'V. Cloud Security'!I26","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'V. Cloud Security'!J26","v":"NA"},{"$f":"'V. Cloud Security'!K26","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB26","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A27","v":3325},{"$f":"'V. Cloud Security'!L27","v":3},{"$f":"'V. Cloud Security'!M27","v":0},{"$f":"'V. Cloud Security'!AA27","v":0},{"$f":"'V. Cloud Security'!B27","v":"V.1.6.4"},{"$f":"'V. Cloud Security'!C27","v":"South America?"},{"$f":"'V. Cloud Security'!D27","v":0},{"$f":"'V. Cloud Security'!E27","v":0},{"$f":"'V. Cloud Security'!F27","v":0},{"$f":"'V. Cloud Security'!I27","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'V. Cloud Security'!J27","v":"NA"},{"$f":"'V. Cloud Security'!K27","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB27","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A28","v":3326},{"$f":"'V. Cloud Security'!L28","v":3},{"$f":"'V. Cloud Security'!M28","v":0},{"$f":"'V. Cloud Security'!AA28","v":0},{"$f":"'V. Cloud Security'!B28","v":"V.1.6.5"},{"$f":"'V. Cloud Security'!C28","v":"Australia?"},{"$f":"'V. Cloud Security'!D28","v":0},{"$f":"'V. Cloud Security'!E28","v":0},{"$f":"'V. Cloud Security'!F28","v":0},{"$f":"'V. Cloud Security'!I28","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'V. Cloud Security'!J28","v":"NA"},{"$f":"'V. Cloud Security'!K28","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB28","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A29","v":3327},{"$f":"'V. Cloud Security'!L29","v":3},{"$f":"'V. Cloud Security'!M29","v":0},{"$f":"'V. Cloud Security'!AA29","v":0},{"$f":"'V. Cloud Security'!B29","v":"V.1.6.6"},{"$f":"'V. Cloud Security'!C29","v":"Asia-Pacific?"},{"$f":"'V. Cloud Security'!D29","v":0},{"$f":"'V. Cloud Security'!E29","v":0},{"$f":"'V. Cloud Security'!F29","v":0},{"$f":"'V. Cloud Security'!I29","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'V. Cloud Security'!J29","v":"NA"},{"$f":"'V. Cloud Security'!K29","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB29","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A30","v":3328},{"$f":"'V. Cloud Security'!L30","v":3},{"$f":"'V. Cloud Security'!M30","v":0},{"$f":"'V. Cloud Security'!AA30","v":0},{"$f":"'V. Cloud Security'!B30","v":"V.1.6.7"},{"$f":"'V. Cloud Security'!C30","v":"Africa?"},{"$f":"'V. Cloud Security'!D30","v":0},{"$f":"'V. Cloud Security'!E30","v":0},{"$f":"'V. Cloud Security'!F30","v":0},{"$f":"'V. Cloud Security'!I30","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'V. Cloud Security'!J30","v":"NA"},{"$f":"'V. Cloud Security'!K30","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB30","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A31","v":3684},{"$f":"'V. Cloud Security'!L31","v":3},{"$f":"'V. Cloud Security'!M31","v":0},{"$f":"'V. Cloud Security'!AA31","v":0},{"$f":"'V. Cloud Security'!B31","v":"V.1.6.8"},{"$f":"'V. Cloud Security'!C31","v":"Europe (EU)?"},{"$f":"'V. Cloud Security'!D31","v":0},{"$f":"'V. Cloud Security'!E31","v":0},{"$f":"'V. Cloud Security'!F31","v":0},{"$f":"'V. Cloud Security'!I31","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'V. Cloud Security'!J31","v":"NA"},{"$f":"'V. Cloud Security'!K31","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB31","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A32","v":3685},{"$f":"'V. Cloud Security'!L32","v":3},{"$f":"'V. Cloud Security'!M32","v":0},{"$f":"'V. Cloud Security'!AA32","v":0},{"$f":"'V. Cloud Security'!B32","v":"V.1.6.9"},{"$f":"'V. Cloud Security'!C32","v":"Europe (non-EU)?"},{"$f":"'V. Cloud Security'!D32","v":0},{"$f":"'V. Cloud Security'!E32","v":0},{"$f":"'V. Cloud Security'!F32","v":0},{"$f":"'V. Cloud Security'!I32","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'V. Cloud Security'!J32","v":"NA"},{"$f":"'V. Cloud Security'!K32","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB32","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A33","v":3329},{"$f":"'V. Cloud Security'!L33","v":3},{"$f":"'V. Cloud Security'!M33","v":0},{"$f":"'V. Cloud Security'!AA33","v":0},{"$f":"'V. Cloud Security'!B33","v":"V.1.6.10"},{"$f":"'V. Cloud Security'!C33","v":"Other (please specify)?"},{"$f":"'V. Cloud Security'!D33","v":0},{"$f":"'V. Cloud Security'!E33","v":0},{"$f":"'V. Cloud Security'!F33","v":0},{"$f":"'V. Cloud Security'!I33","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'V. Cloud Security'!J33","v":"NA"},{"$f":"'V. Cloud Security'!K33","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB33","v":"WP.1.E.1, WP.1.E.4, WP.1.G"}]
[{"$f":"'V. Cloud Security'!A34","v":3330},{"$f":"'V. Cloud Security'!L34","v":2},{"$f":"'V. Cloud Security'!M34","v":0},{"$f":"'V. Cloud Security'!AA34","v":1},{"$f":"'V. Cloud Security'!B34","v":"V.1.7"},{"$f":"'V. Cloud Security'!C34","v":"Can clients define the legal jurisdictions of their data? If yes, can they define where the data is:"},{"$f":"'V. Cloud Security'!D34","v":0},{"$f":"'V. Cloud Security'!E34","v":0},{"$f":"'V. Cloud Security'!F34","v":0},{"$f":"'V. Cloud Security'!I34","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'V. Cloud Security'!J34","v":"18.1.1 "},{"$f":"'V. Cloud Security'!K34","v":"Identification of applicable legislation and contractual requirements"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB34","v":"WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A35","v":3331},{"$f":"'V. Cloud Security'!L35","v":3},{"$f":"'V. Cloud Security'!M35","v":0},{"$f":"'V. Cloud Security'!AA35","v":0},{"$f":"'V. Cloud Security'!B35","v":"V.1.7.1"},{"$f":"'V. Cloud Security'!C35","v":"Stored?"},{"$f":"'V. Cloud Security'!D35","v":0},{"$f":"'V. Cloud Security'!E35","v":0},{"$f":"'V. Cloud Security'!F35","v":0},{"$f":"'V. Cloud Security'!I35","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'V. Cloud Security'!J35","v":"NA"},{"$f":"'V. Cloud Security'!K35","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB35","v":"WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A36","v":3332},{"$f":"'V. Cloud Security'!L36","v":3},{"$f":"'V. Cloud Security'!M36","v":0},{"$f":"'V. Cloud Security'!AA36","v":0},{"$f":"'V. Cloud Security'!B36","v":"V.1.7.2"},{"$f":"'V. Cloud Security'!C36","v":"Processed?"},{"$f":"'V. Cloud Security'!D36","v":0},{"$f":"'V. Cloud Security'!E36","v":0},{"$f":"'V. Cloud Security'!F36","v":0},{"$f":"'V. Cloud Security'!I36","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'V. Cloud Security'!J36","v":"NA"},{"$f":"'V. Cloud Security'!K36","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB36","v":"WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A37","v":3333},{"$f":"'V. Cloud Security'!L37","v":3},{"$f":"'V. Cloud Security'!M37","v":0},{"$f":"'V. Cloud Security'!AA37","v":0},{"$f":"'V. Cloud Security'!B37","v":"V.1.7.3"},{"$f":"'V. Cloud Security'!C37","v":"Transmitted?"},{"$f":"'V. Cloud Security'!D37","v":0},{"$f":"'V. Cloud Security'!E37","v":0},{"$f":"'V. Cloud Security'!F37","v":0},{"$f":"'V. Cloud Security'!I37","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'V. Cloud Security'!J37","v":"NA"},{"$f":"'V. Cloud Security'!K37","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB37","v":"WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A38","v":3334},{"$f":"'V. Cloud Security'!L38","v":3},{"$f":"'V. Cloud Security'!M38","v":0},{"$f":"'V. Cloud Security'!AA38","v":0},{"$f":"'V. Cloud Security'!B38","v":"V.1.7.4"},{"$f":"'V. Cloud Security'!C38","v":"Accessed?"},{"$f":"'V. Cloud Security'!D38","v":0},{"$f":"'V. Cloud Security'!E38","v":0},{"$f":"'V. Cloud Security'!F38","v":0},{"$f":"'V. Cloud Security'!I38","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'V. Cloud Security'!J38","v":"NA"},{"$f":"'V. Cloud Security'!K38","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB38","v":"WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A39","v":3335},{"$f":"'V. Cloud Security'!L39","v":2},{"$f":"'V. Cloud Security'!M39","v":0},{"$f":"'V. Cloud Security'!AA39","v":0},{"$f":"'V. Cloud Security'!B39","v":"V.1.8"},{"$f":"'V. Cloud Security'!C39","v":"Are application instances part of the services provided?"},{"$f":"'V. Cloud Security'!D39","v":0},{"$f":"'V. Cloud Security'!E39","v":0},{"$f":"'V. Cloud Security'!F39","v":0},{"$f":"'V. Cloud Security'!I39","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'V. Cloud Security'!J39","v":"9.4.1 "},{"$f":"'V. Cloud Security'!K39","v":"Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB39","v":"WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A40","v":3336},{"$f":"'V. Cloud Security'!L40","v":3},{"$f":"'V. Cloud Security'!M40","v":0},{"$f":"'V. Cloud Security'!AA40","v":0},{"$f":"'V. Cloud Security'!B40","v":"V.1.8.1"},{"$f":"'V. Cloud Security'!C40","v":"Are these instances shared with other clients?"},{"$f":"'V. Cloud Security'!D40","v":0},{"$f":"'V. Cloud Security'!E40","v":0},{"$f":"'V. Cloud Security'!F40","v":0},{"$f":"'V. Cloud Security'!I40","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'V. Cloud Security'!J40","v":"NA"},{"$f":"'V. Cloud Security'!K40","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB40","v":"WP.1.A.1, WP.1.A.2, WP.1.A.8"}]
[{"$f":"'V. Cloud Security'!A41","v":3337},{"$f":"'V. Cloud Security'!L41","v":2},{"$f":"'V. Cloud Security'!M41","v":0},{"$f":"'V. Cloud Security'!AA41","v":0},{"$f":"'V. Cloud Security'!B41","v":"V.1.9"},{"$f":"'V. Cloud Security'!C41","v":"Are database instances part of the services provided?"},{"$f":"'V. Cloud Security'!D41","v":0},{"$f":"'V. Cloud Security'!E41","v":0},{"$f":"'V. Cloud Security'!F41","v":0},{"$f":"'V. Cloud Security'!I41","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'V. Cloud Security'!J41","v":"9.4.1"},{"$f":"'V. Cloud Security'!K41","v":"Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB41","v":"WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A42","v":3338},{"$f":"'V. Cloud Security'!L42","v":3},{"$f":"'V. Cloud Security'!M42","v":0},{"$f":"'V. Cloud Security'!AA42","v":0},{"$f":"'V. Cloud Security'!B42","v":"V.1.9.1"},{"$f":"'V. Cloud Security'!C42","v":"Are these instances shared with other clients?"},{"$f":"'V. Cloud Security'!D42","v":0},{"$f":"'V. Cloud Security'!E42","v":0},{"$f":"'V. Cloud Security'!F42","v":0},{"$f":"'V. Cloud Security'!I42","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"'V. Cloud Security'!J42","v":"NA"},{"$f":"'V. Cloud Security'!K42","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB42","v":"WP.1.A.1, WP.1.A.2, WP.1.A.8"}]
[{"$f":"'V. Cloud Security'!A43","v":3339},{"$f":"'V. Cloud Security'!L43","v":2},{"$f":"'V. Cloud Security'!M43","v":0},{"$f":"'V. Cloud Security'!AA43","v":1},{"$f":"'V. Cloud Security'!B43","v":"V.1.10"},{"$f":"'V. Cloud Security'!C43","v":"Is data segmentation and separation capability between clients provided? If yes, is it:"},{"$f":"'V. Cloud Security'!D43","v":0},{"$f":"'V. Cloud Security'!E43","v":0},{"$f":"'V. Cloud Security'!F43","v":0},{"$f":"'V. Cloud Security'!I43","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!J43","v":"9.4.1 "},{"$f":"'V. Cloud Security'!K43","v":"Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB43","v":"WP.1.A.1"}]
[{"$f":"'V. Cloud Security'!A44","v":3340},{"$f":"'V. Cloud Security'!L44","v":3},{"$f":"'V. Cloud Security'!M44","v":0},{"$f":"'V. Cloud Security'!AA44","v":0},{"$f":"'V. Cloud Security'!B44","v":"V.1.10.1"},{"$f":"'V. Cloud Security'!C44","v":"Physical segmentation (private cloud)?"},{"$f":"'V. Cloud Security'!D44","v":0},{"$f":"'V. Cloud Security'!E44","v":0},{"$f":"'V. Cloud Security'!F44","v":0},{"$f":"'V. Cloud Security'!I44","v":0},{"$f":"'V. Cloud Security'!J44","v":"9.4.1 "},{"$f":"'V. Cloud Security'!K44","v":"Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB44","v":"WP.1.A.1"}]
[{"$f":"'V. Cloud Security'!A45","v":3341},{"$f":"'V. Cloud Security'!L45","v":3},{"$f":"'V. Cloud Security'!M45","v":0},{"$f":"'V. Cloud Security'!AA45","v":0},{"$f":"'V. Cloud Security'!B45","v":"V.1.10.2"},{"$f":"'V. Cloud Security'!C45","v":"Network segmentation?"},{"$f":"'V. Cloud Security'!D45","v":0},{"$f":"'V. Cloud Security'!E45","v":0},{"$f":"'V. Cloud Security'!F45","v":0},{"$f":"'V. Cloud Security'!I45","v":0},{"$f":"'V. Cloud Security'!J45","v":"9.4.1 "},{"$f":"'V. Cloud Security'!K45","v":"Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB45","v":"WP.1.A.1"}]
[{"$f":"'V. Cloud Security'!A46","v":3342},{"$f":"'V. Cloud Security'!L46","v":3},{"$f":"'V. Cloud Security'!M46","v":0},{"$f":"'V. Cloud Security'!AA46","v":0},{"$f":"'V. Cloud Security'!B46","v":"V.1.10.3"},{"$f":"'V. Cloud Security'!C46","v":"System segmentation (unique system instances (e.g., virtualization)?"},{"$f":"'V. Cloud Security'!D46","v":0},{"$f":"'V. Cloud Security'!E46","v":0},{"$f":"'V. Cloud Security'!F46","v":0},{"$f":"'V. Cloud Security'!I46","v":0},{"$f":"'V. Cloud Security'!J46","v":"9.4.1 "},{"$f":"'V. Cloud Security'!K46","v":"Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB46","v":"WP.1.A.1, WP.1.D.1, WP.1.D.3"}]
[{"$f":"'V. Cloud Security'!A47","v":3343},{"$f":"'V. Cloud Security'!L47","v":3},{"$f":"'V. Cloud Security'!M47","v":0},{"$f":"'V. Cloud Security'!AA47","v":0},{"$f":"'V. Cloud Security'!B47","v":"V.1.10.4"},{"$f":"'V. Cloud Security'!C47","v":"Application segmentation (unique application instances)?"},{"$f":"'V. Cloud Security'!D47","v":0},{"$f":"'V. Cloud Security'!E47","v":0},{"$f":"'V. Cloud Security'!F47","v":0},{"$f":"'V. Cloud Security'!I47","v":0},{"$f":"'V. Cloud Security'!J47","v":"9.4.1 "},{"$f":"'V. Cloud Security'!K47","v":"Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB47","v":"WP.1.A.1"}]
[{"$f":"'V. Cloud Security'!A48","v":3344},{"$f":"'V. Cloud Security'!L48","v":3},{"$f":"'V. Cloud Security'!M48","v":0},{"$f":"'V. Cloud Security'!AA48","v":0},{"$f":"'V. Cloud Security'!B48","v":"V.1.10.5"},{"$f":"'V. Cloud Security'!C48","v":"Application segmentation (e.g., application ID, metadata tagging)?"},{"$f":"'V. Cloud Security'!D48","v":0},{"$f":"'V. Cloud Security'!E48","v":0},{"$f":"'V. Cloud Security'!F48","v":0},{"$f":"'V. Cloud Security'!I48","v":0},{"$f":"'V. Cloud Security'!J48","v":"9.4.1 "},{"$f":"'V. Cloud Security'!K48","v":"Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB48","v":"WP.1.A.1"}]
[{"$f":"'V. Cloud Security'!A49","v":3345},{"$f":"'V. Cloud Security'!L49","v":3},{"$f":"'V. Cloud Security'!M49","v":0},{"$f":"'V. Cloud Security'!AA49","v":0},{"$f":"'V. Cloud Security'!B49","v":"V.1.10.6"},{"$f":"'V. Cloud Security'!C49","v":"Other (please specify)?"},{"$f":"'V. Cloud Security'!D49","v":0},{"$f":"'V. Cloud Security'!E49","v":0},{"$f":"'V. Cloud Security'!F49","v":0},{"$f":"'V. Cloud Security'!I49","v":0},{"$f":"'V. Cloud Security'!J49","v":"9.4.1 "},{"$f":"'V. Cloud Security'!K49","v":"Information access restriction"},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A50","v":3346},{"$f":"'V. Cloud Security'!L50","v":2},{"$f":"'V. Cloud Security'!M50","v":0},{"$f":"'V. Cloud Security'!AA50","v":1},{"$f":"'V. Cloud Security'!B50","v":"V.1.11"},{"$f":"'V. Cloud Security'!C50","v":"Is Scoped Data encrypted? If yes, when:"},{"$f":"'V. Cloud Security'!D50","v":0},{"$f":"'V. Cloud Security'!E50","v":0},{"$f":"'V. Cloud Security'!F50","v":0},{"$f":"'V. Cloud Security'!I50","v":"G.22 Data Security Policy – Encryption "},{"$f":"'V. Cloud Security'!J50","v":"10.1.1                                                     13.1.2                                                14.1.3                                                                 18.1.3"},{"$f":"'V. Cloud Security'!K50","v":"Policy on The Use of Cryptographic Controls,\nSecurity of Network Services,\nProtecting application services transactions,\nProtection of records"},null,null,null,"3.5, 3.6",null,null,{"$f":"'V. Cloud Security'!AB50","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.A.7, WP.1.G.9"}]
[{"$f":"'V. Cloud Security'!A51","v":3347},{"$f":"'V. Cloud Security'!L51","v":3},{"$f":"'V. Cloud Security'!M51","v":0},{"$f":"'V. Cloud Security'!AA51","v":0},{"$f":"'V. Cloud Security'!B51","v":"V.1.11.1"},{"$f":"'V. Cloud Security'!C51","v":"External: Network?"},{"$f":"'V. Cloud Security'!D51","v":0},{"$f":"'V. Cloud Security'!E51","v":0},{"$f":"'V. Cloud Security'!F51","v":0},{"$f":"'V. Cloud Security'!I51","v":"G.22 Data Security Policy – Encryption, G.13 Website – Client Encryption"},{"$f":"'V. Cloud Security'!J51","v":"NA"},{"$f":"'V. Cloud Security'!K51","v":0},null,null,null,"3.5, 3.6"]
[{"$f":"'V. Cloud Security'!A52","v":3348},{"$f":"'V. Cloud Security'!L52","v":3},{"$f":"'V. Cloud Security'!M52","v":0},{"$f":"'V. Cloud Security'!AA52","v":0},{"$f":"'V. Cloud Security'!B52","v":"V.1.11.2"},{"$f":"'V. Cloud Security'!C52","v":"Internal: Network?"},{"$f":"'V. Cloud Security'!D52","v":0},{"$f":"'V. Cloud Security'!E52","v":0},{"$f":"'V. Cloud Security'!F52","v":0},{"$f":"'V. Cloud Security'!I52","v":"G.22 Data Security Policy – Encryption, G.13 Website – Client Encryption"},{"$f":"'V. Cloud Security'!J52","v":"NA"},{"$f":"'V. Cloud Security'!K52","v":0},null,null,null,"3.5, 3.6"]
[{"$f":"'V. Cloud Security'!A53","v":3349},{"$f":"'V. Cloud Security'!L53","v":3},{"$f":"'V. Cloud Security'!M53","v":0},{"$f":"'V. Cloud Security'!AA53","v":0},{"$f":"'V. Cloud Security'!B53","v":"V.1.11.3"},{"$f":"'V. Cloud Security'!C53","v":"Internal: Storage?"},{"$f":"'V. Cloud Security'!D53","v":0},{"$f":"'V. Cloud Security'!E53","v":0},{"$f":"'V. Cloud Security'!F53","v":0},{"$f":"'V. Cloud Security'!I53","v":"G.22 Data Security Policy – Encryption "},{"$f":"'V. Cloud Security'!J53","v":"NA"},{"$f":"'V. Cloud Security'!K53","v":0},null,null,null,"3.5, 3.6"]
[{"$f":"'V. Cloud Security'!A54","v":3350},{"$f":"'V. Cloud Security'!L54","v":3},{"$f":"'V. Cloud Security'!M54","v":0},{"$f":"'V. Cloud Security'!AA54","v":0},{"$f":"'V. Cloud Security'!B54","v":"V.1.11.4"},{"$f":"'V. Cloud Security'!C54","v":"Vendors: Transit to third party vendors?"},{"$f":"'V. Cloud Security'!D54","v":0},{"$f":"'V. Cloud Security'!E54","v":0},{"$f":"'V. Cloud Security'!F54","v":0},{"$f":"'V. Cloud Security'!I54","v":"G.22 Data Security Policy – Encryption "},{"$f":"'V. Cloud Security'!J54","v":"NA"},{"$f":"'V. Cloud Security'!K54","v":0},null,null,null,4.0999999999999996]
[{"$f":"'V. Cloud Security'!A55","v":3351},{"$f":"'V. Cloud Security'!L55","v":3},{"$f":"'V. Cloud Security'!M55","v":0},{"$f":"'V. Cloud Security'!AA55","v":0},{"$f":"'V. Cloud Security'!B55","v":"V.1.11.5"},{"$f":"'V. Cloud Security'!C55","v":"Vendors: Stored by third party vendors?"},{"$f":"'V. Cloud Security'!D55","v":0},{"$f":"'V. Cloud Security'!E55","v":0},{"$f":"'V. Cloud Security'!F55","v":0},{"$f":"'V. Cloud Security'!I55","v":"G.22 Data Security Policy – Encryption "},{"$f":"'V. Cloud Security'!J55","v":"NA"},{"$f":"'V. Cloud Security'!K55","v":0},null,null,null,"3.5, 3.6.3"]
[{"$f":"'V. Cloud Security'!A56","v":3352},{"$f":"'V. Cloud Security'!L56","v":3},{"$f":"'V. Cloud Security'!M56","v":0},{"$f":"'V. Cloud Security'!AA56","v":0},{"$f":"'V. Cloud Security'!B56","v":"V.1.11.6"},{"$f":"'V. Cloud Security'!C56","v":"Other (please specify)?"},{"$f":"'V. Cloud Security'!D56","v":0},{"$f":"'V. Cloud Security'!E56","v":0},{"$f":"'V. Cloud Security'!F56","v":0},{"$f":"'V. Cloud Security'!I56","v":0},{"$f":"'V. Cloud Security'!J56","v":"NA"},{"$f":"'V. Cloud Security'!K56","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A57","v":3353},{"$f":"'V. Cloud Security'!L57","v":2},{"$f":"'V. Cloud Security'!M57","v":0},{"$f":"'V. Cloud Security'!AA57","v":1},{"$f":"'V. Cloud Security'!B57","v":"V.1.12"},{"$f":"'V. Cloud Security'!C57","v":"Are clients provided with the ability to generate a unique encryption key?"},{"$f":"'V. Cloud Security'!D57","v":0},{"$f":"'V. Cloud Security'!E57","v":0},{"$f":"'V. Cloud Security'!F57","v":0},{"$f":"'V. Cloud Security'!I57","v":"G.22 Data Security Policy - Encryption"},{"$f":"'V. Cloud Security'!J57","v":"10.1.2"},{"$f":"'V. Cloud Security'!K57","v":"Key Management"},null,null,null,"3.6.1",null,null,{"$f":"'V. Cloud Security'!AB57","v":"WP.1.A.6"}]
[{"$f":"'V. Cloud Security'!A58","v":3354},{"$f":"'V. Cloud Security'!L58","v":2},{"$f":"'V. Cloud Security'!M58","v":0},{"$f":"'V. Cloud Security'!AA58","v":1},{"$f":"'V. Cloud Security'!B58","v":"V.1.13"},{"$f":"'V. Cloud Security'!C58","v":"Are clients provided with the ability to rotate their encryption key on a scheduled basis?"},{"$f":"'V. Cloud Security'!D58","v":0},{"$f":"'V. Cloud Security'!E58","v":0},{"$f":"'V. Cloud Security'!F58","v":0},{"$f":"'V. Cloud Security'!I58","v":"G.22 Data Security Policy - Encryption"},{"$f":"'V. Cloud Security'!J58","v":"10.1.2"},{"$f":"'V. Cloud Security'!K58","v":"Key Management"},null,null,null,"3.6.4",null,null,{"$f":"'V. Cloud Security'!AB58","v":"WP.1.A.6, WP.1.A.7"}]
[{"$f":"'V. Cloud Security'!A59","v":3355},{"$f":"'V. Cloud Security'!L59","v":2},{"$f":"'V. Cloud Security'!M59","v":0},{"$f":"'V. Cloud Security'!AA59","v":1},{"$f":"'V. Cloud Security'!B59","v":"V.1.14"},{"$f":"'V. Cloud Security'!C59","v":"Is standards based federated ID capability available to clients (e.g., SAML, OpenID)?"},{"$f":"'V. Cloud Security'!D59","v":0},{"$f":"'V. Cloud Security'!E59","v":0},{"$f":"'V. Cloud Security'!F59","v":0},{"$f":"'V. Cloud Security'!I59","v":0},{"$f":"'V. Cloud Security'!J59","v":"9.2.1"},{"$f":"'V. Cloud Security'!K59","v":"User registration and de-registration"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB59","v":"WP.1.H.2, WP.1.H.4"}]
[{"$f":"'V. Cloud Security'!A60","v":3356},{"$f":"'V. Cloud Security'!L60","v":2},{"$f":"'V. Cloud Security'!M60","v":0},{"$f":"'V. Cloud Security'!AA60","v":1},{"$f":"'V. Cloud Security'!B60","v":"V.1.15"},{"$f":"'V. Cloud Security'!C60","v":"Are application self service features or an Internet accessible self-service portal available to clients? If yes, are the following functions available:"},{"$f":"'V. Cloud Security'!D60","v":0},{"$f":"'V. Cloud Security'!E60","v":0},{"$f":"'V. Cloud Security'!F60","v":0},{"$f":"'V. Cloud Security'!I60","v":0},{"$f":"'V. Cloud Security'!J60","v":"9.4.1"},{"$f":"'V. Cloud Security'!K60","v":"Information access restriction"},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A61","v":3357},{"$f":"'V. Cloud Security'!L61","v":3},{"$f":"'V. Cloud Security'!M61","v":0},{"$f":"'V. Cloud Security'!AA61","v":0},{"$f":"'V. Cloud Security'!B61","v":"V.1.15.1"},{"$f":"'V. Cloud Security'!C61","v":"Provision users?"},{"$f":"'V. Cloud Security'!D61","v":0},{"$f":"'V. Cloud Security'!E61","v":0},{"$f":"'V. Cloud Security'!F61","v":0},{"$f":"'V. Cloud Security'!I61","v":0},{"$f":"'V. Cloud Security'!J61","v":"9.2.2 "},{"$f":"'V. Cloud Security'!K61","v":"User access provisioning"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB61","v":"WP.1.H.1, WP.1.H.3, WP.1.H.5, WP.1.H.7"}]
[{"$f":"'V. Cloud Security'!A62","v":3358},{"$f":"'V. Cloud Security'!L62","v":3},{"$f":"'V. Cloud Security'!M62","v":0},{"$f":"'V. Cloud Security'!AA62","v":0},{"$f":"'V. Cloud Security'!B62","v":"V.1.15.2"},{"$f":"'V. Cloud Security'!C62","v":"Audit user entitlements?"},{"$f":"'V. Cloud Security'!D62","v":0},{"$f":"'V. Cloud Security'!E62","v":0},{"$f":"'V. Cloud Security'!F62","v":0},{"$f":"'V. Cloud Security'!I62","v":0},{"$f":"'V. Cloud Security'!J62","v":"9.2.5"},{"$f":"'V. Cloud Security'!K62","v":"Review of User Access Rights"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB62","v":"WP.1.H.9"}]
[{"$f":"'V. Cloud Security'!A63","v":3359},{"$f":"'V. Cloud Security'!L63","v":3},{"$f":"'V. Cloud Security'!M63","v":0},{"$f":"'V. Cloud Security'!AA63","v":0},{"$f":"'V. Cloud Security'!B63","v":"V.1.15.3"},{"$f":"'V. Cloud Security'!C63","v":"View uptime?"},{"$f":"'V. Cloud Security'!D63","v":0},{"$f":"'V. Cloud Security'!E63","v":0},{"$f":"'V. Cloud Security'!F63","v":0},{"$f":"'V. Cloud Security'!I63","v":0},{"$f":"'V. Cloud Security'!J63","v":"12.4.1                                                     15.2.1"},{"$f":"'V. Cloud Security'!K63","v":"Event Logging,\nMonitoring and Review of Supplier Services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB63","v":"WP.1.K.7, WP.1.K.8, WP.1.K.9, WP.1.K.10"}]
[{"$f":"'V. Cloud Security'!A64","v":3360},{"$f":"'V. Cloud Security'!L64","v":3},{"$f":"'V. Cloud Security'!M64","v":0},{"$f":"'V. Cloud Security'!AA64","v":0},{"$f":"'V. Cloud Security'!B64","v":"V.1.15.4"},{"$f":"'V. Cloud Security'!C64","v":"View real-time service interruptions?"},{"$f":"'V. Cloud Security'!D64","v":0},{"$f":"'V. Cloud Security'!E64","v":0},{"$f":"'V. Cloud Security'!F64","v":0},{"$f":"'V. Cloud Security'!I64","v":0},{"$f":"'V. Cloud Security'!J64","v":"12.4.1                                                     15.2.1"},{"$f":"'V. Cloud Security'!K64","v":"Event Logging,\nMonitoring and Review of Supplier Services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB64","v":"WP.1.H.9, WP.1.H.10"}]
[{"$f":"'V. Cloud Security'!A65","v":3361},{"$f":"'V. Cloud Security'!L65","v":3},{"$f":"'V. Cloud Security'!M65","v":0},{"$f":"'V. Cloud Security'!AA65","v":0},{"$f":"'V. Cloud Security'!B65","v":"V.1.15.5"},{"$f":"'V. Cloud Security'!C65","v":"View maintenance window information?"},{"$f":"'V. Cloud Security'!D65","v":0},{"$f":"'V. Cloud Security'!E65","v":0},{"$f":"'V. Cloud Security'!F65","v":0},{"$f":"'V. Cloud Security'!I65","v":0},{"$f":"'V. Cloud Security'!J65","v":"12.4.1                                                     15.2.1"},{"$f":"'V. Cloud Security'!K65","v":"Event Logging,\nMonitoring and Review of Supplier Services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB65","v":"WP.1.H.10"}]
[{"$f":"'V. Cloud Security'!A66","v":3362},{"$f":"'V. Cloud Security'!L66","v":3},{"$f":"'V. Cloud Security'!M66","v":0},{"$f":"'V. Cloud Security'!AA66","v":0},{"$f":"'V. Cloud Security'!B66","v":"V.1.15.6"},{"$f":"'V. Cloud Security'!C66","v":"View access logs?"},{"$f":"'V. Cloud Security'!D66","v":0},{"$f":"'V. Cloud Security'!E66","v":0},{"$f":"'V. Cloud Security'!F66","v":0},{"$f":"'V. Cloud Security'!I66","v":0},{"$f":"'V. Cloud Security'!J66","v":"12.4.1                                                     15.2.1"},{"$f":"'V. Cloud Security'!K66","v":"Event Logging,\nMonitoring and Review of Supplier Services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB66","v":"WP.1.H.9, WP.1.H.10"}]
[{"$f":"'V. Cloud Security'!A67","v":3363},{"$f":"'V. Cloud Security'!L67","v":3},{"$f":"'V. Cloud Security'!M67","v":0},{"$f":"'V. Cloud Security'!AA67","v":0},{"$f":"'V. Cloud Security'!B67","v":"V.1.15.7"},{"$f":"'V. Cloud Security'!C67","v":"Create or modify a new cloud instance?"},{"$f":"'V. Cloud Security'!D67","v":0},{"$f":"'V. Cloud Security'!E67","v":0},{"$f":"'V. Cloud Security'!F67","v":0},{"$f":"'V. Cloud Security'!I67","v":0},{"$f":"'V. Cloud Security'!J67","v":"9.2.3.b "},{"$f":"'V. Cloud Security'!K67","v":"Management of privileged access rights"},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A68","v":3364},{"$f":"'V. Cloud Security'!L68","v":3},{"$f":"'V. Cloud Security'!M68","v":0},{"$f":"'V. Cloud Security'!AA68","v":0},{"$f":"'V. Cloud Security'!B68","v":"V.1.15.8"},{"$f":"'V. Cloud Security'!C68","v":"View system health and status?"},{"$f":"'V. Cloud Security'!D68","v":0},{"$f":"'V. Cloud Security'!E68","v":0},{"$f":"'V. Cloud Security'!F68","v":0},{"$f":"'V. Cloud Security'!I68","v":0},{"$f":"'V. Cloud Security'!J68","v":"9.2.3"},{"$f":"'V. Cloud Security'!K68","v":"Management of privileged access rights"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB68","v":"WP.1.H.9, WP.1.H.10"}]
[{"$f":"'V. Cloud Security'!A69","v":3365},{"$f":"'V. Cloud Security'!L69","v":3},{"$f":"'V. Cloud Security'!M69","v":0},{"$f":"'V. Cloud Security'!AA69","v":0},{"$f":"'V. Cloud Security'!B69","v":"V.1.15.9"},{"$f":"'V. Cloud Security'!C69","v":"Create IP access lists?"},{"$f":"'V. Cloud Security'!D69","v":0},{"$f":"'V. Cloud Security'!E69","v":0},{"$f":"'V. Cloud Security'!F69","v":0},{"$f":"'V. Cloud Security'!I69","v":0},{"$f":"'V. Cloud Security'!J69","v":"9.2.3"},{"$f":"'V. Cloud Security'!K69","v":"Management of privileged access rights"},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A70","v":3366},{"$f":"'V. Cloud Security'!L70","v":3},{"$f":"'V. Cloud Security'!M70","v":0},{"$f":"'V. Cloud Security'!AA70","v":0},{"$f":"'V. Cloud Security'!B70","v":"V.1.15.10"},{"$f":"'V. Cloud Security'!C70","v":"View security events and alerts?"},{"$f":"'V. Cloud Security'!D70","v":0},{"$f":"'V. Cloud Security'!E70","v":0},{"$f":"'V. Cloud Security'!F70","v":0},{"$f":"'V. Cloud Security'!I70","v":0},{"$f":"'V. Cloud Security'!J70","v":"9.2.3"},{"$f":"'V. Cloud Security'!K70","v":"Management of privileged access rights"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB70","v":"WP.1.H.9, WP.1.H.10"}]
[{"$f":"'V. Cloud Security'!A71","v":3367},{"$f":"'V. Cloud Security'!L71","v":3},{"$f":"'V. Cloud Security'!M71","v":0},{"$f":"'V. Cloud Security'!AA71","v":0},{"$f":"'V. Cloud Security'!B71","v":"V.1.15.11"},{"$f":"'V. Cloud Security'!C71","v":"Remote administrative access to the systems?"},{"$f":"'V. Cloud Security'!D71","v":0},{"$f":"'V. Cloud Security'!E71","v":0},{"$f":"'V. Cloud Security'!F71","v":0},{"$f":"'V. Cloud Security'!I71","v":0},{"$f":"'V. Cloud Security'!J71","v":"9.2.3"},{"$f":"'V. Cloud Security'!K71","v":"Management of privileged access rights"},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A72","v":3368},{"$f":"'V. Cloud Security'!L72","v":3},{"$f":"'V. Cloud Security'!M72","v":0},{"$f":"'V. Cloud Security'!AA72","v":0},{"$f":"'V. Cloud Security'!B72","v":"V.1.15.12"},{"$f":"'V. Cloud Security'!C72","v":"View raw system and application logs?"},{"$f":"'V. Cloud Security'!D72","v":0},{"$f":"'V. Cloud Security'!E72","v":0},{"$f":"'V. Cloud Security'!F72","v":0},{"$f":"'V. Cloud Security'!I72","v":0},{"$f":"'V. Cloud Security'!J72","v":"9.2.3"},{"$f":"'V. Cloud Security'!K72","v":"Management of privileged access rights"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB72","v":"WP.1.H.9, WP.1.H.10"}]
[{"$f":"'V. Cloud Security'!A73","v":3369},{"$f":"'V. Cloud Security'!L73","v":3},{"$f":"'V. Cloud Security'!M73","v":0},{"$f":"'V. Cloud Security'!AA73","v":0},{"$f":"'V. Cloud Security'!B73","v":"V.1.15.13"},{"$f":"'V. Cloud Security'!C73","v":"Specify data retention periods?"},{"$f":"'V. Cloud Security'!D73","v":0},{"$f":"'V. Cloud Security'!E73","v":0},{"$f":"'V. Cloud Security'!F73","v":0},{"$f":"'V. Cloud Security'!I73","v":0},{"$f":"'V. Cloud Security'!J73","v":"9.2.3"},{"$f":"'V. Cloud Security'!K73","v":"Management of privileged access rights"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB73","v":"WP.1.K.2, WP.1.K.4"}]
[{"$f":"'V. Cloud Security'!A74","v":3370},{"$f":"'V. Cloud Security'!L74","v":3},{"$f":"'V. Cloud Security'!M74","v":0},{"$f":"'V. Cloud Security'!AA74","v":0},{"$f":"'V. Cloud Security'!B74","v":"V.1.15.14"},{"$f":"'V. Cloud Security'!C74","v":"Delete data on request?"},{"$f":"'V. Cloud Security'!D74","v":0},{"$f":"'V. Cloud Security'!E74","v":0},{"$f":"'V. Cloud Security'!F74","v":0},{"$f":"'V. Cloud Security'!I74","v":0},{"$f":"'V. Cloud Security'!J74","v":"9.2.3"},{"$f":"'V. Cloud Security'!K74","v":"Management of privileged access rights"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB74","v":"WP.1.K.2, WP.1.K.3"}]
[{"$f":"'V. Cloud Security'!A75","v":3371},{"$f":"'V. Cloud Security'!L75","v":3},{"$f":"'V. Cloud Security'!M75","v":0},{"$f":"'V. Cloud Security'!AA75","v":0},{"$f":"'V. Cloud Security'!B75","v":"V.1.15.15"},{"$f":"'V. Cloud Security'!C75","v":"Data extraction tool or process to allow retrieval of data?"},{"$f":"'V. Cloud Security'!D75","v":0},{"$f":"'V. Cloud Security'!E75","v":0},{"$f":"'V. Cloud Security'!F75","v":0},{"$f":"'V. Cloud Security'!I75","v":0},{"$f":"'V. Cloud Security'!J75","v":"9.2.3"},{"$f":"'V. Cloud Security'!K75","v":"Management of privileged access rights"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB75","v":"WP.1.K.5"}]
[{"$f":"'V. Cloud Security'!A76","v":3372},{"$f":"'V. Cloud Security'!L76","v":3},{"$f":"'V. Cloud Security'!M76","v":0},{"$f":"'V. Cloud Security'!AA76","v":0},{"$f":"'V. Cloud Security'!B76","v":"V.1.15.16"},{"$f":"'V. Cloud Security'!C76","v":"Create image snapshots?"},{"$f":"'V. Cloud Security'!D76","v":0},{"$f":"'V. Cloud Security'!E76","v":0},{"$f":"'V. Cloud Security'!F76","v":0},{"$f":"'V. Cloud Security'!I76","v":0},{"$f":"'V. Cloud Security'!J76","v":"9.2.3"},{"$f":"'V. Cloud Security'!K76","v":"Management of privileged access rights"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB76","v":"WP.1.D.1, WP.1.D.2"}]
[{"$f":"'V. Cloud Security'!A77","v":3373},{"$f":"'V. Cloud Security'!L77","v":2},{"$f":"'V. Cloud Security'!M77","v":0},{"$f":"'V. Cloud Security'!AA77","v":1},{"$f":"'V. Cloud Security'!B77","v":"V.1.16"},{"$f":"'V. Cloud Security'!C77","v":"Is there a management approved process to ensure that image snapshots containing Scoped Data are authorized prior to being snapped?"},{"$f":"'V. Cloud Security'!D77","v":0},{"$f":"'V. Cloud Security'!E77","v":0},{"$f":"'V. Cloud Security'!F77","v":0},{"$f":"'V. Cloud Security'!I77","v":0},{"$f":"'V. Cloud Security'!J77","v":"9.2.3"},{"$f":"'V. Cloud Security'!K77","v":"Management of privileged access rights"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB77","v":"WP.1.D.2"}]
[{"$f":"'V. Cloud Security'!A78","v":3374},{"$f":"'V. Cloud Security'!L78","v":3},{"$f":"'V. Cloud Security'!M78","v":0},{"$f":"'V. Cloud Security'!AA78","v":0},{"$f":"'V. Cloud Security'!B78","v":"V.1.16.1"},{"$f":"'V. Cloud Security'!C78","v":"Are image snapshots containing Scoped Data stored in an environment where the security controls protecting them are commensurate with the production environment?"},{"$f":"'V. Cloud Security'!D78","v":0},{"$f":"'V. Cloud Security'!E78","v":0},{"$f":"'V. Cloud Security'!F78","v":0},{"$f":"'V. Cloud Security'!I78","v":0},{"$f":"'V. Cloud Security'!J78","v":"9.2.3"},{"$f":"'V. Cloud Security'!K78","v":"Management of privileged access rights"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB78","v":"WP.1.D.2"}]
[{"$f":"'V. Cloud Security'!A79","v":3375},{"$f":"'V. Cloud Security'!L79","v":2},{"$f":"'V. Cloud Security'!M79","v":1},{"$f":"'V. Cloud Security'!AA79","v":0},{"$f":"'V. Cloud Security'!B79","v":"V.1.17"},{"$f":"'V. Cloud Security'!C79","v":"Are clients provided the ability to:"},{"$f":"'V. Cloud Security'!D79","v":0},{"$f":"'V. Cloud Security'!E79","v":0},{"$f":"'V. Cloud Security'!F79","v":0},{"$f":"'V. Cloud Security'!I79","v":0},{"$f":"'V. Cloud Security'!J79","v":"NA"},{"$f":"'V. Cloud Security'!K79","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB79","v":"WP.1.A.10"}]
[{"$f":"'V. Cloud Security'!A80","v":3376},{"$f":"'V. Cloud Security'!L80","v":3},{"$f":"'V. Cloud Security'!M80","v":0},{"$f":"'V. Cloud Security'!AA80","v":0},{"$f":"'V. Cloud Security'!B80","v":"V.1.17.1"},{"$f":"'V. Cloud Security'!C80","v":"Execute a vulnerability scan of the external environment?"},{"$f":"'V. Cloud Security'!D80","v":0},{"$f":"'V. Cloud Security'!E80","v":0},{"$f":"'V. Cloud Security'!F80","v":0},{"$f":"'V. Cloud Security'!I80","v":"I.1 Application Vulnerability Assessments/Ethical Hacking"},{"$f":"'V. Cloud Security'!J80","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!K80","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A81","v":3377},{"$f":"'V. Cloud Security'!L81","v":3},{"$f":"'V. Cloud Security'!M81","v":0},{"$f":"'V. Cloud Security'!AA81","v":0},{"$f":"'V. Cloud Security'!B81","v":"V.1.17.2"},{"$f":"'V. Cloud Security'!C81","v":"Execute a penetration test of the external environment?"},{"$f":"'V. Cloud Security'!D81","v":0},{"$f":"'V. Cloud Security'!E81","v":0},{"$f":"'V. Cloud Security'!F81","v":0},{"$f":"'V. Cloud Security'!I81","v":"I.1 Application Vulnerability Assessments/Ethical Hacking"},{"$f":"'V. Cloud Security'!J81","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!K81","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB81","v":"WP.1.A.10, WP.1.I.7.d"}]
[{"$f":"'V. Cloud Security'!A82","v":3378},{"$f":"'V. Cloud Security'!L82","v":3},{"$f":"'V. Cloud Security'!M82","v":0},{"$f":"'V. Cloud Security'!AA82","v":0},{"$f":"'V. Cloud Security'!B82","v":"V.1.17.3"},{"$f":"'V. Cloud Security'!C82","v":"Execute a secure code review?"},{"$f":"'V. Cloud Security'!D82","v":0},{"$f":"'V. Cloud Security'!E82","v":0},{"$f":"'V. Cloud Security'!F82","v":0},{"$f":"'V. Cloud Security'!I82","v":"I.2 Secure Systems Development Life Cycle Code Reviews"},{"$f":"'V. Cloud Security'!J82","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!K82","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A83","v":3379},{"$f":"'V. Cloud Security'!L83","v":2},{"$f":"'V. Cloud Security'!M83","v":0},{"$f":"'V. Cloud Security'!AA83","v":1},{"$f":"'V. Cloud Security'!B83","v":"V.1.18"},{"$f":"'V. Cloud Security'!C83","v":"Is there a cloud audit program to address client audit and assessment requirements? If yes, does this program permit:"},{"$f":"'V. Cloud Security'!D83","v":0},{"$f":"'V. Cloud Security'!E83","v":0},{"$f":"'V. Cloud Security'!F83","v":0},{"$f":"'V. Cloud Security'!I83","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!J83","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!K83","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,10.8]
[{"$f":"'V. Cloud Security'!A84","v":3380},{"$f":"'V. Cloud Security'!L84","v":3},{"$f":"'V. Cloud Security'!M84","v":0},{"$f":"'V. Cloud Security'!AA84","v":0},{"$f":"'V. Cloud Security'!B84","v":"V.1.18.1"},{"$f":"'V. Cloud Security'!C84","v":"Onsite assessments by clients?"},{"$f":"'V. Cloud Security'!D84","v":0},{"$f":"'V. Cloud Security'!E84","v":0},{"$f":"'V. Cloud Security'!F84","v":0},{"$f":"'V. Cloud Security'!I84","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!J84","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!K84","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB84","v":"WP.1.F.5"}]
[{"$f":"'V. Cloud Security'!A85","v":3381},{"$f":"'V. Cloud Security'!L85","v":3},{"$f":"'V. Cloud Security'!M85","v":0},{"$f":"'V. Cloud Security'!AA85","v":0},{"$f":"'V. Cloud Security'!B85","v":"V.1.18.2"},{"$f":"'V. Cloud Security'!C85","v":"Program documentation describing audit capabilities, roles and responsibilities?"},{"$f":"'V. Cloud Security'!D85","v":0},{"$f":"'V. Cloud Security'!E85","v":0},{"$f":"'V. Cloud Security'!F85","v":0},{"$f":"'V. Cloud Security'!I85","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!J85","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!K85","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB85","v":"WP.1.F.4, WP.1.F.5 "}]
[{"$f":"'V. Cloud Security'!A86","v":3382},{"$f":"'V. Cloud Security'!L86","v":3},{"$f":"'V. Cloud Security'!M86","v":0},{"$f":"'V. Cloud Security'!AA86","v":0},{"$f":"'V. Cloud Security'!B86","v":"V.1.18.3"},{"$f":"'V. Cloud Security'!C86","v":"Scheduled internal audits?"},{"$f":"'V. Cloud Security'!D86","v":0},{"$f":"'V. Cloud Security'!E86","v":0},{"$f":"'V. Cloud Security'!F86","v":0},{"$f":"'V. Cloud Security'!I86","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!J86","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!K86","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB86","v":"WP.1.J.6"}]
