ANPD checklist — security measures for small organizations

Self-assessment of security and privacy measures for small processing agents, including small businesses (EPP in Portuguese), based on ANPD guidance.

Enable JavaScript to use the tool controls. Processing takes place in your browser.

Self-assessment

45 measures · 8 categories

The 45 measures below are a SinapseTech adaptation based on the ANPD checklist. This instrument does not certify compliance with the LGPD.

Source and reference

Checklist ANPD · Guidance document

ANPD — Guia Orientativo sobre Segurança da Informação para Agentes de Tratamento de Pequeno Porte — versão 1.0, outubro/2021

Security measures

Information Security Policy

Establish simplified policy with controls (backup, passwords, access, email, antivirus, etc.)
Define basic rules such as making backups, using strong passwords, and not opening suspicious attachments.
Periodically review the policy
Review the policy every 6 months or 1 year to keep up with changes.

Awareness and Training

Training and campaigns on LGPD and ANPD
Organize talks and educational materials on data protection.
Raise employee awareness of legal obligations
Show that protecting information protects the company and its clients.
Guide the use of IT controls
Teach the team to use antivirus, make backups, and configure passwords.
Guide incident prevention (viruses, phishing)
Show examples of suspicious emails and teach warning signs.
Secure storage of physical documents
Documents with personal data should be kept in locked cabinets.
Prohibition of sharing logins and passwords
Each person should have their own login.
Lock workstations when stepping away
Configure automatic lock or use Windows+L before leaving.
Encourage incident reporting
Create an environment where problems can be reported without fear.

Contract Management

Include security clauses in contracts
Require data protection in contracts with suppliers.
Define rules for suppliers and partners
Document how suppliers should handle information.
Rules on controller-processor sharing
Define who decides and who executes data processing.
Prohibit incompatible processing
Data collected for one purpose cannot be used for another.
Sign NDAs with employees
Confidentiality agreement to protect company secrets.

Access Control

Avoid using default passwords
Always change factory default passwords on equipment.
Use complex passwords
Use at least 8 characters mixing letters, numbers, and symbols.
Do not reuse passwords
Each system should have a unique password.
Implement proportional access control system
Grant access only to what is necessary for each role.
Block weak passwords
Configure systems to reject obvious passwords.
Prohibit sharing of accounts/passwords
Each person should have their own login.
Apply the principle of least privilege
Grant only the minimum necessary permissions.
Use multi-factor authentication
Configure a second authentication factor.

Personal Data Security

Maintain workstation security configurations
Keep computers updated with antivirus and firewall.
Avoid transferring data to external media
Avoid personal USB drives for company data.
Inventory and encrypt external devices
List and encrypt all storage devices.
Perform offline and secure backups
Make regular copies and store in a different location.
Dispose of media with overwriting or destruction
Completely erase before discarding equipment.
Formalize secure disposal in contracts with third parties
Require a certificate of data destruction.
Minimize personal data collection
Collect only what is essential.
Implement pseudonymization (encryption)
Use pseudonyms and masking for sensitive data.

Communications Security

Use TLS/HTTPS or end-to-end encryption
Use HTTPS on websites and secure connections for email.
Install firewall and/or WAF
Enable firewall on the router and use services like Cloudflare.
Adopt AntiSpam tools and email filters
Configure filters to automatically block spam.
Remove personal data from public networks
Never access systems on public Wi-Fi.
Periodically update systems and apps
Configure automatic updates.
Adopt and update antivirus/antimalware
Use a reliable antivirus and keep it updated.
Perform periodic antivirus scans
Configure a full weekly scan.

Mobile Devices

Multi-factor authentication on mobile devices
Configure password + biometrics on mobile phones.
Separate personal and institutional devices
Use separate profiles for work and personal life.
Implement remote wipe capability
Configure the ability to remotely erase data.

Cloud Services

Establish SLAs with providers
Define service guarantees in writing.
Evaluate provider security requirements
Check certifications and server locations.
Define user access requirements
Configure who can view and edit each resource.
Use multi-factor authentication in cloud services
Configure 2FA on Google Drive, OneDrive, etc.

#main-content > [data-route-loading]{display:none!important}

SinapseTech