1. Are you domiciled in South Africa with no operations outside South Africa to be covered under this policy?
Yes No

2. Do you collect, store or process less than all of the below:

1. 100 000 personally identifiable records (name, ID number, contact details, address)
2. 100 000 bank records or financial account details
3. 100 000 unique payment cards per year (credit card, debit card)
4. 50 000 medical records or health information

Yes No

3. Please confirm if you have implemented the following security controls:

• Active, paid for Internet Security software on all Sensitive Systems e.g Anti-Virus / Anti-Malware
• Apply patches and updates noted as being critical by the provider within 1 month of release and general security related patches and updates within 3 months of release
• Password controls including:
  1. Minimum 8 characters
  2. Passwords which are not easy to guess e.g. not consisting of your name, the company name or well-known simple passwords such as Password!1
  3. Passwords changed at least quarterly unless multi factor authentication is implemented or 14-character passwords are used
  4. Accounts are locked out after at most 10 failed authentication attempts
• Resiliency controls including:
  1. Weekly backup generation or replication (process of copying or reproducing data to a separate location)
  2. Having a backup copy which is separate to or protected from your production (live/working) environment so that the likelihood of one incident impacting live and backup data is mitigated e.g. backup to cloud, disconnected/offline storage or ransomware protection enabled backup generation software
  3. Test the ability to restore or read from backups at least every 6 months

Yes No

Multi factor authentication to gain access to payment applications
Yes No

If you have a company network, please confirm that you have implemented all the following:

• Firewalls to restrict access to Sensitive Information
• Where enabled, remote access is exclusively via secured channels such as virtual private network (VPN)
• Sensitive System activity logs such as firewall and Active Directory (as used in your environment) are stored for at least 3 months

Yes No Not Applicable