{"text_format":"1","workbook":"xlsx","n_sheets":13,"sheets":["Copyright","Terms of Use","Instructions","Dashboard","Business Information","Documentation","Future","Lite","Z. Additional Questions","Glossary","Formula Notes","Full Lite","Drops"],"not_rendered":{"charts":0,"images":1,"macros":1,"external_links":0,"defined_names":34,"comments":1,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Copyright","index":0,"n_rows":12,"n_cols":2,"rows_kept":12,"cut":false,"hidden":false,"merged":[]}
[]
[null,"Copyright "]
[]
[null,"© 2016 The Santa Fe Group, Shared Assessments Program. All rights reserved. "]
[]
[null,"Documents created under the Shared Assessments Program may be downloaded from the official Shared Assessments Program website at www.sharedassessments.org."]
[]
[null,"While retaining copyrights, the Shared Assessments Program makes specific documents available to members and purchasers for the purpose of conducting self-assessments and third party security assessments. Licenses for other uses are available from Shared Assessments. Individuals and organizations should review the terms of use prior to downloading, copying, using or modifying Shared Assessment Program documents."]
[]
[null,"This notice must be included on any copy of the Shared Assessments Program documents, excluding assessors or consultants' reports."]
[]
[null,"The Shared Assessments Program is administered by The Santa Fe Group (www.santa-fe-group.com). Questions about this document and the program should be directed to info@sharedassessments.org. "]

{"sheet":"Terms of Use","index":1,"n_rows":16,"n_cols":2,"rows_kept":16,"cut":false,"hidden":false,"merged":[]}
[]
[null,"Terms of Use"]
[null,"2017 SHARED ASSESSMENTS STANDARDIZED INFORMATION GATHERING (SIG) QUESTIONNAIRE (2017 SIG)"]
[null,"The Shared Assessments Program (\"Program\") maintains, promotes and facilitates the use of the Standardized Information Gathering (\"SIG\") questionnaire documents."]
[]
[null,"The Shared Assessments Program attaches the following conditions to individuals and organizations downloading, copying and/or using the Program Documents:"]
[]
[null,"- No modifications may be made to the Program documents without the express written permission of the Shared Assessments Program and The Santa Fe Group."]
[null,"- Organizations must notify The Santa Fe Group at sharedassessments@santa-fe-group.com of their reasons for the modifications and make the modifications available for"]
[null,"review and approval as additions and/or modifications to the current version of the documents. "]
[null,"- Copyright and all other intellectual property or proprietary rights in any modifications to the Shared Assessments Program documents shall belong to the Shared Assessments "]
[null,"Program and The Santa Fe Group."]
[null,"- Persons downloading the Program documents who wish to incorporate the AUP and/or SIG into a software product offered for license or sale must first obtain a separate "]
[null,"license from the Shared Assessments Program."]
[null,"The Program documents have been developed as tools for information security, privacy and business continuity compliance. They are based on general information security and privacy laws, regulation, principles, frameworks, audit programs, seal programs and regulatory guidance from various jurisdictions and do not constitute legal advice or an exhaustive list of questions or procedures covering all the information security or privacy laws in the US, or rest of the world, that may apply to a service provider. Each user should consult counsel on a case-by-case basis to ensure compliance with all applicable information security and privacy laws, regulations, policies and standards."]
[null,"THE SHARED ASSESSMENTS PROGRAM DOCUMENTS ARE PROVIDED \"AS IS\" AND ANY EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, ARE DISCLAIMED. IN NO EVENT SHALL THE SANTA FE GROUP, OR THE SHARED ASSESSMENTS PROGRAM, ITS SPONSORS OR PROGRAM MEMBERS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THE SHARED ASSESSMENTS PROGRAM DOCUMENTS, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."]

{"sheet":"Instructions","index":2,"n_rows":44,"n_cols":6,"rows_kept":44,"cut":false,"hidden":false,"merged":[]}
[]
[null,null,null,"Assessee Instructions",null,"Issuer/Outsourcer Instructions"]
[null,null,null,"Review the request provided by your client/customer which should provide you with ",null,"We recommend that prior to issuing the SIG you review which sections of the SIG your"]
[null,null,null,"instructions on how to answer the SIG and detail the sections of the SIG you are",null,"vendor should answer based on the type of service(s) they provide. We recommend"]
[null,null,null,"required to complete. In addition, your client/customer should provide you with the",null,"that along with the SIG, you notify them of the sections they are required to complete"]
[null,null,null,"scope of services for which to provide responses. If you did not receive",null,"and any other information required to accurately complete the SIG (additional"]
[null,null,null,"instructions or scope from your client we recommend you contact them and seek",null,"questions, documents, etc.)."]
[null,null,null,"guidance on how they need the SIG answered and the sections they require you to"]
[null,"2017 SHARED ASSESSMENTS STANDARDIZED INFORMATION",null,"complete. ",null,"Detailed instructions on how to use the SIG are contained in the How To Guide"]
[null,"GATHERING (SIG) QUESTIONNAIRE (2017 SIG) Lite - WalkMe",null,null,null,"which you may want to provide along with the SIG."]
[null,"Version 2017",null,"Primary or parent questions are followed by numbered sub or child questions."]
[null,"Released: November 2016",null,"The SIG has built-in automation. Based on your responses, cells will change color",null,"SIG Management Tool (SMT)"]
[null,null,null,"or if Excel macros are enabled child questions may not be displayed. This will reduce",null,"A macros-enabled spreadsheet is provided to Issuers of the SIG to help with"]
[null,"http://www.sharedassessments.org",null,"the number of questions you are required to complete. When you answer No or N/A",null,"processing service provider responses and managing the transfer of responses"]
[null,"sharedassessments@santa-fe-group.com",null,"to a question in a cell, all of its related sub-questions will either be hidden and/or",null,"from previous versions of the SIG. If a master SIG is created, the SMT allows for"]
[null,null,null,"the response field will change color identifying that question has been answered.",null,"comparisons of all responses in the master SIG to the SIG offered by a service"]
[null,"Initiator Information",null,"The issuer will see only the No or N/A response for the parent and all of its child",null,"provider. The SMT will also transfer responses and the \"Additional Information\""]
[null,"WalkMe has completed Shared Assessments Standardized",null,"questions. If your client/customer requests a maturity response, for all Yes responses",null,"field from previous versions of the SIG. For a full list of functions, please refer"]
[null,"Information Gathering (SIG) self-assessment questionnaire.",null,"you must provide a Maturity value for that question in the Maturity column. The Maturity levels",null,"to the SMT Functionality tab."]
[null,"By using the SIG you can obtain all the information necessary",null,"are provided when the cell is selected."]
[null,"to conduct an initial assessment of WalkMe’s IT, privacy and",null,null,null,"Note: Detailed instructions for the use of the SMT are included in the How To Guide."]
[null,"data security controls.",null,"There are two parts to this questionnaire:"]
[null,null,null," - SIG Lite"]
[null,"The SIG questionnaire is a compilation of questions used",null," - Detail tabs (A through U)"]
[null,"to determine how information technology and data security",null,"The instructions below will help you in the completion of the SIG Lite or full SIG. "]
[null,"risks are managed across a broad spectrum of risk control areas."]
[null,"As such, it addresses risk controls across 16 different risk areas.",null,"SIG Lite"]
[null,"The robust set of questions contained in the SIG are reviewed",null,"1) Complete the \"Business Information\" tab."]
[null,"annually for updates and revisions, and are based on referenced ",null,"2) Compile the documentation requested on the \"Documentation\" tab."]
[null,"industry standards (FFIEC, NIST, ISO, COBIT and PCI).",null,"3) Answer all of the questions on the \"SIG Lite\" tab by selecting Yes, No or N/A"]
[null,"New risk areas are added on a regular basis, with Cloud services ",null,"from the drop-down menu."]
[null,"and mobile device security, as examples of some of the more",null,"4) Use the \"Additional Information\" field to provide any pertinent information."]
[null,"recent  additions.",null," (An explanation is required for N/A responses.)"]
[null,null,null,"5) Answer questions on the \"Additional Questions\" tab (tab Z) only if additional"]
[null,"Our SIG provides WalkMe's customers with a standardized",null," questions have been inserted."]
[null,"consistent methodology to gather pertinent information about the"]
[null,"technology, operating and data security controls within WalkMe’s",null,"Note: Answers provided in the Lite tab are automatically transferred to the "]
[null,"environment. The SIG was developed to enable a service provider",null,"corresponding tab in the full SIG avoiding the need to answer those questions again."]
[null,"to compile complete information about these risk areas in one"]
[null,"document. By compiling all of this information in a single document,"]
[null,"a service provider is able to complete one questionnaire, which can"]
[null,"then be shared with multiple clients. This avoids the time consuming"]
[null,"and expensive requirement of completing multiple questionnaires"]
[null,"for multiple clients."]

{"sheet":"Dashboard","index":3,"n_rows":15,"n_cols":6,"rows_kept":15,"cut":false,"hidden":false,"merged":[[1,1,1,5]]}
[null,"Dashboard",null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""}]
[null,"The Dashboard provides you with a quick and easy reference to determine if the required sections of the SIG have been completed. As questions are answered, either directly or by being pre-filled, the Dashboard will track the completion percentage of each section."]
[null,"Tabs","% Comp",null,"Response Cell Background Color Coding (All tabs)","Resp"]
[null,"Copyright","N/A",null,"Response Required (all cells with a blue background are editable)"]
[null,"Terms of Use","N/A",null,"Yes Response","Yes"]
[null,"Instructions","N/A",null,"No Response","No"]
[null,"Business Information",{"$f":"'Business Information'!$C$2","v":1},null,"N/A Response","N/A"]
[null,"Documentation","N/A",null,"Top of table (no response required)"]
[null,{"$f":"Lite!$B$1","v":"SIG Lite"},{"$f":"Lite!$D$2","v":1}]
[null,"Z. Additional Questions","N/A"]
[null,"Glossary","N/A"]
[null,"Formula Notes","N/A"]
[null,"Full","N/A"]
[null,"Full Lite","N/A"]
[null,"SIG Total",{"$f":"IF(COUNTA(INDEX(WorksheetCount,0))>15,Lite!AI22,Lite!D2)","v":1}]

{"sheet":"Business Information","index":4,"n_rows":38,"n_cols":6,"rows_kept":38,"cut":false,"hidden":false,"merged":[]}
[null,"Business Information",null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},"Count","Resp"]
["Serial No",null,{"$f":"IF(E3=0,\"0%\",E3/E2)","v":1},"Percent Complete",{"$f":"COUNTA(E4:E45)","v":32}]
[{"$f":"MAX(A4:A38)","v":4004},"Question/Request",null,"Response",{"$f":"COUNTIF(E4:E45,1)","v":32}]
[2891,"Assessee Name",null,"Yair Amsel",{"$f":"COUNTA(D4)","v":1},{"$f":"IF(D4=\"Yes\",1,IF(D4=\"No\",2,IF(D4=\"N/A\",3,0)))","v":0}]
[2892,"Assessee Job Title",null,"System Security Specialist",{"$f":"COUNTA(D5)","v":1},{"$f":"IF(D5=\"Yes\",1,IF(D5=\"No\",2,IF(D5=\"N/A\",3,0)))","v":0}]
[2893,"Assessee Contact Information",null,"yair.a@walkme.com, 1-855-4-WALKME (925563)",{"$f":"COUNTA(D6)","v":1},0]
[3749,"Names and titles/functions of individuals who contributed to this questionnaire",null,"Daniel Chechik, CISO",{"$f":"COUNTA(D7)","v":1},0]
[2894,"Date of Response",null,"2019-01-11",{"$f":"COUNTA(D8)","v":1},0]
[null,"Company Profile",null,null,null,0]
[2896,"Name of the holding or parent company",null,"N/A",{"$f":"COUNTA(D10)","v":1},3]
[2897,"Company/business name",null,"WalkMe Ltd.",1,0]
[2898,"Publicly or privately held company",null,"Privately held",1,0]
[2899,"If public, what is the name of the Exchange",null,null,{"$f":"IF(D12=\"Privately held\",1,COUNTA(D13))","v":1},0]
[2900,"If public, what is the trading symbol",null,null,{"$f":"IF(D12=\"Privately held\",1,COUNTA(D14))","v":1},0]
[2901,"Type of legal entity and state of incorporation",null,"Ltd, Israel",1,0]
[2902,"How long has the company been in business",null,"Since 2011",1,0]
[2903,"Are there any material claims or judgments against the company",null,"No",1,2]
[2904,"If yes, describe the impact it may have on the services in scope of this document",null,null,{"$f":"IF(D17=\"No\",1,COUNTA(D18))","v":1},0]
[4000,"Has your company suffered a data loss or security breach within the last 3 years?",null,"No",1,2]
[4001,"If yes, please describe the loss or breach.",null,null,{"$f":"IF(D19=\"No\",1,COUNTA(D20))","v":1},0]
[4002,"Has any of your Third Party Vendors suffered a data loss or security breach within the last 3 years?",null,"No",1,2]
[4003,"If yes, please describe the loss or breach.",null,null,{"$f":"IF(D21=\"No\",1,COUNTA(D22))","v":1},0]
[null,"Scope\nPlease provide the below responses to establish the scope of the SIG",null,null,null,0]
[2911,"Are the answers in this questionnaire for only one facility or geographic location? If yes, provide description of physical location (address, city, state, country). ",null,"Yes. The main production Environment Is AWS US-West region (N. California), Availability zone 1a",{"$f":"COUNTA(D24)","v":1},0]
[2912,"Backup site physical address",null,"AWS US-West region (N. California), Availability zone 1c",{"$f":"COUNTA(D25)","v":1},0]
[2913,"Any additional locations where Scoped Systems and Data is stored",null,"No",{"$f":"COUNTA(D26)","v":1},2]
[2914,"If yes, provide each location (address, city, state, country).",null,null,{"$f":"IF(D26=\"No\",1,COUNTA(D27))","v":1},0]
[2973,"Are the answers to this questionnaire for only one specific type of service? If yes, describe the service.",null,"WalkMe is a Digital Adoption Platform. Using it, organizations can create online interactive guides on top of web base applications, helping users to perform complex business processes. WalkMe allows companies to build and overlay interactive Walkthrough s that enable users to self-task successfully with even the most complex processes. Walkthrough s are a sequence of tip balloons that are displayed onscreen based on what the user needs to do. WalkMe’s technology focuses the users' attention on the screen and takes them step-by-step as they progress through the task in real time.",{"$f":"COUNTA(D28)","v":1},0]
[3919,"Are software applications provided?",null,"Yes",{"$f":"COUNTA(D29)","v":1},1]
[3992,"List the applications provided that are in scope.",null,"WalkMe Digital Adoption Platform.\nWalkMe includes three components:\n1. WalkMe Editor: The back-end where your WalkMe admin will create, edit, and publish WalkMe Apps.\n2. WalkMe Player: The front-end where your users will access WalkMe Apps.\n3. WalkMe Insights: A powerful tool for making sense of how your end-users are experiencing your WalkMe Apps.",{"$f":"IF($D$29=\"No\",1,COUNTA(D30))","v":1},0]
[3993,"Identify the applications which are covered by the secure software development lifecycle.",null,"The entire WalkMe application platform is covered by the secure software development lifecycle.",{"$f":"IF($D$29=\"No\",1,COUNTA(D31))","v":1},0]
[3994,"What type of software is being provided, select all that apply?",null,null,null,0]
[3995,"Commercial Off-The-Shelf (COTS)",null,"Yes",{"$f":"IF($D$29=\"No\",1,COUNTA(D33))","v":1},1]
[3996,"Custom Developed",null,"Yes",1,1]
[3997,"Cloud ",null,"Yes",1,1]
[3998,"Mobile",null,"Yes",1,1]
[4004,"Open Source Software",null,"Yes",1,{"$f":"IF(D37=\"Yes\",1,IF(D37=\"No\",2,IF(D37=\"N/A\",3,0)))","v":1}]
[3999,"Other",null,"Yes",1,1]

{"sheet":"Documentation","index":5,"n_rows":32,"n_cols":4,"rows_kept":32,"cut":false,"hidden":false,"merged":[]}
["Serial No","Documentation*\nUse this section to request any specific documentation you want the Respondent to provide along with the SIG",null,{"$f":"Master","v":0}]
[{"$f":"MAX(A3:A32)","v":4006},"Document Request","Question Reference","Name and/or type of information provided (e.g., document, summary, table of contents)"]
[2922,"* Information Security policies and procedures. This should include the following (if not, provide the individual documents as necessary):\na) Hiring policies and practices and employment application\nb) User Account administration policy and procedures for all supported platforms where Scoped Systems and Data are processed and network/LAN access\nc) Supporting documentation to indicate completion of User Entitlement reviews\nd) Employee Non-disclosure agreement document\ne) Information Security Incident Report policy and procedures, including all contract information\nf) Copy of Visitor policy and procedures\ng) Security Log Review policies and procedures\nh) Copy of third party risk management policies and procedures"]
[2923,"* Copy of internal or external information security audit report"]
[2924,"Information technology and security organization charts (including where Respondent information security resides and the composition of any information security steering committees).\nNote: Actual names of employees are not required"]
[2925,"* Physical Security policy and procedures (building and/or restricted access)"]
[2926,"* Third party security reviews/assessments/penetration tests "]
[2927,"Legal clauses and confidentiality templates for third parties"]
[2928,"Topics covered in the security training program"]
[2929,"* Security incident handling and reporting process"]
[2930,"Network configuration diagrams for internal and external networks defined in scope. Note: Sanitized versions of the network diagram are acceptable"]
[2931,"* System and network configuration standards"]
[2932,"* System backup policy and procedures"]
[2933,"* Offsite storage policy and procedures"]
[2934,"* Vulnerability and threat management scan policy and procedures"]
[2935,"* Application security policy"]
[2936,"* Change control policy/procedures"]
[2937,"* Problem management policy/procedures"]
[2938,"* Certification of proprietary encryption algorithms"]
[2939,"* Internal vulnerability assessments of systems, applications, and networks"]
[2940,"* Software development and lifecycle (SDLC) process document"]
[2941,"* Business Resiliency (continuity plan) (BCP) and/or Disaster Recovery Plan"]
[2942,"* Most recent BCP/DR test dates and results"]
[2943,"* Most recent AUP/SSAE16/SOC2 audit report(s)"]
[3301,"* Privacy Policies (internal, external, web)"]
[4005,"* Executive Summary of certificates held. (e.g. PCI, HIPAA, ISO)"]
[4006,"* Performance Reports against contracted SLAs"]
[]
[]
[]
[]
[null,"*If the Respondent policy prohibits the distribution of any of these documents, please provide the document title, the table of contents, the executive summary, revision history, and evidence of approval."]

{"sheet":"Future","index":6,"n_rows":0,"n_cols":0,"rows_kept":0,"cut":false,"hidden":true,"merged":[]}

{"sheet":"Lite","index":7,"n_rows":193,"n_cols":36,"rows_kept":193,"cut":false,"hidden":false,"merged":[[2,1,2,8]]}
[12,"SIG Lite",null,null,null,null,null,null,{"$f":"IF(Master<>\"Master\",\"\",Master)","v":""},null,null,null,null,null,null,null,"SL"]
[null,null,null,{"$f":"IF(SUM(AE5:AE21)/SUM(AD5:AD21)=0,\"0%\",SUM(AE5:AE21)/SUM(AD5:AD21))","v":1},"Percent Complete",null,"Tab Automation:","Enable",null,{"$f":"COUNTA(J5:J193)","v":172}]
["Detail SN","Questionnaire Instructions:\n - For each question choose either Yes, No or N/A from the drop-down menu provided. If N/A is chosen, an explanation is mandatory. Use the Additional Information Field in column F to provide.\n - To display the entire contents of the tab and disable the transfer of responses from the Lite tab, select the word \"Disable\" in the Tab Automation field at the top of the page.\n - Use the Maturity column to identify the Maturity of the question. See the How To Guide for instructions on filling out this field.",null,null,null,null,null,null,null,"Q depth","Detail Letter","Q # Calc","Sec Num",null,null,null,"HL Ans","Loc Ans","Comb Ans",null,"Q Carry Dn","Resp Calc",null,"Filter","Sec Calc",null,null,"Optional\nScoring","Section","Q per Sec","1 & 2 count"]
[{"$f":"MAX(A5:A243)","v":4408},"Ques Num"," Question/Request","Response","Maturity","Additional Information","AUP Reference","ISO 27002:2013 Relevance"]
[null,null,"A. Risk Assessment and Treatment",null,null,null,null,null,null,null,1,{"$f":"IF(A5=\"\",L4,L4+1)","v":0},{"$f":"IF(J5=\"\",M4+1,M4)","v":1},null,null,null,{"$f":"IF(ISNA(VLOOKUP(A5,BusInfoArray,6,FALSE)),0,VLOOKUP(A5,BusInfoArray,6,FALSE))","v":0},{"$f":"IF(J5=\"\",\"\",IF(D5=\"\",0,IF(D5=\"N/A\",3,IF(D5=\"Yes\",1,IF(D5=\"No\",2,\"Oops there is an error\")))))","v":""},{"$f":"IF(J5=\"\",\"\",IF(Q5>0,Q5,IF(R5>0,R5,0)))","v":""},null,{"$f":"IF(J5=\"\",U4,IF(AND(S5>1,OR(U4=\"\",U4=0,U4>=J5)),J5,IF(J5>U4,U4,0)))","v":0},{"$f":"IF(Master=\"Master\",R5,IF(V4=\"\",S5,IF(OR(AND(U5>0,S5<V4),AND(U5=1,S5<=V4)),V4,S5)))","v":""},null,{"$f":"IF(AND(J5=1,S5=1),2,IF(AND(V4=1,M5=M4),2,IF(AND(X4=2,M5=M4),2,IF(OR(J5=1,J5=\"\"),1,\"\"))))","v":1},{"$f":"IF(V5>0,1,0)","v":1},null,null,null,"A",{"$f":"COUNTIF($K$5:$K$243,AC5)","v":22},{"$f":"SUMPRODUCT(($Y$5:$Y$243)*($K$5:$K$243=AC5))","v":22}]
[3198,{"$f":"IF(A6=\"\",\"\",$Q$1&\".\"&L6)","v":"SL.1"},"Is there a risk assessment program that has been approved by management, communicated to constituents and an owner to maintain and review the program? if yes, does it include:","Yes",5,"Formal risk assessments are aligned with the enterprise-wide framework and performed at least annually, or at planned intervals, determining the likelihood and impact of all identified risks, using qualitative and quantitative methods.\nThe likelihood and impact associated with inherent and residual risk is determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance).\nRisks are mitigated to acceptable levels based on company-established criteria in accordance with reasonable resolution time frames.","A.1 IT & Infrastructure Risk Governance and Context","5.1 6.1.2","Leadership & Commitment, Information Security Risk Assessment",1,"A",{"$f":"IF(A6=\"\",L5,L5+1)","v":1},{"$f":"IF(J6=\"\",M5+1,M5)","v":1},null,null,null,{"$f":"IF(ISNA(VLOOKUP(A6,BusInfoArray,6,FALSE)),0,VLOOKUP(A6,BusInfoArray,6,FALSE))","v":0},{"$f":"IF(J6=\"\",\"\",IF(D6=\"\",0,IF(D6=\"N/A\",3,IF(D6=\"Yes\",1,IF(D6=\"No\",2,\"Oops there is an error\")))))","v":1},{"$f":"IF(J6=\"\",\"\",IF(Q6>0,Q6,IF(R6>0,R6,0)))","v":1},null,{"$f":"IF(J6=\"\",U5,IF(AND(S6>1,OR(U5=\"\",U5=0,U5>=J6)),J6,IF(J6>U5,U5,0)))","v":0},{"$f":"IF(Master=\"Master\",R6,IF(V5=\"\",S6,IF(OR(AND(U6>0,S6<V5),AND(U6=1,S6<=V5)),V5,S6)))","v":1},null,{"$f":"IF(AND(J6=1,S6=1),2,IF(AND(V5=1,M6=M5),2,IF(AND(X5=2,M6=M5),2,IF(OR(J6=1,J6=\"\"),1,\"\"))))","v":2},{"$f":"IF(V6>0,1,0)","v":1},null,null,null,"B",2,2]
[3286,"SL.2","Is there a program to manage the treatment of risks identified during assessments?","Yes",5,"Information security risks are managed in accordance with an agreed operational risk framework. All security risks are:\nClearly documented and protected from unauthorized disclosure;\nHave clearly defined accountability;\nMaintaining traceability of the risk throughout the risk lifecycle;\nHave a consistent risk rating system across; and\nOnly be risk-accepted by appropriately authorized persons.","A.2 IT & Infrastructure Risk Assessment Life Cycle","6.1.3","Information Security Risk treatment",2,"A",2,1,null,null,null,0,1,1,null,0,1,null,2,1,null,null,null,"C",1,1]
[4158,"SL.3","A formal process for assigning appropriate management ownership for each risk?","Yes",5,null,"A.2 IT & Infrastructure Risk Assessment Life Cycle",null,null,2,"A",3,1,null,null,null,0,1,1,null,0,1,null,2,1,null,null,null,"D",13,13]
[4159,"SL.4","A formal process for appropriate management knowingly and objectively accepting risks and approving action plans?","Yes",5,null,"A.2 IT & Infrastructure Risk Assessment Life Cycle",null,null,2,"A",4,1,null,null,null,0,1,1,null,0,1,null,2,1,null,null,null,"E",9,9]
[4160,"SL.5","A formal process for tracking the status of action plans and reporting them to management?","Yes",5,null,"A.2 IT & Infrastructure Risk Assessment Life Cycle",null,null,2,"A",5,1,null,null,null,0,1,1,null,0,1,null,2,1,null,null,null,"F",3,3]
[4161,"SL.6","Controls identified for each material risk?","Yes",5,null,"A.2 IT & Infrastructure Risk Assessment Life Cycle",null,null,2,"A",6,1,null,null,null,0,1,1,null,0,1,null,2,1,null,null,null,"G",18,18]
[4162,"SL.7","Measures for defining, monitoring, and reporting risk metrics?","Yes",5,"We follow NIST Cybersecurity framework, which uses risk management processes to enable WalkMe to inform and prioritize decisions regarding cybersecurity. It supports recurring risk assessments and validation of business drivers to help WalkMe select target states for cybersecurity activities that reflect desired outcomes. Thus, the Framework gives WalkMe the ability to dynamically select and direct improvement in cybersecurity risk management for the IT and ICS environments. The Framework is adaptive to provide a flexible and risk-based implementation that can be used with a broad array of cybersecurity risk management processes. Examples of cybersecurity risk management processes include International Organization for Standardization (ISO) 31000:20094, ISO/IEC 27005:20115, National Institute of Standards and Technology (NIST) Special Publication (SP) 800-396, and the Electricity Subsector Cybersecurity Risk Management Process (RMP) guideline.","A.2 IT & Infrastructure Risk Assessment Life Cycle",null,null,2,"A",7,1,null,null,null,0,1,1,null,0,1,null,2,1,null,null,null,"H",9,9]
[853,"SL.8","Do Subcontractors have access to Scoped Systems and Data? (backup vendors, service providers, equipment support maintenance, software maintenance vendors, data recovery vendors, etc.)? If yes, is there:","Yes",null,"WalkMe uses a number of third-party subcontractors to assist with the provision of our service. However, only four (4) subcontractors have access to customers’ end-users' PII (e.g., IP addresses, etc.):\n1) Amazon AWS, our cloud hosting provider.\n2) Akamai, our CDN.\n3) Good Data Analytics engines, our processing service.\n4) Logz.io for logging services.",null,15,"Supplier relationships",1,"A",8,1,null,null,null,0,1,1,null,0,1,null,2,1,null,null,null,"I",21,21]
[3897,"SL.9","A documented vendor management process in place for the selection, oversight and risk assessment of third party vendors? If yes, does it include:","Yes",5,null,"A.7 Subcontractor Selection and Management Process","15.1.1","Information security policy for supplier relationships",1,"A",9,1,null,null,null,0,1,1,null,0,1,null,2,1,null,null,null,"J",4,4]
[3898,"SL.10","Approval by management?","Yes",5,null,"A.7 Subcontractor Selection and Management Process","5.1.1","Policies on information security",2,"A",10,1,null,null,null,0,1,1,null,0,1,null,2,1,null,null,null,"K",15,15]
[3899,"SL.11","Annual review?","Yes",5,null,"A.7 Subcontractor Selection and Management Process","5.1.2","Review of the policies for information security",2,"A",11,1,null,null,null,0,1,1,null,0,1,null,2,1,null,null,null,"L",13,13]
[4168,"SL.12","Required reassessment when service delivery or contract changes?","Yes",5,null,null,null,null,2,"A",12,1,null,null,null,0,1,1,null,0,1,null,2,1,null,null,null,"M",14,14]
[3900,"SL.13","Review of the subcontractor's vendor management policy and procedures?","Yes",5,null,"A.9 Documenting Information Security Assessments for Subcontractors","15.2.1.g","Monitoring and review of supplier services",2,"A",13,1,null,null,null,0,1,1,null,0,1,null,2,1,null,null,null,"N",8,8]
[3901,"SL.14","Is there a process to identify and log subcontractor information security, privacy and/or data breach issues?","Yes",5,null,"A.9 Documenting Information Security Assessments for Subcontractors","15.2.1.e","Monitoring and review of supplier services",2,"A",14,1,null,null,null,0,1,1,null,0,1,null,2,1,null,null,null,"P",9,9]
[3886,"SL.15","Is there a vendor management program?","Yes",5,"We use Panorays, an external SaaS service, to automate third-party security management, and engage on the security posture of their third parties, vendors, suppliers and business partners in order to gain continuous visibility while ensuring compliance to regulations.\nPanorays inherently combines a continuous hacker’s view of the evaluated company together with internal policy enforcement. We examine multiple 3rd party vendors that offer the requested service from product and security perspectives. We classify the classification level that the 3rd party vendor will be exposed to, and adjust our security questionnaires and requirements. We ask for SOC 2 TYPE II, if the customer has it, we review it and send our questions for the ones that were not covered by the SOC 2 TYPE II. In case the vendor doesn't have, we send him our extended Security questionnaire. In addition, we look online, to obtain more information. Finally we review and assess the risks according to risk categories associated With Third-Party Relationships (Credit, Operational, Compliance, Strategic, Reputation, Privacy, Business continuity, etc.). We will only agree to work with a vendor that we are satisfied with their overall security. In case the 3rd party vendor meets our security requirements by our Security Policies, we proceed with the vendor engagement and validate annually that the vendor preserves their security methodologic according to the risk assessment and data classification that was required by the vendor.","A.5 Vendor Risk Management Program",null,null,1,"A",15,1,null,null,null,0,1,1,null,0,1,null,2,1,null,null,null,"T",7,7]
[71,"SL.16","Do external parties have access to Scoped Systems and Data or processing facilities?","No",null,"WalkMe uses a number of third-party subcontractors to assist with the provision of our service. In addition, WalkMe only uses subcontractors that we trust and we use appropriate contractual safeguards which we monitor to ensure the required standards are maintained.",null,15,"Supplier relationships",1,"A",16,1,null,null,null,0,2,2,null,1,2,null,2,1,null,null,null,"U",4,4,null,null,null,null,2]
[3633,"SL.17","Is the maturity of IT management processes formally evaluated at least annually using an established benchmark (e.g., COBIT maturity models)?","No",null,null,null,"17.1.3","Verify, review and evaluate information security continuity",1,"A",17,1,null,null,null,0,2,2,null,1,2,null,2,1,null,null,null,null,{"$f":"SUM(AD5:AD21)","v":172},{"$f":"SUM(AE5:AE21)","v":172},null,null,null,null,2]
[3225,"SL.18","Are there regular privacy risk assessments conducted? If yes, provide frequency and scope. If no, explain reason.","Yes",4,"We use NIST Cybersecurity Framework and Guidelines on Security and Privacy in Public Cloud Computing (SP 800-144) for best practice standards, and our coding standards are set according to CWE/SANS Top 25 Most Dangerous Software Errors, and OWASP best practices (especially in light of the OWASP top 10 web vulnerabilities). We maintain privacy controls according to most of the foundational principles of the Privacy by design approach. We validate all input types coming from the user side, utilize anti cross-site attacks measures in place, manage sessions according to best practices etc.","P.3 Privacy Organization and Program Maintenance","15.1.3.i ","Information and communication technology supply chain",1,"A",18,1,null,null,null,0,1,1,null,0,1,null,2,1,null,null,null,null,null,null,null,null,null,{"$f":"COUNTA(INDEX(WorksheetCount,0))","v":13}]
[3226,"SL.19","Are identified privacy risks and associated mitigation plans formally documented and reviewed by management?","Yes",5,"WalkMe maintains an extensive documented organizational information security policy that has been aligned to industry best practices, regulatory, Federal/State, international laws, annually updated, approved by management and communicated to appropriate constituents, as well as many additional procedures to protect confidential information and govern the processing of Data for any Data Objects in scope. Security and privacy policies are communicated in a way that requires employees to annually certify their understanding and compliance before access is granted. ISO27001 is the framework for our policies and procedures. Data Security Architecture is designed using CSA Trusted Cloud Architectural Standard, a known best practice industry standard.","P.3 Privacy Organization and Program Maintenance","15.1.1.l","Information security policy for supplier relationships",1,"A",19,1,null,null,null,0,1,1,null,0,1,null,2,1]
[3227,"SL.20","Are reasonable resources (in time and money) allocated to mitigating identified privacy risks?","Yes",5,null,"P.3 Privacy Organization and Program Maintenance",null,null,1,"A",20,1,null,null,null,0,1,1,null,0,1,null,2,1]
[3862,"SL.21","Is there a compliance risk management system that addresses the quality and accuracy of reported consumer data?","Yes",5,null,"P.3 Privacy Organization and Program Maintenance",null,null,1,"A",21,1,null,null,null,0,1,1,null,0,1,null,2,1]
[3863,"SL.22","Is there a compliance risk management system that addresses the quality of assembling and maintaining the data?","Yes",5,null,"P.3 Privacy Organization and Program Maintenance",null,null,1,"A",22,1,null,null,null,0,1,1,null,0,1,null,2,1]
[null,"","B. Security Policy",null,null,null,null,null,null,null,1,22,2,null,null,null,0,"","",null,0,"",null,1,1]
[3199,"SL.23","Is there an information security policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?","Yes",5,"WalkMe maintains an extensive documented organizational information security policy that has been aligned to industry best practices, regulatory, Federal/State, international laws, annually updated, approved by management and communicated to appropriate constituents, as well as many additional procedures to protect confidential information and govern the processing of Data for any Data Objects in scope. Security and privacy policies are communicated in a way that requires employees to annually certify their understanding and compliance before access is granted. ISO27001 is the framework for our policies and procedures. Data Security Architecture is designed using CSA Trusted Cloud Architectural Standard, a known best practice industry standard.","B.1 Information Security Policy Maintenance","5.1.1","Policies for information security",1,"B",23,2,null,null,null,0,1,1,null,0,1,null,2,1]
[2471,"SL.24","Have the policies been reviewed in the last 12 months?","Yes",null,null,"B.1 Information Security Policy Maintenance","5.1.2","Review of the policies for information security",1,"B",24,2,null,null,null,0,1,1,null,0,1,null,2,1,null,null,null,null,null,null,null,null,null,null,1]
[null,"","C. Organizational Security",null,null,null,null,null,null,null,1,24,3,null,null,null,0,"","",null,0,"",null,1,1]
[58,"SL.25","Is there a respondent information security function responsible for security initiatives?","Yes",5,"Security is managed by WalkMe's security team. They are titled System Security Specialists. They report to the CISO. The CISO is Responsible for information security. The CISO reports to the CTO which reports to the CEO of the company. The responsibilities include performing risk assessments and audits, creating workplans in order to mitigate the risks and implementing these workplans. Responsibilities are documented as part of the policy. ","C.1 Security Organization Roles / Responsibilities","6.1.1","Information Security Roles and Responsibilities",1,"C",25,3,null,null,null,0,1,1,null,0,1,null,2,1]
[null,"","D. Asset and Information Management",null,null,null,null,null,null,null,1,25,4,null,null,null,0,"","",null,0,"",null,1,1]
[3200,"SL.26","Is there an asset management policy approved by management, communicated to constituents and an owner to maintain and review?","Yes",3,"We maintain an asset management policy, according to which inventory of all information assets (hardware, software, processes, licensing). We maintain all Cloud assets using the AWS console. We have implemented Spiceworks, in order to track & manage Physical inventory assets, and Microsoft SCCM (System Center Configuration Manager) to track & manage Software inventory assets.","D. Asset and Information Management",8.1,"Responsibility for Assets",1,"D",26,4,null,null,null,0,1,1,null,0,1,null,2,1]
[2532,"SL.27","Is information classified?","Yes",5,"According to WalkMe data classification policy, we classify and label data based on its sensitivity in regard to content and context, according to our data classification policy. However, as mentioned above, the data we have from customer perspective is not personal or sensitive. In general, the information is classified into 5 levels of classification. Information is stored in secure locations.  Customer data is retained as long as the customer is active. Formal acceptable use rules been established for all type of assets, both hardware & software assets, according to our acceptable usage policy.\n\nAccording to WalkMe policy, all customer collected data is owned by the customer, labeled 'Business Confidential', and secured accordingly with appropriate controls.","D.1 Asset Accounting and Inventory","8.2.1","Classification of Information",1,"D",27,4,null,null,null,0,1,1,null,0,1,null,2,1]
[3295,"SL.28","Is there a removable media policy or program (CDs, DVDs, tapes, disk drives) that has been approved by management, communicated to appropriate constituents, and an owner to maintain and review the policy?","Yes",5,null,"D.4 Removable Device Security","8.3.1","Management of Removable Media",1,"D",28,4,null,null,null,0,1,1,null,0,1,null,2,1]
[1208,"SL.29","Is Scoped Data sent or received via physical media?","N/A",null,"No physical media is used. WalkMe maintains an acceptable usage policy, according to which, no removable media is allowed. It is both forbidden by policy, as well as technically prevented from connecting.","D.2 Physical Media Tracking","8.3.3","Physical Media in Transit",1,"D",29,4,null,null,null,0,3,3,null,1,3,null,2,1,null,null,null,null,null,null,null,null,null,null,2]
[1806,"SL.30","Are encryption tools managed and maintained for Scoped Data? If yes:","Yes",5,null,"D.5 Data Security Policy - Encryption",10.1,"Cryptographic controls",1,"D",30,4,null,null,null,0,1,1,null,0,1,null,2,1]
[3353,"SL.31","Are clients provided with the ability to generate a unique encryption key?","No",null,null,"D.5 Data Security Policy - Encryption","10.1.2","Key Management",1,"D",31,4,null,null,null,0,2,2,null,1,2,null,2,1,null,null,null,null,null,null,null,null,null,null,2]
[3354,"SL.32","Are clients provided with the ability to rotate their encryption key on a scheduled basis?","No",null,"WalkMe does not manage key rotation for AWS managed CMKs. AWS KMS automatically rotates AWS managed keys every three years (1095 days). When AWS KMS rotates a CMK, it writes the KMS CMK Rotation event to Amazon CloudWatch Events. WalkMe uses this event to verify that the CMK was rotated.\nFor IAM keys, we rotate keys every 270 days. We quarterly audit access key age to ensure rotation.","D.5 Data Security Policy - Encryption","10.1.2","Key Management",1,"D",32,4,null,null,null,0,2,2,null,1,2,null,2,1,null,null,null,null,null,null,null,null,null,null,2]
[3548,"SL.33","Are staff able to access client Scoped Data in an unencrypted state?","Yes",5,"The only users with access to the database are DevOps users and production support.  Access to the account in order to configure it, create Walkthroughs together with people from your side, but without database access is possible for WalkMe PS and CSM teams. The process ensures usage of two-factor Authentication, and every action is logged & audited.","H.3 Logical Access Authorization","9.2.3\n9.4.6","Management of privileged access rights Information access restriction",1,"D",33,4,null,null,null,0,1,1,null,0,1,null,2,1]
[3549,"SL.34","Are staff able to access client's encryption keys?","Yes",null,"The only users with access to AWS KMS are a handful of DevOps admins.  This is required for key management. The process ensures usage of two-factor Authentication, and every action is logged & audited.","H.3 Logical Access Authorization","9.2.3\n9.4.7","Management of privileged access rights Information access restriction",1,"D",34,4,null,null,null,0,1,1,null,0,1,null,2,1]
[3339,"SL.35","Is data segmentation and separation capability between clients provided?","Yes",5,null,"V.1 Service and Deployment Models","9.4.1 ","Information access restriction",1,"D",35,4,null,null,null,0,1,1,null,0,1,null,2,1]
[3481,"SL.36","Does the ability exist to legally demonstrate sufficient data segmentation, in the event of a client subpoena or a forensics incident, so as not to impact other clients data if using resource pooling?","Yes",5,"In the event a follow-up action after an information security incident requires legal action, if the incident affects the customer, WalkMe agrees to take all reasonable legal steps to cooperate and share information, to collaborate with the customer during investigation, according to WalkMe policy, and as long as there is no compromise to other customers data.","V.1 Service and Deployment Models","16.1.1 16.1.7","Responsibilities and Procedures,\nCollection of Evidence.",1,"D",36,4,null,null,null,0,1,1,null,0,1,null,2,1]
[3723,"SL.37","Is there a data classification retention program that identifies the data types that require additional management and governance?","Yes",5,null,"P.1 Scoped Privacy Data Inventory and Flows",8.1999999999999993,"Information Classification",1,"D",37,4,null,null,null,0,1,1,null,0,1,null,2,1]
[3489,"SL.38","Is there a self-service portal or API call available to clients which provides the ability to place a \"Legal hold\" on client data which may be subject to a legal action, without impacting other clients data retention or destruction schedules?","Yes",5,"WalkMe does not disclose customer information unless we’re required to do so to comply with a legally valid and binding order. Unless prohibited from doing so or there is clear indication of illegal conduct in connection with the use of WalkMe products or services, WalkMe notifies customers before disclosing content information.","P.6 Management of Client Scoped Privacy Data","16.1.1 16.1.7 18.1.2 18.1.3","Responsibilities and Procedures,\nCollection of Evidence,\nIntellectual Property Rights,\nProtection of records",1,"D",38,4,null,null,null,0,1,1,null,0,1,null,2,1]
[null,"","E. Human Resource Security",null,null,null,null,null,null,null,1,38,5,null,null,null,0,"","",null,0,"",null,1,1]
[4195,"SL.39","Is there a Human Resource policy approved by management, communicated to constituents and an owner to maintain and review? If yes, does it include:","Yes",5,"For employees, where legally permissible by local law, WalkMe Performs Cross reference checks for previous workplaces, HR interview for determining the reliability of the applicant, and background check calls to verify recommendations. For Contractors and vendors, as part of the vetting process, WalkMe Performs An individual assessment, and require signing NDA or Confidentiality Agreements as a precondition for engagement.\nEmployees are required to sign a Code of Ethics and agreement regarding non-disclosure/confidentiality. ",null,null,null,1,"E",39,5,null,null,null,0,1,1,null,0,1,null,2,1]
[2536,"SL.40","Security roles and responsibilities?","Yes",5,null,"C.1 Security Organization Roles/Responsibilities","6.1.1","Information security roles and responsibilities",2,"E",40,5,null,null,null,0,1,1,null,0,1,null,2,1]
[2538,"SL.41","Background screening?","Yes",5,null,"E.2 Background Investigation Policy Content","7.1.1","Screening",2,"E",41,5,null,null,null,0,1,1,null,0,1,null,2,1]
[183,"SL.42","Employment agreements?","Yes",5,null,"E.3 Agreements for Constituents","7.1.2","Terms and conditions of employment",2,"E",42,5,null,null,null,0,1,1,null,0,1,null,2,1]
[212,"SL.43","Security awareness training?","Yes",5,"Whenever a new employee is recruited, he/she is obligated to sign WalkMe's security policies, code of ethics and agreement regarding non-disclosure/confidentiality. In addition, the policies are explained thoroughly in the annual awareness training sessions that are given to all company employees. The measurement is done based on security drills testing awareness of best practices. As part of our recruitment process, we provide this training to all new hires as well. Specific roles (e.g., developers, IT personnel, etc.) are provided with additional role-specific security and privacy training. \n\nTraining is refreshed annually. Employees with access to sensitive information, including PII and PHI data, will receive periodic reminders of their responsibilities and receive ongoing, periodically updated security awareness training to fortify their understanding of current threats and corresponding security practices to mitigate such threats.","E.1 Security Awareness Training Program","7.2.2","Information security awareness, education, and training",2,"E",43,5,null,null,null,0,1,1,null,0,1,null,2,1]
[293,"SL.44","Disciplinary process for non-compliance?","Yes",5,"The disciplinary process depends on the severity of the violation and the recurrence of it. It can vary from a warning to termination of employment/contract and possible legal action.","E.5 Separation Procedures","7.2.3","Disciplinary process",2,"E",44,5,null,null,null,0,1,1,null,0,1,null,2,1]
[2557,"SL.45","Termination or change of status process?","Yes",5,"Upon termination or role change, HR initiates the process of revoking access (as well as returning equipment etc). All of the relevant personnel are part of the process and are required to approve the access is removed in the systems they are in charge of. The process initiates as soon as the termination or role change take place.","E.5 Separation Procedures",7.3,"Termination responsibilities",2,"E",45,5,null,null,null,0,1,1,null,0,1,null,2,1]
[3517,"SL.46","Are background checks performed for Service Provider Contractors and Subcontractors?","Yes",null,null,"E.2 Background Investigation Policy Content","7.1.1 7.2.1","Screening Management responsibilities",1,"E",46,5,null,null,null,0,1,1,null,0,1,null,2,1]
[220,"SL.47","Do information security personnel have professional security certifications?","Yes",null,"In addition to existing professional certifications and security experience, the security team is currently in the process of CISSP certification.",null,"6.1.4","Contact with special interest groups",1,"E",47,5,null,null,null,0,1,1,null,0,1,null,2,1]
[null,"","F. Physical and Environmental Security",null,null,null,null,null,null,null,1,47,6,null,null,null,0,"","",null,0,"",null,1,1]
[2559,"SL.48","Is there a physical security program?","Yes",5,"WalkMe is a SaaS.\nWe are depended on Amazon AWS as our cloud hosting provider.\nThe physical security policy covers physical security in WalkMe's corporate offices and not the production data center hosted by AWS.\nWe rely on AWS for physical security in their data centers.\nThey are certified with all common security standards, to attest that they do address all physical security related issues properly. In general, AWS’ data centers are state of the art, utilizing innovative architectural and engineering approaches. AWS has many years of experience in designing, constructing, and operating large-scale data centers. This experience has been applied to the AWS platform and infrastructure. AWS data centers are housed in nondescript facilities. Physical access is strictly controlled both at the perimeter and at building ingress points by professional security staff utilizing video surveillance, intrusion detection systems, and other electronic means. Authorized staff must pass two-factor authentication a minimum of two times to access data center floors.","F.2 Physical Security Controls - Scoped Data","5.1.1","Policies for information security",1,"F",48,6,null,null,null,0,1,1,null,0,1,null,2,1]
[2560,"SL.49","Are physical security and environmental controls in the data center and office buildings?","Yes",5,"We have a physical security policy that covers physical security in WalkMe's corporate offices. Our offices physical security meets all best practices in aspects of CCTV, key card based access, alarms etc. WalkMe is responsible for all aspects of our application security. The datacenters are managed by AWS and are certified to most common security & privacy standards (PCI-DSS, HIPAA, ISO27001:2013, SOC2, SOC3, FedRAMP etc.). For the full list, see https://aws.amazon.com/compliance/","F. Physical and Environmental Security",11.1,"Secure areas",1,"F",49,6,null,null,null,0,1,1,null,0,1,null,2,1]
[396,"SL.50","Are visitors permitted in the facility?","Yes",5,"All visitors and contractors are required to present identification and are signed in and continually escorted by authorized staff. AWS only provides data center access and information to employees and contractors who have a legitimate business need for such privileges. When an employee no longer has a business need for these privileges, his or her access is immediately revoked, even if they continue to be an employee of Amazon or Amazon Web Services. All physical access to data centers by AWS employees is logged and audited routinely.","F.7 Visitor Management","11.1.2 ","Physical entry controls",1,"F",50,6,null,null,null,0,1,1,null,0,1,null,2,1]
[null,"","G. Operations Management",null,null,null,null,null,null,null,1,50,7,null,null,null,0,"","",null,0,"",null,1,1]
[2582,"SL.51","Are management approved operating procedures utilized?","Yes",5,null,"G. Operations Management","12.1.1","Documented Operating Procedure",1,"G",51,7,null,null,null,0,1,1,null,0,1,null,2,1]