[{"$f":"'V. Cloud Security'!A87","v":3383},{"$f":"'V. Cloud Security'!L87","v":3},{"$f":"'V. Cloud Security'!M87","v":0},{"$f":"'V. Cloud Security'!AA87","v":0},{"$f":"'V. Cloud Security'!B87","v":"V.1.18.4"},{"$f":"'V. Cloud Security'!C87","v":"Controls verification and validation performed by independent, third party information security professionals?"},{"$f":"'V. Cloud Security'!D87","v":0},{"$f":"'V. Cloud Security'!E87","v":0},{"$f":"'V. Cloud Security'!F87","v":0},{"$f":"'V. Cloud Security'!I87","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!J87","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!K87","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB87","v":"WP.1.F.4, WP.1.F.5 "}]
[{"$f":"'V. Cloud Security'!A88","v":3384},{"$f":"'V. Cloud Security'!L88","v":2},{"$f":"'V. Cloud Security'!M88","v":0},{"$f":"'V. Cloud Security'!AA88","v":0},{"$f":"'V. Cloud Security'!B88","v":"V.1.19"},{"$f":"'V. Cloud Security'!C88","v":"Is there a full time internal security team assigned to protecting the cloud infrastructure?"},{"$f":"'V. Cloud Security'!D88","v":0},{"$f":"'V. Cloud Security'!E88","v":0},{"$f":"'V. Cloud Security'!F88","v":0},{"$f":"'V. Cloud Security'!I88","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!J88","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!K88","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A89","v":3385},{"$f":"'V. Cloud Security'!L89","v":2},{"$f":"'V. Cloud Security'!M89","v":1},{"$f":"'V. Cloud Security'!AA89","v":0},{"$f":"'V. Cloud Security'!B89","v":"V.1.20"},{"$f":"'V. Cloud Security'!C89","v":"Are the following artifacts available during a client audit:"},{"$f":"'V. Cloud Security'!D89","v":0},{"$f":"'V. Cloud Security'!E89","v":0},{"$f":"'V. Cloud Security'!F89","v":0},{"$f":"'V. Cloud Security'!I89","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!J89","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!K89","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB89","v":"WP.1.A.1, WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A90","v":3386},{"$f":"'V. Cloud Security'!L90","v":3},{"$f":"'V. Cloud Security'!M90","v":0},{"$f":"'V. Cloud Security'!AA90","v":0},{"$f":"'V. Cloud Security'!B90","v":"V.1.20.1"},{"$f":"'V. Cloud Security'!C90","v":"Cloud topology and architecture diagrams?"},{"$f":"'V. Cloud Security'!D90","v":0},{"$f":"'V. Cloud Security'!E90","v":0},{"$f":"'V. Cloud Security'!F90","v":0},{"$f":"'V. Cloud Security'!I90","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!J90","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!K90","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB90","v":"WP.1.A.1, WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A91","v":3387},{"$f":"'V. Cloud Security'!L91","v":3},{"$f":"'V. Cloud Security'!M91","v":0},{"$f":"'V. Cloud Security'!AA91","v":0},{"$f":"'V. Cloud Security'!B91","v":"V.1.20.2"},{"$f":"'V. Cloud Security'!C91","v":"Connectivity diagrams?"},{"$f":"'V. Cloud Security'!D91","v":0},{"$f":"'V. Cloud Security'!E91","v":0},{"$f":"'V. Cloud Security'!F91","v":0},{"$f":"'V. Cloud Security'!I91","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!J91","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!K91","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB91","v":"WP.1.A.1, WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A92","v":3388},{"$f":"'V. Cloud Security'!L92","v":3},{"$f":"'V. Cloud Security'!M92","v":0},{"$f":"'V. Cloud Security'!AA92","v":0},{"$f":"'V. Cloud Security'!B92","v":"V.1.20.3"},{"$f":"'V. Cloud Security'!C92","v":"List of ports that are open externally?"},{"$f":"'V. Cloud Security'!D92","v":0},{"$f":"'V. Cloud Security'!E92","v":0},{"$f":"'V. Cloud Security'!F92","v":0},{"$f":"'V. Cloud Security'!I92","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!J92","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!K92","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB92","v":"WP.1.A.1, WP.1.E.1, WP.1.H.6, WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A93","v":3389},{"$f":"'V. Cloud Security'!L93","v":3},{"$f":"'V. Cloud Security'!M93","v":0},{"$f":"'V. Cloud Security'!AA93","v":0},{"$f":"'V. Cloud Security'!B93","v":"V.1.20.4"},{"$f":"'V. Cloud Security'!C93","v":"Component and system configuration standards?"},{"$f":"'V. Cloud Security'!D93","v":0},{"$f":"'V. Cloud Security'!E93","v":0},{"$f":"'V. Cloud Security'!F93","v":0},{"$f":"'V. Cloud Security'!I93","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!J93","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!K93","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB93","v":"WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A94","v":3390},{"$f":"'V. Cloud Security'!L94","v":3},{"$f":"'V. Cloud Security'!M94","v":0},{"$f":"'V. Cloud Security'!AA94","v":0},{"$f":"'V. Cloud Security'!B94","v":"V.1.20.5"},{"$f":"'V. Cloud Security'!C94","v":"Standard operating procedures?"},{"$f":"'V. Cloud Security'!D94","v":0},{"$f":"'V. Cloud Security'!E94","v":0},{"$f":"'V. Cloud Security'!F94","v":0},{"$f":"'V. Cloud Security'!I94","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!J94","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!K94","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB94","v":"WP.1.K.6"}]
[{"$f":"'V. Cloud Security'!A95","v":3391},{"$f":"'V. Cloud Security'!L95","v":2},{"$f":"'V. Cloud Security'!M95","v":1},{"$f":"'V. Cloud Security'!AA95","v":0},{"$f":"'V. Cloud Security'!B95","v":"V.1.21"},{"$f":"'V. Cloud Security'!C95","v":"Who is responsible for user entitlement audits:"},{"$f":"'V. Cloud Security'!D95","v":0},{"$f":"'V. Cloud Security'!E95","v":0},{"$f":"'V. Cloud Security'!F95","v":0},{"$f":"'V. Cloud Security'!I95","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!J95","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!K95","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB95","v":"WP.1.H.9, WP.1.F.4, WP.1.F.5"}]
[{"$f":"'V. Cloud Security'!A96","v":3392},{"$f":"'V. Cloud Security'!L96","v":3},{"$f":"'V. Cloud Security'!M96","v":0},{"$f":"'V. Cloud Security'!AA96","v":0},{"$f":"'V. Cloud Security'!B96","v":"V.1.21.1"},{"$f":"'V. Cloud Security'!C96","v":"Cloud provider?"},{"$f":"'V. Cloud Security'!D96","v":0},{"$f":"'V. Cloud Security'!E96","v":0},{"$f":"'V. Cloud Security'!F96","v":0},{"$f":"'V. Cloud Security'!I96","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!J96","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!K96","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB96","v":"WP.1.H.9, WP.1.F.4, WP.1.F.5"}]
[{"$f":"'V. Cloud Security'!A97","v":3393},{"$f":"'V. Cloud Security'!L97","v":3},{"$f":"'V. Cloud Security'!M97","v":0},{"$f":"'V. Cloud Security'!AA97","v":0},{"$f":"'V. Cloud Security'!B97","v":"V.1.21.2"},{"$f":"'V. Cloud Security'!C97","v":"Client?"},{"$f":"'V. Cloud Security'!D97","v":0},{"$f":"'V. Cloud Security'!E97","v":0},{"$f":"'V. Cloud Security'!F97","v":0},{"$f":"'V. Cloud Security'!I97","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!J97","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!K97","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB97","v":"WP.1.H.9, WP.1.F.4, WP.1.F.5"}]
[{"$f":"'V. Cloud Security'!A98","v":3394},{"$f":"'V. Cloud Security'!L98","v":2},{"$f":"'V. Cloud Security'!M98","v":0},{"$f":"'V. Cloud Security'!AA98","v":1},{"$f":"'V. Cloud Security'!B98","v":"V.1.22"},{"$f":"'V. Cloud Security'!C98","v":"Is there a formal development methodology in operation? If yes, does this include:"},{"$f":"'V. Cloud Security'!D98","v":0},{"$f":"'V. Cloud Security'!E98","v":0},{"$f":"'V. Cloud Security'!F98","v":0},{"$f":"'V. Cloud Security'!I98","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!J98","v":"12.5.1"},{"$f":"'V. Cloud Security'!K98","v":"Control of Operational Software"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB98","v":"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3"}]
[{"$f":"'V. Cloud Security'!A99","v":3395},{"$f":"'V. Cloud Security'!L99","v":3},{"$f":"'V. Cloud Security'!M99","v":0},{"$f":"'V. Cloud Security'!AA99","v":0},{"$f":"'V. Cloud Security'!B99","v":"V.1.22.1"},{"$f":"'V. Cloud Security'!C99","v":"Waterfall"},{"$f":"'V. Cloud Security'!D99","v":0},{"$f":"'V. Cloud Security'!E99","v":0},{"$f":"'V. Cloud Security'!F99","v":0},{"$f":"'V. Cloud Security'!I99","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!J99","v":"NA"},{"$f":"'V. Cloud Security'!K99","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB99","v":"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3"}]
[{"$f":"'V. Cloud Security'!A100","v":3396},{"$f":"'V. Cloud Security'!L100","v":3},{"$f":"'V. Cloud Security'!M100","v":0},{"$f":"'V. Cloud Security'!AA100","v":0},{"$f":"'V. Cloud Security'!B100","v":"V.1.22.2"},{"$f":"'V. Cloud Security'!C100","v":"Agile? If yes, what groups:"},{"$f":"'V. Cloud Security'!D100","v":0},{"$f":"'V. Cloud Security'!E100","v":0},{"$f":"'V. Cloud Security'!F100","v":0},{"$f":"'V. Cloud Security'!I100","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!J100","v":"NA"},{"$f":"'V. Cloud Security'!K100","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB100","v":"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3"}]
[{"$f":"'V. Cloud Security'!A101","v":3397},{"$f":"'V. Cloud Security'!L101","v":4},{"$f":"'V. Cloud Security'!M101","v":0},{"$f":"'V. Cloud Security'!AA101","v":0},{"$f":"'V. Cloud Security'!B101","v":"V.1.22.2.1"},{"$f":"'V. Cloud Security'!C101","v":"Development?"},{"$f":"'V. Cloud Security'!D101","v":0},{"$f":"'V. Cloud Security'!E101","v":0},{"$f":"'V. Cloud Security'!F101","v":0},{"$f":"'V. Cloud Security'!I101","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!J101","v":"NA"},{"$f":"'V. Cloud Security'!K101","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB101","v":"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3"}]
[{"$f":"'V. Cloud Security'!A102","v":3398},{"$f":"'V. Cloud Security'!L102","v":4},{"$f":"'V. Cloud Security'!M102","v":0},{"$f":"'V. Cloud Security'!AA102","v":0},{"$f":"'V. Cloud Security'!B102","v":"V.1.22.2.2"},{"$f":"'V. Cloud Security'!C102","v":"QA?"},{"$f":"'V. Cloud Security'!D102","v":0},{"$f":"'V. Cloud Security'!E102","v":0},{"$f":"'V. Cloud Security'!F102","v":0},{"$f":"'V. Cloud Security'!I102","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!J102","v":"NA"},{"$f":"'V. Cloud Security'!K102","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB102","v":"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3"}]
[{"$f":"'V. Cloud Security'!A103","v":3399},{"$f":"'V. Cloud Security'!L103","v":4},{"$f":"'V. Cloud Security'!M103","v":0},{"$f":"'V. Cloud Security'!AA103","v":0},{"$f":"'V. Cloud Security'!B103","v":"V.1.22.2.3"},{"$f":"'V. Cloud Security'!C103","v":"Security?"},{"$f":"'V. Cloud Security'!D103","v":0},{"$f":"'V. Cloud Security'!E103","v":0},{"$f":"'V. Cloud Security'!F103","v":0},{"$f":"'V. Cloud Security'!I103","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!J103","v":"NA"},{"$f":"'V. Cloud Security'!K103","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB103","v":"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3"}]
[{"$f":"'V. Cloud Security'!A104","v":3400},{"$f":"'V. Cloud Security'!L104","v":3},{"$f":"'V. Cloud Security'!M104","v":0},{"$f":"'V. Cloud Security'!AA104","v":0},{"$f":"'V. Cloud Security'!B104","v":"V.1.22.3"},{"$f":"'V. Cloud Security'!C104","v":"Other?"},{"$f":"'V. Cloud Security'!D104","v":0},{"$f":"'V. Cloud Security'!E104","v":0},{"$f":"'V. Cloud Security'!F104","v":0},{"$f":"'V. Cloud Security'!I104","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!J104","v":"NA"},{"$f":"'V. Cloud Security'!K104","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A105","v":3401},{"$f":"'V. Cloud Security'!L105","v":2},{"$f":"'V. Cloud Security'!M105","v":0},{"$f":"'V. Cloud Security'!AA105","v":1},{"$f":"'V. Cloud Security'!B105","v":"V.1.23"},{"$f":"'V. Cloud Security'!C105","v":"Is there a formal process to ensure clients are notified prior to changes being made which may impact their service? If yes, what is the communication method:"},{"$f":"'V. Cloud Security'!D105","v":0},{"$f":"'V. Cloud Security'!E105","v":0},{"$f":"'V. Cloud Security'!F105","v":0},{"$f":"'V. Cloud Security'!I105","v":"G.21 Change Control"},{"$f":"'V. Cloud Security'!J105","v":"12.1.2"},{"$f":"'V. Cloud Security'!K105","v":"Change management"},null,null,null,6.4,null,null,{"$f":"'V. Cloud Security'!AB105","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A106","v":3402},{"$f":"'V. Cloud Security'!L106","v":3},{"$f":"'V. Cloud Security'!M106","v":0},{"$f":"'V. Cloud Security'!AA106","v":0},{"$f":"'V. Cloud Security'!B106","v":"V.1.23.1"},{"$f":"'V. Cloud Security'!C106","v":"Post to website or portal?"},{"$f":"'V. Cloud Security'!D106","v":0},{"$f":"'V. Cloud Security'!E106","v":0},{"$f":"'V. Cloud Security'!F106","v":0},{"$f":"'V. Cloud Security'!I106","v":"G.21 Change Control"},{"$f":"'V. Cloud Security'!J106","v":"NA"},{"$f":"'V. Cloud Security'!K106","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB106","v":"WP.1.F.6, WP.1.E.3, WP.1.H.10"}]
[{"$f":"'V. Cloud Security'!A107","v":3403},{"$f":"'V. Cloud Security'!L107","v":3},{"$f":"'V. Cloud Security'!M107","v":0},{"$f":"'V. Cloud Security'!AA107","v":0},{"$f":"'V. Cloud Security'!B107","v":"V.1.23.2"},{"$f":"'V. Cloud Security'!C107","v":"Email?"},{"$f":"'V. Cloud Security'!D107","v":0},{"$f":"'V. Cloud Security'!E107","v":0},{"$f":"'V. Cloud Security'!F107","v":0},{"$f":"'V. Cloud Security'!I107","v":"G.21 Change Control"},{"$f":"'V. Cloud Security'!J107","v":"NA"},{"$f":"'V. Cloud Security'!K107","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB107","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A108","v":3404},{"$f":"'V. Cloud Security'!L108","v":3},{"$f":"'V. Cloud Security'!M108","v":0},{"$f":"'V. Cloud Security'!AA108","v":0},{"$f":"'V. Cloud Security'!B108","v":"V.1.23.3"},{"$f":"'V. Cloud Security'!C108","v":"Verbal?"},{"$f":"'V. Cloud Security'!D108","v":0},{"$f":"'V. Cloud Security'!E108","v":0},{"$f":"'V. Cloud Security'!F108","v":0},{"$f":"'V. Cloud Security'!I108","v":"G.21 Change Control"},{"$f":"'V. Cloud Security'!J108","v":"NA"},{"$f":"'V. Cloud Security'!K108","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB108","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A109","v":3405},{"$f":"'V. Cloud Security'!L109","v":3},{"$f":"'V. Cloud Security'!M109","v":0},{"$f":"'V. Cloud Security'!AA109","v":0},{"$f":"'V. Cloud Security'!B109","v":"V.1.23.4"},{"$f":"'V. Cloud Security'!C109","v":"Other?"},{"$f":"'V. Cloud Security'!D109","v":0},{"$f":"'V. Cloud Security'!E109","v":0},{"$f":"'V. Cloud Security'!F109","v":0},{"$f":"'V. Cloud Security'!I109","v":"G.21 Change Control"},{"$f":"'V. Cloud Security'!J109","v":"NA"},{"$f":"'V. Cloud Security'!K109","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB109","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A110","v":3406},{"$f":"'V. Cloud Security'!L110","v":2},{"$f":"'V. Cloud Security'!M110","v":0},{"$f":"'V. Cloud Security'!AA110","v":1},{"$f":"'V. Cloud Security'!B110","v":"V.1.24"},{"$f":"'V. Cloud Security'!C110","v":"Is there a scheduled maintenance window? If yes, what is the frequency:"},{"$f":"'V. Cloud Security'!D110","v":0},{"$f":"'V. Cloud Security'!E110","v":0},{"$f":"'V. Cloud Security'!F110","v":0},{"$f":"'V. Cloud Security'!I110","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J110","v":"12.6.1 "},{"$f":"'V. Cloud Security'!K110","v":"Management of technical vulnerabilities"},null,null,null,"11.3.1, 11.3.2",null,null,{"$f":"'V. Cloud Security'!AB110","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A111","v":3407},{"$f":"'V. Cloud Security'!L111","v":3},{"$f":"'V. Cloud Security'!M111","v":0},{"$f":"'V. Cloud Security'!AA111","v":0},{"$f":"'V. Cloud Security'!B111","v":"V.1.24.1"},{"$f":"'V. Cloud Security'!C111","v":"Daily?"},{"$f":"'V. Cloud Security'!D111","v":0},{"$f":"'V. Cloud Security'!E111","v":0},{"$f":"'V. Cloud Security'!F111","v":0},{"$f":"'V. Cloud Security'!I111","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J111","v":"NA"},{"$f":"'V. Cloud Security'!K111","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB111","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A112","v":3408},{"$f":"'V. Cloud Security'!L112","v":3},{"$f":"'V. Cloud Security'!M112","v":0},{"$f":"'V. Cloud Security'!AA112","v":0},{"$f":"'V. Cloud Security'!B112","v":"V.1.24.2"},{"$f":"'V. Cloud Security'!C112","v":"Weekly?"},{"$f":"'V. Cloud Security'!D112","v":0},{"$f":"'V. Cloud Security'!E112","v":0},{"$f":"'V. Cloud Security'!F112","v":0},{"$f":"'V. Cloud Security'!I112","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J112","v":"NA"},{"$f":"'V. Cloud Security'!K112","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB112","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A113","v":3409},{"$f":"'V. Cloud Security'!L113","v":3},{"$f":"'V. Cloud Security'!M113","v":0},{"$f":"'V. Cloud Security'!AA113","v":0},{"$f":"'V. Cloud Security'!B113","v":"V.1.24.3"},{"$f":"'V. Cloud Security'!C113","v":"Biweekly?"},{"$f":"'V. Cloud Security'!D113","v":0},{"$f":"'V. Cloud Security'!E113","v":0},{"$f":"'V. Cloud Security'!F113","v":0},{"$f":"'V. Cloud Security'!I113","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J113","v":"NA"},{"$f":"'V. Cloud Security'!K113","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB113","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A114","v":3410},{"$f":"'V. Cloud Security'!L114","v":3},{"$f":"'V. Cloud Security'!M114","v":0},{"$f":"'V. Cloud Security'!AA114","v":0},{"$f":"'V. Cloud Security'!B114","v":"V.1.24.4"},{"$f":"'V. Cloud Security'!C114","v":"Monthly?"},{"$f":"'V. Cloud Security'!D114","v":0},{"$f":"'V. Cloud Security'!E114","v":0},{"$f":"'V. Cloud Security'!F114","v":0},{"$f":"'V. Cloud Security'!I114","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J114","v":"NA"},{"$f":"'V. Cloud Security'!K114","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB114","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A115","v":3411},{"$f":"'V. Cloud Security'!L115","v":3},{"$f":"'V. Cloud Security'!M115","v":0},{"$f":"'V. Cloud Security'!AA115","v":0},{"$f":"'V. Cloud Security'!B115","v":"V.1.24.5"},{"$f":"'V. Cloud Security'!C115","v":"Other?"},{"$f":"'V. Cloud Security'!D115","v":0},{"$f":"'V. Cloud Security'!E115","v":0},{"$f":"'V. Cloud Security'!F115","v":0},{"$f":"'V. Cloud Security'!I115","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J115","v":"NA"},{"$f":"'V. Cloud Security'!K115","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB115","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A116","v":3412},{"$f":"'V. Cloud Security'!L116","v":2},{"$f":"'V. Cloud Security'!M116","v":0},{"$f":"'V. Cloud Security'!AA116","v":1},{"$f":"'V. Cloud Security'!B116","v":"V.1.25"},{"$f":"'V. Cloud Security'!C116","v":"Is there a scheduled maintenance window which results in client downtime? If yes, what is the downtime:"},{"$f":"'V. Cloud Security'!D116","v":0},{"$f":"'V. Cloud Security'!E116","v":0},{"$f":"'V. Cloud Security'!F116","v":0},{"$f":"'V. Cloud Security'!I116","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J116","v":"14.2.2.l"},{"$f":"'V. Cloud Security'!K116","v":"System change control procedures"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB116","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A117","v":3413},{"$f":"'V. Cloud Security'!L117","v":3},{"$f":"'V. Cloud Security'!M117","v":0},{"$f":"'V. Cloud Security'!AA117","v":0},{"$f":"'V. Cloud Security'!B117","v":"V.1.25.1"},{"$f":"'V. Cloud Security'!C117","v":"< 30 min?"},{"$f":"'V. Cloud Security'!D117","v":0},{"$f":"'V. Cloud Security'!E117","v":0},{"$f":"'V. Cloud Security'!F117","v":0},{"$f":"'V. Cloud Security'!I117","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J117","v":"NA"},{"$f":"'V. Cloud Security'!K117","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB117","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A118","v":3414},{"$f":"'V. Cloud Security'!L118","v":3},{"$f":"'V. Cloud Security'!M118","v":0},{"$f":"'V. Cloud Security'!AA118","v":0},{"$f":"'V. Cloud Security'!B118","v":"V.1.25.2"},{"$f":"'V. Cloud Security'!C118","v":">30 min < 60 min?"},{"$f":"'V. Cloud Security'!D118","v":0},{"$f":"'V. Cloud Security'!E118","v":0},{"$f":"'V. Cloud Security'!F118","v":0},{"$f":"'V. Cloud Security'!I118","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J118","v":"NA"},{"$f":"'V. Cloud Security'!K118","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB118","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A119","v":3415},{"$f":"'V. Cloud Security'!L119","v":3},{"$f":"'V. Cloud Security'!M119","v":0},{"$f":"'V. Cloud Security'!AA119","v":0},{"$f":"'V. Cloud Security'!B119","v":"V.1.25.3"},{"$f":"'V. Cloud Security'!C119","v":">60 min < 120 min?"},{"$f":"'V. Cloud Security'!D119","v":0},{"$f":"'V. Cloud Security'!E119","v":0},{"$f":"'V. Cloud Security'!F119","v":0},{"$f":"'V. Cloud Security'!I119","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J119","v":"NA"},{"$f":"'V. Cloud Security'!K119","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB119","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A120","v":3416},{"$f":"'V. Cloud Security'!L120","v":3},{"$f":"'V. Cloud Security'!M120","v":0},{"$f":"'V. Cloud Security'!AA120","v":0},{"$f":"'V. Cloud Security'!B120","v":"V.1.25.4"},{"$f":"'V. Cloud Security'!C120","v":">120 min < 180 min?"},{"$f":"'V. Cloud Security'!D120","v":0},{"$f":"'V. Cloud Security'!E120","v":0},{"$f":"'V. Cloud Security'!F120","v":0},{"$f":"'V. Cloud Security'!I120","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J120","v":"NA"},{"$f":"'V. Cloud Security'!K120","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB120","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A121","v":3417},{"$f":"'V. Cloud Security'!L121","v":3},{"$f":"'V. Cloud Security'!M121","v":0},{"$f":"'V. Cloud Security'!AA121","v":0},{"$f":"'V. Cloud Security'!B121","v":"V.1.25.5"},{"$f":"'V. Cloud Security'!C121","v":"Other?"},{"$f":"'V. Cloud Security'!D121","v":0},{"$f":"'V. Cloud Security'!E121","v":0},{"$f":"'V. Cloud Security'!F121","v":0},{"$f":"'V. Cloud Security'!I121","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J121","v":"NA"},{"$f":"'V. Cloud Security'!K121","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB121","v":"WP.1.K.6, WP.1.K.7, WP.1.K.8"}]
[{"$f":"'V. Cloud Security'!A122","v":3418},{"$f":"'V. Cloud Security'!L122","v":2},{"$f":"'V. Cloud Security'!M122","v":0},{"$f":"'V. Cloud Security'!AA122","v":1},{"$f":"'V. Cloud Security'!B122","v":"V.1.26"},{"$f":"'V. Cloud Security'!C122","v":"Is there an online incident response status portal, which outlines planned and unplanned outages? If yes, how long after an unplanned outage is this updated:"},{"$f":"'V. Cloud Security'!D122","v":0},{"$f":"'V. Cloud Security'!E122","v":0},{"$f":"'V. Cloud Security'!F122","v":0},{"$f":"'V. Cloud Security'!I122","v":"J. Information Security Incident Management, P.8 Privacy Incident and Response Management"},{"$f":"'V. Cloud Security'!J122","v":"14.2.2"},{"$f":"'V. Cloud Security'!K122","v":"System change control procedures"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB122","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A123","v":3419},{"$f":"'V. Cloud Security'!L123","v":3},{"$f":"'V. Cloud Security'!M123","v":0},{"$f":"'V. Cloud Security'!AA123","v":0},{"$f":"'V. Cloud Security'!B123","v":"V.1.26.1"},{"$f":"'V. Cloud Security'!C123","v":"Real-time?"},{"$f":"'V. Cloud Security'!D123","v":0},{"$f":"'V. Cloud Security'!E123","v":0},{"$f":"'V. Cloud Security'!F123","v":0},{"$f":"'V. Cloud Security'!I123","v":0},{"$f":"'V. Cloud Security'!J123","v":"NA"},{"$f":"'V. Cloud Security'!K123","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB123","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A124","v":3420},{"$f":"'V. Cloud Security'!L124","v":3},{"$f":"'V. Cloud Security'!M124","v":0},{"$f":"'V. Cloud Security'!AA124","v":0},{"$f":"'V. Cloud Security'!B124","v":"V.1.26.2"},{"$f":"'V. Cloud Security'!C124","v":"< 30 min?"},{"$f":"'V. Cloud Security'!D124","v":0},{"$f":"'V. Cloud Security'!E124","v":0},{"$f":"'V. Cloud Security'!F124","v":0},{"$f":"'V. Cloud Security'!I124","v":0},{"$f":"'V. Cloud Security'!J124","v":"NA"},{"$f":"'V. Cloud Security'!K124","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB124","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A125","v":3421},{"$f":"'V. Cloud Security'!L125","v":3},{"$f":"'V. Cloud Security'!M125","v":0},{"$f":"'V. Cloud Security'!AA125","v":0},{"$f":"'V. Cloud Security'!B125","v":"V.1.26.3"},{"$f":"'V. Cloud Security'!C125","v":">30 min < 60 min?"},{"$f":"'V. Cloud Security'!D125","v":0},{"$f":"'V. Cloud Security'!E125","v":0},{"$f":"'V. Cloud Security'!F125","v":0},{"$f":"'V. Cloud Security'!I125","v":0},{"$f":"'V. Cloud Security'!J125","v":"NA"},{"$f":"'V. Cloud Security'!K125","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB125","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A126","v":3422},{"$f":"'V. Cloud Security'!L126","v":3},{"$f":"'V. Cloud Security'!M126","v":0},{"$f":"'V. Cloud Security'!AA126","v":0},{"$f":"'V. Cloud Security'!B126","v":"V.1.26.4"},{"$f":"'V. Cloud Security'!C126","v":">60 min < 120 min?"},{"$f":"'V. Cloud Security'!D126","v":0},{"$f":"'V. Cloud Security'!E126","v":0},{"$f":"'V. Cloud Security'!F126","v":0},{"$f":"'V. Cloud Security'!I126","v":0},{"$f":"'V. Cloud Security'!J126","v":"NA"},{"$f":"'V. Cloud Security'!K126","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB126","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A127","v":3423},{"$f":"'V. Cloud Security'!L127","v":3},{"$f":"'V. Cloud Security'!M127","v":0},{"$f":"'V. Cloud Security'!AA127","v":0},{"$f":"'V. Cloud Security'!B127","v":"V.1.26.5"},{"$f":"'V. Cloud Security'!C127","v":">120 min < 180 min?"},{"$f":"'V. Cloud Security'!D127","v":0},{"$f":"'V. Cloud Security'!E127","v":0},{"$f":"'V. Cloud Security'!F127","v":0},{"$f":"'V. Cloud Security'!I127","v":0},{"$f":"'V. Cloud Security'!J127","v":"NA"},{"$f":"'V. Cloud Security'!K127","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB127","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A128","v":3424},{"$f":"'V. Cloud Security'!L128","v":3},{"$f":"'V. Cloud Security'!M128","v":0},{"$f":"'V. Cloud Security'!AA128","v":0},{"$f":"'V. Cloud Security'!B128","v":"V.1.26.6"},{"$f":"'V. Cloud Security'!C128","v":"Other?"},{"$f":"'V. Cloud Security'!D128","v":0},{"$f":"'V. Cloud Security'!E128","v":0},{"$f":"'V. Cloud Security'!F128","v":0},{"$f":"'V. Cloud Security'!I128","v":0},{"$f":"'V. Cloud Security'!J128","v":"NA"},{"$f":"'V. Cloud Security'!K128","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB128","v":"WP.1.F.6, WP.1.E.3"}]
[{"$f":"'V. Cloud Security'!A129","v":3425},{"$f":"'V. Cloud Security'!L129","v":2},{"$f":"'V. Cloud Security'!M129","v":0},{"$f":"'V. Cloud Security'!AA129","v":0},{"$f":"'V. Cloud Security'!B129","v":"V.1.27"},{"$f":"'V. Cloud Security'!C129","v":"Is there the option for clients to opt-in or opt-out of specific features in releases?"},{"$f":"'V. Cloud Security'!D129","v":0},{"$f":"'V. Cloud Security'!E129","v":0},{"$f":"'V. Cloud Security'!F129","v":0},{"$f":"'V. Cloud Security'!I129","v":0},{"$f":"'V. Cloud Security'!J129","v":"14.2.2"},{"$f":"'V. Cloud Security'!K129","v":"System change control procedures"},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A130","v":3426},{"$f":"'V. Cloud Security'!L130","v":2},{"$f":"'V. Cloud Security'!M130","v":0},{"$f":"'V. Cloud Security'!AA130","v":1},{"$f":"'V. Cloud Security'!B130","v":"V.1.28"},{"$f":"'V. Cloud Security'!C130","v":"Is there a 24x7x365 staffed phone number available to clients to report security incidents?"},{"$f":"'V. Cloud Security'!D130","v":0},{"$f":"'V. Cloud Security'!E130","v":0},{"$f":"'V. Cloud Security'!F130","v":0},{"$f":"'V. Cloud Security'!I130","v":"J. Information Security Incident Management, P.8 Privacy Incident and Response Management"},{"$f":"'V. Cloud Security'!J130","v":"15.1.1.h "},{"$f":"'V. Cloud Security'!K130","v":"Information security policy for supplier relationships"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB130","v":"WP.1.E.3, WP.1.G.10"}]
[{"$f":"'V. Cloud Security'!A131","v":3427},{"$f":"'V. Cloud Security'!L131","v":2},{"$f":"'V. Cloud Security'!M131","v":0},{"$f":"'V. Cloud Security'!AA131","v":1},{"$f":"'V. Cloud Security'!B131","v":"V.1.29"},{"$f":"'V. Cloud Security'!C131","v":"Are applications created and released into production? If yes, what is the release frequency:"},{"$f":"'V. Cloud Security'!D131","v":0},{"$f":"'V. Cloud Security'!E131","v":0},{"$f":"'V. Cloud Security'!F131","v":0},{"$f":"'V. Cloud Security'!I131","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"'V. Cloud Security'!J131","v":"12.5.1"},{"$f":"'V. Cloud Security'!K131","v":"Control of Operational Software"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB131","v":"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A132","v":3428},{"$f":"'V. Cloud Security'!L132","v":3},{"$f":"'V. Cloud Security'!M132","v":0},{"$f":"'V. Cloud Security'!AA132","v":0},{"$f":"'V. Cloud Security'!B132","v":"V.1.29.1"},{"$f":"'V. Cloud Security'!C132","v":"Ad hoc?"},{"$f":"'V. Cloud Security'!D132","v":0},{"$f":"'V. Cloud Security'!E132","v":0},{"$f":"'V. Cloud Security'!F132","v":0},{"$f":"'V. Cloud Security'!I132","v":0},{"$f":"'V. Cloud Security'!J132","v":"NA"},{"$f":"'V. Cloud Security'!K132","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A133","v":3429},{"$f":"'V. Cloud Security'!L133","v":3},{"$f":"'V. Cloud Security'!M133","v":0},{"$f":"'V. Cloud Security'!AA133","v":0},{"$f":"'V. Cloud Security'!B133","v":"V.1.29.2"},{"$f":"'V. Cloud Security'!C133","v":"Daily?"},{"$f":"'V. Cloud Security'!D133","v":0},{"$f":"'V. Cloud Security'!E133","v":0},{"$f":"'V. Cloud Security'!F133","v":0},{"$f":"'V. Cloud Security'!I133","v":0},{"$f":"'V. Cloud Security'!J133","v":"NA"},{"$f":"'V. Cloud Security'!K133","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A134","v":3430},{"$f":"'V. Cloud Security'!L134","v":3},{"$f":"'V. Cloud Security'!M134","v":0},{"$f":"'V. Cloud Security'!AA134","v":0},{"$f":"'V. Cloud Security'!B134","v":"V.1.29.3"},{"$f":"'V. Cloud Security'!C134","v":"Weekly?"},{"$f":"'V. Cloud Security'!D134","v":0},{"$f":"'V. Cloud Security'!E134","v":0},{"$f":"'V. Cloud Security'!F134","v":0},{"$f":"'V. Cloud Security'!I134","v":0},{"$f":"'V. Cloud Security'!J134","v":"NA"},{"$f":"'V. Cloud Security'!K134","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A135","v":3431},{"$f":"'V. Cloud Security'!L135","v":3},{"$f":"'V. Cloud Security'!M135","v":0},{"$f":"'V. Cloud Security'!AA135","v":0},{"$f":"'V. Cloud Security'!B135","v":"V.1.29.4"},{"$f":"'V. Cloud Security'!C135","v":"Biweekly?"},{"$f":"'V. Cloud Security'!D135","v":0},{"$f":"'V. Cloud Security'!E135","v":0},{"$f":"'V. Cloud Security'!F135","v":0},{"$f":"'V. Cloud Security'!I135","v":0},{"$f":"'V. Cloud Security'!J135","v":"NA"},{"$f":"'V. Cloud Security'!K135","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A136","v":3432},{"$f":"'V. Cloud Security'!L136","v":3},{"$f":"'V. Cloud Security'!M136","v":0},{"$f":"'V. Cloud Security'!AA136","v":0},{"$f":"'V. Cloud Security'!B136","v":"V.1.29.5"},{"$f":"'V. Cloud Security'!C136","v":"Monthly?"},{"$f":"'V. Cloud Security'!D136","v":0},{"$f":"'V. Cloud Security'!E136","v":0},{"$f":"'V. Cloud Security'!F136","v":0},{"$f":"'V. Cloud Security'!I136","v":0},{"$f":"'V. Cloud Security'!J136","v":"NA"},{"$f":"'V. Cloud Security'!K136","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A137","v":3433},{"$f":"'V. Cloud Security'!L137","v":3},{"$f":"'V. Cloud Security'!M137","v":0},{"$f":"'V. Cloud Security'!AA137","v":0},{"$f":"'V. Cloud Security'!B137","v":"V.1.29.6"},{"$f":"'V. Cloud Security'!C137","v":"> 3 months?"},{"$f":"'V. Cloud Security'!D137","v":0},{"$f":"'V. Cloud Security'!E137","v":0},{"$f":"'V. Cloud Security'!F137","v":0},{"$f":"'V. Cloud Security'!I137","v":0},{"$f":"'V. Cloud Security'!J137","v":"NA"},{"$f":"'V. Cloud Security'!K137","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A138","v":3434},{"$f":"'V. Cloud Security'!L138","v":3},{"$f":"'V. Cloud Security'!M138","v":0},{"$f":"'V. Cloud Security'!AA138","v":0},{"$f":"'V. Cloud Security'!B138","v":"V.1.29.7"},{"$f":"'V. Cloud Security'!C138","v":"> 6 months?"},{"$f":"'V. Cloud Security'!D138","v":0},{"$f":"'V. Cloud Security'!E138","v":0},{"$f":"'V. Cloud Security'!F138","v":0},{"$f":"'V. Cloud Security'!I138","v":0},{"$f":"'V. Cloud Security'!J138","v":"NA"},{"$f":"'V. Cloud Security'!K138","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A139","v":3435},{"$f":"'V. Cloud Security'!L139","v":3},{"$f":"'V. Cloud Security'!M139","v":0},{"$f":"'V. Cloud Security'!AA139","v":0},{"$f":"'V. Cloud Security'!B139","v":"V.1.29.8"},{"$f":"'V. Cloud Security'!C139","v":"Other?"},{"$f":"'V. Cloud Security'!D139","v":0},{"$f":"'V. Cloud Security'!E139","v":0},{"$f":"'V. Cloud Security'!F139","v":0},{"$f":"'V. Cloud Security'!I139","v":0},{"$f":"'V. Cloud Security'!J139","v":"NA"},{"$f":"'V. Cloud Security'!K139","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A140","v":3436},{"$f":"'V. Cloud Security'!L140","v":2},{"$f":"'V. Cloud Security'!M140","v":0},{"$f":"'V. Cloud Security'!AA140","v":1},{"$f":"'V. Cloud Security'!B140","v":"V.1.30"},{"$f":"'V. Cloud Security'!C140","v":"Is there an automated secure source code review? If yes, what is the frequency:"},{"$f":"'V. Cloud Security'!D140","v":0},{"$f":"'V. Cloud Security'!E140","v":0},{"$f":"'V. Cloud Security'!F140","v":0},{"$f":"'V. Cloud Security'!I140","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!J140","v":"12.5.1"},{"$f":"'V. Cloud Security'!K140","v":"Control of Operational Software"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB140","v":"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A141","v":3437},{"$f":"'V. Cloud Security'!L141","v":3},{"$f":"'V. Cloud Security'!M141","v":0},{"$f":"'V. Cloud Security'!AA141","v":0},{"$f":"'V. Cloud Security'!B141","v":"V.1.30.1"},{"$f":"'V. Cloud Security'!C141","v":"Ad hoc?"},{"$f":"'V. Cloud Security'!D141","v":0},{"$f":"'V. Cloud Security'!E141","v":0},{"$f":"'V. Cloud Security'!F141","v":0},{"$f":"'V. Cloud Security'!I141","v":0},{"$f":"'V. Cloud Security'!J141","v":"NA"},{"$f":"'V. Cloud Security'!K141","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A142","v":3438},{"$f":"'V. Cloud Security'!L142","v":3},{"$f":"'V. Cloud Security'!M142","v":0},{"$f":"'V. Cloud Security'!AA142","v":0},{"$f":"'V. Cloud Security'!B142","v":"V.1.30.2"},{"$f":"'V. Cloud Security'!C142","v":"Daily?"},{"$f":"'V. Cloud Security'!D142","v":0},{"$f":"'V. Cloud Security'!E142","v":0},{"$f":"'V. Cloud Security'!F142","v":0},{"$f":"'V. Cloud Security'!I142","v":0},{"$f":"'V. Cloud Security'!J142","v":"NA"},{"$f":"'V. Cloud Security'!K142","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A143","v":3439},{"$f":"'V. Cloud Security'!L143","v":3},{"$f":"'V. Cloud Security'!M143","v":0},{"$f":"'V. Cloud Security'!AA143","v":0},{"$f":"'V. Cloud Security'!B143","v":"V.1.30.3"},{"$f":"'V. Cloud Security'!C143","v":"Weekly?"},{"$f":"'V. Cloud Security'!D143","v":0},{"$f":"'V. Cloud Security'!E143","v":0},{"$f":"'V. Cloud Security'!F143","v":0},{"$f":"'V. Cloud Security'!I143","v":0},{"$f":"'V. Cloud Security'!J143","v":"NA"},{"$f":"'V. Cloud Security'!K143","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A144","v":3440},{"$f":"'V. Cloud Security'!L144","v":3},{"$f":"'V. Cloud Security'!M144","v":0},{"$f":"'V. Cloud Security'!AA144","v":0},{"$f":"'V. Cloud Security'!B144","v":"V.1.30.4"},{"$f":"'V. Cloud Security'!C144","v":"Biweekly?"},{"$f":"'V. Cloud Security'!D144","v":0},{"$f":"'V. Cloud Security'!E144","v":0},{"$f":"'V. Cloud Security'!F144","v":0},{"$f":"'V. Cloud Security'!I144","v":0},{"$f":"'V. Cloud Security'!J144","v":"NA"},{"$f":"'V. Cloud Security'!K144","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A145","v":3441},{"$f":"'V. Cloud Security'!L145","v":3},{"$f":"'V. Cloud Security'!M145","v":0},{"$f":"'V. Cloud Security'!AA145","v":0},{"$f":"'V. Cloud Security'!B145","v":"V.1.30.5"},{"$f":"'V. Cloud Security'!C145","v":"Monthly?"},{"$f":"'V. Cloud Security'!D145","v":0},{"$f":"'V. Cloud Security'!E145","v":0},{"$f":"'V. Cloud Security'!F145","v":0},{"$f":"'V. Cloud Security'!I145","v":0},{"$f":"'V. Cloud Security'!J145","v":"NA"},{"$f":"'V. Cloud Security'!K145","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A146","v":3442},{"$f":"'V. Cloud Security'!L146","v":3},{"$f":"'V. Cloud Security'!M146","v":0},{"$f":"'V. Cloud Security'!AA146","v":0},{"$f":"'V. Cloud Security'!B146","v":"V.1.30.6"},{"$f":"'V. Cloud Security'!C146","v":"> 3 months?"},{"$f":"'V. Cloud Security'!D146","v":0},{"$f":"'V. Cloud Security'!E146","v":0},{"$f":"'V. Cloud Security'!F146","v":0},{"$f":"'V. Cloud Security'!I146","v":0},{"$f":"'V. Cloud Security'!J146","v":"NA"},{"$f":"'V. Cloud Security'!K146","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A147","v":3443},{"$f":"'V. Cloud Security'!L147","v":3},{"$f":"'V. Cloud Security'!M147","v":0},{"$f":"'V. Cloud Security'!AA147","v":0},{"$f":"'V. Cloud Security'!B147","v":"V.1.30.7"},{"$f":"'V. Cloud Security'!C147","v":"> 6 months?"},{"$f":"'V. Cloud Security'!D147","v":0},{"$f":"'V. Cloud Security'!E147","v":0},{"$f":"'V. Cloud Security'!F147","v":0},{"$f":"'V. Cloud Security'!I147","v":0},{"$f":"'V. Cloud Security'!J147","v":"NA"},{"$f":"'V. Cloud Security'!K147","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A148","v":3444},{"$f":"'V. Cloud Security'!L148","v":3},{"$f":"'V. Cloud Security'!M148","v":0},{"$f":"'V. Cloud Security'!AA148","v":0},{"$f":"'V. Cloud Security'!B148","v":"V.1.30.8"},{"$f":"'V. Cloud Security'!C148","v":"Other?"},{"$f":"'V. Cloud Security'!D148","v":0},{"$f":"'V. Cloud Security'!E148","v":0},{"$f":"'V. Cloud Security'!F148","v":0},{"$f":"'V. Cloud Security'!I148","v":0},{"$f":"'V. Cloud Security'!J148","v":"NA"},{"$f":"'V. Cloud Security'!K148","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A149","v":3445},{"$f":"'V. Cloud Security'!L149","v":2},{"$f":"'V. Cloud Security'!M149","v":0},{"$f":"'V. Cloud Security'!AA149","v":1},{"$f":"'V. Cloud Security'!B149","v":"V.1.31"},{"$f":"'V. Cloud Security'!C149","v":"Is source code security reviewed manually? If yes, what is the frequency:"},{"$f":"'V. Cloud Security'!D149","v":0},{"$f":"'V. Cloud Security'!E149","v":0},{"$f":"'V. Cloud Security'!F149","v":0},{"$f":"'V. Cloud Security'!I149","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!J149","v":"12.2.1                                                      12.5.1"},{"$f":"'V. Cloud Security'!K149","v":"Controls against malware,\nControl of Operational Software"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB149","v":"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A150","v":3446},{"$f":"'V. Cloud Security'!L150","v":3},{"$f":"'V. Cloud Security'!M150","v":0},{"$f":"'V. Cloud Security'!AA150","v":0},{"$f":"'V. Cloud Security'!B150","v":"V.1.31.1"},{"$f":"'V. Cloud Security'!C150","v":"Ad hoc?"},{"$f":"'V. Cloud Security'!D150","v":0},{"$f":"'V. Cloud Security'!E150","v":0},{"$f":"'V. Cloud Security'!F150","v":0},{"$f":"'V. Cloud Security'!I150","v":0},{"$f":"'V. Cloud Security'!J150","v":"NA"},{"$f":"'V. Cloud Security'!K150","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A151","v":3447},{"$f":"'V. Cloud Security'!L151","v":3},{"$f":"'V. Cloud Security'!M151","v":0},{"$f":"'V. Cloud Security'!AA151","v":0},{"$f":"'V. Cloud Security'!B151","v":"V.1.31.2"},{"$f":"'V. Cloud Security'!C151","v":"Daily?"},{"$f":"'V. Cloud Security'!D151","v":0},{"$f":"'V. Cloud Security'!E151","v":0},{"$f":"'V. Cloud Security'!F151","v":0},{"$f":"'V. Cloud Security'!I151","v":0},{"$f":"'V. Cloud Security'!J151","v":"NA"},{"$f":"'V. Cloud Security'!K151","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A152","v":3448},{"$f":"'V. Cloud Security'!L152","v":3},{"$f":"'V. Cloud Security'!M152","v":0},{"$f":"'V. Cloud Security'!AA152","v":0},{"$f":"'V. Cloud Security'!B152","v":"V.1.31.3"},{"$f":"'V. Cloud Security'!C152","v":"Weekly?"},{"$f":"'V. Cloud Security'!D152","v":0},{"$f":"'V. Cloud Security'!E152","v":0},{"$f":"'V. Cloud Security'!F152","v":0},{"$f":"'V. Cloud Security'!I152","v":0},{"$f":"'V. Cloud Security'!J152","v":"NA"},{"$f":"'V. Cloud Security'!K152","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A153","v":3449},{"$f":"'V. Cloud Security'!L153","v":3},{"$f":"'V. Cloud Security'!M153","v":0},{"$f":"'V. Cloud Security'!AA153","v":0},{"$f":"'V. Cloud Security'!B153","v":"V.1.31.4"},{"$f":"'V. Cloud Security'!C153","v":"Biweekly?"},{"$f":"'V. Cloud Security'!D153","v":0},{"$f":"'V. Cloud Security'!E153","v":0},{"$f":"'V. Cloud Security'!F153","v":0},{"$f":"'V. Cloud Security'!I153","v":0},{"$f":"'V. Cloud Security'!J153","v":"NA"},{"$f":"'V. Cloud Security'!K153","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A154","v":3450},{"$f":"'V. Cloud Security'!L154","v":3},{"$f":"'V. Cloud Security'!M154","v":0},{"$f":"'V. Cloud Security'!AA154","v":0},{"$f":"'V. Cloud Security'!B154","v":"V.1.31.5"},{"$f":"'V. Cloud Security'!C154","v":"Monthly?"},{"$f":"'V. Cloud Security'!D154","v":0},{"$f":"'V. Cloud Security'!E154","v":0},{"$f":"'V. Cloud Security'!F154","v":0},{"$f":"'V. Cloud Security'!I154","v":0},{"$f":"'V. Cloud Security'!J154","v":"NA"},{"$f":"'V. Cloud Security'!K154","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A155","v":3451},{"$f":"'V. Cloud Security'!L155","v":3},{"$f":"'V. Cloud Security'!M155","v":0},{"$f":"'V. Cloud Security'!AA155","v":0},{"$f":"'V. Cloud Security'!B155","v":"V.1.31.6"},{"$f":"'V. Cloud Security'!C155","v":"> 3 months?"},{"$f":"'V. Cloud Security'!D155","v":0},{"$f":"'V. Cloud Security'!E155","v":0},{"$f":"'V. Cloud Security'!F155","v":0},{"$f":"'V. Cloud Security'!I155","v":0},{"$f":"'V. Cloud Security'!J155","v":"NA"},{"$f":"'V. Cloud Security'!K155","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A156","v":3452},{"$f":"'V. Cloud Security'!L156","v":3},{"$f":"'V. Cloud Security'!M156","v":0},{"$f":"'V. Cloud Security'!AA156","v":0},{"$f":"'V. Cloud Security'!B156","v":"V.1.31.7"},{"$f":"'V. Cloud Security'!C156","v":"> 6 months?"},{"$f":"'V. Cloud Security'!D156","v":0},{"$f":"'V. Cloud Security'!E156","v":0},{"$f":"'V. Cloud Security'!F156","v":0},{"$f":"'V. Cloud Security'!I156","v":0},{"$f":"'V. Cloud Security'!J156","v":"NA"},{"$f":"'V. Cloud Security'!K156","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A157","v":3453},{"$f":"'V. Cloud Security'!L157","v":3},{"$f":"'V. Cloud Security'!M157","v":0},{"$f":"'V. Cloud Security'!AA157","v":0},{"$f":"'V. Cloud Security'!B157","v":"V.1.31.8"},{"$f":"'V. Cloud Security'!C157","v":"Other?"},{"$f":"'V. Cloud Security'!D157","v":0},{"$f":"'V. Cloud Security'!E157","v":0},{"$f":"'V. Cloud Security'!F157","v":0},{"$f":"'V. Cloud Security'!I157","v":0},{"$f":"'V. Cloud Security'!J157","v":"NA"},{"$f":"'V. Cloud Security'!K157","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A158","v":3454},{"$f":"'V. Cloud Security'!L158","v":2},{"$f":"'V. Cloud Security'!M158","v":0},{"$f":"'V. Cloud Security'!AA158","v":1},{"$f":"'V. Cloud Security'!B158","v":"V.1.32"},{"$f":"'V. Cloud Security'!C158","v":"Are automated penetration tests performed? If yes, what is the frequency:"},{"$f":"'V. Cloud Security'!D158","v":0},{"$f":"'V. Cloud Security'!E158","v":0},{"$f":"'V. Cloud Security'!F158","v":0},{"$f":"'V. Cloud Security'!I158","v":"I.1 Application Vulnerability Assessments/Ethical Hacking"},{"$f":"'V. Cloud Security'!J158","v":"12.2.1                                                      12.5.1                                              12.6.1"},{"$f":"'V. Cloud Security'!K158","v":"Controls against malware,\nControl of Operational Software                                    Management of technical vulnerabilities"},null,null,null,11.3,null,null,{"$f":"'V. Cloud Security'!AB158","v":"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7, WP.1.A.10"}]
