Trust Center - Secret View

Controls

Specific security measures this organisation has implemented, alongside their current operational status.

Product & Service Development Software tested before being put in productionSecure system architecture establishedLimited use of live data in development and test environments View 3 more

Threats & Vulnerabilities Threat and vulnerability information collected and followed upVulnerability management system in useSoftware kept up to date View 1 more

Logging & Monitoring Log files securedSecurity events monitoredLog files created for security events View 1 more

People & Culture Employees trained in line with job responsibilitiesScreening performed for employeesInformation security in employment contractsView details

System & Network Security Network segmentation implementedView details

Data Security & Privacy Encryption of data in transitEncryption of data at restInformation(assets) classified, labelled and managed View 2 more

Access Control Access rights reviewedView details

Business Continuity Backups performed and redundancy implementedView details

Physical & Environmental Security Physical access control implementedPhysical environmental security implementedView details

Compliance & Legal Corrective actions takenView details

Information Security Governance Operational planning createdScope of the ISMS determinedContext of the organisation documentedView details

Asset Management Asset inventory maintainedView details

Incident & Problem Management Incidents followed up in line with the incident response planView details

Third-Party Management Vendor security policy establishedView details

Risk Management Risk management process establishedView details

Product & Service Development

Software tested before being put in production

Effective

Software, whether purchased or developed, should be thoroughly tested before it is put into production. The extent of testing should be proportionate to the importance, the nature of the system and the potential impact of the change being introduced. **Requirements** - The developed source code should be tested during and after development. This can be done by means of vulnerability scanning (SAST). - The organisation should consider writing test plans. Test plans should be determined using a range of criteria, including security and privacy considerations. - Used libraries should be regularly scanned for information security issues and known vulnerabilities (Software Composition Analysis or SCA). The results should be evaluated and action taken if necessary. - The organisation should consider having the software code reviewed by someone other than the developer before it is put into production (4-eye principle, or peer review). Peer reviews should assess the quality of the source code, compliance with secure software development policies, use of required development environments, platforms and tools, adequate testing and documentation, and follow-up of identified vulnerabilities.

Secure system architecture established

Effective

A secure system architecture is designed and implemented for products and services developed or acquired by the organisation. Information security risks and requirements are identified, implemented, and monitored throughout the software development lifecycle. **Requirements** - The organisation performs activities such as concept exploration, analysis of alternatives, and preliminary or applied research to refine the concepts and/or feasibility of technologies used in a new system. - The organisation defines information security and privacy requirements for products or services to be delivered by the project using various methods and inputs, such as information security policy, regulatory requirements, threat modelling, incident reviews, and the use of vulnerability thresholds or contingency planning. - The architecture should consider any assumptions about - and dependencies on - external systems and services; - This effort is initiated during the concept and development phases of the system lifecycle

Limited use of live data in development and test environments

Effective

Operational data used in development and test environments should be appropriately selected, protected, and managed. **Requirements** - The organisation should secure test information in accordance with the information classification and management policy and relevant laws and regulations, such as by limiting the use of (sensitive) (personal) data, securing access to development and test environments, logging & monitoring, and masking and/or anonymising data where necessary. - Live data should be removed from the test environment immediately after testing has been completed, if possible.

Development, test and production environments separated

Effective

Development, test, and production environments are logically or physically separated to protect the production environment from the risks of development and testing activities. **Requirements** - The organisation should consider: the necessary degree of separation (logical or physical), what activities are performed in each environment, rules and procedures for transporting software code between environments, access restrictions and segregation of duties, monitoring and backups, and minimising or masking of live data in development and test environments.

Software project management applied

Effective

Software projects, including their information security requirements, are managed and monitored throughout the software development lifecycle. **Requirements** - The organisation identifies, assesses, monitors, and reports on security risks for products or services to be delivered by projects. - The organisation defines and assigns information security responsibilities and authorities relevant to the project to specified roles. - When selecting a development platform (including development tools and environments), the organisation should consider the following: the extent to which the software supports project development (such as project tracking, roles and responsibilities, milestones, priorities, project monitoring, and progress reporting), secure storage and processing of software code, configuration options, and functionality that allows code to be developed and tested securely.