[816,"SL.52","Is there an operational change management/change control policy or program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?","Yes",5,"We have a change management policy. Changes to the organization, business processes, information processing facilities and systems that affect information security are controlled.\nThe relevant party at the company needs to fill a 'Change Request' form that is being reviewed and approved by the CISO and the relevant parties if required.","G.1 Change Control","12.1.2","Change Management",1,"G",52,7,null,null,null,0,1,1,null,0,1,null,2,1]
[922,"SL.53","Are backups of Scoped Systems and Data performed?","Yes",5,"Backups are done daily for all databases. The backups are done using AWS features and stored in a dedicated AWS S3 bucket. The daily backups are retained for 30 days.\nData is also replicated to a DR site online.\nThe DR site holds the same physical security standards as the main one.","K.5 Backup Media Restoration","12.3.1","Information Back-Up",1,"G",53,7,null,null,null,0,1,1,null,0,1,null,2,1]
[3304,"SL.54","Are Cloud Services provided? If yes, what service model is provided (select all that apply):","Yes",5,"WalkMe is a SaaS, We are depended on AWS as our cloud hosting provider.","V.1 Service and Deployment Models",4.3,"Determining the scope of the information management system",1,"G",54,7,null,null,null,0,1,1,null,0,1,null,2,1]
[3305,"SL.55","Software as a Service (SaaS)?","Yes",5,"We are a SaaS service. Our servers are hosted in AWS data center in region us-west-1, and by Akamai CDN.","V.1 Service and Deployment Models",null,null,2,"G",55,7,null,null,null,0,1,1,null,0,1,null,2,1]
[3307,"SL.56","Infrastructure as a Service (IaaS)?","N/A",null,null,"V.1 Service and Deployment Models",null,null,2,"G",56,7,null,null,null,0,3,3,null,2,3,null,2,1,null,null,null,null,null,null,null,null,null,null,2]
[3309,"SL.57","Private cloud?","Yes",5,"We use Amazon AWS as our cloud hosting provider, and the segmentation is enforced based on AWS's segments within a Virtual Private Cloud (VPC). There is complete logical segregation between customers in our environment. The segregation is done by attaching the customer ID to every database row, and having a completely separate folder for storing the S3 files.  All traffic between segments and to/from the internet is filtered by the firewalls. Firewall logs are in place to audit all network activity. While multi-tenancy does present a number of challenges in terms of compliance, security, and privacy - The multi-tenant approach is widely widespread, with many secure implementations across industries.\nWalkMe multi-tenant architecture has been tested by large Enterprises and found to be in line with industry best practices. In addition, WalkMe follows security best practice and is ISO 27001, ISO 27017, ISO 27018, ISO 27032, ISO 27799, SOC 2 TYPE II, Privacy shield certified and HIPAA, GDPR compliant. We maintain those certifications and are constantly adding additional security and privacy certifications to attest that we keep improving our security controls of our products and services.\nMoreover, The development of multi-tenant systems, and application security testing processes are more stringent due to the fact that customers' data is separated logically. We have implemented many application security controls to adress this.","V.1 Service and Deployment Models",null,null,2,"G",57,7,null,null,null,0,1,1,null,0,1,null,2,1]
[3310,"SL.58","Public cloud?","N/A",null,null,"V.1 Service and Deployment Models",null,null,2,"G",58,7,null,null,null,0,3,3,null,2,3,null,2,1,null,null,null,null,null,null,null,null,null,null,2]
[3311,"SL.59","Community cloud?","N/A",null,null,"V.1 Service and Deployment Models",null,null,2,"G",{"$f":"IF(A70=\"\",L69,L69+1)","v":59},{"$f":"IF(J70=\"\",M69+1,M69)","v":7},null,null,null,{"$f":"IF(ISNA(VLOOKUP(A70,BusInfoArray,6,FALSE)),0,VLOOKUP(A70,BusInfoArray,6,FALSE))","v":0},{"$f":"IF(J70=\"\",\"\",IF(D70=\"\",0,IF(D70=\"N/A\",3,IF(D70=\"Yes\",1,IF(D70=\"No\",2,\"Oops there is an error\")))))","v":3},{"$f":"IF(J70=\"\",\"\",IF(Q70>0,Q70,IF(R70>0,R70,0)))","v":3},null,{"$f":"IF(J70=\"\",U69,IF(AND(S70>1,OR(U69=\"\",U69=0,U69>=J70)),J70,IF(J70>U69,U69,0)))","v":2},{"$f":"IF(Master=\"Master\",R70,IF(V69=\"\",S70,IF(OR(AND(U70>0,S70<V69),AND(U70=1,S70<=V69)),V69,S70)))","v":3},null,{"$f":"IF(AND(J70=1,S70=1),2,IF(AND(V69=1,M70=M69),2,IF(AND(X69=2,M70=M69),2,IF(OR(J70=1,J70=\"\"),1,\"\"))))","v":2},{"$f":"IF(V70>0,1,0)","v":1},null,null,null,null,null,null,null,null,null,null,2]
[3312,"SL.60","Hybrid cloud?","N/A",null,null,"V.1 Service and Deployment Models",null,null,2,"G",60,7,null,null,null,0,3,3,null,2,3,null,2,1,null,null,null,null,null,null,null,null,null,null,2]
[3516,"SL.61","Is there a client management portal which allows distributed business accounts (business units/departments) to be managed under a single central corporate account?","Yes",5,null,null,"15.2.1","Monitoring and review of supplier services",1,"G",61,7,null,null,null,0,1,1,null,0,1,null,2,1]
[3356,"SL.62","Are application self service features or an Internet accessible self-service portal available to clients?","Yes",5,null,null,"9.4.1","Information access restriction",1,"G",62,7,null,null,null,0,1,1,null,0,1,null,2,1]
[3590,"SL.63","Can clients run their own security services within their own cloud environment?","Yes",5,"WalkMe prides itself for delivering top tier customization options. Any security controls and capabilities could be added, based on specific customer request. (Certain changes require commercial ramifications)\n\nIn general, Security and Compliance is a shared responsibility between WalkMe and the customer. \nWalkMe is responsible for all aspects of our application security. AWS is responsible for all aspects of our infrastructure security.\nWalkme designed its controls with the assumption that certain controls will be the responsibility of its customers (or \"user entities\"). The following is a representative list of controls that are recommended to be in operation at user entities to complement the controls of Walkme's Interactive Online Guidance System. This is not a comprehensive list of all controls that should be employed by Walkme's user entities.\n\nChange Management:\n• Customers are responsible for validating the accuracy and completeness of data contained in their Walkme account.\nLogical Access:\n• Customers are responsible for creating a username and password to access their account.\n• Customers are responsible for establishing their own usage and access policies to their Walkme accounts.\n• Customers are responsible for identifying approved points of contacts to coordinate with Walkme.\n• Customers are responsible for configuring their instance of Walkme according to their organizations policies and procedures.\n• Customer is responsible for provisioning and de-provisioning of access for content creators/editors.\n• Customers are responsible for preforming periodic review of access and configurations for appropriateness.\nIncident Management:\n• Customers are responsible for alerting Walkme of incidents (related to Security, Availability, and Confidentiality) when they become aware of them.\n• Customers are responsible for monitoring or resolving the incident alerts as part of the use of the application.\nPrivacy:\nGetting the end users’ consent is the Data Controller’s responsibility, since they own the site/platform/software. Getting the end-users’ consent for WalkMe alone is not necessary, since by default we’re not collecting any PII other than IP addresses. These IP addresses are not processed, but rather logged for forensic purposes, as required by GDPR.","V.3 Cloud Audit Program","12.4.1 12.4.3 12.5 12.6.1 ","Event logging, Administrator and operator logs, Control of operational software, Management of technical vulnerabilities",1,"G",63,7,null,null,null,0,1,1,null,0,1,null,2,1]
[3373,"SL.64","Is there a management approved process to ensure that image snapshots containing Scoped Data are authorized prior to being snapped?","N/A",null,null,null,"9.2.3","Management of privileged access rights",1,"G",64,7,null,null,null,0,3,3,null,1,3,null,2,1,null,null,null,null,null,null,null,null,null,null,2]
[3401,"SL.65","Is there a formal process to ensure clients are notified prior to changes being made which may impact their service? If yes, what is the communication method:","Yes",5,"Contact by assigned Customer Solutions Manager (CSM).","G.1 Change Control","12.1.2","Change management",1,"G",65,7,null,null,null,0,1,1,null,0,1,null,2,1]
[3406,"SL.66","Is there a scheduled maintenance window? If yes, what is the frequency:","Yes",5,"Maintenance windows are on Sundays at 00:00 PST. In any case of downtime risk, customers are notified 14 days in advance.","V.4 Security Review of Hypervisor Configuration","12.6.1 ","Management of technical vulnerabilities",1,"G",66,7,null,null,null,0,1,1,null,0,1,null,2,1]
[3412,"SL.67","Is there a scheduled maintenance window which results in client downtime? If yes, what is the downtime:","Yes",5,"Maintenance windows are on Sundays at 00:00 PST. In any case of downtime risk, customers are notified 14 days in advance.","V.4 Security Review of Hypervisor Configuration","14.2.2.l","System change control procedures",1,"G",67,7,null,null,null,0,1,1,null,0,1,null,2,1]
[3418,"SL.68","Is there an online incident response status portal, which outlines planned and unplanned outages? If yes, how long after an unplanned outage is this updated:","Yes",5,"WalkMe maintains an external status page. This page allows our customers and partners to become self-sufficient, check the status of our services, be aware of maintenance windows, receive up-to-date information about malfunctions and more. See https://status.walkme.com/","J. Incident Event and Communications Management\nP.8 Privacy Incident Notification and Response Management","14.2.2","System change control procedures",1,"G",68,7,null,null,null,0,1,1,null,0,1,null,2,1]
[null,"","H. Access Control",null,null,null,null,null,null,null,1,68,8,null,null,null,0,"","",null,0,"",null,1,1]
[1998,"SL.69","Are electronic systems used to transmit, process or store Scoped Systems and Data?","Yes",5,"WalkMe is an Overlay. WalkMe collects personally identifiable information and non-personally identifiable information from customers’ end-users in certain circumstances. This is the case for both SaaS solution, as well as local hosting.\n Depending on the context of your account configuration, we may collect or receive the following types of information, including Personal Information, from you:\n• HTML metadata - WalkMe configuration for locating elements on the page.\n• Analytics metadata – User interaction with WalkMe; which Walkthroughs and steps were played, launchers clicked, shoutOuts displayed etc. This is the WalkMe related metadata (the WalkMe configuration [e.g. location of balloon on page is XX,YY], and analytics usage [e.g. user GUID XXXXX used Walkthrough GUID YYYYY]).\n• IP addresses in logs for security and forensic purposes.\n• Pseudonymized masked IP addresses (i.e. 192.168.0.x) and End Users' Approximate geographical Location data\n• Environment properties such as browser and OS, page URL, and title.\nBy Default, collected metadata is assigned to anonymous random GUID.\nThe analytics information is anonymized aggregated usage statistics regarding WalkMe usage.\nAdditionally, Customer may use certain special features which require collecting and storing additional Personal Information (i.e. User Behavior Tracking, Screenshot Settings, Custom Variables, Custom User Identifier, Visions). For more information, please see our privacy policy.",null,null,"",1,"H",69,8,null,null,null,0,1,1,null,0,1,null,2,1]
[1911,"SL.70","Are individual IDs required for user authentication to applications, operating systems, databases and network devices?","Yes",5,null,"H.1 Password Controls","9.2.1.a","User registration and de-registration",1,"H",70,8,null,null,null,0,1,1,null,0,1,null,2,1]
[4408,"SL.71","Are passwords used?","Yes",5,"In order to create content using the WalkMe Editor, content managers must authenticate based on username and password. There is no authentication required for end-users to leverage WalkMe.","H. Access Control",null,"",1,"H",71,8,null,null,null,0,1,1,null,0,1,null,2,1]
[1949,"SL.72","Is there a password policy for systems that transmit, process or store Scoped Systems and Data that has been approved by management, communicated to constituents, and enforced on all platforms?","Yes",5,"WalkMe enforces a strong password policy, based on NIST & OWASP Best Practices:\nLength – Using at least eight characters.\nComplexity (Composition) – Using at least one numeric character. Using at least one uppercase and at least one lowercase alphabetic character. Using at least one special character.\nStrength – A password must not be a dictionary word, dialectal or jargon word from any language, or any of these words written backwards.  Passwords must not be based on personal data (e.g. date of birth, address, name of family member, user's account name or parts of the user's full name etc.).\nHistory (Reuse password Limits) – Users are not allowed to reuse the last 13 passwords.\nMinimum password age – 2 day minimum, in order to prevent users from repeatedly cycling through over 13 passwords until they get to an old favorite, while allowing enough time for full replication cycles. On applicable systems, and overridable by admin for support purposes.\nLifetime (Expiration frequency) – Mandatory Change every 90 Days.\nLockout – we use CAPTCHA against brute force in order to prevent authentication abuse, as an alternative equivalent control to account lockout in order to prevent denial of service (DoS) attacks. (See https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks)\nWe also manage authorization strictly so that there's no way for a user to perform unauthorized activities on our Editor. This includes both identification of the customer (so that a user belonging to customer A can't affect the configuration of customer B) and access rights enforcement within the customer account.\nSession Expiration - User sessions expire after 15 Minutes of inactivity.\nPassword recovery - secured by CAPTCHA, and used as self-support for reset, so the user can reset his password (all password policy still apply, including password history)\nCredential Storage at rest - Passwords are of course only stored as SHA-512 salted cryptographic hashes, in accordance with industry standard cryptographic algorithms, and not in cleartext/encrypted.\nCredential Encryption in transit - All traffic between servers and users is done over TLS protocol.\nMasking (obfuscation) - Passwords either do not appear, or are masked, on the screen when typed.\nInformation disclosure prevention - The application system validates the user identifier and user authenticator as a pair and rejects the logon attempt if it is invalid.  The system does not inform the user, which of the two is wrong.\nPassword Delivery - Passwords are not delivered within the same email as a user's identity or system's URL.\nBlacklisted passwords - Passwords must not be based on common passwords such as \"password\", \"12345678\", or that appear on online \"Worst Passwords\" lists.\nUnique password usage – each password must only be used for a single system, in order to minimize exposure to further systems in case of a compromised password incident.","H. Access Control","9.4.3","Password Management System",1,"H",72,8,null,null,null,0,1,1,null,0,1,null,2,1]
[2028,"SL.73","Is remote access permitted?","Yes",5,"We are hosted on AWS cloud infrastructure in US. Configuration in the AWS is done according to the security best practices in terms of user management, MFA authentication methods, access management, and automation. Remote management is only possible from either that segment within WalkMe offices, or by using an SSL VPN client, with strong MFA authentication based on OTP tokens. This is only applicable to our internal systems, and no remote access to the customer systems is required. 3rd parties do not have access to WalkMe's network.","H.8 Restrictions and Multifactor Authentication",6.2,"Mobile devices and teleworking",1,"H",73,8,null,null,null,0,1,1,null,0,1,null,2,1]
[3355,"SL.74","Is standards based federated ID capability available to clients (e.g., SAML, OpenID)?","Yes",5,"We provide the ability to integrate with customer IdP using SAML 2.0, once we connect WalkMe with customer IdP, customer can leverage their authentication mechanism which can include 2 factor authentication.\n\nIn order to connect WalkMe with costumer IdP, you need to provide us your IdP public certificate, the URL for SAML 2.0 authentication and the field of the username we will use for the authentication. The process itself is standard according to SAML 2.0 protocol, and is done along with us once you decide to use this option.\n\nIf you wish to use 2 factor authentication without your IdP, we will fully support federated identity management in version 154 which will be released at the end of 2017.",null,"9.2.1","User registration and de-registration",1,"H",74,8,null,null,null,0,1,1,null,0,1,null,2,1]
[3538,"SL.75","Is two factor authentication required to access the production environment containing Scoped Data?","Yes",5,"There is no authentication required for end-users to leverage WalkMe. In order to create content using the WalkMe Editor, content managers must authenticate based on username and password. There is also an option to integrate with the customer's identity provider (IdP) using any SSO based on SAML 2.0, so the customer can utilize two factor authentication.",null,"9.3.1","Use of secret authentication information",1,"H",75,8,null,null,null,0,1,1,null,0,1,null,2,1]
[3543,"SL.76","Are staff able to access client Scoped Data? If not, please identify the controls used to prevent this.","Yes",5,"The only users with access to the database are DevOps users and production support.  Access to the account in order to configure it, create Walkthroughs together with people from your side, but without database access is possible for WalkMe PS and CSM teams. The process ensures usage of two-factor Authentication, and every action is logged & audited.","H.3 Logical Access Authorization","9.2.3\n9.4.1","Management of privileged access rights Information access restriction",1,"H",76,8,null,null,null,0,1,1,null,0,1,null,2,1]
[3554,{"$f":"IF(A89=\"\",\"\",$Q$1&\".\"&L89)","v":"SL.77"},"Is there a process which allows the client to specifically list who from the provider will have access to their Scoped Systems and Data?","No",null,"WalkMe defines this, based on our own internal processes, according to the annual risk assessment.\nWalkMe designs and implements controls to mitigate and contain data privacy and security risks through risk assessments, strict role based access controls (need-to and least-privileged principles), Strong MFA based authorization, Segregation of duties, System wide Hardening of hardware devices and applications, Separation of networks, Antivirus & Antimalware, IPS, Network Firewalls & Web application firewalls, continuous efficient awareness training, systematic secure development, periodical access review, periodical vulnerability scans, periodical external penetration tests, automatic integrity checks etc.\nTo reduce the risk of data exfiltration, WalkMe integrates security awareness and best practices into our culture. We consistently evaluate the risks of every interaction with our environments, networks, devices, application, data, and users.\nWe minimize the \"blast radius\" of data exfiltration events through compartmentalization of data.\nWe create redundancy and approvals in system administrator workflows to increase accountability.\nWe use granular permissions and grant access to sensitive data only to those whose job function requires it.\nWe use logging to increase the transparency into the access and movement of data at WalkMe.\nAdditionally, we technically restrict and monitor ingress and egress to machines in WalkMe using networking rules, identity and access management (IAM), and we use a hardened jump server as a bastion host to be used as a single point of access to production data with restrictive DLP controls.","H.3 Logical Access Authorization","9.1.1 9.2.3","\tAccess Control Policy\nManagement of privileged access rights",1,"H",77,8,null,null,null,0,2,2,null,1,2,null,2,1,null,null,null,null,null,null,null,null,null,null,2]
[null,"","I. Application Security",null,null,null,null,null,null,null,1,77,9,null,null,null,0,"","",null,1,"",null,1,1]
[4240,"SL.78","Are applications used to transmit, process or store Scoped Data?","Yes",5,"Yes. The WalkMe service is used to transmit, process and store Scoped Data.\nPrivacy is at the heart of everything we do, and every decision we make starts with the safety and privacy of your data. It takes a combination of policy, innovative thinking, and a deep respect for your right to privacy.\nData is encrypted both when transmitted (in transit), and while stored (at rest).\nWalkMe complies with GDPR as a data processor in the provision of Walkme’s services to its customers, and can make its Data Processing Addendum (DPA) available for execution.\nWalkMe complies with HIPAA regulations as business associates.\nFor any HIPAA-related systems, WalkMe has a standard Business Associate Addendum (BAA) we present to customers for signature. It takes into account the unique services WalkMe provides and accommodates the WalkMe Shared Responsibility Model. The Business Associate Addendum (BAA) is an WalkMe contract that is required under HIPAA rules to ensure that WalkMe appropriately safeguards protected health information (PHI). The BAA also serves to clarify and limit, as appropriate, the permissible uses and disclosures of PHI by WalkMe, based on the relationship between WalkMe and our customers, and the activities or services being performed by WalkMe.\n","I.1 Application Security Program Governance",null,null,1,"I",78,9,null,null,null,0,1,1,null,0,1,null,2,1]
[2230,"SL.79","Is a web site supported, hosted or maintained that has access to Scoped Systems and Data?","Yes",5,"Content is created using the WalkMe Editor, which in turn gathers the required Metadata to present the Walkthroughs via the WalkMe Player. During the publishing process, static JavaScript files are generated and the information is then stored on a private dedicated AWS S3 Bucket.",null,null,null,1,"I",79,9,null,null,null,0,1,1,null,0,1,null,2,1]
[4241,"SL.80","Are Web Servers used for transmitting, processing or storing Scoped Data? If yes, for all server platforms is/are:","Yes",5,"WalkMe is a SaaS.",null,null,null,2,"I",80,9,null,null,null,0,1,1,null,0,1,null,2,1]
[4245,"SL.81","Is HTTPS enabled for all web pages used as part of the scoped service?","Yes",5,"Data encryption in transit – WalkMe follows TLS Deployment Best Practices, based on NIST and FISMA standards, All traffic between servers and users is done over TLS protocol. Settings are signed with a certificate using RSA.\n\nThe authentication is done over TLS using private asymmetric keys, where the cipher suites are AES with RSA in various key sizes (for proper balance between compatibility for supporting different browsers and versions, and security best practices).\n\nSecure HTTPS connection is enforced by proper implementing HSTS with long age, and preload lists where applicable, to mitigate SSLStrip attacks.\n\nThe cipher suites supported are all FIPS 140-2 compliant (as specified by the Federal Information Processing Standard), as we operate using only FIPS 140-2 validated cryptographic modules.\n\nOur first offered ciphersuite is using AES256 with SHA384 for TLS 1.2 protocol. Our careful configuration of TLS first offered ciphersuites provides additional privacy-related properties such as forward secrecy, ensuring that any future disclosure of encryption keys cannot be used to decrypt any TLS communications recorded in the past. The oldest secure protocol supported is TLS 1.0, and the weakest ciphersuite is \"TLS_RSA_WITH_AES_128_CBC_SHA\". The application can be configured to limit and restrict to a custom set what cipher suites are enabled.\n\nProvided a list of all ciphers currently in use:\nWalkMe Player Server:\nTLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\nTLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256\nTLS_ECDHE_RSA_WITH_AES_128_CBC_SHA\nTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\nTLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384\nTLS_ECDHE_RSA_WITH_AES_256_CBC_SHA\nTLS_RSA_WITH_AES_128_GCM_SHA256\nTLS_RSA_WITH_AES_128_CBC_SHA256\nTLS_RSA_WITH_AES_128_CBC_SHA\nTLS_RSA_WITH_AES_256_GCM_SHA384\nTLS_RSA_WITH_AES_256_CBC_SHA256\nTLS_RSA_WITH_AES_256_CBC_SHA\n\nWalkMe Editor & CDN:\nTLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384\nTLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256\nTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\nTLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\nTLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256\nTLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256\nTLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384\nTLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256\nTLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384\nTLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256\nTLS_ECDHE_RSA_WITH_AES_256_CBC_SHA\nTLS_ECDHE_RSA_WITH_AES_128_CBC_SHA\nTLS_RSA_WITH_AES_256_GCM_SHA384\nTLS_RSA_WITH_AES_128_GCM_SHA256\nTLS_RSA_WITH_AES_256_CBC_SHA256\nTLS_RSA_WITH_AES_128_CBC_SHA256\nTLS_RSA_WITH_AES_256_CBC_SHA\nTLS_RSA_WITH_AES_128_CBC_SHA\n\n*WalkMe Editor & CDN prefer ChaCha20 suites for mobile device clients that don't have AES-NI acceleration hardware (e.g., Android devices) to enable the best performance.\n**WalkMe is in final stages for transition to TLS 1.3 encryption.",null,null,null,2,"I",81,9,null,null,null,0,1,1,null,0,1,null,2,1]
[4254,"SL.82","All available high-risk security patches applied and verified at least monthly?","Yes",5,"We have vulnerability & patch management procedure. We are using WSUS to patch & validate that workstations are regularly patched. On production servers we patch once a month, aside from high/critical security updates that are installed immediately. We have implemented Microsoft SCCM (System Center Configuration Manager) for in-office patch management.",null,null,null,2,"I",82,9,null,null,null,0,1,1,null,0,1,null,2,1]
[4260,"SL.83","Are third party alert services used to keep up to date with the latest vulnerabilities?","Yes",5,"We get notifications about vulnerabilities from various sources (SANS, CERT, etc.), and perform patching accordingly. We also work with security vendors, local ISACs and other security partners to gather as much information as possible. Our servers are hardened, patched and protected by an antimalware software installed on them.",null,null,null,2,"I",83,9,null,null,null,0,1,1,null,0,1,null,2,1]
[4263,"SL.84","Events relevant to supporting incident investigation regularly reviewed using a specific methodology to uncover potential incidents?","Yes",5,null,null,null,null,2,"I",84,9,null,null,null,0,1,1,null,0,1,null,2,1]
[4268,"SL.85","Operating system and application logs relevant to supporting incident investigation protected against modification, deletion, and/or inappropriate access?","Yes",5,null,null,null,null,2,"I",85,9,null,null,null,0,1,1,null,0,1,null,2,1]
[2058,"SL.86","Is application development performed?","Yes",5,null,"I. Application Security",null,null,1,"I",86,9,null,null,null,0,1,1,null,0,1,null,2,1]
[3920,"SL.87","Is there a secure software development lifecycle policy (including mobile software applications) that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?","Yes",5,null,"I.2 Secure Systems Development Lifecycle (SDLC) Policies, Standards and Procedures","14.2.1 ","Secure development policy",2,"I",87,9,null,null,null,0,1,1,null,0,1,null,2,1]
[2182,"SL.88","Is development, test, and staging environment separate from the production environment? If so, how are they segmented:","Yes",5,"We have Corporate, Dev, QA, Staging and Production environments. The environments are physically and logically separate, except for the Staging and Production, which are only logically separate. The network is built into several tiers (5 segments), where each type of servers has their own segment and access rules. DMZ is obviously separated from internal segments such as Database, but also from other external servers. Our servers are hosted on AWS infrastructure, and the segmentation is enforced based on AWS's segments within a VPC. The VPC is a closed network with segmentation and without access from the internet to internal segments.",null,"12.1.4","Separation of development, testing and operational environments",2,"I",88,9,null,null,null,0,1,1,null,0,1,null,2,1]
[2059,"SL.89","Is there a formal Software Development Life Cycle (SDLC) process?","Yes",5,"According to WalkMe's SDLC (Secure Development Lifecycle) policy, Security is part of the SDLC in all phases of the cycle – initiation, planning, design, development & coding, testing & QA, implementation, evaluation, maintenance & support, and disposal.\nThe Security Team is part of the design, and The CISO signs off new features.\nWe have a rigorous testing and acceptance procedure for code whether custom, outsourced, packaged application code and third-party apps (components) used in our services.\nThis applies to all In house, purchased or open source development. For any open source code in use, all code is checked for compliance, version control.\nIn order to prevent using components with known vulnerabilities, we identify all public components and the versions we are using, including all dependencies. (e.g., the versions plugin). We monitor the security of these components in public databases, project mailing lists, and security mailing lists, and keep them up to date. Our Policy Governs component use according to our SDLC, passing security tests, and acceptable licenses.\nOur coding standards are set according to best practices (especially in light of the OWASP top 10 web vulnerabilities).\nSecurity testing is part of the testing cycle, making sure that new features are not uploaded to production with vulnerabilities.\nThe involvement of security in each of these stages is done accordingly – in the early stages it's meetings and design reviews.\nWalkMe SDLC is agile. Secure coding is done by our developers. The developers attend annual secure coding training.\nManual peer code review is done on every line of code before its check-in into the source code repository, and in this review the reviewer checks for security issues as well as code quality. \nTesting also checks for security related flaws, according to the feature/module tested.\nWe validate all input types coming from the user side, utilize anti cross-site attacks measures in place, manage sessions according to best practices etc.","I.2 Secure Systems Development Lifecycle (SDLC) Policies, Standards and Procedures","14.2.1 ","Secure development policy",2,"I",89,9,null,null,null,0,1,1,null,0,1,null,2,1]
[2670,"SL.90","Are change control procedures required for all changes to the production environment?","Yes",5,"We have a change management policy. Changes to the organization, business processes, information processing facilities and systems that affect information security are controlled.\nThe relevant party at the company needs to fill a 'Change Request' form that is being reviewed and approved by the CISO and the relevant parties if required.","G.1 Change Control","9.4.5.g","Access control to program source code",2,"I",90,9,null,null,null,0,1,1,null,0,1,null,2,1]
[2169,"SL.91","Is Scoped Systems and Data ever used in the test, development, or QA environments? If yes, is:","No",null,null,null,"14.3.1 ","Protection of test data",2,"I",91,9,null,null,null,0,2,2,null,2,2,null,2,1,null,null,null,null,null,null,null,null,null,null,2]
[2204,"SL.92","Is there a documented change management / change control process? If yes, does it include:","Yes",5,"We have a change management policy. Changes to the organization, business processes, information processing facilities and systems that affect information security are controlled.\nThe relevant party at the company needs to fill a 'Change Request' form that is being reviewed and approved by the CISO and the relevant parties if required.","G.1 Change Control","14.2.2 ","System change control procedures",2,"I",92,9,null,null,null,0,1,1,null,0,1,null,2,1]
[2684,"SL.93","Are compilers, editors or other development tools present in the production environment?","No",null,"No development tools are installed on production environment.","I.13 Production Application Vulnerability Monitoring Process","12.1.4.e","Separation of development, testing and operational environments",2,"I",93,9,null,null,null,0,2,2,null,2,2,null,2,1,null,null,null,null,null,null,null,null,null,null,2]
[3936,"SL.94","Is a secure code review performed at least annually?","Yes",5,"Static source code analysis is integrated at every step of the SDLC using Checkmarx as our Application Security Testing framework. The process is designed to detect and reduce security vulnerabilities, risks, and gaps at the development stage, by remediating issues as they arise, to improve security features and functions such as authentication, encryption or auditing, and to integrate with the enterprise security infrastructure.","I.2 Secure Systems Development Lifecycle (SDLC) Policies, Standards and Procedures","14.2.1 ","Secure development policy",2,"I",94,9,null,null,null,0,1,1,null,0,1,null,2,1]
[3970,"SL.95","Is each release subject to a full secure code review?","Yes",5,"Manual peer code review is done on every line of code before its check-in into the source code repository, and in this review the reviewer checks for security issues as well as code quality. \nTesting also checks for security related flaws, according to the feature/module tested.\nWe validate all input types coming from the user side, utilize anti cross-site attacks measures in place, manage sessions according to best practices etc.","I.7 Secure Code Review","14.2.1","Secure development policy",2,"I",95,9,null,null,null,0,1,1,null,0,1,null,2,1]
[3990,"SL.96","Are applications analyzed on a regular basis to determine their vulnerability against recent attacks?","Yes",5,"WalkMe performs monthly internal vulnerability assessments, and Annual External Penetration Tests, both against the applications and infrastructure of all environments. Summary of the latest Report is available upon request. The vulnerability scans that are performed monthly are Using industry leading Web & Network Vulnerability Scanners, including, but not limited to: Tenable.io Vulnerability Management (Formerly Nessus Cloud Vulnerability Scanner), OpenVAS, AlienVault USM, Nmap, and Burp Web Vulnerability Scanner. Findings are being valiated, assessed, classified and prioritized. All vulnerabilities classified as Critical or High, are remediated immediately. Remaining Identified vulnerabilities are examined and treated, according to Internal Security evaluation, which is done by the security team.","I.10 QA_UAT Process","12.2.1","Controls against malware",1,"I",96,9,null,null,null,0,1,1,null,0,1,null,2,1]
[3394,"SL.97","Is there a formal development methodology in operation? If yes, which groups does it include?:","Yes",5,"According to WalkMe's SDLC (Secure Development Lifecycle) policy, Security is part of the SDLC in all phases of the cycle – initiation, planning, design, development & coding, testing & QA, implementation, evaluation, maintenance & support, and disposal. Development, QA, Security, and DevOPS are included in the process.","I.16 Secure Systems Development Lifecycle (SDLC) Reviews","12.5.1","Control of Operational Software",1,"I",97,9,null,null,null,0,1,1,null,0,1,null,2,1]
[3826,"SL.98","Are mobile applications that access Scoped Systems and Data developed?","Yes",5,"When an End User uses an application with WalkMe Mobile, we collect a randomly generated identifier which by default does not contain Personal Information but which may link to Personal Information if Customer actively chooses for it to do so; timestamp; phone number; masked IP address; and general location information, based on algorithms, to guess if you are using the application from home or from work, however this information does not include your precise geolocation. In addition, we retain IP addresses in logs for security purposes. If you are a Customer who wants to utilize WalkMe Mobile on a mobile application that you own, control, license, or use, we may collect the name of the application and version of the application.",null,null,null,1,"I",98,9,null,null,null,0,1,1,null,0,1,null,2,1]
[null,"","J. Incident Event and Communications Management",null,null,null,null,null,null,null,1,98,10,null,null,null,0,"","",null,0,"",null,1,1]
[2241,"SL.99","Is there an Incident Management Program that has been approved by management, communicated to constituents and an owner to maintain and review the program? If yes, does the program include:","Yes",5,"WalkMe maintains a documented incident management policy that has been approved by management, communicated to appropriate constituents, updated by the security team and reapproved annually by management. According to our Security Incident Management Policy, Evidences are collected directly from the source log files and systems. Evidences are kept safe and inaccessible to anyone aside from the response team. The process of notifying security incidents is described in the incident management policy. In case of an incident, communication will be done to all affected customers as soon as the scope has been identified. The communication is managed by the risk committee and will be done using the dedicated customer success manager within 48 Hours.","J.1 Information Security / Information Technology Incident Management - Policy and Procedures Content",16," Information security incident management",1,"J",99,10,null,null,null,0,1,1,null,0,1,null,2,1]
[3234,"SL.100","Privacy Incidents?","Yes",5,"WalkMe is certified under the EU-US privacy shield and has all the necessary processes in place to comply with the currently in force EU directive so using WalkMe for data subjects located in the EU shouldn’t be a problem. We've updated our privacy policy, which was audited by TRUSTe (TrustArc), to reflect our current status. In order to meet with the new requirements outlined in the EU US Privacy Shield Privacy Principles, WalkMe uses TRUSTe Privacy Dispute Resolution Service to facilitate consumers’ privacy complaints through an online submission mechanism. see https://www.walkme.com/privacy-policy/","P.8 Privacy Incident Notification and Response Management",16.100000000000001,"Management of information security incidents and improvements",2,"J",100,10,null,null,null,0,1,1,null,0,1,null,2,1]
[2246,"SL.101","Is there a formal Incident Response Plan?","Yes",5,"In an event of an incident, customer should contact their dedicated customer success manager, who will pass the information to the CISO. The SLA is provided in the contract and is part of the general terms. Security related incidents have the same SLA. The definition of security issue priority depends on the damage potential of the issue and its scope. Changes for critical or high risks are implemented ASAP. Changes for lower risk security concerns are discussed and put into the workplans.","J. Incident Event and Communications Management","16.1.1.a.1","Responsibilities and procedures",1,"J",101,10,null,null,null,0,1,1,null,0,1,null,2,1]
[3426,"SL.102","Is there a 24x7x365 staffed phone number available to clients to report security incidents?","Yes",5,"WalkMe 24/7 Support line:\n1-855-4-WALKME (925563)\n\nIn addition, There is a live 24/7 Security operations center (SOC) team watching our SIEM alerts that notifies us in case alerts are fired.","J. Information Security Incident Management\nP.8 Privacy Incident Notification and Response Management","15.1.1.h ","Information security policy for supplier relationships",1,"J",102,10,null,null,null,0,1,1,null,0,1,null,2,1]
[null,"","K. Business Resiliency",null,null,null,null,null,null,null,1,102,11,null,null,null,0,"","",null,0,"",null,1,1]
[2719,"SL.103","Is there an established Business Resiliency program that has been approved by management and communicated to appropriate constituents?","Yes",5,null,"K.1 Business Resiliency Governance",5.2,"Management Commitment",1,"K",103,11,null,null,null,0,1,1,null,0,1,null,2,1]
[2329,"SL.104","Has a Business Impact Analysis been conducted?","Yes",5,null,"K.2 Business Impact Analysis","8.2.2","Business impact analysis",1,"K",104,11,null,null,null,0,1,1,null,0,1,null,2,1]
[4038,"SL.105","Is there a formal process focused on identifying and addressing risks of disruptive incidents to the organization?","Yes",5,null,"K.3 Risk Assessment","8.2.3","Risk assessment",1,"K",105,11,null,null,null,0,1,1,null,0,1,null,2,1]
[4042,"SL.106","Are specific response and recovery strategies defined for the prioritized activities?","Yes",5,null,"K.4 Business Activity level Recovery Planning","8.3.1","Determination and selection",1,"K",106,11,null,null,null,0,1,1,null,0,1,null,2,1]
[4049,"SL.107","Are formal business continuity procedures developed and documented?","Yes",5,"We Have BCP. In summary, our BCP relies on using the AWS Availability Zones for servers' redundancy, and the redundancy of infrastructure in our offices.","K.4 Business Activity level Recovery Planning",8.4,"Establish and implement business continuity procedures",1,"K",107,11,null,null,null,0,1,1,null,0,1,null,2,1]
[4054,"SL.108","Has senior management assigned the responsibility for the overall management of the response and recovery efforts?","Yes",5,null,"K.1 Business Resiliency Governance",null,null,1,"K",108,11,null,null,null,0,1,1,null,0,1,null,2,1]
[2286,"SL.109","Is there a periodic (at least annual) review of your Business Resiliency Program?","Yes",5,null,"K.6 Exercising","8.4.1","Establish and implement business continuity procedures",1,"K",109,11,null,null,null,0,1,1,null,0,1,null,2,1]
[2729,"SL.110","Are there any dependencies on critical third party service providers?","Yes",5,null,"K.2 Business Impact Analysis","8.1\n8.3\n8.3.1\n8.44","Operational Planning and Control\n\nBusiness continuity strategy\n\nDetermination and selection\n\nBusiness continuity plans",1,"K",110,11,null,null,null,0,1,1,null,0,1,null,2,1]
[2343,"SL.111","Is there a formal, documented exercise and testing program in place?","Yes",5,"We Annually DR test Servers and DB's, both production env and corporate offices.\nThe last Production DR test was performed on WalkMe service at 18th of July 2016.\nThe last San Francisco offices DR test was performed on WalkMe service at 26th of September 2016.\nThe last Tel-Aviv offices DR test was performed on WalkMe service at 22nd of March 2017.","K.6 Exercising",8.5,"Exercising and testing",1,"K",111,11,null,null,null,0,1,1,null,0,1,null,2,1]
[2305,"SL.112","Is there an Influenza Pandemic / Infectious Disease Outbreak Plan?","Yes",5,"Supporting and maintaining our environment can be securely done from remote. The infrastructure for working remotely is ready and deployed. Moreover, we make sure to not have any person as the single point of knowledge or access.","K.7 Infectious Disease Planning",null,null,1,"K",112,11,null,null,null,0,1,1,null,0,1,null,2,1]
[3602,"SL.113","Is there a specific Recovery Time Objective (RTO)? If yes, what is it?","Yes",5,"Our DR approach is based on the AWS availability zones. Using it we deploy our service on 2 data centers and so if one data center fails, the service still works. In case 2 data centers fail, and the entire region becomes unavailable, we will be able to get our service back up and running within 4 hours on our predefined secondary region in us-west-2. We guarantee 99.99% uptime for the WalkMe player which serves the end users. It important to mention that even in the rare & unlikely event that the service is down/unavailable, the walkthroughs will just not appear on the screen for the end-user. It does not decrease application/website usability. No error message will be displayed and the application/website won't be affected. This is made possible is by design, since WalkMe loads asynchronously to the page, to ensure not to affect load time or performance. By doing so, we create a fully redundant setup and reach RPO and RTO of 0.",null,"17.1.2","Implementing information security continuity",1,"K",113,11,null,null,null,0,1,1,null,0,1,null,2,1]
[3632,"SL.114","Are all suppliers of critical hardware, network services and facility services involved in annual continuity and recovery tests?","Yes",5,null,null,"17.1.3","Verify, review and evaluate information security continuity",1,"K",114,11,null,null,null,0,1,1,null,0,1,null,2,1]
[3625,"SL.115","Are site failover tests performed at least annually?","Yes",5,"Sites are failed over as part of our annually conducted DR test. If it fails, testing will be repeated within 3 months. Aside from Annual DR Tests we conduct, we have never had to restore files after a systems outage. Our setup is fully highly available so we never suffered a data loss.",null,"17.1.3","Verify, review and evaluate information security continuity",1,"K",115,11,null,null,null,0,1,1,null,0,1,null,2,1]
[3639,"SL.116","Do contracts with Critical Service Providers include a penalty or remediation clause for breach of availability and continuity SLAs?","Yes",5,"The SLA is provided in the contract and is part of the general terms. Security related incidents have the same SLA. ",null,"15.1.2 15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",1,"K",116,11,null,null,null,0,1,1,null,0,1,null,2,1]
[3638,"SL.117","Is there sufficient redundancy capacity to ensure services are not impacted in multi-tenancy environments during peak usage and above?","Yes",5,"WalkMe’s architecture is designed to manage large scale traffic and CPS (connections per second) to provide high quality speed/availability. All Walk-thru data requests are done against Akamai.",null,"17.1.3","Verify, review and evaluate information security continuity",1,"K",117,11,null,null,null,0,1,1,null,0,1,null,2,1]
[null,"","L. Compliance",null,null,null,null,null,null,null,1,117,12,null,null,null,0,"","",null,0,"",null,1,1]
[2826,"SL.118","Is there an internal audit, risk management, or compliance department, or similar management oversight unit with responsibility for assessing, identifying and tracking resolution of outstanding regulatory issues?","Yes",5,"WalkMe maintains an extensive compliance program that has been aligned to industry best practices, regulatory, Federal/State, international laws, regional laws, industry-specific requirements. The program assists customers to understand the robust controls in place at WalkMe that maintain security and data protection of WalkMe rendered services, helping customers to establish and operate in a WalkMe security control environment.\n\nWalkMe offers the most comprehensive set of compliance offerings of any SaaS Digital Adoption Platform.","L.3 Monitoring and Reporting - Compliance Requirement Identification","18.1.1 ","Identification of applicable legislation and contractual requirements",1,"L",{"$f":"IF(A134=\"\",L133,L133+1)","v":118},{"$f":"IF(J134=\"\",M133+1,M133)","v":12},null,null,null,{"$f":"IF(ISNA(VLOOKUP(A134,BusInfoArray,6,FALSE)),0,VLOOKUP(A134,BusInfoArray,6,FALSE))","v":0},{"$f":"IF(J134=\"\",\"\",IF(D134=\"\",0,IF(D134=\"N/A\",3,IF(D134=\"Yes\",1,IF(D134=\"No\",2,\"Oops there is an error\")))))","v":1},{"$f":"IF(J134=\"\",\"\",IF(Q134>0,Q134,IF(R134>0,R134,0)))","v":1},null,{"$f":"IF(J134=\"\",U133,IF(AND(S134>1,OR(U133=\"\",U133=0,U133>=J134)),J134,IF(J134>U133,U133,0)))","v":0},{"$f":"IF(Master=\"Master\",R134,IF(V133=\"\",S134,IF(OR(AND(U134>0,S134<V133),AND(U134=1,S134<=V133)),V133,S134)))","v":1},null,{"$f":"IF(AND(J134=1,S134=1),2,IF(AND(V133=1,M134=M133),2,IF(AND(X133=2,M134=M133),2,IF(OR(J134=1,J134=\"\"),1,\"\"))))","v":2},{"$f":"IF(V134>0,1,0)","v":1}]
[4126,"SL.119","Are there policies and procedures to ensure compliance with applicable legislative, regulatory and contractual requirements including intellectual property rights on business processes or information technology software products?","Yes",5,"We are ISO/IEC 27001:2013 certified for Information security management.\nWe are ISO/IEC 27032:2012 certified for Guidelines for Cybersecurity.\nWe are ISO/IEC 27017:2015 certified for Cloud Specific Controls. \nWe are ISO/IEC 27018:2014 certified for Personal data Protection (PII).\nWe are ISO 27799:2016 certified for Security management in health (PHI).\nWe are ISO/IEC 9001:2015 certified for an effective Quality Management System (QMS).\nWe are US-HIPAA, HITECH, and HITRUST CSF compliant.\nWe are SOC 2 certified to meet AICPA’s Trust Security Principles. [Sharing requires signed NDA.]\nWe are SOC 3 (SSAE-18) certified to meet AICPA’s Trust Security Principles.\nWe comply with ICDM (Israel Cyber Defense Methodology)\nWe comply with GDPR (EU) 2016/679.\nWe are Swiss/EU-U.S. Privacy Shield (IP/16/216) certified.\nWe are TrustArc (formerly named TRUSTe) certified for data privacy.\nWe are CSA Security, Trust, and Assurance Level One: Self-Assessment certified.\nWe are graded Enterprise-Ready by CloudTrust program.\nWe operate using FIPS 140-2 validated cryptographic modules.\nWalkMe is an official Amazon Web Services (AWS) Advanced Technology Partner and a member of the APN (Amazon Partner Network).","L.2 Monitoring and Reporting - Compliance ",null,null,1,"L",119,12,null,null,null,0,1,1,null,0,1,null,2,1]
[2837,"SL.120","Is there a records retention policy covering paper and electronic records, including email in support of applicable regulations, standards and contractual requirements?","Yes",5,"According to WalkMe policies, all relevant data is deleted upon specific request. If you wish to export any or all of the data, you are free to contact your WalkMe Customer Success Manager Focal Point, and request partial/complete export. Data will then be provided to the customer using non-proprietary industry supported data format of their choice (.csv, .txt, etc.)",null,"18.1.3 ","Protection of records",1,"L",120,12,null,null,null,0,1,1,null,0,1,null,2,1]
