Q1：Please provide your network and data flow diagrams.- 请提供您的网络和数据流程图。- 请参阅附件 PDF： Q01-POF.pdf
Q2：Please walk through interaction sequence for system components that handle PII data.- 请介绍处理 PII 数据的系统组件的交互顺序。- 请参阅附件 PDF： Q02-POF.pdf
Q3：Data Governance - Are employees required to acknowledge your Privacy and Data Handling Policies? Is Security awareness Training provided? Please provide your employee contract that addresses data Handaling, NDA,acceptable use etc.- 数据治理 员工是否需要了解您的隐私和数据处理政策？是否提供安全意识培训？请提供您的员工合同，其中涉及数据处理、保密协议、可接受的使用等。- 请参阅附件 PDF： Q03-pof.pdf
Q4：Secure Coding Practices - Walk us through the SDLC process from testing to production? Is coding done in-house? Please provide the following:- Screenshot of test environment with dummy data
- Provide your SDLC policy
- Walk us through the process of how code is reviewed prior to release
- Provide example of scanning code for vulnerabilities prior to each release- 安全编码实践 向我们介绍从测试到生产的 SDLC 流程？编码是在内部完成的吗？请提供以下信息：
- 带有虚拟数据的测试环境的屏幕截图
- 提供您的 SDLC 政策
- 向我们介绍发布前代码审查的过程
- 提供每次发布前扫描代码以查找漏洞的示例- 请参阅附件 PDF： Q04-pof.pdf
Q5：Asset Management- Do you maintain and update an inventory of software and physical assets? Walk us through who(specific job titles) is responsible for change management.- Please share your asset inventory(means of tracking hardware such as laptops and software).- Who is responsible for change management?- 资产管理 您是否维护和更新软件和实物资产清单？向我们介绍谁（具体职位）负责变更管理。
- 请分享您的资产清单（跟踪笔记本电脑和软件等硬件的手段）。
- 谁负责变更管理？- 请参阅附件 PDF： Q05-pof.pdf
Q6：Network Protection - Please walk us through the Network control configurations on Web layer, application layer and database layer?- Please attach screenshot evidence showing that you have network protection tools in place(e.g.[e.g. Firewalls, VPN, ACL, security groups, protection against web attacks such as DDOS, etc.) If in AWS, this would be VPC configuration, WAF, Shield, Security Group rules, ACL configuration, etc)- 网络保护 请向我们介绍 Web 层、应用程序层和数据库层的网络控制配置？
- 请附上屏幕截图证据，表明您已安装网络保护工具（例如 [例如防火墙、VPN、ACL、安全组、针对 DDOS 等 Web 攻击的保护等。如果在 AWS 中，这将是 VPC 配置、WAF、Shield、安全组规则、ACL 配置等）- 请参阅附件 PDF： Q06-1-pof.pdf
Q6：Encryption in Transit - What are the different internal and external data transfers that take place? How do you monitor
them?- Please provide evidence that your application is configured to communicate through HTTPS(minimum TLS 1.2 or later),for example through TLS certificates. For AWS this can be shown through what minimum SSL/TLS protocol CloudFront is configured to support. and through the AWS Certificate Manager.- 传输中加密 - 发生的不同内部和外部数据传输有哪些？您如何监控它们？
- 请提供证据，证明您的应用程序已配置为通过 HTTPS（最低 TLS 1.2 或更高版本）进行通信，例如通过 TLS 证书。对于 AWS，可以通过 CloudFront 配置为支持的最低 SSL/TLS 协议以及通过 AWS 证书管理器来显示。- 请参阅附件 PDF： Q06-2-pof.pdf
Q7：Encryption at rest - Where are you storing Amazon data [especially if beyond 30 days]? Can you walk us through the encryption set up?- Please provide the database configuration(e.g. system setting and/or script) showing that PII data is encrypted at rest with at least AES 256 level of protection.- 静态加密 您将 Amazon 数据存储在哪里 [尤其是超过 30 天时]？您能向我们介绍加密设置吗？
- 请提供数据库配置（例如系统设置和/或脚本），表明 PII 数据在静止状态下已加密，且至少具有 AES 256 级别的保护。- 请参阅附件 PDF： Q07-pof.pdf
Q8：Access Managemnt - Can you give us an overview of how your access management is designed for your organization? e.g., how do you authenticate and authorize, or decide on permissions for each user? How often is access reviewed?- Please provide your Access Control Policy
- Please provide User Diagram/Org Chart or Access Control Matrix
- Please provide your User Access Review(for example recurring meeting minutes/memo or other means to track that a scheduled review of access is performed)- 访问管理 您能否概述一下贵组织的访问管理设计？例如，您如何验证和授权，或决定每个用户的权限？多久审查一次访问权限？
