Confidentiality and non-disclosure agreements are signed by all employees and contractors.

"Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes."

# 1. Download the .tsr file above
# 2. Get the TSA root certificate (DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA):
#    curl -O https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem
# 3. Verify:
openssl ts -verify \
  -in tsr-manual.access.nda-*.tsr \
  -digest 6d616e75616c2e6163636573732e6e64613a64656d6f \
  -CAfile $(basename https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem)
# Expected: Verification: OK

System access for terminated employees is revoked within 24 hours of separation.

Administrator and privileged accounts are reviewed quarterly. Access is granted on least-privilege principles.

User access to production systems and sensitive data is formally reviewed and certified every quarter.

"Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes."

# 1. Download the .tsr file above
# 2. Get the TSA root certificate (DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA):
#    curl -O https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem
# 3. Verify:
openssl ts -verify \
  -in tsr-manual.access.quarterly_review-*.tsr \
  -digest 6d616e75616c2e6163636573732e717561727465726c795f7265766965773a64 \
  -CAfile $(basename https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem)
# Expected: Verification: OK

An inventory of information and associated assets (systems, data, media, cloud services) is maintained together with ownership and classification. Reviewed at least annually and updated when assets are added or retired.

A disaster recovery test has been conducted in the current year and results have been reviewed by management.

The relative criticality of specific applications and data in support of contingency planning has been assessed and documented: which systems hold or process ePHI, their recovery priority, and the maximum tolerable downtime for each.

A business continuity plan has been reviewed, approved, and covers recovery time and recovery point objectives.

A current diagram exists showing how cardholder data enters, is processed by, and leaves your systems (Stripe hosted Checkout, iframe, redirect). Reviewed and updated at least annually or upon any material change to the flow.

A list of every script loaded on any page that accepts payment card data (including SAQ A hosted-Checkout redirect pages) is maintained with a documented business justification for each. Any script not on the list is treated as unauthorized.

Every quarter, the CDE boundary is re-confirmed: what systems store, process, or transmit PAN; what systems are connected-to or security-impacting; what is out of scope and why. Changes are documented.

All production changes go through a documented approval process including testing requirements and rollback procedures.

Security requirements are incorporated into the software development lifecycle including code review and security testing.

A CMMC Level 1 self-assessment against all 17 practices has been completed within the past 12 months, and a senior official has affirmed continuing compliance in the Supplier Performance Risk System (SPRS). The assessment record and the affirmation date are retained.

"Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes."

# 1. Download the .tsr file above
# 2. Get the TSA root certificate (DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA):
#    curl -O https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem
# 3. Verify:
openssl ts -verify \
  -in tsr-manual.cmmc.sprs_affirmation-*.tsr \
  -digest 6d616e75616c2e636d6d632e737072735f61666669726d6174696f6e3a64656d \
  -CAfile $(basename https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem)
# Expected: Verification: OK

The systems, storage locations, and external connections that store, process, or transmit Federal Contract Information are identified and documented, including which contracts the FCI relates to. Reviewed at least annually and when systems or contracts change. Knowing where FCI lives is the precondition for limiting access to it.

"Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes."

# 1. Download the .tsr file above
# 2. Get the TSA root certificate (DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA):
#    curl -O https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem
# 3. Verify:
openssl ts -verify \
  -in tsr-manual.cmmc.fci_scoping-*.tsr \
  -digest 6d616e75616c2e636d6d632e6663695f73636f70696e673a64656d6f \
  -CAfile $(basename https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem)
# Expected: Verification: OK

A specific individual is formally designated as the security official responsible for developing and implementing the Security Rule policies and procedures. The designation is documented and current.

"Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes."

# 1. Download the .tsr file above
# 2. Get the TSA root certificate (DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA):
#    curl -O https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem
# 3. Verify:
openssl ts -verify \
  -in tsr-manual.hipaa.security_officer-*.tsr \
  -digest 6d616e75616c2e68697061612e73656375726974795f6f6666696365723a6465 \
  -CAfile $(basename https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem)
# Expected: Verification: OK

The scope of the Information Security Management System is documented, including boundaries and applicability, interfaces and dependencies, and any exclusions with justification. Reviewed at least annually and after significant organizational change.

Information security objectives are established at relevant functions and levels, are consistent with the security policy, are measurable where practical, and are monitored, communicated, and updated as appropriate.