[4127,"SL.121","Is licensing maintained in all jurisdictions where required?","Yes",5,"WalkMe licensing model is global.",null,null,null,1,"L",121,12,null,null,null,0,1,1,null,0,1,null,2,1]
[3733,"SL.122","Is there an documented internal compliance and ethics program to ensure professional ethics and business practices are implemented and maintained?","Yes",5,"WalkMe is committed to conducting business in a fair and open manner within the spirit and letter of the law, with the highest regard for customers, the community, and employees. WalkMe’s success depends not only on the knowledge, skills, and abilities of employees, but also on their performance of work with sound judgment, self-discipline, common sense, and integrity. As such, all employees are required to maintain and uphold the following common ethical standards, in all aspects of their work:\n• To pursue WalkMe objectives in all of their work in a manner that does not conflict with the integrity of the WalkMe or the public interest;\n• To be truthful and accurate in performing job functions;\n• To protect Confidential Information as defined in WalkMe’s relevant policy;\n• To observe all laws, regulations, ordinances, and rules applicable to the operation of the business;\n• To maintain honest and fair relationships with all WalkMe vendors;\n• To ensure quality and value in the company’s products/services and relationships with customers and vendors; and\n• To avoid, during the course of their employment, any situations that may engender any conflict between the personal interests of employees and the exercise of discretionary decisions on behalf of the WalkMe.","L.4 Professional Ethics and Business Practices",null,null,1,"L",122,12,null,null,null,0,1,1,null,0,1,null,2,1]
[4135,"SL.123","Are marketing or selling activities conducted directly to Client's customers?","N/A",null,"WalkMe is B2B.",null,null,null,1,"L",123,12,null,null,null,0,3,3,null,1,3,null,2,1,null,null,null,null,null,null,null,null,null,null,2]
[4141,"SL.124","Are there direct interactions with your client's customers?","N/A",null,"WalkMe is B2B.",null,null,null,1,"L",124,12,null,null,null,0,3,3,null,1,3,null,2,1,null,null,null,null,null,null,null,null,null,null,2]
[4147,"SL.125","Are documented policies and procedures maintained for enabling compliance with applicable legal, regulatory, or contractual obligations related to information security requirements?","Yes",5,null,null,null,null,1,"L",125,12,null,null,null,0,1,1,null,0,1,null,2,1]
[4151,"SL.126","Is there a documented governance process to identify and assess changes that could significantly affect the system of internal controls for security, confidentiality and availability?","Yes",5,"Confidentiality: Security and privacy are managed according to industry best practices in terms of user IDs and password management, MFA authentication methods, encryption, access control management, and automation.\nIntegrity: The JS files generated in the publishing process and served to the customers are hashed, and the hash is stored in our database. \nAvailability: WalkMe utilizes Akamai (CDN) for static files delivery. The customer has a snippet of code added to the website HTML header. This snippet of code will be pointing to your WalkMe files cached on Akamai CDN, so end-users access our CDN for the published content. For redundancy purposes, If Amazon S3 is down, Akamai CDN will automatically publish the latest available cached version of the content. If Both the Amazon S3 and Akamai CDN platform are down/unavailable, the walkthroughs will just not appear on the screen for the end-user. It does not decrease application/website usability. No error message will be displayed and the application/website won't be affected.","L.3 Monitoring and Reporting - Compliance Requirement Identification",null,null,1,"L",126,12,null,null,null,0,1,1,null,0,1,null,2,1]
[4154,"SL.127","Are accounts opened, transactions initiated or other account initiation activity applying payments, taking payments, transferring funds, etc. through either electronic, telephonic, written or in-person requests made on behalf of your client's?","N/A",null,null,null,null,null,1,"L",127,12,null,null,null,0,3,3,null,1,3,null,2,1,null,null,null,null,null,null,null,null,null,null,2]
[4284,"SL.128","Are these sites, applications and systems used to also transmit, process or store non-scoped data?","N/A",null,null,null,null,null,1,"L",128,12,null,null,null,0,3,3,null,1,3,null,2,1,null,null,null,null,null,null,null,null,null,null,2]
[2652,"SL.129","Are all transaction details (such as payment card info and information about the parties conducting transactions) prohibited from being stored in the DMZ?","N/A",null,"No such transactions.",null,"14.1.3.e","Protecting Application Services Transactions",1,"L",129,12,null,null,null,0,3,3,null,1,3,null,2,1,null,null,null,null,null,null,null,null,null,null,2]
[3379,"SL.130","Does the service provider permit client audits and assessments?","Yes",4,"Procedures to allow Customer to perform security penetration scanning:\nWalkMe permits customers to perform independent vulnerability assessments.\nThese must be coordinated in advance. No DoS/Stress testing is allowed.","V.3 Cloud Audit Program","15.1.2 15.2.1 ","Addressing security within supplier agreements, Monitoring and review of supplier services",1,"L",130,12,null,null,null,0,1,1,null,0,1,null,2,1]
[null,"","M. End User Device Security",null,null,null,null,null,null,null,1,130,13,null,null,null,0,"","",null,0,"",null,1,1]
[4297,"SL.131","Are End User Devices (Desktops, Laptops, Tablets, Smartphones) used for transmitting, processing or storing Scoped Data? If yes, for all platforms, are:","No",null,"Encryption of office laptops - All of our laptops implement Full/Whole Disk Encryption by Symantec Endpoint Encryption, using Advanced Encryption Standard (AES) encryption algorithm with 256-bit keys.",null,null,null,1,"M",131,13,null,null,null,0,2,2,null,1,2,null,1,1,null,null,null,null,null,null,null,null,null,null,2]
[4298,"SL.132","Security configuration standards documented? If yes, are:",null,null,null,null,null,null,2,"M",132,13,null,null,null,0,0,0,null,1,2,null,"",1]
[4305,"SL.133","All available high-risk security patches applied and verified at least monthly on all server platforms?",null,null,null,null,null,null,2,"M",133,13,null,null,null,0,0,0,null,1,2,null,"",1]
[4313,"SL.134","Sufficient detail contained in Operating System and application logs to support incident investigation, including successful and failed login attempts and changes to sensitive configuration settings and files?",null,null,"Staff are contractually prohibited from accessing the administrative environment via non-managed private devices. Remote management is only possible from either a specific segment within WalkMe offices, or by using an SSL VPN client, with strong MFA authentication based on OTP tokens. This is only applicable to our internal systems, and no remote access to the customer systems is required. 3rd parties do not have access to WalkMe's network.",null,null,null,2,"M",134,13,null,null,null,0,0,0,null,1,2,null,"",1]
[4317,"SL.135","Operating system and application logs relevant to supporting incident investigation protected against modification, deletion, and/or inappropriate access?",null,null,null,null,null,null,2,"M",135,13,null,null,null,0,0,0,null,1,2,null,"",1]
[4090,{"$f":"IF(A153=\"\",\"\",$Q$1&\".\"&L153)","v":"SL.136"},"Are constituents allowed to utilize mobile devices within your environment? If yes, which of the following functions are allowed:","No",null,null,null,null,null,1,"M",136,13,null,null,null,0,2,2,null,1,2,null,1,1,null,null,null,null,null,null,null,null,null,null,2]
[4091,"SL.137","View Scoped Data?",null,null,null,null,null,null,2,"M",137,13,null,null,null,0,0,0,null,1,2,null,"",1]
[4092,"SL.138","Process Scoped Data?",null,null,null,null,null,null,2,"M",138,13,null,null,null,0,0,0,null,1,2,null,"",1]
[4093,"SL.139","Delete Scoped Data?",null,null,null,null,null,null,2,"M",139,13,null,null,null,0,0,0,null,1,2,null,"",1]
[4094,"SL.140","Store Scoped Data?",null,null,null,null,null,null,2,"M",140,13,null,null,null,0,0,0,null,1,2,null,"",1]
[4097,"SL.141","Is there a mobile device management program in place that has been approved by management and communicated to appropriate constituents?","N/A",null,null,null,null,null,1,"M",141,13,null,null,null,0,3,3,null,1,3,null,1,1,null,null,null,null,null,null,null,null,null,null,2]
[4098,"SL.142","Is there a Mobile Device Management solution in place?",null,null,null,null,null,null,2,"M",142,13,null,null,null,0,0,0,null,1,3,null,"",1]
[3787,"SL.143","Is there an approved process for IT to off-board mobile devices when a constituent terminates, or requests to on-board a new mobile device? If yes, does it:",null,null,null,null,null,null,2,"M",143,13,null,null,null,0,0,0,null,1,3,null,"",1]
[3558,"SL.144","Are staff technically prevented from accessing the administrative environment via non-managed private devices? If yes, is it from:","Yes",3,"Staff are contractually prohibited from accessing the administrative environment via non-managed private devices. Remote management is only possible from either a specific segment within WalkMe offices, or by using an SSL VPN client, with strong MFA authentication based on OTP tokens. This is only applicable to our internal systems, and no remote access to the customer systems is required. 3rd parties do not have access to WalkMe's network.","H.3 Logical Access Authorization","9.1.1 9.1.2 9.2.1 9.2.3 ","Access control policy,\nAccess to networks and network services,\nUser registration and de-registration,\nManagement of privileged access rights",1,"M",144,13,null,null,null,0,1,1,null,0,1,null,2,1]
[null,"","N. Network Security",null,null,null,null,null,null,null,1,144,14,null,null,null,0,"","",null,0,"",null,1,1]
[975,"SL.145","Are there external network connections (Internet, extranet, etc.)?","Yes",5,"WalkMe is a SaaS.\nWe are depended on Amazon AWS as our cloud hosting provider.","B.2 Information Security Standards\nN.Network Security","13.1.1","Network Controls",1,"N",145,14,null,null,null,0,1,1,null,0,1,null,2,1]
[998,"SL.146","Security and hardening standards for network devices, including Firewalls, Switches, Routers and Wireless Access Points (baseline configuration, patching, passwords, access control)?","Yes",5,null,"N. Network Security","13.1.1.c","Network Controls",1,"N",146,14,null,null,null,0,1,1,null,0,1,null,2,1]
[3689,"SL.147","Are firewalls used to isolate critical and sensitive systems into network segments separate from network segments with less sensitive systems?","Yes",5,null,"N.2 Network Security - Firewall(s) and/or Other Devices Providing the Same Functionality","13.1.3","Segregation In Networks",1,"N",147,14,null,null,null,0,1,1,null,0,1,null,2,1]
[1015,"SL.148","Is there a process that requires security approval to allow external networks to connect to the company network, and enforces the least privilege necessary?","Yes",5,"We manage access authorization strictly according to need-to and least-privileged principles. The need is derived from the role of the requesting user, and is concluded per the type of infrastructure, the environment and the part of it that the person needs to work on.",null,"9.1.2.b","Access to networks and network services",1,"N",148,14,null,null,null,0,1,1,null,0,1,null,2,1]
[994,"SL.149","Are all available high-risk security patches applied and verified at least monthly?","Yes",5,null,null,"12.6.1.g","Management of technical vulnerabilities",1,"N",149,14,null,null,null,0,1,1,null,0,1,null,2,1]
[1068,"SL.150","Are Intrusion Detection/Prevention Systems employed in all sensitive network zones and wherever firewalls are enabled?","Yes",5,"We have implemented a host Based ESET IDS/IPS. In addition we use firewalls to inspect and filter traffic. Since in AWS we can't place a network based IPS, we do that with HIPS installed on the servers.\nWe use Akamai Kona Web Application Firewall on our environments.","N.3 Network Security - IDS/IPS Attributes","13.1.2","Security of Network Services",1,"N",150,14,null,null,null,0,1,1,null,0,1,null,2,1]
[1095,"SL.151","Are wireless networking devices connected to networks containing scoped systems and data?","Yes",5,"No wireless LAN access is granted to the production environment at all. Wireless LAN connections in our offices are secured by WPA2-Enterprise, and encrypted with accordance with NIST standards using AES for password authentication. Wireless networks are up to date with vendor security patches to prevent potential 802.11r exploits using newly-disclosed vulnerabilities. This includes mitigation for October 2017 Krack vulnerability.","N.7 Unauthorized Wireless Networks","13.1.1.c","Network Controls",1,"N",151,14,null,null,null,0,1,1,null,0,1,null,2,1]
[3563,"SL.152","Are there controls to prevent one client attempting to compromise another client in a resource pooled environment?","Yes",5,"We manage authorization strictly so that there's no way for a user to perform unauthorized activities on our WalkMe Editor. This includes both identification of the customer (so that a user belonging to customer A can't affect the configuration of customer B) and access rights enforcement within the customer account.","H.3 Logical Access Authorization","12.4.1 15.2.1","Event Logging,\nMonitoring and review of supplier services",1,"N",152,14,null,null,null,0,1,1,null,0,1,null,2,1]
[null,"","P. Privacy",null,null,null,null,null,null,null,1,152,15,null,null,null,0,"","",null,0,"",null,1,1]
[3687,"SL.153","Is Scoped Data transmitted, processed, or stored that can be classified as non-public information (NPI), personally identifiable information (PII), or sensitive customer financial information? If yes, describe and list types of data.","Yes",null,".WalkMe is an Overlay. WalkMe collects personally identifiable information and non-personally identifiable information from customers’ end-users in certain circumstances. This is the case for both SaaS solution, as well as local hosting.\n Depending on the context of your account configuration, we may collect or receive the following types of information, including Personal Information, from you:\n• HTML metadata - WalkMe configuration for locating elements on the page.\n• Analytics metadata – User interaction with WalkMe; which Walkthroughs and steps were played, launchers clicked, shoutOuts displayed etc. This is the WalkMe related metadata (the WalkMe configuration [e.g. location of balloon on page is XX,YY], and analytics usage [e.g. user GUID XXXXX used Walkthrough GUID YYYYY]).\n• IP addresses in logs for security and forensic purposes.\n• Pseudonymized masked IP addresses (i.e. 192.168.0.x) and End Users' Approximate geographical Location data\n• Environment properties such as browser and OS, page URL, and title.\nBy Default, collected metadata is assigned to anonymous random GUID.\nThe analytics information is anonymized aggregated usage statistics regarding WalkMe usage.\nAdditionally, Customer may use certain special features which require collecting and storing additional Personal Information (i.e. User Behavior Tracking, Screenshot Settings, Custom Variables, Custom User Identifier, Visions). For more information, please see our privacy policy.\n\nWalkMe designs its controls with the assumption that certain controls will be the responsibility of its customers (or \"user entities\"). Among these responsibilities, customers agree to make sure that they configure their instance of WalkMe according to their organizations policies and procedures, and that transmitted data will not contain information which may expose personally identifying information, without customer consent.",null,"8.2.1","Classification of Information",1,"P",153,15,null,null,null,0,1,1,null,0,1,null,2,1]
[3690,"SL.154","Do agreements with third parties who have access or potential access to Scoped Data, address confidentiality, audit, security, and privacy, including but not limited to incident response, ongoing monitoring, data sharing and secure disposal of Scoped Data?","Yes",5,null,"P.4 Third Party Privacy Agreements","15.1.2 ","Addressing security within supplier agreements",1,"P",154,15,null,null,null,0,1,1,null,0,1,null,2,1]
[3701,"SL.155","Is a business associate contract in place to address obligations for the privacy and security requirements for the services provided?","Yes",5,"Customers can use WalkMe services to collect data regulated under the U.S. Health\nInsurance Portability and Accountability Act (HIPAA).\n\nIf you plan to include Protected Health Information (as defined by HIPAA) on WalkMe services, you must first enter into a Business Associate Agreement (BAA) with WalkMe. WalkMe will then provide the BAA for you to sign.\n\nIn general, Any WalkMe service can be used with a healthcare application, but only services\ncovered by the WalkMe BAA can be used to store, process, and transmit Protected Health Information under HIPAA. \n\nNOTE: If you are a Covered Entity or Business Associate as defined by the Health Insurance Portability and Accountability Act of 1996 (as amended, “HIPAA”), you agree not to use WalkMe HIPAA Eligible Services for any purpose or in any manner involving Protected Health Information (as defined by HIPAA) without first entering into an WalkMe business associate agreement.","P.4 Third Party Privacy Agreements","15.1.2 ","Addressing security within supplier agreements",1,"P",155,15,null,null,null,0,1,1,null,0,1,null,2,1]
[3704,"SL.156","For Scoped Data, is personal information about individuals transmitted to or received from countries outside the United States? If yes, list the countries.","Yes",5,"WalkMe is a SaaS, We are depended on Amazon AWS as our cloud hosting provider. Content is created using the WalkMe Editor, which in turn gathers the required Metadata to present the Walkthroughs. This information is then stored in JavaScript Files, that reside on a dedicated AWS S3 Bucket (By Default). The S3 Resides by default in us-west-1 region (California, USA). In order to address legal jurisdictional considerations based on where data is stored or accessed, WalkMe allows customers to specify which of our geographic locations their data is allowed to traverse into/out of.  WalkMe customers are allowed to transfer personal data from an AWS region in the EEA to one outside the EEA in full compliance with EU data protection law as AWS already offer customers a Data Processing Addendum, including Model Clauses (Data Processing Addendum), which is signed by WalkMe. This Addendum was approved in 2015 by the EU data protection authorities, known as the Article 29 Working Party. See http://www.cnpd.public.lu/en/actualites/international/2015/03/AWS/index.html Moreover, in addition to the data processing addendum and the Model Clauses, customers who wish to transfer their personal data from EU to US benefit from WalkMe’s participation in the EU-U.S. Privacy Shield Framework. The EU-U.S. Privacy Shield Framework does not affect the way customers use, or work with, WalkMe, but, rather, provides an additional, EU-sanctioned mechanism for transferring personal data from the EU to the US. For details on the obligations for US service providers under the EU-U.S. Privacy Shield framework, please see the European Commission website here: http://ec.europa.eu/justice/data-protection/internationaltransfers/eu-us-privacy-shield/index_en.htm and the EU-U.S. Privacy Shield Framework website here: https://www.privacyshield.gov/participant?id=a2zt00000004EVHAA2",null,null,null,1,"P",156,15,null,null,null,0,1,1,null,0,1,null,2,1]
[3715,"SL.157","Is personal information transmitted, processed, stored, or disclosed to or retained by third parties? If yes, describe.","Yes",5,"WalkMe uses a number of third-party subcontractors to assist with the provision of our service.\n\nWalkMe uses a number of third-party subcontractors to assist with the provision of our service. However, only four (4) subcontractors have access to customers’ end-user’s PII (IP addresses etc.):\nWe use Amazon AWS as our cloud hosting provider.\nWe use Akamai as our CDN.\nWe use Good Data Analytics engines as a processing service.\nWe use Logz.io for Logging services.",null,15,"Supplier Relationships",1,"P",157,15,null,null,null,0,1,1,null,0,1,null,2,1]
[3270,"SL.158","Are there contractual controls to ensure that personal information transmitted, processed, stored or disclosed to or retained by third parties is limited to defined parameters for access, use and disclosure? If yes, describe. If no, explain reason.","Yes",5,"WalkMe only uses subcontractors that we trust and we use appropriate contractual safeguards which we monitor to ensure the required standards are maintained.\n\nWe have a signed Data Processing Agreement (DPA) with each subcontractor, for the processing of PII of users related to the EEA, per the requirements of the GDPR.\n\nAs for transfer to the US, we do that under the EU-US Privacy Shield for which we are certified against. If we need to transfer PII to other locations (which are outside the EEA and/or the US), we may enter into Standard Contractual Clauses with such entity, with respect to EEA related PII.\n\n","P.4 Third Party Privacy Agreements","15.1.2 ","Addressing security within supplier agreements",2,"P",158,15,null,null,null,0,1,1,null,0,1,null,2,1]
[3269,"SL.159","Is personal information accessed, disclosed, processed, transmitted or retained with third parties outside the US? If yes, describe and list the countries.","No",null,"WalkMe subcontractors that access, disclose, process, transmitt or retain are US based.",null,15,"Supplier Relationships",2,"P",159,15,null,null,null,0,2,2,null,2,2,null,2,1,null,null,null,null,null,null,null,null,null,null,2]
[3718,"SL.160","Is there a documented privacy policy or procedures for the protection of information transmitted, processed, or maintained on behalf of the client?","Yes",5,"WalkMe has a documented privacy policy which sets forth the procedures for the protection of information transmitted, processed, or maintained on behalf of the client.\nSee https://www.walkme.com/privacy-policy/\n\nOur Privacy Policy details the third-party subcontractors we use in order to collect and/or process the information on behalf of the client. \n\nSee links to third parties subcontractors' privacy policies below:\n\nAmazon Web Services Inc.\nhttps://aws.amazon.com/privacy\nAkamai Technologies Inc.\nhttps://www.akamai.com/us/en/privacy-policies/\nGoodData Inc.\nhttps://www.gooddata.com/privacy-policy\nLogz.io LTD.\nhttps://logz.io/about-us/privacy-policy/","P.2 Privacy Policy and Privacy Notices","15.1.1","Information security policy for supplier relationships",2,"P",160,15,null,null,null,0,1,1,null,0,1,null,2,1]
[3729,"SL.161","Are transactions for covered accounts accessed, modified, or processed, including address changes and discrepancies? If yes, describe.","No",null,null,null,null,null,1,"P",161,15,null,null,null,0,2,2,null,1,2,null,2,1,null,null,null,null,null,null,null,null,null,null,2]
[null,"","T. Threat Management",null,null,null,null,null,null,null,1,161,16,null,null,null,0,"","",null,1,"",null,1,1]
[895,"SL.162","Is there an anti-malware policy or program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?","Yes",5,"We deploy ESET endpoint security suite on all of our workstations and servers, as well as ESET Live Grid early warning preventative system. The suite includes antimalware & anti-ransomware modules as well as a HIPS functionality. The ESET is configured for auto-update and on-access, so its software is always upgraded to the latest version, and the latest Virus Signature Database updates.","T.1 Virus Protection (Servers)\nT.2 Virus Protection (Workstations)","12.2.1","Controls Against Malware",1,"T",162,16,null,null,null,0,1,1,null,0,1,null,2,1]
[4345,"SL.163","Prohibition of disabling anti-malware with exceptions requiring Security approval and reenablement as soon as possible.","Yes",5,"Settings are password protected to prevent users from changing any settings or disabling protection.",null,null,null,2,"T",163,16,null,null,null,0,1,1,null,0,1,null,2,1]
[4349,"SL.164","Is there a vulnerability management policy or program that has been approved by management, communicated to appropriate constituents and an owner assigned to maintain and review the policy?","Yes",5,"WalkMe performs monthly internal vulnerability assessments, and Annual External Penetration Tests, both against the applications and infrastructure of all environments. Summary of the latest Report is available upon request. The vulnerability scans that are performed monthly are Using industry leading Web & Network Vulnerability Scanners, including, but not limited to: Tenable.io Vulnerability Management (Formerly Nessus Cloud Vulnerability Scanner), OpenVAS, AlienVault USM, Nmap, and Burp Web Vulnerability Scanner. Findings are being valiated, assessed, classified and prioritized. All vulnerabilities classified as Critical or High, are remediated immediately. Remaining Identified vulnerabilities are examined and treated, according to Internal Security evaluation, which is done by the security team.\n\nSeverity Level Remediation Response Time\nCritical Issue is remediated within 1 week.\nHigh Issue is remediated within 2 weeks.\nMedium Issue is remediated within 3 months.\nLow Issue is remediated within 6-12 months.","T.4 Technical Compliance Checking - Vulnerability Testing and Remediation","12.6.1","Control of technical vulnerabilities",1,"T",164,16,null,null,null,0,1,1,null,0,1,null,2,1]
[4365,"SL.165","Are vulnerability scans performed on all internet-facing applications at least monthly and after significant changes?","Yes",5,null,"T.3 Application Vulnerability Assessments/Ethical Hacking","12.6.1","Management of technical vulnerabilities",1,"T",165,16,null,null,null,0,1,1,null,0,1,null,2,1]
[3711,"SL.166","Are vulnerability scans performed against internal networks and systems?","Yes",5,null,null,null,null,1,"T",166,16,null,null,null,0,1,1,null,0,1,null,2,1]
[3721,"SL.167","Are penetration tests performed?","Yes",5,null,null,null,null,1,"T",167,16,null,null,null,0,1,1,null,0,1,null,2,1]
[2233,"SL.168","Are there processes to manage threat and vulnerability assessment tools and the data they collect?","Yes",5,"Tools' generetad logs are audited as part of the penetration test process.","I.1 Application Security Program Governance","12.6.1","Management of technical vulnerabilities",1,"T",168,16,null,null,null,0,1,1,null,0,1,null,2,1]
[null,"","U. Server Security",null,null,null,null,null,null,null,1,168,17,null,null,null,0,"","",null,0,"",null,1,1]
[4366,"SL.169","Are Servers used for transmitting, processing or storing Scoped Data?","Yes",5,"Content is created using the WalkMe Editor Server, which in turn gathers the required Metadata to present the Walkthroughs via the WalkMe Player Server. During the publishing process, static JavaScript files are generated and the information is then stored on a private dedicated AWS S3 Bucket.",null,null,null,1,"U",169,17,null,null,null,0,1,1,null,0,1,null,2,1]
[2213,"SL.170","Are systems and applications patched?","Yes",5,"We have vulnerability & patch management procedure. We are using WSUS to patch & validate that workstations are regularly patched. On production servers we patch once a month, aside from high/critical security updates that are installed immediately. We have implemented Microsoft SCCM (System Center Configuration Manager) for in-office patch management.","G.2 System Patching","12.6.1 ","Management of technical vulnerabilities",1,"U",170,17,null,null,null,0,1,1,null,0,1,null,2,1]
[3568,"SL.171","Are default hardened base virtual images applied to virtualized operating systems?","Yes",3,"WalkMe hardens configures OS's and software securely, update it, create rules and policies to help govern the system in a secure manner, and remove unnecessary applications and services. This is done to minimize a computer OS's exposure to threats and to mitigate possible risk.","U.2 System Hardening Standards",null,null,1,"U",171,17,null,null,null,0,1,1,null,0,1,null,2,1]
[3649,"SL.172","Are Hypervisors used to manage systems used to transmit, process or store Scoped Data?","N/A",null,"We use Amazon AWS as our cloud hosting provider. No Hypervisors used.","V.4 Security Review of Hypervisor Configuration","14.1.2","Securing application services on public networks",1,"U",172,17,null,null,null,0,3,3,null,1,3,null,2,1,null,null,null,null,null,null,null,null,null,null,2]

{"sheet":"Z. Additional Questions","index":8,"n_rows":5,"n_cols":7,"rows_kept":5,"cut":false,"hidden":false,"merged":[[2,0,2,6]]}
["Z. Additional Questions"]
[]
["This tab is used to supply any additional questions not covered by this SIG. Questions on this tab will not be analyzed by the SIG Management Tool."]
[]
["Ques Num","Question/Request","Response","Additional Information","AUP Reference","ISO Ref Num","ISO Ref Text"]

{"sheet":"Glossary","index":9,"n_rows":246,"n_cols":4,"rows_kept":246,"cut":false,"hidden":false,"merged":[]}
[null,"Acceptable Use Policy","Part of the information security framework that defines what users are and are not allowed to do with the IT systems of the respondent. It should contain a subset of the information security policy and refer users to the full security policy when relevant. It should also clearly define the sanctions applied if a user violates the policy."]
[null,"Glossary"]
[null,"Term","Definition","Source"]
[null,"Acceptable Use Policy","Part of the information security framework that defines what users are and are not allowed to do with the IT systems of the respondent. It should contain a subset of the information security policy and refer users to the full security policy when relevant. It should also clearly define the sanctions applied if a user violates the policy."]
[null,"Access ","Obtaining, retrieving, altering, duplicating, copying, scanning, photographing, using, disclosing, examining, printing, reading, and/or viewing Scoped Data stored in any media including but not limited to paper, x-ray, film, a computer’s memory, and electronic media such as an internal or external hard drive, a backup tape, or a USB stick. Viewing, photographing, altering, printing, using, and/or disclosing, Scoped Data displayed on a computer monitor, screen, or any other device such as a smartphone, tablet, and the like. (See also Potential Access)"]
[null,"Accountability ","The obligation of an individual or organization to account for its activities, accept responsibility for all success and failures associated with the activity and to disclose the results in a transparent and timely manner. "]
[null,"Acknowledgement of Acceptable Use","A written attestation from a user of an information system indicating the user's acceptance and willingness to comply with the relevant information systems control policies."]
[null,"ACL (Access Control List)","A list of permissions attached to an object. An ACL specifies which users or system processes are granted access to objects, as well as what operations are allowed on given objects.","Wikipedia"]
[null,"Anti-Tailgating / Anti-Piggybacking Mechanism","Two sets of doors whereby access to the second is not granted until the individual has passed through (and closed) the first, often referred to as a \"man trap.\" A controlled turnstile is also considered an anti-tailgating/piggybacking mechanism."]
[null,"API","Application program interface (API) is a set of routines, protocols, and tools for building software applications. An API specifies how software components should interact and APIs are used when programming graphical user interface (GUI) components.","Webopedia"]
[null,"Applicable Privacy Law","Relevant laws, enactments, regulations, binding industry codes, regulatory permits and licenses that are in effect and address the protection, handling and privacy of scoped privacy data, selected as being in scope for the assessment. "]
[null,"Application Inventory System ","An asset-based approach that includes an itemized list of applications or application components, such that software versions, security testing results and additional attributes can be individually identified against such assets. "]
[null,"Application Segmentation","In response to the advent of borderless applications, application segmentation has evolved and should be applied consistently on the application no matter where it goes, which borders it crosses, or which siloes are carrying its traffic.\nIn enterprises where segmentation is oriented around applications instead of infrastructure, the security benefit is immediately apparent. If a hacker manages to compromise a user, then the hacker’s access is contained and limited to only the applications that the compromised user is allowed to access. They cannot move laterally or hop from application to application, browsing through the IT infrastructure until they find the most sensitive or valuable applications and data. The data breach is, by default, contained and cannot spread.","http://www.cloudstrategymag.com/articles/85958-application-segmentation"]
[null,"Asset","In computer security, a major application, general-support system, high-impact program, physical plant, mission-critical system, personnel, equipment, or a logically related group of systems.","NIST: CNSSI-4009"]
[null,"Asset Classification","The category or type assigned to an asset, which is derived from the asset classification policy. Asset classifications frequently vary from company to company."]
[null,"Asset Control Tag","A unique identification number assigned to all inventoried assets."]
[null,"Asset Management Program","A program for managing an organization's assets which includes formalized governance, policies, and procedures. "]
[null,"Asset Tracking","Asset tracking refers to the method of tracking physical assets, either by scanning barcode labels attached to the assets or by using tags using GPS or RFID which broadcast their location.","Wikipedia"]
[null,"Attack Vector ","Path or means by which an attacker can gain access to a system or network in order to deliver a payload or malicious outcome. "]
[null,"Attribute","A property or field of a particular object."]
[null,"Authentication","The process of verifying the identity of an individual user, machine, software component, or any other entity","FFIEC Information Security Booklet"]
[null,"Baseline","A benchmark by which subsequent items are measured."]
[null,"Battery","An electrochemical cell (or enclosed and protected material) that can be charged electrically to provide a static potential for power or released electrical charge when needed."]
[null,"Biometric Reader","A device that uses measurable biological characteristics such as fingerprints or iris patterns to assist in authenticating a person to an electronic system."]
[null,"Business Associate","A business associate is a person or organization, other than an employee of a covered entity, that performs certain functions on behalf of, or provides certain services to, a covered entity that involve access to PHI. A business associate can also be a subcontractor responsible for creating, receiving, maintaining, or transmitting PHI on behalf of another business associate. Business associates provide services to covered entities that include:\nAccreditation\nBilling\nClaims processing\nConsulting\nData analysis\nFinancial services\nLegal services\nManagement administration\nUtilization review\nNOTE: A covered entity can be a business associate of another covered entity.","https://www.cms.gov/Outreach-and-Education/Medicare-Learning-Network-MLN/MLNProducts/Downloads/HIPAAPrivacyandSecurity.pdf"]
[null,"Business Continuity ","A set of planning, preparatory and related activities which are intended to ensure an organization's critical business functions will either continue to operate despite serious incidents or disasters that might otherwise have interrupted them, or will be recovered to an operational state within a reasonably short period."]
[null,"Business Continuity Plan","A process that defines exactly how, for which applications and for how long, a business plans to continue functioning after a disruptive event. The business continuity plan is usually an overarching plan that includes both operational and technology-related tasks. "]
[null,"Business Impact Analysis (BIA)","This term is applicable across Technology Risk Management, in both information security and business continuity planning domains. An impact analysis results in the differentiation between critical and non-critical business functions. A function may be considered critical if there is an unacceptable impact to stakeholders from damage to the function. The perception of the acceptability of disruption may be modified by the cost of establishing and maintaining appropriate business or technical recovery solutions. A function may also be considered critical if dictated by law."]
[null,"Business Process","An end-to-end service made available to internal or external parties that usually corresponds to standard service products that the Service Provider offers to clients."]
[null,"Business Resiliency","The ability an organization has to quickly adapt to disruptions while maintaining continuous business operations and safeguarding people, assets and overall brand equity. Business resilience is more than disaster recovery, it includes post-disaster strategies to avoid costly downtime, the identification and resolution of vulnerabilities and the ability to maintain business operations in the face of additional, unexpected breaches."]
[null,"Business Resiliency Procedure","A process that defines exactly how, for which applications, and for how long a business plans to continue functioning after a disruptive event. The business resiliency procedure is usually an overarching procedure that includes both operational and technology-related tasks."]
[null,"Change Control","Also known as Change Management - The broad processes for managing organizational change. Change management encompasses planning, oversight or governance, project management, testing, and implementation. The purpose is to ensure that no unnecessary changes are made, that all changes are documented, that services are not unnecessarily disrupted and that resources are used efficiently.","FFIEC Operations Booklet\nand WhatIS.com"]
[null,"Change Initiation Request (CIR)","A document (physical or electronic) used to track change requests, including new features, enhancement requests, defects, and changed requirements. The change initiation request document must contain:\n - The name of the person initiating the change\n - The system affected by the change\n - A description of the change, including the file name(s) and file location(s)\n - The date the change will occur\n - An approval signature by someone other than the person initiating the change\n - An approval date"]
[null,"Cipher Lock","A cipher lock is opened with a programmable keypad. The purpose of cipher locks is to control access, limiting either unannounced intrusions or unescorted entry to particular areas of a facility that are sensitive. A cipher lock may have four or five pushbuttons, depending on the manufacturer. Even with five pushbuttons, the code may be one to five digits. When the cipher lock unit is set up the code is programmed and shared with authorized personnel.","http://www.wisegeek.com/what-is-a-cipher-lock.htm"]
[null,"Clean Room","A network segment or subnet where data is sanitized for mobile devices access only."]
[null,"Client","A client is the individual and/or entity for whom services are being provided by the organization. "]
[null,"Client Scoped Privacy Data ","Data received from the organization’s client that includes EU “sensitive personal data” (health, religion, criminal records, trade union membership, sexual orientation and race) and in the US, protected scoped privacy data includes name, address or telephone number in conjunction with Social Security number, driver’s license number, account number, credit or debit card number, personal identification number or user ID or password. "]
[null,"Climate Control System","A combination of sensors and equipment that monitors the temperature and humidity in a sensitive environment (such as a data center) and that automatically heats/cools/dehumidifies as needed to keep the atmosphere within acceptable tolerances."]
[null,"Closed Circuit TV (CCTV)","CCTV is a TV system in which signals are not publicly distributed but are monitored, primarily for surveillance and security purposes. CCTV relies on strategic placement of cameras and private observation of the camera's input on monitors.","WhatIs.com"]
[null,"Cloud Computing - NIST Definition","Cloud Computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This Cloud model promotes availability and is composed of five essential characteristics, three service models, and four deployment models."]
[null,"Cloud Computing - NIST Definition of Deployment Models - Community Cloud","The Cloud infrastructure is shared by several respondents and supports a specific community that has shared concerns (e.g., mission, security requirements, policy, and compliance considerations). It may be managed by the respondent or subcontractor and may exist on premise or off premise."]
[null,"Cloud Computing - NIST Definition of Deployment Models - Hybrid Cloud","The Cloud infrastructure is a composition of two or more Clouds (private, community, or public) that remain unique entities but are bound together by standardized or proprietary technology that enables data and application portability (e.g., Cloud bursting for load balancing between Clouds)."]
[null,"Cloud Computing - NIST Definition of Deployment Models - Private Cloud","The Cloud infrastructure is operated solely for the respondent. It may be managed by the organization or a third party and may exist on premise or off premise."]
[null,"Cloud Computing - NIST Definition of Deployment Models - Public Cloud","The Cloud infrastructure is made available to the general public or a large industry group and is owned by the Respondent selling Cloud services."]
[null,"Cloud Computing - NIST Definition of Essential Characteristics - Broad Access Network","Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, laptops, and PDAs)."]
[null,"Cloud Computing - NIST Definition of Essential Characteristics - Measured Service","Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service."]
[null,"Cloud Computing - NIST Definition of Essential Characteristics - On-Demand Self-Service","A consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service’s provider."]
[null,"Cloud Computing - NIST Definition of Essential Characteristics - Rapid Elasticity","Capabilities can be rapidly and elastically provisioned, in some cases automatically, to quickly scale out and rapidly released to quickly scale in. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be purchased in any quantity at any time."]
[null,"Cloud Computing - NIST Definition of Essential Characteristics - Resource Pooling","The provider’s computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand. There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter). Examples of resources include storage, processing, memory, network bandwidth, and virtual machines. "]
[null,"Cloud Computing - NIST Definition of Service Models - Cloud Infrastructure as a Service (IaaS)"," The capability provided to the consumer is to provision processing, storage, networks, and other fundamental computing resources where the consumer is able to deploy and run arbitrary software, which can include operating systems and applications. The consumer does not manage or control the underlying Cloud infrastructure but has control over operating systems, storage, deployed applications, and possibly limited control of select networking components (e.g., host firewalls)."]
[null,"Cloud Computing - NIST Definition of Service Models - Cloud Platform as a Service (PaaS)"," The capability provided to the consumer is to deploy onto the Cloud infrastructure consumer-created or acquired applications created using programming languages and tools supported by the provider. The consumer does not manage or control the underlying Cloud infrastructure including network, servers, operating systems, or storage, but has control over the deployed applications and possibly application hosting environment configurations."]
[null,"Cloud Computing - NIST Definition of Service Models - Cloud Software as a Service (SaaS)","The capability provided to the consumer is to use the provider’s applications running on a Cloud infrastructure. The applications are accessible from various client devices through a thin client interface such as a web browser (e.g., web-based email). The consumer does not manage or control the underlying Cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited user-specific application."]
[null,"Cloud Service Provider (CSP) ","The business or entity providing Cloud services. "]
[null,"Cold Site","A remote facility that provides the equipment necessary for data and process restoration."]
[null,"Co-Location","A colocation (colo) is a data center facility in which a business can rent space for servers and other computing hardware. Typically, a colo provides the building, cooling, power, bandwidth and physical security while the customer provides servers and storage.","WhatIs.com"]
[null,"Communications Plan","A tool for communicating information on the considerations and implications of respondent business continuity to improve decision making."]
[null,"Complex Password ","A password that combines alphabetic and non-alphabetic characters, such as special or numeric characters. "]
[null,"Confidential Information ","Confidential information means any information and/or documents of the client or its affiliates to which the organization has had access, whether in oral, written, graphic or machine-readable form, and includes, but is not limited to: (i) trade secrets and work product; (ii) information relating to business plans or practices, sales, pricing, financial data or marketing plans or methods; (iii) software, applications, systems and networks, including source code, object code and documentation and commentary related thereto; (iv) information relating to one or more customers of the subscriber or its affiliates, including, but not limited to, the following (collectively, “client data”): (1) personal information such as a customer’s name, address, telephone number, account relationships, account numbers, account balances and account histories, (2) information concerning such customers that would be considered “nonpublic personal information” within the meaning of Title V of the Gramm-Leach Bliley Act of 1999 (Public Law 106-102, 113 Stat. 1338) and its implementing regulations, as the same may be amended from time to time and (3) information concerning such customers that is protected from disclosure by other applicable federal or state laws and regulations regarding privacy; (v) confidential information of third parties in the subscriber’s or its affiliates’ possession; (vi) security procedures and measures; and (vii) all other information related to the subscriber’s and/or its affiliates’ business(es). Except with respect to customer data, “client confidential information” does not include information that (i) is at the time of its disclosure publicly known; (ii) was rightfully known by licensor at the time of disclosure; or (iii) is lawfully received by licensor from a third party not bound by confidentiality obligations to the owner of such client confidential information. "]
[null,"Confidentiality","The protection of sensitive information from unauthorized disclosure and sensitive facilities due to physical, technical, or electronic penetration or exploitation."]
[null,"Configuration Management","Is the practice of handling changes systematically so that a system maintains its integrity over time. \nThe Information Technology Infrastructure Library (ITIL) specifies the use of a Configuration management system (CMS) or Configuration management database (CMDB) as a means of achieving industry best practices for Configuration Management. CMDBs are used to track Configuration Items (CIs) and the dependencies between them, where CIs represent the things in an enterprise that are worth tracking and managing, such as but not limited to computers, software, software licenses, racks, network devices, storage, and even the components within such items.\n\nThe benefits of a CMS/CMDB includes being able to perform functions like root cause analysis, impact analysis, change management, and current state assessment for future state strategy development.","Wikipedia"]
[null,"Constituent","An active employee or contractor."]
[null,"Contractor","A contracted professional with expertise in a particular domain or area."]
[null,"Covered Account","A covered account is (1) an account primarily for personal, family, or household purposes, that involves or is designed to permit multiple payments or transactions, or (2) any other account for which there is a reasonably foreseeable risk to customers or the safety and soundness of the financial institution or creditor from identity theft. Each financial institution and creditor must periodically determine whether it offers or maintains a ‘‘covered account.’’","Section 114 of the FACT Act\nA. Red Flag Regulations and Guidelines"]
[null,"Covered Entity","(As defined by the HIPAA Rules requirement) A covered entity can be an Individual, a business and/or an agency who must comply with HIPAA rules to protect the privacy and security of health information and must provide individuals with certain rights related to their health information (i.e. Doctors, Health Insurance Companies, healthcare clearing house)."]
[null,"Critical third party service provider","A service provider that is so vital that the incapacity or unavailability of such may have a debilitating impact on the business utilizing the service provider. Provides a product or performs a service for which there is no backup or alternate provider."]