Secure coding practices applied

Effective

When developing software, secure coding principles should be applied to ensure that the number of potential information security vulnerabilities in the software is reduced. **Requirements** - When analysing the source code, the organisation should consider the following: level of adherence to programming standards and practices, readability of the code, use of insecure constructs and functions, opportunities to reduce the attack surface, and consideration of the most common programming errors and vulnerabilities in the source code (e.g. OWASP top 10). - The organisation should consider separating application secrets (passwords, API keys, SSH keys, and digital certificates) from the source code (e.g. in environment variables or in a key vault), to prevent theft of authentication credentials via the application source code. - The organisation should consider the following issues regarding the use of external libraries and tools: popularity, actively managed including regular updates, secure history and reputation, from trusted sources, availability of development sources for future management and maintenance. **Definitions** **Application Secret:** This is information that should be kept secret, such as passwords, API keys, SSH keys, and digital certificates. **Code Linter:** A tool that programmatically scans source code with the goal of identifying potential problems early. Code linters are strong in identifying stylistic errors, suspicious constructions, and bugs. **IDE:** Integrated Development Environment **SAST:** Static testing for application security. A SAST tool programmatically scans source code with the goal of identifying potential vulnerabilities early. SAST tools are strong in identifying the use of poorly secured access methods and opportunities to reduce the attack surface (e.g., analysis of duplicate source code and unused functions).

Threats & Vulnerabilities

Threat and vulnerability information collected and followed up

Effective

Information is gathered and acted upon on existing or emerging threats and vulnerabilities of deployed information systems and the organisation's exposure to these threats and vulnerabilities. **Requirements** - The organisation should obtain a clear understanding and situational awareness of evolving threats and attacker tactics in the current threat landscape (and their potential impact on the business), sharing strategic, tactical, and operational threat information as appropriate, and using it to support strategic decision-making, risk assessment, and resource allocation. - The organisation should establish and maintain contact with special interest groups or other specialized security forums and professional associations. - It is recommended to use additional sources of information, preferably independent vendors or consultants, government agencies, or groups that collectively gather and analyse threat information. - It is recommended to determine the source(s) of information used to identify vulnerabilities for each relevant asset. - It is recommended to use technologies to collect vulnerabilities and evaluate their relevance to assets in use by the organisation. - The organisation should analyse the information gathered and use it as input into processes that address vulnerabilities (e.g., incident response, software updates, anti-malware, and configuration management). - The list of information sources and other methods to identify vulnerabilities should be documented and kept up to date.

Vulnerability management system in use

Effective

Known vulnerabilities in deployed software and hardware are identified, evaluated, and remedied using a vulnerability management system. **Requirements** - It is recommended to use technologies that are able to: a) collect known vulnerabilities; b) scan assets (servers, virtual machines, e-mail servers, developed or purchased (web) applications) for the presence of these vulnerabilities, e.g. using DAST; and c) implement or propose solutions (patches or compensating measures). **Definitions** **Dynamic Application Security Testing (DAST):** A process of testing a (web) application in a running state to find security vulnerabilities (as opposed to SAST, which is performed on the source code). DAST tools analyse programs while they are running to detect security issues such as memory corruption, unsafe configuration, cross-site scripting, user privilege issues, SQL injection, and other critical security issues.

Software kept up to date

Effective

Software and firmware are kept up to date to ensure that the latest approved patches and application updates are installed for all approved software. **Requirements** - The organisation should implement patch management in line with the requirements of the change policy. - For purchased software, facilities to automatically deploy updates should be considered. - For cloud software, patch management should be contractually enforced by the vendor. - The organisation should consider alternative measures when an unacceptable software vulnerability is identified for which no update is available or can be installed (e.g., disabling services, isolating software, modifying firewalls, etc.)

Anti-malware technology applied

Effective

Technology is used to detect and remove malicious software (malware). **Requirements** - It should be determined where the application of anti-malware technology will have the most effect; in application protocols such as email, file transfer, and the web, and/or in user endpoint devices (e.g. laptops) and servers - Anti-malware software should be updated regularly, and the monitored information assets should be scanned regularly. **Definitions** **Malware:** Software used to disrupt computer systems, gather sensitive information, or gain access to private computer systems. Derived from 'malicious software'

Logging & Monitoring

Log files secured

Effective

Log files are protected against unauthorised modification. **Requirements** - Log files should be secured in such a way that no user is able to modify, delete, or otherwise manipulate the log of their own activities.

Security events monitored

Effective

Networks, systems and applications should be monitored for abnormal behaviour and appropriate measures should be taken to evaluate potential information security incidents. **Requirements** - The monitoring system should be configured based on the established baseline (see logging & monitoring policy) to identify abnormal behaviour, to report on it and to minimize false positives. - When using cloud services, it should be clear which party is responsible for (configuring) monitoring systems and following up on deviations. - Monitoring should be done in real-time or at regular intervals, depending on the needs and possibilities of the organisation.

