This is a draft. Each section offers an example: replace every [field] with what is true for you and delete the rest. Publishing it does not mean the practice exists, and Squaretrust does not check that it does.
Risk analysis and security policies
What the customer checks: that you have identified your main risks and set written security rules.
Example to adaptWe keep an information security policy approved by [role] and reviewed every [year]. A risk analysis, updated on [dd/mm/yyyy], lists our [x] main risks, their likelihood, their impact and the measure chosen for each. [Role] owns it.
To attach: the security policy (public or on request); the risk analysis (on request).
Incident handling
What the customer checks: that you can detect an incident, handle it and tell your customer in time.
Example to adaptAlerts from [monitoring tools] and reports from staff go to [address or channel]. [Role] qualifies the incident within [x hours] and decides on the response. If a customer’s data or service is affected, we tell them within [24 hours] at the address set in the contract. Every incident is logged with its cause and the corrective actions.
To attach: the incident handling procedure (on request).
Continuity, backups and crisis management
What the customer checks: that you can restore the service after an incident, and how fast.
Example to adaptWe back up [databases and customer files] every [day] to [provider, region]. Backups are encrypted and kept for [30 days]. We test a full restore [twice a year]; the last test was on [dd/mm/yyyy] and took [x hours]. In a major incident, [role] decides to trigger the recovery plan and informs the affected customers within [24 hours].
To attach: the backup policy (public); the recovery plan and the report of the last test (on request).
Suppliers and the supply chain
What the customer checks: that you know your own suppliers and choose them with security criteria.
Example to adaptWe keep a list of our subprocessors, with their purpose and processing region. Before taking on a new one, we check [its certifications, its data processing agreement, its location]. Every subprocessor that handles personal data is bound by a contract meeting Article 28 GDPR. We tell our customers [x days] before adding or replacing one.
To attach: the subprocessor list (public).
Building and maintaining systems, including vulnerabilities
What the customer checks: that your systems are kept up to date and that flaws get fixed.
Example to adaptWe apply security patches within [x days] for critical vulnerabilities and within [x days] for the others. Code is reviewed before every release, and our dependencies are scanned by [tool]. Anyone can report a vulnerability to us at [address]; we acknowledge it within [x working days].
To attach: the vulnerability handling policy (public or on request).
How you check that the measures work
What the customer checks: that you check regularly that your measures work, instead of assuming it.
Example to adaptWe review our security measures every [year] with [role]. A penetration test is run by [provider] every [x months]; the last one was on [dd/mm/yyyy], and its critical findings were fixed on [dd/mm/yyyy]. Access rights are reviewed every [quarter].
To attach: the summary of the last penetration test (on request).
Basic hygiene and training
What the customer checks: that the basics are applied and that staff are trained in them.
Example to adaptLaptops and servers receive updates [automatically]. Passwords are kept in [password manager], and multi-factor authentication is enforced on [tools]. Every newcomer goes through security awareness training, renewed every [year], with a [yearly] phishing exercise.
To attach: the IT policy or internal rules (on request).
Cryptography
What the customer checks: that data is encrypted where it should be.
Example to adaptData is encrypted in transit (TLS [1.2] or higher) and at rest ([AES-256], keys managed by [provider or service]). Laptop disks are encrypted, and so are backups.
To attach: the encryption policy, if the customer asks for it (on request).
People, access and assets
What the customer checks: that only the right people reach the right systems, and that you know what you own.
Example to adaptAccess is granted by role by [role] and removed on the day a person leaves. Administrator access is limited to [x] people. We keep an inventory of our laptops, servers and online services, updated every [quarter]. Every employee signs [a confidentiality clause].
To attach: the access management policy (on request).
Authentication and secured communications
What the customer checks: that access to important systems takes more than a password, and that your communications are protected.
Example to adaptMulti-factor authentication is mandatory for [email, hosting, source code, admin tools]. Internal communication goes through [tool], and we have a fallback, [phone or channel], if email is down.