Enterprise Security Assessment > Data and Asset Security > Access Control

Do you employ segregation of duties for approving and implementing access requests for Scoped Systems and Data?

book reader icon
1 Minute
12/09/2024
facebook logo gray
linkedin logo gray
mail logo gray

Yes. When necessary, approving and implementing access requests to Scoped Systems and Data is segregated in order to minimize the risks of errors, misuse or unauthorized access. Access requests must include the scope of the required access and a justification.

Last update 1 week ago

Do your subcontractors have access to Scoped Systems and Data or to facilities processing the same?

Yes. If necessary, subcontractors have access to our scoped systems and data. We have DPA contracts with our subcontractors, ensuring full compliance.

Do you limit access to your systems that store or process Scoped Data?

Yes. Both physical and remote access to all of QR Planet's systems, whether storing or processing scoped or other data, is restricted on a need-to-access-basis.

Do you perform remote administration tasks of organizational assets in a manner preventing any unauthorized access?

All possible remote administration of organizational assets is done by pre-approved parties with restricted access as befits their role (RBAC) and requirement.

Do your require encrypted communications for all remote system access?

Yes. Any system access by remote sources needs to be encrypted, as required by our Remote Access and our Network Security Policies.

Do you remove electronic access to systems containing Scoped Data for terminated Constituents?

Yes. All access for terminated constituents is to be rescinded as soon as possible. This may never take more than 24 hours.