SOC for Cybersecurity - Cybersecurity Risk Management Examination DC19: DC19 Key security policies and processes: prevention, detection and response, capacity, environmental events and back-up, and confidential information retention

Describe the key security policies and processes addressing (a) preventing security events, deliberate or accidental (data protection at rest, in processing and in transit; data loss prevention; identification, authentication, authorisation and credentials; physical and logical access provisioning including remote access; privileged accounts; IT asset lifecycle; site physical and environmental safeguards; change, acquisition, development and patch management); (b) detection of events, identification of incidents from internal and third-party sources, evaluation, impact assessment, response, restoration with executive oversight, lessons learned, communications to management and affected third parties, and periodic testing of the incident response plan; (c) processing capacity monitoring and forecasting; (d) detecting and recovering from environmental events, back-up and restoration, and a tested business continuity plan with prioritised recovery and alternate processing; and (e) identifying confidential information, setting and enforcing retention periods, and destroying it at the end of retention. Whether a formal security policy exists, and what it covers, is also described.