{"text_format":"1","workbook":"xlsx","n_sheets":6,"sheets":["Checklist","Network Security ","Fraud Detection","Availability","Access Control ","Authentication"],"not_rendered":{"charts":0,"images":0,"macros":1,"external_links":0,"defined_names":1,"comments":0,"pivot_tables":0},"unopened":[],"bounds":{"document_bytes":16777216,"sheet_cells":100000,"rows_first":2000,"rows_last":500,"rows_between":2000,"halvings":0,"cell_chars":16384,"cell_head_chars":4096},"cells_cut":0,"cells_raw":0,"read":"whole","date_system":"1900"}

{"sheet":"Checklist","index":0,"n_rows":97,"n_cols":7,"rows_kept":97,"cut":false,"hidden":false,"merged":[[0,0,0,6]]}
["DFS Security audit Checklist"]
["Group","Security audit  Question","Audit Counts","Check","Applicable policy or procedure","Policy count","Policy Check"]
["Access Control ","Are login credentials of terminated DFS administrators, agents and users deactivated. Are dormant DFS accounts deactivated?",true,null,"Access control Policy: User access management",true]
["Access Control ","Are default system accounts removed from the DFS system and all systems that connect to DFS systems?",true,null,"Access control Policy: User access management",true]
["Access Control ","Are DFS vendor and support system accounts deactivated after support duties are completed?",true,null,"Access control Policy: User access management",true]
["Access Control ","Are the following logical controls set for DFS user sessions: i) auto logouts and session time out ii) Maximum failed password login attempts iii) Password and PIN complexity. iv) Password/PIN reuse periods",false,null,"Access control Policy: System and application access control",false]
["Access Control ","Are there controls in place to prevent multiple simultaneous logons through multiple channels?   Is the DFS provider only allowing a single session per user at a time to connect to the DFS network? (multiple sessions through different channels could be an indication of a breach)",false,null,"Access control Policy: System and application access control",true]
["Access Control ","Are there controls to limit access to DFS systems especially for remote login users?",false,null,"Access control Policy: User access management",false]
["Access Control ","Are there sufficient physical and logical barriers to limit access to DFS infrastructure? ",false,null,"Physical and environmental security- Secure areas",false]
["Access Control ","Does the DFS provider use Role Based Access Controls?",false,null,"Access control Policy: User access management",true]
["Access Control ","Does the DFS system have capability to detect out-of-pattern transactions based on customer profile?  For example: Does the DFS provider check authenticity of transactions using location-based validation of transactions, for example through geo-velocity tracking or other means?",false,null,"Access control Policy: System and application access control",false]
["Access Control ","Has the DFS provider limited concurrent user logins and provided the option for customers to opt into other login channels? For example, are customers who use USSD able to optionally choose to use a DFS app channel before the DFS provider activates access through this channel?",true,null,"Access control Policy: System and application access control",false]
["Access Control ","Has the DFS provider set a dormancy period after which inactive admin accounts are deactivated? Are all inactive dormant internal staff and API accounts deactivated?",false,null,"Access control Policy: User access management",false]
["Access Control ","Has the DFS provider set USSD and STK DFS sessions to automatically disconnect after a set period of user inactivity?",false,null,"Access control Policy: System and application access control",false]
["Access Control ","Is the DFS provider performing real time device validation before transaction processing? ",true,null,"System acquisition, development, and maintenance: Security in development and support processes",false]
["Access Control ","Is the password transmitted securely? Is the user required to change password after first time login?",false,null,"Access control Policy: User access management",true]
["Access Control ","Is there a maximum number of failed login attempts set before account is locked?",true,null,"Access control Policy: System and application access control",false]
["Access Control ","Is there a sufficient way of validating user identity before activating previously dormant accounts for example biometric validation?",true,null,"Access control Policy: User access management",false]
["Access Control ","Do trace logs and event data records capture/store sensitive user data? (e.g., are customer PINs stored in EDRs)",true,null,"Operations security: Operational procedures and responsibilities",false]
