Please answer these simple 10 questions.

This survey will help determine if your security and governance would improve with YouAttest.

Does your organization segregate incompatible duties and implement alternative controls where necessary? SOC 2 Standard CC5.1.6

Yes

Addresses Segregation of Duties — Management segregates incompatible duties and, where such segregation is not practical, management selects and develops alternative control activities.

Does your organization understand dependencies between business processes and technology general controls? SOC 2 Standard CC5.2.1

Yes

Determines Dependency Between the Use of Technology in Business Processes and Technology General Controls — Management understands and determines the dependency and linkage between business processes, automated control activities, and technology general controls.

Does your organization establish security management process controls to restrict access and protect assets? SOC 2 Standard CC5.2.3

Yes

Establishes Relevant Security Management Process Controls Activities — Management selects and develops control activities that are designed and implemented to restrict technology access rights to authorized users commensurate with their job responsibilities and to protect the entity’s assets from external threats.

Does your organization perform control activities in a timely manner as defined by policies? SOC 2 Standard CC5.3.3

Yes

Performs in a Timely Manner — Responsible personnel perform control activities in a timely manner as defined by the policies and procedures.

Does your organization investigate and take corrective action on identified matters from control activities? SOC 2 Standard CC5.3.4

Yes

Takes Corrective Action — Responsible personnel investigate and act on matters identified as a result of executing control activities.

Does your organization periodically reassess policies and procedures for continued relevance? SOC 2 Standard CC5.3.5

Yes

Reassesses Policies and Procedures — Management periodically reviews control activities to determine their continued relevance and refreshes them when necessary.

Does your organization periodically review access credentials for validity? SOC 2 Standard CC6.2.2

Yes

Reviews Validity of Access Credentials — The entity reviews access credentials on a periodic basis for validity (for example, employees, contractors, vendors, and business partner personnel) and inappropriate system or service accounts.

Does your organization authorize, modify, or remove access based on roles, least privilege, and segregation of duties? SOC 2 Standard CC6.3

Yes

The entity authorizes, modifies, or removes access to data, software, functions, and other protected information assets based on roles, responsibilities, or the system design and changes, giving consideration to the concepts of least privilege and segregation of duties, to meet the entity’s objectives.

Does your organization use access control structures like role-based access to restrict access and support segregation of functions? SOC 2 Standard CC6.3.3

Yes

Uses Access Control Structures — The entity uses access control structures, such as role-based access controls, to restrict access to protected information assets, limit privileges, and support segregation of incompatible functions.

Does your organization periodically review access roles and rules for appropriateness? SOC 2 Standard CC6.3.4

Yes

Reviews Access Roles and Rules — The appropriateness of access roles and access rules is reviewed on a periodic basis for unnecessary and inappropriate individuals (for example, employees, contractors, vendors, business partner personnel) and inappropriate system or service accounts. Access roles and rules are modified, as appropriate.

Full Name *

Email *

Phone *

Business *

GRC Partner Email(Optional)