Control No.

Control Description Check For

18.1.1 Identification of applicable
legislation and contractual
requirements
Are confidentiality or non-disclosure agreements
reflecting the organization's needs for the protection
of information along with the right to audit included in
all agreements with external parties that have access
to organization data?

18.1.2 Intellecutal Property Rights Have procedures been implemented to ensure

compliance with legislative, regulatory and contractual
requirements related to intellectual property rights
and use of proprietary software products are adhered
to?

18.1.3 Protection of Records Is there an information classification policy or program

that defines levels of protection and responsibilities
for handling data?

18.1.4 Privacy and Protection of PII Have procedures been established that specify who is
responsible for contacting law enforcement
agencies/regulatory bodies and when they should be
contacted (e.g. breach of personal information)?

18.1.5 Regulations of Cryptographic Does your organization have a policy that governs the
Controls use of cryptographic controls for protection of
organization data?

18.2.1 Information Security Review Is the compliance with security policies and
procedures regularly reviewed to ensure that security
policies and standards are being followed?
Check In
Confidentiality or non-disclosure agreement

Intellecutal Right Property Procedure Manual

Information Security Policy Document

Privacy Policy

Cryptographic Controls Document

Internal Audit/ Review Report