[null,"Cross Site Request Forgery (CSRF) ","An attack which can occur when a malicious website, email, blog, instant message (IM) or program causes a user’s web browser to perform unwanted action on a trusted website. CSRF allows an attacker to access functionality in a target web application via the victim’s already authenticated browser. "]
[null,"Cross Site Scripting (XSS) ","A computer-related security vulnerability typically found in website applications. This hacking technique can enable attackers to inject client-side script into web pages viewed by other users. "]
[null,"Data Controller ","Any person (including a public authority, agency or any other body) which alone or jointly with others determines the purposes and means of processing scoped privacy data (EU Directive). "]
[null,"Data Flow ","A flow describing and/or depicting the scoped privacy data for a given data subject for a given country or jurisdiction. The data flow defines the scoped privacy data and the protected scoped privacy data collected, stored, used, accessed, shared and transferred across borders of the country or jurisdiction that are secured, retained and retired. "]
[null,"Data segmentation and separation","(see also Network Segmentation ) Better security can be achieved by not mixing trusted and untrusted applications, data, and networks. Segmentation on a cloud-computing infrastructure must provide an equivalent level of isolation as that achievable through physical network separation. Mechanisms to ensure appropriate isolation may be required at the network, operating system, and application layers; and most importantly, there should be guaranteed isolation of data that is stored. ","PCI_DSS_v2_Cloud_Guidelines"]
[null,"Data Subject ","Any person who can be identified, directly or indirectly, by information that identifies one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity. In certain countries (such as Austria, Luxembourg and Italy), this also includes information concerning legal entities/corporations. "]
[null,"Data Subject Category ","Includes, for example, employees, clients, business partners, customers or users. "]
[null,"Demilitarized Zone (DMZ)","A controlled network space, delimited by firewalls or other policy-enforcing devices, which is neither inside an organization's network nor directly part of the Internet. A DMZ is typically used to isolate the respondent's most highly secured information assets while allowing predefined access to those assets that must provide or receive data outside of the respondent. The access and services provided should be restricted to the absolute minimum required."]
[null,"Disaster Recovery","The process, policies and procedures related to preparing for recovery or continuation of technology infrastructure critical to the respondent after a natural or human-induced disaster. Disaster recovery is a subset of business continuity"]
[null,"Electronic Health Records","An Electronic Health Record (EHR) is an electronic version of a patients medical history, that is maintained by the provider over time, and may include all of the key administrative clinical data relevant to that persons care under a particular provider, including demographics, progress notes, problems, medications, vital signs, past medical history, immunizations, laboratory data and radiology reports The EHR automates access to information and has the potential to streamline the clinician's workflow. The EHR also has the ability to support other care-related activities directly or indirectly through various interfaces, including evidence-based decision support, quality management, and outcomes reporting.","https://www.cms.gov/Medicare/E-health/EHealthRecords/index.html "]
[null,"Electronic System","The combination of hardware and software used to manage electronic information. A system which stores information from internal and external sources to facilitate better decision making.","http://thelawdictionary.org/electronic-information-system/"]
[null,"Emergency Periods ","Duration of time when a client’s service provider is experiencing an emergency event that has an impact on the client. "]
[null,"Enclosed","Closed in, surrounded, or included within."]
[null,"Encryption","The process of taking an unencrypted message (plaintext), applying a mathematical function to it (encryption algorithm with a key) and producing an encrypted message (ciphertext). Use of encryption protects information between the encryption process and the decryption process (the inverse of encryption) against unauthorized disclosure","ISACA CSX Fundamentals and pci_dss_glossary_v1-1"]
[null,"Enterprise Risk Governance Program ","A program implemented, reviewed and maintained by an organization’s Executive Board (if applicable) and Senior Management to govern the relevant factors of risks to the organization. This risk factors can include but are not limited to the following: \nStrategic Risks \nFinancial Risks \nOperational Risks \nIT and Infrastructure Risks "]
[null,"Event","Any detectable or discernible occurrence that has significance for the management of the IT Infrastructure or the delivery of IT service and evaluation of the impact a deviation might cause to the services. Events are typically notifications created by an IT service, Configuration Item (CI) or monitoring tool.","Wikipedia"]
[null,"Exception","A result that deviates from the norm or expectation."]
[null,"Exclusion","An item not fully covered by the question."]
[null,"External Parties","Any entity other than the organization providing responses to the SIG. Examples include (but are not limited to) service providers, contractors/consultants, vendors, etc."]
[null,"External Vulnerability Scan","A systematic review process executed from a network address outside of the Scoped Systems and Data network that uses software tools designed to search for and map systems for weaknesses in an application, computer or network. The intent is to determine if there are points of weakness in the security control system that can be exploited from outside the network."]
[null,"Externally Facing","The network entry point that receives inbound traffic."]
[null,"Extranet","An intranet that is partially accessible to authorized outsiders."]
[null,"Facility","A structure or building, or multiple structures or buildings, in which operations are conducted for the services provided. These operations include handling, processing and storage of information, data or systems, as well as personnel that support the operations."]
[null,"Fire Suppression System","A combination of sensors and equipment designed to detect the presence of heat/smoke/fire and actuate a fire retardant or fire extinguishing system."]
[null,"Firewall","A set of related programs, located at a network gateway server, that protects the resources of private networks from other networks. Firewalls may be application/proxy, packet-filtering, or stateful-based. Examples of firewalls are Cisco PIX, Check Point Firewall, Juniper NetScreen and Cyberguard. (Though they contain some firewall functionality, routers are not included in this definition.)"]
[null,"Firewall Rule","Information added to the firewall configuration to define the respondent's security policy through conditional statements that tell the firewall how to react in a particular situation."]
[null,"Fluid Sensor","A mechanical device that is sensitive to the presence of water or moisture that transmits a signal to a measuring or control instrument."]
[null,"Gateway","A node on a network that facilitates the communication of information between two or more nodes."]
[null,"General Perimeter","An area with fully enclosed walls that extend from floor to ceiling (beyond raised floors and ceilings) surrounding the secure perimeter. This may be the same floor as the secure perimeter, if shared by other tenants in the facility, or the facility itself."]
[null,"Generator","A device that converts mechanical energy to electrical energy via an engine (usually fuel-powered) that provides electrical current as input to a power source."]
[null,"Hardware Systems","Includes servers and network devices."]
[null,"Heat Detector","A mechanical device that is sensitive to temperature and transmits a signal to a measuring or control instrument."]
[null,"HIPAA","Acronym that stands for the Health Insurance Portability and Accountability Act, a US law designed to provide privacy standards to protect patients' medical records and other health information provided to health plans, doctors, hospitals and other health care providers.\nThe HIPAA Privacy Rule pertains to all Protected Health Information (PHI) including paper and electronic and the Security Rule deals specifically with Electronic Protected Health Information (EPHI). The Security Rule lays out three types of security safeguards required for compliance: administrative, physical, and technical.","http://www.medicinenet.com/script/main/art.asp?articlekey=31785\n\nand Wikipedia"]
[null,"HITECH","Health Information Technology for Economic and Clinical Health Act was enacted to promote the adoption and meaningful use of health information technology. Subtitle D of the HITECH Act addresses the privacy and security concerns associated with the electronic transmission of health information, in part, through several provisions that strengthen the civil and criminal enforcement of the HIPAA rules. ","http://www.hhs.gov/hipaa/for-professionals/special-topics/HITECH-act-enforcement-interim-final-rule/index.html"]
[null,"Hot Site","A duplicate of the respondent’s original site, with full computer systems and near-complete backups of user data."]
[null,"HVAC","HVAC (heating, ventilating/ventilation, and air conditioning) is the technology of indoor and vehicular environmental comfort. Its goal is to provide thermal comfort and acceptable indoor air quality.","Wikipedia"]
[null,"Hypervisor","A piece of software that provides abstraction of all physical resources (such as central processing units, memory, network, and storage) and thus enables multiple computing stacks (consisting of an operating system, middleware and application programs) called virtual machines to be run on a single physical host.","NIST SP 800-125B"]
[null,"Hypervisor Console","A control panel for a virtual machine manager (hypervisor) which allows multiple operating systems to share a single hardware processor."]
[null,"Immediate Perimeter","A rack or cage that houses the Scoped Systems and Data."]
[null,"Incident","Events outside normal operations that disrupt normal operational processes. An incident can be a relatively minor event, such as running out of disk space on a server, or a major disruption, such as a breach of database security and the loss of private and confidential customer information."]
[null,"Incident Management","A term describing the activities of an organization to identify, analyze, and correct hazards to prevent a future re-occurrence. These incidents within a structured organization are normally dealt with by either an Incident Response Team (IRT), or an Incident Management Team (IMT). These are often designated before hand, or during the event and are placed in control of the organization whilst the incident is dealt with, to restore normal functions.","Wikipedia"]
[null,"Incident Severity","A ranking of an event’s significance that uses, at a minimum, a three-point scale: minor, moderately severe, and severe. For each level of severity, the respondent's IT department should define acceptable resolution times, escalation procedures, and reporting procedures."]
[null,"Information Assets ","Scoped target and/or system data utilized/owned by an organization. "]
[null,"Information Security","Smetimes shortened to InfoSec, is the practice of defending information from unauthorized access, use, disclosure, disruption, modification, inspection, recording or destruction. It is a general term that can be used regardless of the form the data may take (e.g. electronic, physical). An information security program should include all aspects of the sensitivity of corporate information, including confidentiality, integrity and availability.","Wikipedia"]
[null,"Information Security Review","An information security assessment is a measurement of the security posture of a system or organization. The security posture is the way information security is implemented. Security assessments are risk-based assessments, due to their focus on vulnerabilities and impact. Security assessments rely on assessment methods that can accurately assess the Technology, People, and Process elements of security.","Scoping Security Assessments - A Project Management Approach (SANS Institute Reading Room site - SANS Institute May 2011)"]
[null,"Intermediate Distribution Frame IDF","A free-standing or wall-mounted rack for managing and interconnecting the telecommunications cable between end user devices and a main distribution frame (MDF)."]
[null,"Internal Vulnerability Scan","A systematic review process using software tools designed to search for and map systems for weaknesses in an application, computer or network, executed from a network address within the Scoped Systems and Data network. Internal vulnerability scans are used to determine whether points of weakness in the security control system exist that could be exploited by a user with access to the internal network."]
[null,"Internet","A global network connecting millions of computers. More than 100 countries are linked into exchanges of data, news and opinions."]
[null,"Internet Protocol (IP)","A networking standard that allows messages to be sent back and forth over the Internet or other IP networks."]
[null,"Intranet","An IP network that resides behind a firewall and is accessible only to people who are members of the same organization."]
[null,"Intrusion Detection Systems (IDS)","A security inspection system for computers and networks that can allow for the inspection of systems activity and inbound/outbound network activity. The IDS key function identifies suspicious activity or patterns that may indicate a network or system attack."]
[null,"Intrusion Protection System (IPS)","A more sophisticated Intrusion Detection System (IDS) that allows administrators to configure predefined actions to be taken if suspicious activity is detected."]
[null,"Inventory","An itemized list of current assets."]
[null,"Local Backup","A method for backing up data on the local system. For example, an attached tape or storage device."]
[null,"Main Distribution Frame","A wiring rack that connects outside lines with internal lines. Main distribution frames are used to connect public or private lines entering the building to the respondent’s internal networks"]
[null,"Malware","Is designed to secretly access a computer system without the owner’s informed consent. The expression is a general term (short for malicious software) used to mean a variety of forms of hostile, intrusive, or annoying software or program code. Malware includes computer viruses, worms, Trojan horses, spyware, dishonest adware, ransomware, crimeware, most rootkits, and other malicious and unwanted software or programs.","http://ithandbook.ffiec.gov/glossary.aspx "]
[null,"Man-trap","Two sets of doors whereby access to the second is not granted until the individual has passed through (and closed) the first, often referred to as a \"man trap.\" A controlled turnstile is also considered an anti-tailgating/piggybacking mechanism."]
[null,"Map of Dependencies","A diagram that illustrates how a business process relates to its supporting capabilities. (“Supporting capabilities” include: people involved in the delivery of the business process, application software, middleware software, servers, storage, networking, physical facilities, and people involved in the IT and physical infrastructure management.)"]
[null,"Master Change Log","A document or database that contains a report of each change initiation request (CIR) (approved or rejected). The document or database must contain:\n - Reference to a CIR\n - Date submitted\n - Date of change\n - Name of affected system\n - Approval status (approved or rejected)"]
[null,"MD5","A one-way cryptographic hash algorithm that produces a unique 128-bit alphanumeric fingerprint of its input."]
[null,"Media","Physical objects that store data, such as paper, hard disk drives, tapes, and compact disks (CDs).","http://ithandbook.ffiec.gov/glossary.aspx "]
[null,"Mobile Code","Physical objects that store data, such as paper, hard disk drives, tapes, and compact disks (CDs)."]
[null,"Mobile Device"," smartphones, tablet computers, laptops; anyng that is not affixed to a desk or operates wirelessly"]
[null,"Mobile Device Management Solution","Mobile device management (MDM) is an industry term for the administration of mobile devices, such as smartphones, tablet computers, laptops and desktop computers. MDM is usually implemented with the use of a third party product that has management features for particular vendors of mobile devices. It can incorporate safeguards related to but not limited to password controls, remote wipe, remote lock, detection of jailbreak devices, encryption validation."]
[null,"Mobile Device Policy","Policy implemented which governs the use of Mobile devices whether they be BYOD or corporate issued. This policy can incorporate details related to Security training, Terms of Use, constituent responsibilities, data handling and access controls."]
[null,"Modem","A device that allows a computer or terminal to transmit data over an analog telephone line."]
[null,"Multi-factor Authentication","Multifactor authentication requires the use of solutions from two or more of the three categories of factors: \n• Something the user knows (e.g., password, PIN). \n• Something the user has (e.g., ATM card, smart card). \n• Something the user is (e.g., biometric characteristic, such as a fingerprint). \nUsing multiple solutions from the same category at different points in the process may be part of a layered security or other compensating control approach, but it would not constitute multifactor authentication. \n"]
[null,"N+1","N+1 redundancy is a form of resilience that ensures system availability in the event of component failure. Components (N) have at least one independent backup component (+1).","Wikipedia"]
[null,"Network Address Translation (NAT)","A process of rewriting the source and/or destination addresses of IP packets as they pass through a network device."]
[null,"Network Devices","Units that mediate data in a computer network. Computer networking devices are also called network equipment, Intermediate Systems (IS) or InterWorking Unit (IWU)."]
[null,"Network Segment","A portion of a computer network that is separated from the remainder of the network by a device such as a repeater, hub, bridge, switch or router. Each segment may contain one or multiple computers or other hosts. Network segments are typically established for throughput and/or security reasons."]
[null,"Network time protocol (NTP)","A protocol designed to synchronize the clocks of computers over a network."]
[null,"Node","Any physical device with a unique network address."]
[null,"Non-Employees","Auditors, consultants, contractors, and vendors."]
[null,"Non-Public Information (NPI)","Any personally identifiable or company proprietary information that is not publicly available. Non-public information includes but is not limited to: certain company proprietary information, such as internal policies and memorandums; and personal information such as an individual’s name, address or telephone number. It also includes information requiring higher levels of protection according to the company’s security policy, such as company proprietary trade secrets or personal information that bundles an individual’s name, address or telephone number with a Social Security number, driver’s license number, account number, credit or debit card number, personal identification number, health information, religious opinions or a user ID or password. "]
[null,"Non-Public Personal Information (NPPI) ","Any personally identifiable information that is not publicly available. Non-public, personal information includes but is not limited to name, address, city, state, zip code, telephone number, Social Security number, credit card number, bank account number and financial history. "]
[null,"Notice Consent Language ","Any data subject consent language in a privacy notice to be accepted by a data subject (expressly or by implication). The language may relate to consent to the entire privacy notice or to particular uses of the scoped privacy data where a data subject’s non-consent to this use of the scoped privacy data results in a data subject rejecting the privacy notice. Examples of uses include cross-border transfer of scoped privacy data, special use of the scoped privacy data or special local regulatory requirements. "]
[null,"Open Web Application Security Project \n(OWASP) \n","An open, online community dedicated to enabling organizations to conceive, develop, acquire, operate and maintain web applications that can be trusted. "]
[null,"Owner","An individual or entity that has approved management responsibility for controlling the production, development, maintenance, use and security of the assets. Ownership is not an indication of property rights to the asset."]
[null,"Ownership","A formally assigned responsibility for a given asset."]
[null,"Penetration Testing","A conventional security control and the one most widely used by software vendors."]
[null,"Permission","Any data subject permission (opt in or opt out) required to use or share scoped privacy data that can be easily switched on and off, including for the following purposes: marketing, affiliate sharing, product use, promotions, newsletters, tailoring services to data subject’s particular requirements, behavioral and purchasing patterns, social networking and professional networking, excluding notice consent language. "]
[null,"Personal Health Records","A personal health record ( PHR ) is an electronic application used by patients to maintain and manage their health information in a private, secure, and confidential environment. PHRs are managed by patients.","https://www.healthit.gov/providers-professionals/faqs/what-personal-health-record"]
[null,"Personal Identification Number (PIN)","A secret shared between a user and a system that can be used to authenticate the user to the system."]
[null,"Personally Identifiable Informatin (PII) ","NIST Special Publication 800-122 defines PII as \"any information about an individual maintained by an agency, including (1) any information that can be used to distinguish or trace an individual's identity, such as name, social security number, date and place of birth, mother's maiden name, or biometric records; and (2) any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information.\"","Wikipedia and NIST 800-122"]
[null,"Physical Media","Any portable device or substance (e.g., paper) used to store data for specific and legitimate purposes. Examples of physical media include:\n - Magnetic tapes and disks\n - Cartridges, including 9-track, DAT, and VHS\n - Optical disks in CD and DVD format\n - Microfilm/fiche\n - Paper (e.g., computer-generated reports and other printouts)\n - Static memory devices, such as USB memory sticks"]
[null,"Port Scan","A systematic scan of a computer's ports that identifies open doors. Used in managing networks, port scanning also can be used maliciously to find a weakened access point from which to break into computer."]
[null,"Post-Deployment Test Document","A document that provides evidence that the change was tested and approved in the production environment. The document must contain:\n - Reference to a CIR\n - Identified deployment resources\n - Deployment start date\n - Deployment end date\n - Expected results\n - Actual results\n - Approval signature\n - Approval date"]
[null,"Potential Access","Under ordinary circumstances, individuals that are not permitted access to Scoped Data are, however, in certain circumstances able or are permitted access to Scoped Data. For example: a senior executive who reviews Scoped Data in the course of an investigation, or a courier and truck driver who picks up documents in a locked shred bin and transports them in the locked shred bin to a warehouse for shredding."]
[null,"Power Redundancy","Any type of power delivery mechanism that provides continuous power to connected systems in the event of a failure in the main delivery mechanism for electricity. Such mechanisms include multiple electric feeds, automatic failover generators, and uninterruptible power supplies."]
[null,"Pre-Deployment Test Document","A document (electronic or paper) that provides evidence that the requested changes were tested prior to deployment in the production environment. A pre-deployment test document is inspected for:\n - Reference to a CIR\n - Identified testing resources\n - Testing start date\n - Testing end date\n - Expected test results\n - Actual test results"]
[null,"Privacy Incident ","A privacy incident is the unauthorized collection, use, access, retention or disclosure of personal or otherwise sensitive information. "]
[null,"Privacy Inventory Flow ","The current scoped privacy data inventory/list and flow by data subject category that has been approved by management of the organization. A privacy inventory flow identifies the ownership of the scoped privacy data, its sources, collection methods, storage locations, uses (by who, where and for what purpose), sharing within the organization and among its third parties, trans-border flows and adequacy mechanisms chosen to ensure the protection of such scoped privacy data, security, retention and deletion schedules and mechanisms. "]
[null,"Privacy Notice ","Notice given to data subjects on the collection, use, storage, sharing, transfer, retention and destruction of their scoped privacy data in accordance with privacy applicable law and organization policy. "]
[null,"Privacy Policy ","An organization’s internal policy adopted for the life cycle of the scoped privacy data. "]
[null,"Privacy Risk Assessment","A privacy risk/impact assessment states what personally identifiable information (PII) is collected and explains how that information is maintained, how it will be protected and how it will be shared. \nA PIA should identify:\n - Whether the information being collected complies with privacy-related legal and regulatory compliance requirements.\n - The risks and effects of collecting, maintaining and disseminating PII.\n - Protections and processes for handling information to alleviate any potential privacy risks.\n - Options and methods for individuals to provide consent for the collection of their PII.\nGenerally Accepted Privacy Principles (GAPP) is a recognized framework for assessing privacy risk. GAPPoperationalizes complex privacy requirements into a single privacy objective that is supported by 10 privacy principles.\n","http://searchcompliance.techtarget.com/definition/Privacy-impact-assessment-PIA \nand http://www.aicpa.org/InterestAreas/InformationTechnology/Resources/Privacy/GenerallyAcceptedPrivacyPrinciples/DownloadableDocuments/10261378ExecOverviewGAPP.pdf"]
[null,"Privileged Access ","This access grants an employee access to more than usual company data or make changes to the company network. Companies need privileged users because they have access to source code, file systems and other assets that allow them to upgrade the systems or make other technical changes. ","2016 AUP Glossary"]
[null,"Protected Health Information (PHI)","The Privacy Rule protects individually identifiable health information, called PHI, held or transmitted by a covered entity or its business associate, in any form, whether electronic, paper, or verbal. PHI includes information that relates to all of the following:\n\u0081- The individual\u0081fs past, present, or future physical or mental health or condition\n- The provision of health care to the individual\n\u0081- The past, present, or future payment for the provision of health care to the individual PHI includes many common identifiers, such as name, address, birth date, and Social Security number.","HIPAA BASICS FOR PROVIDERS: PRIVACY,\nSECURITY, AND BREACH NOTIFICATION RULES"]
[null,"Protected Scoped data ","Scoped data or any other data that requires a higher level of protection or special treatment due to its sensitivity under: security applicable law; company security policy; and/or as identified in the scope definition of protected scoped data of the Shared Assessments Standardized Information Gathering (SIG) questionnaire and Shared Assessments Agreed Upon Procedures (AUP), a tool for standardized onsite assessments. This may include: scoped data, such as name, address or telephone number in conjunction with Social Security number, driver’s license number, account number, credit or debit card number, personal identification number, user ID or password; an individual’s health information; company trade secrets or certain confidential information. Data that falls under the definitions of both scoped data and protected scoped data (for example, credit card details). "]
[null,"Protected Scoped Privacy data ","Any scoped privacy data required to have a higher level of protection or special treatment under privacy applicable law due to its sensitivity, e.g., encryption. This includes EU “sensitive personal data” (health, religion, criminal records, trade union membership, sexual orientation and race). In the US, protected scoped privacy data includes name, address or telephone number in conjunction with Social Security number, driver’s license number, account number, credit or debit card number, personal identification number or user ID or password. "]
[null,"Protocol","A set of rules and formats that enable the proper exchange of information between different systems."]
[null,"Publicly Accessible","In networking terms, able to accept a connection originating from the public domain, e.g., the Internet."]
[null,"Quality Analysis and User Acceptance Testing (QA UAT)","QA testing usually precedes UAT. QA examines the functional behavior of individual components and integrated feature-level capacity. UAT typically refers to the final testing process prior to deployment. "]
[null,"Raised Floor","Used in data center construction, a raised floor above the \"true\" floor allows air conditioning flow and wiring to pass freely under equipment. The space between the true and raised floors is accessed by removable floor tiles."]
[null,"Receiver Company","The organization that has contracted with a service provider for a specific service."]
[null,"Recovery Time Objective (RTO) ","The targeted duration of time and a service level for which a business process must be restored after a disaster or disruption of service, in order to avoid unacceptable consequences, should a break occur in business continuity. "]
[null,"Red Flag","The Red Flags Rule requires many businesses and organizations to implement a written identity theft prevention program designed to detect the “red flags” of identity theft in their day-to-day operations, take steps to prevent the crime, and mitigate its damage. A program can help businesses spot suspicious patterns and prevent the costly consequences of identity theft. The Federal Trade Commission (FTC) enforces the Red Flags Rule with several other agencies.\n“Red Flags Rule\" is formally known as the \"Identity Theft Red Flags and Address Discrepancies Under the Fair and Accurate Credit Transactions Act of 2003; Final Rule”. \nThe rule applies only to federally regulated financial institutions, and through the FTC, to certain creditors. The term Covered Accounts is contained in the rule.","ftc.gov and Web Hull"]
[null,"Remediation","The process by which organizations address information systems control deficiencies and maturity gaps to ensure that deficiencies are appropriately corrected."]
[null,"Remote Access","Remote access refers to the ability to access a computer, such as a home computer or an office network computer, from a remote location. This allows employees to work offsite, such as at home or in another location, while still having access to a distant computer or network, such as the office network.","Technopedia"]
[null,"Removable Device ","Removable devices are any type of storage device that can be removed from a computer while the system is running. Examples of removable media include CDs, DVDs and Blu-Ray disks, as well as diskettes and USB drives. "]
[null,"Residual Risk Rating Scoring Method","A calculation of the risk that remains after security controls have been applied."]
[null,"Risk Assessment","The process of identifying variables that have the potential to negatively impact an organization’s ability to conduct business. A prioritization of potential business disruptions based on severity and likelihood of occurrence. The risk assessment includes an analysis of threats based on the impact to the institution, its customers, and financial markets, rather than the nature of the threat.","TechTarget and FFIEC IT Examination Handbook Glossary"]
[null,"Risk Governance","Governance refers to the actions, processes, traditions and institutions by which authority is exercised and decisions are taken and implemented. Risk governance applies the principles of good governance to the identification, assessment, management and communication of risks\nEffective risk governance should provide the operating model and decision-making framework needed to identify and respond to risks.","https://www.irgc.org/risk-governance/what-is-risk-governance/"]
[null,"Risk Prioritization Scoring Method","A systematic approach that quantifies risk in terms of loss potential, then sequences individual risks to determine the order in which compensating controls should be implemented."]
[null,"Risk Scenario","An IT risk scenario is a description of an IT related event that can lead to a business impact, when and if it should occur. A risk scenario is characterized by:\n- a threat actor\n- a threat type\n- event\n- asset or resource affected\n- time\nThe risk scenario structure differentiates between loss events (events generating the negative impact), vulnerabilities or vulnerability events (events contributing to the magnitude or frequency of loss events occurring), and threat events (circumstances or events that can trigger loss events).","Wikipedia"]
[null,"Role-Based User Access ","Role-based access control (RBAC) is a method of regulating access to computer or network resources based on the roles of individual users within an enterprise. Roles are defined according to job competency, authority and responsibility within the enterprise. "]
[null,"Root cause analysis","A root cause is a factor that caused a nonconformance and should be permanently eliminated through process improvement. Root Cause Analysis (RCA) describes a wide range of approaches, tools, and techniques used to uncover causes of problems. RCA is based on the basic idea that effective management requires more than merely “putting out fires” for problems that develop, but finding a way to prevent them.","ASQ.org"]
[null,"Safe Harbor","Intended for U.S. organizations that process personal data collected in the EU, the Safe Harbor Principles are designed to assist eligible organizations to comply with the EU Data Protection Directive and maintain the privacy and integrity of that data. NOTE: The EU Privacy Shield program is the successor of the EU US Safe Harbor program. Announced in Feb 2016 it became operational on the 1st August 2016 ","https://www.privacytrust.com/guidance/safe_harbor.html"]
[null,"Sanctions Check","In most countries, organizations are prohibited by law from doing business with drugs and arms merchants and terrorist organizations. Sanctions lists ranging from OFAC to the EU Consolidated Lists to the Interpol Most Wanted to the Hong Kong and Singapore Monetary Authority exist. Part of due diligence in vendor selection should include screening of the third party against sanctions lists.","should this be removed from the questionnaire? P.3.5"]
[null,"Scoped Data","A client’s non-public personal information (NPPI), protected health information (PHI), personal information (PI) or non-public information that is stored, transmitted or processed by the service provider. Scoped data may also include any data selected as being in scope by the organization or client at the scoping of the engagement. Any reference to scoped data includes protected scoped data, where applicable. "]
[null,"Scoped Privacy Data ","Any information relating to a data subject, who can be identified directly or indirectly, by that information, and in particular, by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural or social identity. Examples of scoped privacy data include name, address, telephone number and email address. Scoped privacy data may exist in any media or format. Any reference to scoped privacy data includes protected scoped privacy data, where applicable. "]
[null,"Scoped Systems and Data","Computer hardware, software and/or Non-Public Personal Information that is stored, transmitted, or processed by the service provider in scope for the engagement."]
[null,"Scoping Meeting","A meeting held prior to commencement of a Shared Assessments engagement, to determine the Scoped Systems and Data to be included in a company's Standardized Information Gathering Questionnaire (SIG) and Agreed Upon Procedures (AUP) assessment."]
[null,"Secure Code Review","The process of identifying whether software code meets the respondent's security requirements."]
[null,"Secure Perimeter","A space fully enclosed by walls that surround the immediate perimeter and that extend from floor to ceiling (beyond raised floors and ceilings), which is contained, and whose points of entry are secured."]
[null,"Secure Socket Layer (SSL)","A protocol developed by Netscape for transmitting private documents via the Internet. SSL uses a cryptographic system with two keys to encrypt data: a public key known to everyone and a private or secret key known only to the recipient of the message."]
[null,"Secure Workspace","An environment from where people work from their desks with the purpose of accessing, editing or inputting Scoped Systems and Data on a computer, telephone or physical media, e.g., a BPO or call center environment."]
[null,"Secure Workspace Perimeter","A space fully enclosed by walls that surround the Secure Workspace which is contained, and whose points of entry and exit are secured."]
[null,"Security Applicable Law ","Applicable laws, enactments, regulations, binding industry codes, regulatory permits and licenses which are in effect that address the protection, handling and security of scoped data and protected scoped data and that are determined to be in scope by the organization or client at the scoping of the engagement. "]
[null,"Security Architecture Risk Analysis","Defines concepts, methods, and techniques for analyzing the architecture and design of software systems for security flaws."]
[null,"Security Policy","A published document or set of documents defining requirements for one or more aspects of information security."]
[null,"Segmentation / Separation (of data)","see Data Segmentation / Separation"]
[null,"Sensitive customer financial information","A customer’s name, address, or telephone number, in conjunction with the customer’s social security number, driver’s license number, account number, credit or debit card number, or a personal identification number or password that would permit access to the customer’s account. Sensitive customer information also includes any combination of components of customer information that would allow someone to log onto or access the customer’s account, such as user name and password or password and account number.","Interagency Guidance on Response Programs for Unauthorized Access to Customer Information and Customer Notice"]
[null,"Sensitive Information ","Also known as “scoped data,” any customer data stored at the organization’s facility. This data may be stored in the form of physical media, digital media or any other storage medium. "]
[null,"Server","A computer that makes services, such as access to data files, programs, and peripheral devices, available to workstations on a network."]
[null,"Service Account ","A service account is a user account that has been created to run a particular piece of software or service. The account belongs to the software application instead of to an individual end user. "]
[null,"Service Level Agreement (SLA)","An agreement that details the responsibilities of an IT service provider, the rights of the service provider’s customers, and the penalties assessed when the service provider violates any element of the SLA. SLAs also identify and define the service, plus the supported products, evaluation criteria, and quality of service customers should expect. SLAs are typically measured in terms of metrics. Examples include processing completion times and systems availability times."," FFIEC IT Examination Handbook Glossary"]
[null,"Service Provider","An subcontractor that provides outsourced services, such as data processing, business operations, applications, systems or staffing."]
[null,"Service Set Identifier (SSID)","A 32-character unique identifier attached to the header of packets sent over a wide area network to identify each packet as part of that network."]
[null,"Simple Mail Transfer Protocol (SMTP)","The de facto standard for email transmissions across the Internet."]
[null,"Smoke Detector","A mechanical device that is sensitive to the presence of smoke or particulate material in the air that transmits a signal to a measuring or control instrument."]
[null,"Software","Vendor developed software code used for custom or commercial-off-the-shelf purposes."]
[null,"Software Architecture","The process of defining a structured software solution that meets all of the technical and operational requirements, while optimizing common quality attributes such as performance, security, and manageability."]
[null,"Software Security Group","A group whose charter is to assist in the design, review and implementation of software that protects the information and resources contained in and controlled by that software."]
[null,"Status Change","Change to employment status that is recorded by human resources, such as promotions, demotions or departmental changes."]
[null,"Stewardship","The act of managing and maintaining a given asset."]
[null,"Storage Facility ","The physical location where target systems and data are stored. "]
[null,"Strong Password","Password length must be a minimum of seven (7) characters, must not to contain a common usage word or a word found in the English dictionary, may not contain user name, any part of a full name or access level of the user and must contain characters from at least three (3) of the following four (4) classes of characters:\n • Upper case letters (A, B, C, ….Z)\n • Lower case letters (a, b, c, ….z)\n • Numbers (0,1, 2, …9)\n • Non-alphanumeric (\"special characters\") such as punctuation symbols"]
[null,"Subcontractor"," is a business or an individual that signs a contract to perform part or all of the obligations of another's contract."]
[null,"System Owner","The business unit that retains financial ownership or decision rights for the business use of the asset."]
[null,"System Steward","The primary assigned administrator responsible for maintenance and day-to-day tasks that support the business."]
[null,"Systems Development Life Cycle (SDLC)","A process for planning, creating, developing, testing and deploying a software application or information system. "]
[null,"Target System","Computer hardware and software in scope for the engagement that contains scoped data. "]
[null,"Third Party","All entities or persons that work on behalf of the organization but are not its employees, including consultants, contingent workers, clients, business partners, service providers, subcontractors, vendors, suppliers, affiliates and any other person or entity that accesses Scoped Systems and Data."]
[null,"Threat Impact Calculation Method","A systematic method of determining the loss potential of a particular threat, based on the value of assets affected."]
[null,"Threat Modeling","Threat modeling allows you to systematically identify and rate the threats that are most likely to affect your system. By identifying and rating threats based on a solid understanding of the architecture and implementation of your application, you can address threats with appropriate countermeasures in a logical order, starting with the threats that present the greatest risk.\n\nThreat modeling has a structured approach that is far more cost efficient and effective than applying security features in a haphazard manner without knowing precisely what threats each feature is supposed to address."]
[null,"Threat Probability Calculation Method","A systematic method of determining the potential for a particular threat to occur, based on the likelihood of the occurrence collected from internal staff, past records, and official security records.\n Threats x Vulnerability x Asset Value = Total Risk\n (Threats x Vulnerability x Asset Value) x Controls Gap = Residual Risk"]
[null,"Token","A unique identifier generated on both a host and small, user-held device that allows the user to authenticate to the host."]
[null,"Transmission Control Protocol (TCP) ","A protocol of TCP/IP networks. TCP, the basic communication language (or protocol) of the Internet, enables two hosts to establish a connection and exchange streams of data. "]
[null,"True Ceiling","The permanent overhead interior surface of a room, constructed of solid building materials offering resistance to and evidence of unauthorized entry."]
[null,"True Floor","The permanent bottom interior surface of a room, constructed of solid building materials offering resistance to and evidence of unauthorized entry."]
[null,"Two-factor Authentication","(aka multi-factor authentication ) The process of using two or more factors to achieve authentication. Factors include something you know (e.g., password or personal identification number); something you have (e.g., cryptographic identification device or token); and something you are (e.g., biometric).","FFIEC_CAT_App_C_Glossary_June_2015_PDF5"]
[null,"UI","In information technology, the user interface (UI) is everything designed into an information device with which a human being may interact -- including display screen, keyboard, mouse, light pen, the appearance of a desktop, illuminated characters, help messages, and how an application program or a Web site invites interaction and responds to it.","TechTarget "]
[null,"Unapproved","Operating without consent."]
[null,"Unidentified","Being or having an unknown or unnamed source."]
[null,"Uninterruptible Power Supply (UPS)","A power supply consisting of a bank of batteries, which is continually charged. When power fails, the UPS becomes the source of electrical current for computer equipment until the batteries are discharged. A UPS is often connected to a generator that can provide electrical power indefinitely."]
[null,"User Datagram Protocol (UDP) ","A communications protocol within the Internet protocol suite. UDP, which uses a simple, connectionless transmission model with a minimum of protocol mechanism, performs similar functions as TCP (except datagrams are created instead of packets), but UDP lacks the flow-control and error-recovery functions, allowing for fewer system resources. "]
[null,"Vendor Management","Vendor management is a discipline that enables organizations to control costs, drive service excellence and mitigate risks to gain increased value from their vendors throughout the deal life cycle.\nVendor risk management (VRM) is a comprehensive plan for identifying and decreasing potential business uncertainties and legal liabilities regarding the hiring of 3rd party vendors for information technology (IT) products and services. ","Gartner IT Glossary and TechTarget"]
[null,"Vibration Alarm Sensor","An alarm that responds to vibrations in the surface onto which it is mounted. A normally closed switch momentarily opens when the sensor is subjected to a vibration of sufficiently large amplitude."]
[null,"Virtual Machine (VM)","A virtual machine is a software computer that, like a physical computer, runs an operating system and applications. The virtual machine is comprised of a set of specification and configuration files and is backed by the physical resources of a host.","vmware.com"]
[null,"Virtual Private Network (VPN)","A communication tunnel running through a shared network, such as the Internet, which uses encryption and other security mechanisms to ensure the data cannot be intercepted and that the data senders and receivers are authenticated."]
[null,"Volumetric Alarm Sensor","An alarm sensor designed and employed to detect an unauthorized person in a confined space when the space is normally unoccupied. Such alarms include ultrasonic, microwave, and infrared sensors."]
[null,"Vulnerability","A hardware, firmware, or software flaw that leaves an information system open to potential exploitation; a weakness in automated system security procedures, administrative controls, physical layout, internal controls, etc., that could be exploited to gain unauthorized access to information or to disrupt critical processing."," FFIEC IT Examination Handbook Glossary"]
[null,"Vulnerability Management","Vulnerability management is the process in which vulnerabilities in IT are identified and the risks of these vulnerabilities are evaluated. This evaluation leads to correcting the vulnerabilities and removing the risk or a formal risk acceptance by the management of an organization (e.g. in case the impact of an attack would be low or the cost of correction does not outweigh possible damages to the organization).","Implementing a vulnerability management process - SANS Institute Reading Room"]
[null,"War Walk","Also known as \"war drive,\" using a laptop to \"sniff\" for wireless access points. War walking may be used to locate a public access point for personal use or as a controls assessment to identify access points that are inadequately secured and may indicate an elevated risk of breach."]
[null,"Warm Site","A remote facility which replicates production data in set intervals."]
[null,"Water Sensor","A mechanical device sensitive to the presence of water or moisture that transmits a signal to a measuring or control instrument."]
[null,"Whistleblowing Policy ","A policy protecting anyone who has and reports insider knowledge of illegal activities occurring in an organization. Whistleblowers can be employees, suppliers, contractors, clients or any individual who somehow becomes aware of illegal activities taking place in a business, either through witnessing the behavior or being told about it. "]
[null,"Wireless Networks ","A wireless network, a.k.a. wireless local-area network (LAN), uses radio waves to connect devices such as laptops to the Internet and to your business network and its applications instead of physical cables like a wired network does. An example of wireless network is when you connect a laptop to a WiFi hotspot at a cafe, hotel, airport lounge or other public place you're connecting to that business's wireless network. "]
[null,"Workstation","(1) Single-user computers typically linked together to form a local area network, that can also be used as standalone systems. (2) In networking, any computer connected to a local area network, including a workstation or personal computer."]
[null,"XSS","Cross-site scripting (XSS) is a type of computer security vulnerability typically found in web applications. XSS enables attackers to inject client-side scripts into web pages viewed by other users. A cross-site scripting vulnerability may be used by attackers to bypass access controls such as the same-origin policy.","Wikipedia"]

{"sheet":"Formula Notes","index":10,"n_rows":44,"n_cols":4,"rows_kept":44,"cut":false,"hidden":false,"merged":[]}
["Formula Notes"]
["Column","Description"]
["A\n<Serial No>","This is a unique record for a question. This value is sequential starting with one on Tab A to the end of questions on last tab. Any row that is not a question will not have a number. The highest value used as a unique identifier is located on this tab in cell C22 (below)."]
["A4","Calculates the highest serial number on the tab. This tab cell C22 identifies the highest serial number used so new question serial numbers can be used. Retired serial numbers are never re-used."]
["D\nConditional Formatting\n<Response>","The conditional formatting looks in column J and U to determine the background of the cell. If the value in column J =1, conditional formatting sets the background to a hash (no response required) to indicated the top of a table question. If the value in column U = 1 the background will be green indicating a \"Yes\" response. If the value in column U = 2 than the background will turn orange indicating a \"No\" response. If the value in column U = 3 the background turns violet to indicate an N/A response. The default background is light blue.",null,"If this SIG will be a Master SIG to be used with the SMT, select Master below. If this SIG will be distributed leave blank."]
["E\nConditional Formatting\n<Additional Information>","The conditional formatting looks in column J. If the value in column J =1, conditional formatting sets the background to a hash (no response required) to indicated the top of a table question."]
["I\n<Q Depth>","Values in this column indicate the depth (number of decimal places) the question has."]
["J\n<Table ID>","A value of \"1\" in this cell indicate the top of a table."]
["K\n<1>","This formula is used to calculate the first digit of the question number. It looks to see if there is a value in the cell above, if not it assumes the value should be a 1. Next it looks to see if the depth is 1, If so, it will increment by one, if not it pulls down the value from the cell above."]
["L - O\n<2 - 5>","This formula is used to calculate the second through fifth digits of the question number. It first looks at the cell above and if blank it assumes a 0. If not blank, it looks at it's next highest neighbor above to see if there is a transition, it there is a transition then it resets to 0, Lastly it looks at the question depth to see if it is the same depth as above. If so it increments, if not it will pull down the value from above."]
["P\n<HL Ans>","This formula is used to carry over and convert the answer from the Lite tab to a number on the detail tabs. The VLOOKUP will search the L2_Array named field to find the question serial number and bring back the answer number in that array. For proper SMT operation, if Master (this tab, D6) is selected then high level responses are ignored."]
["Q\n<Loc Ans>","This formula converts the local answer to a number. It first checks to see if the depth is not blank. If it is then assumes the answer should be blank. If the depth field is not blank the formula converts the local answer to a number. 0 = No answer, 1 = \"Yes\", 2 = \"No\" and 3 = \"N/A\"."]
["R\n<Comb Ans>","This formula is used to combine the high level answer and the local answer. If the question depth is blank a blank is assumed. Responses are evaluated in the following order 1st - Lite, 2nd - local response."]
["S\n<Table Calc (Tot Q#)>","The value in this cell determines if the question is actually a question or if it is part of a response list for a question. The logic looks above, below and in column H to make the determination."]
["T\n<Q Carry Dn>","This formula carries parent responses down to it's children. It first looks for a blank in the question depth and if blank will carry down the value from above. If the question has been answered it will bring over the question depth. If the questions not answered it will compare the local question depth to the previous value if the depth is greater the previous value will be carried down, if not it will turn to 0."]
["U\n<Resp Calc>","This formula works with the Q Carry Dn formula to carry the value of the response down. If response is No or N/A those responses values are carried down to the next parent question. For proper SMT operation, if Master is selected (this tab, D6) response carry down is disabled."]
["V\n<T Carry Dn>","The value in this cell identifies if a question in a table has been answered. If any value in a response list is answered the result will be rolled up the next cell until it reaches the list identifier."]
["W\n<Final Ans>","The result in this cell determines if a question has been answered and is used to count the actual questions answered not answers as part of a response list. This is a simple AND function to combine the values in columns T, S and V."]
