Organizational Security Policy

Policy is the First Step in Implementing Cybersecurity

Configuration Management

POL.CM.L2-3.4.1

Baseline configurations and inventories of the CPE/SPE are created and maintained by Planet Security, Inc. for all CLIENT organizations for the entire product life-cycle.

POL.CM.L2-3.4.2

Planet Security, Inc. shall establish and enforce security configuration settings for the CPE/SPE.

POL.CM.L2-3.4.3

Planet Security, Inc. shall track, review, approve, or disapprove, and log changes to the CPE/SPE environment.

CLIENT personnel shall shall track, review, approve or disapprove, and log changes to organizational operations. This group of members is referred to as the Change Control Board (CCB).

POL.CM.L2-3.4.4

Planet Security, Inc. security subject matter experts shall analyze the security impact of changes prior to implementation into a production system.

CLIENT personnel shall track, review, approve or disapprove, and log changes to organizational operations.

POL.CM.L2-3.4.5

Planet Security, inc. shall define, document, approve, and enforce logical access restrictions associated with changes to the CPE/SPE.

Planet Security, inc. shall define, document, approve, and enforce physical and operational access restrictions associated with changes to CLIENT organizational operations.

POL.CM.L2-3.4.6

The CPE/SPE shall employ the principle of least functionality by providing only essential capabilities.

POL.CM.L2-3.4.7

The CPE/SPE shall be configured to restrict, disable, or prevent the use of nonessential programs, functions, ports, protocols, and services.

POL.CM.L2-3.4.8

The CPE/SPE shall employ and be configured to employ permit-by-exception (whitelisting) policy to allow the execution of authorized software.

POL.CM.L2-3.4.9

The CPE/SPE shall not allow user installed software via Application Whitelisting methodology.

For questions regarding this Information Security Policy, please reach out to your Planet Security, Inc. Support Engineers using Signal.