[{"$f":"'V. Cloud Security'!A159","v":3455},{"$f":"'V. Cloud Security'!L159","v":3},{"$f":"'V. Cloud Security'!M159","v":0},{"$f":"'V. Cloud Security'!AA159","v":0},{"$f":"'V. Cloud Security'!B159","v":"V.1.32.1"},{"$f":"'V. Cloud Security'!C159","v":"Ad hoc?"},{"$f":"'V. Cloud Security'!D159","v":0},{"$f":"'V. Cloud Security'!E159","v":0},{"$f":"'V. Cloud Security'!F159","v":0},{"$f":"'V. Cloud Security'!I159","v":0},{"$f":"'V. Cloud Security'!J159","v":"NA"},{"$f":"'V. Cloud Security'!K159","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A160","v":3456},{"$f":"'V. Cloud Security'!L160","v":3},{"$f":"'V. Cloud Security'!M160","v":0},{"$f":"'V. Cloud Security'!AA160","v":0},{"$f":"'V. Cloud Security'!B160","v":"V.1.32.2"},{"$f":"'V. Cloud Security'!C160","v":"Daily?"},{"$f":"'V. Cloud Security'!D160","v":0},{"$f":"'V. Cloud Security'!E160","v":0},{"$f":"'V. Cloud Security'!F160","v":0},{"$f":"'V. Cloud Security'!I160","v":0},{"$f":"'V. Cloud Security'!J160","v":"NA"},{"$f":"'V. Cloud Security'!K160","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A161","v":3457},{"$f":"'V. Cloud Security'!L161","v":3},{"$f":"'V. Cloud Security'!M161","v":0},{"$f":"'V. Cloud Security'!AA161","v":0},{"$f":"'V. Cloud Security'!B161","v":"V.1.32.3"},{"$f":"'V. Cloud Security'!C161","v":"Weekly?"},{"$f":"'V. Cloud Security'!D161","v":0},{"$f":"'V. Cloud Security'!E161","v":0},{"$f":"'V. Cloud Security'!F161","v":0},{"$f":"'V. Cloud Security'!I161","v":0},{"$f":"'V. Cloud Security'!J161","v":"NA"},{"$f":"'V. Cloud Security'!K161","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A162","v":3458},{"$f":"'V. Cloud Security'!L162","v":3},{"$f":"'V. Cloud Security'!M162","v":0},{"$f":"'V. Cloud Security'!AA162","v":0},{"$f":"'V. Cloud Security'!B162","v":"V.1.32.4"},{"$f":"'V. Cloud Security'!C162","v":"Biweekly?"},{"$f":"'V. Cloud Security'!D162","v":0},{"$f":"'V. Cloud Security'!E162","v":0},{"$f":"'V. Cloud Security'!F162","v":0},{"$f":"'V. Cloud Security'!I162","v":0},{"$f":"'V. Cloud Security'!J162","v":"NA"},{"$f":"'V. Cloud Security'!K162","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A163","v":3459},{"$f":"'V. Cloud Security'!L163","v":3},{"$f":"'V. Cloud Security'!M163","v":0},{"$f":"'V. Cloud Security'!AA163","v":0},{"$f":"'V. Cloud Security'!B163","v":"V.1.32.5"},{"$f":"'V. Cloud Security'!C163","v":"Monthly?"},{"$f":"'V. Cloud Security'!D163","v":0},{"$f":"'V. Cloud Security'!E163","v":0},{"$f":"'V. Cloud Security'!F163","v":0},{"$f":"'V. Cloud Security'!I163","v":0},{"$f":"'V. Cloud Security'!J163","v":"NA"},{"$f":"'V. Cloud Security'!K163","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A164","v":3460},{"$f":"'V. Cloud Security'!L164","v":3},{"$f":"'V. Cloud Security'!M164","v":0},{"$f":"'V. Cloud Security'!AA164","v":0},{"$f":"'V. Cloud Security'!B164","v":"V.1.32.6"},{"$f":"'V. Cloud Security'!C164","v":"> 3 months?"},{"$f":"'V. Cloud Security'!D164","v":0},{"$f":"'V. Cloud Security'!E164","v":0},{"$f":"'V. Cloud Security'!F164","v":0},{"$f":"'V. Cloud Security'!I164","v":0},{"$f":"'V. Cloud Security'!J164","v":"NA"},{"$f":"'V. Cloud Security'!K164","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A165","v":3461},{"$f":"'V. Cloud Security'!L165","v":3},{"$f":"'V. Cloud Security'!M165","v":0},{"$f":"'V. Cloud Security'!AA165","v":0},{"$f":"'V. Cloud Security'!B165","v":"V.1.32.7"},{"$f":"'V. Cloud Security'!C165","v":"> 6 months?"},{"$f":"'V. Cloud Security'!D165","v":0},{"$f":"'V. Cloud Security'!E165","v":0},{"$f":"'V. Cloud Security'!F165","v":0},{"$f":"'V. Cloud Security'!I165","v":0},{"$f":"'V. Cloud Security'!J165","v":"NA"},{"$f":"'V. Cloud Security'!K165","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A166","v":3462},{"$f":"'V. Cloud Security'!L166","v":3},{"$f":"'V. Cloud Security'!M166","v":0},{"$f":"'V. Cloud Security'!AA166","v":0},{"$f":"'V. Cloud Security'!B166","v":"V.1.32.8"},{"$f":"'V. Cloud Security'!C166","v":"Other?"},{"$f":"'V. Cloud Security'!D166","v":0},{"$f":"'V. Cloud Security'!E166","v":0},{"$f":"'V. Cloud Security'!F166","v":0},{"$f":"'V. Cloud Security'!I166","v":0},{"$f":"'V. Cloud Security'!J166","v":"NA"},{"$f":"'V. Cloud Security'!K166","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A167","v":3463},{"$f":"'V. Cloud Security'!L167","v":2},{"$f":"'V. Cloud Security'!M167","v":0},{"$f":"'V. Cloud Security'!AA167","v":0},{"$f":"'V. Cloud Security'!B167","v":"V.1.33"},{"$f":"'V. Cloud Security'!C167","v":"Are manual penetration tests performed? If yes, what is the frequency:"},{"$f":"'V. Cloud Security'!D167","v":0},{"$f":"'V. Cloud Security'!E167","v":0},{"$f":"'V. Cloud Security'!F167","v":0},{"$f":"'V. Cloud Security'!I167","v":"I.1 Application Vulnerability Assessments/Ethical Hacking"},{"$f":"'V. Cloud Security'!J167","v":"12.2.1                                                      12.5.1                                              12.6.1"},{"$f":"'V. Cloud Security'!K167","v":"Controls against malware,\nControl of Operational Software                                    Management of technical vulnerabilities"},null,null,null,11.3,null,null,{"$f":"'V. Cloud Security'!AB167","v":"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7, WP.1.A.10"}]
[{"$f":"'V. Cloud Security'!A168","v":3464},{"$f":"'V. Cloud Security'!L168","v":3},{"$f":"'V. Cloud Security'!M168","v":0},{"$f":"'V. Cloud Security'!AA168","v":0},{"$f":"'V. Cloud Security'!B168","v":"V.1.33.1"},{"$f":"'V. Cloud Security'!C168","v":"Ad hoc?"},{"$f":"'V. Cloud Security'!D168","v":0},{"$f":"'V. Cloud Security'!E168","v":0},{"$f":"'V. Cloud Security'!F168","v":0},{"$f":"'V. Cloud Security'!I168","v":0},{"$f":"'V. Cloud Security'!J168","v":"NA"},{"$f":"'V. Cloud Security'!K168","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A169","v":3465},{"$f":"'V. Cloud Security'!L169","v":3},{"$f":"'V. Cloud Security'!M169","v":0},{"$f":"'V. Cloud Security'!AA169","v":0},{"$f":"'V. Cloud Security'!B169","v":"V.1.33.2"},{"$f":"'V. Cloud Security'!C169","v":"Daily?"},{"$f":"'V. Cloud Security'!D169","v":0},{"$f":"'V. Cloud Security'!E169","v":0},{"$f":"'V. Cloud Security'!F169","v":0},{"$f":"'V. Cloud Security'!I169","v":0},{"$f":"'V. Cloud Security'!J169","v":"NA"},{"$f":"'V. Cloud Security'!K169","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A170","v":3466},{"$f":"'V. Cloud Security'!L170","v":3},{"$f":"'V. Cloud Security'!M170","v":0},{"$f":"'V. Cloud Security'!AA170","v":0},{"$f":"'V. Cloud Security'!B170","v":"V.1.33.3"},{"$f":"'V. Cloud Security'!C170","v":"Weekly?"},{"$f":"'V. Cloud Security'!D170","v":0},{"$f":"'V. Cloud Security'!E170","v":0},{"$f":"'V. Cloud Security'!F170","v":0},{"$f":"'V. Cloud Security'!I170","v":0},{"$f":"'V. Cloud Security'!J170","v":"NA"},{"$f":"'V. Cloud Security'!K170","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A171","v":3467},{"$f":"'V. Cloud Security'!L171","v":3},{"$f":"'V. Cloud Security'!M171","v":0},{"$f":"'V. Cloud Security'!AA171","v":0},{"$f":"'V. Cloud Security'!B171","v":"V.1.33.4"},{"$f":"'V. Cloud Security'!C171","v":"Biweekly?"},{"$f":"'V. Cloud Security'!D171","v":0},{"$f":"'V. Cloud Security'!E171","v":0},{"$f":"'V. Cloud Security'!F171","v":0},{"$f":"'V. Cloud Security'!I171","v":0},{"$f":"'V. Cloud Security'!J171","v":"NA"},{"$f":"'V. Cloud Security'!K171","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A172","v":3468},{"$f":"'V. Cloud Security'!L172","v":3},{"$f":"'V. Cloud Security'!M172","v":0},{"$f":"'V. Cloud Security'!AA172","v":0},{"$f":"'V. Cloud Security'!B172","v":"V.1.33.5"},{"$f":"'V. Cloud Security'!C172","v":"Monthly?"},{"$f":"'V. Cloud Security'!D172","v":0},{"$f":"'V. Cloud Security'!E172","v":0},{"$f":"'V. Cloud Security'!F172","v":0},{"$f":"'V. Cloud Security'!I172","v":0},{"$f":"'V. Cloud Security'!J172","v":"NA"},{"$f":"'V. Cloud Security'!K172","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A173","v":3469},{"$f":"'V. Cloud Security'!L173","v":3},{"$f":"'V. Cloud Security'!M173","v":0},{"$f":"'V. Cloud Security'!AA173","v":0},{"$f":"'V. Cloud Security'!B173","v":"V.1.33.6"},{"$f":"'V. Cloud Security'!C173","v":"> 3 months?"},{"$f":"'V. Cloud Security'!D173","v":0},{"$f":"'V. Cloud Security'!E173","v":0},{"$f":"'V. Cloud Security'!F173","v":0},{"$f":"'V. Cloud Security'!I173","v":0},{"$f":"'V. Cloud Security'!J173","v":"NA"},{"$f":"'V. Cloud Security'!K173","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A174","v":3470},{"$f":"'V. Cloud Security'!L174","v":3},{"$f":"'V. Cloud Security'!M174","v":0},{"$f":"'V. Cloud Security'!AA174","v":0},{"$f":"'V. Cloud Security'!B174","v":"V.1.33.7"},{"$f":"'V. Cloud Security'!C174","v":"> 6 months?"},{"$f":"'V. Cloud Security'!D174","v":0},{"$f":"'V. Cloud Security'!E174","v":0},{"$f":"'V. Cloud Security'!F174","v":0},{"$f":"'V. Cloud Security'!I174","v":0},{"$f":"'V. Cloud Security'!J174","v":"NA"},{"$f":"'V. Cloud Security'!K174","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A175","v":3471},{"$f":"'V. Cloud Security'!L175","v":3},{"$f":"'V. Cloud Security'!M175","v":0},{"$f":"'V. Cloud Security'!AA175","v":0},{"$f":"'V. Cloud Security'!B175","v":"V.1.33.8"},{"$f":"'V. Cloud Security'!C175","v":"Other?"},{"$f":"'V. Cloud Security'!D175","v":0},{"$f":"'V. Cloud Security'!E175","v":0},{"$f":"'V. Cloud Security'!F175","v":0},{"$f":"'V. Cloud Security'!I175","v":0},{"$f":"'V. Cloud Security'!J175","v":"NA"},{"$f":"'V. Cloud Security'!K175","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A176","v":3472},{"$f":"'V. Cloud Security'!L176","v":2},{"$f":"'V. Cloud Security'!M176","v":0},{"$f":"'V. Cloud Security'!AA176","v":1},{"$f":"'V. Cloud Security'!B176","v":"V.1.34"},{"$f":"'V. Cloud Security'!C176","v":"Are clients provided with the ability to specify where their data will be stored? If yes, what level:"},{"$f":"'V. Cloud Security'!D176","v":0},{"$f":"'V. Cloud Security'!E176","v":0},{"$f":"'V. Cloud Security'!F176","v":0},{"$f":"'V. Cloud Security'!I176","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"'V. Cloud Security'!J176","v":"8.1.1                                                        15.1.1                                                         18.1.1"},{"$f":"'V. Cloud Security'!K176","v":"Inventory of Assets,                   Information security policy for supplier relationships,\nIdentification of Applicable Legislation"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB176","v":"WP.1.E.4, WP.1.G.2, WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A177","v":3473},{"$f":"'V. Cloud Security'!L177","v":3},{"$f":"'V. Cloud Security'!M177","v":0},{"$f":"'V. Cloud Security'!AA177","v":0},{"$f":"'V. Cloud Security'!B177","v":"V.1.34.1"},{"$f":"'V. Cloud Security'!C177","v":"Data classification zone: based on security classification level (e.g., production networks, PCI networks)"},{"$f":"'V. Cloud Security'!D177","v":0},{"$f":"'V. Cloud Security'!E177","v":0},{"$f":"'V. Cloud Security'!F177","v":0},{"$f":"'V. Cloud Security'!I177","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"'V. Cloud Security'!J177","v":"NA"},{"$f":"'V. Cloud Security'!K177","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB177","v":"WP.1.E.4, WP.1.G.2, WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A178","v":3474},{"$f":"'V. Cloud Security'!L178","v":3},{"$f":"'V. Cloud Security'!M178","v":0},{"$f":"'V. Cloud Security'!AA178","v":0},{"$f":"'V. Cloud Security'!B178","v":"V.1.34.2"},{"$f":"'V. Cloud Security'!C178","v":"Data center?"},{"$f":"'V. Cloud Security'!D178","v":0},{"$f":"'V. Cloud Security'!E178","v":0},{"$f":"'V. Cloud Security'!F178","v":0},{"$f":"'V. Cloud Security'!I178","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"'V. Cloud Security'!J178","v":"NA"},{"$f":"'V. Cloud Security'!K178","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB178","v":"WP.1.E.4, WP.1.G.2, WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A179","v":3475},{"$f":"'V. Cloud Security'!L179","v":3},{"$f":"'V. Cloud Security'!M179","v":0},{"$f":"'V. Cloud Security'!AA179","v":0},{"$f":"'V. Cloud Security'!B179","v":"V.1.34.3"},{"$f":"'V. Cloud Security'!C179","v":"Country?"},{"$f":"'V. Cloud Security'!D179","v":0},{"$f":"'V. Cloud Security'!E179","v":0},{"$f":"'V. Cloud Security'!F179","v":0},{"$f":"'V. Cloud Security'!I179","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"'V. Cloud Security'!J179","v":"NA"},{"$f":"'V. Cloud Security'!K179","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB179","v":"WP.1.E.4, WP.1.G.2, WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A180","v":3476},{"$f":"'V. Cloud Security'!L180","v":3},{"$f":"'V. Cloud Security'!M180","v":0},{"$f":"'V. Cloud Security'!AA180","v":0},{"$f":"'V. Cloud Security'!B180","v":"V.1.34.4"},{"$f":"'V. Cloud Security'!C180","v":"Location based on legal jurisdiction?"},{"$f":"'V. Cloud Security'!D180","v":0},{"$f":"'V. Cloud Security'!E180","v":0},{"$f":"'V. Cloud Security'!F180","v":0},{"$f":"'V. Cloud Security'!I180","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"'V. Cloud Security'!J180","v":"NA"},{"$f":"'V. Cloud Security'!K180","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB180","v":"WP.1.E.4, WP.1.G.2, WP.1.G.3"}]
[{"$f":"'V. Cloud Security'!A181","v":3477},{"$f":"'V. Cloud Security'!L181","v":2},{"$f":"'V. Cloud Security'!M181","v":0},{"$f":"'V. Cloud Security'!AA181","v":0},{"$f":"'V. Cloud Security'!B181","v":"V.1.35"},{"$f":"'V. Cloud Security'!C181","v":"Are there legal data ownership agreements with clients? If yes, do they include:"},{"$f":"'V. Cloud Security'!D181","v":0},{"$f":"'V. Cloud Security'!E181","v":0},{"$f":"'V. Cloud Security'!F181","v":0},{"$f":"'V. Cloud Security'!I181","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"'V. Cloud Security'!J181","v":"18.1.2                                                      18.2.3"},{"$f":"'V. Cloud Security'!K181","v":"Intellectual Property Rights,\nProtection of  Records"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB181","v":"WP.1.G.1"}]
[{"$f":"'V. Cloud Security'!A182","v":3478},{"$f":"'V. Cloud Security'!L182","v":3},{"$f":"'V. Cloud Security'!M182","v":0},{"$f":"'V. Cloud Security'!AA182","v":0},{"$f":"'V. Cloud Security'!B182","v":"V.1.35.1"},{"$f":"'V. Cloud Security'!C182","v":"Who owns the data?"},{"$f":"'V. Cloud Security'!D182","v":0},{"$f":"'V. Cloud Security'!E182","v":0},{"$f":"'V. Cloud Security'!F182","v":0},{"$f":"'V. Cloud Security'!I182","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"'V. Cloud Security'!J182","v":"18.1.2                                                      18.2.3"},{"$f":"'V. Cloud Security'!K182","v":"Intellectual Property Rights,\nProtection of  Records"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB182","v":"WP.1.G.1"}]
[{"$f":"'V. Cloud Security'!A183","v":3479},{"$f":"'V. Cloud Security'!L183","v":3},{"$f":"'V. Cloud Security'!M183","v":0},{"$f":"'V. Cloud Security'!AA183","v":0},{"$f":"'V. Cloud Security'!B183","v":"V.1.35.2"},{"$f":"'V. Cloud Security'!C183","v":"What rights (if any) the cloud provider has to the client's complete data?"},{"$f":"'V. Cloud Security'!D183","v":0},{"$f":"'V. Cloud Security'!E183","v":0},{"$f":"'V. Cloud Security'!F183","v":0},{"$f":"'V. Cloud Security'!I183","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"'V. Cloud Security'!J183","v":"18.1.2                                                      18.2.3"},{"$f":"'V. Cloud Security'!K183","v":"Intellectual Property Rights,\nProtection of  Records"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB183","v":"WP.1.G.1"}]
[{"$f":"'V. Cloud Security'!A184","v":3480},{"$f":"'V. Cloud Security'!L184","v":3},{"$f":"'V. Cloud Security'!M184","v":0},{"$f":"'V. Cloud Security'!AA184","v":0},{"$f":"'V. Cloud Security'!B184","v":"V.1.35.3"},{"$f":"'V. Cloud Security'!C184","v":"What rights (if any) the cloud provider has to the client's aggregate/sanitized data?"},{"$f":"'V. Cloud Security'!D184","v":0},{"$f":"'V. Cloud Security'!E184","v":0},{"$f":"'V. Cloud Security'!F184","v":0},{"$f":"'V. Cloud Security'!I184","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"'V. Cloud Security'!J184","v":"18.1.2                                                      18.2.3"},{"$f":"'V. Cloud Security'!K184","v":"Intellectual Property Rights,\nProtection of  Records"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB184","v":"WP.1.G.1"}]
[{"$f":"'V. Cloud Security'!A185","v":3481},{"$f":"'V. Cloud Security'!L185","v":2},{"$f":"'V. Cloud Security'!M185","v":0},{"$f":"'V. Cloud Security'!AA185","v":1},{"$f":"'V. Cloud Security'!B185","v":"V.1.36"},{"$f":"'V. Cloud Security'!C185","v":"Does the ability exist to legally demonstrate sufficient data segmentation, in the event of a client subpoena or a forensics incident, so as not to impact other clients data if using resource pooling? If yes, is there a:"},{"$f":"'V. Cloud Security'!D185","v":0},{"$f":"'V. Cloud Security'!E185","v":0},{"$f":"'V. Cloud Security'!F185","v":0},{"$f":"'V. Cloud Security'!I185","v":"V.1 Service and Deployment Models"},{"$f":"'V. Cloud Security'!J185","v":"16.1.1                                                     16.1.7"},{"$f":"'V. Cloud Security'!K185","v":"Responsibilities and Procedures,\nCollection of Evidence."},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB185","v":"WP.1.L.2, WP.1.G.5"}]
[{"$f":"'V. Cloud Security'!A186","v":3482},{"$f":"'V. Cloud Security'!L186","v":3},{"$f":"'V. Cloud Security'!M186","v":0},{"$f":"'V. Cloud Security'!AA186","v":0},{"$f":"'V. Cloud Security'!B186","v":"V.1.36.1"},{"$f":"'V. Cloud Security'!C186","v":"Legal strategy document that can be shared with the client?"},{"$f":"'V. Cloud Security'!D186","v":0},{"$f":"'V. Cloud Security'!E186","v":0},{"$f":"'V. Cloud Security'!F186","v":0},{"$f":"'V. Cloud Security'!I186","v":0},{"$f":"'V. Cloud Security'!J186","v":"NA"},{"$f":"'V. Cloud Security'!K186","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB186","v":"WP.1.L.2, WP.1.G.5"}]
[{"$f":"'V. Cloud Security'!A187","v":3483},{"$f":"'V. Cloud Security'!L187","v":3},{"$f":"'V. Cloud Security'!M187","v":0},{"$f":"'V. Cloud Security'!AA187","v":0},{"$f":"'V. Cloud Security'!B187","v":"V.1.36.2"},{"$f":"'V. Cloud Security'!C187","v":"Legal counsel (in-house or external) approval?"},{"$f":"'V. Cloud Security'!D187","v":0},{"$f":"'V. Cloud Security'!E187","v":0},{"$f":"'V. Cloud Security'!F187","v":0},{"$f":"'V. Cloud Security'!I187","v":0},{"$f":"'V. Cloud Security'!J187","v":"NA"},{"$f":"'V. Cloud Security'!K187","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB187","v":"WP.1.L.2, WP.1.G.5"}]
[{"$f":"'V. Cloud Security'!A188","v":3484},{"$f":"'V. Cloud Security'!L188","v":2},{"$f":"'V. Cloud Security'!M188","v":0},{"$f":"'V. Cloud Security'!AA188","v":0},{"$f":"'V. Cloud Security'!B188","v":"V.1.37"},{"$f":"'V. Cloud Security'!C188","v":"Is there a data retention/destruction schedule? If yes, is it:"},{"$f":"'V. Cloud Security'!D188","v":0},{"$f":"'V. Cloud Security'!E188","v":0},{"$f":"'V. Cloud Security'!F188","v":0},{"$f":"'V. Cloud Security'!I188","v":0},{"$f":"'V. Cloud Security'!J188","v":8.3000000000000007},{"$f":"'V. Cloud Security'!K188","v":"Media Handling"},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A189","v":3485},{"$f":"'V. Cloud Security'!L189","v":3},{"$f":"'V. Cloud Security'!M189","v":0},{"$f":"'V. Cloud Security'!AA189","v":0},{"$f":"'V. Cloud Security'!B189","v":"V.1.37.1"},{"$f":"'V. Cloud Security'!C189","v":"Online: disk?"},{"$f":"'V. Cloud Security'!D189","v":0},{"$f":"'V. Cloud Security'!E189","v":0},{"$f":"'V. Cloud Security'!F189","v":0},{"$f":"'V. Cloud Security'!I189","v":0},{"$f":"'V. Cloud Security'!J189","v":"NA"},{"$f":"'V. Cloud Security'!K189","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB189","v":"WP.1.K.2, WP.1.K.3, WP.1.K.5"}]
[{"$f":"'V. Cloud Security'!A190","v":3486},{"$f":"'V. Cloud Security'!L190","v":3},{"$f":"'V. Cloud Security'!M190","v":0},{"$f":"'V. Cloud Security'!AA190","v":0},{"$f":"'V. Cloud Security'!B190","v":"V.1.37.2"},{"$f":"'V. Cloud Security'!C190","v":"Offline: media: (e.g., DLT, DVD)?"},{"$f":"'V. Cloud Security'!D190","v":0},{"$f":"'V. Cloud Security'!E190","v":0},{"$f":"'V. Cloud Security'!F190","v":0},{"$f":"'V. Cloud Security'!I190","v":0},{"$f":"'V. Cloud Security'!J190","v":"NA"},{"$f":"'V. Cloud Security'!K190","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB190","v":"WP.1.K.2, WP.1.K.3, WP.1.K.5"}]
[{"$f":"'V. Cloud Security'!A191","v":3487},{"$f":"'V. Cloud Security'!L191","v":3},{"$f":"'V. Cloud Security'!M191","v":0},{"$f":"'V. Cloud Security'!AA191","v":0},{"$f":"'V. Cloud Security'!B191","v":"V.1.37.3"},{"$f":"'V. Cloud Security'!C191","v":"Online: data managed by third party vendors?"},{"$f":"'V. Cloud Security'!D191","v":0},{"$f":"'V. Cloud Security'!E191","v":0},{"$f":"'V. Cloud Security'!F191","v":0},{"$f":"'V. Cloud Security'!I191","v":0},{"$f":"'V. Cloud Security'!J191","v":"NA"},{"$f":"'V. Cloud Security'!K191","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB191","v":"WP.1.K.2, WP.1.K.3, WP.1.K.5"}]
[{"$f":"'V. Cloud Security'!A192","v":3488},{"$f":"'V. Cloud Security'!L192","v":3},{"$f":"'V. Cloud Security'!M192","v":0},{"$f":"'V. Cloud Security'!AA192","v":0},{"$f":"'V. Cloud Security'!B192","v":"V.1.37.4"},{"$f":"'V. Cloud Security'!C192","v":"Offline: data managed by third party vendors?"},{"$f":"'V. Cloud Security'!D192","v":0},{"$f":"'V. Cloud Security'!E192","v":0},{"$f":"'V. Cloud Security'!F192","v":0},{"$f":"'V. Cloud Security'!I192","v":0},{"$f":"'V. Cloud Security'!J192","v":"NA"},{"$f":"'V. Cloud Security'!K192","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB192","v":"WP.1.K.2, WP.1.K.3, WP.1.K.5"}]
[{"$f":"'V. Cloud Security'!A193","v":3489},{"$f":"'V. Cloud Security'!L193","v":2},{"$f":"'V. Cloud Security'!M193","v":0},{"$f":"'V. Cloud Security'!AA193","v":1},{"$f":"'V. Cloud Security'!B193","v":"V.1.38"},{"$f":"'V. Cloud Security'!C193","v":"Is there a self-service portal or API call available to clients which provides the ability to place a \"Legal hold\" on client data which may be subject to a legal action, without impacting other clients data retention or destruction schedules?"},{"$f":"'V. Cloud Security'!D193","v":0},{"$f":"'V. Cloud Security'!E193","v":0},{"$f":"'V. Cloud Security'!F193","v":0},{"$f":"'V. Cloud Security'!I193","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"'V. Cloud Security'!J193","v":"16.1.1                                                      16.1.7                                                          18.1.2                                             18.1.3"},{"$f":"'V. Cloud Security'!K193","v":"Responsibilities and Procedures,\nCollection of Evidence,\nIntellectual Property Rights,\nProtection of records"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB193","v":"WP.1.K.4"}]
[{"$f":"'V. Cloud Security'!A194","v":3490},{"$f":"'V. Cloud Security'!L194","v":2},{"$f":"'V. Cloud Security'!M194","v":0},{"$f":"'V. Cloud Security'!AA194","v":1},{"$f":"'V. Cloud Security'!B194","v":"V.1.39"},{"$f":"'V. Cloud Security'!C194","v":"Is a Cloud API available to clients?"},{"$f":"'V. Cloud Security'!D194","v":0},{"$f":"'V. Cloud Security'!E194","v":0},{"$f":"'V. Cloud Security'!F194","v":0},{"$f":"'V. Cloud Security'!I194","v":"H.3 Logical Access Authorization"},{"$f":"'V. Cloud Security'!J194","v":"NA"},{"$f":"'V. Cloud Security'!K194","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A195","v":3491},{"$f":"'V. Cloud Security'!L195","v":3},{"$f":"'V. Cloud Security'!M195","v":0},{"$f":"'V. Cloud Security'!AA195","v":0},{"$f":"'V. Cloud Security'!B195","v":"V.1.39.1"},{"$f":"'V. Cloud Security'!C195","v":"Is there a formal security program established to include API security reviews? If yes, does this include:"},{"$f":"'V. Cloud Security'!D195","v":0},{"$f":"'V. Cloud Security'!E195","v":0},{"$f":"'V. Cloud Security'!F195","v":0},{"$f":"'V. Cloud Security'!I195","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!J195","v":"12.5.1"},{"$f":"'V. Cloud Security'!K195","v":"Control of Operational Software"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB195","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A196","v":3492},{"$f":"'V. Cloud Security'!L196","v":4},{"$f":"'V. Cloud Security'!M196","v":0},{"$f":"'V. Cloud Security'!AA196","v":0},{"$f":"'V. Cloud Security'!B196","v":"V.1.39.1.1"},{"$f":"'V. Cloud Security'!C196","v":"API security evaluated at the requirements phase?"},{"$f":"'V. Cloud Security'!D196","v":0},{"$f":"'V. Cloud Security'!E196","v":0},{"$f":"'V. Cloud Security'!F196","v":0},{"$f":"'V. Cloud Security'!I196","v":0},{"$f":"'V. Cloud Security'!J196","v":"12.5.1"},{"$f":"'V. Cloud Security'!K196","v":"Control of Operational Software"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB196","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A197","v":3493},{"$f":"'V. Cloud Security'!L197","v":4},{"$f":"'V. Cloud Security'!M197","v":0},{"$f":"'V. Cloud Security'!AA197","v":0},{"$f":"'V. Cloud Security'!B197","v":"V.1.39.1.2"},{"$f":"'V. Cloud Security'!C197","v":"Security review of API design?"},{"$f":"'V. Cloud Security'!D197","v":0},{"$f":"'V. Cloud Security'!E197","v":0},{"$f":"'V. Cloud Security'!F197","v":0},{"$f":"'V. Cloud Security'!I197","v":0},{"$f":"'V. Cloud Security'!J197","v":"12.5.1"},{"$f":"'V. Cloud Security'!K197","v":"Control of Operational Software"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB197","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A198","v":3494},{"$f":"'V. Cloud Security'!L198","v":4},{"$f":"'V. Cloud Security'!M198","v":0},{"$f":"'V. Cloud Security'!AA198","v":0},{"$f":"'V. Cloud Security'!B198","v":"V.1.39.1.3"},{"$f":"'V. Cloud Security'!C198","v":"API permission model review?"},{"$f":"'V. Cloud Security'!D198","v":0},{"$f":"'V. Cloud Security'!E198","v":0},{"$f":"'V. Cloud Security'!F198","v":0},{"$f":"'V. Cloud Security'!I198","v":0},{"$f":"'V. Cloud Security'!J198","v":"12.5.1"},{"$f":"'V. Cloud Security'!K198","v":"Control of Operational Software"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB198","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A199","v":3495},{"$f":"'V. Cloud Security'!L199","v":3},{"$f":"'V. Cloud Security'!M199","v":0},{"$f":"'V. Cloud Security'!AA199","v":0},{"$f":"'V. Cloud Security'!B199","v":"V.1.39.2"},{"$f":"'V. Cloud Security'!C199","v":"Is the API code security tested against OWASP top 10 security issues? If yes, does this include:"},{"$f":"'V. Cloud Security'!D199","v":0},{"$f":"'V. Cloud Security'!E199","v":0},{"$f":"'V. Cloud Security'!F199","v":0},{"$f":"'V. Cloud Security'!I199","v":0},{"$f":"'V. Cloud Security'!J199","v":"12.6.1"},{"$f":"'V. Cloud Security'!K199","v":"Management of technical vulnerabilities"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB199","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A200","v":3496},{"$f":"'V. Cloud Security'!L200","v":4},{"$f":"'V. Cloud Security'!M200","v":0},{"$f":"'V. Cloud Security'!AA200","v":0},{"$f":"'V. Cloud Security'!B200","v":"V.1.39.2.1"},{"$f":"'V. Cloud Security'!C200","v":"Data scoping?"},{"$f":"'V. Cloud Security'!D200","v":0},{"$f":"'V. Cloud Security'!E200","v":0},{"$f":"'V. Cloud Security'!F200","v":0},{"$f":"'V. Cloud Security'!I200","v":0},{"$f":"'V. Cloud Security'!J200","v":"NA"},{"$f":"'V. Cloud Security'!K200","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB200","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A201","v":3497},{"$f":"'V. Cloud Security'!L201","v":4},{"$f":"'V. Cloud Security'!M201","v":0},{"$f":"'V. Cloud Security'!AA201","v":0},{"$f":"'V. Cloud Security'!B201","v":"V.1.39.2.2"},{"$f":"'V. Cloud Security'!C201","v":"XSS?"},{"$f":"'V. Cloud Security'!D201","v":0},{"$f":"'V. Cloud Security'!E201","v":0},{"$f":"'V. Cloud Security'!F201","v":0},{"$f":"'V. Cloud Security'!I201","v":0},{"$f":"'V. Cloud Security'!J201","v":"NA"},{"$f":"'V. Cloud Security'!K201","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB201","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A202","v":3498},{"$f":"'V. Cloud Security'!L202","v":4},{"$f":"'V. Cloud Security'!M202","v":0},{"$f":"'V. Cloud Security'!AA202","v":0},{"$f":"'V. Cloud Security'!B202","v":"V.1.39.2.3"},{"$f":"'V. Cloud Security'!C202","v":"SQL injection?"},{"$f":"'V. Cloud Security'!D202","v":0},{"$f":"'V. Cloud Security'!E202","v":0},{"$f":"'V. Cloud Security'!F202","v":0},{"$f":"'V. Cloud Security'!I202","v":0},{"$f":"'V. Cloud Security'!J202","v":"NA"},{"$f":"'V. Cloud Security'!K202","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB202","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A203","v":3499},{"$f":"'V. Cloud Security'!L203","v":4},{"$f":"'V. Cloud Security'!M203","v":0},{"$f":"'V. Cloud Security'!AA203","v":0},{"$f":"'V. Cloud Security'!B203","v":"V.1.39.2.4"},{"$f":"'V. Cloud Security'!C203","v":"Session abuse?"},{"$f":"'V. Cloud Security'!D203","v":0},{"$f":"'V. Cloud Security'!E203","v":0},{"$f":"'V. Cloud Security'!F203","v":0},{"$f":"'V. Cloud Security'!I203","v":0},{"$f":"'V. Cloud Security'!J203","v":"NA"},{"$f":"'V. Cloud Security'!K203","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB203","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A204","v":3500},{"$f":"'V. Cloud Security'!L204","v":4},{"$f":"'V. Cloud Security'!M204","v":0},{"$f":"'V. Cloud Security'!AA204","v":0},{"$f":"'V. Cloud Security'!B204","v":"V.1.39.2.5"},{"$f":"'V. Cloud Security'!C204","v":"Replay attack?"},{"$f":"'V. Cloud Security'!D204","v":0},{"$f":"'V. Cloud Security'!E204","v":0},{"$f":"'V. Cloud Security'!F204","v":0},{"$f":"'V. Cloud Security'!I204","v":0},{"$f":"'V. Cloud Security'!J204","v":"NA"},{"$f":"'V. Cloud Security'!K204","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB204","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A205","v":3501},{"$f":"'V. Cloud Security'!L205","v":4},{"$f":"'V. Cloud Security'!M205","v":0},{"$f":"'V. Cloud Security'!AA205","v":0},{"$f":"'V. Cloud Security'!B205","v":"V.1.39.2.6"},{"$f":"'V. Cloud Security'!C205","v":"DoS?"},{"$f":"'V. Cloud Security'!D205","v":0},{"$f":"'V. Cloud Security'!E205","v":0},{"$f":"'V. Cloud Security'!F205","v":0},{"$f":"'V. Cloud Security'!I205","v":0},{"$f":"'V. Cloud Security'!J205","v":"NA"},{"$f":"'V. Cloud Security'!K205","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB205","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A206","v":3502},{"$f":"'V. Cloud Security'!L206","v":4},{"$f":"'V. Cloud Security'!M206","v":0},{"$f":"'V. Cloud Security'!AA206","v":0},{"$f":"'V. Cloud Security'!B206","v":"V.1.39.2.7"},{"$f":"'V. Cloud Security'!C206","v":"Data Leakage"},{"$f":"'V. Cloud Security'!D206","v":0},{"$f":"'V. Cloud Security'!E206","v":0},{"$f":"'V. Cloud Security'!F206","v":0},{"$f":"'V. Cloud Security'!I206","v":0},{"$f":"'V. Cloud Security'!J206","v":"NA"},{"$f":"'V. Cloud Security'!K206","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB206","v":"WP.1.I.3, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A207","v":3503},{"$f":"'V. Cloud Security'!L207","v":3},{"$f":"'V. Cloud Security'!M207","v":0},{"$f":"'V. Cloud Security'!AA207","v":0},{"$f":"'V. Cloud Security'!B207","v":"V.1.39.3"},{"$f":"'V. Cloud Security'!C207","v":"Is there the self-service ability to control access to APIs? If yes, does it include:"},{"$f":"'V. Cloud Security'!D207","v":0},{"$f":"'V. Cloud Security'!E207","v":0},{"$f":"'V. Cloud Security'!F207","v":0},{"$f":"'V. Cloud Security'!I207","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!J207","v":"9.1.2 "},{"$f":"'V. Cloud Security'!K207","v":"Access to networks and network services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB207","v":"WP.1.H.10, WP.1.A.1"}]
[{"$f":"'V. Cloud Security'!A208","v":3504},{"$f":"'V. Cloud Security'!L208","v":4},{"$f":"'V. Cloud Security'!M208","v":0},{"$f":"'V. Cloud Security'!AA208","v":0},{"$f":"'V. Cloud Security'!B208","v":"V.1.39.3.1"},{"$f":"'V. Cloud Security'!C208","v":"Network: Network access control (e.g., firewall ACL)?"},{"$f":"'V. Cloud Security'!D208","v":0},{"$f":"'V. Cloud Security'!E208","v":0},{"$f":"'V. Cloud Security'!F208","v":0},{"$f":"'V. Cloud Security'!I208","v":"I.2 Secure Systems Development Life Cycle (SDLC) Code Reviews, Q.5 Secure Code Review"},{"$f":"'V. Cloud Security'!J208","v":"9.1.2 "},{"$f":"'V. Cloud Security'!K208","v":"Access to networks and network services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB208","v":"WP.1.A.1, WP.1.A.2, WP.1.A.3"}]
[{"$f":"'V. Cloud Security'!A209","v":3505},{"$f":"'V. Cloud Security'!L209","v":4},{"$f":"'V. Cloud Security'!M209","v":0},{"$f":"'V. Cloud Security'!AA209","v":0},{"$f":"'V. Cloud Security'!B209","v":"V.1.39.3.2"},{"$f":"'V. Cloud Security'!C209","v":"Network: VPN?"},{"$f":"'V. Cloud Security'!D209","v":0},{"$f":"'V. Cloud Security'!E209","v":0},{"$f":"'V. Cloud Security'!F209","v":0},{"$f":"'V. Cloud Security'!I209","v":0},{"$f":"'V. Cloud Security'!J209","v":"9.1.2 "},{"$f":"'V. Cloud Security'!K209","v":"Access to networks and network services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB209","v":"WP.1.A.1, WP.1.A.2, WP.1.A.3"}]
[{"$f":"'V. Cloud Security'!A210","v":3506},{"$f":"'V. Cloud Security'!L210","v":4},{"$f":"'V. Cloud Security'!M210","v":0},{"$f":"'V. Cloud Security'!AA210","v":0},{"$f":"'V. Cloud Security'!B210","v":"V.1.39.3.3"},{"$f":"'V. Cloud Security'!C210","v":"Application: Application access control (e.g., application ACL)?"},{"$f":"'V. Cloud Security'!D210","v":0},{"$f":"'V. Cloud Security'!E210","v":0},{"$f":"'V. Cloud Security'!F210","v":0},{"$f":"'V. Cloud Security'!I210","v":"I.5 Application Security Program Governance"},{"$f":"'V. Cloud Security'!J210","v":"9.4.1"},{"$f":"'V. Cloud Security'!K210","v":"Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB210","v":"WP.1.I.2, WP.1.A.1, WP.1.A.2, WP.1.A.3"}]
[{"$f":"'V. Cloud Security'!A211","v":3507},{"$f":"'V. Cloud Security'!L211","v":4},{"$f":"'V. Cloud Security'!M211","v":0},{"$f":"'V. Cloud Security'!AA211","v":0},{"$f":"'V. Cloud Security'!B211","v":"V.1.39.3.4"},{"$f":"'V. Cloud Security'!C211","v":"Credential: username/password?"},{"$f":"'V. Cloud Security'!D211","v":0},{"$f":"'V. Cloud Security'!E211","v":0},{"$f":"'V. Cloud Security'!F211","v":0},{"$f":"'V. Cloud Security'!I211","v":0},{"$f":"'V. Cloud Security'!J211","v":"9.4.2"},{"$f":"'V. Cloud Security'!K211","v":"Secure log-on procedures"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB211","v":"WP.1.I.2, WP.1.A.1, WP.1.A.2, WP.1.A.3"}]
[{"$f":"'V. Cloud Security'!A212","v":3508},{"$f":"'V. Cloud Security'!L212","v":4},{"$f":"'V. Cloud Security'!M212","v":0},{"$f":"'V. Cloud Security'!AA212","v":0},{"$f":"'V. Cloud Security'!B212","v":"V.1.39.3.5"},{"$f":"'V. Cloud Security'!C212","v":"Credential: client side certificate?"},{"$f":"'V. Cloud Security'!D212","v":0},{"$f":"'V. Cloud Security'!E212","v":0},{"$f":"'V. Cloud Security'!F212","v":0},{"$f":"'V. Cloud Security'!I212","v":0},{"$f":"'V. Cloud Security'!J212","v":"9.4.1"},{"$f":"'V. Cloud Security'!K212","v":"Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB212","v":"WP.1.I.2, WP.1.A.1, WP.1.A.2, WP.1.A.3"}]
