Consumer Data Right How-to Guides

ABOUT OUR GUIDES

All you need to know to became an ADR

AssuranceLab’s CDR guides summarise the security and compliance activities required to become an Accredited Data Recipient.

As specialists in cloud services and cybersecurity, our team at AssuranceLab knows the ins and outs of modern products and approaches to satisfy compliance without overburdening your business.

CDR SECURITY WHITEPAPER

A checklist of requirements for your environment

The Consumer Data Right requires information security controls to be implemented at four levels; organisational, infrastructure, software, and endpoint devices. Our white papers provide a checklist to address each layer as it relates to your cloud environment. Get in touch if you want to explore our solution partners that offer out-of-the-box, compliant environments.

Google CDR Security White Paper

Download now

AWS CDR Security White Paper

Download now

PART O1

Governance requirements

There are five steps to implement the governance requirements of the
CDR Schedule 2, Part 1. The three stages to audits and assurance
reporting outline the stages of working to accreditation.

Three stages to audits and assurance reporting

There are three steps for working towards the assurance report for accreditation.

Step 1: CDR security governance

Define and implement a formal governance framework for managing information security risks.

Define the boundaries of your CDR environment

Step 2: Boundaries of CDR data environment

Define and document the boundaries of your CDR data environment and underlying system components.

Step 3: Information security capability

Maintain an information security capability that complies with Schedule 2 Part 2 requirements below.

Step 4: Controls assessment program

Implement a testing program to assess the effectiveness of the information security capability.

Step 5: Manage and report security incidents

Establish procedures and practices to detect, record, and respond to security incidents.

READ MORE

PART 02.1

Access control

An accredited data recipient must have processes in place to limit the
risk of inappropriate or unauthorised access to its CDR data environment.

Access control

The Access Control Policy covers several specific requirements of the CDR for accreditation.

Joiners and leavers

Joiners and leavers checklists are a simple approach to support your access control practices.

User access reviews

Periodically reviewing system access ensures your users remain appropriate with continued business needs.

READ MORE

PART 02.2

Network security

An accredited data recipient of CDR data must take steps to secure their
network and systems within the CDR data environment.

Network Security

Protecting the network perimeter with firewalls and monitoring of network traffic for suspicious activity.

COMING SOON

Hardening and Patching

Security hardening and patching of critical system components to reduce system vulnerabilities.

COMING SOON

CDR Policy

The CDR Policy sets out the use of consumer data and the terms of use and rights of those users.

Physical security

Ensuring access to the data centres and places of business are restricted to authorised personnel.

READ MORE

Encryption

Applying encryption and securing encryption keys to protect the CDR data from unauthorised access.

READ MORE

Segregation of duties

Separating user access roles and duties to ensure the change control process is followed appropriately.

READ MORE

PART 02.3

Information Asset Lifecycle

Separating user access roles and duties to ensure the change control process
is followed appropriately.

Data loss prevention

Ensuring data remains secure within the boundaries of the system and not inadvertently disclosed.

Data handling - information Classification and Handling Policy

Data handling policies

Defining the structure and approach to classifying and handling sensitive information.

Backup and disposal

Established practices for backup, retention, and secure disposal of sensitive information.

COMING SOON

PART 02.4

Vulnerability Management

An accredited data recipient must implement a formal vulnerability management
program to identify, track and remediate vulnerabilities within the CDR data
environment in a timely manner.

Vulnerability program

An established program for identifying, assessing, logging, and resolving technical vulnerabilities.

Change control

Defined policies, procedures, and steps to ensure appropriate and high-quality software development.

Change release checklist

A combined checklist of steps and functions to be performed for each software release.

READ MORE

PART 02.5

Anti-malware

An accredited data recipient must take steps to limit prevent, detect and remove
malware in regards to their CDR data environment.

Anti-malware practices

A combination of security practices and employee behaviours to mitigate the risk of malicious software.

Application whitelisting

Establishing a listing of approved software and restricting the installation on endpoint devices.

COMING SOON

Anti-virus software

Software to identify, block, quarantine, and resolve malicious software from endpoint devices and servers.