Log files created for security events

Effective

Log files recording activities, exceptions, errors and other relevant events should be produced, stored, secured and analysed. **Requirements** - Logging should be in line with the logging & monitoring policy. - Log files should contain the following information: user identifications, system activities, dates/times and details of relevant events, identity of assets and their (virtual) location, network addresses and protocols. - To help identify important events for information security monitoring, the use of appropriate system tools or auditing tools for querying records may be considered (e.g. IDS, SIEM). **Definitions** **IDS:** Intrusion Detection System **SIEM:** Security Information and Event Management

Resource capacity monitored

Effective

The capacity and performance of assets (e.g. systems, applications and services) are continuously monitored to ensure that current and anticipated future capacity requirements are met. **Requirements** - Performance monitoring should be set up in line with requirements identified during the business impact analysis (BIA) and/or business continuity planning (BCP). - Measures should be in place to identify and monitor capacity issues. - Management should use this information to identify and prevent challenges and dependencies. **Definitions** **Resources:** These are the resources that the company has at its disposal to deliver services and products. Systems, applications and services are assets, but so are physical locations, personnel and budget.

People & Culture

Employees trained in line with job responsibilities

Effective

Employees should be appropriately educated and trained in information security and relevant aspects of the ISMS, as relevant to their role. **Requirements** - The organisation should establish an information security awareness program, education and training in accordance with the ISMS, which should include the following aspects: awareness activities, management involvement in information security, the need to be aware of and comply with applicable rules and requirements, personal responsibility in this regard, basic measures such as incident reporting and password protection, contact points and sources for additional information, guidance, and materials, and a final evaluation or assessment of understanding. - The awareness program should (preferably): take into account the roles of personnel (including internal and external personnel), be conducted regularly and on a staggered basis, and build on lessons learned from information security incidents. - For technical teams with roles that require specific skills and expertise, the organisation should establish, prepare, and implement an appropriate training plan. - Employees should be trained periodically and, where necessary, when the role description changes. **Definitions** **ISMS:** Information Security Management System.

Screening performed for employees

Effective

All individuals who enter into employment (full, part, and/or temporary) are screened prior to commencement of employment. **Requirements** - Screening should be proportionate to the business requirements, the classification of information the individual will have access to, and the identified risks. - The following screening activities should be considered, and carried out depending on the criticality of the candidate's role and access: business and personal references, curriculum vitae check, confirmation of claimed academic and professional qualifications, independent identity checks (e.g. passport), and more detailed checks (e.g. credit checks or criminal records). - Screening should be carried out in accordance with all relevant privacy requirements and applicable employment laws - For contract staff, screening requirements should be included in vendor contracts. - Screening should be carried out on promotion and periodically, depending on the criticality of an individual's role and access.

Information security in employment contracts

Effective

Employment contracts should specify the responsibilities of personnel and the organisation with regard to information security. **Requirements** - The organisation should ensure that personnel and contractors agree to terms and conditions regarding information security. - These terms and conditions should include the information security policy (including relevant policies on specific topics) and should be appropriate to the nature and extent of access they will have to (ISMS-relevant) company resources. - The following points should be addressed where relevant: confidentiality agreements (NDAs), legal responsibilities and rights (e.g. over intellectual property), responsibilities for information received, and disciplinary measures. - The organisation should ensure that personnel and contractors agree to these terms and conditions. - The information security terms and conditions should be reviewed when laws, regulations, information security policies or topic-specific policies change. **Definitions** **ISMS:** Information Security Management System.

System & Network Security

Network segmentation implemented

Effective

Groups of information services, users, and information systems are logically or physically separated from each other (segmented). **Requirements** - Groups of information services, users, and information systems (e.g., virtual machines, WANs, and wi-fi networks) should be defined and separated from each other in the organisational network. This can be done by information security criteria (e.g., public domain, desktop domain, server domain, low-risk or high-risk systems), organisational departments (e.g., human resources, finance, marketing), or a combination of both. - Network boundaries, and in particular the external boundaries of each domain and with the Internet, should be defined and governed by a gateway (e.g., firewall). - Wireless access networks for guests should be separated from those for staff.