[{"$f":"'V. Cloud Security'!A213","v":3509},{"$f":"'V. Cloud Security'!L213","v":4},{"$f":"'V. Cloud Security'!M213","v":0},{"$f":"'V. Cloud Security'!AA213","v":0},{"$f":"'V. Cloud Security'!B213","v":"V.1.39.3.6"},{"$f":"'V. Cloud Security'!C213","v":"Credential: multi factor authentication?"},{"$f":"'V. Cloud Security'!D213","v":0},{"$f":"'V. Cloud Security'!E213","v":0},{"$f":"'V. Cloud Security'!F213","v":0},{"$f":"'V. Cloud Security'!I213","v":0},{"$f":"'V. Cloud Security'!J213","v":"9.4.2"},{"$f":"'V. Cloud Security'!K213","v":"Secure log-on procedures"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB213","v":"WP.1.I.2, WP.1.A.1, WP.1.A.2, WP.1.A.3"}]
[{"$f":"'V. Cloud Security'!A214","v":3510},{"$f":"'V. Cloud Security'!L214","v":3},{"$f":"'V. Cloud Security'!M214","v":0},{"$f":"'V. Cloud Security'!AA214","v":0},{"$f":"'V. Cloud Security'!B214","v":"V.1.39.4"},{"$f":"'V. Cloud Security'!C214","v":"Is there a self-service kill switch available to clients to disable an API in the event of a security incident (e.g., DoS)?"},{"$f":"'V. Cloud Security'!D214","v":0},{"$f":"'V. Cloud Security'!E214","v":0},{"$f":"'V. Cloud Security'!F214","v":0},{"$f":"'V. Cloud Security'!I214","v":0},{"$f":"'V. Cloud Security'!J214","v":"9.4.1"},{"$f":"'V. Cloud Security'!K214","v":"Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB214","v":"WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A215","v":3511},{"$f":"'V. Cloud Security'!L215","v":3},{"$f":"'V. Cloud Security'!M215","v":0},{"$f":"'V. Cloud Security'!AA215","v":0},{"$f":"'V. Cloud Security'!B215","v":"V.1.39.5"},{"$f":"'V. Cloud Security'!C215","v":"Does the API have the ability to alert, block or lock based on rate limit?"},{"$f":"'V. Cloud Security'!D215","v":0},{"$f":"'V. Cloud Security'!E215","v":0},{"$f":"'V. Cloud Security'!F215","v":0},{"$f":"'V. Cloud Security'!I215","v":0},{"$f":"'V. Cloud Security'!J215","v":"9.4.2"},{"$f":"'V. Cloud Security'!K215","v":"Secure log-on procedures"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB215","v":"WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A216","v":3512},{"$f":"'V. Cloud Security'!L216","v":3},{"$f":"'V. Cloud Security'!M216","v":0},{"$f":"'V. Cloud Security'!AA216","v":0},{"$f":"'V. Cloud Security'!B216","v":"V.1.39.6"},{"$f":"'V. Cloud Security'!C216","v":"Is Scoped Data encrypted in the API response? "},{"$f":"'V. Cloud Security'!D216","v":0},{"$f":"'V. Cloud Security'!E216","v":0},{"$f":"'V. Cloud Security'!F216","v":0},{"$f":"'V. Cloud Security'!I216","v":0},{"$f":"'V. Cloud Security'!J216","v":"10.1.1                                                     13.1.2"},{"$f":"'V. Cloud Security'!K216","v":"Policy on The Use of Cryptographic Controls  Security of network services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB216","v":"WP.1.A.5, WP.1.A.6, WP.1.G.9, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A217","v":3513},{"$f":"'V. Cloud Security'!L217","v":3},{"$f":"'V. Cloud Security'!M217","v":0},{"$f":"'V. Cloud Security'!AA217","v":0},{"$f":"'V. Cloud Security'!B217","v":"V.1.39.7"},{"$f":"'V. Cloud Security'!C217","v":"Is Scoped Data encrypted in the API request?"},{"$f":"'V. Cloud Security'!D217","v":0},{"$f":"'V. Cloud Security'!E217","v":0},{"$f":"'V. Cloud Security'!F217","v":0},{"$f":"'V. Cloud Security'!I217","v":0},{"$f":"'V. Cloud Security'!J217","v":"10.1.1                                                     13.1.2"},{"$f":"'V. Cloud Security'!K217","v":"Policy on The Use of Cryptographic Controls  Security of network services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB217","v":"WP.1.A.5, WP.1.A.6, WP.1.G.9, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A218","v":3514},{"$f":"'V. Cloud Security'!L218","v":3},{"$f":"'V. Cloud Security'!M218","v":0},{"$f":"'V. Cloud Security'!AA218","v":0},{"$f":"'V. Cloud Security'!B218","v":"V.1.39.8"},{"$f":"'V. Cloud Security'!C218","v":"Is there an option for the API request calls to be digitally signed?"},{"$f":"'V. Cloud Security'!D218","v":0},{"$f":"'V. Cloud Security'!E218","v":0},{"$f":"'V. Cloud Security'!F218","v":0},{"$f":"'V. Cloud Security'!I218","v":0},{"$f":"'V. Cloud Security'!J218","v":"10.1.1                                                     13.1.2"},{"$f":"'V. Cloud Security'!K218","v":"Policy on The Use of Cryptographic Controls  Security of network services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB218","v":"WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A219","v":3515},{"$f":"'V. Cloud Security'!L219","v":3},{"$f":"'V. Cloud Security'!M219","v":0},{"$f":"'V. Cloud Security'!AA219","v":0},{"$f":"'V. Cloud Security'!B219","v":"V.1.39.9"},{"$f":"'V. Cloud Security'!C219","v":"Is there an option for the API response calls to be digitally signed?"},{"$f":"'V. Cloud Security'!D219","v":0},{"$f":"'V. Cloud Security'!E219","v":0},{"$f":"'V. Cloud Security'!F219","v":0},{"$f":"'V. Cloud Security'!I219","v":0},{"$f":"'V. Cloud Security'!J219","v":"10.1.1                                                     13.1.2"},{"$f":"'V. Cloud Security'!K219","v":"Policy on The Use of Cryptographic Controls  Security of network services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB219","v":"WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A220","v":3516},{"$f":"'V. Cloud Security'!L220","v":2},{"$f":"'V. Cloud Security'!M220","v":0},{"$f":"'V. Cloud Security'!AA220","v":1},{"$f":"'V. Cloud Security'!B220","v":"V.1.40"},{"$f":"'V. Cloud Security'!C220","v":"Is there a client management portal which allows distributed business accounts (business units/departments) to be managed under a single central corporate account?"},{"$f":"'V. Cloud Security'!D220","v":0},{"$f":"'V. Cloud Security'!E220","v":0},{"$f":"'V. Cloud Security'!F220","v":0},{"$f":"'V. Cloud Security'!I220","v":0},{"$f":"'V. Cloud Security'!J220","v":"15.2.1"},{"$f":"'V. Cloud Security'!K220","v":"Monitoring and review of supplier services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB220","v":"WP.1.J.1, WP.1.J.7, WP.1.A.3, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.H.6, WP.1.H.10"}]
[{"$f":"'V. Cloud Security'!A221","v":3517},{"$f":"'V. Cloud Security'!L221","v":2},{"$f":"'V. Cloud Security'!M221","v":0},{"$f":"'V. Cloud Security'!AA221","v":0},{"$f":"'V. Cloud Security'!B221","v":"V.1.41"},{"$f":"'V. Cloud Security'!C221","v":"Are background checks performed? If yes, are they for:"},{"$f":"'V. Cloud Security'!D221","v":0},{"$f":"'V. Cloud Security'!E221","v":0},{"$f":"'V. Cloud Security'!F221","v":0},{"$f":"'V. Cloud Security'!I221","v":"E.3 Background Investigation Policy Content"},{"$f":"'V. Cloud Security'!J221","v":"7.1.1                                                        7.2.1"},{"$f":"'V. Cloud Security'!K221","v":"Screening                         Management responsibilities"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB221","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A222","v":3518},{"$f":"'V. Cloud Security'!L222","v":3},{"$f":"'V. Cloud Security'!M222","v":0},{"$f":"'V. Cloud Security'!AA222","v":0},{"$f":"'V. Cloud Security'!B222","v":"V.1.41.1"},{"$f":"'V. Cloud Security'!C222","v":"Cloud provider staff?"},{"$f":"'V. Cloud Security'!D222","v":0},{"$f":"'V. Cloud Security'!E222","v":0},{"$f":"'V. Cloud Security'!F222","v":0},{"$f":"'V. Cloud Security'!I222","v":0},{"$f":"'V. Cloud Security'!J222","v":"7.1.1                                                        7.2.1"},{"$f":"'V. Cloud Security'!K222","v":"Screening                         Management responsibilities"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB222","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A223","v":3519},{"$f":"'V. Cloud Security'!L223","v":3},{"$f":"'V. Cloud Security'!M223","v":0},{"$f":"'V. Cloud Security'!AA223","v":0},{"$f":"'V. Cloud Security'!B223","v":"V.1.41.2"},{"$f":"'V. Cloud Security'!C223","v":"Cloud provider contractors?"},{"$f":"'V. Cloud Security'!D223","v":0},{"$f":"'V. Cloud Security'!E223","v":0},{"$f":"'V. Cloud Security'!F223","v":0},{"$f":"'V. Cloud Security'!I223","v":0},{"$f":"'V. Cloud Security'!J223","v":"7.1.1                                                        7.2.1"},{"$f":"'V. Cloud Security'!K223","v":"Screening                         Management responsibilities"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB223","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A224","v":3520},{"$f":"'V. Cloud Security'!L224","v":3},{"$f":"'V. Cloud Security'!M224","v":0},{"$f":"'V. Cloud Security'!AA224","v":0},{"$f":"'V. Cloud Security'!B224","v":"V.1.41.3"},{"$f":"'V. Cloud Security'!C224","v":"Cloud provider subcontractor?"},{"$f":"'V. Cloud Security'!D224","v":0},{"$f":"'V. Cloud Security'!E224","v":0},{"$f":"'V. Cloud Security'!F224","v":0},{"$f":"'V. Cloud Security'!I224","v":0},{"$f":"'V. Cloud Security'!J224","v":"7.1.1                                                        7.2.1"},{"$f":"'V. Cloud Security'!K224","v":"Screening                         Management responsibilities"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB224","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A225","v":3521},{"$f":"'V. Cloud Security'!L225","v":3},{"$f":"'V. Cloud Security'!M225","v":1},{"$f":"'V. Cloud Security'!AA225","v":0},{"$f":"'V. Cloud Security'!B225","v":"V.1.41.4"},{"$f":"'V. Cloud Security'!C225","v":"What is the default frequency of the background checks:"},{"$f":"'V. Cloud Security'!D225","v":0},{"$f":"'V. Cloud Security'!E225","v":0},{"$f":"'V. Cloud Security'!F225","v":0},{"$f":"'V. Cloud Security'!I225","v":0},{"$f":"'V. Cloud Security'!J225","v":"7.1.1                                                        7.2.1"},{"$f":"'V. Cloud Security'!K225","v":"Screening                         Management responsibilities"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB225","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A226","v":3522},{"$f":"'V. Cloud Security'!L226","v":4},{"$f":"'V. Cloud Security'!M226","v":0},{"$f":"'V. Cloud Security'!AA226","v":0},{"$f":"'V. Cloud Security'!B226","v":"V.1.41.4.1"},{"$f":"'V. Cloud Security'!C226","v":"At time of hire?"},{"$f":"'V. Cloud Security'!D226","v":0},{"$f":"'V. Cloud Security'!E226","v":0},{"$f":"'V. Cloud Security'!F226","v":0},{"$f":"'V. Cloud Security'!I226","v":0},{"$f":"'V. Cloud Security'!J226","v":"NA"},{"$f":"'V. Cloud Security'!K226","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB226","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A227","v":3523},{"$f":"'V. Cloud Security'!L227","v":4},{"$f":"'V. Cloud Security'!M227","v":0},{"$f":"'V. Cloud Security'!AA227","v":0},{"$f":"'V. Cloud Security'!B227","v":"V.1.41.4.2"},{"$f":"'V. Cloud Security'!C227","v":"Quarterly?"},{"$f":"'V. Cloud Security'!D227","v":0},{"$f":"'V. Cloud Security'!E227","v":0},{"$f":"'V. Cloud Security'!F227","v":0},{"$f":"'V. Cloud Security'!I227","v":0},{"$f":"'V. Cloud Security'!J227","v":"NA"},{"$f":"'V. Cloud Security'!K227","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB227","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A228","v":3524},{"$f":"'V. Cloud Security'!L228","v":4},{"$f":"'V. Cloud Security'!M228","v":0},{"$f":"'V. Cloud Security'!AA228","v":0},{"$f":"'V. Cloud Security'!B228","v":"V.1.41.4.3"},{"$f":"'V. Cloud Security'!C228","v":"Semiannually?"},{"$f":"'V. Cloud Security'!D228","v":0},{"$f":"'V. Cloud Security'!E228","v":0},{"$f":"'V. Cloud Security'!F228","v":0},{"$f":"'V. Cloud Security'!I228","v":0},{"$f":"'V. Cloud Security'!J228","v":"NA"},{"$f":"'V. Cloud Security'!K228","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB228","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A229","v":3525},{"$f":"'V. Cloud Security'!L229","v":4},{"$f":"'V. Cloud Security'!M229","v":0},{"$f":"'V. Cloud Security'!AA229","v":0},{"$f":"'V. Cloud Security'!B229","v":"V.1.41.4.4"},{"$f":"'V. Cloud Security'!C229","v":"Annually?"},{"$f":"'V. Cloud Security'!D229","v":0},{"$f":"'V. Cloud Security'!E229","v":0},{"$f":"'V. Cloud Security'!F229","v":0},{"$f":"'V. Cloud Security'!I229","v":0},{"$f":"'V. Cloud Security'!J229","v":"NA"},{"$f":"'V. Cloud Security'!K229","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB229","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A230","v":3526},{"$f":"'V. Cloud Security'!L230","v":4},{"$f":"'V. Cloud Security'!M230","v":0},{"$f":"'V. Cloud Security'!AA230","v":0},{"$f":"'V. Cloud Security'!B230","v":"V.1.41.4.5"},{"$f":"'V. Cloud Security'!C230","v":"Other?"},{"$f":"'V. Cloud Security'!D230","v":0},{"$f":"'V. Cloud Security'!E230","v":0},{"$f":"'V. Cloud Security'!F230","v":0},{"$f":"'V. Cloud Security'!I230","v":0},{"$f":"'V. Cloud Security'!J230","v":"NA"},{"$f":"'V. Cloud Security'!K230","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB230","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A231","v":3532},{"$f":"'V. Cloud Security'!L231","v":3},{"$f":"'V. Cloud Security'!M231","v":1},{"$f":"'V. Cloud Security'!AA231","v":0},{"$f":"'V. Cloud Security'!B231","v":"V.1.41.5"},{"$f":"'V. Cloud Security'!C231","v":"Who performs background checks on direct contractors"},{"$f":"'V. Cloud Security'!D231","v":0},{"$f":"'V. Cloud Security'!E231","v":0},{"$f":"'V. Cloud Security'!F231","v":0},{"$f":"'V. Cloud Security'!I231","v":0},{"$f":"'V. Cloud Security'!J231","v":"7.1.1                                                        7.2.1"},{"$f":"'V. Cloud Security'!K231","v":"Screening                         Management responsibilities"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB231","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A232","v":3533},{"$f":"'V. Cloud Security'!L232","v":4},{"$f":"'V. Cloud Security'!M232","v":0},{"$f":"'V. Cloud Security'!AA232","v":0},{"$f":"'V. Cloud Security'!B232","v":"V.1.41.5.1"},{"$f":"'V. Cloud Security'!C232","v":"Direct contracting firm?"},{"$f":"'V. Cloud Security'!D232","v":0},{"$f":"'V. Cloud Security'!E232","v":0},{"$f":"'V. Cloud Security'!F232","v":0},{"$f":"'V. Cloud Security'!I232","v":0},{"$f":"'V. Cloud Security'!J232","v":"NA"},{"$f":"'V. Cloud Security'!K232","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB232","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A233","v":3534},{"$f":"'V. Cloud Security'!L233","v":4},{"$f":"'V. Cloud Security'!M233","v":0},{"$f":"'V. Cloud Security'!AA233","v":0},{"$f":"'V. Cloud Security'!B233","v":"V.1.41.5.2"},{"$f":"'V. Cloud Security'!C233","v":"Subcontracting firm?"},{"$f":"'V. Cloud Security'!D233","v":0},{"$f":"'V. Cloud Security'!E233","v":0},{"$f":"'V. Cloud Security'!F233","v":0},{"$f":"'V. Cloud Security'!I233","v":0},{"$f":"'V. Cloud Security'!J233","v":"NA"},{"$f":"'V. Cloud Security'!K233","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A234","v":3535},{"$f":"'V. Cloud Security'!L234","v":4},{"$f":"'V. Cloud Security'!M234","v":0},{"$f":"'V. Cloud Security'!AA234","v":0},{"$f":"'V. Cloud Security'!B234","v":"V.1.41.5.3"},{"$f":"'V. Cloud Security'!C234","v":"Cloud provider?"},{"$f":"'V. Cloud Security'!D234","v":0},{"$f":"'V. Cloud Security'!E234","v":0},{"$f":"'V. Cloud Security'!F234","v":0},{"$f":"'V. Cloud Security'!I234","v":0},{"$f":"'V. Cloud Security'!J234","v":"NA"},{"$f":"'V. Cloud Security'!K234","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB234","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A235","v":3536},{"$f":"'V. Cloud Security'!L235","v":4},{"$f":"'V. Cloud Security'!M235","v":0},{"$f":"'V. Cloud Security'!AA235","v":0},{"$f":"'V. Cloud Security'!B235","v":"V.1.41.5.4"},{"$f":"'V. Cloud Security'!C235","v":"Client?"},{"$f":"'V. Cloud Security'!D235","v":0},{"$f":"'V. Cloud Security'!E235","v":0},{"$f":"'V. Cloud Security'!F235","v":0},{"$f":"'V. Cloud Security'!I235","v":0},{"$f":"'V. Cloud Security'!J235","v":"NA"},{"$f":"'V. Cloud Security'!K235","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB235","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A236","v":3537},{"$f":"'V. Cloud Security'!L236","v":4},{"$f":"'V. Cloud Security'!M236","v":0},{"$f":"'V. Cloud Security'!AA236","v":0},{"$f":"'V. Cloud Security'!B236","v":"V.1.41.5.5"},{"$f":"'V. Cloud Security'!C236","v":"Other?"},{"$f":"'V. Cloud Security'!D236","v":0},{"$f":"'V. Cloud Security'!E236","v":0},{"$f":"'V. Cloud Security'!F236","v":0},{"$f":"'V. Cloud Security'!I236","v":0},{"$f":"'V. Cloud Security'!J236","v":"NA"},{"$f":"'V. Cloud Security'!K236","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB236","v":"WP.1.E.2, WP.1.G.2, WP.1.G.11, WP.1.J.4, WP.1.J.7"}]
[{"$f":"'V. Cloud Security'!A237","v":3538},{"$f":"'V. Cloud Security'!L237","v":2},{"$f":"'V. Cloud Security'!M237","v":0},{"$f":"'V. Cloud Security'!AA237","v":1},{"$f":"'V. Cloud Security'!B237","v":"V.1.42"},{"$f":"'V. Cloud Security'!C237","v":"Is two factor authentication required to access the production cloud environment containing Scoped Data?  If yes, does it include:"},{"$f":"'V. Cloud Security'!D237","v":0},{"$f":"'V. Cloud Security'!E237","v":0},{"$f":"'V. Cloud Security'!F237","v":0},{"$f":"'V. Cloud Security'!I237","v":"I.6 Application Security Vulnerability Assessment and Remediation"},{"$f":"'V. Cloud Security'!J237","v":"9.3.1"},{"$f":"'V. Cloud Security'!K237","v":"Use of secret authentication information"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB237","v":"WP.1.H.6, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A238","v":3539},{"$f":"'V. Cloud Security'!L238","v":3},{"$f":"'V. Cloud Security'!M238","v":0},{"$f":"'V. Cloud Security'!AA238","v":0},{"$f":"'V. Cloud Security'!B238","v":"V.1.42.1"},{"$f":"'V. Cloud Security'!C238","v":"Admin access (shell or UI): Internally from within cloud provider network?"},{"$f":"'V. Cloud Security'!D238","v":0},{"$f":"'V. Cloud Security'!E238","v":0},{"$f":"'V. Cloud Security'!F238","v":0},{"$f":"'V. Cloud Security'!I238","v":0},{"$f":"'V. Cloud Security'!J238","v":"9.4.1"},{"$f":"'V. Cloud Security'!K238","v":"Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB238","v":"WP.1.H.6, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A239","v":3540},{"$f":"'V. Cloud Security'!L239","v":3},{"$f":"'V. Cloud Security'!M239","v":0},{"$f":"'V. Cloud Security'!AA239","v":0},{"$f":"'V. Cloud Security'!B239","v":"V.1.42.2"},{"$f":"'V. Cloud Security'!C239","v":"Non-admin access (shell or UI): Internally from within cloud provider network?"},{"$f":"'V. Cloud Security'!D239","v":0},{"$f":"'V. Cloud Security'!E239","v":0},{"$f":"'V. Cloud Security'!F239","v":0},{"$f":"'V. Cloud Security'!I239","v":0},{"$f":"'V. Cloud Security'!J239","v":"9.4.1"},{"$f":"'V. Cloud Security'!K239","v":"Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB239","v":"WP.1.H.6, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A240","v":3541},{"$f":"'V. Cloud Security'!L240","v":3},{"$f":"'V. Cloud Security'!M240","v":0},{"$f":"'V. Cloud Security'!AA240","v":0},{"$f":"'V. Cloud Security'!B240","v":"V.1.42.3"},{"$f":"'V. Cloud Security'!C240","v":"Admin access (shell or UI): remote access?"},{"$f":"'V. Cloud Security'!D240","v":0},{"$f":"'V. Cloud Security'!E240","v":0},{"$f":"'V. Cloud Security'!F240","v":0},{"$f":"'V. Cloud Security'!I240","v":0},{"$f":"'V. Cloud Security'!J240","v":"9.4.1"},{"$f":"'V. Cloud Security'!K240","v":"Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB240","v":"WP.1.H.6, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A241","v":3542},{"$f":"'V. Cloud Security'!L241","v":3},{"$f":"'V. Cloud Security'!M241","v":0},{"$f":"'V. Cloud Security'!AA241","v":0},{"$f":"'V. Cloud Security'!B241","v":"V.1.42.4"},{"$f":"'V. Cloud Security'!C241","v":"Non-admin access (shell or UI): remote access?"},{"$f":"'V. Cloud Security'!D241","v":0},{"$f":"'V. Cloud Security'!E241","v":0},{"$f":"'V. Cloud Security'!F241","v":0},{"$f":"'V. Cloud Security'!I241","v":0},{"$f":"'V. Cloud Security'!J241","v":"9.4.1"},{"$f":"'V. Cloud Security'!K241","v":"Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB241","v":"WP.1.H.6, WP.1.I.4, WP.1.I.7"}]
[{"$f":"'V. Cloud Security'!A242","v":3543},{"$f":"'V. Cloud Security'!L242","v":2},{"$f":"'V. Cloud Security'!M242","v":0},{"$f":"'V. Cloud Security'!AA242","v":0},{"$f":"'V. Cloud Security'!B242","v":"V.1.43"},{"$f":"'V. Cloud Security'!C242","v":"Are staff able to access client Scoped Data? If not, which of the following controls are used to prevent this:"},{"$f":"'V. Cloud Security'!D242","v":0},{"$f":"'V. Cloud Security'!E242","v":0},{"$f":"'V. Cloud Security'!F242","v":0},{"$f":"'V. Cloud Security'!I242","v":"H.3 Logical Access Authorization"},{"$f":"'V. Cloud Security'!J242","v":"9.2.3\n9.4.1"},{"$f":"'V. Cloud Security'!K242","v":"Management of privileged access rights                                Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB242","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A243","v":3544},{"$f":"'V. Cloud Security'!L243","v":3},{"$f":"'V. Cloud Security'!M243","v":0},{"$f":"'V. Cloud Security'!AA243","v":0},{"$f":"'V. Cloud Security'!B243","v":"V.1.43.1"},{"$f":"'V. Cloud Security'!C243","v":"Preventative controls (e.g., technical)?"},{"$f":"'V. Cloud Security'!D243","v":0},{"$f":"'V. Cloud Security'!E243","v":0},{"$f":"'V. Cloud Security'!F243","v":0},{"$f":"'V. Cloud Security'!I243","v":0},{"$f":"'V. Cloud Security'!J243","v":"9.2.3\n9.4.2"},{"$f":"'V. Cloud Security'!K243","v":"Management of privileged access rights                                Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB243","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A244","v":3545},{"$f":"'V. Cloud Security'!L244","v":3},{"$f":"'V. Cloud Security'!M244","v":0},{"$f":"'V. Cloud Security'!AA244","v":0},{"$f":"'V. Cloud Security'!B244","v":"V.1.43.2"},{"$f":"'V. Cloud Security'!C244","v":"Detective controls?"},{"$f":"'V. Cloud Security'!D244","v":0},{"$f":"'V. Cloud Security'!E244","v":0},{"$f":"'V. Cloud Security'!F244","v":0},{"$f":"'V. Cloud Security'!I244","v":0},{"$f":"'V. Cloud Security'!J244","v":"9.2.3\n9.4.3"},{"$f":"'V. Cloud Security'!K244","v":"Management of privileged access rights                                Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB244","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A245","v":3546},{"$f":"'V. Cloud Security'!L245","v":3},{"$f":"'V. Cloud Security'!M245","v":0},{"$f":"'V. Cloud Security'!AA245","v":0},{"$f":"'V. Cloud Security'!B245","v":"V.1.43.3"},{"$f":"'V. Cloud Security'!C245","v":"Corrective controls?"},{"$f":"'V. Cloud Security'!D245","v":0},{"$f":"'V. Cloud Security'!E245","v":0},{"$f":"'V. Cloud Security'!F245","v":0},{"$f":"'V. Cloud Security'!I245","v":0},{"$f":"'V. Cloud Security'!J245","v":"9.2.3\n9.4.4"},{"$f":"'V. Cloud Security'!K245","v":"Management of privileged access rights                                Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB245","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A246","v":3547},{"$f":"'V. Cloud Security'!L246","v":3},{"$f":"'V. Cloud Security'!M246","v":0},{"$f":"'V. Cloud Security'!AA246","v":0},{"$f":"'V. Cloud Security'!B246","v":"V.1.43.4"},{"$f":"'V. Cloud Security'!C246","v":"Policy controls?"},{"$f":"'V. Cloud Security'!D246","v":0},{"$f":"'V. Cloud Security'!E246","v":0},{"$f":"'V. Cloud Security'!F246","v":0},{"$f":"'V. Cloud Security'!I246","v":0},{"$f":"'V. Cloud Security'!J246","v":"9.2.3\n9.4.5"},{"$f":"'V. Cloud Security'!K246","v":"Management of privileged access rights                                Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB246","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A247","v":3548},{"$f":"'V. Cloud Security'!L247","v":2},{"$f":"'V. Cloud Security'!M247","v":0},{"$f":"'V. Cloud Security'!AA247","v":1},{"$f":"'V. Cloud Security'!B247","v":"V.1.44"},{"$f":"'V. Cloud Security'!C247","v":"Are staff able to access client Scoped Data in an unencrypted state?"},{"$f":"'V. Cloud Security'!D247","v":0},{"$f":"'V. Cloud Security'!E247","v":0},{"$f":"'V. Cloud Security'!F247","v":0},{"$f":"'V. Cloud Security'!I247","v":"H.3 Logical Access Authorization"},{"$f":"'V. Cloud Security'!J247","v":"9.2.3\n9.4.6"},{"$f":"'V. Cloud Security'!K247","v":"Management of privileged access rights                                Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB247","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A248","v":3549},{"$f":"'V. Cloud Security'!L248","v":2},{"$f":"'V. Cloud Security'!M248","v":0},{"$f":"'V. Cloud Security'!AA248","v":1},{"$f":"'V. Cloud Security'!B248","v":"V.1.45"},{"$f":"'V. Cloud Security'!C248","v":"Are staff able to access client's encryption key? If not, which of the following controls are used to prevent this:"},{"$f":"'V. Cloud Security'!D248","v":0},{"$f":"'V. Cloud Security'!E248","v":0},{"$f":"'V. Cloud Security'!F248","v":0},{"$f":"'V. Cloud Security'!I248","v":"H.3 Logical Access Authorization"},{"$f":"'V. Cloud Security'!J248","v":"9.2.3\n9.4.7"},{"$f":"'V. Cloud Security'!K248","v":"Management of privileged access rights                                Information access restriction"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB248","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A249","v":3550},{"$f":"'V. Cloud Security'!L249","v":3},{"$f":"'V. Cloud Security'!M249","v":0},{"$f":"'V. Cloud Security'!AA249","v":0},{"$f":"'V. Cloud Security'!B249","v":"V.1.45.1"},{"$f":"'V. Cloud Security'!C249","v":"Preventative controls (e.g., technical)?"},{"$f":"'V. Cloud Security'!D249","v":0},{"$f":"'V. Cloud Security'!E249","v":0},{"$f":"'V. Cloud Security'!F249","v":0},{"$f":"'V. Cloud Security'!I249","v":0},{"$f":"'V. Cloud Security'!J249","v":"NA"},{"$f":"'V. Cloud Security'!K249","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB249","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A250","v":3551},{"$f":"'V. Cloud Security'!L250","v":3},{"$f":"'V. Cloud Security'!M250","v":0},{"$f":"'V. Cloud Security'!AA250","v":0},{"$f":"'V. Cloud Security'!B250","v":"V.1.45.2"},{"$f":"'V. Cloud Security'!C250","v":"Detective controls?"},{"$f":"'V. Cloud Security'!D250","v":0},{"$f":"'V. Cloud Security'!E250","v":0},{"$f":"'V. Cloud Security'!F250","v":0},{"$f":"'V. Cloud Security'!I250","v":0},{"$f":"'V. Cloud Security'!J250","v":"NA"},{"$f":"'V. Cloud Security'!K250","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB250","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A251","v":3552},{"$f":"'V. Cloud Security'!L251","v":3},{"$f":"'V. Cloud Security'!M251","v":0},{"$f":"'V. Cloud Security'!AA251","v":0},{"$f":"'V. Cloud Security'!B251","v":"V.1.45.3"},{"$f":"'V. Cloud Security'!C251","v":"Corrective controls?"},{"$f":"'V. Cloud Security'!D251","v":0},{"$f":"'V. Cloud Security'!E251","v":0},{"$f":"'V. Cloud Security'!F251","v":0},{"$f":"'V. Cloud Security'!I251","v":0},{"$f":"'V. Cloud Security'!J251","v":"NA"},{"$f":"'V. Cloud Security'!K251","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB251","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A252","v":3553},{"$f":"'V. Cloud Security'!L252","v":3},{"$f":"'V. Cloud Security'!M252","v":0},{"$f":"'V. Cloud Security'!AA252","v":0},{"$f":"'V. Cloud Security'!B252","v":"V.1.45.4"},{"$f":"'V. Cloud Security'!C252","v":"Policy controls?"},{"$f":"'V. Cloud Security'!D252","v":0},{"$f":"'V. Cloud Security'!E252","v":0},{"$f":"'V. Cloud Security'!F252","v":0},{"$f":"'V. Cloud Security'!I252","v":0},{"$f":"'V. Cloud Security'!J252","v":"NA"},{"$f":"'V. Cloud Security'!K252","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB252","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A253","v":3554},{"$f":"'V. Cloud Security'!L253","v":2},{"$f":"'V. Cloud Security'!M253","v":0},{"$f":"'V. Cloud Security'!AA253","v":1},{"$f":"'V. Cloud Security'!B253","v":"V.1.46"},{"$f":"'V. Cloud Security'!C253","v":"Is there a process which allows the client to specifically list who from the cloud provider will have access to their Scoped Systems and Data? If yes, does this include:"},{"$f":"'V. Cloud Security'!D253","v":0},{"$f":"'V. Cloud Security'!E253","v":0},{"$f":"'V. Cloud Security'!F253","v":0},{"$f":"'V. Cloud Security'!I253","v":"H.3 Logical Access Authorization"},{"$f":"'V. Cloud Security'!J253","v":"9.1.1                                                        9.2.3"},{"$f":"'V. Cloud Security'!K253","v":"\tAccess Control Policy\nManagement of privileged access rights"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB253","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A254","v":3555},{"$f":"'V. Cloud Security'!L254","v":3},{"$f":"'V. Cloud Security'!M254","v":0},{"$f":"'V. Cloud Security'!AA254","v":0},{"$f":"'V. Cloud Security'!B254","v":"V.1.46.1"},{"$f":"'V. Cloud Security'!C254","v":"Role based access groups?"},{"$f":"'V. Cloud Security'!D254","v":0},{"$f":"'V. Cloud Security'!E254","v":0},{"$f":"'V. Cloud Security'!F254","v":0},{"$f":"'V. Cloud Security'!I254","v":0},{"$f":"'V. Cloud Security'!J254","v":"NA"},{"$f":"'V. Cloud Security'!K254","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB254","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A255","v":3556},{"$f":"'V. Cloud Security'!L255","v":3},{"$f":"'V. Cloud Security'!M255","v":0},{"$f":"'V. Cloud Security'!AA255","v":0},{"$f":"'V. Cloud Security'!B255","v":"V.1.46.2"},{"$f":"'V. Cloud Security'!C255","v":"Written approval from client?"},{"$f":"'V. Cloud Security'!D255","v":0},{"$f":"'V. Cloud Security'!E255","v":0},{"$f":"'V. Cloud Security'!F255","v":0},{"$f":"'V. Cloud Security'!I255","v":0},{"$f":"'V. Cloud Security'!J255","v":"NA"},{"$f":"'V. Cloud Security'!K255","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB255","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A256","v":3557},{"$f":"'V. Cloud Security'!L256","v":3},{"$f":"'V. Cloud Security'!M256","v":0},{"$f":"'V. Cloud Security'!AA256","v":0},{"$f":"'V. Cloud Security'!B256","v":"V.1.46.3"},{"$f":"'V. Cloud Security'!C256","v":"Other?"},{"$f":"'V. Cloud Security'!D256","v":0},{"$f":"'V. Cloud Security'!E256","v":0},{"$f":"'V. Cloud Security'!F256","v":0},{"$f":"'V. Cloud Security'!I256","v":0},{"$f":"'V. Cloud Security'!J256","v":"NA"},{"$f":"'V. Cloud Security'!K256","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB256","v":"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A257","v":3558},{"$f":"'V. Cloud Security'!L257","v":2},{"$f":"'V. Cloud Security'!M257","v":0},{"$f":"'V. Cloud Security'!AA257","v":1},{"$f":"'V. Cloud Security'!B257","v":"V.1.47"},{"$f":"'V. Cloud Security'!C257","v":"Are staff technically prevented from accessing the cloud environment via non-managed private devices? If yes, is it from:"},{"$f":"'V. Cloud Security'!D257","v":0},{"$f":"'V. Cloud Security'!E257","v":0},{"$f":"'V. Cloud Security'!F257","v":0},{"$f":"'V. Cloud Security'!I257","v":"H.3 Logical Access Authorization"},{"$f":"'V. Cloud Security'!J257","v":"9.1.1                                                        9.1.2                                                                               9.2.1                                                  9.2.3 "},{"$f":"'V. Cloud Security'!K257","v":"Access control policy,\nAccess to networks and network services,\nUser registration and de-registration,\nManagement of privileged access rights"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB257","v":"WP.1.E.2, WP.1.H.6"}]
[{"$f":"'V. Cloud Security'!A258","v":3559},{"$f":"'V. Cloud Security'!L258","v":3},{"$f":"'V. Cloud Security'!M258","v":0},{"$f":"'V. Cloud Security'!AA258","v":0},{"$f":"'V. Cloud Security'!B258","v":"V.1.47.1"},{"$f":"'V. Cloud Security'!C258","v":"Admin access (shell or UI): Internally from within cloud provider network?"},{"$f":"'V. Cloud Security'!D258","v":0},{"$f":"'V. Cloud Security'!E258","v":0},{"$f":"'V. Cloud Security'!F258","v":0},{"$f":"'V. Cloud Security'!I258","v":0},{"$f":"'V. Cloud Security'!J258","v":"NA"},{"$f":"'V. Cloud Security'!K258","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB258","v":"WP.1.E.2, WP.1.H.6"}]
[{"$f":"'V. Cloud Security'!A259","v":3560},{"$f":"'V. Cloud Security'!L259","v":3},{"$f":"'V. Cloud Security'!M259","v":0},{"$f":"'V. Cloud Security'!AA259","v":0},{"$f":"'V. Cloud Security'!B259","v":"V.1.47.2"},{"$f":"'V. Cloud Security'!C259","v":"Non-Admin access (shell or UI): Internally from within cloud provider network?"},{"$f":"'V. Cloud Security'!D259","v":0},{"$f":"'V. Cloud Security'!E259","v":0},{"$f":"'V. Cloud Security'!F259","v":0},{"$f":"'V. Cloud Security'!I259","v":0},{"$f":"'V. Cloud Security'!J259","v":"NA"},{"$f":"'V. Cloud Security'!K259","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB259","v":"WP.1.E.2, WP.1.H.6"}]
[{"$f":"'V. Cloud Security'!A260","v":3561},{"$f":"'V. Cloud Security'!L260","v":3},{"$f":"'V. Cloud Security'!M260","v":0},{"$f":"'V. Cloud Security'!AA260","v":0},{"$f":"'V. Cloud Security'!B260","v":"V.1.47.3"},{"$f":"'V. Cloud Security'!C260","v":"Admin access (shell or UI): Remote access?"},{"$f":"'V. Cloud Security'!D260","v":0},{"$f":"'V. Cloud Security'!E260","v":0},{"$f":"'V. Cloud Security'!F260","v":0},{"$f":"'V. Cloud Security'!I260","v":0},{"$f":"'V. Cloud Security'!J260","v":"NA"},{"$f":"'V. Cloud Security'!K260","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB260","v":"WP.1.E.2, WP.1.H.6"}]
[{"$f":"'V. Cloud Security'!A261","v":3562},{"$f":"'V. Cloud Security'!L261","v":3},{"$f":"'V. Cloud Security'!M261","v":0},{"$f":"'V. Cloud Security'!AA261","v":0},{"$f":"'V. Cloud Security'!B261","v":"V.1.47.4"},{"$f":"'V. Cloud Security'!C261","v":"Non-admin access (shell or UI): remote access?"},{"$f":"'V. Cloud Security'!D261","v":0},{"$f":"'V. Cloud Security'!E261","v":0},{"$f":"'V. Cloud Security'!F261","v":0},{"$f":"'V. Cloud Security'!I261","v":0},{"$f":"'V. Cloud Security'!J261","v":"NA"},{"$f":"'V. Cloud Security'!K261","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB261","v":"WP.1.E.2, WP.1.H.6"}]
[{"$f":"'V. Cloud Security'!A262","v":3563},{"$f":"'V. Cloud Security'!L262","v":2},{"$f":"'V. Cloud Security'!M262","v":0},{"$f":"'V. Cloud Security'!AA262","v":1},{"$f":"'V. Cloud Security'!B262","v":"V.1.48"},{"$f":"'V. Cloud Security'!C262","v":"Are there controls to prevent one client attempting to compromise another client in a resource pooled environment? If yes, does that include:"},{"$f":"'V. Cloud Security'!D262","v":0},{"$f":"'V. Cloud Security'!E262","v":0},{"$f":"'V. Cloud Security'!F262","v":0},{"$f":"'V. Cloud Security'!I262","v":"H.3 Logical Access Authorization"},{"$f":"'V. Cloud Security'!J262","v":"12.4.1                                                      15.2.1"},{"$f":"'V. Cloud Security'!K262","v":"Event Logging,\nMonitoring and review of supplier services"},null,null,null,7.1,null,null,{"$f":"'V. Cloud Security'!AB262","v":"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A263","v":3564},{"$f":"'V. Cloud Security'!L263","v":3},{"$f":"'V. Cloud Security'!M263","v":0},{"$f":"'V. Cloud Security'!AA263","v":0},{"$f":"'V. Cloud Security'!B263","v":"V.1.48.1"},{"$f":"'V. Cloud Security'!C263","v":"Inbound/Outbound firewall?"},{"$f":"'V. Cloud Security'!D263","v":0},{"$f":"'V. Cloud Security'!E263","v":0},{"$f":"'V. Cloud Security'!F263","v":0},{"$f":"'V. Cloud Security'!I263","v":0},{"$f":"'V. Cloud Security'!J263","v":"12.4.1                                                      15.2.1"},{"$f":"'V. Cloud Security'!K263","v":"Event Logging,\nMonitoring and review of supplier services"},null,null,null,1.1000000000000001,null,null,{"$f":"'V. Cloud Security'!AB263","v":"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A264","v":3565},{"$f":"'V. Cloud Security'!L264","v":3},{"$f":"'V. Cloud Security'!M264","v":0},{"$f":"'V. Cloud Security'!AA264","v":0},{"$f":"'V. Cloud Security'!B264","v":"V.1.48.2"},{"$f":"'V. Cloud Security'!C264","v":"IPS?"},{"$f":"'V. Cloud Security'!D264","v":0},{"$f":"'V. Cloud Security'!E264","v":0},{"$f":"'V. Cloud Security'!F264","v":0},{"$f":"'V. Cloud Security'!I264","v":0},{"$f":"'V. Cloud Security'!J264","v":"12.4.1                                                      15.2.1"},{"$f":"'V. Cloud Security'!K264","v":"Event Logging,\nMonitoring and review of supplier services"},null,null,null,"1.2.1",null,null,{"$f":"'V. Cloud Security'!AB264","v":"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A265","v":3566},{"$f":"'V. Cloud Security'!L265","v":3},{"$f":"'V. Cloud Security'!M265","v":0},{"$f":"'V. Cloud Security'!AA265","v":0},{"$f":"'V. Cloud Security'!B265","v":"V.1.48.3"},{"$f":"'V. Cloud Security'!C265","v":"Real-time alerting?"},{"$f":"'V. Cloud Security'!D265","v":0},{"$f":"'V. Cloud Security'!E265","v":0},{"$f":"'V. Cloud Security'!F265","v":0},{"$f":"'V. Cloud Security'!I265","v":0},{"$f":"'V. Cloud Security'!J265","v":"12.4.1                                                      15.2.1"},{"$f":"'V. Cloud Security'!K265","v":"Event Logging,\nMonitoring and review of supplier services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB265","v":"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A266","v":3567},{"$f":"'V. Cloud Security'!L266","v":3},{"$f":"'V. Cloud Security'!M266","v":0},{"$f":"'V. Cloud Security'!AA266","v":0},{"$f":"'V. Cloud Security'!B266","v":"V.1.48.4"},{"$f":"'V. Cloud Security'!C266","v":"Real-time monitoring by cloud provider?"},{"$f":"'V. Cloud Security'!D266","v":0},{"$f":"'V. Cloud Security'!E266","v":0},{"$f":"'V. Cloud Security'!F266","v":0},{"$f":"'V. Cloud Security'!I266","v":0},{"$f":"'V. Cloud Security'!J266","v":"12.4.1                                                      15.2.1"},{"$f":"'V. Cloud Security'!K266","v":"Event Logging,\nMonitoring and review of supplier services"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB266","v":"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A267","v":3568},{"$f":"'V. Cloud Security'!L267","v":2},{"$f":"'V. Cloud Security'!M267","v":0},{"$f":"'V. Cloud Security'!AA267","v":1},{"$f":"'V. Cloud Security'!B267","v":"V.1.49"},{"$f":"'V. Cloud Security'!C267","v":"Is a default hardened base virtual image available to clients? If yes, does it include:"},{"$f":"'V. Cloud Security'!D267","v":0},{"$f":"'V. Cloud Security'!E267","v":0},{"$f":"'V. Cloud Security'!F267","v":0},{"$f":"'V. Cloud Security'!I267","v":"I.3 Secure System Hardening Standards"},{"$f":"'V. Cloud Security'!J267","v":"NA"},{"$f":"'V. Cloud Security'!K267","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB267","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A268","v":3569},{"$f":"'V. Cloud Security'!L268","v":3},{"$f":"'V. Cloud Security'!M268","v":0},{"$f":"'V. Cloud Security'!AA268","v":0},{"$f":"'V. Cloud Security'!B268","v":"V.1.49.1"},{"$f":"'V. Cloud Security'!C268","v":"Cloud providers default hardened Image?"},{"$f":"'V. Cloud Security'!D268","v":0},{"$f":"'V. Cloud Security'!E268","v":0},{"$f":"'V. Cloud Security'!F268","v":0},{"$f":"'V. Cloud Security'!I268","v":0},{"$f":"'V. Cloud Security'!J268","v":"NA"},{"$f":"'V. Cloud Security'!K268","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB268","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A269","v":3570},{"$f":"'V. Cloud Security'!L269","v":3},{"$f":"'V. Cloud Security'!M269","v":0},{"$f":"'V. Cloud Security'!AA269","v":0},{"$f":"'V. Cloud Security'!B269","v":"V.1.49.2"},{"$f":"'V. Cloud Security'!C269","v":"Client supplied default hardening Image?"},{"$f":"'V. Cloud Security'!D269","v":0},{"$f":"'V. Cloud Security'!E269","v":0},{"$f":"'V. Cloud Security'!F269","v":0},{"$f":"'V. Cloud Security'!I269","v":0},{"$f":"'V. Cloud Security'!J269","v":"NA"},{"$f":"'V. Cloud Security'!K269","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB269","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A270","v":3571},{"$f":"'V. Cloud Security'!L270","v":3},{"$f":"'V. Cloud Security'!M270","v":0},{"$f":"'V. Cloud Security'!AA270","v":0},{"$f":"'V. Cloud Security'!B270","v":"V.1.49.3"},{"$f":"'V. Cloud Security'!C270","v":"Center for Internet Security (CIS) hardening standard?"},{"$f":"'V. Cloud Security'!D270","v":0},{"$f":"'V. Cloud Security'!E270","v":0},{"$f":"'V. Cloud Security'!F270","v":0},{"$f":"'V. Cloud Security'!I270","v":0},{"$f":"'V. Cloud Security'!J270","v":"NA"},{"$f":"'V. Cloud Security'!K270","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB270","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A271","v":3572},{"$f":"'V. Cloud Security'!L271","v":3},{"$f":"'V. Cloud Security'!M271","v":0},{"$f":"'V. Cloud Security'!AA271","v":0},{"$f":"'V. Cloud Security'!B271","v":"V.1.49.4"},{"$f":"'V. Cloud Security'!C271","v":"National Institute of Standards and Technology (NIST) hardening standard?"},{"$f":"'V. Cloud Security'!D271","v":0},{"$f":"'V. Cloud Security'!E271","v":0},{"$f":"'V. Cloud Security'!F271","v":0},{"$f":"'V. Cloud Security'!I271","v":0},{"$f":"'V. Cloud Security'!J271","v":"NA"},{"$f":"'V. Cloud Security'!K271","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB271","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A272","v":3573},{"$f":"'V. Cloud Security'!L272","v":3},{"$f":"'V. Cloud Security'!M272","v":0},{"$f":"'V. Cloud Security'!AA272","v":0},{"$f":"'V. Cloud Security'!B272","v":"V.1.49.5"},{"$f":"'V. Cloud Security'!C272","v":"SANS hardening standard?"},{"$f":"'V. Cloud Security'!D272","v":0},{"$f":"'V. Cloud Security'!E272","v":0},{"$f":"'V. Cloud Security'!F272","v":0},{"$f":"'V. Cloud Security'!I272","v":0},{"$f":"'V. Cloud Security'!J272","v":"NA"},{"$f":"'V. Cloud Security'!K272","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB272","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A273","v":3574},{"$f":"'V. Cloud Security'!L273","v":3},{"$f":"'V. Cloud Security'!M273","v":0},{"$f":"'V. Cloud Security'!AA273","v":0},{"$f":"'V. Cloud Security'!B273","v":"V.1.49.6"},{"$f":"'V. Cloud Security'!C273","v":"Vendor hardening standard?"},{"$f":"'V. Cloud Security'!D273","v":0},{"$f":"'V. Cloud Security'!E273","v":0},{"$f":"'V. Cloud Security'!F273","v":0},{"$f":"'V. Cloud Security'!I273","v":0},{"$f":"'V. Cloud Security'!J273","v":"NA"},{"$f":"'V. Cloud Security'!K273","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB273","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A274","v":3575},{"$f":"'V. Cloud Security'!L274","v":3},{"$f":"'V. Cloud Security'!M274","v":0},{"$f":"'V. Cloud Security'!AA274","v":0},{"$f":"'V. Cloud Security'!B274","v":"V.1.49.7"},{"$f":"'V. Cloud Security'!C274","v":"Other?"},{"$f":"'V. Cloud Security'!D274","v":0},{"$f":"'V. Cloud Security'!E274","v":0},{"$f":"'V. Cloud Security'!F274","v":0},{"$f":"'V. Cloud Security'!I274","v":0},{"$f":"'V. Cloud Security'!J274","v":"NA"},{"$f":"'V. Cloud Security'!K274","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB274","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A275","v":3576},{"$f":"'V. Cloud Security'!L275","v":2},{"$f":"'V. Cloud Security'!M275","v":0},{"$f":"'V. Cloud Security'!AA275","v":0},{"$f":"'V. Cloud Security'!B275","v":"V.1.50"},{"$f":"'V. Cloud Security'!C275","v":"Are systems and applications patched? If yes, how:"},{"$f":"'V. Cloud Security'!D275","v":0},{"$f":"'V. Cloud Security'!E275","v":0},{"$f":"'V. Cloud Security'!F275","v":0},{"$f":"'V. Cloud Security'!I275","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J275","v":"12.6.1 "},{"$f":"'V. Cloud Security'!K275","v":"Management of technical vulnerabilities"},null,null,null,6.2]
