Security Readiness (V1)

SEC-GOV-1 - Security policy governance

• Do you maintain approved security policies?
• Are policy owners assigned and reviewed quarterly?

SEC-ACC-1 - Identity and access controls

• Is MFA enforced for privileged accounts?
• Are access reviews performed at least quarterly?