Trust Center Control Categories

Category

Description

Infrastructure Security

This category focuses on security of the underlying technological infrastructure that supports an organization's operations and product.

This includes servers (physical and virtual), networks, cloud environments, databases, and other hardware/software components.

Controls in this area often cover things like network segmentation, vulnerability management, and secure configuration.

Organizational Security

This category address the security aspects related to the overall organization's structure, processes and people.

It encompasses policies, procedures, and training that ensures security is embedded throughout the company.

Examples include security awareness training for employees, background checks, incident response planning, security roles and responsibilities, and physical security of office spaces.

Product Security

This category specifically deals with the security of the products or services of an organization offers to its customers.

it covers the entire software development cycle (SLDC) from design to deployment and maintenance.

Controls here include secure coding practices, security testing (penetration testing, vulnerability scanning), application security controls (input validation, authentication, authorization), Incident response plan.

Internal Security Procedures

This category deals with the security of your organization's internal operations, systems and infrastructure. It encompasses the policies, processes, and technologies used to protect your own corporate assets and data.

This typically includes: Access controls to internal systems and data, employee security awareness training, endpoint security (Anti-virus, mobile device management for employee computers), network security, incident response for internal security breaches.

Data and Privacy

This category is dedicated to the protection of sensitive data, especially personal identifiable information (PII) and other confidential information, and ensuring compliance with privacy regulations.

This often involves: Data classification and handling policies, data encryption (In transit and at rest), data retention and disposal policies, privacy by design principles, data access logging and monitoring.