A formal information security policy has been reviewed and approved by management within the past 12 months.

"Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes."

# 1. Download the .tsr file above
# 2. Get the TSA root certificate (DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA):
#    curl -O https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem
# 3. Verify:
openssl ts -verify \
  -in tsr-manual.governance.security_policy-*.tsr \
  -digest 6d616e75616c2e676f7665726e616e63652e73656375726974795f706f6c6963 \
  -CAfile $(basename https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem)
# Expected: Verification: OK

Management reviews and approves the information security program annually and accountability is assigned.

"Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes."

# 1. Download the .tsr file above
# 2. Get the TSA root certificate (DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA):
#    curl -O https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem
# 3. Verify:
openssl ts -verify \
  -in tsr-manual.governance.board_oversight-*.tsr \
  -digest 6d616e75616c2e676f7665726e616e63652e626f6172645f6f76657273696768 \
  -CAfile $(basename https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem)
# Expected: Verification: OK

Top management has reviewed the ISMS within the past 12 months, considering audit results, feedback, risk assessment results, achievement of objectives, and opportunities for improvement. Decisions and actions are documented.

A current Statement of Applicability lists every Annex A control, whether it is included or excluded, the justification for the decision, and whether it is implemented. Updated whenever the risk treatment plan or applied controls change.

All employees have completed security awareness training in the current calendar year.

"Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes."

# 1. Download the .tsr file above
# 2. Get the TSA root certificate (DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA):
#    curl -O https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem
# 3. Verify:
openssl ts -verify \
  -in tsr-manual.hr.security_training-*.tsr \
  -digest 6d616e75616c2e68722e73656375726974795f747261696e696e673a64656d6f \
  -CAfile $(basename https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem)
# Expected: Verification: OK

Pre-employment background checks are conducted for all employees with access to production systems.

"Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes."

# 1. Download the .tsr file above
# 2. Get the TSA root certificate (DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA):
#    curl -O https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem
# 3. Verify:
openssl ts -verify \
  -in tsr-manual.hr.background_checks-*.tsr \
  -digest 6d616e75616c2e68722e6261636b67726f756e645f636865636b733a64656d6f \
  -CAfile $(basename https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem)
# Expected: Verification: OK

Personnel with access to systems in scope for PCI DSS complete PCI-specific security awareness training at hire and at least annually thereafter. Training covers cardholder data handling, phishing, and role-specific responsibilities. Attendance and materials are retained.

A documented sanction policy applies appropriate consequences to workforce members who fail to comply with security policies and procedures. Application of sanctions is recorded when they occur.

An incident response tabletop exercise has been conducted in the current year and results have been documented.

A breach notification process is documented and tested, complying with applicable regulatory requirements.

The incident response plan includes card-brand-specific breach notification steps: forensics firm on retainer, card-brand notification contacts (Visa/Mastercard/Amex/Discover), acquirer notification path, and evidence preservation procedures for CHD-related incidents.

A formal incident response plan exists, has been approved by management, and is reviewed and updated annually.

"Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes."

# 1. Download the .tsr file above
# 2. Get the TSA root certificate (DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA):
#    curl -O https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem
# 3. Verify:
openssl ts -verify \
  -in tsr-manual.incident.ir_plan-*.tsr \
  -digest 6d616e75616c2e696e636964656e742e69725f706c616e3a64656d6f \
  -CAfile $(basename https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem)
# Expected: Verification: OK

An annual penetration test has been completed by a qualified third party and critical findings have been remediated.

An internal audit of the ISMS has been conducted within the past 12 months against the requirements of ISO/IEC 27001 and the organization's own procedures. Findings are documented and tracked to closure.

Nonconformities identified through audit, incident, or review are logged with root cause, corrective action, responsible owner, and closure evidence. The tracker is reviewed by management on a defined cadence.

A change-detection mechanism is in place on all payment pages (including redirects to hosted Checkout) that alerts on unauthorized modification of headers, scripts, or content. Evidence of alert testing and any triaged alerts is retained.

Policies govern the receipt, movement, reuse, and disposal of hardware and electronic media containing ePHI: sanitization before reuse, destruction records for disposed media, accountability logs for media movement, and backup before equipment moves.