["Access Control ","Is there adequate monitoring of traffic for internet facing DFS applications?",false,null,"Operations security: Technical vulnerability management",false]
["Authentication","Are processes and policies in place to ensure that identity verification is in place prior to SIM swap operations? Are there technical mechanisms in place to prevent any leakage or transfer of information until the SIM swap has been confirmed?",false,null,"Access control Policy: User access management",false]
["Authentication","Are DFS user authentication credentials transmitted via a different channel/out-of-band? (e.g., if account setup is done via USSD channel are one-time passwords transmitted via e-mail or voice calls?)",false,null,"Access control Policy: System and application access control",false]
["Authentication","Are there controls to check validate privileged users? For example, through IP validation and checking login time?",false,null,"Access control Policy: User access management",false]
["Authentication","Does the DFS app stores or transmits Personal Account Number/Sensitive Authentication Data in plain text over SMS/email? ",true,null,"Asset management: Media handling",false]
["Authentication","Does the DFS provider enforce server-based authentication for all access requests? ",false,null,"Access control Policy: System and application access control",false]
["Authentication","Does the mobile network operator perform biometric authentication before SIM swaps or SIM replacement?",true,null,"Access control Policy: User access management",false]
["Authentication","Does the mobile network operator securely store SIM data like IMSI, Kc and Ki?",true,null,"Access control Policy: User access management",true]
["Authentication","Is multi factor used for authenticating users? ",false,null,"Access control Policy: System and application access control",true]
["Authentication","Is multifactor authentication used when connecting to DFS accounts?",true,null,"Access control Policy: User access management",true]
["Authentication","Is the DFS provider able to detect a SIM swap or SIM change for a DFS account?",false,null,"Access control Policy: System and application access control",false]
["Authentication","Is the DFS provider checking the IMSI of mobile numbers used for DFS transactions to protect against SIM swaps?",true,null,"Access control Policy: User access management",false]
["Authentication","Is the DFS provider involved in the SIM recycling process for DFS accounts?",false,null,"Asset management: Media handling",true]
["Authentication","Is the DFS provider performing XML validation of data through APIs and USSD requests? E.g., input validation, amounts, special characters in amounts, currency checks etc.",true,null,"System acquisition, development, and maintenance: Security in development and support processes",false]
["Authentication","Is there additional authorisation and authentication for high value transactions and changes on DFS user accounts? For example, what additional checks are done when increasing transaction limits?",false,null,"Access control Policy: User access management",false]
["Authentication","Does the DFS system have capability to detect out-of-pattern transactions based on customer profile?  Are the DFS provider performing checks based on user transactions profile? E.g., agent shops performing late transactions, DFS users perfuming transactions in two different locations?",false,null,"Access control Policy: System and application access control",true]
["Availability","Are there procedures in place for the DFS provider to detect suspicious SIM swaps and SIM recycling?",false,null,"Operations security: Backup",true]
["Availability","Are there policies in place to assure management during system downtime?",true,null,"Access control Policy: User access management",false]
["Availability","Are there end to end tests been performed after changes or upgrades to the DFS systems? End to end tests may include capacity tests, security tests, QoS tests, user acceptance tests etc.",true,null,"Access control Policy: User access management",false]
["Availability","Are there systems in place to ensure service availability? Example (service redundancy) Are there reports and utilities to measure system response time and down time?",true,null,"Information security incident management: Redundancies",false]
["Availability","Are there systems to measure quality of service and quality of experience? Do the QoS and QoE conform to the standards for DFS? ",false,null,"System acquisition, development, and maintenance: Security in development and support processes",false]
["Availability","Is there regular penetration testing of the DFS systems?",false,null,"Operations security: Technical vulnerability management",false]
