Security

Enterprise Risk Management

1. Is there a formalized risk governance plan approved by management that defines the Enterprise Risk Management program requirements?‍

Yes there is a formalized risk governance plan.

2. Does the risk governance plan include risk management policies, procedures, and internal controls?‍

Chezie’s Risk Governance Plan is guided by procedures and our risk management policy.     Please see Risk Management Policy

3. Is there a documented third-party risk management program in place for the selection, oversight and risk assessment of third parties (e.g., subcontractors, suppliers, service providers, dependent service providers, sub-processors) in scope for the services?‍

Currently, we do not have a third-party risk management program, but we have plans to   implement one in the near future.

4. Are annual internal risk assessments performed?

Yes. All annual risk assessments are performed in-house.

5. Does your organization maintain an internal risk register for tracking and remediating risks?

As part of our risk governance plan, we maintain an internal risk register.

6. How often is the risk register reviewed internally?

We review our risk register annually.

Information Security Policy

1. Is there a set of information security policies that have been approved by management, published, and communicated to constituents?

Yes, please see Information Security Policy.

2. Do the information security policies and procedures establish requirements for the protection of information that is processed, stored or transmitted on external systems?

The information security policies and procedures establish requirements for the protection of information. We follow industry-standard best practices to ensure all information we handle is done so with security in mind.

3. Have all information security policies and standards been reviewed in the last 12 months?

All information security policies have been reviewed in the last 12 months.

Asset and Information Management

1. Is there a set of information security policies that have been approved by management, published, and communicated to constituents?‍

Yes, please see Information Security Policy.‍

2. Do the information security policies and procedures establish requirements for the protection of information that is processed, stored or transmitted on external systems?‍

The information security policies and procedures establish requirements for the protection of information. We follow industry-standard best practices to ensure all information we handle is done so with security in mind.‍

3. Have all information security policies and standards been reviewed in the last 12 months?‍

All information security policies have been reviewed in the last 12 months.