BEAR provisions and revokes access to client-managed infrastructure based on client authorization and employee role.
Privileged credentials are centrally managed, rotated, and monitored. MFA enforced.
Access via secure jump hosts with MFA and session logging.
Standardized configuration of RMM agents across customer endpoints.
Automated systems apply patches and security updates; failed deployments remediated.
Lifecycle tracking for client-managed hardware, including EOL/EOS reporting.
Support requests validated via PIN, domain verification, ticket auth, or callback.
PSA system tracks and reports client SLA adherence.
Logical and operational controls isolate customer data and configurations.
Controls ensure data residency requirements are met for compliance.
Assist clients in assessing vendor security posture, SLAs, and breach practices.
Monitor and identify unauthorized client software/services.
Daily monitoring and testing of backups to maintain data integrity.
Periodic DR testing with clients to validate recoverability.
Technicians verify end-user identity before executing sensitive requests.
Privileged actions via RMM or remote desktop are logged and reviewed.
Requests escalated based on severity and permissions.
Maintain inventory of client-managed hardware assets.
Decommissioned hardware erased or destroyed; certificates of destruction retained.
Technicians log purpose, activities, systems accessed, and outcomes.
Least-privilege enforced via role-based access.
Personnel trained to protect client confidentiality and avoid cross-contamination.
Termination checklists ensure access is revoked promptly.
Passwords configured according to BEAR’s policy.
Remote access requires MFA.
Remote access via approved encrypted channels.
Unique credentials or SSH keys required for systems and applications.
Production systems restricted to authorized users with business need.
Documented requests and manager approval required for provisioning.
IDS provides continuous monitoring and detection.
Logs collected, retained, and monitored.
Sensitive data encrypted in transit.
Segmented production network protects customer data.
Key access limited to authorized users.
Firewalls deployed and rulesets reviewed annually.
Hardening standards documented and reviewed annually.
Formal vulnerability management and monitoring procedures in place.
Electronic media destroyed per best practices with certificates retained.
Formal retention and disposal procedures for data.
Pre-employment background checks performed.
Employees and contractors sign confidentiality agreements and acknowledge Code of Conduct.
Annual performance evaluations conducted.
Annual security awareness training required.
Formal inventory of production assets.
Customer datastores encrypted at rest.
Annual control self-assessments with corrective actions.
Annual penetration testing with remediation plans.
BC/DR plans established and tested annually.
Incident response policies established and tested annually.
Formal change management and configuration controls in place.
Quarterly access reviews conducted.
Annual risk assessments and risk management program in place.
Critical vendor inventory and reviews annually.
Insurance coverage maintained.
Formal SDLC governs system development and changes.
Data purged when customers leave the service.
Policy ensures confidential data properly secured.
