Laserfiche WebLink
<br />©2025 Lumifi Cyber, Inc. All rights reserved. <br />PRIVATE - Controlled by Lumifi Cyber <br /> <br />23/25 <br />PRIVATE - Controlled by Lumifi Cyber <br />• How do you assess the controls expected on classified systems or <br />systems and networks handling regulated or classified data? <br />• Do you apply role-based access to applications and systems using <br />regulated or classified data? <br />• Do you follow the Principle of Least Privilege when creating Windows, <br />applications and SaaS access roles for regulated or classified data? <br />• DBAs and Application Administrators: <br />• Cloud SaaS or on premises? <br />• How do you provide access based on the principle of least privilege? <br />• Is all access to the application for users entirely role -based access <br />control (RBAC) and what are those roles based on? <br />• Is access reviewed periodically and how often? <br />• How is access approved? <br />• Do you use multifactor authentication for access whether by users or by <br />administrators? <br />• How are users decommissioned? <br />• How are connections made to the DB, stored procedures or direct DB <br />calls? <br />• Is data encryption enforced at the application layer or the DB layer and <br />how and what ciphers? <br />• What authentication methods are used for the application and where can <br />the application be accessed from, i.e. the Internet or internal only? <br />• Is the application using a fat client, thin client, Citrix/RDP or VPN? <br />• Facilities and Plant Interview Session: People whose responsibilities include building <br />and facility access control, employee and visitor badging and escorting, video <br />monitoring, card key and physical key systems, datacenter controls such as back -up <br />power, temperature sensors, water sensors, fire suppression, paper and media <br />management and disposal (shredding), up to 1 hour <br />• Describe physical security controls <br />• Card keys <br />• Duplicates allowed? <br />• Temp card keys issued to employees when left ‘at home’?