["Fraud Detection ","Are there security guidelines followed when disposing of DFS related data?",false,null,"Operations security: Technical vulnerability management",false]
["Fraud Detection ","Does the DFS provider have regular scheduled backups? Are the backups encrypted and stored on an offsite location?",false,null,"Operations security: Logging and monitoring",false]
["Fraud Detection ","Are DFS logs stored securely in a tamper proof module? E.g., SIEM",true,null,"Operations security: Logging and monitoring",false]
["Fraud Detection ","Are there mechanisms in place to detect data modification and tampering on the database?",false,null,"Operations security: Logging and monitoring",false]
["Fraud Detection ","Are there mechanisms to detect SMS and call spoofing? E.g., CLI analysis?",true,null,"Communications security: Information transfer",false]
["Fraud Detection ","Are there sufficient controls to review and approve for critical changes on accounts? e.g., is there maker-checker and approval process before changes are made?",false,null,"Access control Policy: System and application access control",false]
["Fraud Detection ","Do the audit logs provided sufficiently track all changes on the DFS system or MNO systems that affect DFS services?",false,null,"Operations security: Logging and monitoring",false]
["Fraud Detection ","Do the DFS customers get alerts when DFS transactions are performed on their accounts?",true,null,"Access control Policy: User access management",false]
["Fraud Detection ","Does the app store transactions for later transmission? ",false,null,"Operations security: Operational procedures and responsibilities",false]
["Fraud Detection ","Does the DFS provider implement Role Based Access Controls?",false,null,"Access control Policy: User access management",false]
["Fraud Detection ","Is there a mechanism in place to review administrative privileges? ",false,null,"Data Security and Data Leakage Prevention Standard",false]
["Fraud Detection ","Is there more than one person required to complete a critical DFS tasks?",true,null,"Access control Policy: System and application access control",false]
["Network Security ","Are there policies and processes in place to manage a new threats and attacks to the DFS systems?",true,null,"Operations security: Operational procedures and responsibilities",true]
["Network Security ","Are all devices used to connect to DFS systems scanned for threats and checked for the latest software patches?",false,null,"Operations security: Operational procedures and responsibilities",false]
["Network Security ","Are code changes tested and approved before moving it into production? For example, user and internal acceptance certificates that show that the code was tested.",true,null,"System acquisition, development, and maintenance: Security in development and support processes",true]
["Network Security ","Are encryption keys were changed from default at installation? Are default SNMP strings changed?",true,null,"Communications Security Policy: Network security management",true]
["Network Security ","Are the clocks within the DFS ecosystem synchronized?",true,null,"Operations security: Operational procedures and responsibilities",true]
["Network Security ","Are the DFS systems updated to the latest versions to protect against new threats?",true,null,"Operations security: Protection from malware",false]
["Network Security ","Are the encryption algorithms and keys used are strong enough to protect customer PINs and data?",false,null,"Cryptography: - Cryptographic controls",false]
["Network Security ","Are the firewall rules adequately configured? e.g. port whitelisting, packet filtering",true,null,"Operations security: Protection from malware",false]
["Network Security ","Are there adequate protections against network attacks like firewalls and traffic filters with proper configurations?",false,null,"Operations security: Protection from malware",true]
["Network Security ","Are there logical boundaries that limit access to the DFS systems from all other systems?  (For example, are other unauthorized internal users logically and/physically limited on the network from accessing DFS processing systems)",false,null,"Communications Security Policy: Network security management",true]
["Network Security ","Are there operational controls to detect threats associated with APIs? Are there controls in place to detect rouge/malicious APIs? ",false,null,"Operations security: Protection from malware",false]
["Network Security ","Are there procedures in place to monitor software updates and are the updates installed securely?",false,null,"Operations security: Technical vulnerability management",true]