[{"$f":"'V. Cloud Security'!A276","v":3577},{"$f":"'V. Cloud Security'!L276","v":3},{"$f":"'V. Cloud Security'!M276","v":0},{"$f":"'V. Cloud Security'!AA276","v":0},{"$f":"'V. Cloud Security'!B276","v":"V.1.50.1"},{"$f":"'V. Cloud Security'!C276","v":"Cloud provider: deploy to the live server?"},{"$f":"'V. Cloud Security'!D276","v":0},{"$f":"'V. Cloud Security'!E276","v":0},{"$f":"'V. Cloud Security'!F276","v":0},{"$f":"'V. Cloud Security'!I276","v":0},{"$f":"'V. Cloud Security'!J276","v":"NA"},{"$f":"'V. Cloud Security'!K276","v":0},null,null,null,6.2,null,null,{"$f":"'V. Cloud Security'!AB276","v":"WP.1.C.2, WP.1.C.3, WP.1.C.4, WP.1.F.4, WP.1.I.4, WP.1.I.6, WP.1.J.5"}]
[{"$f":"'V. Cloud Security'!A277","v":3578},{"$f":"'V. Cloud Security'!L277","v":3},{"$f":"'V. Cloud Security'!M277","v":0},{"$f":"'V. Cloud Security'!AA277","v":0},{"$f":"'V. Cloud Security'!B277","v":"V.1.50.2"},{"$f":"'V. Cloud Security'!C277","v":"Client: deploy to the live server?"},{"$f":"'V. Cloud Security'!D277","v":0},{"$f":"'V. Cloud Security'!E277","v":0},{"$f":"'V. Cloud Security'!F277","v":0},{"$f":"'V. Cloud Security'!I277","v":0},{"$f":"'V. Cloud Security'!J277","v":"NA"},{"$f":"'V. Cloud Security'!K277","v":0},null,null,null,6.2,null,null,{"$f":"'V. Cloud Security'!AB277","v":"WP.1.C.2, WP.1.C.3, WP.1.C.4, WP.1.F.4, WP.1.I.4, WP.1.I.6, WP.1.J.5"}]
[{"$f":"'V. Cloud Security'!A278","v":3579},{"$f":"'V. Cloud Security'!L278","v":3},{"$f":"'V. Cloud Security'!M278","v":0},{"$f":"'V. Cloud Security'!AA278","v":0},{"$f":"'V. Cloud Security'!B278","v":"V.1.50.3"},{"$f":"'V. Cloud Security'!C278","v":"Cloud provider: deploy to the base image?"},{"$f":"'V. Cloud Security'!D278","v":0},{"$f":"'V. Cloud Security'!E278","v":0},{"$f":"'V. Cloud Security'!F278","v":0},{"$f":"'V. Cloud Security'!I278","v":0},{"$f":"'V. Cloud Security'!J278","v":"NA"},{"$f":"'V. Cloud Security'!K278","v":0},null,null,null,6.2,null,null,{"$f":"'V. Cloud Security'!AB278","v":"WP.1.C.2, WP.1.C.3, WP.1.C.4, WP.1.F.4, WP.1.I.4, WP.1.I.6, WP.1.J.5"}]
[{"$f":"'V. Cloud Security'!A279","v":3580},{"$f":"'V. Cloud Security'!L279","v":3},{"$f":"'V. Cloud Security'!M279","v":0},{"$f":"'V. Cloud Security'!AA279","v":0},{"$f":"'V. Cloud Security'!B279","v":"V.1.50.4"},{"$f":"'V. Cloud Security'!C279","v":"Client: deploy to the base image?"},{"$f":"'V. Cloud Security'!D279","v":0},{"$f":"'V. Cloud Security'!E279","v":0},{"$f":"'V. Cloud Security'!F279","v":0},{"$f":"'V. Cloud Security'!I279","v":0},{"$f":"'V. Cloud Security'!J279","v":"NA"},{"$f":"'V. Cloud Security'!K279","v":0},null,null,null,6.2,null,null,{"$f":"'V. Cloud Security'!AB279","v":"WP.1.C.2, WP.1.C.3, WP.1.C.4, WP.1.F.4, WP.1.I.4, WP.1.I.6, WP.1.J.5"}]
[{"$f":"'V. Cloud Security'!A280","v":3581},{"$f":"'V. Cloud Security'!L280","v":3},{"$f":"'V. Cloud Security'!M280","v":0},{"$f":"'V. Cloud Security'!AA280","v":0},{"$f":"'V. Cloud Security'!B280","v":"V.1.50.5"},{"$f":"'V. Cloud Security'!C280","v":"Other?"},{"$f":"'V. Cloud Security'!D280","v":0},{"$f":"'V. Cloud Security'!E280","v":0},{"$f":"'V. Cloud Security'!F280","v":0},{"$f":"'V. Cloud Security'!I280","v":0},{"$f":"'V. Cloud Security'!J280","v":"NA"},{"$f":"'V. Cloud Security'!K280","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB280","v":"WP.1.C.2, WP.1.C.3, WP.1.C.4, WP.1.F.4, WP.1.I.4, WP.1.I.6, WP.1.J.5"}]
[{"$f":"'V. Cloud Security'!A281","v":3582},{"$f":"'V. Cloud Security'!L281","v":2},{"$f":"'V. Cloud Security'!M281","v":1},{"$f":"'V. Cloud Security'!AA281","v":0},{"$f":"'V. Cloud Security'!B281","v":"V.1.51"},{"$f":"'V. Cloud Security'!C281","v":"Which of the following are responsible for the base image and patching:"},{"$f":"'V. Cloud Security'!D281","v":0},{"$f":"'V. Cloud Security'!E281","v":0},{"$f":"'V. Cloud Security'!F281","v":0},{"$f":"'V. Cloud Security'!I281","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J281","v":"12.6.1 "},{"$f":"'V. Cloud Security'!K281","v":"Management of technical vulnerabilities"},null,null,null,6.2,null,null,{"$f":"'V. Cloud Security'!AB281","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A282","v":3583},{"$f":"'V. Cloud Security'!L282","v":3},{"$f":"'V. Cloud Security'!M282","v":0},{"$f":"'V. Cloud Security'!AA282","v":0},{"$f":"'V. Cloud Security'!B282","v":"V.1.51.1"},{"$f":"'V. Cloud Security'!C282","v":"Cloud provider: initial base image hardening and patching?"},{"$f":"'V. Cloud Security'!D282","v":0},{"$f":"'V. Cloud Security'!E282","v":0},{"$f":"'V. Cloud Security'!F282","v":0},{"$f":"'V. Cloud Security'!I282","v":0},{"$f":"'V. Cloud Security'!J282","v":"NA"},{"$f":"'V. Cloud Security'!K282","v":0},null,null,null,6.2,null,null,{"$f":"'V. Cloud Security'!AB282","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A283","v":3584},{"$f":"'V. Cloud Security'!L283","v":3},{"$f":"'V. Cloud Security'!M283","v":0},{"$f":"'V. Cloud Security'!AA283","v":0},{"$f":"'V. Cloud Security'!B283","v":"V.1.51.2"},{"$f":"'V. Cloud Security'!C283","v":"Client: Initial base image hardening and patching?"},{"$f":"'V. Cloud Security'!D283","v":0},{"$f":"'V. Cloud Security'!E283","v":0},{"$f":"'V. Cloud Security'!F283","v":0},{"$f":"'V. Cloud Security'!I283","v":0},{"$f":"'V. Cloud Security'!J283","v":"NA"},{"$f":"'V. Cloud Security'!K283","v":0},null,null,null,6.2,null,null,{"$f":"'V. Cloud Security'!AB283","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A284","v":3585},{"$f":"'V. Cloud Security'!L284","v":3},{"$f":"'V. Cloud Security'!M284","v":0},{"$f":"'V. Cloud Security'!AA284","v":0},{"$f":"'V. Cloud Security'!B284","v":"V.1.51.3"},{"$f":"'V. Cloud Security'!C284","v":"Cloud provider: ongoing hardening and patching?"},{"$f":"'V. Cloud Security'!D284","v":0},{"$f":"'V. Cloud Security'!E284","v":0},{"$f":"'V. Cloud Security'!F284","v":0},{"$f":"'V. Cloud Security'!I284","v":0},{"$f":"'V. Cloud Security'!J284","v":"NA"},{"$f":"'V. Cloud Security'!K284","v":0},null,null,null,6.2,null,null,{"$f":"'V. Cloud Security'!AB284","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A285","v":3586},{"$f":"'V. Cloud Security'!L285","v":3},{"$f":"'V. Cloud Security'!M285","v":0},{"$f":"'V. Cloud Security'!AA285","v":0},{"$f":"'V. Cloud Security'!B285","v":"V.1.51.4"},{"$f":"'V. Cloud Security'!C285","v":"Client: ongoing hardening and patching?"},{"$f":"'V. Cloud Security'!D285","v":0},{"$f":"'V. Cloud Security'!E285","v":0},{"$f":"'V. Cloud Security'!F285","v":0},{"$f":"'V. Cloud Security'!I285","v":0},{"$f":"'V. Cloud Security'!J285","v":"NA"},{"$f":"'V. Cloud Security'!K285","v":0},null,null,null,6.2,null,null,{"$f":"'V. Cloud Security'!AB285","v":"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A286","v":3587},{"$f":"'V. Cloud Security'!L286","v":2},{"$f":"'V. Cloud Security'!M286","v":0},{"$f":"'V. Cloud Security'!AA286","v":0},{"$f":"'V. Cloud Security'!B286","v":"V.1.52"},{"$f":"'V. Cloud Security'!C286","v":"Can image versions be electronically signed to insure integrity? If yes, who would perform:"},{"$f":"'V. Cloud Security'!D286","v":0},{"$f":"'V. Cloud Security'!E286","v":0},{"$f":"'V. Cloud Security'!F286","v":0},{"$f":"'V. Cloud Security'!I286","v":0},{"$f":"'V. Cloud Security'!J286","v":"14.2.2                                                     14.2.4"},{"$f":"'V. Cloud Security'!K286","v":"System change control procedures,                                Restrictions on changes to software packages"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB286","v":"WP.1.D.1, WP.1.D.2, WP.1.D.3, WP.1.J.4, WP.1.J.5, WP.1.F4"}]
[{"$f":"'V. Cloud Security'!A287","v":3588},{"$f":"'V. Cloud Security'!L287","v":3},{"$f":"'V. Cloud Security'!M287","v":0},{"$f":"'V. Cloud Security'!AA287","v":0},{"$f":"'V. Cloud Security'!B287","v":"V.1.52.1"},{"$f":"'V. Cloud Security'!C287","v":"Cloud provider?"},{"$f":"'V. Cloud Security'!D287","v":0},{"$f":"'V. Cloud Security'!E287","v":0},{"$f":"'V. Cloud Security'!F287","v":0},{"$f":"'V. Cloud Security'!I287","v":0},{"$f":"'V. Cloud Security'!J287","v":"NA"},{"$f":"'V. Cloud Security'!K287","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB287","v":"WP.1.D.1, WP.1.D.2, WP.1.D.3, WP.1.J.4, WP.1.J.5, WP.1.F4"}]
[{"$f":"'V. Cloud Security'!A288","v":3589},{"$f":"'V. Cloud Security'!L288","v":3},{"$f":"'V. Cloud Security'!M288","v":0},{"$f":"'V. Cloud Security'!AA288","v":0},{"$f":"'V. Cloud Security'!B288","v":"V.1.52.2"},{"$f":"'V. Cloud Security'!C288","v":"Client?"},{"$f":"'V. Cloud Security'!D288","v":0},{"$f":"'V. Cloud Security'!E288","v":0},{"$f":"'V. Cloud Security'!F288","v":0},{"$f":"'V. Cloud Security'!I288","v":0},{"$f":"'V. Cloud Security'!J288","v":"NA"},{"$f":"'V. Cloud Security'!K288","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB288","v":"WP.1.D.1, WP.1.D.2, WP.1.D.3, WP.1.J.4, WP.1.J.5, WP.1.F4"}]
[{"$f":"'V. Cloud Security'!A289","v":3590},{"$f":"'V. Cloud Security'!L289","v":2},{"$f":"'V. Cloud Security'!M289","v":0},{"$f":"'V. Cloud Security'!AA289","v":1},{"$f":"'V. Cloud Security'!B289","v":"V.1.53"},{"$f":"'V. Cloud Security'!C289","v":"Can clients run their own security services within their own cloud environment? If yes, can it include:"},{"$f":"'V. Cloud Security'!D289","v":0},{"$f":"'V. Cloud Security'!E289","v":0},{"$f":"'V. Cloud Security'!F289","v":0},{"$f":"'V. Cloud Security'!I289","v":"V.3 Cloud Audit Program"},{"$f":"'V. Cloud Security'!J289","v":"12.4.1                                                     12.4.3                                                 12.5                                                12.6.1 "},{"$f":"'V. Cloud Security'!K289","v":"Event logging,                           Administrator and operator logs,                                     Control of operational software,                   Management of technical vulnerabilities"},null,null,null,"5.1, 5.2",null,null,{"$f":"'V. Cloud Security'!AB289","v":"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6"}]
[{"$f":"'V. Cloud Security'!A290","v":3591},{"$f":"'V. Cloud Security'!L290","v":3},{"$f":"'V. Cloud Security'!M290","v":0},{"$f":"'V. Cloud Security'!AA290","v":0},{"$f":"'V. Cloud Security'!B290","v":"V.1.53.1"},{"$f":"'V. Cloud Security'!C290","v":"Firewall?"},{"$f":"'V. Cloud Security'!D290","v":0},{"$f":"'V. Cloud Security'!E290","v":0},{"$f":"'V. Cloud Security'!F290","v":0},{"$f":"'V. Cloud Security'!I290","v":0},{"$f":"'V. Cloud Security'!J290","v":"NA"},{"$f":"'V. Cloud Security'!K290","v":0},null,null,null,"5.1, 5.2",null,null,{"$f":"'V. Cloud Security'!AB290","v":"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6"}]
[{"$f":"'V. Cloud Security'!A291","v":3592},{"$f":"'V. Cloud Security'!L291","v":3},{"$f":"'V. Cloud Security'!M291","v":0},{"$f":"'V. Cloud Security'!AA291","v":0},{"$f":"'V. Cloud Security'!B291","v":"V.1.53.2"},{"$f":"'V. Cloud Security'!C291","v":"IDS/IPS?"},{"$f":"'V. Cloud Security'!D291","v":0},{"$f":"'V. Cloud Security'!E291","v":0},{"$f":"'V. Cloud Security'!F291","v":0},{"$f":"'V. Cloud Security'!I291","v":0},{"$f":"'V. Cloud Security'!J291","v":"NA"},{"$f":"'V. Cloud Security'!K291","v":0},null,null,null,"5.1, 5.2",null,null,{"$f":"'V. Cloud Security'!AB291","v":"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6"}]
[{"$f":"'V. Cloud Security'!A292","v":3593},{"$f":"'V. Cloud Security'!L292","v":3},{"$f":"'V. Cloud Security'!M292","v":0},{"$f":"'V. Cloud Security'!AA292","v":0},{"$f":"'V. Cloud Security'!B292","v":"V.1.53.3"},{"$f":"'V. Cloud Security'!C292","v":"Data integrity monitoring (host based Integrity)?"},{"$f":"'V. Cloud Security'!D292","v":0},{"$f":"'V. Cloud Security'!E292","v":0},{"$f":"'V. Cloud Security'!F292","v":0},{"$f":"'V. Cloud Security'!I292","v":0},{"$f":"'V. Cloud Security'!J292","v":"NA"},{"$f":"'V. Cloud Security'!K292","v":0},null,null,null,3.7,null,null,{"$f":"'V. Cloud Security'!AB292","v":"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6"}]
[{"$f":"'V. Cloud Security'!A293","v":3594},{"$f":"'V. Cloud Security'!L293","v":3},{"$f":"'V. Cloud Security'!M293","v":0},{"$f":"'V. Cloud Security'!AA293","v":0},{"$f":"'V. Cloud Security'!B293","v":"V.1.53.4"},{"$f":"'V. Cloud Security'!C293","v":"Anti virus?"},{"$f":"'V. Cloud Security'!D293","v":0},{"$f":"'V. Cloud Security'!E293","v":0},{"$f":"'V. Cloud Security'!F293","v":0},{"$f":"'V. Cloud Security'!I293","v":0},{"$f":"'V. Cloud Security'!J293","v":"NA"},{"$f":"'V. Cloud Security'!K293","v":0},null,null,null,"5.1, 5.2",null,null,{"$f":"'V. Cloud Security'!AB293","v":"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6"}]
[{"$f":"'V. Cloud Security'!A294","v":3595},{"$f":"'V. Cloud Security'!L294","v":3},{"$f":"'V. Cloud Security'!M294","v":0},{"$f":"'V. Cloud Security'!AA294","v":0},{"$f":"'V. Cloud Security'!B294","v":"V.1.53.5"},{"$f":"'V. Cloud Security'!C294","v":"Other (please specify)?"},{"$f":"'V. Cloud Security'!D294","v":0},{"$f":"'V. Cloud Security'!E294","v":0},{"$f":"'V. Cloud Security'!F294","v":0},{"$f":"'V. Cloud Security'!I294","v":0},{"$f":"'V. Cloud Security'!J294","v":"NA"},{"$f":"'V. Cloud Security'!K294","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB294","v":"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6"}]
[{"$f":"'V. Cloud Security'!A295","v":3596},{"$f":"'V. Cloud Security'!L295","v":2},{"$f":"'V. Cloud Security'!M295","v":0},{"$f":"'V. Cloud Security'!AA295","v":0},{"$f":"'V. Cloud Security'!B295","v":"V.1.54"},{"$f":"'V. Cloud Security'!C295","v":"Is 24x7x365 security monitoring performed? If yes, does it include:"},{"$f":"'V. Cloud Security'!D295","v":0},{"$f":"'V. Cloud Security'!E295","v":0},{"$f":"'V. Cloud Security'!F295","v":0},{"$f":"'V. Cloud Security'!I295","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J295","v":"12.4.1                                                     12.4.3                                                 12.5                                                12.6.1 "},{"$f":"'V. Cloud Security'!K295","v":"Event logging,                           Administrator and operator logs,                                     Control of operational software,                   Management of technical vulnerabilities"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB295","v":"WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A296","v":3597},{"$f":"'V. Cloud Security'!L296","v":3},{"$f":"'V. Cloud Security'!M296","v":0},{"$f":"'V. Cloud Security'!AA296","v":0},{"$f":"'V. Cloud Security'!B296","v":"V.1.54.1"},{"$f":"'V. Cloud Security'!C296","v":"Inbound: Internet to cloud platform (client)?"},{"$f":"'V. Cloud Security'!D296","v":0},{"$f":"'V. Cloud Security'!E296","v":0},{"$f":"'V. Cloud Security'!F296","v":0},{"$f":"'V. Cloud Security'!I296","v":0},{"$f":"'V. Cloud Security'!J296","v":"NA"},{"$f":"'V. Cloud Security'!K296","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB296","v":"WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A297","v":3598},{"$f":"'V. Cloud Security'!L297","v":3},{"$f":"'V. Cloud Security'!M297","v":0},{"$f":"'V. Cloud Security'!AA297","v":0},{"$f":"'V. Cloud Security'!B297","v":"V.1.54.2"},{"$f":"'V. Cloud Security'!C297","v":"Outbound: Cloud platform (client) to internet?"},{"$f":"'V. Cloud Security'!D297","v":0},{"$f":"'V. Cloud Security'!E297","v":0},{"$f":"'V. Cloud Security'!F297","v":0},{"$f":"'V. Cloud Security'!I297","v":0},{"$f":"'V. Cloud Security'!J297","v":"NA"},{"$f":"'V. Cloud Security'!K297","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB297","v":"WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A298","v":3599},{"$f":"'V. Cloud Security'!L298","v":3},{"$f":"'V. Cloud Security'!M298","v":0},{"$f":"'V. Cloud Security'!AA298","v":0},{"$f":"'V. Cloud Security'!B298","v":"V.1.54.3"},{"$f":"'V. Cloud Security'!C298","v":"Internal: Cloud staff environment to cloud platform (client)?"},{"$f":"'V. Cloud Security'!D298","v":0},{"$f":"'V. Cloud Security'!E298","v":0},{"$f":"'V. Cloud Security'!F298","v":0},{"$f":"'V. Cloud Security'!I298","v":0},{"$f":"'V. Cloud Security'!J298","v":"NA"},{"$f":"'V. Cloud Security'!K298","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB298","v":"WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A299","v":3600},{"$f":"'V. Cloud Security'!L299","v":3},{"$f":"'V. Cloud Security'!M299","v":0},{"$f":"'V. Cloud Security'!AA299","v":0},{"$f":"'V. Cloud Security'!B299","v":"V.1.54.4"},{"$f":"'V. Cloud Security'!C299","v":"Internal: Cloud platform (client) to cloud staff environment?"},{"$f":"'V. Cloud Security'!D299","v":0},{"$f":"'V. Cloud Security'!E299","v":0},{"$f":"'V. Cloud Security'!F299","v":0},{"$f":"'V. Cloud Security'!I299","v":0},{"$f":"'V. Cloud Security'!J299","v":"NA"},{"$f":"'V. Cloud Security'!K299","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB299","v":"WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A300","v":3601},{"$f":"'V. Cloud Security'!L300","v":3},{"$f":"'V. Cloud Security'!M300","v":0},{"$f":"'V. Cloud Security'!AA300","v":0},{"$f":"'V. Cloud Security'!B300","v":"V.1.54.5"},{"$f":"'V. Cloud Security'!C300","v":"Internal: Cloud platform (client) to cloud platform (client)?"},{"$f":"'V. Cloud Security'!D300","v":0},{"$f":"'V. Cloud Security'!E300","v":0},{"$f":"'V. Cloud Security'!F300","v":0},{"$f":"'V. Cloud Security'!I300","v":0},{"$f":"'V. Cloud Security'!J300","v":"NA"},{"$f":"'V. Cloud Security'!K300","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB300","v":"WP.1.I.2"}]
[{"$f":"'V. Cloud Security'!A301","v":3602},{"$f":"'V. Cloud Security'!L301","v":2},{"$f":"'V. Cloud Security'!M301","v":0},{"$f":"'V. Cloud Security'!AA301","v":1},{"$f":"'V. Cloud Security'!B301","v":"V.1.55"},{"$f":"'V. Cloud Security'!C301","v":"Is there a specific Recovery Time Objective (RTO)? If yes, specify."},{"$f":"'V. Cloud Security'!D301","v":0},{"$f":"'V. Cloud Security'!E301","v":0},{"$f":"'V. Cloud Security'!F301","v":0},{"$f":"'V. Cloud Security'!I301","v":0},{"$f":"'V. Cloud Security'!J301","v":"17.1.2"},{"$f":"'V. Cloud Security'!K301","v":"Implementing information security continuity"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB301","v":"WP.1.K.10"}]
[{"$f":"'V. Cloud Security'!A302","v":3603},{"$f":"'V. Cloud Security'!L302","v":2},{"$f":"'V. Cloud Security'!M302","v":0},{"$f":"'V. Cloud Security'!AA302","v":0},{"$f":"'V. Cloud Security'!B302","v":"V.1.56"},{"$f":"'V. Cloud Security'!C302","v":"Is there a specific Recovery Point Objective (RPO)? If yes, specify."},{"$f":"'V. Cloud Security'!D302","v":0},{"$f":"'V. Cloud Security'!E302","v":0},{"$f":"'V. Cloud Security'!F302","v":0},{"$f":"'V. Cloud Security'!I302","v":0},{"$f":"'V. Cloud Security'!J302","v":"17.1.2"},{"$f":"'V. Cloud Security'!K302","v":"Implementing information security continuity"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB302","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A303","v":3604},{"$f":"'V. Cloud Security'!L303","v":2},{"$f":"'V. Cloud Security'!M303","v":0},{"$f":"'V. Cloud Security'!AA303","v":0},{"$f":"'V. Cloud Security'!B303","v":"V.1.57"},{"$f":"'V. Cloud Security'!C303","v":"Are any critical vendors necessary to provide the scoped services to clients?"},{"$f":"'V. Cloud Security'!D303","v":0},{"$f":"'V. Cloud Security'!E303","v":0},{"$f":"'V. Cloud Security'!F303","v":0},{"$f":"'V. Cloud Security'!I303","v":"V.2 Nested Service Provider Relationships"},{"$f":"'V. Cloud Security'!J303","v":"17.1.2                                                     17.2.1"},{"$f":"'V. Cloud Security'!K303","v":"Implementing information security continuity \nAvailability of information processing facilities"},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A304","v":3605},{"$f":"'V. Cloud Security'!L304","v":3},{"$f":"'V. Cloud Security'!M304","v":0},{"$f":"'V. Cloud Security'!AA304","v":0},{"$f":"'V. Cloud Security'!B304","v":"V.1.57.1"},{"$f":"'V. Cloud Security'!C304","v":"Is a critical vendor dependency chart made available to clients?"},{"$f":"'V. Cloud Security'!D304","v":0},{"$f":"'V. Cloud Security'!E304","v":0},{"$f":"'V. Cloud Security'!F304","v":0},{"$f":"'V. Cloud Security'!I304","v":"V.2 Nested Service Provider Relationships"},{"$f":"'V. Cloud Security'!J304","v":"17.1.2                                                     17.2.1"},{"$f":"'V. Cloud Security'!K304","v":"Implementing information security continuity \nAvailability of information processing facilities"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB304","v":"WP.1.K.7"}]
[{"$f":"'V. Cloud Security'!A305","v":3606},{"$f":"'V. Cloud Security'!L305","v":3},{"$f":"'V. Cloud Security'!M305","v":0},{"$f":"'V. Cloud Security'!AA305","v":0},{"$f":"'V. Cloud Security'!B305","v":"V.1.57.2"},{"$f":"'V. Cloud Security'!C305","v":"Are each of the vendors identified in the vendor dependency chart subjected to at least an annual disaster recovery test for service provided? If yes, is the test:"},{"$f":"'V. Cloud Security'!D305","v":0},{"$f":"'V. Cloud Security'!E305","v":0},{"$f":"'V. Cloud Security'!F305","v":0},{"$f":"'V. Cloud Security'!I305","v":"V.2 Nested Service Provider Relationships"},{"$f":"'V. Cloud Security'!J305","v":"17.1.2                                                     17.2.1"},{"$f":"'V. Cloud Security'!K305","v":"Implementing information security continuity \nAvailability of information processing facilities"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB305","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A306","v":3607},{"$f":"'V. Cloud Security'!L306","v":4},{"$f":"'V. Cloud Security'!M306","v":0},{"$f":"'V. Cloud Security'!AA306","v":0},{"$f":"'V. Cloud Security'!B306","v":"V.1.57.2.1"},{"$f":"'V. Cloud Security'!C306","v":"Table top?"},{"$f":"'V. Cloud Security'!D306","v":0},{"$f":"'V. Cloud Security'!E306","v":0},{"$f":"'V. Cloud Security'!F306","v":0},{"$f":"'V. Cloud Security'!I306","v":0},{"$f":"'V. Cloud Security'!J306","v":"NA"},{"$f":"'V. Cloud Security'!K306","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB306","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A307","v":3608},{"$f":"'V. Cloud Security'!L307","v":4},{"$f":"'V. Cloud Security'!M307","v":0},{"$f":"'V. Cloud Security'!AA307","v":0},{"$f":"'V. Cloud Security'!B307","v":"V.1.57.2.2"},{"$f":"'V. Cloud Security'!C307","v":"Simulated test?"},{"$f":"'V. Cloud Security'!D307","v":0},{"$f":"'V. Cloud Security'!E307","v":0},{"$f":"'V. Cloud Security'!F307","v":0},{"$f":"'V. Cloud Security'!I307","v":0},{"$f":"'V. Cloud Security'!J307","v":"NA"},{"$f":"'V. Cloud Security'!K307","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB307","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A308","v":3609},{"$f":"'V. Cloud Security'!L308","v":4},{"$f":"'V. Cloud Security'!M308","v":0},{"$f":"'V. Cloud Security'!AA308","v":0},{"$f":"'V. Cloud Security'!B308","v":"V.1.57.2.3"},{"$f":"'V. Cloud Security'!C308","v":"Functional test?"},{"$f":"'V. Cloud Security'!D308","v":0},{"$f":"'V. Cloud Security'!E308","v":0},{"$f":"'V. Cloud Security'!F308","v":0},{"$f":"'V. Cloud Security'!I308","v":0},{"$f":"'V. Cloud Security'!J308","v":"NA"},{"$f":"'V. Cloud Security'!K308","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB308","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A309","v":3610},{"$f":"'V. Cloud Security'!L309","v":4},{"$f":"'V. Cloud Security'!M309","v":0},{"$f":"'V. Cloud Security'!AA309","v":0},{"$f":"'V. Cloud Security'!B309","v":"V.1.57.2.4"},{"$f":"'V. Cloud Security'!C309","v":"Full scale failover?"},{"$f":"'V. Cloud Security'!D309","v":0},{"$f":"'V. Cloud Security'!E309","v":0},{"$f":"'V. Cloud Security'!F309","v":0},{"$f":"'V. Cloud Security'!I309","v":0},{"$f":"'V. Cloud Security'!J309","v":"NA"},{"$f":"'V. Cloud Security'!K309","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB309","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A310","v":3611},{"$f":"'V. Cloud Security'!L310","v":2},{"$f":"'V. Cloud Security'!M310","v":1},{"$f":"'V. Cloud Security'!AA310","v":0},{"$f":"'V. Cloud Security'!B310","v":"V.1.58"},{"$f":"'V. Cloud Security'!C310","v":"How many different critical vendors is the live cloud platform running on at any given time:"},{"$f":"'V. Cloud Security'!D310","v":0},{"$f":"'V. Cloud Security'!E310","v":0},{"$f":"'V. Cloud Security'!F310","v":0},{"$f":"'V. Cloud Security'!I310","v":"V.2 Nested Service Provider Relationships"},{"$f":"'V. Cloud Security'!J310","v":"17.1.3"},{"$f":"'V. Cloud Security'!K310","v":"Verify, review and evaluate information security continuity"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB310","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A311","v":3612},{"$f":"'V. Cloud Security'!L311","v":3},{"$f":"'V. Cloud Security'!M311","v":0},{"$f":"'V. Cloud Security'!AA311","v":0},{"$f":"'V. Cloud Security'!B311","v":"V.1.58.1"},{"$f":"'V. Cloud Security'!C311","v":"1?"},{"$f":"'V. Cloud Security'!D311","v":0},{"$f":"'V. Cloud Security'!E311","v":0},{"$f":"'V. Cloud Security'!F311","v":0},{"$f":"'V. Cloud Security'!I311","v":0},{"$f":"'V. Cloud Security'!J311","v":"NA"},{"$f":"'V. Cloud Security'!K311","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB311","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A312","v":3613},{"$f":"'V. Cloud Security'!L312","v":3},{"$f":"'V. Cloud Security'!M312","v":0},{"$f":"'V. Cloud Security'!AA312","v":0},{"$f":"'V. Cloud Security'!B312","v":"V.1.58.2"},{"$f":"'V. Cloud Security'!C312","v":">1 <2?"},{"$f":"'V. Cloud Security'!D312","v":0},{"$f":"'V. Cloud Security'!E312","v":0},{"$f":"'V. Cloud Security'!F312","v":0},{"$f":"'V. Cloud Security'!I312","v":0},{"$f":"'V. Cloud Security'!J312","v":"NA"},{"$f":"'V. Cloud Security'!K312","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB312","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A313","v":3614},{"$f":"'V. Cloud Security'!L313","v":3},{"$f":"'V. Cloud Security'!M313","v":0},{"$f":"'V. Cloud Security'!AA313","v":0},{"$f":"'V. Cloud Security'!B313","v":"V.1.58.3"},{"$f":"'V. Cloud Security'!C313","v":"> 2?"},{"$f":"'V. Cloud Security'!D313","v":0},{"$f":"'V. Cloud Security'!E313","v":0},{"$f":"'V. Cloud Security'!F313","v":0},{"$f":"'V. Cloud Security'!I313","v":0},{"$f":"'V. Cloud Security'!J313","v":"NA"},{"$f":"'V. Cloud Security'!K313","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB313","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A314","v":3615},{"$f":"'V. Cloud Security'!L314","v":2},{"$f":"'V. Cloud Security'!M314","v":1},{"$f":"'V. Cloud Security'!AA314","v":0},{"$f":"'V. Cloud Security'!B314","v":"V.1.59"},{"$f":"'V. Cloud Security'!C314","v":"How many separate data center(s) is the live cloud platform running in at any one time:"},{"$f":"'V. Cloud Security'!D314","v":0},{"$f":"'V. Cloud Security'!E314","v":0},{"$f":"'V. Cloud Security'!F314","v":0},{"$f":"'V. Cloud Security'!I314","v":0},{"$f":"'V. Cloud Security'!J314","v":"17.1.3"},{"$f":"'V. Cloud Security'!K314","v":"Verify, review and evaluate information security continuity"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB314","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A315","v":3616},{"$f":"'V. Cloud Security'!L315","v":3},{"$f":"'V. Cloud Security'!M315","v":0},{"$f":"'V. Cloud Security'!AA315","v":0},{"$f":"'V. Cloud Security'!B315","v":"V.1.59.1"},{"$f":"'V. Cloud Security'!C315","v":"1?"},{"$f":"'V. Cloud Security'!D315","v":0},{"$f":"'V. Cloud Security'!E315","v":0},{"$f":"'V. Cloud Security'!F315","v":0},{"$f":"'V. Cloud Security'!I315","v":0},{"$f":"'V. Cloud Security'!J315","v":"NA"},{"$f":"'V. Cloud Security'!K315","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB315","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A316","v":3617},{"$f":"'V. Cloud Security'!L316","v":3},{"$f":"'V. Cloud Security'!M316","v":0},{"$f":"'V. Cloud Security'!AA316","v":0},{"$f":"'V. Cloud Security'!B316","v":"V.1.59.2"},{"$f":"'V. Cloud Security'!C316","v":">1 <2?"},{"$f":"'V. Cloud Security'!D316","v":0},{"$f":"'V. Cloud Security'!E316","v":0},{"$f":"'V. Cloud Security'!F316","v":0},{"$f":"'V. Cloud Security'!I316","v":0},{"$f":"'V. Cloud Security'!J316","v":"NA"},{"$f":"'V. Cloud Security'!K316","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB316","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A317","v":3618},{"$f":"'V. Cloud Security'!L317","v":3},{"$f":"'V. Cloud Security'!M317","v":0},{"$f":"'V. Cloud Security'!AA317","v":0},{"$f":"'V. Cloud Security'!B317","v":"V.1.59.3"},{"$f":"'V. Cloud Security'!C317","v":"> 2?"},{"$f":"'V. Cloud Security'!D317","v":0},{"$f":"'V. Cloud Security'!E317","v":0},{"$f":"'V. Cloud Security'!F317","v":0},{"$f":"'V. Cloud Security'!I317","v":0},{"$f":"'V. Cloud Security'!J317","v":"NA"},{"$f":"'V. Cloud Security'!K317","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB317","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A318","v":3619},{"$f":"'V. Cloud Security'!L318","v":2},{"$f":"'V. Cloud Security'!M318","v":1},{"$f":"'V. Cloud Security'!AA318","v":0},{"$f":"'V. Cloud Security'!B318","v":"V.1.60"},{"$f":"'V. Cloud Security'!C318","v":"Which availability mode is the critical cloud infrastructure running:"},{"$f":"'V. Cloud Security'!D318","v":0},{"$f":"'V. Cloud Security'!E318","v":0},{"$f":"'V. Cloud Security'!F318","v":0},{"$f":"'V. Cloud Security'!I318","v":0},{"$f":"'V. Cloud Security'!J318","v":"17.1.3"},{"$f":"'V. Cloud Security'!K318","v":"Verify, review and evaluate information security continuity"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB318","v":"WP.1.K.7"}]
[{"$f":"'V. Cloud Security'!A319","v":3620},{"$f":"'V. Cloud Security'!L319","v":3},{"$f":"'V. Cloud Security'!M319","v":0},{"$f":"'V. Cloud Security'!AA319","v":0},{"$f":"'V. Cloud Security'!B319","v":"V.1.60.1"},{"$f":"'V. Cloud Security'!C319","v":"Cold standby?"},{"$f":"'V. Cloud Security'!D319","v":0},{"$f":"'V. Cloud Security'!E319","v":0},{"$f":"'V. Cloud Security'!F319","v":0},{"$f":"'V. Cloud Security'!I319","v":0},{"$f":"'V. Cloud Security'!J319","v":"NA"},{"$f":"'V. Cloud Security'!K319","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB319","v":"WP.1.K.7"}]
[{"$f":"'V. Cloud Security'!A320","v":3621},{"$f":"'V. Cloud Security'!L320","v":3},{"$f":"'V. Cloud Security'!M320","v":0},{"$f":"'V. Cloud Security'!AA320","v":0},{"$f":"'V. Cloud Security'!B320","v":"V.1.60.2"},{"$f":"'V. Cloud Security'!C320","v":"Warm standby?"},{"$f":"'V. Cloud Security'!D320","v":0},{"$f":"'V. Cloud Security'!E320","v":0},{"$f":"'V. Cloud Security'!F320","v":0},{"$f":"'V. Cloud Security'!I320","v":0},{"$f":"'V. Cloud Security'!J320","v":"NA"},{"$f":"'V. Cloud Security'!K320","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB320","v":"WP.1.K.7"}]
[{"$f":"'V. Cloud Security'!A321","v":3622},{"$f":"'V. Cloud Security'!L321","v":3},{"$f":"'V. Cloud Security'!M321","v":0},{"$f":"'V. Cloud Security'!AA321","v":0},{"$f":"'V. Cloud Security'!B321","v":"V.1.60.3"},{"$f":"'V. Cloud Security'!C321","v":"Active, Active?"},{"$f":"'V. Cloud Security'!D321","v":0},{"$f":"'V. Cloud Security'!E321","v":0},{"$f":"'V. Cloud Security'!F321","v":0},{"$f":"'V. Cloud Security'!I321","v":0},{"$f":"'V. Cloud Security'!J321","v":"NA"},{"$f":"'V. Cloud Security'!K321","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB321","v":"WP.1.K.7"}]
[{"$f":"'V. Cloud Security'!A322","v":3623},{"$f":"'V. Cloud Security'!L322","v":2},{"$f":"'V. Cloud Security'!M322","v":0},{"$f":"'V. Cloud Security'!AA322","v":1},{"$f":"'V. Cloud Security'!B322","v":"V.1.61"},{"$f":"'V. Cloud Security'!C322","v":"Are the failover sites for the underlying infrastructure running on the same vendor physical systems?"},{"$f":"'V. Cloud Security'!D322","v":0},{"$f":"'V. Cloud Security'!E322","v":0},{"$f":"'V. Cloud Security'!F322","v":0},{"$f":"'V. Cloud Security'!I322","v":0},{"$f":"'V. Cloud Security'!J322","v":"17.1.3"},{"$f":"'V. Cloud Security'!K322","v":"Verify, review and evaluate information security continuity"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB322","v":"WP.1.K.12"}]
[{"$f":"'V. Cloud Security'!A323","v":3734},{"$f":"'V. Cloud Security'!L323","v":2},{"$f":"'V. Cloud Security'!M323","v":0},{"$f":"'V. Cloud Security'!AA323","v":0},{"$f":"'V. Cloud Security'!B323","v":"V.1.62"},{"$f":"'V. Cloud Security'!C323","v":"Are the failover sites for the underlying infrastructure running on different vendor physical systems?"},{"$f":"'V. Cloud Security'!D323","v":0},{"$f":"'V. Cloud Security'!E323","v":0},{"$f":"'V. Cloud Security'!F323","v":0},{"$f":"'V. Cloud Security'!I323","v":0},{"$f":"'V. Cloud Security'!J323","v":"17.1.3"},{"$f":"'V. Cloud Security'!K323","v":"Verify, review and evaluate information security continuity"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB323","v":"WP.1.K.12"}]
[{"$f":"'V. Cloud Security'!A324","v":3624},{"$f":"'V. Cloud Security'!L324","v":2},{"$f":"'V. Cloud Security'!M324","v":0},{"$f":"'V. Cloud Security'!AA324","v":1},{"$f":"'V. Cloud Security'!B324","v":"V.1.63"},{"$f":"'V. Cloud Security'!C324","v":"Is the critical infrastructure running active/active at two or more sites?"},{"$f":"'V. Cloud Security'!D324","v":0},{"$f":"'V. Cloud Security'!E324","v":0},{"$f":"'V. Cloud Security'!F324","v":0},{"$f":"'V. Cloud Security'!I324","v":0},{"$f":"'V. Cloud Security'!J324","v":"17.1.3"},{"$f":"'V. Cloud Security'!K324","v":"Verify, review and evaluate information security continuity"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB324","v":"WP.1.K.12"}]
