Check List

Regulation of sales organization

Purpose

To confirm that sales person and technical engineers are trained for an adequate level of protection under control of security and risk management

Audit resources

Procedure

Verification

Document

Sales reports, Meeting record of customer information

Product

Detailed study list and method

-    Check if the risks to the organization’s information and information processing facilities from business processes involving external parties are identified and appropriate controls implemented before granting access.

-    Check if the policy of sales representatives and technicians are established to check that staff working outside lottery organization are trained and implemented for an adequate protection and security control.

Check List

Customer service areas

Purpose

To maintain the security of the organization’s information and information processing facilities that are accessed, processed, communicated to, or managed by external parties with customer.

Audit resources

Procedure

Verification

Document

Security requirements report, agreements with third parties

Product

Detailed study list and method

-    Check if all identified security requirements are addressed before giving customers access to the organization’s information or assets.

-    Check if agreements with third parties involving accessing, processing, communicating or managing the organization’s information or information processing facilities, or adding products or services to information processing facilities cover all relevant security requirements.

-    Check if a policy is established to ensure that staff working in sensitive areas with public access is receiving an adequate level of protection.