["Network Security ","Are there technical controls in place to limit exposure of internal DFS systems addresses (like database IP addresses?",true,null,"Communications Security Policy: Network security management",false]
["Network Security ","Does the DFS provider have a mechanism in place to securely store cryptographic keys? ",true,null,"Cryptography: - Cryptographic controls",false]
["Network Security ","Does the MNO enforce use of the Personal Unlock Key on SIM cards to reduce the risk associated with stolen SIMs that are used for DFS?",true,null,"Communications security: Information transfer",false]
["Network Security ","Does the MNO have a firewall in place to detect and protect against external SS7 based attacks? For example (firewall protection against subscriber traffic interception, unauthorized USSD and SM use)",true,null,"Communications Security Policy: Network security management",false]
["Network Security ","Does the MNO operator have controls in place to limit access to MAP tracing and use of protocol analysers on the internal network? (SMS and USSD messages are transmitted in plain text in the MAP protocol)",true,null,"Access control Policy: User access management",false]
["Network Security ","Has MNO implemented the SS7 and diameter signaling controls to protect against SS7 vulnerabilities?",false,null,"Communications Security Policy: Network security management",false]
["Network Security ","Has the use of known weak ciphers been discontinued? Has the deployment been prepared for new ciphers?",true,null,"Communications security: Information transfer",true]
["Network Security ","Is the DFS provider performing input validation checks?",false,null,"System acquisition, development, and maintenance: Security in development and support processes",true]
["Network Security ","Is the DFS provider performing user transaction geo-velocity checks before transaction processing?",true,null,"System acquisition, development, and maintenance: Security in development and support processes",false]
["Network Security ","Is TLS encryption used secure? i.e., v.12 or higher (July 2020) Does the app use latest versions of TLS?  Does the app use any deprecated TLS version? ",true,null,"Communications security: Information transfer",false]
["Network Security ","Is transaction validation performed using secure OTP? ",true,null,"Access control Policy: User access management",true]
["Network Security ","Do event logs contain customer-sensitive data such as PINs? ",false,null,"Operations security: Technical vulnerability management",false]
["Network Security ","Does the application or underlying operating system provide support for remote wipes of DFS data or of the mobile device, and are there mechanisms in place to ensure that data is encrypted in the event of device loss or theft?",true,null,"Operations security: Technical vulnerability management",false]
["Network Security ","Is there limitation on customer sensitive information shared during transaction processing with third parties? (e.g., Only information needed for processing the transaction is shared with the third party)",true,null,"Operations security: Technical vulnerability management",true]
["Privacy & Confidentiality","Are there regular vulnerability scans that are performed on the DFS systems?",false,null,"Operations security: Operational procedures and responsibilities",false]
["Privacy & Confidentiality","Are there sufficient mechanisms to monitor transactions processed through payment APIs? Does the DFS provider have nondisclosure agreements pertaining to customer sensitive data with third parties? Are there strong cryptographic algorithms used when transferring data with third parties? ",true,null,"Operations security: Logging and monitoring",false]
["Privacy & Confidentiality","Are the DFS systems patched against known vulnerabilities?",true,null,"Operations security: Operational procedures and responsibilities",true]
["Privacy & Confidentiality","Are there pending transactions, duplicate transactions in the DFS system? Has the transaction been fully executed?",false,null,"Operations security: Protection from malware",true]
["Privacy & Confidentiality","Are digital signatures used by DFS applications or by third-party providers? Are the digital signatures based on sufficiently strong cryptographic algorithms and key sizes? Are the implementations of the cryptographic algorithms secure and up to date and do they provide sufficient randomness? (For example, strong digital signature algorithms include RSA, DSA, and ECDSA. Elliptic-curve cryptographic algorithms can use shorter keys to provide equivalent security to other ciphers.) ",false,null,"Access control Policy: User access management",false]