[{"$f":"'V. Cloud Security'!A325","v":3625},{"$f":"'V. Cloud Security'!L325","v":2},{"$f":"'V. Cloud Security'!M325","v":0},{"$f":"'V. Cloud Security'!AA325","v":1},{"$f":"'V. Cloud Security'!B325","v":"V.1.64"},{"$f":"'V. Cloud Security'!C325","v":"Are sites failed over as part of normal operation or as part of a test? If yes, what is the frequency:"},{"$f":"'V. Cloud Security'!D325","v":0},{"$f":"'V. Cloud Security'!E325","v":0},{"$f":"'V. Cloud Security'!F325","v":0},{"$f":"'V. Cloud Security'!I325","v":0},{"$f":"'V. Cloud Security'!J325","v":"17.1.3"},{"$f":"'V. Cloud Security'!K325","v":"Verify, review and evaluate information security continuity"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB325","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A326","v":3626},{"$f":"'V. Cloud Security'!L326","v":3},{"$f":"'V. Cloud Security'!M326","v":0},{"$f":"'V. Cloud Security'!AA326","v":0},{"$f":"'V. Cloud Security'!B326","v":"V.1.64.1"},{"$f":"'V. Cloud Security'!C326","v":"Never?"},{"$f":"'V. Cloud Security'!D326","v":0},{"$f":"'V. Cloud Security'!E326","v":0},{"$f":"'V. Cloud Security'!F326","v":0},{"$f":"'V. Cloud Security'!I326","v":0},{"$f":"'V. Cloud Security'!J326","v":"NA"},{"$f":"'V. Cloud Security'!K326","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB326","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A327","v":3627},{"$f":"'V. Cloud Security'!L327","v":3},{"$f":"'V. Cloud Security'!M327","v":0},{"$f":"'V. Cloud Security'!AA327","v":0},{"$f":"'V. Cloud Security'!B327","v":"V.1.64.2"},{"$f":"'V. Cloud Security'!C327","v":"Weekly?"},{"$f":"'V. Cloud Security'!D327","v":0},{"$f":"'V. Cloud Security'!E327","v":0},{"$f":"'V. Cloud Security'!F327","v":0},{"$f":"'V. Cloud Security'!I327","v":0},{"$f":"'V. Cloud Security'!J327","v":"NA"},{"$f":"'V. Cloud Security'!K327","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB327","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A328","v":3628},{"$f":"'V. Cloud Security'!L328","v":3},{"$f":"'V. Cloud Security'!M328","v":0},{"$f":"'V. Cloud Security'!AA328","v":0},{"$f":"'V. Cloud Security'!B328","v":"V.1.64.3"},{"$f":"'V. Cloud Security'!C328","v":"Monthly?"},{"$f":"'V. Cloud Security'!D328","v":0},{"$f":"'V. Cloud Security'!E328","v":0},{"$f":"'V. Cloud Security'!F328","v":0},{"$f":"'V. Cloud Security'!I328","v":0},{"$f":"'V. Cloud Security'!J328","v":"NA"},{"$f":"'V. Cloud Security'!K328","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB328","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A329","v":3629},{"$f":"'V. Cloud Security'!L329","v":3},{"$f":"'V. Cloud Security'!M329","v":0},{"$f":"'V. Cloud Security'!AA329","v":0},{"$f":"'V. Cloud Security'!B329","v":"V.1.64.4"},{"$f":"'V. Cloud Security'!C329","v":"Annually?"},{"$f":"'V. Cloud Security'!D329","v":0},{"$f":"'V. Cloud Security'!E329","v":0},{"$f":"'V. Cloud Security'!F329","v":0},{"$f":"'V. Cloud Security'!I329","v":0},{"$f":"'V. Cloud Security'!J329","v":"NA"},{"$f":"'V. Cloud Security'!K329","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB329","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A330","v":3630},{"$f":"'V. Cloud Security'!L330","v":3},{"$f":"'V. Cloud Security'!M330","v":0},{"$f":"'V. Cloud Security'!AA330","v":0},{"$f":"'V. Cloud Security'!B330","v":"V.1.64.5"},{"$f":"'V. Cloud Security'!C330","v":"Dependent on change?"},{"$f":"'V. Cloud Security'!D330","v":0},{"$f":"'V. Cloud Security'!E330","v":0},{"$f":"'V. Cloud Security'!F330","v":0},{"$f":"'V. Cloud Security'!I330","v":0},{"$f":"'V. Cloud Security'!J330","v":"NA"},{"$f":"'V. Cloud Security'!K330","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB330","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A331","v":3631},{"$f":"'V. Cloud Security'!L331","v":3},{"$f":"'V. Cloud Security'!M331","v":0},{"$f":"'V. Cloud Security'!AA331","v":0},{"$f":"'V. Cloud Security'!B331","v":"V.1.64.6"},{"$f":"'V. Cloud Security'!C331","v":"Continuous?"},{"$f":"'V. Cloud Security'!D331","v":0},{"$f":"'V. Cloud Security'!E331","v":0},{"$f":"'V. Cloud Security'!F331","v":0},{"$f":"'V. Cloud Security'!I331","v":0},{"$f":"'V. Cloud Security'!J331","v":"NA"},{"$f":"'V. Cloud Security'!K331","v":0},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB331","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A332","v":3632},{"$f":"'V. Cloud Security'!L332","v":2},{"$f":"'V. Cloud Security'!M332","v":0},{"$f":"'V. Cloud Security'!AA332","v":1},{"$f":"'V. Cloud Security'!B332","v":"V.1.65"},{"$f":"'V. Cloud Security'!C332","v":"Are all suppliers of critical hardware, network services and facility services involved in annual continuity and recovery tests?"},{"$f":"'V. Cloud Security'!D332","v":0},{"$f":"'V. Cloud Security'!E332","v":0},{"$f":"'V. Cloud Security'!F332","v":0},{"$f":"'V. Cloud Security'!I332","v":0},{"$f":"'V. Cloud Security'!J332","v":"17.1.3"},{"$f":"'V. Cloud Security'!K332","v":"Verify, review and evaluate information security continuity"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB332","v":"WP.1.K.11"}]
[{"$f":"'V. Cloud Security'!A333","v":3633},{"$f":"'V. Cloud Security'!L333","v":2},{"$f":"'V. Cloud Security'!M333","v":0},{"$f":"'V. Cloud Security'!AA333","v":0},{"$f":"'V. Cloud Security'!B333","v":"V.1.66"},{"$f":"'V. Cloud Security'!C333","v":"Is the maturity of IT management processes formally evaluated at least annually using an established benchmark (e.g., COBIT maturity models)?"},{"$f":"'V. Cloud Security'!D333","v":0},{"$f":"'V. Cloud Security'!E333","v":0},{"$f":"'V. Cloud Security'!F333","v":0},{"$f":"'V. Cloud Security'!I333","v":0},{"$f":"'V. Cloud Security'!J333","v":"17.1.3"},{"$f":"'V. Cloud Security'!K333","v":"Verify, review and evaluate information security continuity"},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A334","v":3634},{"$f":"'V. Cloud Security'!L334","v":2},{"$f":"'V. Cloud Security'!M334","v":0},{"$f":"'V. Cloud Security'!AA334","v":1},{"$f":"'V. Cloud Security'!B334","v":"V.1.67"},{"$f":"'V. Cloud Security'!C334","v":"Are all critical technology service providers described on an architecture diagram that includes physical systems and facilities?"},{"$f":"'V. Cloud Security'!D334","v":0},{"$f":"'V. Cloud Security'!E334","v":0},{"$f":"'V. Cloud Security'!F334","v":0},{"$f":"'V. Cloud Security'!I334","v":0},{"$f":"'V. Cloud Security'!J334","v":"17.1.3"},{"$f":"'V. Cloud Security'!K334","v":"Verify, review and evaluate information security continuity"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB334","v":"WP.1.E.1"}]
[{"$f":"'V. Cloud Security'!A335","v":3635},{"$f":"'V. Cloud Security'!L335","v":3},{"$f":"'V. Cloud Security'!M335","v":0},{"$f":"'V. Cloud Security'!AA335","v":0},{"$f":"'V. Cloud Security'!B335","v":"V.1.67.1"},{"$f":"'V. Cloud Security'!C335","v":"Do the BCP failover test scenarios contain fail-over across critical vendors?"},{"$f":"'V. Cloud Security'!D335","v":0},{"$f":"'V. Cloud Security'!E335","v":0},{"$f":"'V. Cloud Security'!F335","v":0},{"$f":"'V. Cloud Security'!I335","v":0},{"$f":"'V. Cloud Security'!J335","v":"17.1.3"},{"$f":"'V. Cloud Security'!K335","v":"Verify, review and evaluate information security continuity"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB335","v":"WP.1.I.6"}]
[{"$f":"'V. Cloud Security'!A336","v":3636},{"$f":"'V. Cloud Security'!L336","v":3},{"$f":"'V. Cloud Security'!M336","v":0},{"$f":"'V. Cloud Security'!AA336","v":0},{"$f":"'V. Cloud Security'!B336","v":"V.1.67.2"},{"$f":"'V. Cloud Security'!C336","v":"Are there requirements to review and update the BCP for each significant business change to the critical supporting vendors?"},{"$f":"'V. Cloud Security'!D336","v":0},{"$f":"'V. Cloud Security'!E336","v":0},{"$f":"'V. Cloud Security'!F336","v":0},{"$f":"'V. Cloud Security'!I336","v":0},{"$f":"'V. Cloud Security'!J336","v":"17.1.3"},{"$f":"'V. Cloud Security'!K336","v":"Verify, review and evaluate information security continuity"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB336","v":"WP.1.K.12"}]
[{"$f":"'V. Cloud Security'!A337","v":3637},{"$f":"'V. Cloud Security'!L337","v":2},{"$f":"'V. Cloud Security'!M337","v":0},{"$f":"'V. Cloud Security'!AA337","v":0},{"$f":"'V. Cloud Security'!B337","v":"V.1.68"},{"$f":"'V. Cloud Security'!C337","v":"Are \"Red and Blue\" fully redundant networks run at the physical level?"},{"$f":"'V. Cloud Security'!D337","v":0},{"$f":"'V. Cloud Security'!E337","v":0},{"$f":"'V. Cloud Security'!F337","v":0},{"$f":"'V. Cloud Security'!I337","v":0},{"$f":"'V. Cloud Security'!J337","v":"17.1.3"},{"$f":"'V. Cloud Security'!K337","v":"Verify, review and evaluate information security continuity"},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A338","v":3638},{"$f":"'V. Cloud Security'!L338","v":2},{"$f":"'V. Cloud Security'!M338","v":0},{"$f":"'V. Cloud Security'!AA338","v":1},{"$f":"'V. Cloud Security'!B338","v":"V.1.69"},{"$f":"'V. Cloud Security'!C338","v":"Is there sufficient redundancy capacity to ensure services are not impacted in multi-tenancy environments during peak usage and above?"},{"$f":"'V. Cloud Security'!D338","v":0},{"$f":"'V. Cloud Security'!E338","v":0},{"$f":"'V. Cloud Security'!F338","v":0},{"$f":"'V. Cloud Security'!I338","v":0},{"$f":"'V. Cloud Security'!J338","v":"17.1.3"},{"$f":"'V. Cloud Security'!K338","v":"Verify, review and evaluate information security continuity"},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A339","v":3639},{"$f":"'V. Cloud Security'!L339","v":2},{"$f":"'V. Cloud Security'!M339","v":0},{"$f":"'V. Cloud Security'!AA339","v":1},{"$f":"'V. Cloud Security'!B339","v":"V.1.70"},{"$f":"'V. Cloud Security'!C339","v":"Do contracts include a penalty or remediation clause for breach of availability and continuity SLAs? If yes, is the penalty based on:"},{"$f":"'V. Cloud Security'!D339","v":0},{"$f":"'V. Cloud Security'!E339","v":0},{"$f":"'V. Cloud Security'!F339","v":0},{"$f":"'V. Cloud Security'!I339","v":0},{"$f":"'V. Cloud Security'!J339","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!K339","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A340","v":3640},{"$f":"'V. Cloud Security'!L340","v":3},{"$f":"'V. Cloud Security'!M340","v":0},{"$f":"'V. Cloud Security'!AA340","v":0},{"$f":"'V. Cloud Security'!B340","v":"V.1.70.1"},{"$f":"'V. Cloud Security'!C340","v":"Direct damages arising from breach of warranty or contract?"},{"$f":"'V. Cloud Security'!D340","v":0},{"$f":"'V. Cloud Security'!E340","v":0},{"$f":"'V. Cloud Security'!F340","v":0},{"$f":"'V. Cloud Security'!I340","v":0},{"$f":"'V. Cloud Security'!J340","v":"NA"},{"$f":"'V. Cloud Security'!K340","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A341","v":3641},{"$f":"'V. Cloud Security'!L341","v":3},{"$f":"'V. Cloud Security'!M341","v":0},{"$f":"'V. Cloud Security'!AA341","v":0},{"$f":"'V. Cloud Security'!B341","v":"V.1.70.2"},{"$f":"'V. Cloud Security'!C341","v":"Indirect damages arising from breach of warranty or contract?"},{"$f":"'V. Cloud Security'!D341","v":0},{"$f":"'V. Cloud Security'!E341","v":0},{"$f":"'V. Cloud Security'!F341","v":0},{"$f":"'V. Cloud Security'!I341","v":0},{"$f":"'V. Cloud Security'!J341","v":"NA"},{"$f":"'V. Cloud Security'!K341","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A342","v":3642},{"$f":"'V. Cloud Security'!L342","v":3},{"$f":"'V. Cloud Security'!M342","v":0},{"$f":"'V. Cloud Security'!AA342","v":0},{"$f":"'V. Cloud Security'!B342","v":"V.1.70.3"},{"$f":"'V. Cloud Security'!C342","v":"Indemnification for damages from breach of service obligations (or claims against customer for breach of service obligations)?"},{"$f":"'V. Cloud Security'!D342","v":0},{"$f":"'V. Cloud Security'!E342","v":0},{"$f":"'V. Cloud Security'!F342","v":0},{"$f":"'V. Cloud Security'!I342","v":0},{"$f":"'V. Cloud Security'!J342","v":"NA"},{"$f":"'V. Cloud Security'!K342","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A343","v":3643},{"$f":"'V. Cloud Security'!L343","v":3},{"$f":"'V. Cloud Security'!M343","v":0},{"$f":"'V. Cloud Security'!AA343","v":0},{"$f":"'V. Cloud Security'!B343","v":"V.1.70.4"},{"$f":"'V. Cloud Security'!C343","v":"Service credits for downtime?"},{"$f":"'V. Cloud Security'!D343","v":0},{"$f":"'V. Cloud Security'!E343","v":0},{"$f":"'V. Cloud Security'!F343","v":0},{"$f":"'V. Cloud Security'!I343","v":0},{"$f":"'V. Cloud Security'!J343","v":"NA"},{"$f":"'V. Cloud Security'!K343","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A344","v":3644},{"$f":"'V. Cloud Security'!L344","v":3},{"$f":"'V. Cloud Security'!M344","v":0},{"$f":"'V. Cloud Security'!AA344","v":0},{"$f":"'V. Cloud Security'!B344","v":"V.1.70.5"},{"$f":"'V. Cloud Security'!C344","v":"Grant customer a termination and/or refund right?"},{"$f":"'V. Cloud Security'!D344","v":0},{"$f":"'V. Cloud Security'!E344","v":0},{"$f":"'V. Cloud Security'!F344","v":0},{"$f":"'V. Cloud Security'!I344","v":0},{"$f":"'V. Cloud Security'!J344","v":"NA"},{"$f":"'V. Cloud Security'!K344","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A345","v":3645},{"$f":"'V. Cloud Security'!L345","v":3},{"$f":"'V. Cloud Security'!M345","v":0},{"$f":"'V. Cloud Security'!AA345","v":0},{"$f":"'V. Cloud Security'!B345","v":"V.1.70.6"},{"$f":"'V. Cloud Security'!C345","v":"Continued obligation to apply effort to resolve a problem?"},{"$f":"'V. Cloud Security'!D345","v":0},{"$f":"'V. Cloud Security'!E345","v":0},{"$f":"'V. Cloud Security'!F345","v":0},{"$f":"'V. Cloud Security'!I345","v":0},{"$f":"'V. Cloud Security'!J345","v":"NA"},{"$f":"'V. Cloud Security'!K345","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A346","v":3646},{"$f":"'V. Cloud Security'!L346","v":3},{"$f":"'V. Cloud Security'!M346","v":0},{"$f":"'V. Cloud Security'!AA346","v":0},{"$f":"'V. Cloud Security'!B346","v":"V.1.70.7"},{"$f":"'V. Cloud Security'!C346","v":"Calculation of business loss based on actual damages?"},{"$f":"'V. Cloud Security'!D346","v":0},{"$f":"'V. Cloud Security'!E346","v":0},{"$f":"'V. Cloud Security'!F346","v":0},{"$f":"'V. Cloud Security'!I346","v":0},{"$f":"'V. Cloud Security'!J346","v":"NA"},{"$f":"'V. Cloud Security'!K346","v":0},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A347","v":3647},{"$f":"'V. Cloud Security'!L347","v":2},{"$f":"'V. Cloud Security'!M347","v":0},{"$f":"'V. Cloud Security'!AA347","v":0},{"$f":"'V. Cloud Security'!B347","v":"V.1.71"},{"$f":"'V. Cloud Security'!C347","v":"Is priority access to resources from suppliers contractually ensured in the event of an adverse situation, affecting multiple customers of suppliers (e.g., fuel oil, recovery center space)?"},{"$f":"'V. Cloud Security'!D347","v":0},{"$f":"'V. Cloud Security'!E347","v":0},{"$f":"'V. Cloud Security'!F347","v":0},{"$f":"'V. Cloud Security'!I347","v":0},{"$f":"'V. Cloud Security'!J347","v":"15.1.2                                                      15.2.1 "},{"$f":"'V. Cloud Security'!K347","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,"N/A"]
[{"$f":"'V. Cloud Security'!A348","v":3649},{"$f":"'V. Cloud Security'!L348","v":2},{"$f":"'V. Cloud Security'!M348","v":0},{"$f":"'V. Cloud Security'!AA348","v":1},{"$f":"'V. Cloud Security'!B348","v":"V.1.72"},{"$f":"'V. Cloud Security'!C348","v":"Are Hypervisors used to manage systems used to transmit, process or store Scoped Data? If yes, are there:"},{"$f":"'V. Cloud Security'!D348","v":0},{"$f":"'V. Cloud Security'!E348","v":0},{"$f":"'V. Cloud Security'!F348","v":0},{"$f":"'V. Cloud Security'!I348","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J348","v":"14.1.2"},{"$f":"'V. Cloud Security'!K348","v":"Securing application services on public networks"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB348","v":"WP.1.D.1"}]
[{"$f":"'V. Cloud Security'!A349","v":3650},{"$f":"'V. Cloud Security'!L349","v":3},{"$f":"'V. Cloud Security'!M349","v":0},{"$f":"'V. Cloud Security'!AA349","v":0},{"$f":"'V. Cloud Security'!B349","v":"V.1.72.1"},{"$f":"'V. Cloud Security'!C349","v":"Hypervisor hardening standards applied?"},{"$f":"'V. Cloud Security'!D349","v":0},{"$f":"'V. Cloud Security'!E349","v":0},{"$f":"'V. Cloud Security'!F349","v":0},{"$f":"'V. Cloud Security'!I349","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J349","v":"12.6.1 "},{"$f":"'V. Cloud Security'!K349","v":"Management of technical vulnerabilities"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB349","v":"WP.1.I.3"}]
[{"$f":"'V. Cloud Security'!A350","v":3651},{"$f":"'V. Cloud Security'!L350","v":3},{"$f":"'V. Cloud Security'!M350","v":0},{"$f":"'V. Cloud Security'!AA350","v":0},{"$f":"'V. Cloud Security'!B350","v":"V.1.72.2"},{"$f":"'V. Cloud Security'!C350","v":"Standard builds/security compliance checks?"},{"$f":"'V. Cloud Security'!D350","v":0},{"$f":"'V. Cloud Security'!E350","v":0},{"$f":"'V. Cloud Security'!F350","v":0},{"$f":"'V. Cloud Security'!I350","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J350","v":"12.6.1 "},{"$f":"'V. Cloud Security'!K350","v":"Management of technical vulnerabilities"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB350","v":"WP.1.D.1"}]
[{"$f":"'V. Cloud Security'!A351","v":3652},{"$f":"'V. Cloud Security'!L351","v":3},{"$f":"'V. Cloud Security'!M351","v":0},{"$f":"'V. Cloud Security'!AA351","v":0},{"$f":"'V. Cloud Security'!B351","v":"V.1.72.3"},{"$f":"'V. Cloud Security'!C351","v":"Current patches?"},{"$f":"'V. Cloud Security'!D351","v":0},{"$f":"'V. Cloud Security'!E351","v":0},{"$f":"'V. Cloud Security'!F351","v":0},{"$f":"'V. Cloud Security'!I351","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J351","v":"12.6.1 "},{"$f":"'V. Cloud Security'!K351","v":"Management of technical vulnerabilities"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB351","v":"WP.1.I.6"}]
[{"$f":"'V. Cloud Security'!A352","v":3653},{"$f":"'V. Cloud Security'!L352","v":3},{"$f":"'V. Cloud Security'!M352","v":0},{"$f":"'V. Cloud Security'!AA352","v":0},{"$f":"'V. Cloud Security'!B352","v":"V.1.72.4"},{"$f":"'V. Cloud Security'!C352","v":"Unnecessary/unused services turned off?"},{"$f":"'V. Cloud Security'!D352","v":0},{"$f":"'V. Cloud Security'!E352","v":0},{"$f":"'V. Cloud Security'!F352","v":0},{"$f":"'V. Cloud Security'!I352","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J352","v":"12.6.1 "},{"$f":"'V. Cloud Security'!K352","v":"Management of technical vulnerabilities"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB352","v":"WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A353","v":3654},{"$f":"'V. Cloud Security'!L353","v":3},{"$f":"'V. Cloud Security'!M353","v":0},{"$f":"'V. Cloud Security'!AA353","v":0},{"$f":"'V. Cloud Security'!B353","v":"V.1.72.5"},{"$f":"'V. Cloud Security'!C353","v":"Regular log reviews using a specific methodology to uncover potential incidents?"},{"$f":"'V. Cloud Security'!D353","v":0},{"$f":"'V. Cloud Security'!E353","v":0},{"$f":"'V. Cloud Security'!F353","v":0},{"$f":"'V. Cloud Security'!I353","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J353","v":"12.4.1"},{"$f":"'V. Cloud Security'!K353","v":"Event logging"},null,null,null,10.1,null,null,{"$f":"'V. Cloud Security'!AB353","v":"WP.1.H.9"}]
[{"$f":"'V. Cloud Security'!A354","v":3655},{"$f":"'V. Cloud Security'!L354","v":3},{"$f":"'V. Cloud Security'!M354","v":0},{"$f":"'V. Cloud Security'!AA354","v":0},{"$f":"'V. Cloud Security'!B354","v":"V.1.72.6"},{"$f":"'V. Cloud Security'!C354","v":"Sufficient information in the logs to evaluate incidents?"},{"$f":"'V. Cloud Security'!D354","v":0},{"$f":"'V. Cloud Security'!E354","v":0},{"$f":"'V. Cloud Security'!F354","v":0},{"$f":"'V. Cloud Security'!I354","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J354","v":"12.4.1"},{"$f":"'V. Cloud Security'!K354","v":"Event logging"},null,null,null,10.6,null,null,{"$f":"'V. Cloud Security'!AB354","v":"WP.1.H.9"}]
[{"$f":"'V. Cloud Security'!A355","v":3656},{"$f":"'V. Cloud Security'!L355","v":3},{"$f":"'V. Cloud Security'!M355","v":0},{"$f":"'V. Cloud Security'!AA355","v":0},{"$f":"'V. Cloud Security'!B355","v":"V.1.72.7"},{"$f":"'V. Cloud Security'!C355","v":"Logs retained for a minimum of one year?"},{"$f":"'V. Cloud Security'!D355","v":0},{"$f":"'V. Cloud Security'!E355","v":0},{"$f":"'V. Cloud Security'!F355","v":0},{"$f":"'V. Cloud Security'!I355","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J355","v":"12.4.1"},{"$f":"'V. Cloud Security'!K355","v":"Event logging"},null,null,null,10.7,null,null,{"$f":"'V. Cloud Security'!AB355","v":"WP.1.H.9"}]
[{"$f":"'V. Cloud Security'!A356","v":3657},{"$f":"'V. Cloud Security'!L356","v":3},{"$f":"'V. Cloud Security'!M356","v":0},{"$f":"'V. Cloud Security'!AA356","v":0},{"$f":"'V. Cloud Security'!B356","v":"V.1.72.8"},{"$f":"'V. Cloud Security'!C356","v":"System generated alerts in the event of an audit log failure?"},{"$f":"'V. Cloud Security'!D356","v":0},{"$f":"'V. Cloud Security'!E356","v":0},{"$f":"'V. Cloud Security'!F356","v":0},{"$f":"'V. Cloud Security'!I356","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J356","v":"12.4.1"},{"$f":"'V. Cloud Security'!K356","v":"Event logging"},null,null,null,"10.2.4",null,null,{"$f":"'V. Cloud Security'!AB356","v":"WP.1.H.9, WP.1.H.10"}]
[{"$f":"'V. Cloud Security'!A357","v":3658},{"$f":"'V. Cloud Security'!L357","v":3},{"$f":"'V. Cloud Security'!M357","v":0},{"$f":"'V. Cloud Security'!AA357","v":0},{"$f":"'V. Cloud Security'!B357","v":"V.1.72.9"},{"$f":"'V. Cloud Security'!C357","v":"Audit logs stored on alternate systems?"},{"$f":"'V. Cloud Security'!D357","v":0},{"$f":"'V. Cloud Security'!E357","v":0},{"$f":"'V. Cloud Security'!F357","v":0},{"$f":"'V. Cloud Security'!I357","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J357","v":"12.4.1"},{"$f":"'V. Cloud Security'!K357","v":"Event logging"},null,null,null,"10.5.4",null,null,{"$f":"'V. Cloud Security'!AB357","v":"WP.1.H.9"}]
[{"$f":"'V. Cloud Security'!A358","v":3659},{"$f":"'V. Cloud Security'!L358","v":3},{"$f":"'V. Cloud Security'!M358","v":0},{"$f":"'V. Cloud Security'!AA358","v":0},{"$f":"'V. Cloud Security'!B358","v":"V.1.72.10"},{"$f":"'V. Cloud Security'!C358","v":"Audit logs protected against modification, deletion, and/or inappropriate access?"},{"$f":"'V. Cloud Security'!D358","v":0},{"$f":"'V. Cloud Security'!E358","v":0},{"$f":"'V. Cloud Security'!F358","v":0},{"$f":"'V. Cloud Security'!I358","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J358","v":"12.4.1"},{"$f":"'V. Cloud Security'!K358","v":"Event logging"},null,null,null,"10.5.2",null,null,{"$f":"'V. Cloud Security'!AB358","v":"WP.1.H.9"}]
[{"$f":"'V. Cloud Security'!A359","v":3660},{"$f":"'V. Cloud Security'!L359","v":3},{"$f":"'V. Cloud Security'!M359","v":0},{"$f":"'V. Cloud Security'!AA359","v":0},{"$f":"'V. Cloud Security'!B359","v":"V.1.72.11"},{"$f":"'V. Cloud Security'!C359","v":"Minimum password length at least eight characters?"},{"$f":"'V. Cloud Security'!D359","v":0},{"$f":"'V. Cloud Security'!E359","v":0},{"$f":"'V. Cloud Security'!F359","v":0},{"$f":"'V. Cloud Security'!I359","v":"H.1 Password Controls"},{"$f":"'V. Cloud Security'!J359","v":"9.3.1"},{"$f":"'V. Cloud Security'!K359","v":"Use of secret authentication information"},null,null,null,"8.2.3",null,null,{"$f":"'V. Cloud Security'!AB359","v":"WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A360","v":3661},{"$f":"'V. Cloud Security'!L360","v":3},{"$f":"'V. Cloud Security'!M360","v":0},{"$f":"'V. Cloud Security'!AA360","v":0},{"$f":"'V. Cloud Security'!B360","v":"V.1.72.12"},{"$f":"'V. Cloud Security'!C360","v":"Complex passwords required?"},{"$f":"'V. Cloud Security'!D360","v":0},{"$f":"'V. Cloud Security'!E360","v":0},{"$f":"'V. Cloud Security'!F360","v":0},{"$f":"'V. Cloud Security'!I360","v":"H.1 Password Controls"},{"$f":"'V. Cloud Security'!J360","v":"9.3.1"},{"$f":"'V. Cloud Security'!K360","v":"Use of secret authentication information"},null,null,null,"8.2.3",null,null,{"$f":"'V. Cloud Security'!AB360","v":"WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A361","v":3662},{"$f":"'V. Cloud Security'!L361","v":3},{"$f":"'V. Cloud Security'!M361","v":0},{"$f":"'V. Cloud Security'!AA361","v":0},{"$f":"'V. Cloud Security'!B361","v":"V.1.72.13"},{"$f":"'V. Cloud Security'!C361","v":"Minimum password expiration at least every 90 days?"},{"$f":"'V. Cloud Security'!D361","v":0},{"$f":"'V. Cloud Security'!E361","v":0},{"$f":"'V. Cloud Security'!F361","v":0},{"$f":"'V. Cloud Security'!I361","v":"H.1 Password Controls"},{"$f":"'V. Cloud Security'!J361","v":"9.3.1"},{"$f":"'V. Cloud Security'!K361","v":"Use of secret authentication information"},null,null,null,"8.2.4",null,null,{"$f":"'V. Cloud Security'!AB361","v":"WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A362","v":3663},{"$f":"'V. Cloud Security'!L362","v":3},{"$f":"'V. Cloud Security'!M362","v":0},{"$f":"'V. Cloud Security'!AA362","v":0},{"$f":"'V. Cloud Security'!B362","v":"V.1.72.14"},{"$f":"'V. Cloud Security'!C362","v":"Password history of 12 before reuse?"},{"$f":"'V. Cloud Security'!D362","v":0},{"$f":"'V. Cloud Security'!E362","v":0},{"$f":"'V. Cloud Security'!F362","v":0},{"$f":"'V. Cloud Security'!I362","v":"H.1 Password Controls"},{"$f":"'V. Cloud Security'!J362","v":"9.3.1"},{"$f":"'V. Cloud Security'!K362","v":"Use of secret authentication information"},null,null,null,"8.2.5",null,null,{"$f":"'V. Cloud Security'!AB362","v":"WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A363","v":3664},{"$f":"'V. Cloud Security'!L363","v":3},{"$f":"'V. Cloud Security'!M363","v":0},{"$f":"'V. Cloud Security'!AA363","v":0},{"$f":"'V. Cloud Security'!B363","v":"V.1.72.15"},{"$f":"'V. Cloud Security'!C363","v":"Password change requirements at first logon?"},{"$f":"'V. Cloud Security'!D363","v":0},{"$f":"'V. Cloud Security'!E363","v":0},{"$f":"'V. Cloud Security'!F363","v":0},{"$f":"'V. Cloud Security'!I363","v":"H.1 Password Controls"},{"$f":"'V. Cloud Security'!J363","v":"9.3.1"},{"$f":"'V. Cloud Security'!K363","v":"Use of secret authentication information"},null,null,null,"8.2.6",null,null,{"$f":"'V. Cloud Security'!AB363","v":"WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A364","v":3665},{"$f":"'V. Cloud Security'!L364","v":3},{"$f":"'V. Cloud Security'!M364","v":0},{"$f":"'V. Cloud Security'!AA364","v":0},{"$f":"'V. Cloud Security'!B364","v":"V.1.72.16"},{"$f":"'V. Cloud Security'!C364","v":"Stand alone authentication requirements such as a PIN or secret question?"},{"$f":"'V. Cloud Security'!D364","v":0},{"$f":"'V. Cloud Security'!E364","v":0},{"$f":"'V. Cloud Security'!F364","v":0},{"$f":"'V. Cloud Security'!I364","v":"H.1 Password Controls"},{"$f":"'V. Cloud Security'!J364","v":"9.3.1"},{"$f":"'V. Cloud Security'!K364","v":"Use of secret authentication information"},null,null,null,8.1999999999999993,null,null,{"$f":"'V. Cloud Security'!AB364","v":"WP.1.I.4"}]
[{"$f":"'V. Cloud Security'!A365","v":3666},{"$f":"'V. Cloud Security'!L365","v":3},{"$f":"'V. Cloud Security'!M365","v":0},{"$f":"'V. Cloud Security'!AA365","v":0},{"$f":"'V. Cloud Security'!B365","v":"V.1.72.17"},{"$f":"'V. Cloud Security'!C365","v":"Passwords encrypted in transit?"},{"$f":"'V. Cloud Security'!D365","v":0},{"$f":"'V. Cloud Security'!E365","v":0},{"$f":"'V. Cloud Security'!F365","v":0},{"$f":"'V. Cloud Security'!I365","v":"H.1 Password Controls"},{"$f":"'V. Cloud Security'!J365","v":"9.3.1                                                        10.1.1"},{"$f":"'V. Cloud Security'!K365","v":"Use of secret authentication information,                                        Policy on the use of cryptographic controls"},null,null,null,"8.2.1"]
[{"$f":"'V. Cloud Security'!A366","v":3667},{"$f":"'V. Cloud Security'!L366","v":3},{"$f":"'V. Cloud Security'!M366","v":0},{"$f":"'V. Cloud Security'!AA366","v":0},{"$f":"'V. Cloud Security'!B366","v":"V.1.72.18"},{"$f":"'V. Cloud Security'!C366","v":"Passwords encrypted or hashed in storage?"},{"$f":"'V. Cloud Security'!D366","v":0},{"$f":"'V. Cloud Security'!E366","v":0},{"$f":"'V. Cloud Security'!F366","v":0},{"$f":"'V. Cloud Security'!I366","v":"H.1 Password Controls"},{"$f":"'V. Cloud Security'!J366","v":"9.3.1"},{"$f":"'V. Cloud Security'!K366","v":"Use of secret authentication information"},null,null,null,"8.2.1"]
[{"$f":"'V. Cloud Security'!A367","v":3668},{"$f":"'V. Cloud Security'!L367","v":3},{"$f":"'V. Cloud Security'!M367","v":0},{"$f":"'V. Cloud Security'!AA367","v":0},{"$f":"'V. Cloud Security'!B367","v":"V.1.72.19"},{"$f":"'V. Cloud Security'!C367","v":"Passwords displayed when entered into a system?"},{"$f":"'V. Cloud Security'!D367","v":0},{"$f":"'V. Cloud Security'!E367","v":0},{"$f":"'V. Cloud Security'!F367","v":0},{"$f":"'V. Cloud Security'!I367","v":"H.1 Password Controls"},{"$f":"'V. Cloud Security'!J367","v":"9.3.1"},{"$f":"'V. Cloud Security'!K367","v":"Use of secret authentication information"},null,null,null,"N/A",null,null,{"$f":"'V. Cloud Security'!AB367","v":"WP.1.A.7"}]
[{"$f":"'V. Cloud Security'!A368","v":3669},{"$f":"'V. Cloud Security'!L368","v":3},{"$f":"'V. Cloud Security'!M368","v":0},{"$f":"'V. Cloud Security'!AA368","v":0},{"$f":"'V. Cloud Security'!B368","v":"V.1.72.20"},{"$f":"'V. Cloud Security'!C368","v":"User accounts associated to a unique individual?"},{"$f":"'V. Cloud Security'!D368","v":0},{"$f":"'V. Cloud Security'!E368","v":0},{"$f":"'V. Cloud Security'!F368","v":0},{"$f":"'V. Cloud Security'!I368","v":"H.1 Password Controls"},{"$f":"'V. Cloud Security'!J368","v":"9.2.1 "},{"$f":"'V. Cloud Security'!K368","v":"User registration and de-registration"},null,null,null,"8.1.1",null,null,{"$f":"'V. Cloud Security'!AB368","v":"WP.1.A.6"}]
[{"$f":"'V. Cloud Security'!A369","v":3670},{"$f":"'V. Cloud Security'!L369","v":3},{"$f":"'V. Cloud Security'!M369","v":0},{"$f":"'V. Cloud Security'!AA369","v":0},{"$f":"'V. Cloud Security'!B369","v":"V.1.72.21"},{"$f":"'V. Cloud Security'!C369","v":"System lock requirements after 3-5 invalid login attempts?"},{"$f":"'V. Cloud Security'!D369","v":0},{"$f":"'V. Cloud Security'!E369","v":0},{"$f":"'V. Cloud Security'!F369","v":0},{"$f":"'V. Cloud Security'!I369","v":0},{"$f":"'V. Cloud Security'!J369","v":"9.2.4 "},{"$f":"'V. Cloud Security'!K369","v":"Management of secret authentication information of users"},null,null,null,"8.1.6",null,null,{"$f":"'V. Cloud Security'!AB369","v":"WP.1.A.7"}]
[{"$f":"'V. Cloud Security'!A370","v":3671},{"$f":"'V. Cloud Security'!L370","v":3},{"$f":"'V. Cloud Security'!M370","v":0},{"$f":"'V. Cloud Security'!AA370","v":0},{"$f":"'V. Cloud Security'!B370","v":"V.1.72.22"},{"$f":"'V. Cloud Security'!C370","v":"Restricted administrative access to the management interfaces?"},{"$f":"'V. Cloud Security'!D370","v":0},{"$f":"'V. Cloud Security'!E370","v":0},{"$f":"'V. Cloud Security'!F370","v":0},{"$f":"'V. Cloud Security'!I370","v":"H.3 Logical Access Authorization"},{"$f":"'V. Cloud Security'!J370","v":"9.1.1                                                  9.2.3"},{"$f":"'V. Cloud Security'!K370","v":"Access control policy,               Management of privileged access rights"},null,null,null,7.1,null,null,{"$f":"'V. Cloud Security'!AB370","v":"WP.1.A.7"}]
[{"$f":"'V. Cloud Security'!A371","v":3672},{"$f":"'V. Cloud Security'!L371","v":3},{"$f":"'V. Cloud Security'!M371","v":0},{"$f":"'V. Cloud Security'!AA371","v":0},{"$f":"'V. Cloud Security'!B371","v":"V.1.72.23"},{"$f":"'V. Cloud Security'!C371","v":"Disabling unneeded hypervisor services (e.g., file-sharing between the guest and the host operating system)?"},{"$f":"'V. Cloud Security'!D371","v":0},{"$f":"'V. Cloud Security'!E371","v":0},{"$f":"'V. Cloud Security'!F371","v":0},{"$f":"'V. Cloud Security'!I371","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J371","v":"9.4.1"},{"$f":"'V. Cloud Security'!K371","v":"Information access restriction"},null,null,null,"7.2.3",null,null,{"$f":"'V. Cloud Security'!AB371","v":"WP.1.A.7"}]
[{"$f":"'V. Cloud Security'!A372","v":3673},{"$f":"'V. Cloud Security'!L372","v":3},{"$f":"'V. Cloud Security'!M372","v":0},{"$f":"'V. Cloud Security'!AA372","v":0},{"$f":"'V. Cloud Security'!B372","v":"V.1.72.24"},{"$f":"'V. Cloud Security'!C372","v":"Introspection capabilities to monitor the security of each guest operating system?"},{"$f":"'V. Cloud Security'!D372","v":0},{"$f":"'V. Cloud Security'!E372","v":0},{"$f":"'V. Cloud Security'!F372","v":0},{"$f":"'V. Cloud Security'!I372","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J372","v":"12.4.1"},{"$f":"'V. Cloud Security'!K372","v":"Event logging"},null,null,null,"10.6.2",null,null,{"$f":"'V. Cloud Security'!AB372","v":"WP.1.A.7"}]
[{"$f":"'V. Cloud Security'!A373","v":3674},{"$f":"'V. Cloud Security'!L373","v":3},{"$f":"'V. Cloud Security'!M373","v":0},{"$f":"'V. Cloud Security'!AA373","v":0},{"$f":"'V. Cloud Security'!B373","v":"V.1.72.25"},{"$f":"'V. Cloud Security'!C373","v":"Introspection capabilities to monitor the security of activity taking place between each guest operating system?"},{"$f":"'V. Cloud Security'!D373","v":0},{"$f":"'V. Cloud Security'!E373","v":0},{"$f":"'V. Cloud Security'!F373","v":0},{"$f":"'V. Cloud Security'!I373","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J373","v":"12.4.1"},{"$f":"'V. Cloud Security'!K373","v":"Event logging"},null,null,null,"10.6.2",null,null,{"$f":"'V. Cloud Security'!AB373","v":"WP.1.A.7"}]
[{"$f":"'V. Cloud Security'!A374","v":3675},{"$f":"'V. Cloud Security'!L374","v":3},{"$f":"'V. Cloud Security'!M374","v":0},{"$f":"'V. Cloud Security'!AA374","v":0},{"$f":"'V. Cloud Security'!B374","v":"V.1.72.26"},{"$f":"'V. Cloud Security'!C374","v":" Separate network VLANs for host operating system communication with guest operating systems?"},{"$f":"'V. Cloud Security'!D374","v":0},{"$f":"'V. Cloud Security'!E374","v":0},{"$f":"'V. Cloud Security'!F374","v":0},{"$f":"'V. Cloud Security'!I374","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J374","v":"13.1.3"},{"$f":"'V. Cloud Security'!K374","v":"Segregation in networks"},null,null,null,"1.2; 1.2.3",null,null,{"$f":"'V. Cloud Security'!AB374","v":"WP.1.A.2, WP.1.A.3, WP.1.A.8"}]
[{"$f":"'V. Cloud Security'!A375","v":3676},{"$f":"'V. Cloud Security'!L375","v":3},{"$f":"'V. Cloud Security'!M375","v":0},{"$f":"'V. Cloud Security'!AA375","v":0},{"$f":"'V. Cloud Security'!B375","v":"V.1.72.27"},{"$f":"'V. Cloud Security'!C375","v":"Guest operating systems communicate on separate VLAN's from other Guest operating systems that they do not need to communicate with?"},{"$f":"'V. Cloud Security'!D375","v":0},{"$f":"'V. Cloud Security'!E375","v":0},{"$f":"'V. Cloud Security'!F375","v":0},{"$f":"'V. Cloud Security'!I375","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J375","v":"13.1.3"},{"$f":"'V. Cloud Security'!K375","v":"Segregation in networks"},null,null,null,"1.2; 1.2.3",null,null,{"$f":"'V. Cloud Security'!AB375","v":"WP.1.A.2, WP.1.A.3, WP.1.A.8"}]
[{"$f":"'V. Cloud Security'!A376","v":3677},{"$f":"'V. Cloud Security'!L376","v":3},{"$f":"'V. Cloud Security'!M376","v":0},{"$f":"'V. Cloud Security'!AA376","v":0},{"$f":"'V. Cloud Security'!B376","v":"V.1.72.28"},{"$f":"'V. Cloud Security'!C376","v":"Host operating system management interface on a separate network than those used by guest operating systems?"},{"$f":"'V. Cloud Security'!D376","v":0},{"$f":"'V. Cloud Security'!E376","v":0},{"$f":"'V. Cloud Security'!F376","v":0},{"$f":"'V. Cloud Security'!I376","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J376","v":"13.1.3"},{"$f":"'V. Cloud Security'!K376","v":"Segregation in networks"},null,null,null,"1.2; 1.2.3",null,null,{"$f":"'V. Cloud Security'!AB376","v":"WP.1.A.2, WP.1.A.3, WP.1.A.8"}]
[{"$f":"'V. Cloud Security'!A377","v":3678},{"$f":"'V. Cloud Security'!L377","v":3},{"$f":"'V. Cloud Security'!M377","v":0},{"$f":"'V. Cloud Security'!AA377","v":0},{"$f":"'V. Cloud Security'!B377","v":"V.1.72.29"},{"$f":"'V. Cloud Security'!C377","v":"Two factor authentication for access to the administrative interfaces?"},{"$f":"'V. Cloud Security'!D377","v":0},{"$f":"'V. Cloud Security'!E377","v":0},{"$f":"'V. Cloud Security'!F377","v":0},{"$f":"'V. Cloud Security'!I377","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J377","v":"9.1.1"},{"$f":"'V. Cloud Security'!K377","v":"Access control policy"},null,null,null,8.3000000000000007]
[{"$f":"'V. Cloud Security'!A378","v":3679},{"$f":"'V. Cloud Security'!L378","v":3},{"$f":"'V. Cloud Security'!M378","v":0},{"$f":"'V. Cloud Security'!AA378","v":0},{"$f":"'V. Cloud Security'!B378","v":"V.1.72.30"},{"$f":"'V. Cloud Security'!C378","v":"Volume or disk partitioning to prevent inadvertent resource bottlenecks from guest operating systems?"},{"$f":"'V. Cloud Security'!D378","v":0},{"$f":"'V. Cloud Security'!E378","v":0},{"$f":"'V. Cloud Security'!F378","v":0},{"$f":"'V. Cloud Security'!I378","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J378","v":"12.1.3"},{"$f":"'V. Cloud Security'!K378","v":"Capacity Management"},null,null,null,1.2,null,null,{"$f":"'V. Cloud Security'!AB378","v":"WP.1.A.2, WP.1.A.3, WP.1.A.8"}]
[{"$f":"'V. Cloud Security'!A379","v":3680},{"$f":"'V. Cloud Security'!L379","v":3},{"$f":"'V. Cloud Security'!M379","v":0},{"$f":"'V. Cloud Security'!AA379","v":0},{"$f":"'V. Cloud Security'!B379","v":"V.1.72.31"},{"$f":"'V. Cloud Security'!C379","v":"Approval process before VMs can be created to avoid VM sprawl?"},{"$f":"'V. Cloud Security'!D379","v":0},{"$f":"'V. Cloud Security'!E379","v":0},{"$f":"'V. Cloud Security'!F379","v":0},{"$f":"'V. Cloud Security'!I379","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J379","v":"12.1.2"},{"$f":"'V. Cloud Security'!K379","v":"Change Management"},null,null,null,"12.3.1"]
[{"$f":"'V. Cloud Security'!A380","v":3681},{"$f":"'V. Cloud Security'!L380","v":3},{"$f":"'V. Cloud Security'!M380","v":0},{"$f":"'V. Cloud Security'!AA380","v":0},{"$f":"'V. Cloud Security'!B380","v":"V.1.72.32"},{"$f":"'V. Cloud Security'!C380","v":"Migration of VMs logged including source and target systems, time, user?"},{"$f":"'V. Cloud Security'!D380","v":0},{"$f":"'V. Cloud Security'!E380","v":0},{"$f":"'V. Cloud Security'!F380","v":0},{"$f":"'V. Cloud Security'!I380","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J380","v":"12.4.1"},{"$f":"'V. Cloud Security'!K380","v":"Event logging"},null,null,null,"10.1, 10.2"]
[{"$f":"'V. Cloud Security'!A381","v":3682},{"$f":"'V. Cloud Security'!L381","v":3},{"$f":"'V. Cloud Security'!M381","v":0},{"$f":"'V. Cloud Security'!AA381","v":0},{"$f":"'V. Cloud Security'!B381","v":"V.1.72.33"},{"$f":"'V. Cloud Security'!C381","v":"VM's in the same host sharing the risk and data classification?"},{"$f":"'V. Cloud Security'!D381","v":0},{"$f":"'V. Cloud Security'!E381","v":0},{"$f":"'V. Cloud Security'!F381","v":0},{"$f":"'V. Cloud Security'!I381","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J381","v":"12.1.4"},{"$f":"'V. Cloud Security'!K381","v":"Separation of Development, Test, And Operational Facilities"},null,null,null,2.6,null,null,{"$f":"'V. Cloud Security'!AB381","v":"WP.1.K.1"}]
[{"$f":"'V. Cloud Security'!A382","v":3683},{"$f":"'V. Cloud Security'!L382","v":3},{"$f":"'V. Cloud Security'!M382","v":0},{"$f":"'V. Cloud Security'!AA382","v":0},{"$f":"'V. Cloud Security'!B382","v":"V.1.72.34"},{"$f":"'V. Cloud Security'!C382","v":"VM's in the same host sharing system sensitivity level grouping (development and production not present on the same host)?"},{"$f":"'V. Cloud Security'!D382","v":0},{"$f":"'V. Cloud Security'!E382","v":0},{"$f":"'V. Cloud Security'!F382","v":0},{"$f":"'V. Cloud Security'!I382","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"'V. Cloud Security'!J382","v":"12.1.4"},{"$f":"'V. Cloud Security'!K382","v":"Separation of Development, Test, And Operational Facilities"},null,null,null,"2.6, 1.1"]
[{"$f":"'V. Cloud Security'!A383","v":0},{"$f":"'V. Cloud Security'!L383","v":0},{"$f":"'V. Cloud Security'!M383","v":0},{"$f":"'V. Cloud Security'!AA383","v":0},{"$f":"'V. Cloud Security'!B383","v":0},{"$f":"'V. Cloud Security'!C383","v":0},{"$f":"'V. Cloud Security'!D383","v":0},{"$f":"'V. Cloud Security'!E383","v":0},{"$f":"'V. Cloud Security'!F383","v":0},{"$f":"'V. Cloud Security'!I383","v":0},{"$f":"'V. Cloud Security'!J383","v":0},{"$f":"'V. Cloud Security'!K383","v":0}]

{"sheet":"Full Lite","index":27,"n_rows":160,"n_cols":19,"rows_kept":160,"cut":false,"hidden":false,"merged":[[0,10,0,11]]}
["Ser No.","Depth","Table","SL ID","Ques Num","SIG Question Text","Response","Maturity","Additional Information","AUP 2015 Relevance","ISO 27002:2013 Relevance",null,"Appendix J Section and  Line Reference","COBIT 4.0 Relevance",null,"PCI 3.0","FFIEC","COBIT 4.1 Relevance","Shared Assessments Program Cloud Computing White Paper Description"]
[{"$f":"Lite!B1","v":"SIG Lite"},null,null,null,{"$f":"Lite!B1","v":"SIG Lite"}]
[{"$f":"Lite!A5","v":0},{"$f":"Lite!M5","v":1},{"$f":"Lite!K5","v":1},{"$f":"Lite!Y5","v":0},{"$f":"Lite!B5","v":0},{"$f":"Lite!C5","v":"A. Risk Assessment and Treatment"},{"$f":"Lite!D5","v":0},{"$f":"Lite!E5","v":0},{"$f":"Lite!F5","v":0},{"$f":"Lite!G5","v":0},{"$f":"Lite!H5","v":0},{"$f":"Lite!I5","v":0}]
[{"$f":"Lite!A6","v":3198},{"$f":"Lite!M6","v":1},{"$f":"Lite!K6","v":"A"},{"$f":"Lite!Y6","v":0},{"$f":"Lite!B6","v":"SL.1"},{"$f":"Lite!C6","v":"Is there a risk assessment program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the program?"},{"$f":"Lite!D6","v":0},{"$f":"Lite!E6","v":0},{"$f":"Lite!F6","v":0},{"$f":"Lite!G6","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"Lite!H6","v":"5.1                                            6.1.2"},{"$f":"Lite!I6","v":"Leadership & Commitment,                Information Security Risk Assessment"},null,null,null,12.2,"IS.1.3.1 BCP.1.2.1 BCP.1.3.5 MGMT.1.6.1.1 OPS.1.3","PO9.4"]
[{"$f":"Lite!A7","v":0},{"$f":"Lite!M7","v":2},{"$f":"Lite!K7","v":1},{"$f":"Lite!Y7","v":1},{"$f":"Lite!B7","v":""},{"$f":"Lite!C7","v":"B. Security Policy"},{"$f":"Lite!D7","v":0},{"$f":"Lite!E7","v":0},{"$f":"Lite!F7","v":0},{"$f":"Lite!G7","v":0},{"$f":"Lite!H7","v":0},{"$f":"Lite!I7","v":0}]