- 请提供您的访问控制策略
- 请提供用户图表/组织结构图或访问控制矩阵
- 请提供您的用户访问审查（例如定期会议记录/备忘录或其他方式来跟踪是否执行了预定的访问审查）- 请参阅附件 PDF： Q08-pof.pdf
Q9：Least Privileged Principle - Walk us through you decide on permission for each user? If a user tries to perform a function outside their assigned role, what happens?- Please show that the application has unique roles and permissions assigned to users.- 最小特权原则 请向我们介绍您决定每个用户的权限的过程？如果用户试图执行其分配角色之外的功能，会发生什么？
- 请说明应用程序具有分配给用户的唯一角色和权限。- 请参阅附件 PDF： Q09-pof.pdf
Q10：What is the authorization model implemented to integrate with MWS/SP- APIs?How are you authenticating into the network and application environment?- Please provide a screenshot of your password settings for your application and network
- Additionally, please provide evidence of secure means of establishing connections(e.g. VPN, MFA, SSH connection to servers)- Can you provide the Seller setup guide to authorize your application? This can be linked or attached in the case.- 为与 MWS/SP-API 集成而实施的授权模型是什么？您如何验证进入网络和应用程序环境？
- 请提供您应用程序和网络的密码设置的屏幕截图
- 此外，请提供建立连接的安全方式的证据（例如 VPN、MFA、与服务器的 SSH 连接）
- 您能否提供卖家设置指南来授权您的应用程序？这可以链接或附在案例中。- 请参阅附件 PDF： Q10-pof.pdf
Q11： Data Retention - How are you archiving and retrieving data on need-by basis? How do you delete data? Please show retention/deletion settings.- Please provide the scheduled job/task that deletes PII data after 30 days
- If data is moved to cold storage after 30 days, please provide this evidence showing the task and how it is encrypted.- 数据保留 您如何根据需要存档和检索数据？您如何删除数据？请显示保留/删除设置。
- 请提供在 30 天后删除 PII 数据的计划作业/任务
- 如果数据在 30 天后移至冷存储，请提供此证据以显示任务及其加密方式。- 请参阅附件 PDF： Q11-pof.pdf
Q12：Logging and Monitoring - What type of logging and monitoring mechanism you have in-place. Walk us through how you detect unauthorized access to your systems and what type of mitigation plan you have when there is a suspicious activity. Are logs protected
against tampering?- Please provide the log configurations showing the type of alerts and monitoring that occurs in your environment(e.g.database, network, APIs).- Please show the log retention setting
- Please provide a screenshot of the users who have elevated access to logs?- Do logs contain PII?- 日志记录和监控 您已部署了哪种类型的日志记录和监控机制。
- 向我们介绍您如何检测对系统的未经授权的访问以及当出现可疑活动时您有哪种类型的缓解计划。日志是否受到保护以防止篡改？
- 请提供日志配置，显示您的环境中发生的警报和监控类型（例如数据库、网络、API）。
- 请显示日志保留设置
- 请提供具有日志访问权限的用户的屏幕截图？
- 日志是否包含 PII？- 请参阅附件 PDF： Q12-pof.pdf
Q13：Incident Response Walk through the Incident Response Plan. What notification mechanisms are in place to notify you about an incident?- Please provide your Incident Response Plan; it should include notice to 3p-security@amazon.com in event of incident involving data obtained through Amazon APIs.- Please summarize the steps taken from incident notification to remediation.- 事件响应 - 了解事件响应计划。有哪些通知机制可以通知您有关事件的信息？
- 请提供您的事件响应计划；如果发生涉及通过 Amazon API 获取的数据的事件，它应包括在发生事件时向 3p-security@amazon.com 发出通知。
- 请总结从事件通知到补救所采取的步骤。- 请参阅附件 PDF： Q13-pof.pdf
Q14：Vulnerability Management - Walk us through vulnerability scanning/detection tools used and the process of remediating findings.- Please provide example reports from your vulnerability scan and penetration test results. This could be an executive summary/memo from the results.- Please provide your Vulnerability Management Policy/Procedure, and an example of a resolved vulnerability(for example a ticket, project plan, resolved report etc.)- 漏洞管理 请向我们介绍所使用的漏洞扫描/检测工具以及修复漏洞的过程。
- 请提供漏洞扫描和渗透测试结果的示例报告。这可以是结果的执行摘要/备忘录。
- 请提供漏洞管理政策/程序，以及已解决漏洞的示例（例如工单、项目计划、已解决报告等）请参阅附件 PDF： Q14-pof.pdf