["Privacy & Confidentiality","Are procedures in place to assure the trustworthiness and protection of private and secret keys? Are certificates and other cryptographic information protected by operating system controls?",false,null,"Access control Policy: User access management",true]
["Privacy & Confidentiality","Are digital signatures used to identify third party providers that connect to the DFS systems?",true,null,"Access control Policy: System and application access control",true]
["Privacy & Confidentiality","Are the cryptographic libraries used by the operating system or by the application correctly designed and implemented and are they up to date? Do the cryptographic libraries support strong cryptographic ciphersuites and do they prevent or discourage use of weak ciphersuites? Are hashing algorithms used that have not been deprecated and are adequate digest lengths supported? (Anything less than SHA512 is considered weak today. MD5 and SHA1 have been broken.) For symmetric encryption ciphers, are strong ciphers used and are adequate key lengths supported? (For example, AES is considered secure to use while 3-DES is no longer a preferred cipher because of the SWEET-32 attack, and it is encouraged to move away from it to AES as soon as possible.) - For public-key encryption, are key lengths chosen to be an appropriate size for the public key algorithm being used? Are the criteria used for selecting cryptographic algorithms and key sizes based on public and well-examined standards? (For example, NIST 800-57 special publication has guidelines on minimum key sizes for each algorithm and how long this key size is good for)",true,null,"Cryptography: - Cryptographic controls",false]
["Privacy & Confidentiality","Are the encryption algorithms and keys used are strong enough to protect customer PINs and data?",false,null,"Cryptography: - Cryptographic controls",false]
["Privacy & Confidentiality","Are there processes that limit the data shared with third parties when transactions are being performed?",false,null,"Asset management: Media handling",true]
["Privacy & Confidentiality","Has all sensitive consumer data been encrypted by the application or the operating system? Are unencrypted versions of the data accessible in the device, for example, in temporary buffers or in memory? Is all information sent over a network connection encrypted with a strong encryption cipher? (See C17 for more discussion of what comprises a strong encryption cipher.) ",false,null,"Cryptography: - Cryptographic controls",true]
["Privacy & Confidentiality","Have strong encryption ciphers and integrity protection mechanisms such as message authentication codes been used for data stored on the device and when data is communicated to backend DFS systems? (See C17 for a discussion of strong encryption algorithms.) Are policies in place to assure the reaction of sensitive customer confidential information?",false,null,"Cryptography: - Cryptographic controls",true]
["Privacy & Confidentiality","Is test data and test user accounts deleted from the production environment?",false,null,"System acquisition, development, and maintenance: Security in development and support processes",true]
["Privacy & Confidentiality","Is the DFS data and forms used for customer registration securely stored, transmitted, and stored to prevent any data leakages using RBAC, data encryption etc.?",false,null,"Asset management: Media handling",true]
["Privacy & Confidentiality","Is the TLS lifetime certificate up to date? I.e., the certificate age should be less than 825 days",false,null,"Communications Security Policy: Network security management",true]
["Privacy & Confidentiality","Is there a mechanism in place to ensure that data-at-rest is encrypted and stored securely? ",false,null,"Data Security and Data Leakage Prevention Standard",true]
["Privacy & Confidentiality","Is there a monitoring mechanism in place to track data sharing through APIs?  Are there controls in place to prevent data leakage? ",false,null,"Communications Security Policy: Network security management",true]
["Privacy & Confidentiality","Is there proper segregation of data implemented for tests and production environments?   Are there processes that limit the use of customer data for test purposes? Such as data anonymization",false,null,"Asset management: Media handling",false]

{"sheet":"Network Security ","index":1,"n_rows":28,"n_cols":5,"rows_kept":28,"cut":false,"hidden":true,"merged":[]}
[]
[null,"1.5             Network Security "]
["Network Security ","1.5.1        Are all devices used to connect to DFS systems scanned for threats and checked for the latest software patches?","Network Security ",true,{"$f":"IF(D3,1,0)","v":1}]
["Network Security ","1.5.2        Are code changes tested and approved before moving it into production? For example, user and internal acceptance certificates that show that the code was tested.","Network Security ",true,1]