["X\n<HL Chk>","Identifies if the question is duplicated on the Lite tab"]
[]
["Column (Cell)","Formula","Highest Ser #"]
["A","Hard coded, unique serial number (Rows without questions have no serial numbers)",{"$f":" MAX('Business Information'!A3,Documentation!A2,Lite!A4,#REF!,#REF!,#REF!,#REF!,#REF!,#REF!,#REF!,#REF!,#REF!,#REF!,#REF!,#REF!,#REF!,#REF!,#REF!,#REF!,#REF!)","v":{"$error":"#REF!"}}]
["A4 (some tabs location is different)","MAX(An:An)"]
["D Conditional Formatting"]
["E Conditional Formatting"]
["I","Manually entered question depth value (0 - 5)"]
["J","Manually entered table top identifier (if 1 than table top)"]
["K","IF(Kn-1=\"\",1,IF(In=1,Kn-1+1,Kn-1))"]
["L (M - O) are similar ","IF(Ln-1=\"\",0,IF(Kn-1<>Kn,0,IF($In=2,Ln-1+1,Ln-1)))"]
["P","IF(OR(Master=\"Master\",In=0,Jn=1),0,IF(ISNA(VLOOKUP(An,L2_Array,21,FALSE)),0,VLOOKUP(An,L2_Array,21,FALSE)))"]
["Q","IF(In=\"\",\"\",IF(Dn=\"Yes\",1,IF(Dn=\"No\",2,IF(Dn=\"N/A\",3,0))))"]
["R","IF(In=\"\",\"\",IF(Pn>0,Pn,IF(Qn>0,Qn,0)))"]
["S","IF(OR(In=\"\",In=0),\"\",IF(OR(In=1,Sn-1=\"\"),1,IF(OR(AND(Jn-1=1,(In-In-2<>0)),AND(Sn-1=0,In-1=I5),AND(Jn-1=1,In=In-2)),0,1)))"]
["T","IF(In=\"\",Tn-1,IF(AND(Rn>1,OR(Tn-1=\"\",Tn-1=0,Tn-1>=In)),In,IF(In>Tn-1,Tn-1,0)))"]
["U","IF(Master=\"Master\",Qn,IF(Un-1=\"\",Rn,IF(OR(AND(Tn>0,Rn<Un-1),AND(Tn=1,Rn<=Un-1)),Un-1,Rn)))"]
["V","IF(In=\"\",\"\",IF(OR(AND(Sn-1=1,Tn=1),Rn>0,AND(Sn+1=0,Vn+1=1)),1,0))"]
["W","IF(In=\"\",\"\",IF(OR(AND(Tn>0,Sn=1),AND(Sn=1,Vn=1)),1,0))"]
["X","IF(ISNA(VLOOKUP(An,L2_Array,1,FALSE)),\"\",1)"]
[]
["Named Range","Formula"]
["Master","Formula Notes'!$D$5"]
["L2_Array","Lv2_Questions!$A$4:$U$568"]
["SIG_Data","Full!$E$3:$H$951"]
["Sheet Protection","8bdoz4XW"]

{"sheet":"Full Lite","index":11,"n_rows":192,"n_cols":20,"rows_kept":192,"cut":false,"hidden":false,"merged":[[0,10,0,11]]}
["Ser No.","Depth","Table","SL ID","Ques Num","SIG Question Text","Response","Maturity","Additional Information","AUP 2017 Relevance","ISO 27002:2013 Relevance",null,"Appendix J Section and Line Reference","FFIEC CAT Tool_June 2015",null,"PCI 3.2_April 2016","FFIEC IT Mgmt Handbook_Nov2015","COBIT 4.1 Relevance","NIST Cybersecurity Framework_February2014","HIPAA Simplification_March2013"]
[{"$f":"Lite!B1","v":"SIG Lite"},null,null,null,{"$f":"Lite!B1","v":"SIG Lite"}]
[{"$f":"Lite!A5","v":0},{"$f":"Lite!M5","v":1},{"$f":"Lite!K5","v":1},{"$f":"Lite!Y5","v":1},{"$f":"Lite!B5","v":0},{"$f":"Lite!C5","v":"A. Risk Assessment and Treatment"},{"$f":"Lite!D5","v":0},{"$f":"Lite!E5","v":0},{"$f":"Lite!F5","v":0},{"$f":"Lite!G5","v":0},{"$f":"Lite!H5","v":0},{"$f":"Lite!I5","v":0}]
[{"$f":"Lite!A6","v":3198},{"$f":"Lite!M6","v":1},{"$f":"Lite!K6","v":"A"},{"$f":"Lite!Y6","v":1},{"$f":"Lite!B6","v":"SL.1"},{"$f":"Lite!C6","v":"Is there a risk assessment program that has been approved by management, communicated to constituents and an owner to maintain and review the program? if yes, does it include:"},{"$f":"Lite!D6","v":"Yes"},{"$f":"Lite!E6","v":5},{"$f":"Lite!F6","v":"Formal risk assessments are aligned with the enterprise-wide framework and performed at least annually, or at planned intervals, determining the likelihood and impact of all identified risks, using qualitative and quantitative methods.\nThe likelihood and impact associated with inherent and residual risk is determined independently, considering all risk categories (e.g., audit results, threat and vulnerability analysis, and regulatory compliance).\nRisks are mitigated to acceptable levels based on company-established criteria in accordance with reasonable resolution time frames."},{"$f":"Lite!G6","v":"A.1 IT & Infrastructure Risk Governance and Context"},{"$f":"Lite!H6","v":"5.1 6.1.2"},{"$f":"Lite!I6","v":"Leadership & Commitment, Information Security Risk Assessment"},null,"Governance: Oversight\nRisk Management: Risk Assessment","D1.G.Ov.B.2\n\nD1.RM.RA.B.1\nD1.RM.RA.B.2",12.2,"1.A.1\n3.B","PO9.4","ID.GV-4\nID.RA-5\nID.RM-1","164.308 (a)(1)(ii)(A)"]
[{"$f":"Lite!A7","v":3286},{"$f":"Lite!M7","v":1},{"$f":"Lite!K7","v":"A"},{"$f":"Lite!Y7","v":1},{"$f":"Lite!B7","v":"SL.2"},{"$f":"Lite!C7","v":"Is there a program to manage the treatment of risks identified during assessments?"},{"$f":"Lite!D7","v":"Yes"},{"$f":"Lite!E7","v":5},{"$f":"Lite!F7","v":"Information security risks are managed in accordance with an agreed operational risk framework. All security risks are:\nClearly documented and protected from unauthorized disclosure;\nHave clearly defined accountability;\nMaintaining traceability of the risk throughout the risk lifecycle;\nHave a consistent risk rating system across; and\nOnly be risk-accepted by appropriately authorized persons."},{"$f":"Lite!G7","v":"A.2 IT & Infrastructure Risk Assessment Life Cycle"},{"$f":"Lite!H7","v":"6.1.3"},{"$f":"Lite!I7","v":"Information Security Risk treatment"},null,null,null,"N/A","1.A.2\n2.A","PO9.4",null,"164.308 (a)(1)(ii)(B)"]
[{"$f":"Lite!A8","v":4158},{"$f":"Lite!M8","v":1},{"$f":"Lite!K8","v":"A"},{"$f":"Lite!Y8","v":1},{"$f":"Lite!B8","v":"SL.3"},{"$f":"Lite!C8","v":"A formal process for assigning appropriate management ownership for each risk?"},{"$f":"Lite!D8","v":"Yes"},{"$f":"Lite!E8","v":5},{"$f":"Lite!F8","v":0},{"$f":"Lite!G8","v":"A.2 IT & Infrastructure Risk Assessment Life Cycle"},{"$f":"Lite!H8","v":0},{"$f":"Lite!I8","v":0},null,null,null,null,"1.B.7(b)\n2.A"]
[{"$f":"Lite!A9","v":4159},{"$f":"Lite!M9","v":1},{"$f":"Lite!K9","v":"A"},{"$f":"Lite!Y9","v":1},{"$f":"Lite!B9","v":"SL.4"},{"$f":"Lite!C9","v":"A formal process for appropriate management knowingly and objectively accepting risks and approving action plans?"},{"$f":"Lite!D9","v":"Yes"},{"$f":"Lite!E9","v":5},{"$f":"Lite!F9","v":0},{"$f":"Lite!G9","v":"A.2 IT & Infrastructure Risk Assessment Life Cycle"},{"$f":"Lite!H9","v":0},{"$f":"Lite!I9","v":0},null,null,null,null,"2.A",null,"ID.RM-2"]
[{"$f":"Lite!A10","v":4160},{"$f":"Lite!M10","v":1},{"$f":"Lite!K10","v":"A"},{"$f":"Lite!Y10","v":1},{"$f":"Lite!B10","v":"SL.5"},{"$f":"Lite!C10","v":"A formal process for tracking the status of action plans and reporting them to management?"},{"$f":"Lite!D10","v":"Yes"},{"$f":"Lite!E10","v":5},{"$f":"Lite!F10","v":0},{"$f":"Lite!G10","v":"A.2 IT & Infrastructure Risk Assessment Life Cycle"},{"$f":"Lite!H10","v":0},{"$f":"Lite!I10","v":0},null,null,null,null,"2.A\n3.D.7"]
[{"$f":"Lite!A11","v":4161},{"$f":"Lite!M11","v":1},{"$f":"Lite!K11","v":"A"},{"$f":"Lite!Y11","v":1},{"$f":"Lite!B11","v":"SL.6"},{"$f":"Lite!C11","v":"Controls identified for each material risk?"},{"$f":"Lite!D11","v":"Yes"},{"$f":"Lite!E11","v":5},{"$f":"Lite!F11","v":0},{"$f":"Lite!G11","v":"A.2 IT & Infrastructure Risk Assessment Life Cycle"},{"$f":"Lite!H11","v":0},{"$f":"Lite!I11","v":0},null,null,null,null,"2.A"]
[{"$f":"Lite!A12","v":4162},{"$f":"Lite!M12","v":1},{"$f":"Lite!K12","v":"A"},{"$f":"Lite!Y12","v":1},{"$f":"Lite!B12","v":"SL.7"},{"$f":"Lite!C12","v":"Measures for defining, monitoring, and reporting risk metrics?"},{"$f":"Lite!D12","v":"Yes"},{"$f":"Lite!E12","v":5},{"$f":"Lite!F12","v":"We follow NIST Cybersecurity framework, which uses risk management processes to enable WalkMe to inform and prioritize decisions regarding cybersecurity. It supports recurring risk assessments and validation of business drivers to help WalkMe select target states for cybersecurity activities that reflect desired outcomes. Thus, the Framework gives WalkMe the ability to dynamically select and direct improvement in cybersecurity risk management for the IT and ICS environments. The Framework is adaptive to provide a flexible and risk-based implementation that can be used with a broad array of cybersecurity risk management processes. Examples of cybersecurity risk management processes include International Organization for Standardization (ISO) 31000:20094, ISO/IEC 27005:20115, National Institute of Standards and Technology (NIST) Special Publication (SP) 800-396, and the Electricity Subsector Cybersecurity Risk Management Process (RMP) guideline."},{"$f":"Lite!G12","v":"A.2 IT & Infrastructure Risk Assessment Life Cycle"},{"$f":"Lite!H12","v":0},{"$f":"Lite!I12","v":0},null,null,null,null,"1.A.3"]
[{"$f":"Lite!A13","v":853},{"$f":"Lite!M13","v":1},{"$f":"Lite!K13","v":"A"},{"$f":"Lite!Y13","v":1},{"$f":"Lite!B13","v":"SL.8"},{"$f":"Lite!C13","v":"Do Subcontractors have access to Scoped Systems and Data? (backup vendors, service providers, equipment support maintenance, software maintenance vendors, data recovery vendors, etc.)? If yes, is there:"},{"$f":"Lite!D13","v":"Yes"},{"$f":"Lite!E13","v":0},{"$f":"Lite!F13","v":"WalkMe uses a number of third-party subcontractors to assist with the provision of our service. However, only four (4) subcontractors have access to customers’ end-users' PII (e.g., IP addresses, etc.):\n1) Amazon AWS, our cloud hosting provider.\n2) Akamai, our CDN.\n3) Good Data Analytics engines, our processing service.\n4) Logz.io for logging services."},{"$f":"Lite!G13","v":0},{"$f":"Lite!H13","v":15},{"$f":"Lite!I13","v":"Supplier relationships"},null,null,null,12.8,null,"DS1.1, DS1.2, DS1.3, DS2.4",null,"164.308 (b)"]
[{"$f":"Lite!A14","v":3897},{"$f":"Lite!M14","v":1},{"$f":"Lite!K14","v":"A"},{"$f":"Lite!Y14","v":1},{"$f":"Lite!B14","v":"SL.9"},{"$f":"Lite!C14","v":"A documented vendor management process in place for the selection, oversight and risk assessment of third party vendors? If yes, does it include:"},{"$f":"Lite!D14","v":"Yes"},{"$f":"Lite!E14","v":5},{"$f":"Lite!F14","v":0},{"$f":"Lite!G14","v":"A.7 Subcontractor Selection and Management Process"},{"$f":"Lite!H14","v":"15.1.1"},{"$f":"Lite!I14","v":"Information security policy for supplier relationships"},null,"Relationship Management: Due Diligence","D4.RM.DD.B.2","12.8\n12.8.3\n12.8.4","3.C.3\n3.C.5\n3.C.8\n12.8","DS1.5, DS2.4, ME2.6",null,"164.308 (b)"]
[{"$f":"Lite!A15","v":3898},{"$f":"Lite!M15","v":1},{"$f":"Lite!K15","v":"A"},{"$f":"Lite!Y15","v":1},{"$f":"Lite!B15","v":"SL.10"},{"$f":"Lite!C15","v":"Approval by management?"},{"$f":"Lite!D15","v":"Yes"},{"$f":"Lite!E15","v":5},{"$f":"Lite!F15","v":0},{"$f":"Lite!G15","v":"A.7 Subcontractor Selection and Management Process"},{"$f":"Lite!H15","v":"5.1.1"},{"$f":"Lite!I15","v":"Policies on information security"},null,null,null,null,null,"PO4.14, DS2.1, DS2.3, DS5.4, DS5.9, DS5.11, DS12.3",null,"164.308 (b)"]
[{"$f":"Lite!A16","v":3899},{"$f":"Lite!M16","v":1},{"$f":"Lite!K16","v":"A"},{"$f":"Lite!Y16","v":1},{"$f":"Lite!B16","v":"SL.11"},{"$f":"Lite!C16","v":"Annual review?"},{"$f":"Lite!D16","v":"Yes"},{"$f":"Lite!E16","v":5},{"$f":"Lite!F16","v":0},{"$f":"Lite!G16","v":"A.7 Subcontractor Selection and Management Process"},{"$f":"Lite!H16","v":"5.1.2"},{"$f":"Lite!I16","v":"Review of the policies for information security"},null,"Relationship Management: Ongoing Monitoring","D4.RM.OM.B.1","12.8.4",null,"PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6",null,"164.308 (b)"]
[{"$f":"Lite!A17","v":4168},{"$f":"Lite!M17","v":1},{"$f":"Lite!K17","v":"A"},{"$f":"Lite!Y17","v":1},{"$f":"Lite!B17","v":"SL.12"},{"$f":"Lite!C17","v":"Required reassessment when service delivery or contract changes?"},{"$f":"Lite!D17","v":"Yes"},{"$f":"Lite!E17","v":5},{"$f":"Lite!F17","v":0},{"$f":"Lite!G17","v":0},{"$f":"Lite!H17","v":0},{"$f":"Lite!I17","v":0}]
[{"$f":"Lite!A18","v":3900},{"$f":"Lite!M18","v":1},{"$f":"Lite!K18","v":"A"},{"$f":"Lite!Y18","v":1},{"$f":"Lite!B18","v":"SL.13"},{"$f":"Lite!C18","v":"Review of the subcontractor's vendor management policy and procedures?"},{"$f":"Lite!D18","v":"Yes"},{"$f":"Lite!E18","v":5},{"$f":"Lite!F18","v":0},{"$f":"Lite!G18","v":"A.9 Documenting Information Security Assessments for Subcontractors"},{"$f":"Lite!H18","v":"15.2.1.g"},{"$f":"Lite!I18","v":"Monitoring and review of supplier services"},null,null,null,"N/A",null,"DS1.5, DS2.2, DS2.3",null,"164.308 (b)"]
[{"$f":"Lite!A19","v":3901},{"$f":"Lite!M19","v":1},{"$f":"Lite!K19","v":"A"},{"$f":"Lite!Y19","v":1},{"$f":"Lite!B19","v":"SL.14"},{"$f":"Lite!C19","v":"Is there a process to identify and log subcontractor information security, privacy and/or data breach issues?"},{"$f":"Lite!D19","v":"Yes"},{"$f":"Lite!E19","v":5},{"$f":"Lite!F19","v":0},{"$f":"Lite!G19","v":"A.9 Documenting Information Security Assessments for Subcontractors"},{"$f":"Lite!H19","v":"15.2.1.e"},{"$f":"Lite!I19","v":"Monitoring and review of supplier services"},null,null,null,"N/A",null,"DS3.1, DS3.2, DS3.3",null,"164.308 (b)"]
[{"$f":"Lite!A20","v":3886},{"$f":"Lite!M20","v":1},{"$f":"Lite!K20","v":"A"},{"$f":"Lite!Y20","v":1},{"$f":"Lite!B20","v":"SL.15"},{"$f":"Lite!C20","v":"Is there a vendor management program?"},{"$f":"Lite!D20","v":"Yes"},{"$f":"Lite!E20","v":5},{"$f":"Lite!F20","v":"We use Panorays, an external SaaS service, to automate third-party security management, and engage on the security posture of their third parties, vendors, suppliers and business partners in order to gain continuous visibility while ensuring compliance to regulations.\nPanorays inherently combines a continuous hacker’s view of the evaluated company together with internal policy enforcement. We examine multiple 3rd party vendors that offer the requested service from product and security perspectives. We classify the classification level that the 3rd party vendor will be exposed to, and adjust our security questionnaires and requirements. We ask for SOC 2 TYPE II, if the customer has it, we review it and send our questions for the ones that were not covered by the SOC 2 TYPE II. In case the vendor doesn't have, we send him our extended Security questionnaire. In addition, we look online, to obtain more information. Finally we review and assess the risks according to risk categories associated With Third-Party Relationships (Credit, Operational, Compliance, Strategic, Reputation, Privacy, Business continuity, etc.). We will only agree to work with a vendor that we are satisfied with their overall security. In case the 3rd party vendor meets our security requirements by our Security Policies, we proceed with the vendor engagement and validate annually that the vendor preserves their security methodologic according to the risk assessment and data classification that was required by the vendor."},{"$f":"Lite!G20","v":"A.5 Vendor Risk Management Program"},{"$f":"Lite!H20","v":0},{"$f":"Lite!I20","v":0},null,"Relationship Management: Due Diligence","D4.RM.DD.B.2","12.8.4","3.A.1\n3.C.3\n3.C.5",null,null,"164.308 (b)(1)\n164.314 (a)(1)"]
[{"$f":"Lite!A21","v":71},{"$f":"Lite!M21","v":1},{"$f":"Lite!K21","v":"A"},{"$f":"Lite!Y21","v":1},{"$f":"Lite!B21","v":"SL.16"},{"$f":"Lite!C21","v":"Do external parties have access to Scoped Systems and Data or processing facilities?"},{"$f":"Lite!D21","v":"No"},{"$f":"Lite!E21","v":0},{"$f":"Lite!F21","v":"WalkMe uses a number of third-party subcontractors to assist with the provision of our service. In addition, WalkMe only uses subcontractors that we trust and we use appropriate contractual safeguards which we monitor to ensure the required standards are maintained."},{"$f":"Lite!G21","v":0},{"$f":"Lite!H21","v":15},{"$f":"Lite!I21","v":"Supplier relationships"},null,"Governance: Strategies & Policies","D1.G.SP.B.5",12.8,null,"PO6.4, DS5.5, ME2.2, ME2.5, ME4.7",null,"164.308 (b)"]
[{"$f":"Lite!A22","v":3633},{"$f":"Lite!M22","v":1},{"$f":"Lite!K22","v":"A"},{"$f":"Lite!Y22","v":1},{"$f":"Lite!B22","v":"SL.17"},{"$f":"Lite!C22","v":"Is the maturity of IT management processes formally evaluated at least annually using an established benchmark (e.g., COBIT maturity models)?"},{"$f":"Lite!D22","v":"No"},{"$f":"Lite!E22","v":0},{"$f":"Lite!F22","v":0},{"$f":"Lite!G22","v":0},{"$f":"Lite!H22","v":"17.1.3"},{"$f":"Lite!I22","v":"Verify, review and evaluate information security continuity"},null,null,null,"N/A"]
[{"$f":"Lite!A23","v":3225},{"$f":"Lite!M23","v":1},{"$f":"Lite!K23","v":"A"},{"$f":"Lite!Y23","v":1},{"$f":"Lite!B23","v":"SL.18"},{"$f":"Lite!C23","v":"Are there regular privacy risk assessments conducted? If yes, provide frequency and scope. If no, explain reason."},{"$f":"Lite!D23","v":"Yes"},{"$f":"Lite!E23","v":4},{"$f":"Lite!F23","v":"We use NIST Cybersecurity Framework and Guidelines on Security and Privacy in Public Cloud Computing (SP 800-144) for best practice standards, and our coding standards are set according to CWE/SANS Top 25 Most Dangerous Software Errors, and OWASP best practices (especially in light of the OWASP top 10 web vulnerabilities). We maintain privacy controls according to most of the foundational principles of the Privacy by design approach. We validate all input types coming from the user side, utilize anti cross-site attacks measures in place, manage sessions according to best practices etc."},{"$f":"Lite!G23","v":"P.3 Privacy Organization and Program Maintenance"},{"$f":"Lite!H23","v":"15.1.3.i "},{"$f":"Lite!I23","v":"Information and communication technology supply chain"},null,null,null,"N/A",null,null,null,"164.308 (a)(1)(ii)(A)"]
[{"$f":"Lite!A24","v":3226},{"$f":"Lite!M24","v":1},{"$f":"Lite!K24","v":"A"},{"$f":"Lite!Y24","v":1},{"$f":"Lite!B24","v":"SL.19"},{"$f":"Lite!C24","v":"Are identified privacy risks and associated mitigation plans formally documented and reviewed by management?"},{"$f":"Lite!D24","v":"Yes"},{"$f":"Lite!E24","v":5},{"$f":"Lite!F24","v":"WalkMe maintains an extensive documented organizational information security policy that has been aligned to industry best practices, regulatory, Federal/State, international laws, annually updated, approved by management and communicated to appropriate constituents, as well as many additional procedures to protect confidential information and govern the processing of Data for any Data Objects in scope. Security and privacy policies are communicated in a way that requires employees to annually certify their understanding and compliance before access is granted. ISO27001 is the framework for our policies and procedures. Data Security Architecture is designed using CSA Trusted Cloud Architectural Standard, a known best practice industry standard."},{"$f":"Lite!G24","v":"P.3 Privacy Organization and Program Maintenance"},{"$f":"Lite!H24","v":"15.1.1.l"},{"$f":"Lite!I24","v":"Information security policy for supplier relationships"},null,"Risk Management: Audit\nCorrective Controls: Remediation","D1.RM.Au.B.4\nD3.CC.R.B.1","N/A",null,null,null,"164.308 (a)(1)(ii)(B)"]
[{"$f":"Lite!A25","v":3227},{"$f":"Lite!M25","v":1},{"$f":"Lite!K25","v":"A"},{"$f":"Lite!Y25","v":1},{"$f":"Lite!B25","v":"SL.20"},{"$f":"Lite!C25","v":"Are reasonable resources (in time and money) allocated to mitigating identified privacy risks?"},{"$f":"Lite!D25","v":"Yes"},{"$f":"Lite!E25","v":5},{"$f":"Lite!F25","v":0},{"$f":"Lite!G25","v":"P.3 Privacy Organization and Program Maintenance"},{"$f":"Lite!H25","v":0},{"$f":"Lite!I25","v":0},null,"Corrective Controls: Remediation","D3.CC.R.B.1","N/A",null,null,null,"164.308 (a)(1)(ii)(B)"]
[{"$f":"Lite!A26","v":3862},{"$f":"Lite!M26","v":1},{"$f":"Lite!K26","v":"A"},{"$f":"Lite!Y26","v":1},{"$f":"Lite!B26","v":"SL.21"},{"$f":"Lite!C26","v":"Is there a compliance risk management system that addresses the quality and accuracy of reported consumer data?"},{"$f":"Lite!D26","v":"Yes"},{"$f":"Lite!E26","v":5},{"$f":"Lite!F26","v":0},{"$f":"Lite!G26","v":"P.3 Privacy Organization and Program Maintenance"},{"$f":"Lite!H26","v":0},{"$f":"Lite!I26","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A27","v":3863},{"$f":"Lite!M27","v":1},{"$f":"Lite!K27","v":"A"},{"$f":"Lite!Y27","v":1},{"$f":"Lite!B27","v":"SL.22"},{"$f":"Lite!C27","v":"Is there a compliance risk management system that addresses the quality of assembling and maintaining the data?"},{"$f":"Lite!D27","v":"Yes"},{"$f":"Lite!E27","v":5},{"$f":"Lite!F27","v":0},{"$f":"Lite!G27","v":"P.3 Privacy Organization and Program Maintenance"},{"$f":"Lite!H27","v":0},{"$f":"Lite!I27","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A28","v":0},{"$f":"Lite!M28","v":2},{"$f":"Lite!K28","v":1},{"$f":"Lite!Y28","v":1},{"$f":"Lite!B28","v":""},{"$f":"Lite!C28","v":"B. Security Policy"},{"$f":"Lite!D28","v":0},{"$f":"Lite!E28","v":0},{"$f":"Lite!F28","v":0},{"$f":"Lite!G28","v":0},{"$f":"Lite!H28","v":0},{"$f":"Lite!I28","v":0}]
[{"$f":"Lite!A29","v":3199},{"$f":"Lite!M29","v":2},{"$f":"Lite!K29","v":"B"},{"$f":"Lite!Y29","v":1},{"$f":"Lite!B29","v":"SL.23"},{"$f":"Lite!C29","v":"Is there an information security policy that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"Lite!D29","v":"Yes"},{"$f":"Lite!E29","v":5},{"$f":"Lite!F29","v":"WalkMe maintains an extensive documented organizational information security policy that has been aligned to industry best practices, regulatory, Federal/State, international laws, annually updated, approved by management and communicated to appropriate constituents, as well as many additional procedures to protect confidential information and govern the processing of Data for any Data Objects in scope. Security and privacy policies are communicated in a way that requires employees to annually certify their understanding and compliance before access is granted. ISO27001 is the framework for our policies and procedures. Data Security Architecture is designed using CSA Trusted Cloud Architectural Standard, a known best practice industry standard."},{"$f":"Lite!G29","v":"B.1 Information Security Policy Maintenance"},{"$f":"Lite!H29","v":"5.1.1"},{"$f":"Lite!I29","v":"Policies for information security"},null,"Governance: Strategies & Policies","D1.G.SP.B.4","5.4\n10.9\n12.2","1.B.2\n3.C.1\n3.C.3(b)","PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1","ID.GV-1","164.308 (a)(1)(i)"]
[{"$f":"Lite!A30","v":2471},{"$f":"Lite!M30","v":2},{"$f":"Lite!K30","v":"B"},{"$f":"Lite!Y30","v":1},{"$f":"Lite!B30","v":"SL.24"},{"$f":"Lite!C30","v":"Have the policies been reviewed in the last 12 months?"},{"$f":"Lite!D30","v":"Yes"},{"$f":"Lite!E30","v":0},{"$f":"Lite!F30","v":0},{"$f":"Lite!G30","v":"B.1 Information Security Policy Maintenance"},{"$f":"Lite!H30","v":"5.1.2"},{"$f":"Lite!I30","v":"Review of the policies for information security"},null,null,null,"12.1.1",null,"PO3.1, PO5.3, PO5.4, PO6.3, PO9.4, DS5.2, DS5.3, ME2.2, ME2.5, ME2.7, ME4.7",null,"164.308 (a)(1)(i)"]
[{"$f":"Lite!A31","v":0},{"$f":"Lite!M31","v":3},{"$f":"Lite!K31","v":1},{"$f":"Lite!Y31","v":1},{"$f":"Lite!B31","v":""},{"$f":"Lite!C31","v":"C. Organizational Security"},{"$f":"Lite!D31","v":0},{"$f":"Lite!E31","v":0},{"$f":"Lite!F31","v":0},{"$f":"Lite!G31","v":0},{"$f":"Lite!H31","v":0},{"$f":"Lite!I31","v":0}]
[{"$f":"Lite!A32","v":58},{"$f":"Lite!M32","v":3},{"$f":"Lite!K32","v":"C"},{"$f":"Lite!Y32","v":1},{"$f":"Lite!B32","v":"SL.25"},{"$f":"Lite!C32","v":"Is there a respondent information security function responsible for security initiatives?"},{"$f":"Lite!D32","v":"Yes"},{"$f":"Lite!E32","v":5},{"$f":"Lite!F32","v":"Security is managed by WalkMe's security team. They are titled System Security Specialists. They report to the CISO. The CISO is Responsible for information security. The CISO reports to the CTO which reports to the CEO of the company. The responsibilities include performing risk assessments and audits, creating workplans in order to mitigate the risks and implementing these workplans. Responsibilities are documented as part of the policy. "},{"$f":"Lite!G32","v":"C.1 Security Organization Roles / Responsibilities"},{"$f":"Lite!H32","v":"6.1.1"},{"$f":"Lite!I32","v":"Information Security Roles and Responsibilities"},null,null,null,12.5,null,"PO3.3, PO3.5, PO4.3, PO4.4, PO4.5, PO4.8, PO6.3, PO6.4, PO6.5, DS5.1",null,"164.308 (a)(2)"]
[{"$f":"Lite!A33","v":0},{"$f":"Lite!M33","v":4},{"$f":"Lite!K33","v":1},{"$f":"Lite!Y33","v":1},{"$f":"Lite!B33","v":""},{"$f":"Lite!C33","v":"D. Asset and Information Management"},{"$f":"Lite!D33","v":0},{"$f":"Lite!E33","v":0},{"$f":"Lite!F33","v":0},{"$f":"Lite!G33","v":0},{"$f":"Lite!H33","v":0},{"$f":"Lite!I33","v":0}]
[{"$f":"Lite!A34","v":3200},{"$f":"Lite!M34","v":4},{"$f":"Lite!K34","v":"D"},{"$f":"Lite!Y34","v":1},{"$f":"Lite!B34","v":"SL.26"},{"$f":"Lite!C34","v":"Is there an asset management policy approved by management, communicated to constituents and an owner to maintain and review?"},{"$f":"Lite!D34","v":"Yes"},{"$f":"Lite!E34","v":3},{"$f":"Lite!F34","v":"We maintain an asset management policy, according to which inventory of all information assets (hardware, software, processes, licensing). We maintain all Cloud assets using the AWS console. We have implemented Spiceworks, in order to track & manage Physical inventory assets, and Microsoft SCCM (System Center Configuration Manager) to track & manage Software inventory assets."},{"$f":"Lite!G34","v":"D. Asset and Information Management"},{"$f":"Lite!H34","v":8.1},{"$f":"Lite!I34","v":"Responsibility for Assets"},null,"Governance: IT Asset Management","D1.G.IT.B.1\nD1.G.IT.B.3\n","N/A","3.A.1","PO4.14, PO6.4, PO8.3, AI5.2, DS2.2, DS2.3, DS2.4, DS5.1, ME2.6",null,"164.306 (b)(2)(ii)"]
[{"$f":"Lite!A35","v":2532},{"$f":"Lite!M35","v":4},{"$f":"Lite!K35","v":"D"},{"$f":"Lite!Y35","v":1},{"$f":"Lite!B35","v":"SL.27"},{"$f":"Lite!C35","v":"Is information classified?"},{"$f":"Lite!D35","v":"Yes"},{"$f":"Lite!E35","v":5},{"$f":"Lite!F35","v":"According to WalkMe data classification policy, we classify and label data based on its sensitivity in regard to content and context, according to our data classification policy. However, as mentioned above, the data we have from customer perspective is not personal or sensitive. In general, the information is classified into 5 levels of classification. Information is stored in secure locations.  Customer data is retained as long as the customer is active. Formal acceptable use rules been established for all type of assets, both hardware & software assets, according to our acceptable usage policy.\n\nAccording to WalkMe policy, all customer collected data is owned by the customer, labeled 'Business Confidential', and secured accordingly with appropriate controls."},{"$f":"Lite!G35","v":"D.1 Asset Accounting and Inventory"},{"$f":"Lite!H35","v":"8.2.1"},{"$f":"Lite!I35","v":"Classification of Information"},null,"Governance: IT Asset Management","D1.G.IT.B.2","9.6.1",null,"PO2, AI2, DS9","ID.AM-1\nID.AM-2","164.310 (d)(1)"]
[{"$f":"Lite!A36","v":3295},{"$f":"Lite!M36","v":4},{"$f":"Lite!K36","v":"D"},{"$f":"Lite!Y36","v":1},{"$f":"Lite!B36","v":"SL.28"},{"$f":"Lite!C36","v":"Is there a removable media policy or program (CDs, DVDs, tapes, disk drives) that has been approved by management, communicated to appropriate constituents, and an owner to maintain and review the policy?"},{"$f":"Lite!D36","v":"Yes"},{"$f":"Lite!E36","v":5},{"$f":"Lite!F36","v":0},{"$f":"Lite!G36","v":"D.4 Removable Device Security"},{"$f":"Lite!H36","v":"8.3.1"},{"$f":"Lite!I36","v":"Management of Removable Media"},null,"Preventative Controls: Access and Data Management\nPreventative Controls: Device/End-Point Security","D3.PC.ADM.B.14\n\n\nD3.PC.DEPS.B.1","9.7.1",null,"DS5.4, DS5.7","PR.PT-2","164.310 (d)(1)"]
[{"$f":"Lite!A37","v":1208},{"$f":"Lite!M37","v":4},{"$f":"Lite!K37","v":"D"},{"$f":"Lite!Y37","v":1},{"$f":"Lite!B37","v":"SL.29"},{"$f":"Lite!C37","v":"Is Scoped Data sent or received via physical media?"},{"$f":"Lite!D37","v":"N/A"},{"$f":"Lite!E37","v":0},{"$f":"Lite!F37","v":"No physical media is used. WalkMe maintains an acceptable usage policy, according to which, no removable media is allowed. It is both forbidden by policy, as well as technically prevented from connecting."},{"$f":"Lite!G37","v":"D.2 Physical Media Tracking"},{"$f":"Lite!H37","v":"8.3.3"},{"$f":"Lite!I37","v":"Physical Media in Transit"},null,null,null,"N/A",null,"AI6.3, DS5.7","PR.DS-5","164.310 (d)(1)"]
[{"$f":"Lite!A38","v":1806},{"$f":"Lite!M38","v":4},{"$f":"Lite!K38","v":"D"},{"$f":"Lite!Y38","v":1},{"$f":"Lite!B38","v":"SL.30"},{"$f":"Lite!C38","v":"Are encryption tools managed and maintained for Scoped Data? If yes:"},{"$f":"Lite!D38","v":"Yes"},{"$f":"Lite!E38","v":5},{"$f":"Lite!F38","v":0},{"$f":"Lite!G38","v":"D.5 Data Security Policy - Encryption"},{"$f":"Lite!H38","v":10.1},{"$f":"Lite!I38","v":"Cryptographic controls"},null,null,null,"3.5.3\n3.6.1\n3.6.4\n3.6.5",null,"N/A"]
[{"$f":"Lite!A39","v":3353},{"$f":"Lite!M39","v":4},{"$f":"Lite!K39","v":"D"},{"$f":"Lite!Y39","v":1},{"$f":"Lite!B39","v":"SL.31"},{"$f":"Lite!C39","v":"Are clients provided with the ability to generate a unique encryption key?"},{"$f":"Lite!D39","v":"No"},{"$f":"Lite!E39","v":0},{"$f":"Lite!F39","v":0},{"$f":"Lite!G39","v":"D.5 Data Security Policy - Encryption"},{"$f":"Lite!H39","v":"10.1.2"},{"$f":"Lite!I39","v":"Key Management"},null,null,null,"3.6.1"]
[{"$f":"Lite!A40","v":3354},{"$f":"Lite!M40","v":4},{"$f":"Lite!K40","v":"D"},{"$f":"Lite!Y40","v":1},{"$f":"Lite!B40","v":"SL.32"},{"$f":"Lite!C40","v":"Are clients provided with the ability to rotate their encryption key on a scheduled basis?"},{"$f":"Lite!D40","v":"No"},{"$f":"Lite!E40","v":0},{"$f":"Lite!F40","v":"WalkMe does not manage key rotation for AWS managed CMKs. AWS KMS automatically rotates AWS managed keys every three years (1095 days). When AWS KMS rotates a CMK, it writes the KMS CMK Rotation event to Amazon CloudWatch Events. WalkMe uses this event to verify that the CMK was rotated.\nFor IAM keys, we rotate keys every 270 days. We quarterly audit access key age to ensure rotation."},{"$f":"Lite!G40","v":"D.5 Data Security Policy - Encryption"},{"$f":"Lite!H40","v":"10.1.2"},{"$f":"Lite!I40","v":"Key Management"},null,null,null,"3.6.4"]
[{"$f":"Lite!A41","v":3548},{"$f":"Lite!M41","v":4},{"$f":"Lite!K41","v":"D"},{"$f":"Lite!Y41","v":1},{"$f":"Lite!B41","v":"SL.33"},{"$f":"Lite!C41","v":"Are staff able to access client Scoped Data in an unencrypted state?"},{"$f":"Lite!D41","v":"Yes"},{"$f":"Lite!E41","v":5},{"$f":"Lite!F41","v":"The only users with access to the database are DevOps users and production support.  Access to the account in order to configure it, create Walkthroughs together with people from your side, but without database access is possible for WalkMe PS and CSM teams. The process ensures usage of two-factor Authentication, and every action is logged & audited."},{"$f":"Lite!G41","v":"H.3 Logical Access Authorization"},{"$f":"Lite!H41","v":"9.2.3\n9.4.6"},{"$f":"Lite!I41","v":"Management of privileged access rights Information access restriction"},null,null,null,"N/A"]
[{"$f":"Lite!A42","v":3549},{"$f":"Lite!M42","v":4},{"$f":"Lite!K42","v":"D"},{"$f":"Lite!Y42","v":1},{"$f":"Lite!B42","v":"SL.34"},{"$f":"Lite!C42","v":"Are staff able to access client's encryption keys?"},{"$f":"Lite!D42","v":"Yes"},{"$f":"Lite!E42","v":0},{"$f":"Lite!F42","v":"The only users with access to AWS KMS are a handful of DevOps admins.  This is required for key management. The process ensures usage of two-factor Authentication, and every action is logged & audited."},{"$f":"Lite!G42","v":"H.3 Logical Access Authorization"},{"$f":"Lite!H42","v":"9.2.3\n9.4.7"},{"$f":"Lite!I42","v":"Management of privileged access rights Information access restriction"},null,null,null,"N/A"]
[{"$f":"Lite!A43","v":3339},{"$f":"Lite!M43","v":4},{"$f":"Lite!K43","v":"D"},{"$f":"Lite!Y43","v":1},{"$f":"Lite!B43","v":"SL.35"},{"$f":"Lite!C43","v":"Is data segmentation and separation capability between clients provided?"},{"$f":"Lite!D43","v":"Yes"},{"$f":"Lite!E43","v":5},{"$f":"Lite!F43","v":0},{"$f":"Lite!G43","v":"V.1 Service and Deployment Models"},{"$f":"Lite!H43","v":"9.4.1 "},{"$f":"Lite!I43","v":"Information access restriction"},null,null,null,"N/A"]
[{"$f":"Lite!A44","v":3481},{"$f":"Lite!M44","v":4},{"$f":"Lite!K44","v":"D"},{"$f":"Lite!Y44","v":1},{"$f":"Lite!B44","v":"SL.36"},{"$f":"Lite!C44","v":"Does the ability exist to legally demonstrate sufficient data segmentation, in the event of a client subpoena or a forensics incident, so as not to impact other clients data if using resource pooling?"},{"$f":"Lite!D44","v":"Yes"},{"$f":"Lite!E44","v":5},{"$f":"Lite!F44","v":"In the event a follow-up action after an information security incident requires legal action, if the incident affects the customer, WalkMe agrees to take all reasonable legal steps to cooperate and share information, to collaborate with the customer during investigation, according to WalkMe policy, and as long as there is no compromise to other customers data."},{"$f":"Lite!G44","v":"V.1 Service and Deployment Models"},{"$f":"Lite!H44","v":"16.1.1 16.1.7"},{"$f":"Lite!I44","v":"Responsibilities and Procedures,\nCollection of Evidence."},null,null,null,"N/A"]
[{"$f":"Lite!A45","v":3723},{"$f":"Lite!M45","v":4},{"$f":"Lite!K45","v":"D"},{"$f":"Lite!Y45","v":1},{"$f":"Lite!B45","v":"SL.37"},{"$f":"Lite!C45","v":"Is there a data classification retention program that identifies the data types that require additional management and governance?"},{"$f":"Lite!D45","v":"Yes"},{"$f":"Lite!E45","v":5},{"$f":"Lite!F45","v":0},{"$f":"Lite!G45","v":"P.1 Scoped Privacy Data Inventory and Flows"},{"$f":"Lite!H45","v":8.1999999999999993},{"$f":"Lite!I45","v":"Information Classification"},null,null,null,"N/A",null,null,null,"164.308 (a)(7)(ii)(E)"]
[{"$f":"Lite!A46","v":3489},{"$f":"Lite!M46","v":4},{"$f":"Lite!K46","v":"D"},{"$f":"Lite!Y46","v":1},{"$f":"Lite!B46","v":"SL.38"},{"$f":"Lite!C46","v":"Is there a self-service portal or API call available to clients which provides the ability to place a \"Legal hold\" on client data which may be subject to a legal action, without impacting other clients data retention or destruction schedules?"},{"$f":"Lite!D46","v":"Yes"},{"$f":"Lite!E46","v":5},{"$f":"Lite!F46","v":"WalkMe does not disclose customer information unless we’re required to do so to comply with a legally valid and binding order. Unless prohibited from doing so or there is clear indication of illegal conduct in connection with the use of WalkMe products or services, WalkMe notifies customers before disclosing content information."},{"$f":"Lite!G46","v":"P.6 Management of Client Scoped Privacy Data"},{"$f":"Lite!H46","v":"16.1.1 16.1.7 18.1.2 18.1.3"},{"$f":"Lite!I46","v":"Responsibilities and Procedures,\nCollection of Evidence,\nIntellectual Property Rights,\nProtection of records"},null,null,null,"N/A"]
[{"$f":"Lite!A47","v":0},{"$f":"Lite!M47","v":5},{"$f":"Lite!K47","v":1},{"$f":"Lite!Y47","v":1},{"$f":"Lite!B47","v":""},{"$f":"Lite!C47","v":"E. Human Resource Security"},{"$f":"Lite!D47","v":0},{"$f":"Lite!E47","v":0},{"$f":"Lite!F47","v":0},{"$f":"Lite!G47","v":0},{"$f":"Lite!H47","v":0},{"$f":"Lite!I47","v":0}]
[{"$f":"Lite!A48","v":4195},{"$f":"Lite!M48","v":5},{"$f":"Lite!K48","v":"E"},{"$f":"Lite!Y48","v":1},{"$f":"Lite!B48","v":"SL.39"},{"$f":"Lite!C48","v":"Is there a Human Resource policy approved by management, communicated to constituents and an owner to maintain and review? If yes, does it include:"},{"$f":"Lite!D48","v":"Yes"},{"$f":"Lite!E48","v":5},{"$f":"Lite!F48","v":"For employees, where legally permissible by local law, WalkMe Performs Cross reference checks for previous workplaces, HR interview for determining the reliability of the applicant, and background check calls to verify recommendations. For Contractors and vendors, as part of the vetting process, WalkMe Performs An individual assessment, and require signing NDA or Confidentiality Agreements as a precondition for engagement.\nEmployees are required to sign a Code of Ethics and agreement regarding non-disclosure/confidentiality. "},{"$f":"Lite!G48","v":0},{"$f":"Lite!H48","v":0},{"$f":"Lite!I48","v":0},null,null,null,null,null,null,"ID.AM-6"]
[{"$f":"Lite!A49","v":2536},{"$f":"Lite!M49","v":5},{"$f":"Lite!K49","v":"E"},{"$f":"Lite!Y49","v":1},{"$f":"Lite!B49","v":"SL.40"},{"$f":"Lite!C49","v":"Security roles and responsibilities?"},{"$f":"Lite!D49","v":"Yes"},{"$f":"Lite!E49","v":5},{"$f":"Lite!F49","v":0},{"$f":"Lite!G49","v":"C.1 Security Organization Roles/Responsibilities"},{"$f":"Lite!H49","v":"6.1.1"},{"$f":"Lite!I49","v":"Information security roles and responsibilities"},null,null,null,"3.6.8\n3.7",null,"PO4.6, PO4.8, PO6.3, PO7.1, PO7.2, PO7.3, DS5.4","PR.AT-2\nDE.DP-1","164.308 (a)(2)"]
[{"$f":"Lite!A50","v":2538},{"$f":"Lite!M50","v":5},{"$f":"Lite!K50","v":"E"},{"$f":"Lite!Y50","v":1},{"$f":"Lite!B50","v":"SL.41"},{"$f":"Lite!C50","v":"Background screening?"},{"$f":"Lite!D50","v":"Yes"},{"$f":"Lite!E50","v":5},{"$f":"Lite!F50","v":0},{"$f":"Lite!G50","v":"E.2 Background Investigation Policy Content"},{"$f":"Lite!H50","v":"7.1.1"},{"$f":"Lite!I50","v":"Screening"},null,null,null,12.7,null,"N/A",null,"164.308 (a)(3)"]
[{"$f":"Lite!A51","v":183},{"$f":"Lite!M51","v":5},{"$f":"Lite!K51","v":"E"},{"$f":"Lite!Y51","v":1},{"$f":"Lite!B51","v":"SL.42"},{"$f":"Lite!C51","v":"Employment agreements?"},{"$f":"Lite!D51","v":"Yes"},{"$f":"Lite!E51","v":5},{"$f":"Lite!F51","v":0},{"$f":"Lite!G51","v":"E.3 Agreements for Constituents"},{"$f":"Lite!H51","v":"7.1.2"},{"$f":"Lite!I51","v":"Terms and conditions of employment"},null,null,null,"12.6.2",null,"PO4.6, PO7.1, PO7.3, DS2.3",null,"164.308 (a)(3)"]
[{"$f":"Lite!A52","v":212},{"$f":"Lite!M52","v":5},{"$f":"Lite!K52","v":"E"},{"$f":"Lite!Y52","v":1},{"$f":"Lite!B52","v":"SL.43"},{"$f":"Lite!C52","v":"Security awareness training?"},{"$f":"Lite!D52","v":"Yes"},{"$f":"Lite!E52","v":5},{"$f":"Lite!F52","v":"Whenever a new employee is recruited, he/she is obligated to sign WalkMe's security policies, code of ethics and agreement regarding non-disclosure/confidentiality. In addition, the policies are explained thoroughly in the annual awareness training sessions that are given to all company employees. The measurement is done based on security drills testing awareness of best practices. As part of our recruitment process, we provide this training to all new hires as well. Specific roles (e.g., developers, IT personnel, etc.) are provided with additional role-specific security and privacy training. \n\nTraining is refreshed annually. Employees with access to sensitive information, including PII and PHI data, will receive periodic reminders of their responsibilities and receive ongoing, periodically updated security awareness training to fortify their understanding of current threats and corresponding security practices to mitigate such threats."},{"$f":"Lite!G52","v":"E.1 Security Awareness Training Program"},{"$f":"Lite!H52","v":"7.2.2"},{"$f":"Lite!I52","v":"Information security awareness, education, and training"},null,"Training and Culture: Training","D1.TC.Tr.B.1\nD1.TC.Tr.B.2",12.6,"1.A.2","PO4.6, PO6.2, PO6.4, PO7.2, PO7.4, PO7.7, AI1.1, AI7.1, DS5.1, DS5.2, DS5.3, DS7.1, DS7.2","PR.AT-1","164.308 (a)(5)(i)"]
[{"$f":"Lite!A53","v":293},{"$f":"Lite!M53","v":5},{"$f":"Lite!K53","v":"E"},{"$f":"Lite!Y53","v":1},{"$f":"Lite!B53","v":"SL.44"},{"$f":"Lite!C53","v":"Disciplinary process for non-compliance?"},{"$f":"Lite!D53","v":"Yes"},{"$f":"Lite!E53","v":5},{"$f":"Lite!F53","v":"The disciplinary process depends on the severity of the violation and the recurrence of it. It can vary from a warning to termination of employment/contract and possible legal action."},{"$f":"Lite!G53","v":"E.5 Separation Procedures"},{"$f":"Lite!H53","v":"7.2.3"},{"$f":"Lite!I53","v":"Disciplinary process"},null,"Training and Culture: Training","D1.TC.C.B.1","N/A",null,"PO4.8, PO7.8, DS5.6",null,"164.308 (a)(1)(ii)(C)"]
[{"$f":"Lite!A54","v":2557},{"$f":"Lite!M54","v":5},{"$f":"Lite!K54","v":"E"},{"$f":"Lite!Y54","v":1},{"$f":"Lite!B54","v":"SL.45"},{"$f":"Lite!C54","v":"Termination or change of status process?"},{"$f":"Lite!D54","v":"Yes"},{"$f":"Lite!E54","v":5},{"$f":"Lite!F54","v":"Upon termination or role change, HR initiates the process of revoking access (as well as returning equipment etc). All of the relevant personnel are part of the process and are required to approve the access is removed in the systems they are in charge of. The process initiates as soon as the termination or role change take place."},{"$f":"Lite!G54","v":"E.5 Separation Procedures"},{"$f":"Lite!H54","v":7.3},{"$f":"Lite!I54","v":"Termination responsibilities"},null,"Preventative Controls: Access and Data Management","D3.PC.ADM.B.5","N/A",null,"PO4.8, PO7.8, DS5.6",null,"164.308 (a)(3)(ii)(c)"]
