# Happeo Happeo is the leading AI-powered intranet platform that connects people, knowledge, and tools all in one place. Trusted by companies like Rayonier, Gant, and Neste, Happeo helps organizations improve collaboration, streamline internal communication, and make knowledge easy to find. Founded in 2017, Happeo serves hundreds of customers across borders and industries, with offices in New York, USA, Helsinki, Finland, Amsterdam, The Netherlands and Cluj, Romania. ## Controls Updated 8 minutes ago ### Infrastructure security | Control | Status | | --- | --- | | Information security for use of cloud services
Processes for acquisition, use, management and exit from cloud services shall be established in accordance with the organization’s information security requirements. | | | Protecting against physical and environmental threats
Protection against physical and environmental threats, such as natural disasters and other intentional or unintentional physical threats to infrastructure shall be designed and implemented. | | | Information deletion
Information stored in information systems, devices or in any other storage media shall be deleted when no longer required. | | | Data masking
Data masking shall be used in accordance with the organization’s topic-specific policy on access control and other related topic-specific policies, and business requirements, taking applicable legislation into consideration. | | | Data leakage prevention
Data leakage prevention measures shall be applied to systems, networks and any other devices that process, store or transmit sensitive information. | | | Information backup
Backup copies of information, software and systems shall be maintained and regularly tested in accordance with the agreed topic-specific policy on backup. | | | Monitoring activities
Networks, systems and applications shall be monitored for anomalous behaviour and appropriate actions taken to evaluate potential information security incidents. | | | Clock synchronization
The clocks of information processing systems used by the organization shall be synchronized to approved time sources. | | | Use of privileged utility programs
The use of utility programs that can be capable of overriding system and application controls shall be restricted and tightly controlled. | | | Installation of software on operational systems
Procedures and measures shall be implemented to securely manage software installation on operational systems. | | ### Organizational security | Control | Status | | --- | --- | | Return of assets
Personnel and other interested parties as appropriate shall return all the organization’s assets in their possession upon change or termination of their employment, contract or agreement. | | | Intellectual property rights
The organization shall implement appropriate procedures to protect intellectual property rights. | | | Security of assets off-premises
Off-site assets shall be protected. | | | Storage media
Storage media shall be managed through their life cycle of acquisition, use, transportation and disposal in accordance with the organization’s classification scheme and handling requirements. | | | Redundancy of information processing facilities
Information processing facilities shall be implemented with redundancy sufficient to meet availability requirements. | | | Capacity management
The use of resources shall be monitored and adjusted in line with current and expected capacity requirements. | | | Internal Audit Program
The organization shall plan, establish, implement and maintain an audit programme(s), including the frequency, methods, responsibilities, planning requirements and reporting.
When establishing the internal audit programme(s), the organization shall consider the importance of the processes concerned and the results of previous audits.
The organization shall:
a) define the audit criteria and scope for each audit;
b) select auditors and conduct audits that ensure objectivity and the impartiality of the audit process;
c) ensure that the results of the audits are reported to relevant management;
Documented information shall be available as evidence of the implementation of the audit programme(s) and the audit results. | | | Legal, statutory, regulatory and contractual requirements
Legal, statutory, regulatory and contractual requirements relevant to information security and the organization’s approach to meet these requirements shall be identified, documented and kept up to date. | | | Independent review of information security
The organization’s approach to managing information security and its implementation including people, processes and technologies shall be reviewed independently at planned intervals, or when significant changes occur. | | | Information transfer
Information transfer rules, procedures, or agreements shall be in place for all types of transfer facilities within the organization and between the organization and other parties. | | ### Product security | Control | Status | | --- | --- | | Secure disposal or re-use of equipment
Items of equipment containing storage media shall be verified to ensure that any sensitive data and licensed software has been removed or securely overwritten prior to disposal or re-use. | | | Access to source code
Read and write access to source code, development tools and software libraries shall be appropriately managed. | | | Secure coding
Secure coding principles shall be applied to software development. | | | Separation of development, test and production environments
Development, testing and production environments shall be separated and secured. | | | Information security in supplier relationships
Processes and procedures shall be defined and implemented to manage the information security risks associated with the use of supplier’s products or services. | | | Managing information security in the ICT supply chain
Processes and procedures shall be defined and implemented to manage the information security risks associated with the ICT products and services supply chain. | | ### Internal security procedures | Control | Status | | --- | --- | | ICT readiness for business continuity
ICT readiness shall be planned, implemented, maintained and tested based on business continuity objectives and ICT continuity requirements. | | | Acceptable use of information and other associated assets
Rules for the acceptable use and procedures for handling information and other associated assets shall be identified, documented and implemented. | | | Documented operating procedures
Operating procedures for information processing facilities shall be documented and made available to personnel who need them. | | | Disciplinary process
A disciplinary process shall be formalized and communicated to take actions against personnel and other relevant interested parties who have committed an information security policy violation | | | Response to information security incidents
Information security incidents shall be responded to in accordance with the documented procedures. | | | Learning from information security incidents
Knowledge gained from information security incidents shall be used to strengthen and improve the information security controls. | | | Security testing in development and acceptance
Security testing processes shall be defined and implemented in the development life cycle. | | ### Data and privacy | Control | Status | | --- | --- | | Equipment maintenance
Equipment shall be maintained correctly to ensure availability, integrity and confidentiality of information. | | | Cabling security
Cables carrying power, data or supporting information services shall be protected from interception, interference or damage. | |