["Network Security ","1.5.3        Are encryption keys were changed from default at installation? Are default SNMP strings changed?","Network Security ",false,0]
["Network Security ","1.5.4        Are the clocks within the DFS ecosystem synchronized?","Network Security ",true,1]
["Network Security ","1.5.5        Are the DFS systems patched against known vulnerabilities?","Network Security ",false,0]
["Network Security ","1.5.6        Are the DFS systems updated to the latest versions to protect against new threats?","Network Security ",true,1]
["Network Security ","1.5.7        Are the encryption algorithms and keys used are strong enough to protect customer PINs and data?","Network Security ",true,1]
["Network Security ","1.5.8        Are the firewall rules adequately configured? e.g. port whitelisting, packet filtering","Network Security ",true,1]
["Network Security ","1.5.9        Are there adequate protections against network attacks like firewalls and traffic filters with proper configurations?","Network Security ",false,0]
["Network Security ","1.5.10     Are there logical boundaries that limit access to the DFS systems from all other systems?  (For example, are other unauthorized internal users logically and/physically limited on the network from accessing DFS processing systems)","Network Security ",false,0]
["Network Security ","1.5.11     Are there operational controls to detect threats associated with APIs? Are there controls in place to detect rouge/malicious APIs? ","Network Security ",true,1]
["Network Security ","1.5.12     Are there pending transactions, duplicate transactions in the DFS system? Has the transaction been fully executed?","Network Security ",false,0]
["Network Security ","1.5.13     Are there procedures in place to monitor software updates and are the updates installed securely?","Network Security ",true,1]
["Network Security ","1.5.14     Are there technical controls in place to limit exposure of internal DFS systems addresses (like database IP addresses?","Network Security ",false,0]
["Network Security ","1.5.15     Does the DFS provider have a mechanism in place to securely store cryptographic keys? ","Network Security ",true,1]
["Network Security ","1.5.16     Does the MNO enforce use of the Personal Unlock Key on SIM cards to reduce the risk associated with stolen SIMs that are used for DFS?","Network Security ",true,1]
["Network Security ","1.5.17     Does the MNO have a firewall in place to detect and protect against external SS7 based attacks? For example (firewall protection against subscriber traffic interception, unauthorized USSD and SM use)","Network Security ",true,1]
["Network Security ","1.5.18     Does the MNO operator have controls in place to limit access to MAP tracing and use of protocol analysers on the internal network? (SMS and USSD messages are transmitted in plain text in the MAP protocol)","Network Security ",true,1]
["Network Security ","1.5.19     Has MNO implemented the SS7 and diameter signaling controls to protect against SS7 vulnerabilities?","Network Security ",true,1]
["Network Security ","1.5.20     Has the use of known weak ciphers been discontinued? Has the deployment been prepared for new ciphers?","Network Security ",false,0]
["Network Security ","1.5.21     Is the DFS provider performing input validation checks?","Network Security ",true,1]
["Network Security ","1.5.22     Is the DFS provider performing user transaction geo-velocity checks before transaction processing?","Network Security ",false,0]
["Network Security ","1.5.23     Is there adequate monitoring of traffic for internet facing DFS applications?","Network Security ",true,1]
["Network Security ","1.5.24     Is there regular penetration testing of the DFS systems?","Network Security ",false,0]
["Network Security ","1.5.25     Is TLS encryption used secure? i.e., v.12 or higher (July 2020) Does the app use latest versions of TLS?  Does the app use any deprecated TLS version? ","Network Security ",true,1]
["Network Security ","1.5.26     Is transaction validation performed using secure OTP? ","Network Security ",true,1]

{"sheet":"Fraud Detection","index":2,"n_rows":13,"n_cols":5,"rows_kept":13,"cut":false,"hidden":true,"merged":[]}
[null,"1.4             Fraud Detection "]
[" Fraud Detection ","1.4.1        Are DFS logs stored securely in a tamper proof module? E.g., SIEM"," Fraud Detection ",true,{"$f":"IF(D2,1,0)","v":1}]
[" Fraud Detection ","1.4.2        Are there mechanisms in place to detect data modification and tampering on the database?"," Fraud Detection ",true,1]
[" Fraud Detection ","1.4.3        Are there mechanisms to detect SMS and call spoofing? E.g., CLI analysis?"," Fraud Detection ",false,0]