Data Security & Privacy

Encryption of data in transit

Effective

Transmitted data is appropriately encrypted to ensure data integrity and confidentiality. **Requirements** - Encryption of data in transit should comply with the requirements of the secure baseline configuration and cryptographic key management policy (see access control policy)

Encryption of data at rest

Effective

Stored data is appropriately encrypted to ensure data integrity and confidentiality. **Requirements** - Encryption of stored data should be in accordance with the requirements of the secure baseline configuration and cryptographic key management policy (see access control policy )

Information(assets) classified, labelled and managed

Effective

Information is classified, labelled, and managed in accordance with the information classification and management policy. **Requirements** - The organisation should periodically determine that information, in accordance with the information classification and management policy: a) is (appropriately) classified and labelled, e.g., by means of a business impact analysis for all information and information assets; b) is processed in accordance with the requirements arising from the classification (e.g., restriction of access and distribution, secure processing and transfer, masking or anonymisation, retention, encryption, and back-up). - The organisation should identify and make available documentation that the organisation considers necessary for the effectiveness of the information security management system.

Data leakage prevention (DLP) technology in use

Effective

Where the protection of sensitive data (e.g., personal data) is a concern, the organisation should consider deploying a technology that helps prevent data leakage. **Requirements** - The organisation should identify and categorise sensitive data that requires the implementation of a data leakage prevention technology to meet legal, statutory, regulatory, and contractual requirements. - The organisation should then deploy it on systems, networks, and other devices on or through which the sensitive information is processed, stored, or transported. - The organisation should consider the following tools: a) Identifying which sensitive information is at risk of unauthorised disclosure (e.g., in unstructured data on a user's system); b) Detecting disclosure of sensitive information (e.g., when information is uploaded to untrusted third-party cloud services or sent via email); c) blocking user actions or network transmissions that expose sensitive information (e.g. uploading or downloading files to or from cloud services, copying data to a spreadsheet, using portable storage devices, taking screenshots). - Monitoring of staff communications and online activities should be in accordance with applicable guidelines and laws and regulations (e.g. privacy laws).

Sensitive data masked

Effective

Where the protection of sensitive data (e.g. personal data) is a concern, the organisation should consider hiding such data using techniques such as data masking, pseudonymisation, or anonymisation. **Requirements** - The organisation should identify and categorise sensitive data that requires masking to meet legal, statutory, regulatory, and contractual requirements. - The organisation should implement appropriate data masking techniques based on the sensitivity and use case of the data. - Masking techniques should be applied consistently across production, test, and development environments. - Data masking procedures should be regularly reviewed and updated to address new risks or changes in data processing.

Access Control

Access rights reviewed

Effective

Access rights are reviewed periodically and adjusted or removed if necessary (user access review). **Requirements** - Physical and logical access rights should be reviewed regularly, with attention to the following aspects: privileged access rights (such as admin accounts, high-privilege system accounts, and other "privileged access"), non-personal identities (e.g. shared credentials, group accounts), and the access rights of users after a change of role within the organisation or termination of employment.

Business Continuity

Backups performed and redundancy implemented

Effective

Backups of information, software and systems are made and maintained to enable recovery of data or systems in the event of loss. **Requirements** - The organisation should make backups of data and information systems in accordance with the business continuity plan.

Physical & Environmental Security

Physical access control implemented

Effective

The security of physical access by employees and guests is established and periodically reviewed and assessed. **Requirements** - The organisation should implement appropriate measures to prevent individuals from gaining unauthorised access to physical locations and areas (e.g. identification and registration of visitors, access barriers and controls, maintaining logs of access granted, alarm systems, and key management).

Physical environmental security implemented

Effective

The security of physical rooms and equipment is established and periodically reviewed and assessed. **Requirements** - The organisation should implement appropriate measures to prevent physical equipment from being damaged or rendered inoperable by external threats (e.g. fire extinguishers, protection against water damage and electromagnetic radiation and lightning, monitoring of environmental conditions such as temperature and humidity, and a ban on eating, drinking and smoking in protected areas).

Compliance & Legal

Corrective actions taken

Effective

The organisation responds to nonconformities by taking action to analyse and correct them. **Requirements** - Management should respond to nonconformities by taking action to control and correct them, or by addressing their consequences. - Management should evaluate the need to take action to eliminate the causes of nonconformities; - Management should implement all necessary actions and evaluate the effectiveness of those actions. - Management should make changes to the ISMS as necessary; - The nature of nonconformities, the actions taken, and the results thereof should be documented. **Definitions** **ISMS:** Information Security Management System.

Information Security Governance

Operational planning created

Effective

Operational plans are defined and implemented. **Requirements** - The operational planning should provide for achieving the information security requirements and objectives. - Measurable criteria should be established for this and associated process control should be implemented. - The planning (and progress on it) should be documented and kept up to date.

