Audit Review Summary

This page lists the various audits/reviews required to be performed regularly on a specific time frame, as covered in the other policies/procedures covered in the InfoSec wiki site for ThingLogix.

• Review Security Policy Changes with Employees and Contractors
  • Occurrence: Ad-hoc when changed during weekly all-hands web conference; Annual All-Hands Meeting for review
  • Owner: CEO and/or Security Manager
  • Reference: https://sites.google.com/thinglogix.com/thinglogix-infosec/information-security-infrastructure?pli=1&authuser=1

• Review Security Access to all ThingLogix applications
  • Occurrence: Monthly; reminder via automated Freshdesk ticket
    • Security Manager to manage the automated Freshdesk ticket reminders via scheduled calendar events from Google Calendar integrated with Freshdesk
  • Owner/Administrator:
    • AWS root access: Rob Rastovich / Collin Dutter
    • AWS IAM Policies: Rob Rastovich / Collin Dutter
    • G-Suite: Carl Krupitzer / Lauren Zondervan
    • Quickbooks Online: Carl Krupitzer / Lauren Zondervan
    • Freshdesk: Carl Krupitzer / Eric Dirst
    • Trello: Eric Dirst / Nilesh Patel
    • Harvest: Nilesh Patel / Lauren Zondervan
    • Bitbucket: Rob Rastovich / Collin Dutter
  • Reference: https://sites.google.com/thinglogix.com/thinglogix-infosec/information-security-infrastructure?pli=1&authuser=1
  • Reference: https://sites.google.com/thinglogix.com/thinglogix-infosec/access-control?pli=1&authuser=1

• Review Third Party Services, Reports and Records
  • Occurrence:
    • Services - upon delivery
    • Reports and Records - Monthly
  • Owner:
    • Services - Nilesh Patel
    • Reports and Records - Nilesh Patel for Accuracy, Lauren Zondervan for billing/payment authorization
  • Reference: https://sites.google.com/thinglogix.com/thinglogix-infosec/third-party-service-delivery-management?pli=1&authuser=1

• Review of audit trails and records of security events, operational problems, failures and service disruption
  • Occurrence: Every 2 Weeks review of CloudWatch and CloudTrail logs
  • Owner: Rob Rastovich, or assigned Development Team Member
  • Reference: https://sites.google.com/thinglogix.com/thinglogix-infosec/third-party-service-delivery-management?pli=1&authuser=1
  • Reference: https://sites.google.com/thinglogix.com/thinglogix-infosec/monitoring?pli=1&authuser=1

• Review of Office Access Rights
  • Occurence: Monthly
  • Owner: Carl Krupitzer/CEO
  • Reference: https://sites.google.com/thinglogix.com/thinglogix-infosec/access-control?pli=1&authuser=1

• Review Third Party Contractor adherence to ThingLogix InfoSec policies
  • Occurrence: Before contracting with firm (if possible), or within first year after contracting; then once every other year thereafter
  • Owner: Eric Dirst/COO
  • Reference: https://sites.google.com/s/1d5iN8wUBI1X7cygCHrAKVphc5BDAV--u/p/10LHRFP1iigplk4LNJE7dxi1awR-2rRyL/edit?pli=1&authuser=1