[{"$f":"Lite!A8","v":3199},{"$f":"Lite!M8","v":2},{"$f":"Lite!K8","v":"B"},{"$f":"Lite!Y8","v":0},{"$f":"Lite!B8","v":"SL.2"},{"$f":"Lite!C8","v":"Is there an information security policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"Lite!D8","v":0},{"$f":"Lite!E8","v":0},{"$f":"Lite!F8","v":0},{"$f":"Lite!G8","v":"B.1 Information Security Policy Content & Maintenance"},{"$f":"Lite!H8","v":"5.1.1"},{"$f":"Lite!I8","v":"Policies for information security"},null,"PO6.1","IT policy and control environment","5.4, 12.1","IS.1.4.1","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"Lite!A9","v":2471},{"$f":"Lite!M9","v":2},{"$f":"Lite!K9","v":"B"},{"$f":"Lite!Y9","v":0},{"$f":"Lite!B9","v":"SL.3"},{"$f":"Lite!C9","v":"Have the policies been reviewed in the last 12 months?"},{"$f":"Lite!D9","v":0},{"$f":"Lite!E9","v":0},{"$f":"Lite!F9","v":0},{"$f":"Lite!G9","v":"B.1 Procedure: d"},{"$f":"Lite!H9","v":"5.1.2"},{"$f":"Lite!I9","v":"Review of the policies for information security"},null,"PO3.1","Technological direction planning","12.2.b","IS.1.4.2.7","PO3.1, PO5.3, PO5.4, PO6.3, PO9.4, DS5.2, DS5.3, ME2.2, ME2.5, ME2.7, ME4.7"]
[{"$f":"Lite!A10","v":3886},{"$f":"Lite!M10","v":2},{"$f":"Lite!K10","v":"B"},{"$f":"Lite!Y10","v":0},{"$f":"Lite!B10","v":"SL.4"},{"$f":"Lite!C10","v":"Is there a vendor management program?"},{"$f":"Lite!D10","v":0},{"$f":"Lite!E10","v":0},{"$f":"Lite!F10","v":0},{"$f":"Lite!G10","v":0},{"$f":"Lite!H10","v":0},{"$f":"Lite!I10","v":0},null,null,null,12.8,"N/A","N/A"]
[{"$f":"Lite!A11","v":0},{"$f":"Lite!M11","v":3},{"$f":"Lite!K11","v":1},{"$f":"Lite!Y11","v":1},{"$f":"Lite!B11","v":""},{"$f":"Lite!C11","v":"C. Organizational Security"},{"$f":"Lite!D11","v":0},{"$f":"Lite!E11","v":0},{"$f":"Lite!F11","v":0},{"$f":"Lite!G11","v":0},{"$f":"Lite!H11","v":0},{"$f":"Lite!I11","v":0}]
[{"$f":"Lite!A12","v":58},{"$f":"Lite!M12","v":3},{"$f":"Lite!K12","v":"C"},{"$f":"Lite!Y12","v":0},{"$f":"Lite!B12","v":"SL.5"},{"$f":"Lite!C12","v":"Is there a respondent information security function responsible for security initiatives?"},{"$f":"Lite!D12","v":0},{"$f":"Lite!E12","v":0},{"$f":"Lite!F12","v":0},{"$f":"Lite!G12","v":"C.2 Security Organization Roles / Responsibilities"},{"$f":"Lite!H12","v":"6.1.1"},{"$f":"Lite!I12","v":"Information Security Roles and Responsibilities"},null,"PO3.3","Monitoring of future trends and regulations",12.5,"IS.1.7.4 MGMT.1.6.1.6","PO3.3, PO3.5, PO4.3, PO4.4, PO4.5, PO4.8, PO6.3, PO6.4, PO6.5, DS5.1"]
[{"$f":"Lite!A13","v":71},{"$f":"Lite!M13","v":3},{"$f":"Lite!K13","v":"C"},{"$f":"Lite!Y13","v":0},{"$f":"Lite!B13","v":"SL.6"},{"$f":"Lite!C13","v":"Do external parties have access to Scoped Systems and Data or processing facilities?"},{"$f":"Lite!D13","v":0},{"$f":"Lite!E13","v":0},{"$f":"Lite!F13","v":0},{"$f":"Lite!G13","v":0},{"$f":"Lite!H13","v":15},{"$f":"Lite!I13","v":"Supplier relationships"},null,null,null,12.8,"N/A","PO6.4, DS5.5, ME2.2, ME2.5, ME4.7"]
[{"$f":"Lite!A14","v":0},{"$f":"Lite!M14","v":4},{"$f":"Lite!K14","v":1},{"$f":"Lite!Y14","v":1},{"$f":"Lite!B14","v":""},{"$f":"Lite!C14","v":"D. Asset Management"},{"$f":"Lite!D14","v":0},{"$f":"Lite!E14","v":0},{"$f":"Lite!F14","v":0},{"$f":"Lite!G14","v":0},{"$f":"Lite!H14","v":0},{"$f":"Lite!I14","v":0}]
[{"$f":"Lite!A15","v":3200},{"$f":"Lite!M15","v":4},{"$f":"Lite!K15","v":"D"},{"$f":"Lite!Y15","v":0},{"$f":"Lite!B15","v":"SL.7"},{"$f":"Lite!C15","v":"Is there an asset management program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"Lite!D15","v":0},{"$f":"Lite!E15","v":0},{"$f":"Lite!F15","v":0},{"$f":"Lite!G15","v":"D. Assessment Management"},{"$f":"Lite!H15","v":8.1},{"$f":"Lite!I15","v":"Responsibility For Assets"},null,null,null,"N/A","N/A","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6"]
[{"$f":"Lite!A16","v":2532},{"$f":"Lite!M16","v":4},{"$f":"Lite!K16","v":"D"},{"$f":"Lite!Y16","v":0},{"$f":"Lite!B16","v":"SL.8"},{"$f":"Lite!C16","v":"Are information assets classified?"},{"$f":"Lite!D16","v":0},{"$f":"Lite!E16","v":0},{"$f":"Lite!F16","v":0},{"$f":"Lite!G16","v":"D.1 Procedure: e.1"},{"$f":"Lite!H16","v":"8.2.1"},{"$f":"Lite!I16","v":"Classification of Information"},null,"PO2.3","Data classification scheme","9.6.1","N/A","PO2, AI2, DS9"]
[{"$f":"Lite!A17","v":0},{"$f":"Lite!M17","v":5},{"$f":"Lite!K17","v":1},{"$f":"Lite!Y17","v":1},{"$f":"Lite!B17","v":""},{"$f":"Lite!C17","v":"E. Human Resource Security"},{"$f":"Lite!D17","v":0},{"$f":"Lite!E17","v":0},{"$f":"Lite!F17","v":0},{"$f":"Lite!G17","v":0},{"$f":"Lite!H17","v":0},{"$f":"Lite!I17","v":0}]
[{"$f":"Lite!A18","v":2536},{"$f":"Lite!M18","v":5},{"$f":"Lite!K18","v":"E"},{"$f":"Lite!Y18","v":0},{"$f":"Lite!B18","v":"SL.9"},{"$f":"Lite!C18","v":"Are security roles and responsibilities of constituents defined and documented in accordance with the respondent’s information security policy?"},{"$f":"Lite!D18","v":0},{"$f":"Lite!E18","v":0},{"$f":"Lite!F18","v":0},{"$f":"Lite!G18","v":"C.2 Security Organization Roles/Responsibilities"},{"$f":"Lite!H18","v":"6.1.1"},{"$f":"Lite!I18","v":"Information security roles and responsibilities"},null,"PO4.6","Roles and responsibilities",12.1,"IS.2.M.15.1 MGMT.1.6.1.2 WPS.2.2.1.3.1","PO4.6, PO4.8, PO6.3, PO7.1, PO7.2, PO7.3, DS5.4"]
[{"$f":"Lite!A19","v":2538},{"$f":"Lite!M19","v":5},{"$f":"Lite!K19","v":"E"},{"$f":"Lite!Y19","v":0},{"$f":"Lite!B19","v":"SL.10"},{"$f":"Lite!C19","v":"Is a background screening performed prior to allowing constituent access to Scoped Systems and Data?"},{"$f":"Lite!D19","v":0},{"$f":"Lite!E19","v":0},{"$f":"Lite!F19","v":0},{"$f":"Lite!G19","v":"E.3 Background Investigation Policy Content"},{"$f":"Lite!H19","v":"7.1.1"},{"$f":"Lite!I19","v":"Screening"},null,null,null,12.7,"IS.2.F.1","N/A"]
[{"$f":"Lite!A20","v":183},{"$f":"Lite!M20","v":5},{"$f":"Lite!K20","v":"E"},{"$f":"Lite!Y20","v":0},{"$f":"Lite!B20","v":"SL.11"},{"$f":"Lite!C20","v":"Are new hires required to sign any agreements upon hire?"},{"$f":"Lite!D20","v":0},{"$f":"Lite!E20","v":0},{"$f":"Lite!F20","v":0},{"$f":"Lite!G20","v":0},{"$f":"Lite!H20","v":"7.1.2"},{"$f":"Lite!I20","v":"Terms and conditions of employment"},null,"PO4.6","Roles and responsibilities","12.6.2","IS.2.A.8.1 IS.2.F.4 IS.2.F.2","PO4.6, PO7.1, PO7.3, DS2.3"]
[{"$f":"Lite!A21","v":212},{"$f":"Lite!M21","v":5},{"$f":"Lite!K21","v":"E"},{"$f":"Lite!Y21","v":0},{"$f":"Lite!B21","v":"SL.12"},{"$f":"Lite!C21","v":"Is there a security awareness training program?"},{"$f":"Lite!D21","v":0},{"$f":"Lite!E21","v":0},{"$f":"Lite!F21","v":0},{"$f":"Lite!G21","v":"E.1 Security Awareness Training Program Maintenance"},{"$f":"Lite!H21","v":"7.2.2"},{"$f":"Lite!I21","v":"Information security awareness, education, and training"},null,"PO4.6","Roles and responsibilities",12.6,"IS.1.7.2 E-BANK.1.4.2.11 E-BANK.1.4.2.12","PO4.6, PO6.2, PO6.4, PO7.2, PO7.4, PO7.7, AI1.1, AI7.1, DS5.1, DS5.2, DS5.3, DS7.1, DS7.2"]
[{"$f":"Lite!A22","v":293},{"$f":"Lite!M22","v":5},{"$f":"Lite!K22","v":"E"},{"$f":"Lite!Y22","v":0},{"$f":"Lite!B22","v":"SL.13"},{"$f":"Lite!C22","v":"Is there a disciplinarily process for non-compliance with information security policies?"},{"$f":"Lite!D22","v":0},{"$f":"Lite!E22","v":0},{"$f":"Lite!F22","v":0},{"$f":"Lite!G22","v":0},{"$f":"Lite!H22","v":"7.2.3"},{"$f":"Lite!I22","v":"Disciplinary process"},null,"PO4.8","Responsibility for risk, security and compliance","N/A","IS.1.7.6","PO4.8, PO7.8, DS5.6"]
[{"$f":"Lite!A23","v":2557},{"$f":"Lite!M23","v":5},{"$f":"Lite!K23","v":"E"},{"$f":"Lite!Y23","v":0},{"$f":"Lite!B23","v":"SL.14"},{"$f":"Lite!C23","v":"Is there a constituent termination or change of status process?"},{"$f":"Lite!D23","v":0},{"$f":"Lite!E23","v":0},{"$f":"Lite!F23","v":0},{"$f":"Lite!G23","v":"H.2 Revoke System and Physical Access"},{"$f":"Lite!H23","v":7.3},{"$f":"Lite!I23","v":"Termination responsibilities"},null,"PO7.8","Job change and termination","N/A","OPS.1.5.3.5","PO4.8, PO7.8, DS5.6"]
[{"$f":"Lite!A24","v":0},{"$f":"Lite!M24","v":6},{"$f":"Lite!K24","v":1},{"$f":"Lite!Y24","v":1},{"$f":"Lite!B24","v":""},{"$f":"Lite!C24","v":"F. Physical and Environmental Security"},{"$f":"Lite!D24","v":0},{"$f":"Lite!E24","v":0},{"$f":"Lite!F24","v":0},{"$f":"Lite!G24","v":0},{"$f":"Lite!H24","v":0},{"$f":"Lite!I24","v":0}]
[{"$f":"Lite!A25","v":2559},{"$f":"Lite!M25","v":6},{"$f":"Lite!K25","v":"F"},{"$f":"Lite!Y25","v":0},{"$f":"Lite!B25","v":"SL.15"},{"$f":"Lite!C25","v":"Is there a physical security program?"},{"$f":"Lite!D25","v":0},{"$f":"Lite!E25","v":0},{"$f":"Lite!F25","v":0},{"$f":"Lite!G25","v":0},{"$f":"Lite!H25","v":"5.1.1"},{"$f":"Lite!I25","v":"Policies for information security"},null,"PO6.1","IT policy and control environment",12.1,"IS.2.E.1 OPS.1.5.1.6 OPS.1.5.1.8 WPS.2.2.1.3.5 AUDIT.2.D.1.10 E-BANK.1.4.2.8 E-BANK.1.5.4 RPS.1.2.2.2","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1"]
[{"$f":"Lite!A26","v":2560},{"$f":"Lite!M26","v":6},{"$f":"Lite!K26","v":"F"},{"$f":"Lite!Y26","v":0},{"$f":"Lite!B26","v":"SL.16"},{"$f":"Lite!C26","v":"Are reasonable physical security and environmental controls present in the building/data center that contains Scoped Systems and Data?"},{"$f":"Lite!D26","v":0},{"$f":"Lite!E26","v":0},{"$f":"Lite!F26","v":0},{"$f":"Lite!G26","v":"F. Physical and Environmental Security"},{"$f":"Lite!H26","v":11.1},{"$f":"Lite!I26","v":"Secure areas"},null,null,null,9.3000000000000007,"N/A","N/A"]
[{"$f":"Lite!A27","v":396},{"$f":"Lite!M27","v":6},{"$f":"Lite!K27","v":"F"},{"$f":"Lite!Y27","v":0},{"$f":"Lite!B27","v":"SL.17"},{"$f":"Lite!C27","v":"Are visitors permitted in the facility?"},{"$f":"Lite!D27","v":0},{"$f":"Lite!E27","v":0},{"$f":"Lite!F27","v":0},{"$f":"Lite!G27","v":0},{"$f":"Lite!H27","v":"11.1.2 "},{"$f":"Lite!I27","v":"Physical entry controls"},null,"DS12.2","Physical security measures",9.4,"OPS.2.12.E.9 WPS.2.9.1.2","DS12.2, DS12.3"]
[{"$f":"Lite!A28","v":0},{"$f":"Lite!M28","v":7},{"$f":"Lite!K28","v":1},{"$f":"Lite!Y28","v":1},{"$f":"Lite!B28","v":""},{"$f":"Lite!C28","v":"G. Communications and Operations Management"},{"$f":"Lite!D28","v":0},{"$f":"Lite!E28","v":0},{"$f":"Lite!F28","v":0},{"$f":"Lite!G28","v":0},{"$f":"Lite!H28","v":0},{"$f":"Lite!I28","v":0}]
[{"$f":"Lite!A29","v":2582},{"$f":"Lite!M29","v":7},{"$f":"Lite!K29","v":"G"},{"$f":"Lite!Y29","v":0},{"$f":"Lite!B29","v":"SL.18"},{"$f":"Lite!C29","v":"Are Management approved operating procedures utilized?"},{"$f":"Lite!D29","v":0},{"$f":"Lite!E29","v":0},{"$f":"Lite!F29","v":0},{"$f":"Lite!G29","v":"G. Communications and Operations Management"},{"$f":"Lite!H29","v":"12.1.1"},{"$f":"Lite!I29","v":"Documented Operating Procedure"},null,"AI1.1","Definition and maintenance of business functional and technical requirements","N/A","MGMT.1.6.1.4 OPS.1.5 WPS.2.2.1.3.2 AUDIT.2.D.1.11","AI1.1, AI4.4, DS13.1"]
[{"$f":"Lite!A30","v":816},{"$f":"Lite!M30","v":7},{"$f":"Lite!K30","v":"G"},{"$f":"Lite!Y30","v":0},{"$f":"Lite!B30","v":"SL.19"},{"$f":"Lite!C30","v":"Is there an operational change management/change control policy or program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"Lite!D30","v":0},{"$f":"Lite!E30","v":0},{"$f":"Lite!F30","v":0},{"$f":"Lite!G30","v":"G.21 Change Control"},{"$f":"Lite!H30","v":"12.1.2"},{"$f":"Lite!I30","v":"Change Management"},null,"AI6.1","Change standards and procedures",6.4,"IS.1.7.8 OPS.1.5.1.3","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"Lite!A31","v":853},{"$f":"Lite!M31","v":7},{"$f":"Lite!K31","v":"G"},{"$f":"Lite!Y31","v":0},{"$f":"Lite!B31","v":"SL.20"},{"$f":"Lite!C31","v":"Do third party vendors have access to Scoped Systems and Data? (backup vendors, service providers, equipment support maintenance, software maintenance vendors, data recovery vendors, etc.)?"},{"$f":"Lite!D31","v":0},{"$f":"Lite!E31","v":0},{"$f":"Lite!F31","v":0},{"$f":"Lite!G31","v":0},{"$f":"Lite!H31","v":15},{"$f":"Lite!I31","v":"Supplier relationships"},null,"DS1.1","Service level management framework",12.8,"IS.1.4.1.11 IS.1.5.1 O.1.3.1.1 O.1.3.3","DS1.1, DS1.2, DS1.3, DS2.4"]
[{"$f":"Lite!A32","v":895},{"$f":"Lite!M32","v":7},{"$f":"Lite!K32","v":"G"},{"$f":"Lite!Y32","v":0},{"$f":"Lite!B32","v":"SL.21"},{"$f":"Lite!C32","v":"Is there an anti-virus/malware policy or program (workstations, servers, mobile devices) that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"Lite!D32","v":0},{"$f":"Lite!E32","v":0},{"$f":"Lite!F32","v":0},{"$f":"Lite!G32","v":"G.7 Virus Protection (Servers), G.8 Virus Protection (Workstations)"},{"$f":"Lite!H32","v":"12.2.1"},{"$f":"Lite!I32","v":"Controls Against Malware"},null,"PO4.11","Segregation of duties","N/A","IS.2.B.9.4 IS.2.M.5","PO4.1, DS5.9, DS5.11"]
[{"$f":"Lite!A33","v":922},{"$f":"Lite!M33","v":7},{"$f":"Lite!K33","v":"G"},{"$f":"Lite!Y33","v":0},{"$f":"Lite!B33","v":"SL.22"},{"$f":"Lite!C33","v":"Are system backups of Scoped Systems and Data performed?"},{"$f":"Lite!D33","v":0},{"$f":"Lite!E33","v":0},{"$f":"Lite!F33","v":0},{"$f":"Lite!G33","v":"G.20 Backup Media Restoration"},{"$f":"Lite!H33","v":"12.3.1"},{"$f":"Lite!I33","v":"Information Back-Up"},null,"AI6.1","Change standards and procedures","9.6.2","IS.2.B.9.6","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5"]
[{"$f":"Lite!A34","v":3688},{"$f":"Lite!M34","v":7},{"$f":"Lite!K34","v":"G"},{"$f":"Lite!Y34","v":0},{"$f":"Lite!B34","v":"SL.23"},{"$f":"Lite!C34","v":"Are firewalls in use for both internal and external connections?"},{"$f":"Lite!D34","v":0},{"$f":"Lite!E34","v":0},{"$f":"Lite!F34","v":0},{"$f":"Lite!G34","v":"G.2 Network Security – Firewall(s)"},{"$f":"Lite!H34","v":"13.1.3"},{"$f":"Lite!I34","v":"Segregation in networks"},null,"PO6.2","Enterprise IT risk and internal control framework",6.1,"N/A","PO6.2, DS5.2, DS5.3, DS5.7"]
[{"$f":"Lite!A35","v":3706},{"$f":"Lite!M35","v":7},{"$f":"Lite!K35","v":"G"},{"$f":"Lite!Y35","v":0},{"$f":"Lite!B35","v":"SL.24"},{"$f":"Lite!C35","v":"Are vulnerability assessments, scans or penetration tests performed on internal or external networks?"},{"$f":"Lite!D35","v":0},{"$f":"Lite!E35","v":0},{"$f":"Lite!F35","v":0},{"$f":"Lite!G35","v":"L.2 Technical Compliance Checking – Vulnerability Testing and Remediation"},{"$f":"Lite!H35","v":"12.6.1"},{"$f":"Lite!I35","v":"Control of technical vulnerabilities"},null,"DS5.10","Network security",11.3,"N/A","DS5.9, DS5.11"]
[{"$f":"Lite!A36","v":975},{"$f":"Lite!M36","v":7},{"$f":"Lite!K36","v":"G"},{"$f":"Lite!Y36","v":0},{"$f":"Lite!B36","v":"SL.25"},{"$f":"Lite!C36","v":"Are there external network connections (Internet, intranet, extranet, etc.)?"},{"$f":"Lite!D36","v":0},{"$f":"Lite!E36","v":0},{"$f":"Lite!F36","v":0},{"$f":"Lite!G36","v":0},{"$f":"Lite!H36","v":"13.1.1"},{"$f":"Lite!I36","v":"Network Controls"},null,null,null,"10.5.4","N/A","DS5.7, DS5.9, DS5.11"]
[{"$f":"Lite!A37","v":1095},{"$f":"Lite!M37","v":7},{"$f":"Lite!K37","v":"G"},{"$f":"Lite!Y37","v":0},{"$f":"Lite!B37","v":"SL.26"},{"$f":"Lite!C37","v":"Is wireless networking technology used?"},{"$f":"Lite!D37","v":0},{"$f":"Lite!E37","v":0},{"$f":"Lite!F37","v":0},{"$f":"Lite!G37","v":"G.17 Unapproved Wireless Networks"},{"$f":"Lite!H37","v":"13.1.1.c"},{"$f":"Lite!I37","v":"Network Controls"},null,null,null,"N/A","IS.2.M.6","DS5.5, DS5.7"]
[{"$f":"Lite!A38","v":3295},{"$f":"Lite!M38","v":7},{"$f":"Lite!K38","v":"G"},{"$f":"Lite!Y38","v":0},{"$f":"Lite!B38","v":"SL.27"},{"$f":"Lite!C38","v":"Is there a removable media policy or program (CDs, DVDs, tapes, disk drives) that has been approved by management, communicated to appropriate constituents, and an owner to maintain and review the policy?"},{"$f":"Lite!D38","v":0},{"$f":"Lite!E38","v":0},{"$f":"Lite!F38","v":0},{"$f":"Lite!G38","v":"G.15 Physical Media Tracking"},{"$f":"Lite!H38","v":"8.3.1"},{"$f":"Lite!I38","v":"Management of Removable Media"},null,"DS5.3","Identity management","9.7.1","N/A","DS5.4, DS5.7"]
[{"$f":"Lite!A39","v":1208},{"$f":"Lite!M39","v":7},{"$f":"Lite!K39","v":"G"},{"$f":"Lite!Y39","v":0},{"$f":"Lite!B39","v":"SL.28"},{"$f":"Lite!C39","v":"Is Scoped Data sent or received electronically or via physical media?"},{"$f":"Lite!D39","v":0},{"$f":"Lite!E39","v":0},{"$f":"Lite!F39","v":0},{"$f":"Lite!G39","v":"G.4 Network Management – Encrypted Authentication Credentials"},{"$f":"Lite!H39","v":"8.3.3"},{"$f":"Lite!I39","v":"Physical media in transit"},null,"DS5.5","Security testing, surveillance and monitoring","N/A","IS.2.C.2","AI6.3, DS5.7"]
[{"$f":"Lite!A40","v":1770},{"$f":"Lite!M40","v":7},{"$f":"Lite!K40","v":"G"},{"$f":"Lite!Y40","v":0},{"$f":"Lite!B40","v":"SL.29"},{"$f":"Lite!C40","v":"Are Web services provided?"},{"$f":"Lite!D40","v":0},{"$f":"Lite!E40","v":0},{"$f":"Lite!F40","v":0},{"$f":"Lite!G40","v":0},{"$f":"Lite!H40","v":"N/A"},{"$f":"Lite!I40","v":""},null,null,null,"N/A"]
[{"$f":"Lite!A41","v":0},{"$f":"Lite!M41","v":8},{"$f":"Lite!K41","v":1},{"$f":"Lite!Y41","v":1},{"$f":"Lite!B41","v":""},{"$f":"Lite!C41","v":"H. Access Control"},{"$f":"Lite!D41","v":0},{"$f":"Lite!E41","v":0},{"$f":"Lite!F41","v":0},{"$f":"Lite!G41","v":0},{"$f":"Lite!H41","v":0},{"$f":"Lite!I41","v":0}]
[{"$f":"Lite!A42","v":1998},{"$f":"Lite!M42","v":8},{"$f":"Lite!K42","v":"H"},{"$f":"Lite!Y42","v":0},{"$f":"Lite!B42","v":"SL.30"},{"$f":"Lite!C42","v":"Are electronic systems used to transmit, process or store Scoped Systems and Data?"},{"$f":"Lite!D42","v":0},{"$f":"Lite!E42","v":0},{"$f":"Lite!F42","v":0},{"$f":"Lite!G42","v":0},{"$f":"Lite!H42","v":"N/A"},{"$f":"Lite!I42","v":""},null,null,null,"N/A","N/A","N/A"]
[{"$f":"Lite!A43","v":1911},{"$f":"Lite!M43","v":8},{"$f":"Lite!K43","v":"H"},{"$f":"Lite!Y43","v":0},{"$f":"Lite!B43","v":"SL.31"},{"$f":"Lite!C43","v":"Are unique user IDs used for access?"},{"$f":"Lite!D43","v":0},{"$f":"Lite!E43","v":0},{"$f":"Lite!F43","v":0},{"$f":"Lite!G43","v":"H.1 Password Controls"},{"$f":"Lite!H43","v":"9.2.1.a"},{"$f":"Lite!I43","v":"User registration and de-registration"},null,"DS5.4","User account management","8.1.1","IS.2.A.2.1 IS.2.A.2.3 IS.2.A.4.7&\" \"&","DS5.4"]
[{"$f":"Lite!A44","v":1948},{"$f":"Lite!M44","v":8},{"$f":"Lite!K44","v":"H"},{"$f":"Lite!Y44","v":0},{"$f":"Lite!B44","v":"SL.32"},{"$f":"Lite!C44","v":"Are passwords required to access systems transmitting, processing or storing Scoped Systems and Data?"},{"$f":"Lite!D44","v":0},{"$f":"Lite!E44","v":0},{"$f":"Lite!F44","v":0},{"$f":"Lite!G44","v":"H.1 Password Controls"},{"$f":"Lite!H44","v":"9.4.3"},{"$f":"Lite!I44","v":"Password Management System"},null,"DS5.3","Identity management",8.1,"N/A","DS5.3"]
[{"$f":"Lite!A45","v":2028},{"$f":"Lite!M45","v":8},{"$f":"Lite!K45","v":"H"},{"$f":"Lite!Y45","v":0},{"$f":"Lite!B45","v":"SL.33"},{"$f":"Lite!C45","v":"Is remote access permitted?"},{"$f":"Lite!D45","v":0},{"$f":"Lite!E45","v":0},{"$f":"Lite!F45","v":0},{"$f":"Lite!G45","v":"H.7 Restrictions and Multifactor Authentication for Remote Access"},{"$f":"Lite!H45","v":6.2},{"$f":"Lite!I45","v":"Mobile devices and teleworking"},null,null,null,"N/A","N/A","AI1.2, AI2.4, DS5.7, DS5.10, DS5.11"]
[{"$f":"Lite!A46","v":0},{"$f":"Lite!M46","v":9},{"$f":"Lite!K46","v":1},{"$f":"Lite!Y46","v":1},{"$f":"Lite!B46","v":""},{"$f":"Lite!C46","v":"I. Information Systems Acquisition Development & Maintenance"},{"$f":"Lite!D46","v":0},{"$f":"Lite!E46","v":0},{"$f":"Lite!F46","v":0},{"$f":"Lite!G46","v":0},{"$f":"Lite!H46","v":0},{"$f":"Lite!I46","v":0}]
[{"$f":"Lite!A47","v":2665},{"$f":"Lite!M47","v":9},{"$f":"Lite!K47","v":"I"},{"$f":"Lite!Y47","v":0},{"$f":"Lite!B47","v":"SL.34"},{"$f":"Lite!C47","v":"Are business information systems used to transmit, process or store Scoped Systems and Data?"},{"$f":"Lite!D47","v":0},{"$f":"Lite!E47","v":0},{"$f":"Lite!F47","v":0},{"$f":"Lite!G47","v":0},{"$f":"Lite!H47","v":14.1},{"$f":"Lite!I47","v":"Security requirements of information systems"},null,"AI1.2","Risk analysis report","N/A","N/A","AI1.2, AI2.4, AI3.2"]
[{"$f":"Lite!A48","v":2058},{"$f":"Lite!M48","v":9},{"$f":"Lite!K48","v":"I"},{"$f":"Lite!Y48","v":0},{"$f":"Lite!B48","v":"SL.35"},{"$f":"Lite!C48","v":"Is application development performed?"},{"$f":"Lite!D48","v":0},{"$f":"Lite!E48","v":0},{"$f":"Lite!F48","v":0},{"$f":"Lite!G48","v":0},{"$f":"Lite!H48","v":"14.2.1"},{"$f":"Lite!I48","v":"Secure development policy"},null,"N/A",0,"N/A","N/A","AI2.4, AI7.4, AI7.6, DS11.3, DS11.6"]
[{"$f":"Lite!A49","v":2059},{"$f":"Lite!M49","v":9},{"$f":"Lite!K49","v":"I"},{"$f":"Lite!Y49","v":0},{"$f":"Lite!B49","v":"SL.36"},{"$f":"Lite!C49","v":"Is there a formal Software Development Life Cycle (SDLC) process?"},{"$f":"Lite!D49","v":0},{"$f":"Lite!E49","v":0},{"$f":"Lite!F49","v":0},{"$f":"Lite!G49","v":"I.7 Application Security SDLC Phases"},{"$f":"Lite!H49","v":"14.2.1 "},{"$f":"Lite!I49","v":"Secure development policy"},null,"N/A",0,"N/A","IS.1.4.1.8 MGMT.1.6.1.3","AI2.4, AI7.4, AI7.6, DS11.3, DS11.6"]
[{"$f":"Lite!A50","v":2213},{"$f":"Lite!M50","v":9},{"$f":"Lite!K50","v":"I"},{"$f":"Lite!Y50","v":0},{"$f":"Lite!B50","v":"SL.37"},{"$f":"Lite!C50","v":"Are systems and applications patched?"},{"$f":"Lite!D50","v":0},{"$f":"Lite!E50","v":0},{"$f":"Lite!F50","v":0},{"$f":"Lite!G50","v":"I.4 System Patching"},{"$f":"Lite!H50","v":"12.6.1 "},{"$f":"Lite!I50","v":"Management of technical vulnerabilities"},null,"AI3.3","Infrastructure maintenance",6.2,"D&A.1.11","AI3.3, AI6.2, AI6.3, DS5.5, DS5.7, DS9.2"]
[{"$f":"Lite!A51","v":2230},{"$f":"Lite!M51","v":9},{"$f":"Lite!K51","v":"I"},{"$f":"Lite!Y51","v":0},{"$f":"Lite!B51","v":"SL.38"},{"$f":"Lite!C51","v":"Is a web site supported, hosted or maintained that has access to Scoped Systems and Data?"},{"$f":"Lite!D51","v":0},{"$f":"Lite!E51","v":0},{"$f":"Lite!F51","v":0},{"$f":"Lite!G51","v":0},{"$f":"Lite!H51","v":"N/A"},{"$f":"Lite!I51","v":0},null,"N/A",0,"N/A","N/A","N/A"]
[{"$f":"Lite!A52","v":2225},{"$f":"Lite!M52","v":9},{"$f":"Lite!K52","v":"I"},{"$f":"Lite!Y52","v":0},{"$f":"Lite!B52","v":"SL.39"},{"$f":"Lite!C52","v":"Are vulnerability tests (internal/external) performed on all applications at least annually?"},{"$f":"Lite!D52","v":0},{"$f":"Lite!E52","v":0},{"$f":"Lite!F52","v":0},{"$f":"Lite!G52","v":"I.1 Application Vulnerability Assessments / Ethical Hacking"},{"$f":"Lite!H52","v":"18.2.3"},{"$f":"Lite!I52","v":"Technical compliance review"},null,"DS5.5","Security testing, surveillance and monitoring",11.2,"IS.2.M.10.3 E-BANK.1.2.5.2 E-BANK.1.1.1.8.3","DS5.5, DS5.7, ME2.5"]
[{"$f":"Lite!A53","v":1806},{"$f":"Lite!M53","v":9},{"$f":"Lite!K53","v":"I"},{"$f":"Lite!Y53","v":0},{"$f":"Lite!B53","v":"SL.40"},{"$f":"Lite!C53","v":"Are encryption tools managed and maintained for Scoped Data?"},{"$f":"Lite!D53","v":0},{"$f":"Lite!E53","v":0},{"$f":"Lite!F53","v":0},{"$f":"Lite!G53","v":"G.22 Data Security Policy - Encryption"},{"$f":"Lite!H53","v":10.1},{"$f":"Lite!I53","v":"Cryptographic controls"},null,"N/A",0,3.6,"WPS.2.5","N/A"]
[{"$f":"Lite!A54","v":0},{"$f":"Lite!M54","v":10},{"$f":"Lite!K54","v":1},{"$f":"Lite!Y54","v":1},{"$f":"Lite!B54","v":""},{"$f":"Lite!C54","v":"J. Incident Event and Communications Management"},{"$f":"Lite!D54","v":0},{"$f":"Lite!E54","v":0},{"$f":"Lite!F54","v":0},{"$f":"Lite!G54","v":0},{"$f":"Lite!H54","v":0},{"$f":"Lite!I54","v":0}]
[{"$f":"Lite!A55","v":2241},{"$f":"Lite!M55","v":10},{"$f":"Lite!K55","v":"J"},{"$f":"Lite!Y55","v":0},{"$f":"Lite!B55","v":"SL.41"},{"$f":"Lite!C55","v":"Is there an Incident Management program?"},{"$f":"Lite!D55","v":0},{"$f":"Lite!E55","v":0},{"$f":"Lite!F55","v":0},{"$f":"Lite!G55","v":"J.1 Information Security Incident Management\nP.8 Privacy Incident and Response Management"},{"$f":"Lite!H55","v":16},{"$f":"Lite!I55","v":"Information security incident management"},null,null,null,"N/A","IS.2.M.13 OPS.1.5.1.9 OPS.1.10","N/A"]
[{"$f":"Lite!A56","v":0},{"$f":"Lite!M56","v":11},{"$f":"Lite!K56","v":1},{"$f":"Lite!Y56","v":1},{"$f":"Lite!B56","v":""},{"$f":"Lite!C56","v":"K. Business Resiliency"},{"$f":"Lite!D56","v":0},{"$f":"Lite!E56","v":0},{"$f":"Lite!F56","v":0},{"$f":"Lite!G56","v":0},{"$f":"Lite!H56","v":"ISO 22301:2012 Relevance"}]
[{"$f":"Lite!A57","v":2719},{"$f":"Lite!M57","v":11},{"$f":"Lite!K57","v":"K"},{"$f":"Lite!Y57","v":0},{"$f":"Lite!B57","v":"SL.42"},{"$f":"Lite!C57","v":"Is there an established Business Resiliency program that has been approved by management and communicated to appropriate constituents?"},{"$f":"Lite!D57","v":0},{"$f":"Lite!E57","v":0},{"$f":"Lite!F57","v":0},{"$f":"Lite!G57","v":"K.1 Business Resiliency Governance"},{"$f":"Lite!H57","v":5.2},{"$f":"Lite!I57","v":"Management Commitment"},null,null,null,"N/A","AUDIT.2.F.2.3","N/A"]
[{"$f":"Lite!A58","v":2329},{"$f":"Lite!M58","v":11},{"$f":"Lite!K58","v":"K"},{"$f":"Lite!Y58","v":0},{"$f":"Lite!B58","v":"SL.43"},{"$f":"Lite!C58","v":"Has a Business Impact Analysis been conducted?"},{"$f":"Lite!D58","v":0},{"$f":"Lite!E58","v":0},{"$f":"Lite!F58","v":0},{"$f":"Lite!G58","v":"K.2 Business Impact Analysis"},{"$f":"Lite!H58","v":"8.2.2"},{"$f":"Lite!I58","v":"Business impact analysis"},null,"PO3.1","Technological direction planning","N/A","BCP.1.10.3 BCP.1.10.2 BCP.2.2.1 BCP.2.2.1.7 WPS.2.10.1.2 RPS.2.E.1.6 RPS.2.L.1","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[{"$f":"Lite!A59","v":4038},{"$f":"Lite!M59","v":11},{"$f":"Lite!K59","v":"K"},{"$f":"Lite!Y59","v":0},{"$f":"Lite!B59","v":"SL.44"},{"$f":"Lite!C59","v":"Is there a formal process focused on identifying and addressing risks of disruptive incidents to the organization?"},{"$f":"Lite!D59","v":0},{"$f":"Lite!E59","v":0},{"$f":"Lite!F59","v":0},{"$f":"Lite!G59","v":"K.3 Risk Assessment"},{"$f":"Lite!H59","v":"8.2.3"},{"$f":"Lite!I59","v":"Risk assessment"},null,"PO3.1","Technological direction planning","N/A","N/A","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10"]
[{"$f":"Lite!A60","v":4042},{"$f":"Lite!M60","v":11},{"$f":"Lite!K60","v":"K"},{"$f":"Lite!Y60","v":0},{"$f":"Lite!B60","v":"SL.45"},{"$f":"Lite!C60","v":"Are specific response and recovery strategies defined for the prioritized activities?"},{"$f":"Lite!D60","v":0},{"$f":"Lite!E60","v":0},{"$f":"Lite!F60","v":0},{"$f":"Lite!G60","v":"K.4 Response and Recovery Strategy"},{"$f":"Lite!H60","v":"8.3.1"},{"$f":"Lite!I60","v":"Determination and selection"},null,"PO9.1","IT and business risk management alignment management process","N/A","BCP.1.8.1","PO9.1, PO9.2, PO9.4, DS4.1, DS4.3"]
[{"$f":"Lite!A61","v":4049},{"$f":"Lite!M61","v":11},{"$f":"Lite!K61","v":"K"},{"$f":"Lite!Y61","v":0},{"$f":"Lite!B61","v":"SL.46"},{"$f":"Lite!C61","v":"Are formal business continuity procedures developed and documented?"},{"$f":"Lite!D61","v":0},{"$f":"Lite!E61","v":0},{"$f":"Lite!F61","v":0},{"$f":"Lite!G61","v":"K.5 Business Activity Level Recovery Planning"},{"$f":"Lite!H61","v":8.4},{"$f":"Lite!I61","v":"Establish and implement business continuity procedures"},null,"PO9.1","IT and business risk management alignment management process","N/A","BCP.1.3","PO9.1, PO9.2, PO9.4, DS4.1, DS4.3"]
[{"$f":"Lite!A62","v":4054},{"$f":"Lite!M62","v":11},{"$f":"Lite!K62","v":"K"},{"$f":"Lite!Y62","v":0},{"$f":"Lite!B62","v":"SL.47"},{"$f":"Lite!C62","v":"Has senior management assigned the responsibility for the overall management of the response and recovery efforts?"},{"$f":"Lite!D62","v":0},{"$f":"Lite!E62","v":0},{"$f":"Lite!F62","v":0},{"$f":"Lite!G62","v":"K.1 Business Resiliency Governance"},{"$f":"Lite!H62","v":"N/A"},{"$f":"Lite!I62","v":0},null,"PO3.1","Technological direction planning","N/A","BCP.1.4.3.10 MGMT.1.3.8","PO3.1, PO9.1, PO9.2, DS4.1, DS4.3, DS4.8, DS8.3"]
[{"$f":"Lite!A63","v":2286},{"$f":"Lite!M63","v":11},{"$f":"Lite!K63","v":"K"},{"$f":"Lite!Y63","v":0},{"$f":"Lite!B63","v":"SL.48"},{"$f":"Lite!C63","v":"Is there a periodic (at least annual) review of your Business Resiliency Program?"},{"$f":"Lite!D63","v":0},{"$f":"Lite!E63","v":0},{"$f":"Lite!F63","v":0},{"$f":"Lite!G63","v":"K.7 Exercising"},{"$f":"Lite!H63","v":"8.4.1"},{"$f":"Lite!I63","v":"Establish and implement business continuity procedures"}]
[{"$f":"Lite!A64","v":2729},{"$f":"Lite!M64","v":11},{"$f":"Lite!K64","v":"K"},{"$f":"Lite!Y64","v":0},{"$f":"Lite!B64","v":"SL.49"},{"$f":"Lite!C64","v":"Are there any dependencies on critical third party service providers?"},{"$f":"Lite!D64","v":0},{"$f":"Lite!E64","v":0},{"$f":"Lite!F64","v":0},{"$f":"Lite!G64","v":"K.2 Business Impact Analysis"},{"$f":"Lite!H64","v":"8.1\n\n8.3\n8.3.1\n\n8.44"},{"$f":"Lite!I64","v":"Operational Planning and Control\r\nBusiness continuity strategy\r\nDetermination and selection\r\nBusiness continuity plans"}]
[{"$f":"Lite!A65","v":2343},{"$f":"Lite!M65","v":11},{"$f":"Lite!K65","v":"K"},{"$f":"Lite!Y65","v":0},{"$f":"Lite!B65","v":"SL.50"},{"$f":"Lite!C65","v":"Is there a formal, documented exercise and testing program in place?"},{"$f":"Lite!D65","v":0},{"$f":"Lite!E65","v":0},{"$f":"Lite!F65","v":0},{"$f":"Lite!G65","v":"K.7 Exercising"},{"$f":"Lite!H65","v":8.5},{"$f":"Lite!I65","v":"Exercising and testing"}]
[{"$f":"Lite!A66","v":2305},{"$f":"Lite!M66","v":11},{"$f":"Lite!K66","v":"K"},{"$f":"Lite!Y66","v":0},{"$f":"Lite!B66","v":"SL.51"},{"$f":"Lite!C66","v":"Is there an Influenza Pandemic/Infectious Disease Outbreak Plan?"},{"$f":"Lite!D66","v":0},{"$f":"Lite!E66","v":0},{"$f":"Lite!F66","v":0},{"$f":"Lite!G66","v":"K.8 Infectious Disease Planning"},{"$f":"Lite!H66","v":"N/A"},{"$f":"Lite!I66","v":0}]
[{"$f":"Lite!A67","v":2365},{"$f":"Lite!M67","v":11},{"$f":"Lite!K67","v":"K"},{"$f":"Lite!Y67","v":0},{"$f":"Lite!B67","v":"SL.52"},{"$f":"Lite!C67","v":"Is there insurance coverage for business interruptions or general services interruption?"},{"$f":"Lite!D67","v":0},{"$f":"Lite!E67","v":0},{"$f":"Lite!F67","v":0},{"$f":"Lite!G67","v":"K.9 Business Insurance"},{"$f":"Lite!H67","v":"N/A"},{"$f":"Lite!I67","v":0}]
[{"$f":"Lite!A68","v":0},{"$f":"Lite!M68","v":12},{"$f":"Lite!K68","v":1},{"$f":"Lite!Y68","v":1},{"$f":"Lite!B68","v":""},{"$f":"Lite!C68","v":"L. Compliance"},{"$f":"Lite!D68","v":0},{"$f":"Lite!E68","v":0},{"$f":"Lite!F68","v":0},{"$f":"Lite!G68","v":0},{"$f":"Lite!H68","v":0},{"$f":"Lite!I68","v":0}]
[{"$f":"Lite!A69","v":2826},{"$f":"Lite!M69","v":12},{"$f":"Lite!K69","v":"L"},{"$f":"Lite!Y69","v":0},{"$f":"Lite!B69","v":"SL.53"},{"$f":"Lite!C69","v":"Is there an internal audit, risk management, or compliance department, or other management oversight unit with responsibility for identifying and tracking resolution of outstanding regulatory issues?"},{"$f":"Lite!D69","v":0},{"$f":"Lite!E69","v":0},{"$f":"Lite!F69","v":0},{"$f":"Lite!G69","v":"L.3 Monitoring and Reporting - Compliance Reporting\nL.4 Monitoring and Reporting - Compliance"},{"$f":"Lite!H69","v":"18.1.1 "},{"$f":"Lite!I69","v":"Identification of applicable legislation and contractual requirements"},null,"PO4.4","Organisational placement of the IT function","N/A","MGMT.1.2.1.15.2 RPS.1.4.3","PO4.4, PO4.5, PO4.6, PO4.8, PO4.10, PO6.5, DS5.1, DS5.2, DS5.3"]
[{"$f":"Lite!A70","v":4126},{"$f":"Lite!M70","v":12},{"$f":"Lite!K70","v":"L"},{"$f":"Lite!Y70","v":0},{"$f":"Lite!B70","v":"SL.54"},{"$f":"Lite!C70","v":"Are there policies and procedures to ensure compliance with applicable legislative, regulatory and contractual requirements to address intellectual property rights on business processes or information technology software products?"},{"$f":"Lite!D70","v":0},{"$f":"Lite!E70","v":0},{"$f":"Lite!F70","v":0},{"$f":"Lite!G70","v":"L. Compliance"},{"$f":"Lite!H70","v":"NA"},{"$f":"Lite!I70","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A71","v":2837},{"$f":"Lite!M71","v":12},{"$f":"Lite!K71","v":"L"},{"$f":"Lite!Y71","v":0},{"$f":"Lite!B71","v":"SL.55"},{"$f":"Lite!C71","v":"Is there a records retention policy covering paper & electronic records, including email in support of applicable regulations, standards and contractual requirements?"},{"$f":"Lite!D71","v":0},{"$f":"Lite!E71","v":0},{"$f":"Lite!F71","v":0},{"$f":"Lite!G71","v":"D.1 Asset Accounting and Inventory"},{"$f":"Lite!H71","v":"18.1.3 "},{"$f":"Lite!I71","v":"Protection of records"}]
[{"$f":"Lite!A72","v":4127},{"$f":"Lite!M72","v":12},{"$f":"Lite!K72","v":"L"},{"$f":"Lite!Y72","v":0},{"$f":"Lite!B72","v":"SL.56"},{"$f":"Lite!C72","v":"Is licensing maintained in all jurisdictions where the business is or where licensing is required?"},{"$f":"Lite!D72","v":0},{"$f":"Lite!E72","v":0},{"$f":"Lite!F72","v":0},{"$f":"Lite!G72","v":0},{"$f":"Lite!H72","v":"NA"},{"$f":"Lite!I72","v":0}]
[{"$f":"Lite!A73","v":3733},{"$f":"Lite!M73","v":12},{"$f":"Lite!K73","v":"L"},{"$f":"Lite!Y73","v":0},{"$f":"Lite!B73","v":"SL.57"},{"$f":"Lite!C73","v":"Is there an internal compliance and ethics program to ensure professional ethics and business practices are implemented?"},{"$f":"Lite!D73","v":0},{"$f":"Lite!E73","v":0},{"$f":"Lite!F73","v":0},{"$f":"Lite!G73","v":"A.4 Professional Ethics and Business Practices"},{"$f":"Lite!H73","v":"NA"},{"$f":"Lite!I73","v":0}]
[{"$f":"Lite!A74","v":4135},{"$f":"Lite!M74","v":12},{"$f":"Lite!K74","v":"L"},{"$f":"Lite!Y74","v":0},{"$f":"Lite!B74","v":"SL.58"},{"$f":"Lite!C74","v":"Are marketing or selling activities conducted directly to client's customers?"},{"$f":"Lite!D74","v":0},{"$f":"Lite!E74","v":0},{"$f":"Lite!F74","v":0},{"$f":"Lite!G74","v":0},{"$f":"Lite!H74","v":"NA"},{"$f":"Lite!I74","v":0}]
[{"$f":"Lite!A75","v":4141},{"$f":"Lite!M75","v":12},{"$f":"Lite!K75","v":"L"},{"$f":"Lite!Y75","v":0},{"$f":"Lite!B75","v":"SL.59"},{"$f":"Lite!C75","v":"Are there direct interactions with your client's customers?"},{"$f":"Lite!D75","v":0},{"$f":"Lite!E75","v":0},{"$f":"Lite!F75","v":0},{"$f":"Lite!G75","v":0},{"$f":"Lite!H75","v":"NA"},{"$f":"Lite!I75","v":0}]
[{"$f":"Lite!A76","v":4147},{"$f":"Lite!M76","v":12},{"$f":"Lite!K76","v":"L"},{"$f":"Lite!Y76","v":0},{"$f":"Lite!B76","v":"SL.60"},{"$f":"Lite!C76","v":"Are policies and procedures maintained for enabling compliance with applicable legal, regulatory, statutory, or contractual obligations related to any information security requirements? "},{"$f":"Lite!D76","v":0},{"$f":"Lite!E76","v":0},{"$f":"Lite!F76","v":0},{"$f":"Lite!G76","v":"A.3 Legal, Regulatory, and Standards Compliance"},{"$f":"Lite!H76","v":"NA"},{"$f":"Lite!I76","v":0}]
[{"$f":"Lite!A77","v":4151},{"$f":"Lite!M77","v":12},{"$f":"Lite!K77","v":"L"},{"$f":"Lite!Y77","v":0},{"$f":"Lite!B77","v":"SL.61"},{"$f":"Lite!C77","v":"Is there a formalized governance process to identify and assess changes that could significantly affect the system of internal controls for security, confidentiality and availability?"},{"$f":"Lite!D77","v":0},{"$f":"Lite!E77","v":0},{"$f":"Lite!F77","v":0},{"$f":"Lite!G77","v":"G.21 Change Control\nL.3 Procedure b.3.i"},{"$f":"Lite!H77","v":"NA"},{"$f":"Lite!I77","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A78","v":4154},{"$f":"Lite!M78","v":12},{"$f":"Lite!K78","v":"L"},{"$f":"Lite!Y78","v":0},{"$f":"Lite!B78","v":"SL.62"},{"$f":"Lite!C78","v":"Are accounts opened, transactions initiated or other account initiation activity applying payments, taking payments, transferring funds, etc. through either electronic, telephonic, written or in-person requests made on behalf of your client's?"},{"$f":"Lite!D78","v":0},{"$f":"Lite!E78","v":0},{"$f":"Lite!F78","v":0},{"$f":"Lite!G78","v":0},{"$f":"Lite!H78","v":"NA"},{"$f":"Lite!I78","v":0}]
[{"$f":"Lite!A79","v":0},{"$f":"Lite!M79","v":13},{"$f":"Lite!K79","v":1},{"$f":"Lite!Y79","v":1},{"$f":"Lite!B79","v":""},{"$f":"Lite!C79","v":"M. Mobile"},{"$f":"Lite!D79","v":0},{"$f":"Lite!E79","v":0},{"$f":"Lite!F79","v":0},{"$f":"Lite!G79","v":0},{"$f":"Lite!H79","v":0},{"$f":"Lite!I79","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A80","v":4090},{"$f":"Lite!M80","v":13},{"$f":"Lite!K80","v":"M"},{"$f":"Lite!Y80","v":0},{"$f":"Lite!B80","v":"SL.63"},{"$f":"Lite!C80","v":"Are constituents allowed to utilize mobile devices within your environment? If yes, which of the following functions are allowed:"},{"$f":"Lite!D80","v":0},{"$f":"Lite!E80","v":0},{"$f":"Lite!F80","v":0},{"$f":"Lite!G80","v":0},{"$f":"Lite!H80","v":6.2},{"$f":"Lite!I80","v":"Mobile devices and teleworking"},null,null,null,"N/A"]
[{"$f":"Lite!A81","v":4091},{"$f":"Lite!M81","v":13},{"$f":"Lite!K81","v":"M"},{"$f":"Lite!Y81","v":0},{"$f":"Lite!B81","v":"SL.64"},{"$f":"Lite!C81","v":"View Scoped Data?"},{"$f":"Lite!D81","v":0},{"$f":"Lite!E81","v":0},{"$f":"Lite!F81","v":0},{"$f":"Lite!G81","v":0},{"$f":"Lite!H81","v":0},{"$f":"Lite!I81","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A82","v":4092},{"$f":"Lite!M82","v":13},{"$f":"Lite!K82","v":"M"},{"$f":"Lite!Y82","v":0},{"$f":"Lite!B82","v":"SL.65"},{"$f":"Lite!C82","v":"Process Scoped Data?"},{"$f":"Lite!D82","v":0},{"$f":"Lite!E82","v":0},{"$f":"Lite!F82","v":0},{"$f":"Lite!G82","v":0},{"$f":"Lite!H82","v":0},{"$f":"Lite!I82","v":0}]
[{"$f":"Lite!A83","v":4093},{"$f":"Lite!M83","v":13},{"$f":"Lite!K83","v":"M"},{"$f":"Lite!Y83","v":0},{"$f":"Lite!B83","v":"SL.66"},{"$f":"Lite!C83","v":"Delete Scoped Data?"},{"$f":"Lite!D83","v":0},{"$f":"Lite!E83","v":0},{"$f":"Lite!F83","v":0},{"$f":"Lite!G83","v":0},{"$f":"Lite!H83","v":0},{"$f":"Lite!I83","v":0}]
[{"$f":"Lite!A84","v":4094},{"$f":"Lite!M84","v":13},{"$f":"Lite!K84","v":"M"},{"$f":"Lite!Y84","v":0},{"$f":"Lite!B84","v":"SL.67"},{"$f":"Lite!C84","v":"Store Scoped Data?"},{"$f":"Lite!D84","v":0},{"$f":"Lite!E84","v":0},{"$f":"Lite!F84","v":0},{"$f":"Lite!G84","v":0},{"$f":"Lite!H84","v":0},{"$f":"Lite!I84","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A85","v":4097},{"$f":"Lite!M85","v":13},{"$f":"Lite!K85","v":"M"},{"$f":"Lite!Y85","v":0},{"$f":"Lite!B85","v":"SL.68"},{"$f":"Lite!C85","v":"Is there a mobile device management program in place that has been approved by management and communicated to appropriate constituents?"},{"$f":"Lite!D85","v":0},{"$f":"Lite!E85","v":0},{"$f":"Lite!F85","v":0},{"$f":"Lite!G85","v":0},{"$f":"Lite!H85","v":0},{"$f":"Lite!I85","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A86","v":0},{"$f":"Lite!M86","v":14},{"$f":"Lite!K86","v":1},{"$f":"Lite!Y86","v":1},{"$f":"Lite!B86","v":""},{"$f":"Lite!C86","v":"P. Privacy"},{"$f":"Lite!D86","v":0},{"$f":"Lite!E86","v":0},{"$f":"Lite!F86","v":0},{"$f":"Lite!G86","v":0},{"$f":"Lite!H86","v":0},{"$f":"Lite!I86","v":0}]
[{"$f":"Lite!A87","v":3687},{"$f":"Lite!M87","v":14},{"$f":"Lite!K87","v":"P"},{"$f":"Lite!Y87","v":0},{"$f":"Lite!B87","v":"SL.69"},{"$f":"Lite!C87","v":"Is Scoped Data transmitted, processed, or stored that can be classified as non-public information (NPI), personally identifiable information (PII), or sensitive customer financial information? If yes, describe and list types of data."},{"$f":"Lite!D87","v":0},{"$f":"Lite!E87","v":0},{"$f":"Lite!F87","v":0},{"$f":"Lite!G87","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"Lite!H87","v":"8.2.1"},{"$f":"Lite!I87","v":"Classification of Information"},null,null,null,"N/A"]
[{"$f":"Lite!A88","v":3694},{"$f":"Lite!M88","v":14},{"$f":"Lite!K88","v":"P"},{"$f":"Lite!Y88","v":0},{"$f":"Lite!B88","v":"SL.70"},{"$f":"Lite!C88","v":"Is Scoped Data transmitted, processed, or stored that can be classified as protected health information, electronic health records, or personal health records? If yes, identify the classifications."},{"$f":"Lite!D88","v":0},{"$f":"Lite!E88","v":0},{"$f":"Lite!F88","v":0},{"$f":"Lite!G88","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"Lite!H88","v":"8.2.2"},{"$f":"Lite!I88","v":"Classification of Information"},null,null,null,"N/A"]