Scope of the ISMS determined

Effective

The organisation should define the scope of its ISMS, taking into account the relevant issues, the stakeholder requirements including legal, statutory, regulatory, and contractual requirements, and the interfaces and dependencies between the activities that the organisation itself carries out and activities that other organisations carry out. **Requirements** - This information should be documented and kept up to date. **Definitions** **ISMS:** Information Security Management System

Context of the organisation documented

Effective

The organisation understands the internal and external context in which it operates and its scope of information security. **Requirements** - The organisation should identify external and internal key issues that are relevant to its purpose and that affect its ability to achieve the intended results of its information security management system (ISMS). - The organisation should further determine which stakeholders are relevant to the management system, and which requirements of these stakeholders are relevant to information security - The organisation profile provides guidance for risk analysis and determining measures to mitigate risks. - The organisation profile should be documented and kept up to date.

Asset Management

Asset inventory maintained

Effective

An inventory of information and other related assets that support the organisation's business functions and processes is established and maintained. **Requirements** - The inventory should include the following for each asset or group of assets: name, owner (an individual or group), classification (see business impact analysis), and, where applicable, vendor, version number, location, and relationship to other internal and external systems and processes - The inventory may be divided into several lists and therefore does not have to be in one location. - The level of granularity of the inventory of information and other related assets should be appropriate to the needs of the organisation. - The inventory should be documented, accurate, current, consistent, and in line with other inventory records.

Incident & Problem Management

Incidents followed up in line with the incident response plan

Effective

Incidents are adequately resolved, reported, and evaluated to limit impact, maintain or restore services, and prevent future incidents. **Requirements** - Incidents are resolved and reported in accordance with the incident response plan - Significant and disruptive incidents are reported without delay to management and external agencies in accordance with applicable laws and regulations. - Lessons learned from information security incidents should be used to strengthen and improve information security controls.

Third-Party Management

Vendor security policy established

Effective

Rules and procedures for managing information security risks associated with the use of products and services provided by vendors are defined and implemented. **Requirements** - The organisation should describe in this document the processes and procedures that the organisation requires the vendor to implement in order to commence (or cease) use of a vendor's products or services. - The organisation should also describe in this document the following processes and procedures that it implements itself, including: a) identifying and documenting the types of vendors, products and services that may pose an information security risk, including how they are subsequently evaluated and selected; b) selecting only vendors, products and services with low risk, adequate information security controls, or adequate compensating measures; c) managing risks caused by the vendor's use of the organisation's information and other assets, and by vulnerabilities or disruptions in products and services provided; d) monitoring each type of vendor and each type of access, and taking action where vendors do not meet information security requirements; e) dealing with incidents and emergencies f) requirements for personnel of the own organisation and that of the vendor g) safely terminating vendor relationships. - The policy should also be applied to cloud service providers, when outsourcing development work, and imposed on the entire ICT supply chain of vendors. - The policy should be documented, communicated, and kept up to date. **Definitions** **Information security risk:** A risk that, if it occurs, could have an impact on the availability, integrity, and/or confidentiality (AIC) of information of the organisation

Risk Management

Risk management process established

Effective

Procedures for assessing and treating information security risks are established and implemented. **Requirements** - The risk management process should include: criteria for risk assessment and risk acceptance, procedures for identifying, analysing, evaluating, treating and accepting risks, and treatment plans. - The process should be documented, approved, and kept up to date.

Service providers

Third parties this organisation works with that may process customer data.

Clerk.dev Security & Identity

Clerk provides authentication and identity management services for Secret View, including login, registration, session management, MFA, SSO and user role management for our platforms. It may process user identity and authentication-related data required to provide secure access.

Postmark Communications & Email

Postmark provides transactional email delivery services for Secret View. The service is used to send functional emails triggered by our own software, such as system notifications, confirmations and other operational messages. Postmark may process recipient email addresses, message metadata and the content of transactional emails required to deliver these messages.

BDO Payment Processing

BDO Nederland provides accountancy, bookkeeping and financial advisory services to Secret View. BDO supports our day-to-day financial administration, invoicing and the preparation of mystery shopper payments.

Exact Payment Processing

Exact Online provides accounting and financial administration services for Secret View. It stores the financial records required to invoice clients and process community payments, including names, contact details, IBANs and payment histories. Exact Online is integrated with our internally developed platform and our banking services.

Mailjet Communications & Email

Mailjet provides email marketing and campaign delivery services for Secret View. We use Mailjet primarily to send marketing and community-related communications to members of the Secret View community and to client contacts.