[" Fraud Detection ","1.4.4        Are there sufficient controls to review and approve for critical changes on accounts? e.g., is there maker-checker and approval process before changes are made?"," Fraud Detection ",true,1]
[" Fraud Detection ","1.4.5        Are there sufficient mechanisms to monitor transactions processed through payment APIs? Does the DFS provider have nondisclosure agreements pertaining to customer sensitive data with third parties? Are there strong cryptographic algorithms used when transferring data with third parties? "," Fraud Detection ",true,1]
[" Fraud Detection ","1.4.6        Do the audit logs provided sufficiently track all changes on the DFS system or MNO systems that affect DFS services?"," Fraud Detection ",false,0]
[" Fraud Detection ","1.4.7        Do the DFS customers get alerts when DFS transactions are performed on their accounts?"," Fraud Detection ",true,1]
[" Fraud Detection ","1.4.8        Do trace logs and event data records capture/store sensitive user data? (e.g., are customer PINs stored in EDRs)"," Fraud Detection ",true,1]
[" Fraud Detection ","1.4.9        Does the app store transactions for later transmission? "," Fraud Detection ",true,1]
[" Fraud Detection ","1.4.10     Does the DFS provider implement Role Based Access Controls?"," Fraud Detection ",true,1]
[" Fraud Detection ","1.4.11     Is there a mechanism in place to review administrative privileges? "," Fraud Detection ",false,0]
[" Fraud Detection ","1.4.12     Is there more than one person required to complete a critical DFS tasks?"," Fraud Detection ",true,1]

{"sheet":"Availability","index":3,"n_rows":7,"n_cols":5,"rows_kept":7,"cut":false,"hidden":true,"merged":[]}
[null,"1.3             Availability"]
["Availability","1.3.1        Are there policies in place to assure management during system downtime?","Availability",false,{"$f":"IF(D2,1,0)","v":0}]
["Availability","1.3.2        Are there end to end tests been performed after changes or upgrades to the DFS systems? End to end tests may include capacity tests, security tests, QoS tests, user acceptance tests etc.","Availability",true,1]
["Availability","1.3.3        Are there regular vulnerability scans that are performed on the DFS systems?","Availability",false,0]
["Availability","1.3.4        Are there systems in place to ensure service availability? Example (service redundancy) Are there reports and utilities to measure system response time and down time?","Availability",true,1]
["Availability","1.3.5        Are there systems to measure quality of service and quality of experience? Do the QoS and QoE conform to the standards for DFS? ","Availability",false,0]
["Availability","1.3.6        Does the DFS provider have regular scheduled backups? Are the backups encrypted and stored on an offsite location?","Availability",true,1]

{"sheet":"Access Control ","index":4,"n_rows":20,"n_cols":5,"rows_kept":20,"cut":false,"hidden":true,"merged":[]}
[]
[null,"1.1             Access Control ","Control","Check ","Counts"]
["Access Control ","1.1.1        Are login credentials of terminated DFS administrators, agents and users deactivated. Are dormant DFS accounts deactivated?","Access Control ",false,{"$f":"IF(D3,1,0)","v":0}]
["Access Control ","1.1.2        Are default system accounts removed from the DFS system and all systems that connect to DFS systems?","Access Control ",false,0]
["Access Control ","1.1.3        Are DFS vendor and support system accounts deactivated after support duties are completed?","Access Control ",true,1]
["Access Control ","1.1.4        Are the following logical controls set for DFS user sessions: i) auto logouts and session time out ii) Maximum failed password login attempts iii) Password and PIN complexity. iv) Password/PIN reuse periods","Access Control ",false,0]
["Access Control ","1.1.5        Are there procedures in place for the DFS provider to detect suspicious SIM swaps and SIM recycling?","Access Control ",true,1]
["Access Control","1.1.6        Are there controls in place to prevent multiple simultaneous logons through multiple channels?   Is the DFS provider only allowing a single session per user at a time to connect to the DFS network? (multiple sessions through different channels could be an indication of a breach)","Access Control ",true,1]
["Access Control ","1.1.7        Are there controls to limit access to DFS systems especially for remote login users?","Access Control ",false,0]
["Access Control ","1.1.8        Are there policies and processes in place to manage a new threats and attacks to the DFS systems?","Access Control ",true,1]
["Access Control ","1.1.9        Are there sufficient physical and logical barriers to limit access to DFS infrastructure? ","Access Control ",false,0]
