Security Oversight

Criteria: The company is a responsible caretaker of my data.

See this test in action:

• Smart lock
• Smart pressure cooker
• Smart baby monitor

Methodology for Assessing Each Indicator

1) The company has systems in place to limit and monitor employee access to user information.

• Obtain and review a copy of the product’s privacy policy, review any other online documentation available
• Look for language describing access limitations or data privacy policies that prevent employees from viewing user information.
• Review the website more generally, likely sections marked “Legal” or “Policies,” for information about user privacy and access to information.
• If the privacy policy indicates that the company has limitations or processes regulating employee access to user information, mark PASS.
• If the privacy policy does not indicate whether or not the company has limitations or processes regulating employee access to user information, mark FAIL.

2) The company has an internal security team that conducts security audits on the company's products and services.

• Obtain and review a copy of the product’s privacy policy.
• Look for language describing internal review processes or audits.
• Look for language describing staff or experts who are engaged in security audits.
• Review the website more generally, likely sections marked “Legal” or “Policies” for information about security audits.
• If the privacy policy indicates that the company has an internal security team that conducts security audits on the company's products and services, mark PASS.
• If the privacy policy does not indicate whether or not the company has limitations or processes regulating employee access to user information, mark FAIL.

3) The company commissions third-party security audits on its products and services.

• Obtain and review a copy of the product’s privacy policy.
• Look for language describing whether the company commissions third-parties to conduct review processes or audits of its services.
• Look for language describing which third-parties are engaged to conduct these audits.
• Review the website more generally, likely sections marked “Legal” or “Policies,” for information about third-party security audits.
• If the privacy policy or another part of the website indicates that the company commissions third-party security audits on its products and services, mark PASS.
• If the privacy policy does not indicate whether or not the company commissions third-party security audits on its products and services, mark FAIL.

4) The company ensures that third-parties who process data on behalf of the company implement the required technical and organizational measures to protect user data.

• Obtain and review a copy of the product’s privacy policy.
• Look for language describing security measures required of third-party data processors.
• If the privacy policy describes requirements for data protection policies by third-party data processors, mark PASS.
• If the privacy policy does not describe requirements for data protection policies by third-party data processors, mark FAIL.