Policies and procedures limit physical access to systems containing ePHI and the facilities housing them (office, data-room, or the physical-access responsibilities delegated to a cloud or colocation provider), while ensuring authorized access is allowed. Contingency operations and facility security plans are addressed.

Information system media containing Federal Contract Information, paper and digital, is sanitized or destroyed before disposal or release for reuse, with a record of what was sanitized or destroyed, when, how, and by whom.

"Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes."

# 1. Download the .tsr file above
# 2. Get the TSA root certificate (DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA):
#    curl -O https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem
# 3. Verify:
openssl ts -verify \
  -in tsr-manual.cmmc.media_disposal-*.tsr \
  -digest 6d616e75616c2e636d6d632e6d656469615f646973706f73616c3a64656d6f \
  -CAfile $(basename https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem)
# Expected: Verification: OK

Keys, badges, access cards, and other physical access devices for areas housing Federal Contract Information are inventoried, issued against named individuals, and recovered or deactivated when no longer needed.

Visitors to facilities housing systems with Federal Contract Information are escorted, their activity is monitored, and physical access is logged. For fully cloud-hosted environments, the provider's physical-access responsibility and any office areas where FCI is handled are both addressed.

Policies specify the proper functions, manner of use, and physical safeguards for workstations that can access ePHI: screen locking, disk encryption on laptops, clean-desk expectations for PHI, and restrictions on public or shared devices.

"Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes."

# 1. Download the .tsr file above
# 2. Get the TSA root certificate (DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA):
#    curl -O https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem
# 3. Verify:
openssl ts -verify \
  -in tsr-manual.hipaa.workstation_security-*.tsr \
  -digest 6d616e75616c2e68697061612e776f726b73746174696f6e5f73656375726974 \
  -CAfile $(basename https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem)
# Expected: Verification: OK

An information security risk assessment covering the in-scope environment has been completed in the current year.

Fraud risks have been identified and controls are in place and monitored to mitigate them.

A risk treatment plan is documented showing selected treatment options, necessary controls (from Annex A and elsewhere), residual risk, and risk-owner approvals. Reviewed after the annual risk assessment or upon significant change.

An accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI has been completed, is documented, and is updated when the environment or threat landscape changes materially. Scope explicitly identifies where ePHI is created, received, maintained, and transmitted.

"Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes."

# 1. Download the .tsr file above
# 2. Get the TSA root certificate (DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA):
#    curl -O https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem
# 3. Verify:
openssl ts -verify \
  -in tsr-manual.hipaa.risk_analysis-*.tsr \
  -digest 6d616e75616c2e68697061612e7269736b5f616e616c797369733a64656d6f \
  -CAfile $(basename https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem)
# Expected: Verification: OK

All vendors with access to production data or systems have been assessed for security controls annually.

"Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes."

# 1. Download the .tsr file above
# 2. Get the TSA root certificate (DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA):
#    curl -O https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem
# 3. Verify:
openssl ts -verify \
  -in tsr-manual.vendor.annual_review-*.tsr \
  -digest 6d616e75616c2e76656e646f722e616e6e75616c5f7265766965773a64656d6f \
  -CAfile $(basename https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem)
# Expected: Verification: OK

A current inventory lists every business associate and subcontractor that creates, receives, maintains, or transmits ePHI on the organization's behalf, with the BAA status and date for each. Reviewed at least annually.

"Reviewed by demo admin. Evidence file uploaded; placeholder for demo purposes."

# 1. Download the .tsr file above
# 2. Get the TSA root certificate (DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA):
#    curl -O https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem
# 3. Verify:
openssl ts -verify \
  -in tsr-manual.hipaa.baa_inventory-*.tsr \
  -digest 6d616e75616c2e68697061612e6261615f696e76656e746f72793a64656d6f \
  -CAfile $(basename https://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt.pem)
# Expected: Verification: OK

A maintained list of all TPSPs with which cardholder data is shared or that could affect the security of the CDE (payment processor, cloud host, ASV, WAF, tag manager) including each party's PCI DSS AoC status and responsibility matrix.

Data Processing Agreements or Business Associate Agreements are signed with all vendors handling customer or sensitive data.

Signed written agreements are in place with each TPSP in scope that explicitly acknowledge which PCI DSS requirements they are responsible for on your behalf.