[{"$f":"Lite!A55","v":3517},{"$f":"Lite!M55","v":5},{"$f":"Lite!K55","v":"E"},{"$f":"Lite!Y55","v":1},{"$f":"Lite!B55","v":"SL.46"},{"$f":"Lite!C55","v":"Are background checks performed for Service Provider Contractors and Subcontractors?"},{"$f":"Lite!D55","v":"Yes"},{"$f":"Lite!E55","v":0},{"$f":"Lite!F55","v":0},{"$f":"Lite!G55","v":"E.2 Background Investigation Policy Content"},{"$f":"Lite!H55","v":"7.1.1 7.2.1"},{"$f":"Lite!I55","v":"Screening Management responsibilities"},null,null,null,"N/A","3.C.2"]
[{"$f":"Lite!A56","v":220},{"$f":"Lite!M56","v":5},{"$f":"Lite!K56","v":"E"},{"$f":"Lite!Y56","v":1},{"$f":"Lite!B56","v":"SL.47"},{"$f":"Lite!C56","v":"Do information security personnel have professional security certifications?"},{"$f":"Lite!D56","v":"Yes"},{"$f":"Lite!E56","v":0},{"$f":"Lite!F56","v":"In addition to existing professional certifications and security experience, the security team is currently in the process of CISSP certification."},{"$f":"Lite!G56","v":0},{"$f":"Lite!H56","v":"6.1.4"},{"$f":"Lite!I56","v":"Contact with special interest groups"},null,null,null,null,"1.B.7(a)"]
[{"$f":"Lite!A57","v":0},{"$f":"Lite!M57","v":6},{"$f":"Lite!K57","v":1},{"$f":"Lite!Y57","v":1},{"$f":"Lite!B57","v":""},{"$f":"Lite!C57","v":"F. Physical and Environmental Security"},{"$f":"Lite!D57","v":0},{"$f":"Lite!E57","v":0},{"$f":"Lite!F57","v":0},{"$f":"Lite!G57","v":0},{"$f":"Lite!H57","v":0},{"$f":"Lite!I57","v":0}]
[{"$f":"Lite!A58","v":2559},{"$f":"Lite!M58","v":6},{"$f":"Lite!K58","v":"F"},{"$f":"Lite!Y58","v":1},{"$f":"Lite!B58","v":"SL.48"},{"$f":"Lite!C58","v":"Is there a physical security program?"},{"$f":"Lite!D58","v":"Yes"},{"$f":"Lite!E58","v":5},{"$f":"Lite!F58","v":"WalkMe is a SaaS.\nWe are depended on Amazon AWS as our cloud hosting provider.\nThe physical security policy covers physical security in WalkMe's corporate offices and not the production data center hosted by AWS.\nWe rely on AWS for physical security in their data centers.\nThey are certified with all common security standards, to attest that they do address all physical security related issues properly. In general, AWS’ data centers are state of the art, utilizing innovative architectural and engineering approaches. AWS has many years of experience in designing, constructing, and operating large-scale data centers. This experience has been applied to the AWS platform and infrastructure. AWS data centers are housed in nondescript facilities. Physical access is strictly controlled both at the perimeter and at building ingress points by professional security staff utilizing video surveillance, intrusion detection systems, and other electronic means. Authorized staff must pass two-factor authentication a minimum of two times to access data center floors."},{"$f":"Lite!G58","v":"F.2 Physical Security Controls - Scoped Data"},{"$f":"Lite!H58","v":"5.1.1"},{"$f":"Lite!I58","v":"Policies for information security"},null,null,null,12.1,null,"PO6.1, PO6.2, PO6.3, PO6.5, DS5.2, DS5.3, ME2.1",null,"164.310 (a)(2)(ii)"]
[{"$f":"Lite!A59","v":2560},{"$f":"Lite!M59","v":6},{"$f":"Lite!K59","v":"F"},{"$f":"Lite!Y59","v":1},{"$f":"Lite!B59","v":"SL.49"},{"$f":"Lite!C59","v":"Are physical security and environmental controls in the data center and office buildings?"},{"$f":"Lite!D59","v":"Yes"},{"$f":"Lite!E59","v":5},{"$f":"Lite!F59","v":"We have a physical security policy that covers physical security in WalkMe's corporate offices. Our offices physical security meets all best practices in aspects of CCTV, key card based access, alarms etc. WalkMe is responsible for all aspects of our application security. The datacenters are managed by AWS and are certified to most common security & privacy standards (PCI-DSS, HIPAA, ISO27001:2013, SOC2, SOC3, FedRAMP etc.). For the full list, see https://aws.amazon.com/compliance/"},{"$f":"Lite!G59","v":"F. Physical and Environmental Security"},{"$f":"Lite!H59","v":11.1},{"$f":"Lite!I59","v":"Secure areas"},null,"Preventative Controls: Access and Data Management\nDetective Controls: Event Detection","D3.PC.ADM.B.11\n\n\nD3.DC.ED.B.5",9.3000000000000007,null,"N/A","PR.AC-2\nPR.IP-5\nPR.MA-1\nPR.PT-3\nDE.CM-2","164.310 (a)(2)(ii)"]
[{"$f":"Lite!A60","v":396},{"$f":"Lite!M60","v":6},{"$f":"Lite!K60","v":"F"},{"$f":"Lite!Y60","v":1},{"$f":"Lite!B60","v":"SL.50"},{"$f":"Lite!C60","v":"Are visitors permitted in the facility?"},{"$f":"Lite!D60","v":"Yes"},{"$f":"Lite!E60","v":5},{"$f":"Lite!F60","v":"All visitors and contractors are required to present identification and are signed in and continually escorted by authorized staff. AWS only provides data center access and information to employees and contractors who have a legitimate business need for such privileges. When an employee no longer has a business need for these privileges, his or her access is immediately revoked, even if they continue to be an employee of Amazon or Amazon Web Services. All physical access to data centers by AWS employees is logged and audited routinely."},{"$f":"Lite!G60","v":"F.7 Visitor Management"},{"$f":"Lite!H60","v":"11.1.2 "},{"$f":"Lite!I60","v":"Physical entry controls"},null,"Preventative Controls: Access and Data Management\nDetective Controls: Event Detection","D3.PC.ADM.B.11\n\n\nD3.DC.ED.B.5",9.4,null,"DS12.2, DS12.3",null,"164.310 (a)(2)(iii)"]
[{"$f":"Lite!A61","v":0},{"$f":"Lite!M61","v":7},{"$f":"Lite!K61","v":1},{"$f":"Lite!Y61","v":1},{"$f":"Lite!B61","v":""},{"$f":"Lite!C61","v":"G. Operations Management"},{"$f":"Lite!D61","v":0},{"$f":"Lite!E61","v":0},{"$f":"Lite!F61","v":0},{"$f":"Lite!G61","v":0},{"$f":"Lite!H61","v":0},{"$f":"Lite!I61","v":0}]
[{"$f":"Lite!A62","v":2582},{"$f":"Lite!M62","v":7},{"$f":"Lite!K62","v":"G"},{"$f":"Lite!Y62","v":1},{"$f":"Lite!B62","v":"SL.51"},{"$f":"Lite!C62","v":"Are management approved operating procedures utilized?"},{"$f":"Lite!D62","v":"Yes"},{"$f":"Lite!E62","v":5},{"$f":"Lite!F62","v":0},{"$f":"Lite!G62","v":"G. Operations Management"},{"$f":"Lite!H62","v":"12.1.1"},{"$f":"Lite!I62","v":"Documented Operating Procedure"},null,null,null,11.6,null,"AI1.1, AI4.4, DS13.1",null,"164.316 (a)"]
[{"$f":"Lite!A63","v":816},{"$f":"Lite!M63","v":7},{"$f":"Lite!K63","v":"G"},{"$f":"Lite!Y63","v":1},{"$f":"Lite!B63","v":"SL.52"},{"$f":"Lite!C63","v":"Is there an operational change management/change control policy or program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"Lite!D63","v":"Yes"},{"$f":"Lite!E63","v":5},{"$f":"Lite!F63","v":"We have a change management policy. Changes to the organization, business processes, information processing facilities and systems that affect information security are controlled.\nThe relevant party at the company needs to fill a 'Change Request' form that is being reviewed and approved by the CISO and the relevant parties if required."},{"$f":"Lite!G63","v":"G.1 Change Control"},{"$f":"Lite!H63","v":"12.1.2"},{"$f":"Lite!I63","v":"Change Management"},null,"Governance: IT Asset Management","D1.G.IT.B.4",6.4,"3.C.6","AI6.1, AI6.2, AI6.3, AI6.4, AI6.5",null,"164.308 (a)(8)\n164.316 (b)(2)(iii)"]
[{"$f":"Lite!A64","v":922},{"$f":"Lite!M64","v":7},{"$f":"Lite!K64","v":"G"},{"$f":"Lite!Y64","v":1},{"$f":"Lite!B64","v":"SL.53"},{"$f":"Lite!C64","v":"Are backups of Scoped Systems and Data performed?"},{"$f":"Lite!D64","v":"Yes"},{"$f":"Lite!E64","v":5},{"$f":"Lite!F64","v":"Backups are done daily for all databases. The backups are done using AWS features and stored in a dedicated AWS S3 bucket. The daily backups are retained for 30 days.\nData is also replicated to a DR site online.\nThe DR site holds the same physical security standards as the main one."},{"$f":"Lite!G64","v":"K.5 Backup Media Restoration"},{"$f":"Lite!H64","v":"12.3.1"},{"$f":"Lite!I64","v":"Information Back-Up"},null,"Incident Resilience Planning and Strategy: Testing","D5.IR.PST.B.3","9.6.2",null,"AI6.1, AI6.2, AI6.3, AI6.4, AI6.5","PR.IP-4","164.310 (d)(2)(iv)"]
[{"$f":"Lite!A65","v":3304},{"$f":"Lite!M65","v":7},{"$f":"Lite!K65","v":"G"},{"$f":"Lite!Y65","v":1},{"$f":"Lite!B65","v":"SL.54"},{"$f":"Lite!C65","v":"Are Cloud Services provided? If yes, what service model is provided (select all that apply):"},{"$f":"Lite!D65","v":"Yes"},{"$f":"Lite!E65","v":5},{"$f":"Lite!F65","v":"WalkMe is a SaaS, We are depended on AWS as our cloud hosting provider."},{"$f":"Lite!G65","v":"V.1 Service and Deployment Models"},{"$f":"Lite!H65","v":4.3},{"$f":"Lite!I65","v":"Determining the scope of the information management system"},null,null,null,"N/A"]
[{"$f":"Lite!A66","v":3305},{"$f":"Lite!M66","v":7},{"$f":"Lite!K66","v":"G"},{"$f":"Lite!Y66","v":1},{"$f":"Lite!B66","v":"SL.55"},{"$f":"Lite!C66","v":"Software as a Service (SaaS)?"},{"$f":"Lite!D66","v":"Yes"},{"$f":"Lite!E66","v":5},{"$f":"Lite!F66","v":"We are a SaaS service. Our servers are hosted in AWS data center in region us-west-1, and by Akamai CDN."},{"$f":"Lite!G66","v":"V.1 Service and Deployment Models"},{"$f":"Lite!H66","v":0},{"$f":"Lite!I66","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A67","v":3307},{"$f":"Lite!M67","v":7},{"$f":"Lite!K67","v":"G"},{"$f":"Lite!Y67","v":1},{"$f":"Lite!B67","v":"SL.56"},{"$f":"Lite!C67","v":"Infrastructure as a Service (IaaS)?"},{"$f":"Lite!D67","v":"N/A"},{"$f":"Lite!E67","v":0},{"$f":"Lite!F67","v":0},{"$f":"Lite!G67","v":"V.1 Service and Deployment Models"},{"$f":"Lite!H67","v":0},{"$f":"Lite!I67","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A68","v":3309},{"$f":"Lite!M68","v":7},{"$f":"Lite!K68","v":"G"},{"$f":"Lite!Y68","v":1},{"$f":"Lite!B68","v":"SL.57"},{"$f":"Lite!C68","v":"Private cloud?"},{"$f":"Lite!D68","v":"Yes"},{"$f":"Lite!E68","v":5},{"$f":"Lite!F68","v":"We use Amazon AWS as our cloud hosting provider, and the segmentation is enforced based on AWS's segments within a Virtual Private Cloud (VPC). There is complete logical segregation between customers in our environment. The segregation is done by attaching the customer ID to every database row, and having a completely separate folder for storing the S3 files.  All traffic between segments and to/from the internet is filtered by the firewalls. Firewall logs are in place to audit all network activity. While multi-tenancy does present a number of challenges in terms of compliance, security, and privacy - The multi-tenant approach is widely widespread, with many secure implementations across industries.\nWalkMe multi-tenant architecture has been tested by large Enterprises and found to be in line with industry best practices. In addition, WalkMe follows security best practice and is ISO 27001, ISO 27017, ISO 27018, ISO 27032, ISO 27799, SOC 2 TYPE II, Privacy shield certified and HIPAA, GDPR compliant. We maintain those certifications and are constantly adding additional security and privacy certifications to attest that we keep improving our security controls of our products and services.\nMoreover, The development of multi-tenant systems, and application security testing processes are more stringent due to the fact that customers' data is separated logically. We have implemented many application security controls to adress this."},{"$f":"Lite!G68","v":"V.1 Service and Deployment Models"},{"$f":"Lite!H68","v":0},{"$f":"Lite!I68","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A69","v":3310},{"$f":"Lite!M69","v":7},{"$f":"Lite!K69","v":"G"},{"$f":"Lite!Y69","v":1},{"$f":"Lite!B69","v":"SL.58"},{"$f":"Lite!C69","v":"Public cloud?"},{"$f":"Lite!D69","v":"N/A"},{"$f":"Lite!E69","v":0},{"$f":"Lite!F69","v":0},{"$f":"Lite!G69","v":"V.1 Service and Deployment Models"},{"$f":"Lite!H69","v":0},{"$f":"Lite!I69","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A70","v":3311},{"$f":"Lite!M70","v":7},{"$f":"Lite!K70","v":"G"},{"$f":"Lite!Y70","v":1},{"$f":"Lite!B70","v":"SL.59"},{"$f":"Lite!C70","v":"Community cloud?"},{"$f":"Lite!D70","v":"N/A"},{"$f":"Lite!E70","v":0},{"$f":"Lite!F70","v":0},{"$f":"Lite!G70","v":"V.1 Service and Deployment Models"},{"$f":"Lite!H70","v":0},{"$f":"Lite!I70","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A71","v":3312},{"$f":"Lite!M71","v":7},{"$f":"Lite!K71","v":"G"},{"$f":"Lite!Y71","v":1},{"$f":"Lite!B71","v":"SL.60"},{"$f":"Lite!C71","v":"Hybrid cloud?"},{"$f":"Lite!D71","v":"N/A"},{"$f":"Lite!E71","v":0},{"$f":"Lite!F71","v":0},{"$f":"Lite!G71","v":"V.1 Service and Deployment Models"},{"$f":"Lite!H71","v":0},{"$f":"Lite!I71","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A72","v":3516},{"$f":"Lite!M72","v":7},{"$f":"Lite!K72","v":"G"},{"$f":"Lite!Y72","v":1},{"$f":"Lite!B72","v":"SL.61"},{"$f":"Lite!C72","v":"Is there a client management portal which allows distributed business accounts (business units/departments) to be managed under a single central corporate account?"},{"$f":"Lite!D72","v":"Yes"},{"$f":"Lite!E72","v":5},{"$f":"Lite!F72","v":0},{"$f":"Lite!G72","v":0},{"$f":"Lite!H72","v":"15.2.1"},{"$f":"Lite!I72","v":"Monitoring and review of supplier services"},null,null,null,"N/A"]
[{"$f":"Lite!A73","v":3356},{"$f":"Lite!M73","v":7},{"$f":"Lite!K73","v":"G"},{"$f":"Lite!Y73","v":1},{"$f":"Lite!B73","v":"SL.62"},{"$f":"Lite!C73","v":"Are application self service features or an Internet accessible self-service portal available to clients?"},{"$f":"Lite!D73","v":"Yes"},{"$f":"Lite!E73","v":5},{"$f":"Lite!F73","v":0},{"$f":"Lite!G73","v":0},{"$f":"Lite!H73","v":"9.4.1"},{"$f":"Lite!I73","v":"Information access restriction"},null,null,null,"N/A"]
[{"$f":"Lite!A74","v":3590},{"$f":"Lite!M74","v":7},{"$f":"Lite!K74","v":"G"},{"$f":"Lite!Y74","v":1},{"$f":"Lite!B74","v":"SL.63"},{"$f":"Lite!C74","v":"Can clients run their own security services within their own cloud environment?"},{"$f":"Lite!D74","v":"Yes"},{"$f":"Lite!E74","v":5},{"$f":"Lite!F74","v":"WalkMe prides itself for delivering top tier customization options. Any security controls and capabilities could be added, based on specific customer request. (Certain changes require commercial ramifications)\n\nIn general, Security and Compliance is a shared responsibility between WalkMe and the customer. \nWalkMe is responsible for all aspects of our application security. AWS is responsible for all aspects of our infrastructure security.\nWalkme designed its controls with the assumption that certain controls will be the responsibility of its customers (or \"user entities\"). The following is a representative list of controls that are recommended to be in operation at user entities to complement the controls of Walkme's Interactive Online Guidance System. This is not a comprehensive list of all controls that should be employed by Walkme's user entities.\n\nChange Management:\n• Customers are responsible for validating the accuracy and completeness of data contained in their Walkme account.\nLogical Access:\n• Customers are responsible for creating a username and password to access their account.\n• Customers are responsible for establishing their own usage and access policies to their Walkme accounts.\n• Customers are responsible for identifying approved points of contacts to coordinate with Walkme.\n• Customers are responsible for configuring their instance of Walkme according to their organizations policies and procedures.\n• Customer is responsible for provisioning and de-provisioning of access for content creators/editors.\n• Customers are responsible for preforming periodic review of access and configurations for appropriateness.\nIncident Management:\n• Customers are responsible for alerting Walkme of incidents (related to Security, Availability, and Confidentiality) when they become aware of them.\n• Customers are responsible for monitoring or resolving the incident alerts as part of the use of the application.\nPrivacy:\nGetting the end users’ consent is the Data Controller’s responsibility, since they own the site/platform/software. Getting the end-users’ consent for WalkMe alone is not necessary, since by default we’re not collecting any PII other than IP addresses. These IP addresses are not processed, but rather logged for forensic purposes, as required by GDPR."},{"$f":"Lite!G74","v":"V.3 Cloud Audit Program"},{"$f":"Lite!H74","v":"12.4.1 12.4.3 12.5 12.6.1 "},{"$f":"Lite!I74","v":"Event logging, Administrator and operator logs, Control of operational software, Management of technical vulnerabilities"},null,null,null,"5.1, 5.2"]
[{"$f":"Lite!A75","v":3373},{"$f":"Lite!M75","v":7},{"$f":"Lite!K75","v":"G"},{"$f":"Lite!Y75","v":1},{"$f":"Lite!B75","v":"SL.64"},{"$f":"Lite!C75","v":"Is there a management approved process to ensure that image snapshots containing Scoped Data are authorized prior to being snapped?"},{"$f":"Lite!D75","v":"N/A"},{"$f":"Lite!E75","v":0},{"$f":"Lite!F75","v":0},{"$f":"Lite!G75","v":0},{"$f":"Lite!H75","v":"9.2.3"},{"$f":"Lite!I75","v":"Management of privileged access rights"},null,null,null,"N/A"]
[{"$f":"Lite!A76","v":3401},{"$f":"Lite!M76","v":7},{"$f":"Lite!K76","v":"G"},{"$f":"Lite!Y76","v":1},{"$f":"Lite!B76","v":"SL.65"},{"$f":"Lite!C76","v":"Is there a formal process to ensure clients are notified prior to changes being made which may impact their service? If yes, what is the communication method:"},{"$f":"Lite!D76","v":"Yes"},{"$f":"Lite!E76","v":5},{"$f":"Lite!F76","v":"Contact by assigned Customer Solutions Manager (CSM)."},{"$f":"Lite!G76","v":"G.1 Change Control"},{"$f":"Lite!H76","v":"12.1.2"},{"$f":"Lite!I76","v":"Change management"},null,null,null,6.4]
[{"$f":"Lite!A77","v":3406},{"$f":"Lite!M77","v":7},{"$f":"Lite!K77","v":"G"},{"$f":"Lite!Y77","v":1},{"$f":"Lite!B77","v":"SL.66"},{"$f":"Lite!C77","v":"Is there a scheduled maintenance window? If yes, what is the frequency:"},{"$f":"Lite!D77","v":"Yes"},{"$f":"Lite!E77","v":5},{"$f":"Lite!F77","v":"Maintenance windows are on Sundays at 00:00 PST. In any case of downtime risk, customers are notified 14 days in advance."},{"$f":"Lite!G77","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"Lite!H77","v":"12.6.1 "},{"$f":"Lite!I77","v":"Management of technical vulnerabilities"},null,null,null,"11.3.1, 11.3.2"]
[{"$f":"Lite!A78","v":3412},{"$f":"Lite!M78","v":7},{"$f":"Lite!K78","v":"G"},{"$f":"Lite!Y78","v":1},{"$f":"Lite!B78","v":"SL.67"},{"$f":"Lite!C78","v":"Is there a scheduled maintenance window which results in client downtime? If yes, what is the downtime:"},{"$f":"Lite!D78","v":"Yes"},{"$f":"Lite!E78","v":5},{"$f":"Lite!F78","v":"Maintenance windows are on Sundays at 00:00 PST. In any case of downtime risk, customers are notified 14 days in advance."},{"$f":"Lite!G78","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"Lite!H78","v":"14.2.2.l"},{"$f":"Lite!I78","v":"System change control procedures"},null,null,null,"N/A"]
[{"$f":"Lite!A79","v":3418},{"$f":"Lite!M79","v":7},{"$f":"Lite!K79","v":"G"},{"$f":"Lite!Y79","v":1},{"$f":"Lite!B79","v":"SL.68"},{"$f":"Lite!C79","v":"Is there an online incident response status portal, which outlines planned and unplanned outages? If yes, how long after an unplanned outage is this updated:"},{"$f":"Lite!D79","v":"Yes"},{"$f":"Lite!E79","v":5},{"$f":"Lite!F79","v":"WalkMe maintains an external status page. This page allows our customers and partners to become self-sufficient, check the status of our services, be aware of maintenance windows, receive up-to-date information about malfunctions and more. See https://status.walkme.com/"},{"$f":"Lite!G79","v":"J. Incident Event and Communications Management\nP.8 Privacy Incident Notification and Response Management"},{"$f":"Lite!H79","v":"14.2.2"},{"$f":"Lite!I79","v":"System change control procedures"},null,null,null,"N/A",null,null,"PR.DS-5"]
[{"$f":"Lite!A80","v":0},{"$f":"Lite!M80","v":8},{"$f":"Lite!K80","v":1},{"$f":"Lite!Y80","v":1},{"$f":"Lite!B80","v":""},{"$f":"Lite!C80","v":"H. Access Control"},{"$f":"Lite!D80","v":0},{"$f":"Lite!E80","v":0},{"$f":"Lite!F80","v":0},{"$f":"Lite!G80","v":0},{"$f":"Lite!H80","v":0},{"$f":"Lite!I80","v":0}]
[{"$f":"Lite!A81","v":1998},{"$f":"Lite!M81","v":8},{"$f":"Lite!K81","v":"H"},{"$f":"Lite!Y81","v":1},{"$f":"Lite!B81","v":"SL.69"},{"$f":"Lite!C81","v":"Are electronic systems used to transmit, process or store Scoped Systems and Data?"},{"$f":"Lite!D81","v":"Yes"},{"$f":"Lite!E81","v":5},{"$f":"Lite!F81","v":"WalkMe is an Overlay. WalkMe collects personally identifiable information and non-personally identifiable information from customers’ end-users in certain circumstances. This is the case for both SaaS solution, as well as local hosting.\n Depending on the context of your account configuration, we may collect or receive the following types of information, including Personal Information, from you:\n• HTML metadata - WalkMe configuration for locating elements on the page.\n• Analytics metadata – User interaction with WalkMe; which Walkthroughs and steps were played, launchers clicked, shoutOuts displayed etc. This is the WalkMe related metadata (the WalkMe configuration [e.g. location of balloon on page is XX,YY], and analytics usage [e.g. user GUID XXXXX used Walkthrough GUID YYYYY]).\n• IP addresses in logs for security and forensic purposes.\n• Pseudonymized masked IP addresses (i.e. 192.168.0.x) and End Users' Approximate geographical Location data\n• Environment properties such as browser and OS, page URL, and title.\nBy Default, collected metadata is assigned to anonymous random GUID.\nThe analytics information is anonymized aggregated usage statistics regarding WalkMe usage.\nAdditionally, Customer may use certain special features which require collecting and storing additional Personal Information (i.e. User Behavior Tracking, Screenshot Settings, Custom Variables, Custom User Identifier, Visions). For more information, please see our privacy policy."},{"$f":"Lite!G81","v":0},{"$f":"Lite!H81","v":0},{"$f":"Lite!I81","v":""},null,null,null,"N/A",null,"N/A"]
[{"$f":"Lite!A82","v":1911},{"$f":"Lite!M82","v":8},{"$f":"Lite!K82","v":"H"},{"$f":"Lite!Y82","v":1},{"$f":"Lite!B82","v":"SL.70"},{"$f":"Lite!C82","v":"Are individual IDs required for user authentication to applications, operating systems, databases and network devices?"},{"$f":"Lite!D82","v":"Yes"},{"$f":"Lite!E82","v":5},{"$f":"Lite!F82","v":0},{"$f":"Lite!G82","v":"H.1 Password Controls"},{"$f":"Lite!H82","v":"9.2.1.a"},{"$f":"Lite!I82","v":"User registration and de-registration"},null,"Preventative Controls: Access and Data Management","D3.PC.ADM.B.6","8.1.1\n12.3.2",null,"DS5.4","PR.AC-1","164.312 (a)(2)(i)"]
[{"$f":"Lite!A83","v":4408},{"$f":"Lite!M83","v":8},{"$f":"Lite!K83","v":"H"},{"$f":"Lite!Y83","v":1},{"$f":"Lite!B83","v":"SL.71"},{"$f":"Lite!C83","v":"Are passwords used?"},{"$f":"Lite!D83","v":"Yes"},{"$f":"Lite!E83","v":5},{"$f":"Lite!F83","v":"In order to create content using the WalkMe Editor, content managers must authenticate based on username and password. There is no authentication required for end-users to leverage WalkMe."},{"$f":"Lite!G83","v":"H. Access Control"},{"$f":"Lite!H83","v":0},{"$f":"Lite!I83","v":""}]
[{"$f":"Lite!A84","v":1949},{"$f":"Lite!M84","v":8},{"$f":"Lite!K84","v":"H"},{"$f":"Lite!Y84","v":1},{"$f":"Lite!B84","v":"SL.72"},{"$f":"Lite!C84","v":"Is there a password policy for systems that transmit, process or store Scoped Systems and Data that has been approved by management, communicated to constituents, and enforced on all platforms?"},{"$f":"Lite!D84","v":"Yes"},{"$f":"Lite!E84","v":5},{"$f":"Lite!F84","v":"WalkMe enforces a strong password policy, based on NIST & OWASP Best Practices:\nLength – Using at least eight characters.\nComplexity (Composition) – Using at least one numeric character. Using at least one uppercase and at least one lowercase alphabetic character. Using at least one special character.\nStrength – A password must not be a dictionary word, dialectal or jargon word from any language, or any of these words written backwards.  Passwords must not be based on personal data (e.g. date of birth, address, name of family member, user's account name or parts of the user's full name etc.).\nHistory (Reuse password Limits) – Users are not allowed to reuse the last 13 passwords.\nMinimum password age – 2 day minimum, in order to prevent users from repeatedly cycling through over 13 passwords until they get to an old favorite, while allowing enough time for full replication cycles. On applicable systems, and overridable by admin for support purposes.\nLifetime (Expiration frequency) – Mandatory Change every 90 Days.\nLockout – we use CAPTCHA against brute force in order to prevent authentication abuse, as an alternative equivalent control to account lockout in order to prevent denial of service (DoS) attacks. (See https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks)\nWe also manage authorization strictly so that there's no way for a user to perform unauthorized activities on our Editor. This includes both identification of the customer (so that a user belonging to customer A can't affect the configuration of customer B) and access rights enforcement within the customer account.\nSession Expiration - User sessions expire after 15 Minutes of inactivity.\nPassword recovery - secured by CAPTCHA, and used as self-support for reset, so the user can reset his password (all password policy still apply, including password history)\nCredential Storage at rest - Passwords are of course only stored as SHA-512 salted cryptographic hashes, in accordance with industry standard cryptographic algorithms, and not in cleartext/encrypted.\nCredential Encryption in transit - All traffic between servers and users is done over TLS protocol.\nMasking (obfuscation) - Passwords either do not appear, or are masked, on the screen when typed.\nInformation disclosure prevention - The application system validates the user identifier and user authenticator as a pair and rejects the logon attempt if it is invalid.  The system does not inform the user, which of the two is wrong.\nPassword Delivery - Passwords are not delivered within the same email as a user's identity or system's URL.\nBlacklisted passwords - Passwords must not be based on common passwords such as \"password\", \"12345678\", or that appear on online \"Worst Passwords\" lists.\nUnique password usage – each password must only be used for a single system, in order to minimize exposure to further systems in case of a compromised password incident."},{"$f":"Lite!G84","v":"H. Access Control"},{"$f":"Lite!H84","v":"9.4.3"},{"$f":"Lite!I84","v":"Password Management System"},null,null,null,8.1,null,"DS5.3",null,"164.308 (a)(5)(ii)(D)"]
[{"$f":"Lite!A85","v":2028},{"$f":"Lite!M85","v":8},{"$f":"Lite!K85","v":"H"},{"$f":"Lite!Y85","v":1},{"$f":"Lite!B85","v":"SL.73"},{"$f":"Lite!C85","v":"Is remote access permitted?"},{"$f":"Lite!D85","v":"Yes"},{"$f":"Lite!E85","v":5},{"$f":"Lite!F85","v":"We are hosted on AWS cloud infrastructure in US. Configuration in the AWS is done according to the security best practices in terms of user management, MFA authentication methods, access management, and automation. Remote management is only possible from either that segment within WalkMe offices, or by using an SSL VPN client, with strong MFA authentication based on OTP tokens. This is only applicable to our internal systems, and no remote access to the customer systems is required. 3rd parties do not have access to WalkMe's network."},{"$f":"Lite!G85","v":"H.8 Restrictions and Multifactor Authentication"},{"$f":"Lite!H85","v":6.2},{"$f":"Lite!I85","v":"Mobile devices and teleworking"},null,"Preventative Controls: Access and Data Management","D3.PC.ADM.B.15","12.3.9",null,"AI1.2, AI2.4, DS5.7, DS5.10, DS5.11"]
[{"$f":"Lite!A86","v":3355},{"$f":"Lite!M86","v":8},{"$f":"Lite!K86","v":"H"},{"$f":"Lite!Y86","v":1},{"$f":"Lite!B86","v":"SL.74"},{"$f":"Lite!C86","v":"Is standards based federated ID capability available to clients (e.g., SAML, OpenID)?"},{"$f":"Lite!D86","v":"Yes"},{"$f":"Lite!E86","v":5},{"$f":"Lite!F86","v":"We provide the ability to integrate with customer IdP using SAML 2.0, once we connect WalkMe with customer IdP, customer can leverage their authentication mechanism which can include 2 factor authentication.\n\nIn order to connect WalkMe with costumer IdP, you need to provide us your IdP public certificate, the URL for SAML 2.0 authentication and the field of the username we will use for the authentication. The process itself is standard according to SAML 2.0 protocol, and is done along with us once you decide to use this option.\n\nIf you wish to use 2 factor authentication without your IdP, we will fully support federated identity management in version 154 which will be released at the end of 2017."},{"$f":"Lite!G86","v":0},{"$f":"Lite!H86","v":"9.2.1"},{"$f":"Lite!I86","v":"User registration and de-registration"},null,null,null,"N/A"]
[{"$f":"Lite!A87","v":3538},{"$f":"Lite!M87","v":8},{"$f":"Lite!K87","v":"H"},{"$f":"Lite!Y87","v":1},{"$f":"Lite!B87","v":"SL.75"},{"$f":"Lite!C87","v":"Is two factor authentication required to access the production environment containing Scoped Data?"},{"$f":"Lite!D87","v":"Yes"},{"$f":"Lite!E87","v":5},{"$f":"Lite!F87","v":"There is no authentication required for end-users to leverage WalkMe. In order to create content using the WalkMe Editor, content managers must authenticate based on username and password. There is also an option to integrate with the customer's identity provider (IdP) using any SSO based on SAML 2.0, so the customer can utilize two factor authentication."},{"$f":"Lite!G87","v":0},{"$f":"Lite!H87","v":"9.3.1"},{"$f":"Lite!I87","v":"Use of secret authentication information"},null,null,null,"N/A"]
[{"$f":"Lite!A88","v":3543},{"$f":"Lite!M88","v":8},{"$f":"Lite!K88","v":"H"},{"$f":"Lite!Y88","v":1},{"$f":"Lite!B88","v":"SL.76"},{"$f":"Lite!C88","v":"Are staff able to access client Scoped Data? If not, please identify the controls used to prevent this."},{"$f":"Lite!D88","v":"Yes"},{"$f":"Lite!E88","v":5},{"$f":"Lite!F88","v":"The only users with access to the database are DevOps users and production support.  Access to the account in order to configure it, create Walkthroughs together with people from your side, but without database access is possible for WalkMe PS and CSM teams. The process ensures usage of two-factor Authentication, and every action is logged & audited."},{"$f":"Lite!G88","v":"H.3 Logical Access Authorization"},{"$f":"Lite!H88","v":"9.2.3\n9.4.1"},{"$f":"Lite!I88","v":"Management of privileged access rights Information access restriction"},null,null,null,"12.3.10"]
[{"$f":"Lite!A89","v":3554},{"$f":"Lite!M89","v":8},{"$f":"Lite!K89","v":"H"},{"$f":"Lite!Y89","v":1},{"$f":"Lite!B89","v":"SL.77"},{"$f":"Lite!C89","v":"Is there a process which allows the client to specifically list who from the provider will have access to their Scoped Systems and Data?"},{"$f":"Lite!D89","v":"No"},{"$f":"Lite!E89","v":0},{"$f":"Lite!F89","v":"WalkMe defines this, based on our own internal processes, according to the annual risk assessment.\nWalkMe designs and implements controls to mitigate and contain data privacy and security risks through risk assessments, strict role based access controls (need-to and least-privileged principles), Strong MFA based authorization, Segregation of duties, System wide Hardening of hardware devices and applications, Separation of networks, Antivirus & Antimalware, IPS, Network Firewalls & Web application firewalls, continuous efficient awareness training, systematic secure development, periodical access review, periodical vulnerability scans, periodical external penetration tests, automatic integrity checks etc.\nTo reduce the risk of data exfiltration, WalkMe integrates security awareness and best practices into our culture. We consistently evaluate the risks of every interaction with our environments, networks, devices, application, data, and users.\nWe minimize the \"blast radius\" of data exfiltration events through compartmentalization of data.\nWe create redundancy and approvals in system administrator workflows to increase accountability.\nWe use granular permissions and grant access to sensitive data only to those whose job function requires it.\nWe use logging to increase the transparency into the access and movement of data at WalkMe.\nAdditionally, we technically restrict and monitor ingress and egress to machines in WalkMe using networking rules, identity and access management (IAM), and we use a hardened jump server as a bastion host to be used as a single point of access to production data with restrictive DLP controls."},{"$f":"Lite!G89","v":"H.3 Logical Access Authorization"},{"$f":"Lite!H89","v":"9.1.1 9.2.3"},{"$f":"Lite!I89","v":"\tAccess Control Policy\nManagement of privileged access rights"},null,null,null,"N/A"]
[{"$f":"Lite!A90","v":0},{"$f":"Lite!M90","v":9},{"$f":"Lite!K90","v":1},{"$f":"Lite!Y90","v":1},{"$f":"Lite!B90","v":""},{"$f":"Lite!C90","v":"I. Application Security"},{"$f":"Lite!D90","v":0},{"$f":"Lite!E90","v":0},{"$f":"Lite!F90","v":0},{"$f":"Lite!G90","v":0},{"$f":"Lite!H90","v":0},{"$f":"Lite!I90","v":0}]
[{"$f":"Lite!A91","v":4240},{"$f":"Lite!M91","v":9},{"$f":"Lite!K91","v":"I"},{"$f":"Lite!Y91","v":1},{"$f":"Lite!B91","v":"SL.78"},{"$f":"Lite!C91","v":"Are applications used to transmit, process or store Scoped Data?"},{"$f":"Lite!D91","v":"Yes"},{"$f":"Lite!E91","v":5},{"$f":"Lite!F91","v":"Yes. The WalkMe service is used to transmit, process and store Scoped Data.\nPrivacy is at the heart of everything we do, and every decision we make starts with the safety and privacy of your data. It takes a combination of policy, innovative thinking, and a deep respect for your right to privacy.\nData is encrypted both when transmitted (in transit), and while stored (at rest).\nWalkMe complies with GDPR as a data processor in the provision of Walkme’s services to its customers, and can make its Data Processing Addendum (DPA) available for execution.\nWalkMe complies with HIPAA regulations as business associates.\nFor any HIPAA-related systems, WalkMe has a standard Business Associate Addendum (BAA) we present to customers for signature. It takes into account the unique services WalkMe provides and accommodates the WalkMe Shared Responsibility Model. The Business Associate Addendum (BAA) is an WalkMe contract that is required under HIPAA rules to ensure that WalkMe appropriately safeguards protected health information (PHI). The BAA also serves to clarify and limit, as appropriate, the permissible uses and disclosures of PHI by WalkMe, based on the relationship between WalkMe and our customers, and the activities or services being performed by WalkMe.\n"},{"$f":"Lite!G91","v":"I.1 Application Security Program Governance"},{"$f":"Lite!H91","v":0},{"$f":"Lite!I91","v":0}]
[{"$f":"Lite!A92","v":2230},{"$f":"Lite!M92","v":9},{"$f":"Lite!K92","v":"I"},{"$f":"Lite!Y92","v":1},{"$f":"Lite!B92","v":"SL.79"},{"$f":"Lite!C92","v":"Is a web site supported, hosted or maintained that has access to Scoped Systems and Data?"},{"$f":"Lite!D92","v":"Yes"},{"$f":"Lite!E92","v":5},{"$f":"Lite!F92","v":"Content is created using the WalkMe Editor, which in turn gathers the required Metadata to present the Walkthroughs via the WalkMe Player. During the publishing process, static JavaScript files are generated and the information is then stored on a private dedicated AWS S3 Bucket."},{"$f":"Lite!G92","v":0},{"$f":"Lite!H92","v":0},{"$f":"Lite!I92","v":0},null,null,null,"N/A",null,"N/A"]
[{"$f":"Lite!A93","v":4241},{"$f":"Lite!M93","v":9},{"$f":"Lite!K93","v":"I"},{"$f":"Lite!Y93","v":1},{"$f":"Lite!B93","v":"SL.80"},{"$f":"Lite!C93","v":"Are Web Servers used for transmitting, processing or storing Scoped Data? If yes, for all server platforms is/are:"},{"$f":"Lite!D93","v":"Yes"},{"$f":"Lite!E93","v":5},{"$f":"Lite!F93","v":"WalkMe is a SaaS."},{"$f":"Lite!G93","v":0},{"$f":"Lite!H93","v":0},{"$f":"Lite!I93","v":0}]
[{"$f":"Lite!A94","v":4245},{"$f":"Lite!M94","v":9},{"$f":"Lite!K94","v":"I"},{"$f":"Lite!Y94","v":1},{"$f":"Lite!B94","v":"SL.81"},{"$f":"Lite!C94","v":"Is HTTPS enabled for all web pages used as part of the scoped service?"},{"$f":"Lite!D94","v":"Yes"},{"$f":"Lite!E94","v":5},{"$f":"Lite!F94","v":"Data encryption in transit – WalkMe follows TLS Deployment Best Practices, based on NIST and FISMA standards, All traffic between servers and users is done over TLS protocol. Settings are signed with a certificate using RSA.\n\nThe authentication is done over TLS using private asymmetric keys, where the cipher suites are AES with RSA in various key sizes (for proper balance between compatibility for supporting different browsers and versions, and security best practices).\n\nSecure HTTPS connection is enforced by proper implementing HSTS with long age, and preload lists where applicable, to mitigate SSLStrip attacks.\n\nThe cipher suites supported are all FIPS 140-2 compliant (as specified by the Federal Information Processing Standard), as we operate using only FIPS 140-2 validated cryptographic modules.\n\nOur first offered ciphersuite is using AES256 with SHA384 for TLS 1.2 protocol. Our careful configuration of TLS first offered ciphersuites provides additional privacy-related properties such as forward secrecy, ensuring that any future disclosure of encryption keys cannot be used to decrypt any TLS communications recorded in the past. The oldest secure protocol supported is TLS 1.0, and the weakest ciphersuite is \"TLS_RSA_WITH_AES_128_CBC_SHA\". The application can be configured to limit and restrict to a custom set what cipher suites are enabled.\n\nProvided a list of all ciphers currently in use:\nWalkMe Player Server:\nTLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\nTLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256\nTLS_ECDHE_RSA_WITH_AES_128_CBC_SHA\nTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\nTLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384\nTLS_ECDHE_RSA_WITH_AES_256_CBC_SHA\nTLS_RSA_WITH_AES_128_GCM_SHA256\nTLS_RSA_WITH_AES_128_CBC_SHA256\nTLS_RSA_WITH_AES_128_CBC_SHA\nTLS_RSA_WITH_AES_256_GCM_SHA384\nTLS_RSA_WITH_AES_256_CBC_SHA256\nTLS_RSA_WITH_AES_256_CBC_SHA\n\nWalkMe Editor & CDN:\nTLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384\nTLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256\nTLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384\nTLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\nTLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256\nTLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256\nTLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384\nTLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256\nTLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384\nTLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256\nTLS_ECDHE_RSA_WITH_AES_256_CBC_SHA\nTLS_ECDHE_RSA_WITH_AES_128_CBC_SHA\nTLS_RSA_WITH_AES_256_GCM_SHA384\nTLS_RSA_WITH_AES_128_GCM_SHA256\nTLS_RSA_WITH_AES_256_CBC_SHA256\nTLS_RSA_WITH_AES_128_CBC_SHA256\nTLS_RSA_WITH_AES_256_CBC_SHA\nTLS_RSA_WITH_AES_128_CBC_SHA\n\n*WalkMe Editor & CDN prefer ChaCha20 suites for mobile device clients that don't have AES-NI acceleration hardware (e.g., Android devices) to enable the best performance.\n**WalkMe is in final stages for transition to TLS 1.3 encryption."},{"$f":"Lite!G94","v":0},{"$f":"Lite!H94","v":0},{"$f":"Lite!I94","v":0}]