Security Awareness

An accredited data recipient must implement a formal information security
training and awareness program for all personnel interacting with CDR data.

Acceptable use

READ MORE

Security awareness

Training for employees to raise awareness of security and privacy risks, requirements and objectives.

READ MORE

Background checks

Police checks and other background checks conducted on employees prior to hiring.

Consumer Data Right How-to Guides

ABOUT OUR GUIDES

All you need to know to became an ADR

AssuranceLab’s CDR guides summarise the security and compliance activities required to become an Accredited Data Recipient.

As specialists in cloud services and cybersecurity, our team at AssuranceLab knows the ins and outs of modern products and approaches to satisfy compliance without overburdening your business.

CDR SECURITY WHITEPAPER

A checklist of requirements for your environment

PART O1

Governance requirements

There are five steps to implement the governance requirements of the
CDR Schedule 2, Part 1. The three stages to audits and assurance
reporting outline the stages of working to accreditation.

PART 02.1

Access control

An accredited data recipient must have processes in place to limit the
risk of inappropriate or unauthorised access to its CDR data environment.

PART 02.2

Network security

An accredited data recipient of CDR data must take steps to secure their
network and systems within the CDR data environment.

PART 02.3

Information Asset Lifecycle

Separating user access roles and duties to ensure the change control process
is followed appropriately.

PART 02.4

Vulnerability Management

An accredited data recipient must implement a formal vulnerability management
program to identify, track and remediate vulnerabilities within the CDR data
environment in a timely manner.

PART 02.5

Anti-malware

An accredited data recipient must take steps to limit prevent, detect and remove
malware in regards to their CDR data environment.

PART 02.6

Security Awareness

An accredited data recipient must implement a formal information security
training and awareness program for all personnel interacting with CDR data.

We earn trust, to help our clients earn trust.

Company

Products

Audits

Resources

Consumer Data Right How-to Guides

ABOUT OUR GUIDES

All you need to know to became an ADR

AssuranceLab’s CDR guides summarise the security and compliance activities required to become an Accredited Data Recipient.

As specialists in cloud services and cybersecurity, our team at AssuranceLab knows the ins and outs of modern products and approaches to satisfy compliance without overburdening your business.

CDR SECURITY WHITEPAPER

A checklist of requirements for your environment

PART O1

Governance requirements

There are five steps to implement the governance requirements of theCDR Schedule 2, Part 1. The three stages to audits and assurancereporting outline the stages of working to accreditation.

PART 02.1

Access control

An accredited data recipient must have processes in place to limit therisk of inappropriate or unauthorised access to its CDR data environment.

PART 02.2

Network security

An accredited data recipient of CDR data must take steps to secure theirnetwork and systems within the CDR data environment.

PART 02.3

Information Asset Lifecycle

Separating user access roles and duties to ensure the change control processis followed appropriately.

PART 02.4

Vulnerability Management

An accredited data recipient must implement a formal vulnerability managementprogram to identify, track and remediate vulnerabilities within the CDR dataenvironment in a timely manner.

PART 02.5

Anti-malware

An accredited data recipient must take steps to limit prevent, detect and removemalware in regards to their CDR data environment.

PART 02.6

Security Awareness

An accredited data recipient must implement a formal information securitytraining and awareness program for all personnel interacting with CDR data.

There are five steps to implement the governance requirements of the
CDR Schedule 2, Part 1. The three stages to audits and assurance
reporting outline the stages of working to accreditation.

An accredited data recipient must have processes in place to limit the
risk of inappropriate or unauthorised access to its CDR data environment.

An accredited data recipient of CDR data must take steps to secure their
network and systems within the CDR data environment.

Separating user access roles and duties to ensure the change control process
is followed appropriately.

An accredited data recipient must implement a formal vulnerability management
program to identify, track and remediate vulnerabilities within the CDR data
environment in a timely manner.

An accredited data recipient must take steps to limit prevent, detect and remove
malware in regards to their CDR data environment.

An accredited data recipient must implement a formal information security
training and awareness program for all personnel interacting with CDR data.