[{"$f":"Lite!A89","v":3704},{"$f":"Lite!M89","v":14},{"$f":"Lite!K89","v":"P"},{"$f":"Lite!Y89","v":0},{"$f":"Lite!B89","v":"SL.71"},{"$f":"Lite!C89","v":"For Scoped Data, is personal information about individuals transmitted to or received from countries outside the United States? If yes, identify the countries."},{"$f":"Lite!D89","v":0},{"$f":"Lite!E89","v":0},{"$f":"Lite!F89","v":0},{"$f":"Lite!G89","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"Lite!H89","v":"N/A"},{"$f":"Lite!I89","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A90","v":3872},{"$f":"Lite!M90","v":14},{"$f":"Lite!K90","v":"P"},{"$f":"Lite!Y90","v":0},{"$f":"Lite!B90","v":"SL.72"},{"$f":"Lite!C90","v":"For Scoped Data is there a dedicated person (or group) responsible for privacy compliance. If yes, describe. If no, explain reason."},{"$f":"Lite!D90","v":0},{"$f":"Lite!E90","v":0},{"$f":"Lite!F90","v":0},{"$f":"Lite!G90","v":"P.3 Privacy Organization and Program Maintenance"},{"$f":"Lite!H90","v":"16.1.1.b.3 "},{"$f":"Lite!I90","v":"Responsibilities and procedures"},null,null,null,"N/A"]
[{"$f":"Lite!A91","v":3873},{"$f":"Lite!M91","v":14},{"$f":"Lite!K91","v":"P"},{"$f":"Lite!Y91","v":0},{"$f":"Lite!B91","v":"SL.73"},{"$f":"Lite!C91","v":"For Scoped Data, is there a documented privacy policy or procedures to protect confidential information?"},{"$f":"Lite!D91","v":0},{"$f":"Lite!E91","v":0},{"$f":"Lite!F91","v":0},{"$f":"Lite!G91","v":"P.2 Privacy Policy and Privacy Notices"},{"$f":"Lite!H91","v":"15.1.1"},{"$f":"Lite!I91","v":"Information security policy for supplier relationships"},null,null,null,"N/A"]
[{"$f":"Lite!A92","v":3225},{"$f":"Lite!M92","v":14},{"$f":"Lite!K92","v":"P"},{"$f":"Lite!Y92","v":0},{"$f":"Lite!B92","v":"SL.74"},{"$f":"Lite!C92","v":"For Scoped Data are there regular privacy risk assessments conducted? If yes, provide frequency and scope. If no, explain reason."},{"$f":"Lite!D92","v":0},{"$f":"Lite!E92","v":0},{"$f":"Lite!F92","v":0},{"$f":"Lite!G92","v":"P.3 Privacy Organization and Program Maintenance"},{"$f":"Lite!H92","v":"15.1.3.i "},{"$f":"Lite!I92","v":"Information and communication technology supply chain"},null,null,null,"N/A"]
[{"$f":"Lite!A93","v":3228},{"$f":"Lite!M93","v":14},{"$f":"Lite!K93","v":"P"},{"$f":"Lite!Y93","v":0},{"$f":"Lite!B93","v":"SL.75"},{"$f":"Lite!C93","v":"Is there formal privacy awareness training for employees, contractors, and third-party users to ensure confidentiality and privacy of Scoped Data?"},{"$f":"Lite!D93","v":0},{"$f":"Lite!E93","v":0},{"$f":"Lite!F93","v":0},{"$f":"Lite!G93","v":"P.7 Privacy Awareness"},{"$f":"Lite!H93","v":"7.2.2 "},{"$f":"Lite!I93","v":"Information security awareness, education and training"},null,null,null,"N/A"]
[{"$f":"Lite!A94","v":3874},{"$f":"Lite!M94","v":14},{"$f":"Lite!K94","v":"P"},{"$f":"Lite!Y94","v":0},{"$f":"Lite!B94","v":"SL.76"},{"$f":"Lite!C94","v":"Is there a formal process for reporting and responding to privacy complaints or privacy incidents for Scoped Data? If yes, describe. If no, explain reason."},{"$f":"Lite!D94","v":0},{"$f":"Lite!E94","v":0},{"$f":"Lite!F94","v":0},{"$f":"Lite!G94","v":"P.8 Privacy Event Notification and Response Management"},{"$f":"Lite!H94","v":"16.1.1 "},{"$f":"Lite!I94","v":"Responsibilities and procedures"}]
[{"$f":"Lite!A95","v":3723},{"$f":"Lite!M95","v":14},{"$f":"Lite!K95","v":"P"},{"$f":"Lite!Y95","v":0},{"$f":"Lite!B95","v":"SL.77"},{"$f":"Lite!C95","v":"Is there a data classification and retention program for Scoped Data that identifies the data types that require additional management and governance?"},{"$f":"Lite!D95","v":0},{"$f":"Lite!E95","v":0},{"$f":"Lite!F95","v":0},{"$f":"Lite!G95","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"Lite!H95","v":8.1999999999999993},{"$f":"Lite!I95","v":"Information Classification"}]
[{"$f":"Lite!A96","v":3234},{"$f":"Lite!M96","v":14},{"$f":"Lite!K96","v":"P"},{"$f":"Lite!Y96","v":0},{"$f":"Lite!B96","v":"SL.78"},{"$f":"Lite!C96","v":"Is there a documented response program to address privacy incidents, unauthorized disclosure, unauthorized access or breach of Scoped Data?"},{"$f":"Lite!D96","v":0},{"$f":"Lite!E96","v":0},{"$f":"Lite!F96","v":0},{"$f":"Lite!G96","v":"P.8 Privacy Event Notification and Response Management"},{"$f":"Lite!H96","v":"16.1.1 "},{"$f":"Lite!I96","v":"Responsibilities and procedures"}]
[{"$f":"Lite!A97","v":3715},{"$f":"Lite!M97","v":14},{"$f":"Lite!K97","v":"P"},{"$f":"Lite!Y97","v":0},{"$f":"Lite!B97","v":"SL.79"},{"$f":"Lite!C97","v":"Is Scoped Data disclosed to third parties? If yes, describe"},{"$f":"Lite!D97","v":0},{"$f":"Lite!E97","v":0},{"$f":"Lite!F97","v":0},{"$f":"Lite!G97","v":0},{"$f":"Lite!H97","v":0},{"$f":"Lite!I97","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A98","v":3269},{"$f":"Lite!M98","v":14},{"$f":"Lite!K98","v":"P"},{"$f":"Lite!Y98","v":0},{"$f":"Lite!B98","v":"SL.80"},{"$f":"Lite!C98","v":"Is Scoped Data disclosed to third parties outside of the U.S.? If yes, describe."},{"$f":"Lite!D98","v":0},{"$f":"Lite!E98","v":0},{"$f":"Lite!F98","v":0},{"$f":"Lite!G98","v":0},{"$f":"Lite!H98","v":0},{"$f":"Lite!I98","v":0}]
[{"$f":"Lite!A99","v":3270},{"$f":"Lite!M99","v":14},{"$f":"Lite!K99","v":"P"},{"$f":"Lite!Y99","v":0},{"$f":"Lite!B99","v":"SL.81"},{"$f":"Lite!C99","v":"Are there contractual controls to ensure that Scoped Data shared with third parties is limited to defined parameters for access, use and disclosure? If yes, describe the controls, If no, explain reason."},{"$f":"Lite!D99","v":0},{"$f":"Lite!E99","v":0},{"$f":"Lite!F99","v":0},{"$f":"Lite!G99","v":"P.4 Privacy Third Party Agreements"},{"$f":"Lite!H99","v":"15.1.2 "},{"$f":"Lite!I99","v":"Addressing security within supplier agreements"},null,null,null,"N/A"]
[{"$f":"Lite!A100","v":3701},{"$f":"Lite!M100","v":14},{"$f":"Lite!K100","v":"P"},{"$f":"Lite!Y100","v":0},{"$f":"Lite!B100","v":"SL.82"},{"$f":"Lite!C100","v":"Is there a business associate contract in place to address obligations for the privacy and security requirements of the services provided?"},{"$f":"Lite!D100","v":0},{"$f":"Lite!E100","v":0},{"$f":"Lite!F100","v":0},{"$f":"Lite!G100","v":"P.4 Privacy Third Party Agreements"},{"$f":"Lite!H100","v":"15.1.2 "},{"$f":"Lite!I100","v":"Addressing security within supplier agreements"}]
[{"$f":"Lite!A101","v":3718},{"$f":"Lite!M101","v":14},{"$f":"Lite!K101","v":"P"},{"$f":"Lite!Y101","v":0},{"$f":"Lite!B101","v":"SL.83"},{"$f":"Lite!C101","v":"Is there a documented privacy program with administrative, technical, and physical safeguards for the protection of Scoped Data?"},{"$f":"Lite!D101","v":0},{"$f":"Lite!E101","v":0},{"$f":"Lite!F101","v":0},{"$f":"Lite!G101","v":"P.2 Privacy Policy and Privacy Notices"},{"$f":"Lite!H101","v":"15.1.1"},{"$f":"Lite!I101","v":"Information security policy for supplier relationships"}]
[{"$f":"Lite!A102","v":3875},{"$f":"Lite!M102","v":14},{"$f":"Lite!K102","v":"P"},{"$f":"Lite!Y102","v":0},{"$f":"Lite!B102","v":"SL.84"},{"$f":"Lite!C102","v":"Is there a process for ensuring the accuracy of Scoped Data at the direction of the client? If yes, describe. If no, explain reason."},{"$f":"Lite!D102","v":0},{"$f":"Lite!E102","v":0},{"$f":"Lite!F102","v":0},{"$f":"Lite!G102","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"Lite!H102","v":"8.2.3"},{"$f":"Lite!I102","v":"Handling of assets"},null,null,null,"N/A"]
[{"$f":"Lite!A103","v":3876},{"$f":"Lite!M103","v":14},{"$f":"Lite!K103","v":"P"},{"$f":"Lite!Y103","v":0},{"$f":"Lite!B103","v":"SL.85"},{"$f":"Lite!C103","v":"Is there a process to ensure that the personal information provided by an individual is limited for the purposes described in the respondent's privacy notice? If yes, describe. If no, explain reason."},{"$f":"Lite!D103","v":0},{"$f":"Lite!E103","v":0},{"$f":"Lite!F103","v":0},{"$f":"Lite!G103","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"Lite!H103","v":"8.2.4"},{"$f":"Lite!I103","v":"Handling of assets"},null,null,null,"N/A"]
[{"$f":"Lite!A104","v":3877},{"$f":"Lite!M104","v":14},{"$f":"Lite!K104","v":"P"},{"$f":"Lite!Y104","v":0},{"$f":"Lite!B104","v":"SL.86"},{"$f":"Lite!C104","v":"Are constituents regularly monitored for privacy compliance? If yes, describe. If no, explain reason."},{"$f":"Lite!D104","v":0},{"$f":"Lite!E104","v":0},{"$f":"Lite!F104","v":0},{"$f":"Lite!G104","v":0},{"$f":"Lite!H104","v":0},{"$f":"Lite!I104","v":0}]
[{"$f":"Lite!A105","v":3724},{"$f":"Lite!M105","v":14},{"$f":"Lite!K105","v":"P"},{"$f":"Lite!Y105","v":0},{"$f":"Lite!B105","v":"SL.87"},{"$f":"Lite!C105","v":"Are there documented policies, procedures, and controls to limit access based on need to know or minimum necessary for constituents? If yes, describe."},{"$f":"Lite!D105","v":0},{"$f":"Lite!E105","v":0},{"$f":"Lite!F105","v":0},{"$f":"Lite!G105","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"Lite!H105","v":"9.1.1.b"},{"$f":"Lite!I105","v":"Access control policy"},null,null,null,"N/A",null,null,"WP.1.A.1, WP.1.A.2"]
[{"$f":"Lite!A106","v":3879},{"$f":"Lite!M106","v":14},{"$f":"Lite!K106","v":"P"},{"$f":"Lite!Y106","v":0},{"$f":"Lite!B106","v":"SL.88"},{"$f":"Lite!C106","v":"Are enforcement mechanisms applied to constituents who violate privacy policies or confidentiality requirements?"},{"$f":"Lite!D106","v":0},{"$f":"Lite!E106","v":0},{"$f":"Lite!F106","v":0},{"$f":"Lite!G106","v":0},{"$f":"Lite!H106","v":0},{"$f":"Lite!I106","v":0},null,null,null,"N/A",null,null,"WP.1.A.1, WP.1.A.2"]
[{"$f":"Lite!A107","v":3729},{"$f":"Lite!M107","v":14},{"$f":"Lite!K107","v":"P"},{"$f":"Lite!Y107","v":0},{"$f":"Lite!B107","v":"SL.89"},{"$f":"Lite!C107","v":"Are transactions for covered accounts accessed, modified, or processed, including address changes and discrepancies? If yes, describe."},{"$f":"Lite!D107","v":0},{"$f":"Lite!E107","v":0},{"$f":"Lite!F107","v":0},{"$f":"Lite!G107","v":0},{"$f":"Lite!H107","v":0},{"$f":"Lite!I107","v":0},null,null,null,"N/A",null,null,"WP.1.A.1, WP.1.A.2"]
[{"$f":"Lite!A108","v":3739},{"$f":"Lite!M108","v":14},{"$f":"Lite!K108","v":"P"},{"$f":"Lite!Y108","v":0},{"$f":"Lite!B108","v":"SL.90"},{"$f":"Lite!C108","v":"Is customer data accessed, transmitted, processed, or stored that can be classified as consumer report information provided by a consumer reporting agency?"},{"$f":"Lite!D108","v":0},{"$f":"Lite!E108","v":0},{"$f":"Lite!F108","v":0},{"$f":"Lite!G108","v":0},{"$f":"Lite!H108","v":0},{"$f":"Lite!I108","v":0},null,null,null,"N/A",null,null,"WP.1.A.1, WP.1.A.2"]
[{"$f":"Lite!A109","v":0},{"$f":"Lite!M109","v":15},{"$f":"Lite!K109","v":1},{"$f":"Lite!Y109","v":1},{"$f":"Lite!B109","v":""},{"$f":"Lite!C109","v":"Q. Software Application Security"},{"$f":"Lite!D109","v":0},{"$f":"Lite!E109","v":0},{"$f":"Lite!F109","v":0},{"$f":"Lite!G109","v":0},{"$f":"Lite!H109","v":0},{"$f":"Lite!I109","v":0},null,null,null,"N/A",null,null,"WP.1.E.1"]
[{"$f":"Lite!A110","v":3919},{"$f":"Lite!M110","v":15},{"$f":"Lite!K110","v":"Q"},{"$f":"Lite!Y110","v":0},{"$f":"Lite!B110","v":"SL.91"},{"$f":"Lite!C110","v":"Is software provided?  "},{"$f":"Lite!D110","v":0},{"$f":"Lite!E110","v":0},{"$f":"Lite!F110","v":0},{"$f":"Lite!G110","v":"Q. Software Application Security"},{"$f":"Lite!H110","v":"N/A"},{"$f":"Lite!I110","v":0},null,null,null,"N/A",null,null,"WP.1.E.1"]
[{"$f":"Lite!A111","v":3920},{"$f":"Lite!M111","v":15},{"$f":"Lite!K111","v":"Q"},{"$f":"Lite!Y111","v":0},{"$f":"Lite!B111","v":"SL.92"},{"$f":"Lite!C111","v":"Is there a secure software development lifecycle policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy? "},{"$f":"Lite!D111","v":0},{"$f":"Lite!E111","v":0},{"$f":"Lite!F111","v":0},{"$f":"Lite!G111","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"Lite!H111","v":"14.2.1 "},{"$f":"Lite!I111","v":"Secure development policy"},null,null,null,"N/A",null,null,"WP.1.E.1"]
[{"$f":"Lite!A112","v":0},{"$f":"Lite!M112","v":16},{"$f":"Lite!K112","v":1},{"$f":"Lite!Y112","v":1},{"$f":"Lite!B112","v":""},{"$f":"Lite!C112","v":"V. Cloud Security"},{"$f":"Lite!D112","v":0},{"$f":"Lite!E112","v":0},{"$f":"Lite!F112","v":0},{"$f":"Lite!G112","v":0},{"$f":"Lite!H112","v":0},{"$f":"Lite!I112","v":0},null,null,null,"N/A",null,null,"WP.1.E.1"]
[{"$f":"Lite!A113","v":3304},{"$f":"Lite!M113","v":16},{"$f":"Lite!K113","v":"V"},{"$f":"Lite!Y113","v":0},{"$f":"Lite!B113","v":"SL.93"},{"$f":"Lite!C113","v":"Are Cloud Services provided? If yes, what service model and deployment model is provided (select all that apply):"},{"$f":"Lite!D113","v":0},{"$f":"Lite!E113","v":0},{"$f":"Lite!F113","v":0},{"$f":"Lite!G113","v":"V.1 Service and Deployment Models"},{"$f":"Lite!H113","v":4.3},{"$f":"Lite!I113","v":"Determining the scope of the information management system"},null,null,null,"N/A",null,null,"WP.1.G.3"]
[{"$f":"Lite!A114","v":3305},{"$f":"Lite!M114","v":16},{"$f":"Lite!K114","v":"V"},{"$f":"Lite!Y114","v":0},{"$f":"Lite!B114","v":"SL.94"},{"$f":"Lite!C114","v":"Software as a Service (SaaS)"},{"$f":"Lite!D114","v":0},{"$f":"Lite!E114","v":0},{"$f":"Lite!F114","v":0},{"$f":"Lite!G114","v":"V.1 Service and Deployment Models"},{"$f":"Lite!H114","v":"N/A"},{"$f":"Lite!I114","v":0},null,null,null,"N/A",null,null,"WP.1.A.1"]
[{"$f":"Lite!A115","v":3306},{"$f":"Lite!M115","v":16},{"$f":"Lite!K115","v":"V"},{"$f":"Lite!Y115","v":0},{"$f":"Lite!B115","v":"SL.95"},{"$f":"Lite!C115","v":"Platform as a Service (PaaS)"},{"$f":"Lite!D115","v":0},{"$f":"Lite!E115","v":0},{"$f":"Lite!F115","v":0},{"$f":"Lite!G115","v":"V.1 Service and Deployment Models"},{"$f":"Lite!H115","v":"N/A"},{"$f":"Lite!I115","v":0},null,null,null,"3.5, 3.6",null,null,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.A.7, WP.1.G.9"]
[{"$f":"Lite!A116","v":3307},{"$f":"Lite!M116","v":16},{"$f":"Lite!K116","v":"V"},{"$f":"Lite!Y116","v":0},{"$f":"Lite!B116","v":"SL.96"},{"$f":"Lite!C116","v":"Infrastructure as a Service (IaaS)"},{"$f":"Lite!D116","v":0},{"$f":"Lite!E116","v":0},{"$f":"Lite!F116","v":0},{"$f":"Lite!G116","v":"V.1 Service and Deployment Models"},{"$f":"Lite!H116","v":"N/A"},{"$f":"Lite!I116","v":0},null,null,null,"3.6.1",null,null,"WP.1.A.6"]
[{"$f":"Lite!A117","v":3309},{"$f":"Lite!M117","v":16},{"$f":"Lite!K117","v":"V"},{"$f":"Lite!Y117","v":0},{"$f":"Lite!B117","v":"SL.97"},{"$f":"Lite!C117","v":"Private cloud"},{"$f":"Lite!D117","v":0},{"$f":"Lite!E117","v":0},{"$f":"Lite!F117","v":0},{"$f":"Lite!G117","v":"V.1 Service and Deployment Models"},{"$f":"Lite!H117","v":"N/A"},{"$f":"Lite!I117","v":0},null,null,null,"3.6.4",null,null,"WP.1.A.6, WP.1.A.7"]
[{"$f":"Lite!A118","v":3310},{"$f":"Lite!M118","v":16},{"$f":"Lite!K118","v":"V"},{"$f":"Lite!Y118","v":0},{"$f":"Lite!B118","v":"SL.98"},{"$f":"Lite!C118","v":"Public cloud"},{"$f":"Lite!D118","v":0},{"$f":"Lite!E118","v":0},{"$f":"Lite!F118","v":0},{"$f":"Lite!G118","v":"V.1 Service and Deployment Models"},{"$f":"Lite!H118","v":"N/A"},{"$f":"Lite!I118","v":0},null,null,null,"N/A",null,null,"WP.1.H.2, WP.1.H.4"]
[{"$f":"Lite!A119","v":3311},{"$f":"Lite!M119","v":16},{"$f":"Lite!K119","v":"V"},{"$f":"Lite!Y119","v":0},{"$f":"Lite!B119","v":"SL.99"},{"$f":"Lite!C119","v":"Community cloud"},{"$f":"Lite!D119","v":0},{"$f":"Lite!E119","v":0},{"$f":"Lite!F119","v":0},{"$f":"Lite!G119","v":"V.1 Service and Deployment Models"},{"$f":"Lite!H119","v":"N/A"},{"$f":"Lite!I119","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A120","v":3312},{"$f":"Lite!M120","v":16},{"$f":"Lite!K120","v":"V"},{"$f":"Lite!Y120","v":0},{"$f":"Lite!B120","v":"SL.100"},{"$f":"Lite!C120","v":"Hybrid cloud"},{"$f":"Lite!D120","v":0},{"$f":"Lite!E120","v":0},{"$f":"Lite!F120","v":0},{"$f":"Lite!G120","v":"V.1 Service and Deployment Models"},{"$f":"Lite!H120","v":"N/A"},{"$f":"Lite!I120","v":0},null,null,null,"N/A",null,null,"WP.1.D.2"]
[{"$f":"Lite!A121","v":3330},{"$f":"Lite!M121","v":16},{"$f":"Lite!K121","v":"V"},{"$f":"Lite!Y121","v":0},{"$f":"Lite!B121","v":"SL.101"},{"$f":"Lite!C121","v":"Can clients define the legal jurisdictions where their data can be transmitted, processed or stored?"},{"$f":"Lite!D121","v":0},{"$f":"Lite!E121","v":0},{"$f":"Lite!F121","v":0},{"$f":"Lite!G121","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"Lite!H121","v":"15.1.2"},{"$f":"Lite!I121","v":"Addressing security within supplier agreements"},null,null,null,10.8]
[{"$f":"Lite!A122","v":3339},{"$f":"Lite!M122","v":16},{"$f":"Lite!K122","v":"V"},{"$f":"Lite!Y122","v":0},{"$f":"Lite!B122","v":"SL.102"},{"$f":"Lite!C122","v":"Is data segmentation and separation capability between clients provided? If yes, describe."},{"$f":"Lite!D122","v":0},{"$f":"Lite!E122","v":0},{"$f":"Lite!F122","v":0},{"$f":"Lite!G122","v":"V.1 Service and Deployment Models"},{"$f":"Lite!H122","v":"11.2.6, 9.1.1"},{"$f":"Lite!I122","v":"Security of equipment and assets off-premises, Access Control Policy"},null,null,null,"N/A",null,null,"WP.1.K.6, WP.1.C.1, WP.1.C.2, WP.1.C.3"]
[{"$f":"Lite!A123","v":3346},{"$f":"Lite!M123","v":16},{"$f":"Lite!K123","v":"V"},{"$f":"Lite!Y123","v":0},{"$f":"Lite!B123","v":"SL.103"},{"$f":"Lite!C123","v":"Is Scoped Data encrypted?"},{"$f":"Lite!D123","v":0},{"$f":"Lite!E123","v":0},{"$f":"Lite!F123","v":0},{"$f":"Lite!G123","v":"G.22 Data Security Policy - Encryption"},{"$f":"Lite!H123","v":10.1},{"$f":"Lite!I123","v":"Cryptographic Controls"},null,null,null,6.4,null,null,"WP.1.F.6, WP.1.E.3"]
[{"$f":"Lite!A124","v":3353},{"$f":"Lite!M124","v":16},{"$f":"Lite!K124","v":"V"},{"$f":"Lite!Y124","v":0},{"$f":"Lite!B124","v":"SL.104"},{"$f":"Lite!C124","v":"Are clients provided with the ability to generate a unique encryption key?"},{"$f":"Lite!D124","v":0},{"$f":"Lite!E124","v":0},{"$f":"Lite!F124","v":0},{"$f":"Lite!G124","v":"G.22 Data Security Policy - Encryption"},{"$f":"Lite!H124","v":"10.1.2"},{"$f":"Lite!I124","v":"Key Management"},null,null,null,"11.3.1, 11.3.2",null,null,"WP.1.K.6, WP.1.K.7, WP.1.K.8"]
[{"$f":"Lite!A125","v":3354},{"$f":"Lite!M125","v":16},{"$f":"Lite!K125","v":"V"},{"$f":"Lite!Y125","v":0},{"$f":"Lite!B125","v":"SL.105"},{"$f":"Lite!C125","v":"Are clients provided with the ability to rotate their encryption key on a scheduled basis?"},{"$f":"Lite!D125","v":0},{"$f":"Lite!E125","v":0},{"$f":"Lite!F125","v":0},{"$f":"Lite!G125","v":"G.22 Data Security Policy - Encryption"},{"$f":"Lite!H125","v":"10.1.2"},{"$f":"Lite!I125","v":"Key Management"},null,null,null,"N/A",null,null,"WP.1.K.6, WP.1.K.7, WP.1.K.8"]
[{"$f":"Lite!A126","v":3355},{"$f":"Lite!M126","v":16},{"$f":"Lite!K126","v":"V"},{"$f":"Lite!Y126","v":0},{"$f":"Lite!B126","v":"SL.106"},{"$f":"Lite!C126","v":"Is standards based federated ID capability available to clients (e.g., SAML, OpenID)?"},{"$f":"Lite!D126","v":0},{"$f":"Lite!E126","v":0},{"$f":"Lite!F126","v":0},{"$f":"Lite!G126","v":"N/A"},{"$f":"Lite!H126","v":"9.2.4"},{"$f":"Lite!I126","v":"Management of secret authentication information of users."},null,null,null,"N/A",null,null,"WP.1.F.6, WP.1.E.3"]
[{"$f":"Lite!A127","v":3356},{"$f":"Lite!M127","v":16},{"$f":"Lite!K127","v":"V"},{"$f":"Lite!Y127","v":0},{"$f":"Lite!B127","v":"SL.107"},{"$f":"Lite!C127","v":"Are application self service features or an Internet accessible self-service portal available to clients? If yes, describe."},{"$f":"Lite!D127","v":0},{"$f":"Lite!E127","v":0},{"$f":"Lite!F127","v":0},{"$f":"Lite!G127","v":"N/A"},{"$f":"Lite!H127","v":"11.2.6, 9.1.1"},{"$f":"Lite!I127","v":"Security of equipment and assets off-premises, Access Control Policy"},null,null,null,"N/A",null,null,"WP.1.E.3, WP.1.G.10"]
[{"$f":"Lite!A128","v":3373},{"$f":"Lite!M128","v":16},{"$f":"Lite!K128","v":"V"},{"$f":"Lite!Y128","v":0},{"$f":"Lite!B128","v":"SL.108"},{"$f":"Lite!C128","v":"Is there a management approved process to ensure that image snapshots containing Scoped Data are authorized prior to being snapped?"},{"$f":"Lite!D128","v":0},{"$f":"Lite!E128","v":0},{"$f":"Lite!F128","v":0},{"$f":"Lite!G128","v":"N/A"},{"$f":"Lite!H128","v":"N/A"},{"$f":"Lite!I128","v":0},null,null,null,"N/A",null,null,"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7"]
[{"$f":"Lite!A129","v":3379},{"$f":"Lite!M129","v":16},{"$f":"Lite!K129","v":"V"},{"$f":"Lite!Y129","v":0},{"$f":"Lite!B129","v":"SL.109"},{"$f":"Lite!C129","v":"Is there a cloud audit program to address client audit and assessment requirements? If yes, describe."},{"$f":"Lite!D129","v":0},{"$f":"Lite!E129","v":0},{"$f":"Lite!F129","v":0},{"$f":"Lite!G129","v":"V.3 Cloud Audit Program"},{"$f":"Lite!H129","v":"N/A"},{"$f":"Lite!I129","v":0},null,null,null,"N/A",null,null,"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7"]
[{"$f":"Lite!A130","v":3394},{"$f":"Lite!M130","v":16},{"$f":"Lite!K130","v":"V"},{"$f":"Lite!Y130","v":0},{"$f":"Lite!B130","v":"SL.110"},{"$f":"Lite!C130","v":"Is an agile development methodology in operation?"},{"$f":"Lite!D130","v":0},{"$f":"Lite!E130","v":0},{"$f":"Lite!F130","v":0},{"$f":"Lite!G130","v":"I.2 Secure Systems Development Lifecycle Code Reviews\nQ.5 Secure Code Review"},{"$f":"Lite!H130","v":12.5},{"$f":"Lite!I130","v":"Control Of Operational Software"},null,null,null,"N/A",null,null,"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7"]
[{"$f":"Lite!A131","v":3401},{"$f":"Lite!M131","v":16},{"$f":"Lite!K131","v":"V"},{"$f":"Lite!Y131","v":0},{"$f":"Lite!B131","v":"SL.111"},{"$f":"Lite!C131","v":"Is there a formal process to ensure clients are notified prior to changes being made which may impact their service? If yes, describe."},{"$f":"Lite!D131","v":0},{"$f":"Lite!E131","v":0},{"$f":"Lite!F131","v":0},{"$f":"Lite!G131","v":"G.21 Change Control"},{"$f":"Lite!H131","v":"12.1.2, 14.2.2"},{"$f":"Lite!I131","v":"Change Management, System change control procedures"},null,null,null,11.3,null,null,"WP.1.I.3, WP.1.I.5, WP.1.I.6, WP.1.I.7, WP.1.A.10"]
[{"$f":"Lite!A132","v":3406},{"$f":"Lite!M132","v":16},{"$f":"Lite!K132","v":"V"},{"$f":"Lite!Y132","v":0},{"$f":"Lite!B132","v":"SL.112"},{"$f":"Lite!C132","v":"Is there a scheduled maintenance window? If yes, what is the frequency?"},{"$f":"Lite!D132","v":0},{"$f":"Lite!E132","v":0},{"$f":"Lite!F132","v":0},{"$f":"Lite!G132","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"Lite!H132","v":"12.1.2, 14.2.2"},{"$f":"Lite!I132","v":"Change Management, System change control procedures"},null,null,null,"N/A",null,null,"WP.1.E.4, WP.1.G.2, WP.1.G.3"]
[{"$f":"Lite!A133","v":3412},{"$f":"Lite!M133","v":16},{"$f":"Lite!K133","v":"V"},{"$f":"Lite!Y133","v":0},{"$f":"Lite!B133","v":"SL.113"},{"$f":"Lite!C133","v":"Is there a scheduled maintenance window which results in client downtime, If yes, what is the period of the downtime?"},{"$f":"Lite!D133","v":0},{"$f":"Lite!E133","v":0},{"$f":"Lite!F133","v":0},{"$f":"Lite!G133","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"Lite!H133","v":"12.1.2, 14.2.2"},{"$f":"Lite!I133","v":"Change Management, System change control procedures"},null,null,null,"N/A",null,null,"WP.1.L.2, WP.1.G.5"]
[{"$f":"Lite!A134","v":3418},{"$f":"Lite!M134","v":16},{"$f":"Lite!K134","v":"V"},{"$f":"Lite!Y134","v":0},{"$f":"Lite!B134","v":"SL.114"},{"$f":"Lite!C134","v":"Is there an online incident response status portal which outlines planned and unplanned outages? If yes, how long after an unplanned outage is this updated?"},{"$f":"Lite!D134","v":0},{"$f":"Lite!E134","v":0},{"$f":"Lite!F134","v":0},{"$f":"Lite!G134","v":"J.1 Information Security Incident Management\nP.8 Privacy Incident and Response Management"},{"$f":"Lite!H134","v":"12.1.2, 14.2.2"},{"$f":"Lite!I134","v":"Change Management, System change control procedures"},null,null,null,"N/A",null,null,"WP.1.K.4"]
[{"$f":"Lite!A135","v":3426},{"$f":"Lite!M135","v":16},{"$f":"Lite!K135","v":"V"},{"$f":"Lite!Y135","v":0},{"$f":"Lite!B135","v":"SL.115"},{"$f":"Lite!C135","v":"Is there a 24x7x365 staffed phone number available to clients to report security incidents?"},{"$f":"Lite!D135","v":0},{"$f":"Lite!E135","v":0},{"$f":"Lite!F135","v":0},{"$f":"Lite!G135","v":"J.1 Information Security Incident Management\nP.8 Privacy Incident and Response Management"},{"$f":"Lite!H135","v":"12.1.2, 14.2.2"},{"$f":"Lite!I135","v":"Change Management, System change control procedures"},null,null,null,"N/A"]
[{"$f":"Lite!A136","v":3427},{"$f":"Lite!M136","v":16},{"$f":"Lite!K136","v":"V"},{"$f":"Lite!Y136","v":0},{"$f":"Lite!B136","v":"SL.116"},{"$f":"Lite!C136","v":"Are applications created and released into production? If yes, what is the release frequency?"},{"$f":"Lite!D136","v":0},{"$f":"Lite!E136","v":0},{"$f":"Lite!F136","v":0},{"$f":"Lite!G136","v":"Q.1 Secure SDLC Policies, Standards and Procedures"},{"$f":"Lite!H136","v":12.5},{"$f":"Lite!I136","v":"Control Of Operational Software"},null,null,null,"N/A",null,null,"WP.1.J.1, WP.1.J.7, WP.1.A.3, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.H.6, WP.1.H.10"]
[{"$f":"Lite!A137","v":3436},{"$f":"Lite!M137","v":16},{"$f":"Lite!K137","v":"V"},{"$f":"Lite!Y137","v":0},{"$f":"Lite!B137","v":"SL.117"},{"$f":"Lite!C137","v":"Is there an automated secure source code review? If yes, what is the frequency?"},{"$f":"Lite!D137","v":0},{"$f":"Lite!E137","v":0},{"$f":"Lite!F137","v":0},{"$f":"Lite!G137","v":"I.2 Secure Systems Development Lifecycle Code Reviews\nQ.5 Secure Code Review"},{"$f":"Lite!H137","v":12.5},{"$f":"Lite!I137","v":"Control Of Operational Software"},null,null,null,"N/A",null,null,"WP.1.H.6, WP.1.I.4, WP.1.I.7"]
[{"$f":"Lite!A138","v":3445},{"$f":"Lite!M138","v":16},{"$f":"Lite!K138","v":"V"},{"$f":"Lite!Y138","v":0},{"$f":"Lite!B138","v":"SL.118"},{"$f":"Lite!C138","v":"Is source code security reviewed manually? If yes, what is the frequency?"},{"$f":"Lite!D138","v":0},{"$f":"Lite!E138","v":0},{"$f":"Lite!F138","v":0},{"$f":"Lite!G138","v":"I.2 Secure Systems Development Lifecycle Code Reviews\nQ.5 Secure Code Review"},{"$f":"Lite!H138","v":"12.2.1, 12.5"},{"$f":"Lite!I138","v":"Control against malware, Control Of Operational Software"},null,null,null,"N/A",null,null,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"]
[{"$f":"Lite!A139","v":3454},{"$f":"Lite!M139","v":16},{"$f":"Lite!K139","v":"V"},{"$f":"Lite!Y139","v":0},{"$f":"Lite!B139","v":"SL.119"},{"$f":"Lite!C139","v":"Are automated penetration tests performed? If yes, what is the frequency?"},{"$f":"Lite!D139","v":0},{"$f":"Lite!E139","v":0},{"$f":"Lite!F139","v":0},{"$f":"Lite!G139","v":"I.1 Application Vulnerability Assessments/Ethical Hacking"},{"$f":"Lite!H139","v":12.6},{"$f":"Lite!I139","v":"Technical vulnerability management"},null,null,null,"N/A",null,null,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"]
[{"$f":"Lite!A140","v":3472},{"$f":"Lite!M140","v":16},{"$f":"Lite!K140","v":"V"},{"$f":"Lite!Y140","v":0},{"$f":"Lite!B140","v":"SL.120"},{"$f":"Lite!C140","v":"Are clients provided with the ability to specify where their data will be stored? If yes, describe at what level (e.g., data center, country)?"},{"$f":"Lite!D140","v":0},{"$f":"Lite!E140","v":0},{"$f":"Lite!F140","v":0},{"$f":"Lite!G140","v":"P.6 Management of Client Target Privacy Data"},{"$f":"Lite!H140","v":"8.2.3, 11.1, 15.1.2"},{"$f":"Lite!I140","v":"Handling of assets,\nSecure areas,\nAddressing security within supplier agreements"},null,null,null,"N/A",null,null,"WP.1.A.1, WP.1.A.5, WP.1.A.6, WP.1.D.2, WP.1.E.2, WP.1.E.3, WP.1.G.1, WP.1.G.2, WP.1.H.6, WP.1.H.8, WP.1.H.9, WP.1.K.1"]
[{"$f":"Lite!A141","v":3481},{"$f":"Lite!M141","v":16},{"$f":"Lite!K141","v":"V"},{"$f":"Lite!Y141","v":0},{"$f":"Lite!B141","v":"SL.121"},{"$f":"Lite!C141","v":"Does the ability exist to legally demonstrate sufficient data segmentation, in the event of a client subpoena or a forensics incident, so as not to impact other client's data? If using resource pooling? "},{"$f":"Lite!D141","v":0},{"$f":"Lite!E141","v":0},{"$f":"Lite!F141","v":0},{"$f":"Lite!G141","v":"V.1 Service and Deployment Models"},{"$f":"Lite!H141","v":16.100000000000001},{"$f":"Lite!I141","v":"Management of information security incidents and improvements"},null,null,null,"N/A",null,null,"WP.1.E.2, WP.1.H.6"]
[{"$f":"Lite!A142","v":3489},{"$f":"Lite!M142","v":16},{"$f":"Lite!K142","v":"V"},{"$f":"Lite!Y142","v":0},{"$f":"Lite!B142","v":"SL.122"},{"$f":"Lite!C142","v":"Is there a self-service portal or API call available to clients which provides the ability to place a \"Legal hold\" on client data which may be subject to a legal action, without impacting other clients data retention or destruction schedules?"},{"$f":"Lite!D142","v":0},{"$f":"Lite!E142","v":0},{"$f":"Lite!F142","v":0},{"$f":"Lite!G142","v":"P.6 Management of Client Target Privacy Data"},{"$f":"Lite!H142","v":"8.2.3, 11.1, 15.1.2, 18.1.2"},{"$f":"Lite!I142","v":"Handling of assets,\nSecure areas,\nAddressing security within supplier agreements, Intellectual property rights"},null,null,null,7.1,null,null,"WP.1.A.1, WP.1.A.2, WP.1.A.5, WP.1.A.6, WP.1.A.8, WP.1.A.9, WP.1.E.2, WP.1.I.2"]
[{"$f":"Lite!A143","v":3490},{"$f":"Lite!M143","v":16},{"$f":"Lite!K143","v":"V"},{"$f":"Lite!Y143","v":0},{"$f":"Lite!B143","v":"SL.123"},{"$f":"Lite!C143","v":"Is a Cloud API available to clients?"},{"$f":"Lite!D143","v":0},{"$f":"Lite!E143","v":0},{"$f":"Lite!F143","v":0},{"$f":"Lite!G143","v":"H.3 Logical Access Authorization"},{"$f":"Lite!H143","v":"N/A"},{"$f":"Lite!I143","v":0},null,null,null,"N/A",null,null,"WP.1.A.1, WP.1.D.1, WP.1.D.2, WP.1.I.4"]
[{"$f":"Lite!A144","v":3516},{"$f":"Lite!M144","v":16},{"$f":"Lite!K144","v":"V"},{"$f":"Lite!Y144","v":0},{"$f":"Lite!B144","v":"SL.124"},{"$f":"Lite!C144","v":"Is there a client management portal which allows distributed business accounts (business units/departments) to be managed under a single central corporate account?"},{"$f":"Lite!D144","v":0},{"$f":"Lite!E144","v":0},{"$f":"Lite!F144","v":0},{"$f":"Lite!G144","v":0},{"$f":"Lite!H144","v":"12.1.2, 14.2.2"},{"$f":"Lite!I144","v":"Change Management, System change control procedures"},null,null,null,"5.1, 5.2",null,null,"WP.1.F.4, WP.1.F.5, WP.1.H.1, WP.1.H.9, WP.1.J.4, WP.1.J.5, WP.1.J.6, WP.1.J.7, WP.1.K.6"]
[{"$f":"Lite!A145","v":3538},{"$f":"Lite!M145","v":16},{"$f":"Lite!K145","v":"V"},{"$f":"Lite!Y145","v":0},{"$f":"Lite!B145","v":"SL.125"},{"$f":"Lite!C145","v":"Are staff required to use two factor authentication to remotely access the production cloud environment containing Scoped Data?"},{"$f":"Lite!D145","v":0},{"$f":"Lite!E145","v":0},{"$f":"Lite!F145","v":0},{"$f":"Lite!G145","v":"I.6 Application Security Vulnerability Assessments and Remediation"},{"$f":"Lite!H145","v":"9.3.1, 9.4.2, 9.4.3"},{"$f":"Lite!I145","v":"Use of secret authentication information, Secure log-on procedures, Password management system"},null,null,null,"N/A",null,null,"WP.1.K.10"]
[{"$f":"Lite!A146","v":3548},{"$f":"Lite!M146","v":16},{"$f":"Lite!K146","v":"V"},{"$f":"Lite!Y146","v":0},{"$f":"Lite!B146","v":"SL.126"},{"$f":"Lite!C146","v":"Are staff able to access client Scoped Data in an unencrypted state?"},{"$f":"Lite!D146","v":0},{"$f":"Lite!E146","v":0},{"$f":"Lite!F146","v":0},{"$f":"Lite!G146","v":"H.3 Logical Access Authorization"},{"$f":"Lite!H146","v":"9.4.1"},{"$f":"Lite!I146","v":"Information access restriction"},null,null,null,"N/A",null,null,"WP.1.K.12"]
[{"$f":"Lite!A147","v":3549},{"$f":"Lite!M147","v":16},{"$f":"Lite!K147","v":"V"},{"$f":"Lite!Y147","v":0},{"$f":"Lite!B147","v":"SL.127"},{"$f":"Lite!C147","v":"Are staff able to access client's encryption key?"},{"$f":"Lite!D147","v":0},{"$f":"Lite!E147","v":0},{"$f":"Lite!F147","v":0},{"$f":"Lite!G147","v":"H.3 Logical Access Authorization"},{"$f":"Lite!H147","v":"9.4.1"},{"$f":"Lite!I147","v":"Information access restriction"},null,null,null,"N/A",null,null,"WP.1.K.12"]
[{"$f":"Lite!A148","v":3554},{"$f":"Lite!M148","v":16},{"$f":"Lite!K148","v":"V"},{"$f":"Lite!Y148","v":0},{"$f":"Lite!B148","v":"SL.128"},{"$f":"Lite!C148","v":"Is there a process which allows the client to specifically list who from the cloud provider, will have access to their Scoped Systems and Data? If yes, describe."},{"$f":"Lite!D148","v":0},{"$f":"Lite!E148","v":0},{"$f":"Lite!F148","v":0},{"$f":"Lite!G148","v":"H.3 Logical Access Authorization"},{"$f":"Lite!H148","v":"9.1.1, 9.4.1"},{"$f":"Lite!I148","v":"\tAccess Control Policy\nInformation access restriction"},null,null,null,"N/A",null,null,"WP.1.K.11"]
[{"$f":"Lite!A149","v":3558},{"$f":"Lite!M149","v":16},{"$f":"Lite!K149","v":"V"},{"$f":"Lite!Y149","v":0},{"$f":"Lite!B149","v":"SL.129"},{"$f":"Lite!C149","v":"Are staff technically prevented from accessing the cloud environment via non-managed private devices? "},{"$f":"Lite!D149","v":0},{"$f":"Lite!E149","v":0},{"$f":"Lite!F149","v":0},{"$f":"Lite!G149","v":"H.3 Logical Access Authorization"},{"$f":"Lite!H149","v":"9.1.1, 9.4.1"},{"$f":"Lite!I149","v":"\tAccess Control Policy\nInformation access restriction"},null,null,null,"N/A",null,null,"WP.1.K.11"]
[{"$f":"Lite!A150","v":3563},{"$f":"Lite!M150","v":16},{"$f":"Lite!K150","v":"V"},{"$f":"Lite!Y150","v":0},{"$f":"Lite!B150","v":"SL.130"},{"$f":"Lite!C150","v":"Are there controls to prevent one client attempting to compromise another client in a resource pooled environment? If yes, describe."},{"$f":"Lite!D150","v":0},{"$f":"Lite!E150","v":0},{"$f":"Lite!F150","v":0},{"$f":"Lite!G150","v":"H.3 Logical Access Authorization"},{"$f":"Lite!H150","v":"9.1.1, 9.4.1"},{"$f":"Lite!I150","v":"\tAccess Control Policy\nInformation access restriction"},null,null,null,"N/A",null,null,"WP.1.E.1"]
[{"$f":"Lite!A151","v":3568},{"$f":"Lite!M151","v":16},{"$f":"Lite!K151","v":"V"},{"$f":"Lite!Y151","v":0},{"$f":"Lite!B151","v":"SL.131"},{"$f":"Lite!C151","v":"Is a default hardened base virtual image available to clients?"},{"$f":"Lite!D151","v":0},{"$f":"Lite!E151","v":0},{"$f":"Lite!F151","v":0},{"$f":"Lite!G151","v":"I.3 Secure Systems Hardening Standards"},{"$f":"Lite!H151","v":"N/A"},{"$f":"Lite!I151","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A152","v":3590},{"$f":"Lite!M152","v":16},{"$f":"Lite!K152","v":"V"},{"$f":"Lite!Y152","v":0},{"$f":"Lite!B152","v":"SL.132"},{"$f":"Lite!C152","v":"Can clients run their own security services within their own cloud environment? If yes, describe."},{"$f":"Lite!D152","v":0},{"$f":"Lite!E152","v":0},{"$f":"Lite!F152","v":0},{"$f":"Lite!G152","v":"V.3 Cloud Audit Program"},{"$f":"Lite!H152","v":"8.2.3, 11.1, 15.1.2, 18.1.2"},{"$f":"Lite!I152","v":"Handling of assets,\nSecure areas,\nAddressing security within supplier agreements, Intellectual property rights"},null,null,null,"N/A"]
[{"$f":"Lite!A153","v":3602},{"$f":"Lite!M153","v":16},{"$f":"Lite!K153","v":"V"},{"$f":"Lite!Y153","v":0},{"$f":"Lite!B153","v":"SL.133"},{"$f":"Lite!C153","v":"Is there a specific Recovery Time Objective(s) (RTO)? If yes, specify the RTO for the scoped services."},{"$f":"Lite!D153","v":0},{"$f":"Lite!E153","v":0},{"$f":"Lite!F153","v":0},{"$f":"Lite!G153","v":"N/A"},{"$f":"Lite!H153","v":17.100000000000001},{"$f":"Lite!I153","v":"Information security continuity"},null,null,null,"N/A",null,null,"WP.1.D.1"]
[{"$f":"Lite!A154","v":3623},{"$f":"Lite!M154","v":16},{"$f":"Lite!K154","v":"V"},{"$f":"Lite!Y154","v":0},{"$f":"Lite!B154","v":"SL.134"},{"$f":"Lite!C154","v":"Are the failover sites for the underlying infrastructure running on different vendor physical systems?"},{"$f":"Lite!D154","v":0},{"$f":"Lite!E154","v":0},{"$f":"Lite!F154","v":0},{"$f":"Lite!G154","v":"N/A"},{"$f":"Lite!H154","v":17.100000000000001},{"$f":"Lite!I154","v":"Information security continuity"}]
[{"$f":"Lite!A155","v":3624},{"$f":"Lite!M155","v":16},{"$f":"Lite!K155","v":"V"},{"$f":"Lite!Y155","v":0},{"$f":"Lite!B155","v":"SL.135"},{"$f":"Lite!C155","v":"Is the critical infrastructure running active/active at two or more sites?"},{"$f":"Lite!D155","v":0},{"$f":"Lite!E155","v":0},{"$f":"Lite!F155","v":0},{"$f":"Lite!G155","v":"N/A"},{"$f":"Lite!H155","v":17.100000000000001},{"$f":"Lite!I155","v":"Information security continuity"}]
[{"$f":"Lite!A156","v":3625},{"$f":"Lite!M156","v":16},{"$f":"Lite!K156","v":"V"},{"$f":"Lite!Y156","v":0},{"$f":"Lite!B156","v":"SL.136"},{"$f":"Lite!C156","v":"Are sites failed over as part of normal operation or as part of a test? If yes, what is the frequency?"},{"$f":"Lite!D156","v":0},{"$f":"Lite!E156","v":0},{"$f":"Lite!F156","v":0},{"$f":"Lite!G156","v":"N/A"},{"$f":"Lite!H156","v":17.100000000000001},{"$f":"Lite!I156","v":"Information security continuity"}]
[{"$f":"Lite!A157","v":3632},{"$f":"Lite!M157","v":16},{"$f":"Lite!K157","v":"V"},{"$f":"Lite!Y157","v":0},{"$f":"Lite!B157","v":"SL.137"},{"$f":"Lite!C157","v":"Are all suppliers of critical hardware, network services and facility services involved in annual continuity and recovery tests?"},{"$f":"Lite!D157","v":0},{"$f":"Lite!E157","v":0},{"$f":"Lite!F157","v":0},{"$f":"Lite!G157","v":"N/A"},{"$f":"Lite!H157","v":17.100000000000001},{"$f":"Lite!I157","v":"Information security continuity"}]
[{"$f":"Lite!A158","v":3634},{"$f":"Lite!M158","v":16},{"$f":"Lite!K158","v":"V"},{"$f":"Lite!Y158","v":0},{"$f":"Lite!B158","v":"SL.138"},{"$f":"Lite!C158","v":"Are all critical technology service providers described on an architecture diagram that includes physical systems and facilities?"},{"$f":"Lite!D158","v":0},{"$f":"Lite!E158","v":0},{"$f":"Lite!F158","v":0},{"$f":"Lite!G158","v":"N/A"},{"$f":"Lite!H158","v":17.100000000000001},{"$f":"Lite!I158","v":"Information security continuity"}]
[{"$f":"Lite!A159","v":3638},{"$f":"Lite!M159","v":16},{"$f":"Lite!K159","v":"V"},{"$f":"Lite!Y159","v":0},{"$f":"Lite!B159","v":"SL.139"},{"$f":"Lite!C159","v":"Is there sufficient redundancy capacity to ensure services are not impacted in multi-tenancy environments during peak usage and above?"},{"$f":"Lite!D159","v":0},{"$f":"Lite!E159","v":0},{"$f":"Lite!F159","v":0},{"$f":"Lite!G159","v":"N/A"},{"$f":"Lite!H159","v":17.2},{"$f":"Lite!I159","v":"Redundancies"}]
[{"$f":"Lite!A160","v":3639},{"$f":"Lite!M160","v":16},{"$f":"Lite!K160","v":"V"},{"$f":"Lite!Y160","v":0},{"$f":"Lite!B160","v":"SL.140"},{"$f":"Lite!C160","v":"Do contracts include a penalty or remediation clause for breach of availability and continuity SLAs? "},{"$f":"Lite!D160","v":0},{"$f":"Lite!E160","v":0},{"$f":"Lite!F160","v":0},{"$f":"Lite!G160","v":"N/A"},{"$f":"Lite!H160","v":"15.1.2, 15.2.1"},{"$f":"Lite!I160","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"}]
[{"$f":"Lite!A161","v":3649},{"$f":"Lite!M161","v":16},{"$f":"Lite!K161","v":"V"},{"$f":"Lite!Y161","v":0},{"$f":"Lite!B161","v":"SL.141"},{"$f":"Lite!C161","v":"Is a Hypervisor used to manage systems used to transmit, process or store Scoped Data? If yes, describe the controls used to protect the hypervisor and the managed Guest Operating Systems."},{"$f":"Lite!D161","v":0},{"$f":"Lite!E161","v":0},{"$f":"Lite!F161","v":0},{"$f":"Lite!G161","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"Lite!H161","v":"N/A"},{"$f":"Lite!I161","v":0}]
[{"$f":"Lite!A162","v":0},{"$f":"Lite!M162","v":0},{"$f":"Lite!K162","v":0},{"$f":"Lite!Y162","v":0},{"$f":"Lite!B162","v":0},{"$f":"Lite!C162","v":0},{"$f":"Lite!D162","v":0},{"$f":"Lite!E162","v":0},{"$f":"Lite!F162","v":0},{"$f":"Lite!G162","v":0},{"$f":"Lite!H162","v":0},{"$f":"Lite!I162","v":0}]

{"sheet":"Drops","index":28,"n_rows":8,"n_cols":7,"rows_kept":8,"cut":false,"hidden":true,"merged":[]}
["Binary","ScaledLarge","TabAuto","Master"]
[null,null,"Enable",null,"LiteMatCell","DetailMatCell","CloudMatCell"]
["Yes",1,"Disable","Master"]
["No",2]
["N/A",3]
[null,4]
[null,5]
[null,"N/A"]