Do you know ALTA Best Practices, Pillar 3 specifically?

Pillar 3 of the ALTA Best Practices framework requires a written information security program protecting non-public personal information, with a named individual accountable for it. The current framework is version 4.0, which sharpened the security expectations considerably.

What it asks for, and where we fit:

• A written information security program. We help produce it and, more importantly, keep it matching reality. A policy that describes controls you do not have is worse than no policy.
• Risk assessment and asset inventory. Ours is continuous rather than annual, because we are managing the assets anyway.
• Network security and multi factor authentication. Version 4.0 singles out MFA as the most important control. It is a floor for every client we take on, so this is already in place.
• Password standards, timely patching, device security wherever NPI might land. Managed and reported.
• Third party and vendor due diligence. We can provide our own documentation, and help you assess the other vendors touching your data.
• Physical access, clean desk, retention and disposal. Partly operational and yours, partly technical and ours, including secure disposal of equipment that held NPI.

Pillar 2, escrow trust accounting, is your accounting function rather than ours, though we secure and control access to the systems it runs on.