[{"$f":"Lite!A95","v":4254},{"$f":"Lite!M95","v":9},{"$f":"Lite!K95","v":"I"},{"$f":"Lite!Y95","v":1},{"$f":"Lite!B95","v":"SL.82"},{"$f":"Lite!C95","v":"All available high-risk security patches applied and verified at least monthly?"},{"$f":"Lite!D95","v":"Yes"},{"$f":"Lite!E95","v":5},{"$f":"Lite!F95","v":"We have vulnerability & patch management procedure. We are using WSUS to patch & validate that workstations are regularly patched. On production servers we patch once a month, aside from high/critical security updates that are installed immediately. We have implemented Microsoft SCCM (System Center Configuration Manager) for in-office patch management."},{"$f":"Lite!G95","v":0},{"$f":"Lite!H95","v":0},{"$f":"Lite!I95","v":0}]
[{"$f":"Lite!A96","v":4260},{"$f":"Lite!M96","v":9},{"$f":"Lite!K96","v":"I"},{"$f":"Lite!Y96","v":1},{"$f":"Lite!B96","v":"SL.83"},{"$f":"Lite!C96","v":"Are third party alert services used to keep up to date with the latest vulnerabilities?"},{"$f":"Lite!D96","v":"Yes"},{"$f":"Lite!E96","v":5},{"$f":"Lite!F96","v":"We get notifications about vulnerabilities from various sources (SANS, CERT, etc.), and perform patching accordingly. We also work with security vendors, local ISACs and other security partners to gather as much information as possible. Our servers are hardened, patched and protected by an antimalware software installed on them."},{"$f":"Lite!G96","v":0},{"$f":"Lite!H96","v":0},{"$f":"Lite!I96","v":0}]
[{"$f":"Lite!A97","v":4263},{"$f":"Lite!M97","v":9},{"$f":"Lite!K97","v":"I"},{"$f":"Lite!Y97","v":1},{"$f":"Lite!B97","v":"SL.84"},{"$f":"Lite!C97","v":"Events relevant to supporting incident investigation regularly reviewed using a specific methodology to uncover potential incidents?"},{"$f":"Lite!D97","v":"Yes"},{"$f":"Lite!E97","v":5},{"$f":"Lite!F97","v":0},{"$f":"Lite!G97","v":0},{"$f":"Lite!H97","v":0},{"$f":"Lite!I97","v":0},null,"Monitoring and Analyzing: Monitoring and Analyzing","D2.MA.MA.B.2"]
[{"$f":"Lite!A98","v":4268},{"$f":"Lite!M98","v":9},{"$f":"Lite!K98","v":"I"},{"$f":"Lite!Y98","v":1},{"$f":"Lite!B98","v":"SL.85"},{"$f":"Lite!C98","v":"Operating system and application logs relevant to supporting incident investigation protected against modification, deletion, and/or inappropriate access?"},{"$f":"Lite!D98","v":"Yes"},{"$f":"Lite!E98","v":5},{"$f":"Lite!F98","v":0},{"$f":"Lite!G98","v":0},{"$f":"Lite!H98","v":0},{"$f":"Lite!I98","v":0}]
[{"$f":"Lite!A99","v":2058},{"$f":"Lite!M99","v":9},{"$f":"Lite!K99","v":"I"},{"$f":"Lite!Y99","v":1},{"$f":"Lite!B99","v":"SL.86"},{"$f":"Lite!C99","v":"Is application development performed?"},{"$f":"Lite!D99","v":"Yes"},{"$f":"Lite!E99","v":5},{"$f":"Lite!F99","v":0},{"$f":"Lite!G99","v":"I. Application Security"},{"$f":"Lite!H99","v":0},{"$f":"Lite!I99","v":0},null,"Preventative Controls: Secure Coding\nDetective Controls: Threat and Vulnerability Detection","D3.PC.SC.B.3\n\nD3.DC.TVD.B.1","N/A",null,"AI2.4, AI7.4, AI7.6, DS11.3, DS11.6"]
[{"$f":"Lite!A100","v":3920},{"$f":"Lite!M100","v":9},{"$f":"Lite!K100","v":"I"},{"$f":"Lite!Y100","v":1},{"$f":"Lite!B100","v":"SL.87"},{"$f":"Lite!C100","v":"Is there a secure software development lifecycle policy (including mobile software applications) that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"Lite!D100","v":"Yes"},{"$f":"Lite!E100","v":5},{"$f":"Lite!F100","v":0},{"$f":"Lite!G100","v":"I.2 Secure Systems Development Lifecycle (SDLC) Policies, Standards and Procedures"},{"$f":"Lite!H100","v":"14.2.1 "},{"$f":"Lite!I100","v":"Secure development policy"},null,null,null,"N/A","3.C.3\n3.C.5",null,"PR.IP-1\nPR.IP-2\nPR.IP-12","164.306 (b)(2)(ii)"]
[{"$f":"Lite!A101","v":2182},{"$f":"Lite!M101","v":9},{"$f":"Lite!K101","v":"I"},{"$f":"Lite!Y101","v":1},{"$f":"Lite!B101","v":"SL.88"},{"$f":"Lite!C101","v":"Is development, test, and staging environment separate from the production environment? If so, how are they segmented:"},{"$f":"Lite!D101","v":"Yes"},{"$f":"Lite!E101","v":5},{"$f":"Lite!F101","v":"We have Corporate, Dev, QA, Staging and Production environments. The environments are physically and logically separate, except for the Staging and Production, which are only logically separate. The network is built into several tiers (5 segments), where each type of servers has their own segment and access rules. DMZ is obviously separated from internal segments such as Database, but also from other external servers. Our servers are hosted on AWS infrastructure, and the segmentation is enforced based on AWS's segments within a VPC. The VPC is a closed network with segmentation and without access from the internet to internal segments."},{"$f":"Lite!G101","v":0},{"$f":"Lite!H101","v":"12.1.4"},{"$f":"Lite!I101","v":"Separation of development, testing and operational environments"},null,"Preventive Controls: Access and Data Management","D3.PC.ADM.B.10","6.4.1\n6.4.3",null,"N/A","PR.DS-7"]
[{"$f":"Lite!A102","v":2059},{"$f":"Lite!M102","v":9},{"$f":"Lite!K102","v":"I"},{"$f":"Lite!Y102","v":1},{"$f":"Lite!B102","v":"SL.89"},{"$f":"Lite!C102","v":"Is there a formal Software Development Life Cycle (SDLC) process?"},{"$f":"Lite!D102","v":"Yes"},{"$f":"Lite!E102","v":5},{"$f":"Lite!F102","v":"According to WalkMe's SDLC (Secure Development Lifecycle) policy, Security is part of the SDLC in all phases of the cycle – initiation, planning, design, development & coding, testing & QA, implementation, evaluation, maintenance & support, and disposal.\nThe Security Team is part of the design, and The CISO signs off new features.\nWe have a rigorous testing and acceptance procedure for code whether custom, outsourced, packaged application code and third-party apps (components) used in our services.\nThis applies to all In house, purchased or open source development. For any open source code in use, all code is checked for compliance, version control.\nIn order to prevent using components with known vulnerabilities, we identify all public components and the versions we are using, including all dependencies. (e.g., the versions plugin). We monitor the security of these components in public databases, project mailing lists, and security mailing lists, and keep them up to date. Our Policy Governs component use according to our SDLC, passing security tests, and acceptable licenses.\nOur coding standards are set according to best practices (especially in light of the OWASP top 10 web vulnerabilities).\nSecurity testing is part of the testing cycle, making sure that new features are not uploaded to production with vulnerabilities.\nThe involvement of security in each of these stages is done accordingly – in the early stages it's meetings and design reviews.\nWalkMe SDLC is agile. Secure coding is done by our developers. The developers attend annual secure coding training.\nManual peer code review is done on every line of code before its check-in into the source code repository, and in this review the reviewer checks for security issues as well as code quality. \nTesting also checks for security related flaws, according to the feature/module tested.\nWe validate all input types coming from the user side, utilize anti cross-site attacks measures in place, manage sessions according to best practices etc."},{"$f":"Lite!G102","v":"I.2 Secure Systems Development Lifecycle (SDLC) Policies, Standards and Procedures"},{"$f":"Lite!H102","v":"14.2.1 "},{"$f":"Lite!I102","v":"Secure development policy"},null,"Preventative Controls: Secure Coding","D3.PC.SC.B.1",6.3,null,"AI2.4, AI7.4, AI7.6, DS11.3, DS11.6","PR.IP-2\nDE.CM-7"]
[{"$f":"Lite!A103","v":2670},{"$f":"Lite!M103","v":9},{"$f":"Lite!K103","v":"I"},{"$f":"Lite!Y103","v":1},{"$f":"Lite!B103","v":"SL.90"},{"$f":"Lite!C103","v":"Are change control procedures required for all changes to the production environment?"},{"$f":"Lite!D103","v":"Yes"},{"$f":"Lite!E103","v":5},{"$f":"Lite!F103","v":"We have a change management policy. Changes to the organization, business processes, information processing facilities and systems that affect information security are controlled.\nThe relevant party at the company needs to fill a 'Change Request' form that is being reviewed and approved by the CISO and the relevant parties if required."},{"$f":"Lite!G103","v":"G.1 Change Control"},{"$f":"Lite!H103","v":"9.4.5.g"},{"$f":"Lite!I103","v":"Access control to program source code"},null,null,null,6.4,null,"AI2.4, AI7.4, AI7.6, DS11.3, DS11.6","PR.IP-3"]
[{"$f":"Lite!A104","v":2169},{"$f":"Lite!M104","v":9},{"$f":"Lite!K104","v":"I"},{"$f":"Lite!Y104","v":1},{"$f":"Lite!B104","v":"SL.91"},{"$f":"Lite!C104","v":"Is Scoped Systems and Data ever used in the test, development, or QA environments? If yes, is:"},{"$f":"Lite!D104","v":"No"},{"$f":"Lite!E104","v":0},{"$f":"Lite!F104","v":0},{"$f":"Lite!G104","v":0},{"$f":"Lite!H104","v":"14.3.1 "},{"$f":"Lite!I104","v":"Protection of test data"},null,null,null,"6.4.3",null,"AI3.3, DS2.4, DS9.1, DS9.2, DS11.6"]
[{"$f":"Lite!A105","v":2204},{"$f":"Lite!M105","v":9},{"$f":"Lite!K105","v":"I"},{"$f":"Lite!Y105","v":1},{"$f":"Lite!B105","v":"SL.92"},{"$f":"Lite!C105","v":"Is there a documented change management / change control process? If yes, does it include:"},{"$f":"Lite!D105","v":"Yes"},{"$f":"Lite!E105","v":5},{"$f":"Lite!F105","v":"We have a change management policy. Changes to the organization, business processes, information processing facilities and systems that affect information security are controlled.\nThe relevant party at the company needs to fill a 'Change Request' form that is being reviewed and approved by the CISO and the relevant parties if required."},{"$f":"Lite!G105","v":"G.1 Change Control"},{"$f":"Lite!H105","v":"14.2.2 "},{"$f":"Lite!I105","v":"System change control procedures"},null,null,null,6.4,null,"AI2.6, AI6.2, AI6.3, AI7.2"]
[{"$f":"Lite!A106","v":2684},{"$f":"Lite!M106","v":9},{"$f":"Lite!K106","v":"I"},{"$f":"Lite!Y106","v":1},{"$f":"Lite!B106","v":"SL.93"},{"$f":"Lite!C106","v":"Are compilers, editors or other development tools present in the production environment?"},{"$f":"Lite!D106","v":"No"},{"$f":"Lite!E106","v":0},{"$f":"Lite!F106","v":"No development tools are installed on production environment."},{"$f":"Lite!G106","v":"I.13 Production Application Vulnerability Monitoring Process"},{"$f":"Lite!H106","v":"12.1.4.e"},{"$f":"Lite!I106","v":"Separation of development, testing and operational environments"},null,null,null,"N/A",null,"PO4.11, AI3.4, AI7.4"]
[{"$f":"Lite!A107","v":3936},{"$f":"Lite!M107","v":9},{"$f":"Lite!K107","v":"I"},{"$f":"Lite!Y107","v":1},{"$f":"Lite!B107","v":"SL.94"},{"$f":"Lite!C107","v":"Is a secure code review performed at least annually?"},{"$f":"Lite!D107","v":"Yes"},{"$f":"Lite!E107","v":5},{"$f":"Lite!F107","v":"Static source code analysis is integrated at every step of the SDLC using Checkmarx as our Application Security Testing framework. The process is designed to detect and reduce security vulnerabilities, risks, and gaps at the development stage, by remediating issues as they arise, to improve security features and functions such as authentication, encryption or auditing, and to integrate with the enterprise security infrastructure."},{"$f":"Lite!G107","v":"I.2 Secure Systems Development Lifecycle (SDLC) Policies, Standards and Procedures"},{"$f":"Lite!H107","v":"14.2.1 "},{"$f":"Lite!I107","v":"Secure development policy"},null,"Preventative Controls: Secure Coding","D3.PC.SC.B.2","6.3.2",null,null,null,"164.306 (b)(2)(ii)"]
[{"$f":"Lite!A108","v":3970},{"$f":"Lite!M108","v":9},{"$f":"Lite!K108","v":"I"},{"$f":"Lite!Y108","v":1},{"$f":"Lite!B108","v":"SL.95"},{"$f":"Lite!C108","v":"Is each release subject to a full secure code review?"},{"$f":"Lite!D108","v":"Yes"},{"$f":"Lite!E108","v":5},{"$f":"Lite!F108","v":"Manual peer code review is done on every line of code before its check-in into the source code repository, and in this review the reviewer checks for security issues as well as code quality. \nTesting also checks for security related flaws, according to the feature/module tested.\nWe validate all input types coming from the user side, utilize anti cross-site attacks measures in place, manage sessions according to best practices etc."},{"$f":"Lite!G108","v":"I.7 Secure Code Review"},{"$f":"Lite!H108","v":"14.2.1"},{"$f":"Lite!I108","v":"Secure development policy"},null,"Preventative Controls: Secure Coding","D3.PC.SC.B.2","N/A",null,null,null,"164.306 (b)(2)(ii)"]
[{"$f":"Lite!A109","v":3990},{"$f":"Lite!M109","v":9},{"$f":"Lite!K109","v":"I"},{"$f":"Lite!Y109","v":1},{"$f":"Lite!B109","v":"SL.96"},{"$f":"Lite!C109","v":"Are applications analyzed on a regular basis to determine their vulnerability against recent attacks?"},{"$f":"Lite!D109","v":"Yes"},{"$f":"Lite!E109","v":5},{"$f":"Lite!F109","v":"WalkMe performs monthly internal vulnerability assessments, and Annual External Penetration Tests, both against the applications and infrastructure of all environments. Summary of the latest Report is available upon request. The vulnerability scans that are performed monthly are Using industry leading Web & Network Vulnerability Scanners, including, but not limited to: Tenable.io Vulnerability Management (Formerly Nessus Cloud Vulnerability Scanner), OpenVAS, AlienVault USM, Nmap, and Burp Web Vulnerability Scanner. Findings are being valiated, assessed, classified and prioritized. All vulnerabilities classified as Critical or High, are remediated immediately. Remaining Identified vulnerabilities are examined and treated, according to Internal Security evaluation, which is done by the security team."},{"$f":"Lite!G109","v":"I.10 QA_UAT Process"},{"$f":"Lite!H109","v":"12.2.1"},{"$f":"Lite!I109","v":"Controls against malware"},null,null,null,"11.2.2",null,null,"ID.RA-2\nDE.CM-1","164.306 (b)(2)(ii)"]
[{"$f":"Lite!A110","v":3394},{"$f":"Lite!M110","v":9},{"$f":"Lite!K110","v":"I"},{"$f":"Lite!Y110","v":1},{"$f":"Lite!B110","v":"SL.97"},{"$f":"Lite!C110","v":"Is there a formal development methodology in operation? If yes, which groups does it include?:"},{"$f":"Lite!D110","v":"Yes"},{"$f":"Lite!E110","v":5},{"$f":"Lite!F110","v":"According to WalkMe's SDLC (Secure Development Lifecycle) policy, Security is part of the SDLC in all phases of the cycle – initiation, planning, design, development & coding, testing & QA, implementation, evaluation, maintenance & support, and disposal. Development, QA, Security, and DevOPS are included in the process."},{"$f":"Lite!G110","v":"I.16 Secure Systems Development Lifecycle (SDLC) Reviews"},{"$f":"Lite!H110","v":"12.5.1"},{"$f":"Lite!I110","v":"Control of Operational Software"},null,null,null,"N/A"]
[{"$f":"Lite!A111","v":3826},{"$f":"Lite!M111","v":9},{"$f":"Lite!K111","v":"I"},{"$f":"Lite!Y111","v":1},{"$f":"Lite!B111","v":"SL.98"},{"$f":"Lite!C111","v":"Are mobile applications that access Scoped Systems and Data developed?"},{"$f":"Lite!D111","v":"Yes"},{"$f":"Lite!E111","v":5},{"$f":"Lite!F111","v":"When an End User uses an application with WalkMe Mobile, we collect a randomly generated identifier which by default does not contain Personal Information but which may link to Personal Information if Customer actively chooses for it to do so; timestamp; phone number; masked IP address; and general location information, based on algorithms, to guess if you are using the application from home or from work, however this information does not include your precise geolocation. In addition, we retain IP addresses in logs for security purposes. If you are a Customer who wants to utilize WalkMe Mobile on a mobile application that you own, control, license, or use, we may collect the name of the application and version of the application."},{"$f":"Lite!G111","v":0},{"$f":"Lite!H111","v":0},{"$f":"Lite!I111","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A112","v":0},{"$f":"Lite!M112","v":10},{"$f":"Lite!K112","v":1},{"$f":"Lite!Y112","v":1},{"$f":"Lite!B112","v":""},{"$f":"Lite!C112","v":"J. Incident Event and Communications Management"},{"$f":"Lite!D112","v":0},{"$f":"Lite!E112","v":0},{"$f":"Lite!F112","v":0},{"$f":"Lite!G112","v":0},{"$f":"Lite!H112","v":0},{"$f":"Lite!I112","v":0}]
[{"$f":"Lite!A113","v":2241},{"$f":"Lite!M113","v":10},{"$f":"Lite!K113","v":"J"},{"$f":"Lite!Y113","v":1},{"$f":"Lite!B113","v":"SL.99"},{"$f":"Lite!C113","v":"Is there an Incident Management Program that has been approved by management, communicated to constituents and an owner to maintain and review the program? If yes, does the program include:"},{"$f":"Lite!D113","v":"Yes"},{"$f":"Lite!E113","v":5},{"$f":"Lite!F113","v":"WalkMe maintains a documented incident management policy that has been approved by management, communicated to appropriate constituents, updated by the security team and reapproved annually by management. According to our Security Incident Management Policy, Evidences are collected directly from the source log files and systems. Evidences are kept safe and inaccessible to anyone aside from the response team. The process of notifying security incidents is described in the incident management policy. In case of an incident, communication will be done to all affected customers as soon as the scope has been identified. The communication is managed by the risk committee and will be done using the dedicated customer success manager within 48 Hours."},{"$f":"Lite!G113","v":"J.1 Information Security / Information Technology Incident Management - Policy and Procedures Content"},{"$f":"Lite!H113","v":16},{"$f":"Lite!I113","v":" Information security incident management"},null,"Incident Resilience Planning and Strategy: Planning","D5.IR.PSP.B.1","11.1.2\n12.10","3.C.3","N/A",null,"164.308 (a)(6)(i)"]
[{"$f":"Lite!A114","v":3234},{"$f":"Lite!M114","v":10},{"$f":"Lite!K114","v":"J"},{"$f":"Lite!Y114","v":1},{"$f":"Lite!B114","v":"SL.100"},{"$f":"Lite!C114","v":"Privacy Incidents?"},{"$f":"Lite!D114","v":"Yes"},{"$f":"Lite!E114","v":5},{"$f":"Lite!F114","v":"WalkMe is certified under the EU-US privacy shield and has all the necessary processes in place to comply with the currently in force EU directive so using WalkMe for data subjects located in the EU shouldn’t be a problem. We've updated our privacy policy, which was audited by TRUSTe (TrustArc), to reflect our current status. In order to meet with the new requirements outlined in the EU US Privacy Shield Privacy Principles, WalkMe uses TRUSTe Privacy Dispute Resolution Service to facilitate consumers’ privacy complaints through an online submission mechanism. see https://www.walkme.com/privacy-policy/"},{"$f":"Lite!G114","v":"P.8 Privacy Incident Notification and Response Management"},{"$f":"Lite!H114","v":16.100000000000001},{"$f":"Lite!I114","v":"Management of information security incidents and improvements"},null,null,null,"N/A"]
[{"$f":"Lite!A115","v":2246},{"$f":"Lite!M115","v":10},{"$f":"Lite!K115","v":"J"},{"$f":"Lite!Y115","v":1},{"$f":"Lite!B115","v":"SL.101"},{"$f":"Lite!C115","v":"Is there a formal Incident Response Plan?"},{"$f":"Lite!D115","v":"Yes"},{"$f":"Lite!E115","v":5},{"$f":"Lite!F115","v":"In an event of an incident, customer should contact their dedicated customer success manager, who will pass the information to the CISO. The SLA is provided in the contract and is part of the general terms. Security related incidents have the same SLA. The definition of security issue priority depends on the damage potential of the issue and its scope. Changes for critical or high risks are implemented ASAP. Changes for lower risk security concerns are discussed and put into the workplans."},{"$f":"Lite!G115","v":"J. Incident Event and Communications Management"},{"$f":"Lite!H115","v":"16.1.1.a.1"},{"$f":"Lite!I115","v":"Responsibilities and procedures"},null,"Detection, Response, and Mitigation: Detection","D5.DRM.D.B.3","12.10.1","3.C.3","PO9.3, DS5.6, DS8.2","PR.IP-9\nRS.RP-1\nRS.AN-2","164.308 (a)(6)(ii)"]
[{"$f":"Lite!A116","v":3426},{"$f":"Lite!M116","v":10},{"$f":"Lite!K116","v":"J"},{"$f":"Lite!Y116","v":1},{"$f":"Lite!B116","v":"SL.102"},{"$f":"Lite!C116","v":"Is there a 24x7x365 staffed phone number available to clients to report security incidents?"},{"$f":"Lite!D116","v":"Yes"},{"$f":"Lite!E116","v":5},{"$f":"Lite!F116","v":"WalkMe 24/7 Support line:\n1-855-4-WALKME (925563)\n\nIn addition, There is a live 24/7 Security operations center (SOC) team watching our SIEM alerts that notifies us in case alerts are fired."},{"$f":"Lite!G116","v":"J. Information Security Incident Management\nP.8 Privacy Incident Notification and Response Management"},{"$f":"Lite!H116","v":"15.1.1.h "},{"$f":"Lite!I116","v":"Information security policy for supplier relationships"},null,"Incident Resilience Planning and Strategy: Planning","D5.IR.PSP.B.2","N/A",null,null,"WP.1.E.3, WP.1.G.10"]
[{"$f":"Lite!A117","v":0},{"$f":"Lite!M117","v":11},{"$f":"Lite!K117","v":1},{"$f":"Lite!Y117","v":1},{"$f":"Lite!B117","v":""},{"$f":"Lite!C117","v":"K. Business Resiliency"},{"$f":"Lite!D117","v":0},{"$f":"Lite!E117","v":0},{"$f":"Lite!F117","v":0},{"$f":"Lite!G117","v":0},{"$f":"Lite!H117","v":0},{"$f":"Lite!I117","v":0}]
[{"$f":"Lite!A118","v":2719},{"$f":"Lite!M118","v":11},{"$f":"Lite!K118","v":"K"},{"$f":"Lite!Y118","v":1},{"$f":"Lite!B118","v":"SL.103"},{"$f":"Lite!C118","v":"Is there an established Business Resiliency program that has been approved by management and communicated to appropriate constituents?"},{"$f":"Lite!D118","v":"Yes"},{"$f":"Lite!E118","v":5},{"$f":"Lite!F118","v":0},{"$f":"Lite!G118","v":"K.1 Business Resiliency Governance"},{"$f":"Lite!H118","v":5.2},{"$f":"Lite!I118","v":"Management Commitment"},null,"Risk Management: Risk Management Program\nIncident Resilience Planning and Strategy: Planning","D1.RM.RMP.B.1\n\nD5.IR.PSP.B.6","N/A","1.B.4\n3.C.4","N/A","ID.BE-5\nPR.IP-9","164.308 (a)(7)"]
[{"$f":"Lite!A119","v":2329},{"$f":"Lite!M119","v":11},{"$f":"Lite!K119","v":"K"},{"$f":"Lite!Y119","v":1},{"$f":"Lite!B119","v":"SL.104"},{"$f":"Lite!C119","v":"Has a Business Impact Analysis been conducted?"},{"$f":"Lite!D119","v":"Yes"},{"$f":"Lite!E119","v":5},{"$f":"Lite!F119","v":0},{"$f":"Lite!G119","v":"K.2 Business Impact Analysis"},{"$f":"Lite!H119","v":"8.2.2"},{"$f":"Lite!I119","v":"Business impact analysis"},null,"Incident Resilience Planning and Strategy: Planning","D5.IR.PSP.B.5","N/A","3.B","N/A","ID.BE-4\nRS.AN-2","164.308 (a)(7)"]
[{"$f":"Lite!A120","v":4038},{"$f":"Lite!M120","v":11},{"$f":"Lite!K120","v":"K"},{"$f":"Lite!Y120","v":1},{"$f":"Lite!B120","v":"SL.105"},{"$f":"Lite!C120","v":"Is there a formal process focused on identifying and addressing risks of disruptive incidents to the organization?"},{"$f":"Lite!D120","v":"Yes"},{"$f":"Lite!E120","v":5},{"$f":"Lite!F120","v":0},{"$f":"Lite!G120","v":"K.3 Risk Assessment"},{"$f":"Lite!H120","v":"8.2.3"},{"$f":"Lite!I120","v":"Risk assessment"},null,null,null,"N/A","1.A.3\n3.B","PO3.1, DS4.4, DS4.5, DS4.6, DS4.7, DS4.10",null,"164.308 (a)(7)"]
[{"$f":"Lite!A121","v":4042},{"$f":"Lite!M121","v":11},{"$f":"Lite!K121","v":"K"},{"$f":"Lite!Y121","v":1},{"$f":"Lite!B121","v":"SL.106"},{"$f":"Lite!C121","v":"Are specific response and recovery strategies defined for the prioritized activities?"},{"$f":"Lite!D121","v":"Yes"},{"$f":"Lite!E121","v":5},{"$f":"Lite!F121","v":0},{"$f":"Lite!G121","v":"K.4 Business Activity level Recovery Planning"},{"$f":"Lite!H121","v":"8.3.1"},{"$f":"Lite!I121","v":"Determination and selection"},null,null,null,"N/A","3.A.1","N/A","RS.IM-2","164.308 (a)(7)"]
[{"$f":"Lite!A122","v":4049},{"$f":"Lite!M122","v":11},{"$f":"Lite!K122","v":"K"},{"$f":"Lite!Y122","v":1},{"$f":"Lite!B122","v":"SL.107"},{"$f":"Lite!C122","v":"Are formal business continuity procedures developed and documented?"},{"$f":"Lite!D122","v":"Yes"},{"$f":"Lite!E122","v":5},{"$f":"Lite!F122","v":"We Have BCP. In summary, our BCP relies on using the AWS Availability Zones for servers' redundancy, and the redundancy of infrastructure in our offices."},{"$f":"Lite!G122","v":"K.4 Business Activity level Recovery Planning"},{"$f":"Lite!H122","v":8.4},{"$f":"Lite!I122","v":"Establish and implement business continuity procedures"},null,null,null,"N/A",null,"N/A",null,"164.308 (a)(7)"]
[{"$f":"Lite!A123","v":4054},{"$f":"Lite!M123","v":11},{"$f":"Lite!K123","v":"K"},{"$f":"Lite!Y123","v":1},{"$f":"Lite!B123","v":"SL.108"},{"$f":"Lite!C123","v":"Has senior management assigned the responsibility for the overall management of the response and recovery efforts?"},{"$f":"Lite!D123","v":"Yes"},{"$f":"Lite!E123","v":5},{"$f":"Lite!F123","v":0},{"$f":"Lite!G123","v":"K.1 Business Resiliency Governance"},{"$f":"Lite!H123","v":0},{"$f":"Lite!I123","v":0},null,null,null,"N/A",null,"PO3.1, PO9.1, PO9.2, DS4.1, DS4.3, DS4.8, DS8.3","RS.CO-4\nRC.CO-3","164.308 (a)(7)"]
[{"$f":"Lite!A124","v":2286},{"$f":"Lite!M124","v":11},{"$f":"Lite!K124","v":"K"},{"$f":"Lite!Y124","v":1},{"$f":"Lite!B124","v":"SL.109"},{"$f":"Lite!C124","v":"Is there a periodic (at least annual) review of your Business Resiliency Program?"},{"$f":"Lite!D124","v":"Yes"},{"$f":"Lite!E124","v":5},{"$f":"Lite!F124","v":0},{"$f":"Lite!G124","v":"K.6 Exercising"},{"$f":"Lite!H124","v":"8.4.1"},{"$f":"Lite!I124","v":"Establish and implement business continuity procedures"},null,null,null,null,null,null,null,"164.308 (a)(7)"]
[{"$f":"Lite!A125","v":2729},{"$f":"Lite!M125","v":11},{"$f":"Lite!K125","v":"K"},{"$f":"Lite!Y125","v":1},{"$f":"Lite!B125","v":"SL.110"},{"$f":"Lite!C125","v":"Are there any dependencies on critical third party service providers?"},{"$f":"Lite!D125","v":"Yes"},{"$f":"Lite!E125","v":5},{"$f":"Lite!F125","v":0},{"$f":"Lite!G125","v":"K.2 Business Impact Analysis"},{"$f":"Lite!H125","v":"8.1\n8.3\n8.3.1\n8.44"},{"$f":"Lite!I125","v":"Operational Planning and Control\n\nBusiness continuity strategy\n\nDetermination and selection\n\nBusiness continuity plans"},"Strategic Considerations - Third Party Management. Line 124",null,null,null,null,null,null,"164.308 (a)(7)"]
[{"$f":"Lite!A126","v":2343},{"$f":"Lite!M126","v":11},{"$f":"Lite!K126","v":"K"},{"$f":"Lite!Y126","v":1},{"$f":"Lite!B126","v":"SL.111"},{"$f":"Lite!C126","v":"Is there a formal, documented exercise and testing program in place?"},{"$f":"Lite!D126","v":"Yes"},{"$f":"Lite!E126","v":5},{"$f":"Lite!F126","v":"We Annually DR test Servers and DB's, both production env and corporate offices.\nThe last Production DR test was performed on WalkMe service at 18th of July 2016.\nThe last San Francisco offices DR test was performed on WalkMe service at 26th of September 2016.\nThe last Tel-Aviv offices DR test was performed on WalkMe service at 22nd of March 2017."},{"$f":"Lite!G126","v":"K.6 Exercising"},{"$f":"Lite!H126","v":8.5},{"$f":"Lite!I126","v":"Exercising and testing"},"Testing with Third Party TSPs lines 236-237",null,null,null,null,null,null,"164.308 (a)(7)"]
[{"$f":"Lite!A127","v":2305},{"$f":"Lite!M127","v":11},{"$f":"Lite!K127","v":"K"},{"$f":"Lite!Y127","v":1},{"$f":"Lite!B127","v":"SL.112"},{"$f":"Lite!C127","v":"Is there an Influenza Pandemic / Infectious Disease Outbreak Plan?"},{"$f":"Lite!D127","v":"Yes"},{"$f":"Lite!E127","v":5},{"$f":"Lite!F127","v":"Supporting and maintaining our environment can be securely done from remote. The infrastructure for working remotely is ready and deployed. Moreover, we make sure to not have any person as the single point of knowledge or access."},{"$f":"Lite!G127","v":"K.7 Infectious Disease Planning"},{"$f":"Lite!H127","v":0},{"$f":"Lite!I127","v":0},null,null,null,null,null,null,null,"164.308 (a)(7)"]
[{"$f":"Lite!A128","v":3602},{"$f":"Lite!M128","v":11},{"$f":"Lite!K128","v":"K"},{"$f":"Lite!Y128","v":1},{"$f":"Lite!B128","v":"SL.113"},{"$f":"Lite!C128","v":"Is there a specific Recovery Time Objective (RTO)? If yes, what is it?"},{"$f":"Lite!D128","v":"Yes"},{"$f":"Lite!E128","v":5},{"$f":"Lite!F128","v":"Our DR approach is based on the AWS availability zones. Using it we deploy our service on 2 data centers and so if one data center fails, the service still works. In case 2 data centers fail, and the entire region becomes unavailable, we will be able to get our service back up and running within 4 hours on our predefined secondary region in us-west-2. We guarantee 99.99% uptime for the WalkMe player which serves the end users. It important to mention that even in the rare & unlikely event that the service is down/unavailable, the walkthroughs will just not appear on the screen for the end-user. It does not decrease application/website usability. No error message will be displayed and the application/website won't be affected. This is made possible is by design, since WalkMe loads asynchronously to the page, to ensure not to affect load time or performance. By doing so, we create a fully redundant setup and reach RPO and RTO of 0."},{"$f":"Lite!G128","v":0},{"$f":"Lite!H128","v":"17.1.2"},{"$f":"Lite!I128","v":"Implementing information security continuity"},null,null,null,"N/A"]
[{"$f":"Lite!A129","v":3632},{"$f":"Lite!M129","v":11},{"$f":"Lite!K129","v":"K"},{"$f":"Lite!Y129","v":1},{"$f":"Lite!B129","v":"SL.114"},{"$f":"Lite!C129","v":"Are all suppliers of critical hardware, network services and facility services involved in annual continuity and recovery tests?"},{"$f":"Lite!D129","v":"Yes"},{"$f":"Lite!E129","v":5},{"$f":"Lite!F129","v":0},{"$f":"Lite!G129","v":0},{"$f":"Lite!H129","v":"17.1.3"},{"$f":"Lite!I129","v":"Verify, review and evaluate information security continuity"},null,null,null,"N/A"]
[{"$f":"Lite!A130","v":3625},{"$f":"Lite!M130","v":11},{"$f":"Lite!K130","v":"K"},{"$f":"Lite!Y130","v":1},{"$f":"Lite!B130","v":"SL.115"},{"$f":"Lite!C130","v":"Are site failover tests performed at least annually?"},{"$f":"Lite!D130","v":"Yes"},{"$f":"Lite!E130","v":5},{"$f":"Lite!F130","v":"Sites are failed over as part of our annually conducted DR test. If it fails, testing will be repeated within 3 months. Aside from Annual DR Tests we conduct, we have never had to restore files after a systems outage. Our setup is fully highly available so we never suffered a data loss."},{"$f":"Lite!G130","v":0},{"$f":"Lite!H130","v":"17.1.3"},{"$f":"Lite!I130","v":"Verify, review and evaluate information security continuity"},null,null,null,"N/A"]
[{"$f":"Lite!A131","v":3639},{"$f":"Lite!M131","v":11},{"$f":"Lite!K131","v":"K"},{"$f":"Lite!Y131","v":1},{"$f":"Lite!B131","v":"SL.116"},{"$f":"Lite!C131","v":"Do contracts with Critical Service Providers include a penalty or remediation clause for breach of availability and continuity SLAs?"},{"$f":"Lite!D131","v":"Yes"},{"$f":"Lite!E131","v":5},{"$f":"Lite!F131","v":"The SLA is provided in the contract and is part of the general terms. Security related incidents have the same SLA. "},{"$f":"Lite!G131","v":0},{"$f":"Lite!H131","v":"15.1.2 15.2.1 "},{"$f":"Lite!I131","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,"N/A"]
[{"$f":"Lite!A132","v":3638},{"$f":"Lite!M132","v":11},{"$f":"Lite!K132","v":"K"},{"$f":"Lite!Y132","v":1},{"$f":"Lite!B132","v":"SL.117"},{"$f":"Lite!C132","v":"Is there sufficient redundancy capacity to ensure services are not impacted in multi-tenancy environments during peak usage and above?"},{"$f":"Lite!D132","v":"Yes"},{"$f":"Lite!E132","v":5},{"$f":"Lite!F132","v":"WalkMe’s architecture is designed to manage large scale traffic and CPS (connections per second) to provide high quality speed/availability. All Walk-thru data requests are done against Akamai."},{"$f":"Lite!G132","v":0},{"$f":"Lite!H132","v":"17.1.3"},{"$f":"Lite!I132","v":"Verify, review and evaluate information security continuity"},null,null,null,"N/A"]
[{"$f":"Lite!A133","v":0},{"$f":"Lite!M133","v":12},{"$f":"Lite!K133","v":1},{"$f":"Lite!Y133","v":1},{"$f":"Lite!B133","v":""},{"$f":"Lite!C133","v":"L. Compliance"},{"$f":"Lite!D133","v":0},{"$f":"Lite!E133","v":0},{"$f":"Lite!F133","v":0},{"$f":"Lite!G133","v":0},{"$f":"Lite!H133","v":0},{"$f":"Lite!I133","v":0}]
[{"$f":"Lite!A134","v":2826},{"$f":"Lite!M134","v":12},{"$f":"Lite!K134","v":"L"},{"$f":"Lite!Y134","v":1},{"$f":"Lite!B134","v":"SL.118"},{"$f":"Lite!C134","v":"Is there an internal audit, risk management, or compliance department, or similar management oversight unit with responsibility for assessing, identifying and tracking resolution of outstanding regulatory issues?"},{"$f":"Lite!D134","v":"Yes"},{"$f":"Lite!E134","v":5},{"$f":"Lite!F134","v":"WalkMe maintains an extensive compliance program that has been aligned to industry best practices, regulatory, Federal/State, international laws, regional laws, industry-specific requirements. The program assists customers to understand the robust controls in place at WalkMe that maintain security and data protection of WalkMe rendered services, helping customers to establish and operate in a WalkMe security control environment.\n\nWalkMe offers the most comprehensive set of compliance offerings of any SaaS Digital Adoption Platform."},{"$f":"Lite!G134","v":"L.3 Monitoring and Reporting - Compliance Requirement Identification"},{"$f":"Lite!H134","v":"18.1.1 "},{"$f":"Lite!I134","v":"Identification of applicable legislation and contractual requirements"},null,null,null,"N/A","1.B.7( c )\n3.D.4","PO4.4, PO4.5, PO4.6, PO4.8, PO4.10, PO6.5, DS5.1, DS5.2, DS5.3"]
[{"$f":"Lite!A135","v":4126},{"$f":"Lite!M135","v":12},{"$f":"Lite!K135","v":"L"},{"$f":"Lite!Y135","v":1},{"$f":"Lite!B135","v":"SL.119"},{"$f":"Lite!C135","v":"Are there policies and procedures to ensure compliance with applicable legislative, regulatory and contractual requirements including intellectual property rights on business processes or information technology software products?"},{"$f":"Lite!D135","v":"Yes"},{"$f":"Lite!E135","v":5},{"$f":"Lite!F135","v":"We are ISO/IEC 27001:2013 certified for Information security management.\nWe are ISO/IEC 27032:2012 certified for Guidelines for Cybersecurity.\nWe are ISO/IEC 27017:2015 certified for Cloud Specific Controls. \nWe are ISO/IEC 27018:2014 certified for Personal data Protection (PII).\nWe are ISO 27799:2016 certified for Security management in health (PHI).\nWe are ISO/IEC 9001:2015 certified for an effective Quality Management System (QMS).\nWe are US-HIPAA, HITECH, and HITRUST CSF compliant.\nWe are SOC 2 certified to meet AICPA’s Trust Security Principles. [Sharing requires signed NDA.]\nWe are SOC 3 (SSAE-18) certified to meet AICPA’s Trust Security Principles.\nWe comply with ICDM (Israel Cyber Defense Methodology)\nWe comply with GDPR (EU) 2016/679.\nWe are Swiss/EU-U.S. Privacy Shield (IP/16/216) certified.\nWe are TrustArc (formerly named TRUSTe) certified for data privacy.\nWe are CSA Security, Trust, and Assurance Level One: Self-Assessment certified.\nWe are graded Enterprise-Ready by CloudTrust program.\nWe operate using FIPS 140-2 validated cryptographic modules.\nWalkMe is an official Amazon Web Services (AWS) Advanced Technology Partner and a member of the APN (Amazon Partner Network)."},{"$f":"Lite!G135","v":"L.2 Monitoring and Reporting - Compliance "},{"$f":"Lite!H135","v":0},{"$f":"Lite!I135","v":0},null,null,null,"N/A",null,"N/A"]
[{"$f":"Lite!A136","v":2837},{"$f":"Lite!M136","v":12},{"$f":"Lite!K136","v":"L"},{"$f":"Lite!Y136","v":1},{"$f":"Lite!B136","v":"SL.120"},{"$f":"Lite!C136","v":"Is there a records retention policy covering paper and electronic records, including email in support of applicable regulations, standards and contractual requirements?"},{"$f":"Lite!D136","v":"Yes"},{"$f":"Lite!E136","v":5},{"$f":"Lite!F136","v":"According to WalkMe policies, all relevant data is deleted upon specific request. If you wish to export any or all of the data, you are free to contact your WalkMe Customer Success Manager Focal Point, and request partial/complete export. Data will then be provided to the customer using non-proprietary industry supported data format of their choice (.csv, .txt, etc.)"},{"$f":"Lite!G136","v":0},{"$f":"Lite!H136","v":"18.1.3 "},{"$f":"Lite!I136","v":"Protection of records"},null,null,null,"N/A",null,"PO4.8, DS11.2",null,"164.105 (c)(2)"]
[{"$f":"Lite!A137","v":4127},{"$f":"Lite!M137","v":12},{"$f":"Lite!K137","v":"L"},{"$f":"Lite!Y137","v":1},{"$f":"Lite!B137","v":"SL.121"},{"$f":"Lite!C137","v":"Is licensing maintained in all jurisdictions where required?"},{"$f":"Lite!D137","v":"Yes"},{"$f":"Lite!E137","v":5},{"$f":"Lite!F137","v":"WalkMe licensing model is global."},{"$f":"Lite!G137","v":0},{"$f":"Lite!H137","v":0},{"$f":"Lite!I137","v":0},null,null,null,"N/A",null,"N/A"]
[{"$f":"Lite!A138","v":3733},{"$f":"Lite!M138","v":12},{"$f":"Lite!K138","v":"L"},{"$f":"Lite!Y138","v":1},{"$f":"Lite!B138","v":"SL.122"},{"$f":"Lite!C138","v":"Is there an documented internal compliance and ethics program to ensure professional ethics and business practices are implemented and maintained?"},{"$f":"Lite!D138","v":"Yes"},{"$f":"Lite!E138","v":5},{"$f":"Lite!F138","v":"WalkMe is committed to conducting business in a fair and open manner within the spirit and letter of the law, with the highest regard for customers, the community, and employees. WalkMe’s success depends not only on the knowledge, skills, and abilities of employees, but also on their performance of work with sound judgment, self-discipline, common sense, and integrity. As such, all employees are required to maintain and uphold the following common ethical standards, in all aspects of their work:\n• To pursue WalkMe objectives in all of their work in a manner that does not conflict with the integrity of the WalkMe or the public interest;\n• To be truthful and accurate in performing job functions;\n• To protect Confidential Information as defined in WalkMe’s relevant policy;\n• To observe all laws, regulations, ordinances, and rules applicable to the operation of the business;\n• To maintain honest and fair relationships with all WalkMe vendors;\n• To ensure quality and value in the company’s products/services and relationships with customers and vendors; and\n• To avoid, during the course of their employment, any situations that may engender any conflict between the personal interests of employees and the exercise of discretionary decisions on behalf of the WalkMe."},{"$f":"Lite!G138","v":"L.4 Professional Ethics and Business Practices"},{"$f":"Lite!H138","v":0},{"$f":"Lite!I138","v":0},null,null,null,"N/A",null,"N/A"]
[{"$f":"Lite!A139","v":4135},{"$f":"Lite!M139","v":12},{"$f":"Lite!K139","v":"L"},{"$f":"Lite!Y139","v":1},{"$f":"Lite!B139","v":"SL.123"},{"$f":"Lite!C139","v":"Are marketing or selling activities conducted directly to Client's customers?"},{"$f":"Lite!D139","v":"N/A"},{"$f":"Lite!E139","v":0},{"$f":"Lite!F139","v":"WalkMe is B2B."},{"$f":"Lite!G139","v":0},{"$f":"Lite!H139","v":0},{"$f":"Lite!I139","v":0},null,null,null,"N/A",null,"N/A"]
[{"$f":"Lite!A140","v":4141},{"$f":"Lite!M140","v":12},{"$f":"Lite!K140","v":"L"},{"$f":"Lite!Y140","v":1},{"$f":"Lite!B140","v":"SL.124"},{"$f":"Lite!C140","v":"Are there direct interactions with your client's customers?"},{"$f":"Lite!D140","v":"N/A"},{"$f":"Lite!E140","v":0},{"$f":"Lite!F140","v":"WalkMe is B2B."},{"$f":"Lite!G140","v":0},{"$f":"Lite!H140","v":0},{"$f":"Lite!I140","v":0},null,null,null,"N/A",null,"N/A"]
[{"$f":"Lite!A141","v":4147},{"$f":"Lite!M141","v":12},{"$f":"Lite!K141","v":"L"},{"$f":"Lite!Y141","v":1},{"$f":"Lite!B141","v":"SL.125"},{"$f":"Lite!C141","v":"Are documented policies and procedures maintained for enabling compliance with applicable legal, regulatory, or contractual obligations related to information security requirements?"},{"$f":"Lite!D141","v":"Yes"},{"$f":"Lite!E141","v":5},{"$f":"Lite!F141","v":0},{"$f":"Lite!G141","v":0},{"$f":"Lite!H141","v":0},{"$f":"Lite!I141","v":0},null,null,null,"N/A",null,"N/A","ID.GV-3"]