["Access Control ","1.1.10     Does the DFS provider use Role Based Access Controls?","Access Control ",true,1]
["Access Control ","1.1.11     Does the DFS system have capability to detect out-of-pattern transactions based on customer profile?  For example: Does the DFS provider check authenticity of transactions using location-based validation of transactions, for example through geo-velocity tracking or other means?","Access Control ",true,1]
["Access Control ","1.1.12     Has the DFS provider limited concurrent user logins and provided the option for customers to opt into other login channels? For example, are customers who use USSD able to optionally choose to use a DFS app channel before the DFS provider activates access through this channel?","Access Control ",true,1]
["Access Control ","1.1.13     Has the DFS provider set a dormancy period after which inactive admin accounts are deactivated? Are all inactive dormant internal staff and API accounts deactivated?","Access Control ",false,0]
["Access Control ","1.1.14     Has the DFS provider set USSD and STK DFS sessions to automatically disconnect after a set period of user inactivity?","Access Control ",false,0]
["Access Control ","1.1.15     Is the DFS provider performing real time device validation before transaction processing? ","Access Control ",true,1]
["Access Control ","1.1.16     Is the password transmitted securely? Is the user required to change password after first time login?","Access Control ",true,1]
["Access Control ","1.1.17     Is there a maximum number of failed login attempts set before account is locked?","Access Control ",true,1]
["Access Control ","1.1.18     Is there a sufficient way of validating user identity before activating previously dormant accounts for example biometric validation?","Access Control ",false,0]

{"sheet":"Authentication","index":5,"n_rows":17,"n_cols":5,"rows_kept":17,"cut":false,"hidden":true,"merged":[]}
[]
[null,"1.2             Authentication"]
["Authentication","1.2.1        Are processes and policies in place to ensure that identity verification is in place prior to SIM swap operations? Are there technical mechanisms in place to prevent any leakage or transfer of information until the SIM swap has been confirmed?","Authentication",true,{"$f":"IF(D3,1,0)","v":1}]
["Authentication","1.2.2        Are DFS user authentication credentials transmitted via a different channel/out-of-band? (e.g., if account setup is done via USSD channel are one-time passwords transmitted via e-mail or voice calls?)","Authentication",true,1]
["Authentication","1.2.3        Are there controls to check validate privileged users? For example, through IP validation and checking login time?","Authentication",true,1]
["Authentication","1.2.4        Does the DFS app stores or transmits Personal Account Number/Sensitive Authentication Data in plain text over SMS/email? ","Authentication",false,0]
["Authentication","1.2.5        Does the DFS provider enforce server-based authentication for all access requests? ","Authentication",true,1]
["Authentication","1.2.6        Does the mobile network operator perform biometric authentication before SIM swaps or SIM replacement?","Authentication",true,1]
["Authentication","1.2.7        Does the mobile network operator securely store SIM data like IMSI, Kc and Ki?","Authentication",true,1]
["Authentication","1.2.8        Is multi factor used for authenticating users? ","Authentication",false,0]
["Authentication","1.2.9        Is multifactor authentication used when connecting to DFS accounts?","Authentication",true,1]
["Authentication","1.2.10     Is the DFS provider able to detect a SIM swap or SIM change for a DFS account?","Authentication",false,0]
["Authentication","1.2.11     Is the DFS provider checking the IMSI of mobile numbers used for DFS transactions to protect against SIM swaps?","Authentication",true,1]
["Authentication","1.2.12     Is the DFS provider involved in the SIM recycling process for DFS accounts?","Authentication",false,0]
["Authentication","1.2.13     Is the DFS provider performing XML validation of data through APIs and USSD requests? E.g., input validation, amounts, special characters in amounts, currency checks etc.","Authentication",true,1]
["Authentication","1.2.14     Is there additional authorisation and authentication for high value transactions and changes on DFS user accounts? For example, what additional checks are done when increasing transaction limits?","Authentication",false,0]
["Authentication","1.2.15     Does the DFS system have capability to detect out-of-pattern transactions based on customer profile?  Are the DFS provider performing checks based on user transactions profile? E.g., agent shops performing late transactions, DFS users perfuming transactions in two different locations?","Authentication",false,0]