Form banner image

Please answer these simple 10 questions.

This survey will help determine if your security and governance would improve with YouAttest.

Does your enterprise have a system to automate detections of identity risks, such as over-privileged accounts? GLBA Standard 314.4(b)

Yes

No

Risk assessment: Conduct a written risk assessment to identify reasonably foreseeable internal and external risks to the security, confidentiality, and integrity of customer information, and assess the sufficiency of safeguards.

Is there an assigned resource to implement the policies of risk assessment and information security program? GLBA Standard 314.4(a)

Yes

No

Designate a Qualified Individual: Appoint a qualified individual responsible for overseeing, implementing, and enforcing the information security program.

Does your organization have policies and practices around allocating appropriate access to customer information? GLBA Standard 314.4(c)(1)

Yes

No

Access controls: Implement and periodically review access controls, including technical and physical controls to authenticate and permit access only to authorized users based on need.

Does your organization have quantified access request/approval for customer information resources? GLBA Standard 314.4(c)(1)

Yes

No

Access controls: Implement and periodically review access controls, including technical and physical controls to authenticate and permit access only to authorized users based on need.

Does your organization have procedures to address security incidents involving customer information? GLBA Standard 314.4(h)

Yes

No

Incident response plan: Establish a written incident response plan designed to promptly respond to, and recover from, any security event materially affecting the confidentiality, integrity, or availability of customer information.

Does your enterprise have automated methods to review access in emergency mode operations or contingency plans? GLBA Standard 314.4(c)(1)

Yes

No

Access controls: Implement and periodically review access controls, including technical and physical controls to authenticate and permit access only to authorized users based on need.

Does your enterprise perform periodic evaluations of key resources for security controls around customer information? GLBA Standard 314.4(g)

Yes

No

Evaluate and adjust: Evaluate and adjust the information security program in light of testing and monitoring results, material changes, or other circumstances that may impact the program.

Does your enterprise have the ability to review access by group/role to physical access to customer information resources? GLBA Standard 314.4(c)(1)

Yes

No

Access controls: Implement and periodically review access controls, including technical and physical controls to authenticate and permit access only to authorized users based on need.

Does your organization ensure that individual access is granted to users of customer information for allocation, review, and revocation? GLBA Standard 314.4(c)(1)

Yes

No

Access controls: Implement and periodically review access controls, including technical and physical controls to authenticate and permit access only to authorized users based on need.

Does your organization have an established method to ascertain access to customer information and create reports for compliance? GLBA Standard 314.4(i)

Yes

No

Reporting to board: Require the Qualified Individual to report in writing, regularly and at least annually, to the board of directors or equivalent governing body on the overall status of the information security program.

Full Name *

Email *

Phone *

Business *

GRC Partner Email(Optional)

NEXT