[{"$f":"Lite!A142","v":4151},{"$f":"Lite!M142","v":12},{"$f":"Lite!K142","v":"L"},{"$f":"Lite!Y142","v":1},{"$f":"Lite!B142","v":"SL.126"},{"$f":"Lite!C142","v":"Is there a documented governance process to identify and assess changes that could significantly affect the system of internal controls for security, confidentiality and availability?"},{"$f":"Lite!D142","v":"Yes"},{"$f":"Lite!E142","v":5},{"$f":"Lite!F142","v":"Confidentiality: Security and privacy are managed according to industry best practices in terms of user IDs and password management, MFA authentication methods, encryption, access control management, and automation.\nIntegrity: The JS files generated in the publishing process and served to the customers are hashed, and the hash is stored in our database. \nAvailability: WalkMe utilizes Akamai (CDN) for static files delivery. The customer has a snippet of code added to the website HTML header. This snippet of code will be pointing to your WalkMe files cached on Akamai CDN, so end-users access our CDN for the published content. For redundancy purposes, If Amazon S3 is down, Akamai CDN will automatically publish the latest available cached version of the content. If Both the Amazon S3 and Akamai CDN platform are down/unavailable, the walkthroughs will just not appear on the screen for the end-user. It does not decrease application/website usability. No error message will be displayed and the application/website won't be affected."},{"$f":"Lite!G142","v":"L.3 Monitoring and Reporting - Compliance Requirement Identification"},{"$f":"Lite!H142","v":0},{"$f":"Lite!I142","v":0},null,null,null,"N/A",null,"N/A"]
[{"$f":"Lite!A143","v":4154},{"$f":"Lite!M143","v":12},{"$f":"Lite!K143","v":"L"},{"$f":"Lite!Y143","v":1},{"$f":"Lite!B143","v":"SL.127"},{"$f":"Lite!C143","v":"Are accounts opened, transactions initiated or other account initiation activity applying payments, taking payments, transferring funds, etc. through either electronic, telephonic, written or in-person requests made on behalf of your client's?"},{"$f":"Lite!D143","v":"N/A"},{"$f":"Lite!E143","v":0},{"$f":"Lite!F143","v":0},{"$f":"Lite!G143","v":0},{"$f":"Lite!H143","v":0},{"$f":"Lite!I143","v":0}]
[{"$f":"Lite!A144","v":4284},{"$f":"Lite!M144","v":12},{"$f":"Lite!K144","v":"L"},{"$f":"Lite!Y144","v":1},{"$f":"Lite!B144","v":"SL.128"},{"$f":"Lite!C144","v":"Are these sites, applications and systems used to also transmit, process or store non-scoped data?"},{"$f":"Lite!D144","v":"N/A"},{"$f":"Lite!E144","v":0},{"$f":"Lite!F144","v":0},{"$f":"Lite!G144","v":0},{"$f":"Lite!H144","v":0},{"$f":"Lite!I144","v":0}]
[{"$f":"Lite!A145","v":2652},{"$f":"Lite!M145","v":12},{"$f":"Lite!K145","v":"L"},{"$f":"Lite!Y145","v":1},{"$f":"Lite!B145","v":"SL.129"},{"$f":"Lite!C145","v":"Are all transaction details (such as payment card info and information about the parties conducting transactions) prohibited from being stored in the DMZ?"},{"$f":"Lite!D145","v":"N/A"},{"$f":"Lite!E145","v":0},{"$f":"Lite!F145","v":"No such transactions."},{"$f":"Lite!G145","v":0},{"$f":"Lite!H145","v":"14.1.3.e"},{"$f":"Lite!I145","v":"Protecting Application Services Transactions"},null,null,null,"N/A",null,null,null,"164.312 (e)"]
[{"$f":"Lite!A146","v":3379},{"$f":"Lite!M146","v":12},{"$f":"Lite!K146","v":"L"},{"$f":"Lite!Y146","v":1},{"$f":"Lite!B146","v":"SL.130"},{"$f":"Lite!C146","v":"Does the service provider permit client audits and assessments?"},{"$f":"Lite!D146","v":"Yes"},{"$f":"Lite!E146","v":4},{"$f":"Lite!F146","v":"Procedures to allow Customer to perform security penetration scanning:\nWalkMe permits customers to perform independent vulnerability assessments.\nThese must be coordinated in advance. No DoS/Stress testing is allowed."},{"$f":"Lite!G146","v":"V.3 Cloud Audit Program"},{"$f":"Lite!H146","v":"15.1.2 15.2.1 "},{"$f":"Lite!I146","v":"Addressing security within supplier agreements, Monitoring and review of supplier services"},null,null,null,10.8]
[{"$f":"Lite!A147","v":0},{"$f":"Lite!M147","v":13},{"$f":"Lite!K147","v":1},{"$f":"Lite!Y147","v":1},{"$f":"Lite!B147","v":""},{"$f":"Lite!C147","v":"M. End User Device Security"},{"$f":"Lite!D147","v":0},{"$f":"Lite!E147","v":0},{"$f":"Lite!F147","v":0},{"$f":"Lite!G147","v":0},{"$f":"Lite!H147","v":0},{"$f":"Lite!I147","v":0}]
[{"$f":"Lite!A148","v":4297},{"$f":"Lite!M148","v":13},{"$f":"Lite!K148","v":"M"},{"$f":"Lite!Y148","v":1},{"$f":"Lite!B148","v":"SL.131"},{"$f":"Lite!C148","v":"Are End User Devices (Desktops, Laptops, Tablets, Smartphones) used for transmitting, processing or storing Scoped Data? If yes, for all platforms, are:"},{"$f":"Lite!D148","v":"No"},{"$f":"Lite!E148","v":0},{"$f":"Lite!F148","v":"Encryption of office laptops - All of our laptops implement Full/Whole Disk Encryption by Symantec Endpoint Encryption, using Advanced Encryption Standard (AES) encryption algorithm with 256-bit keys."},{"$f":"Lite!G148","v":0},{"$f":"Lite!H148","v":0},{"$f":"Lite!I148","v":0}]
[{"$f":"Lite!A149","v":4298},{"$f":"Lite!M149","v":13},{"$f":"Lite!K149","v":"M"},{"$f":"Lite!Y149","v":1},{"$f":"Lite!B149","v":"SL.132"},{"$f":"Lite!C149","v":"Security configuration standards documented? If yes, are:"},{"$f":"Lite!D149","v":0},{"$f":"Lite!E149","v":0},{"$f":"Lite!F149","v":0},{"$f":"Lite!G149","v":0},{"$f":"Lite!H149","v":0},{"$f":"Lite!I149","v":0}]
[{"$f":"Lite!A150","v":4305},{"$f":"Lite!M150","v":13},{"$f":"Lite!K150","v":"M"},{"$f":"Lite!Y150","v":1},{"$f":"Lite!B150","v":"SL.133"},{"$f":"Lite!C150","v":"All available high-risk security patches applied and verified at least monthly on all server platforms?"},{"$f":"Lite!D150","v":0},{"$f":"Lite!E150","v":0},{"$f":"Lite!F150","v":0},{"$f":"Lite!G150","v":0},{"$f":"Lite!H150","v":0},{"$f":"Lite!I150","v":0}]
[{"$f":"Lite!A151","v":4313},{"$f":"Lite!M151","v":13},{"$f":"Lite!K151","v":"M"},{"$f":"Lite!Y151","v":1},{"$f":"Lite!B151","v":"SL.134"},{"$f":"Lite!C151","v":"Sufficient detail contained in Operating System and application logs to support incident investigation, including successful and failed login attempts and changes to sensitive configuration settings and files?"},{"$f":"Lite!D151","v":0},{"$f":"Lite!E151","v":0},{"$f":"Lite!F151","v":"Staff are contractually prohibited from accessing the administrative environment via non-managed private devices. Remote management is only possible from either a specific segment within WalkMe offices, or by using an SSL VPN client, with strong MFA authentication based on OTP tokens. This is only applicable to our internal systems, and no remote access to the customer systems is required. 3rd parties do not have access to WalkMe's network."},{"$f":"Lite!G151","v":0},{"$f":"Lite!H151","v":0},{"$f":"Lite!I151","v":0}]
[{"$f":"Lite!A152","v":4317},{"$f":"Lite!M152","v":13},{"$f":"Lite!K152","v":"M"},{"$f":"Lite!Y152","v":1},{"$f":"Lite!B152","v":"SL.135"},{"$f":"Lite!C152","v":"Operating system and application logs relevant to supporting incident investigation protected against modification, deletion, and/or inappropriate access?"},{"$f":"Lite!D152","v":0},{"$f":"Lite!E152","v":0},{"$f":"Lite!F152","v":0},{"$f":"Lite!G152","v":0},{"$f":"Lite!H152","v":0},{"$f":"Lite!I152","v":0}]
[{"$f":"Lite!A153","v":4090},{"$f":"Lite!M153","v":13},{"$f":"Lite!K153","v":"M"},{"$f":"Lite!Y153","v":1},{"$f":"Lite!B153","v":"SL.136"},{"$f":"Lite!C153","v":"Are constituents allowed to utilize mobile devices within your environment? If yes, which of the following functions are allowed:"},{"$f":"Lite!D153","v":"No"},{"$f":"Lite!E153","v":0},{"$f":"Lite!F153","v":0},{"$f":"Lite!G153","v":0},{"$f":"Lite!H153","v":0},{"$f":"Lite!I153","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A154","v":4091},{"$f":"Lite!M154","v":13},{"$f":"Lite!K154","v":"M"},{"$f":"Lite!Y154","v":1},{"$f":"Lite!B154","v":"SL.137"},{"$f":"Lite!C154","v":"View Scoped Data?"},{"$f":"Lite!D154","v":0},{"$f":"Lite!E154","v":0},{"$f":"Lite!F154","v":0},{"$f":"Lite!G154","v":0},{"$f":"Lite!H154","v":0},{"$f":"Lite!I154","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A155","v":4092},{"$f":"Lite!M155","v":13},{"$f":"Lite!K155","v":"M"},{"$f":"Lite!Y155","v":1},{"$f":"Lite!B155","v":"SL.138"},{"$f":"Lite!C155","v":"Process Scoped Data?"},{"$f":"Lite!D155","v":0},{"$f":"Lite!E155","v":0},{"$f":"Lite!F155","v":0},{"$f":"Lite!G155","v":0},{"$f":"Lite!H155","v":0},{"$f":"Lite!I155","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A156","v":4093},{"$f":"Lite!M156","v":13},{"$f":"Lite!K156","v":"M"},{"$f":"Lite!Y156","v":1},{"$f":"Lite!B156","v":"SL.139"},{"$f":"Lite!C156","v":"Delete Scoped Data?"},{"$f":"Lite!D156","v":0},{"$f":"Lite!E156","v":0},{"$f":"Lite!F156","v":0},{"$f":"Lite!G156","v":0},{"$f":"Lite!H156","v":0},{"$f":"Lite!I156","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A157","v":4094},{"$f":"Lite!M157","v":13},{"$f":"Lite!K157","v":"M"},{"$f":"Lite!Y157","v":1},{"$f":"Lite!B157","v":"SL.140"},{"$f":"Lite!C157","v":"Store Scoped Data?"},{"$f":"Lite!D157","v":0},{"$f":"Lite!E157","v":0},{"$f":"Lite!F157","v":0},{"$f":"Lite!G157","v":0},{"$f":"Lite!H157","v":0},{"$f":"Lite!I157","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A158","v":4097},{"$f":"Lite!M158","v":13},{"$f":"Lite!K158","v":"M"},{"$f":"Lite!Y158","v":1},{"$f":"Lite!B158","v":"SL.141"},{"$f":"Lite!C158","v":"Is there a mobile device management program in place that has been approved by management and communicated to appropriate constituents?"},{"$f":"Lite!D158","v":"N/A"},{"$f":"Lite!E158","v":0},{"$f":"Lite!F158","v":0},{"$f":"Lite!G158","v":0},{"$f":"Lite!H158","v":0},{"$f":"Lite!I158","v":0},null,null,null,"N/A",null,null,"DE.CM-5"]
[{"$f":"Lite!A159","v":4098},{"$f":"Lite!M159","v":13},{"$f":"Lite!K159","v":"M"},{"$f":"Lite!Y159","v":1},{"$f":"Lite!B159","v":"SL.142"},{"$f":"Lite!C159","v":"Is there a Mobile Device Management solution in place?"},{"$f":"Lite!D159","v":0},{"$f":"Lite!E159","v":0},{"$f":"Lite!F159","v":0},{"$f":"Lite!G159","v":0},{"$f":"Lite!H159","v":0},{"$f":"Lite!I159","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A160","v":3787},{"$f":"Lite!M160","v":13},{"$f":"Lite!K160","v":"M"},{"$f":"Lite!Y160","v":1},{"$f":"Lite!B160","v":"SL.143"},{"$f":"Lite!C160","v":"Is there an approved process for IT to off-board mobile devices when a constituent terminates, or requests to on-board a new mobile device? If yes, does it:"},{"$f":"Lite!D160","v":0},{"$f":"Lite!E160","v":0},{"$f":"Lite!F160","v":0},{"$f":"Lite!G160","v":0},{"$f":"Lite!H160","v":0},{"$f":"Lite!I160","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A161","v":3558},{"$f":"Lite!M161","v":13},{"$f":"Lite!K161","v":"M"},{"$f":"Lite!Y161","v":1},{"$f":"Lite!B161","v":"SL.144"},{"$f":"Lite!C161","v":"Are staff technically prevented from accessing the administrative environment via non-managed private devices? If yes, is it from:"},{"$f":"Lite!D161","v":"Yes"},{"$f":"Lite!E161","v":3},{"$f":"Lite!F161","v":"Staff are contractually prohibited from accessing the administrative environment via non-managed private devices. Remote management is only possible from either a specific segment within WalkMe offices, or by using an SSL VPN client, with strong MFA authentication based on OTP tokens. This is only applicable to our internal systems, and no remote access to the customer systems is required. 3rd parties do not have access to WalkMe's network."},{"$f":"Lite!G161","v":"H.3 Logical Access Authorization"},{"$f":"Lite!H161","v":"9.1.1 9.1.2 9.2.1 9.2.3 "},{"$f":"Lite!I161","v":"Access control policy,\nAccess to networks and network services,\nUser registration and de-registration,\nManagement of privileged access rights"},null,null,null,"N/A"]
[{"$f":"Lite!A162","v":0},{"$f":"Lite!M162","v":14},{"$f":"Lite!K162","v":1},{"$f":"Lite!Y162","v":1},{"$f":"Lite!B162","v":""},{"$f":"Lite!C162","v":"N. Network Security"},{"$f":"Lite!D162","v":0},{"$f":"Lite!E162","v":0},{"$f":"Lite!F162","v":0},{"$f":"Lite!G162","v":0},{"$f":"Lite!H162","v":0},{"$f":"Lite!I162","v":0}]
[{"$f":"Lite!A163","v":975},{"$f":"Lite!M163","v":14},{"$f":"Lite!K163","v":"N"},{"$f":"Lite!Y163","v":1},{"$f":"Lite!B163","v":"SL.145"},{"$f":"Lite!C163","v":"Are there external network connections (Internet, extranet, etc.)?"},{"$f":"Lite!D163","v":"Yes"},{"$f":"Lite!E163","v":5},{"$f":"Lite!F163","v":"WalkMe is a SaaS.\nWe are depended on Amazon AWS as our cloud hosting provider."},{"$f":"Lite!G163","v":"B.2 Information Security Standards\nN.Network Security"},{"$f":"Lite!H163","v":"13.1.1"},{"$f":"Lite!I163","v":"Network Controls"},null,null,null,"10.5.4",null,"DS5.7, DS5.9, DS5.11",null,"164.312 (e)"]
[{"$f":"Lite!A164","v":998},{"$f":"Lite!M164","v":14},{"$f":"Lite!K164","v":"N"},{"$f":"Lite!Y164","v":1},{"$f":"Lite!B164","v":"SL.146"},{"$f":"Lite!C164","v":"Security and hardening standards for network devices, including Firewalls, Switches, Routers and Wireless Access Points (baseline configuration, patching, passwords, access control)?"},{"$f":"Lite!D164","v":"Yes"},{"$f":"Lite!E164","v":5},{"$f":"Lite!F164","v":0},{"$f":"Lite!G164","v":"N. Network Security"},{"$f":"Lite!H164","v":"13.1.1.c"},{"$f":"Lite!I164","v":"Network Controls"},null,"Preventive Controls: Infrastructure Management\n\nCorrective Controls: Patch Management","D3.PC.IM.B.1\nD3.PC.IM.B.2\nD3.PC.IM.B.10\nD3.CC.PM.B.1","1.1\n6.2\n10.2.4",null,"N/A",null,"164.312 (e)"]
[{"$f":"Lite!A165","v":3689},{"$f":"Lite!M165","v":14},{"$f":"Lite!K165","v":"N"},{"$f":"Lite!Y165","v":1},{"$f":"Lite!B165","v":"SL.147"},{"$f":"Lite!C165","v":"Are firewalls used to isolate critical and sensitive systems into network segments separate from network segments with less sensitive systems?"},{"$f":"Lite!D165","v":"Yes"},{"$f":"Lite!E165","v":5},{"$f":"Lite!F165","v":0},{"$f":"Lite!G165","v":"N.2 Network Security - Firewall(s) and/or Other Devices Providing the Same Functionality"},{"$f":"Lite!H165","v":"13.1.3"},{"$f":"Lite!I165","v":"Segregation In Networks"},null,null,null,"1.2.1",null,"N/A","PR.PT-4","164.312 (e)"]
[{"$f":"Lite!A166","v":1015},{"$f":"Lite!M166","v":14},{"$f":"Lite!K166","v":"N"},{"$f":"Lite!Y166","v":1},{"$f":"Lite!B166","v":"SL.148"},{"$f":"Lite!C166","v":"Is there a process that requires security approval to allow external networks to connect to the company network, and enforces the least privilege necessary?"},{"$f":"Lite!D166","v":"Yes"},{"$f":"Lite!E166","v":5},{"$f":"Lite!F166","v":"We manage access authorization strictly according to need-to and least-privileged principles. The need is derived from the role of the requesting user, and is concluded per the type of infrastructure, the environment and the part of it that the person needs to work on."},{"$f":"Lite!G166","v":0},{"$f":"Lite!H166","v":"9.1.2.b"},{"$f":"Lite!I166","v":"Access to networks and network services"},null,null,null,"N/A",null,"DS5.7",null,"164.312 (e)"]
[{"$f":"Lite!A167","v":994},{"$f":"Lite!M167","v":14},{"$f":"Lite!K167","v":"N"},{"$f":"Lite!Y167","v":1},{"$f":"Lite!B167","v":"SL.149"},{"$f":"Lite!C167","v":"Are all available high-risk security patches applied and verified at least monthly?"},{"$f":"Lite!D167","v":"Yes"},{"$f":"Lite!E167","v":5},{"$f":"Lite!F167","v":0},{"$f":"Lite!G167","v":0},{"$f":"Lite!H167","v":"12.6.1.g"},{"$f":"Lite!I167","v":"Management of technical vulnerabilities"},null,"Corrective Controls: Patch Management","D3.CC.PM.B.1",1.3,null,"DS11.6",null,"164.312 (e)"]
[{"$f":"Lite!A168","v":1068},{"$f":"Lite!M168","v":14},{"$f":"Lite!K168","v":"N"},{"$f":"Lite!Y168","v":1},{"$f":"Lite!B168","v":"SL.150"},{"$f":"Lite!C168","v":"Are Intrusion Detection/Prevention Systems employed in all sensitive network zones and wherever firewalls are enabled?"},{"$f":"Lite!D168","v":"Yes"},{"$f":"Lite!E168","v":5},{"$f":"Lite!F168","v":"We have implemented a host Based ESET IDS/IPS. In addition we use firewalls to inspect and filter traffic. Since in AWS we can't place a network based IPS, we do that with HIPS installed on the servers.\nWe use Akamai Kona Web Application Firewall on our environments."},{"$f":"Lite!G168","v":"N.3 Network Security - IDS/IPS Attributes"},{"$f":"Lite!H168","v":"13.1.2"},{"$f":"Lite!I168","v":"Security of Network Services"},null,null,null,11.4,null,"AI6.3, DS5.7","DE.CM-1\nDE.CM-7","164.312 (e)"]
[{"$f":"Lite!A169","v":1095},{"$f":"Lite!M169","v":14},{"$f":"Lite!K169","v":"N"},{"$f":"Lite!Y169","v":1},{"$f":"Lite!B169","v":"SL.151"},{"$f":"Lite!C169","v":"Are wireless networking devices connected to networks containing scoped systems and data?"},{"$f":"Lite!D169","v":"Yes"},{"$f":"Lite!E169","v":5},{"$f":"Lite!F169","v":"No wireless LAN access is granted to the production environment at all. Wireless LAN connections in our offices are secured by WPA2-Enterprise, and encrypted with accordance with NIST standards using AES for password authentication. Wireless networks are up to date with vendor security patches to prevent potential 802.11r exploits using newly-disclosed vulnerabilities. This includes mitigation for October 2017 Krack vulnerability."},{"$f":"Lite!G169","v":"N.7 Unauthorized Wireless Networks"},{"$f":"Lite!H169","v":"13.1.1.c"},{"$f":"Lite!I169","v":"Network Controls"},null,"Preventative Controls: Infrastructure Management","D3.PC.IM.B.10","N/A",null,"DS5.5, DS5.7",null,"164.312 (e)"]
[{"$f":"Lite!A170","v":3563},{"$f":"Lite!M170","v":14},{"$f":"Lite!K170","v":"N"},{"$f":"Lite!Y170","v":1},{"$f":"Lite!B170","v":"SL.152"},{"$f":"Lite!C170","v":"Are there controls to prevent one client attempting to compromise another client in a resource pooled environment?"},{"$f":"Lite!D170","v":"Yes"},{"$f":"Lite!E170","v":5},{"$f":"Lite!F170","v":"We manage authorization strictly so that there's no way for a user to perform unauthorized activities on our WalkMe Editor. This includes both identification of the customer (so that a user belonging to customer A can't affect the configuration of customer B) and access rights enforcement within the customer account."},{"$f":"Lite!G170","v":"H.3 Logical Access Authorization"},{"$f":"Lite!H170","v":"12.4.1 15.2.1"},{"$f":"Lite!I170","v":"Event Logging,\nMonitoring and review of supplier services"},null,null,null,7.1]
[{"$f":"Lite!A171","v":0},{"$f":"Lite!M171","v":15},{"$f":"Lite!K171","v":1},{"$f":"Lite!Y171","v":1},{"$f":"Lite!B171","v":""},{"$f":"Lite!C171","v":"P. Privacy"},{"$f":"Lite!D171","v":0},{"$f":"Lite!E171","v":0},{"$f":"Lite!F171","v":0},{"$f":"Lite!G171","v":0},{"$f":"Lite!H171","v":0},{"$f":"Lite!I171","v":0}]
[{"$f":"Lite!A172","v":3687},{"$f":"Lite!M172","v":15},{"$f":"Lite!K172","v":"P"},{"$f":"Lite!Y172","v":1},{"$f":"Lite!B172","v":"SL.153"},{"$f":"Lite!C172","v":"Is Scoped Data transmitted, processed, or stored that can be classified as non-public information (NPI), personally identifiable information (PII), or sensitive customer financial information? If yes, describe and list types of data."},{"$f":"Lite!D172","v":"Yes"},{"$f":"Lite!E172","v":0},{"$f":"Lite!F172","v":".WalkMe is an Overlay. WalkMe collects personally identifiable information and non-personally identifiable information from customers’ end-users in certain circumstances. This is the case for both SaaS solution, as well as local hosting.\n Depending on the context of your account configuration, we may collect or receive the following types of information, including Personal Information, from you:\n• HTML metadata - WalkMe configuration for locating elements on the page.\n• Analytics metadata – User interaction with WalkMe; which Walkthroughs and steps were played, launchers clicked, shoutOuts displayed etc. This is the WalkMe related metadata (the WalkMe configuration [e.g. location of balloon on page is XX,YY], and analytics usage [e.g. user GUID XXXXX used Walkthrough GUID YYYYY]).\n• IP addresses in logs for security and forensic purposes.\n• Pseudonymized masked IP addresses (i.e. 192.168.0.x) and End Users' Approximate geographical Location data\n• Environment properties such as browser and OS, page URL, and title.\nBy Default, collected metadata is assigned to anonymous random GUID.\nThe analytics information is anonymized aggregated usage statistics regarding WalkMe usage.\nAdditionally, Customer may use certain special features which require collecting and storing additional Personal Information (i.e. User Behavior Tracking, Screenshot Settings, Custom Variables, Custom User Identifier, Visions). For more information, please see our privacy policy.\n\nWalkMe designs its controls with the assumption that certain controls will be the responsibility of its customers (or \"user entities\"). Among these responsibilities, customers agree to make sure that they configure their instance of WalkMe according to their organizations policies and procedures, and that transmitted data will not contain information which may expose personally identifying information, without customer consent."},{"$f":"Lite!G172","v":0},{"$f":"Lite!H172","v":"8.2.1"},{"$f":"Lite!I172","v":"Classification of Information"},null,null,null,"N/A"]
[{"$f":"Lite!A173","v":3690},{"$f":"Lite!M173","v":15},{"$f":"Lite!K173","v":"P"},{"$f":"Lite!Y173","v":1},{"$f":"Lite!B173","v":"SL.154"},{"$f":"Lite!C173","v":"Do agreements with third parties who have access or potential access to Scoped Data, address confidentiality, audit, security, and privacy, including but not limited to incident response, ongoing monitoring, data sharing and secure disposal of Scoped Data?"},{"$f":"Lite!D173","v":"Yes"},{"$f":"Lite!E173","v":5},{"$f":"Lite!F173","v":0},{"$f":"Lite!G173","v":"P.4 Third Party Privacy Agreements"},{"$f":"Lite!H173","v":"15.1.2 "},{"$f":"Lite!I173","v":"Addressing security within supplier agreements"},null,null,null,"3.7\n12.8.2",null,null,null,"164.502 (e) \n164.504 (e)"]
[{"$f":"Lite!A174","v":3701},{"$f":"Lite!M174","v":15},{"$f":"Lite!K174","v":"P"},{"$f":"Lite!Y174","v":1},{"$f":"Lite!B174","v":"SL.155"},{"$f":"Lite!C174","v":"Is a business associate contract in place to address obligations for the privacy and security requirements for the services provided?"},{"$f":"Lite!D174","v":"Yes"},{"$f":"Lite!E174","v":5},{"$f":"Lite!F174","v":"Customers can use WalkMe services to collect data regulated under the U.S. Health\nInsurance Portability and Accountability Act (HIPAA).\n\nIf you plan to include Protected Health Information (as defined by HIPAA) on WalkMe services, you must first enter into a Business Associate Agreement (BAA) with WalkMe. WalkMe will then provide the BAA for you to sign.\n\nIn general, Any WalkMe service can be used with a healthcare application, but only services\ncovered by the WalkMe BAA can be used to store, process, and transmit Protected Health Information under HIPAA. \n\nNOTE: If you are a Covered Entity or Business Associate as defined by the Health Insurance Portability and Accountability Act of 1996 (as amended, “HIPAA”), you agree not to use WalkMe HIPAA Eligible Services for any purpose or in any manner involving Protected Health Information (as defined by HIPAA) without first entering into an WalkMe business associate agreement."},{"$f":"Lite!G174","v":"P.4 Third Party Privacy Agreements"},{"$f":"Lite!H174","v":"15.1.2 "},{"$f":"Lite!I174","v":"Addressing security within supplier agreements"},null,null,null,"N/A",null,null,null,"164.306 (a)"]
[{"$f":"Lite!A175","v":3704},{"$f":"Lite!M175","v":15},{"$f":"Lite!K175","v":"P"},{"$f":"Lite!Y175","v":1},{"$f":"Lite!B175","v":"SL.156"},{"$f":"Lite!C175","v":"For Scoped Data, is personal information about individuals transmitted to or received from countries outside the United States? If yes, list the countries."},{"$f":"Lite!D175","v":"Yes"},{"$f":"Lite!E175","v":5},{"$f":"Lite!F175","v":"WalkMe is a SaaS, We are depended on Amazon AWS as our cloud hosting provider. Content is created using the WalkMe Editor, which in turn gathers the required Metadata to present the Walkthroughs. This information is then stored in JavaScript Files, that reside on a dedicated AWS S3 Bucket (By Default). The S3 Resides by default in us-west-1 region (California, USA). In order to address legal jurisdictional considerations based on where data is stored or accessed, WalkMe allows customers to specify which of our geographic locations their data is allowed to traverse into/out of.  WalkMe customers are allowed to transfer personal data from an AWS region in the EEA to one outside the EEA in full compliance with EU data protection law as AWS already offer customers a Data Processing Addendum, including Model Clauses (Data Processing Addendum), which is signed by WalkMe. This Addendum was approved in 2015 by the EU data protection authorities, known as the Article 29 Working Party. See http://www.cnpd.public.lu/en/actualites/international/2015/03/AWS/index.html Moreover, in addition to the data processing addendum and the Model Clauses, customers who wish to transfer their personal data from EU to US benefit from WalkMe’s participation in the EU-U.S. Privacy Shield Framework. The EU-U.S. Privacy Shield Framework does not affect the way customers use, or work with, WalkMe, but, rather, provides an additional, EU-sanctioned mechanism for transferring personal data from the EU to the US. For details on the obligations for US service providers under the EU-U.S. Privacy Shield framework, please see the European Commission website here: http://ec.europa.eu/justice/data-protection/internationaltransfers/eu-us-privacy-shield/index_en.htm and the EU-U.S. Privacy Shield Framework website here: https://www.privacyshield.gov/participant?id=a2zt00000004EVHAA2"},{"$f":"Lite!G175","v":0},{"$f":"Lite!H175","v":0},{"$f":"Lite!I175","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A176","v":3715},{"$f":"Lite!M176","v":15},{"$f":"Lite!K176","v":"P"},{"$f":"Lite!Y176","v":1},{"$f":"Lite!B176","v":"SL.157"},{"$f":"Lite!C176","v":"Is personal information transmitted, processed, stored, or disclosed to or retained by third parties? If yes, describe."},{"$f":"Lite!D176","v":"Yes"},{"$f":"Lite!E176","v":5},{"$f":"Lite!F176","v":"WalkMe uses a number of third-party subcontractors to assist with the provision of our service.\n\nWalkMe uses a number of third-party subcontractors to assist with the provision of our service. However, only four (4) subcontractors have access to customers’ end-user’s PII (IP addresses etc.):\nWe use Amazon AWS as our cloud hosting provider.\nWe use Akamai as our CDN.\nWe use Good Data Analytics engines as a processing service.\nWe use Logz.io for Logging services."},{"$f":"Lite!G176","v":0},{"$f":"Lite!H176","v":15},{"$f":"Lite!I176","v":"Supplier Relationships"},null,null,null,"N/A"]
[{"$f":"Lite!A177","v":3270},{"$f":"Lite!M177","v":15},{"$f":"Lite!K177","v":"P"},{"$f":"Lite!Y177","v":1},{"$f":"Lite!B177","v":"SL.158"},{"$f":"Lite!C177","v":"Are there contractual controls to ensure that personal information transmitted, processed, stored or disclosed to or retained by third parties is limited to defined parameters for access, use and disclosure? If yes, describe. If no, explain reason."},{"$f":"Lite!D177","v":"Yes"},{"$f":"Lite!E177","v":5},{"$f":"Lite!F177","v":"WalkMe only uses subcontractors that we trust and we use appropriate contractual safeguards which we monitor to ensure the required standards are maintained.\n\nWe have a signed Data Processing Agreement (DPA) with each subcontractor, for the processing of PII of users related to the EEA, per the requirements of the GDPR.\n\nAs for transfer to the US, we do that under the EU-US Privacy Shield for which we are certified against. If we need to transfer PII to other locations (which are outside the EEA and/or the US), we may enter into Standard Contractual Clauses with such entity, with respect to EEA related PII.\n\n"},{"$f":"Lite!G177","v":"P.4 Third Party Privacy Agreements"},{"$f":"Lite!H177","v":"15.1.2 "},{"$f":"Lite!I177","v":"Addressing security within supplier agreements"},null,null,null,"N/A"]
[{"$f":"Lite!A178","v":3269},{"$f":"Lite!M178","v":15},{"$f":"Lite!K178","v":"P"},{"$f":"Lite!Y178","v":1},{"$f":"Lite!B178","v":"SL.159"},{"$f":"Lite!C178","v":"Is personal information accessed, disclosed, processed, transmitted or retained with third parties outside the US? If yes, describe and list the countries."},{"$f":"Lite!D178","v":"No"},{"$f":"Lite!E178","v":0},{"$f":"Lite!F178","v":"WalkMe subcontractors that access, disclose, process, transmitt or retain are US based."},{"$f":"Lite!G178","v":0},{"$f":"Lite!H178","v":15},{"$f":"Lite!I178","v":"Supplier Relationships"},null,null,null,"N/A"]
[{"$f":"Lite!A179","v":3718},{"$f":"Lite!M179","v":15},{"$f":"Lite!K179","v":"P"},{"$f":"Lite!Y179","v":1},{"$f":"Lite!B179","v":"SL.160"},{"$f":"Lite!C179","v":"Is there a documented privacy policy or procedures for the protection of information transmitted, processed, or maintained on behalf of the client?"},{"$f":"Lite!D179","v":"Yes"},{"$f":"Lite!E179","v":5},{"$f":"Lite!F179","v":"WalkMe has a documented privacy policy which sets forth the procedures for the protection of information transmitted, processed, or maintained on behalf of the client.\nSee https://www.walkme.com/privacy-policy/\n\nOur Privacy Policy details the third-party subcontractors we use in order to collect and/or process the information on behalf of the client. \n\nSee links to third parties subcontractors' privacy policies below:\n\nAmazon Web Services Inc.\nhttps://aws.amazon.com/privacy\nAkamai Technologies Inc.\nhttps://www.akamai.com/us/en/privacy-policies/\nGoodData Inc.\nhttps://www.gooddata.com/privacy-policy\nLogz.io LTD.\nhttps://logz.io/about-us/privacy-policy/"},{"$f":"Lite!G179","v":"P.2 Privacy Policy and Privacy Notices"},{"$f":"Lite!H179","v":"15.1.1"},{"$f":"Lite!I179","v":"Information security policy for supplier relationships"},null,null,null,"N/A",null,null,null,"164.308 (a)(3)(i)"]
[{"$f":"Lite!A180","v":3729},{"$f":"Lite!M180","v":15},{"$f":"Lite!K180","v":"P"},{"$f":"Lite!Y180","v":1},{"$f":"Lite!B180","v":"SL.161"},{"$f":"Lite!C180","v":"Are transactions for covered accounts accessed, modified, or processed, including address changes and discrepancies? If yes, describe."},{"$f":"Lite!D180","v":"No"},{"$f":"Lite!E180","v":0},{"$f":"Lite!F180","v":0},{"$f":"Lite!G180","v":0},{"$f":"Lite!H180","v":0},{"$f":"Lite!I180","v":0},null,"Detective Controls: Anomalous Activity Detection","D3.DC.AAD.B.2","N/A"]
[{"$f":"Lite!A181","v":0},{"$f":"Lite!M181","v":16},{"$f":"Lite!K181","v":1},{"$f":"Lite!Y181","v":1},{"$f":"Lite!B181","v":""},{"$f":"Lite!C181","v":"T. Threat Management"},{"$f":"Lite!D181","v":0},{"$f":"Lite!E181","v":0},{"$f":"Lite!F181","v":0},{"$f":"Lite!G181","v":0},{"$f":"Lite!H181","v":0},{"$f":"Lite!I181","v":0}]
[{"$f":"Lite!A182","v":895},{"$f":"Lite!M182","v":16},{"$f":"Lite!K182","v":"T"},{"$f":"Lite!Y182","v":1},{"$f":"Lite!B182","v":"SL.162"},{"$f":"Lite!C182","v":"Is there an anti-malware policy or program that has been approved by management, communicated to appropriate constituents and an owner to maintain and review the policy?"},{"$f":"Lite!D182","v":"Yes"},{"$f":"Lite!E182","v":5},{"$f":"Lite!F182","v":"We deploy ESET endpoint security suite on all of our workstations and servers, as well as ESET Live Grid early warning preventative system. The suite includes antimalware & anti-ransomware modules as well as a HIPS functionality. The ESET is configured for auto-update and on-access, so its software is always upgraded to the latest version, and the latest Virus Signature Database updates."},{"$f":"Lite!G182","v":"T.1 Virus Protection (Servers)\nT.2 Virus Protection (Workstations)"},{"$f":"Lite!H182","v":"12.2.1"},{"$f":"Lite!I182","v":"Controls Against Malware"},null,"Preventative Controls: Infrastructure Management\nDetective Controls: Threat and Vulnerability Detection","D3.PC.IM.B.4\n\nD3.DC.TVD.B.2","5.1\n5.1.1\n5.2\n5.3\n5.4",null,"PO4.1, DS5.9, DS5.11",null,"164.310 (c)"]
[{"$f":"Lite!A183","v":4345},{"$f":"Lite!M183","v":16},{"$f":"Lite!K183","v":"T"},{"$f":"Lite!Y183","v":1},{"$f":"Lite!B183","v":"SL.163"},{"$f":"Lite!C183","v":"Prohibition of disabling anti-malware with exceptions requiring Security approval and reenablement as soon as possible."},{"$f":"Lite!D183","v":"Yes"},{"$f":"Lite!E183","v":5},{"$f":"Lite!F183","v":"Settings are password protected to prevent users from changing any settings or disabling protection."},{"$f":"Lite!G183","v":0},{"$f":"Lite!H183","v":0},{"$f":"Lite!I183","v":0},null,"Preventative Controls: Infrastructure Management\nDetective Controls: Threat and Vulnerability Detection","D3.PC.IM.B.4\n\nD3.DC.TVD.B.2"]
[{"$f":"Lite!A184","v":4349},{"$f":"Lite!M184","v":16},{"$f":"Lite!K184","v":"T"},{"$f":"Lite!Y184","v":1},{"$f":"Lite!B184","v":"SL.164"},{"$f":"Lite!C184","v":"Is there a vulnerability management policy or program that has been approved by management, communicated to appropriate constituents and an owner assigned to maintain and review the policy?"},{"$f":"Lite!D184","v":"Yes"},{"$f":"Lite!E184","v":5},{"$f":"Lite!F184","v":"WalkMe performs monthly internal vulnerability assessments, and Annual External Penetration Tests, both against the applications and infrastructure of all environments. Summary of the latest Report is available upon request. The vulnerability scans that are performed monthly are Using industry leading Web & Network Vulnerability Scanners, including, but not limited to: Tenable.io Vulnerability Management (Formerly Nessus Cloud Vulnerability Scanner), OpenVAS, AlienVault USM, Nmap, and Burp Web Vulnerability Scanner. Findings are being valiated, assessed, classified and prioritized. All vulnerabilities classified as Critical or High, are remediated immediately. Remaining Identified vulnerabilities are examined and treated, according to Internal Security evaluation, which is done by the security team.\n\nSeverity Level Remediation Response Time\nCritical Issue is remediated within 1 week.\nHigh Issue is remediated within 2 weeks.\nMedium Issue is remediated within 3 months.\nLow Issue is remediated within 6-12 months."},{"$f":"Lite!G184","v":"T.4 Technical Compliance Checking - Vulnerability Testing and Remediation"},{"$f":"Lite!H184","v":"12.6.1"},{"$f":"Lite!I184","v":"Control of technical vulnerabilities"},null,null,null,null,null,null,"DE.CM-8"]
[{"$f":"Lite!A185","v":4365},{"$f":"Lite!M185","v":16},{"$f":"Lite!K185","v":"T"},{"$f":"Lite!Y185","v":1},{"$f":"Lite!B185","v":"SL.165"},{"$f":"Lite!C185","v":"Are vulnerability scans performed on all internet-facing applications at least monthly and after significant changes?"},{"$f":"Lite!D185","v":"Yes"},{"$f":"Lite!E185","v":5},{"$f":"Lite!F185","v":0},{"$f":"Lite!G185","v":"T.3 Application Vulnerability Assessments/Ethical Hacking"},{"$f":"Lite!H185","v":"12.6.1"},{"$f":"Lite!I185","v":"Management of technical vulnerabilities"},null,null,null,"11.2.3"]
[{"$f":"Lite!A186","v":3711},{"$f":"Lite!M186","v":16},{"$f":"Lite!K186","v":"T"},{"$f":"Lite!Y186","v":1},{"$f":"Lite!B186","v":"SL.166"},{"$f":"Lite!C186","v":"Are vulnerability scans performed against internal networks and systems?"},{"$f":"Lite!D186","v":"Yes"},{"$f":"Lite!E186","v":5},{"$f":"Lite!F186","v":0},{"$f":"Lite!G186","v":0},{"$f":"Lite!H186","v":0},{"$f":"Lite!I186","v":0},null,null,null,"11.2\n11.2.2",null,"DS5.9, DS5.11","DE.CM-8","164.308 (a)(1)(ii)(A)"]
[{"$f":"Lite!A187","v":3721},{"$f":"Lite!M187","v":16},{"$f":"Lite!K187","v":"T"},{"$f":"Lite!Y187","v":1},{"$f":"Lite!B187","v":"SL.167"},{"$f":"Lite!C187","v":"Are penetration tests performed?"},{"$f":"Lite!D187","v":"Yes"},{"$f":"Lite!E187","v":5},{"$f":"Lite!F187","v":0},{"$f":"Lite!G187","v":0},{"$f":"Lite!H187","v":0},{"$f":"Lite!I187","v":0},null,null,null,11.3,"3.C.3","DS5.9",null,"164.308 (a)(1)(ii)(A)"]
[{"$f":"Lite!A188","v":2233},{"$f":"Lite!M188","v":16},{"$f":"Lite!K188","v":"T"},{"$f":"Lite!Y188","v":1},{"$f":"Lite!B188","v":"SL.168"},{"$f":"Lite!C188","v":"Are there processes to manage threat and vulnerability assessment tools and the data they collect?"},{"$f":"Lite!D188","v":"Yes"},{"$f":"Lite!E188","v":5},{"$f":"Lite!F188","v":"Tools' generetad logs are audited as part of the penetration test process."},{"$f":"Lite!G188","v":"I.1 Application Security Program Governance"},{"$f":"Lite!H188","v":"12.6.1"},{"$f":"Lite!I188","v":"Management of technical vulnerabilities"},null,null,null,11.2,null,"AI2.3, AI2.4, DS5.7"]
[{"$f":"Lite!A189","v":0},{"$f":"Lite!M189","v":17},{"$f":"Lite!K189","v":1},{"$f":"Lite!Y189","v":1},{"$f":"Lite!B189","v":""},{"$f":"Lite!C189","v":"U. Server Security"},{"$f":"Lite!D189","v":0},{"$f":"Lite!E189","v":0},{"$f":"Lite!F189","v":0},{"$f":"Lite!G189","v":0},{"$f":"Lite!H189","v":0},{"$f":"Lite!I189","v":0}]
[{"$f":"Lite!A190","v":4366},{"$f":"Lite!M190","v":17},{"$f":"Lite!K190","v":"U"},{"$f":"Lite!Y190","v":1},{"$f":"Lite!B190","v":"SL.169"},{"$f":"Lite!C190","v":"Are Servers used for transmitting, processing or storing Scoped Data?"},{"$f":"Lite!D190","v":"Yes"},{"$f":"Lite!E190","v":5},{"$f":"Lite!F190","v":"Content is created using the WalkMe Editor Server, which in turn gathers the required Metadata to present the Walkthroughs via the WalkMe Player Server. During the publishing process, static JavaScript files are generated and the information is then stored on a private dedicated AWS S3 Bucket."},{"$f":"Lite!G190","v":0},{"$f":"Lite!H190","v":0},{"$f":"Lite!I190","v":0}]
[{"$f":"Lite!A191","v":2213},{"$f":"Lite!M191","v":17},{"$f":"Lite!K191","v":"U"},{"$f":"Lite!Y191","v":1},{"$f":"Lite!B191","v":"SL.170"},{"$f":"Lite!C191","v":"Are systems and applications patched?"},{"$f":"Lite!D191","v":"Yes"},{"$f":"Lite!E191","v":5},{"$f":"Lite!F191","v":"We have vulnerability & patch management procedure. We are using WSUS to patch & validate that workstations are regularly patched. On production servers we patch once a month, aside from high/critical security updates that are installed immediately. We have implemented Microsoft SCCM (System Center Configuration Manager) for in-office patch management."},{"$f":"Lite!G191","v":"G.2 System Patching"},{"$f":"Lite!H191","v":"12.6.1 "},{"$f":"Lite!I191","v":"Management of technical vulnerabilities"},null,"Corrective Controls: Patch Management","D3.CC.PM.B.1",6.2,null,"AI3.3, AI6.2, AI6.3, DS5.5, DS5.7, DS9.2","DE.CM-4"]
[{"$f":"Lite!A192","v":3568},{"$f":"Lite!M192","v":17},{"$f":"Lite!K192","v":"U"},{"$f":"Lite!Y192","v":1},{"$f":"Lite!B192","v":"SL.171"},{"$f":"Lite!C192","v":"Are default hardened base virtual images applied to virtualized operating systems?"},{"$f":"Lite!D192","v":"Yes"},{"$f":"Lite!E192","v":3},{"$f":"Lite!F192","v":"WalkMe hardens configures OS's and software securely, update it, create rules and policies to help govern the system in a secure manner, and remove unnecessary applications and services. This is done to minimize a computer OS's exposure to threats and to mitigate possible risk."},{"$f":"Lite!G192","v":"U.2 System Hardening Standards"},{"$f":"Lite!H192","v":0},{"$f":"Lite!I192","v":0},null,null,null,"N/A"]
[{"$f":"Lite!A193","v":3649},{"$f":"Lite!M193","v":17},{"$f":"Lite!K193","v":"U"},{"$f":"Lite!Y193","v":1},{"$f":"Lite!B193","v":"SL.172"},{"$f":"Lite!C193","v":"Are Hypervisors used to manage systems used to transmit, process or store Scoped Data?"},{"$f":"Lite!D193","v":"N/A"},{"$f":"Lite!E193","v":0},{"$f":"Lite!F193","v":"We use Amazon AWS as our cloud hosting provider. No Hypervisors used."},{"$f":"Lite!G193","v":"V.4 Security Review of Hypervisor Configuration"},{"$f":"Lite!H193","v":"14.1.2"},{"$f":"Lite!I193","v":"Securing application services on public networks"},null,null,null,"N/A"]
[{"$f":"Lite!A226","v":0},{"$f":"Lite!M226","v":0},{"$f":"Lite!K226","v":0},{"$f":"Lite!Y226","v":0},{"$f":"Lite!B226","v":0},{"$f":"Lite!C226","v":0},{"$f":"Lite!D226","v":0},{"$f":"Lite!E226","v":0},{"$f":"Lite!F226","v":0},{"$f":"Lite!G226","v":0},{"$f":"Lite!H226","v":0},{"$f":"Lite!I226","v":0}]

{"sheet":"Drops","index":12,"n_rows":8,"n_cols":5,"rows_kept":8,"cut":false,"hidden":true,"merged":[]}
["Binary","ScaledLarge","TabAuto","Master","QuesInclude"]
[null,null,"Enable",null,"Yes"]
["Yes",1,"Disable","Master","No"]
["No",2]
["N/A",3]
[null,4]
[null,5]
[null,"N/A"]