How is data related to a particular client kept confidential / separate from data associated with another client?
Is there any monitoring /escalation process in place for non-authorized access to systems?
Where is the customer data stored?
How are data transfers of different customers managed?
How is data security managed in Scout?
How strong is the data encryption and data integrity?
Are different encryption keys used for different customers?
Who is responsible for managing the cryptographic keys?
Does the team responsible for managing the cryptographic keys follow key management procedures including Key recovery, Key updates, Key backup and restore?
What type of keys, in terms of strength, are used across the service?
If PKI Certificates are used for externally facing websites, do the PKI Certificates use a fully qualified Domain Name for the Subject common name (CN) (e.g., CN=www.customer.com, wildcard certificates not in use)?
What is the key management process supported by the application?
Can customers provide their keys or is Bring Your Own Keys (BYOK) supported?
Can the same encryption key/certificate be shared between production and non-production environments?
What kinds of authentication and access control procedures are in place?
How does the authentication process segregate the access to data across different customers?
Are all actions taken by any individual with root or administrative privileges, logged each time it occurs?
Does Scout support Single Sign-On (SSO), and if so, which standards?
Does Scout support federated Single Sign-On (SSO), and if so, which standards?
How are identities of customers using the Cloud service managed?
Are users required to re-authenticate to unlock a session (desktop, database, or application) that has been inactive for more than 30 minutes?
Is a user's identity verified before communicating an initial/temporary password or initiating a password reset by an automated or manual process?
What is the frequency of vulnerability scans performed by Scout?
What is the vulnerability remediation process followed in Scout?
Is regular penetration testing conducted in the system?
Which entity is responsible for patching all components that make up the cloud service? For which components is Soroco responsible?
Are findings from vulnerability scans tracked and are rescans performed until no findings are identified?
Are penetration tests of critical applications or networks with Internet connectivity conducted at least every 12 months and after significant changes?
Does each customer have a regular log of access to their data?
Are all actions taken by any individual with root or administrative privileges, logged each time it occurs?
Are logs continually reviewed, in real time, by a dedicated person/team?
Are logs protected from tampering and unauthorized access and retained for at least 1 year?
What ability does the product have to log User Activity Auditing and Administrator Activity Auditing?
Is there a documented Information Security Incident Management procedure in place?
Are incident response procedures for information security incidents defined and documented (e.g., network outages, abuse of access privileges)?
Are information security/business continuity incidents documented?
Is there a process to notify customers of information security incidents / business continuity incident that affects customer data or services?
