Organization should maintain documented information security policies
High
Cross-cloud
General
manual-soc2-security-policy
How to fix it
Maintain comprehensive information security policies covering access control, data classification, incident response, acceptable use, and change management. Review and update policies at least annually.
How to verify
- Verify information security policy document exists
- Confirm annual review date is within the last 12 months
- Verify policies cover all required domains
Compliance frameworks
Is your environment compliant with this rule?
CGPulse checks it — and 621 others — against your Azure and AWS accounts with read-only access.
Related Cross-cloud rules
- Block storage volumes must be encrypted
- Cache service security hardening
- Cache services must enforce TLS encryption in transit
- Container registry security hardening
- Database authentication must use managed identities
- Databases must not be publicly accessible
- IAM password policy must require minimum length of 14
- Key management service security hardening