下载文档原格式
1Business Partner Requirement1.01.00Does the facility participate in any Government sponsored or World Customs Organization (WCO) accredited facility security programs administered by the local customs authority? -参与政府或WCO的反恐计划。
1.01.01If Yes, please describe the name of the program and the date of participation.-计划的名称和参与日期1.02.00Is the facility C-TPAT certified?-有没有C-TPAT认证1.03.00Does the facility have written processes for the selection of business partners including product suppliers and local transportation companies?-供应商和货运商的选择程序1.03.01Does the facility require all 3rd party logistics providers to comply with importer CTPAT requirement or country specific security programs?-有没有第三方物流公司符合CTPAT要求2Container and Trailer Security / Conveyance2.01.00Is the facility always using seals provided by 3PL or ocean carrier for sealing full container or trailer loads?-有没有第三方物流公司或船运公司提供的封条2.02.00Are factory shipping personnel trained to know what type of seal is a high security seal?-船务人员是否明白什么是高保质封条2.03.00Are there written procedures for seals to be controlled and affixed to loaded containers and trailers?-书面的封条控制与加封的程序2.03.01Do written procedures outline how seals are logged and handled regardless of which party provides the seals?-无论有谁提供封条，是否有书面的程序规定封条是如何记录和使用的2.03.02Are there written procedures for securing goods between additional stops en route to a forwarder or consolidator?-是否有书面的程序确保货物运输途中的安全2.04.00Are there written procedures on how to recognize and report to the freight forwarder and/or the appropriate foreign authority compromised seals and/or containers/trailers?-是否有书面的程序向货代或国外相应的机构汇报受损的封条和集装箱。
网站业务安全checklist编写指南在网络时代，随着互联网的发展，越来越多的业务都开始转移到网上进行，网站也成为了很多企业的重要组成部分。
然而，随之而来的安全威胁也开始不断涌现。
为了保护网站的业务安全，编写一个全面的checklist是十分必要的。
本指南将为您介绍如何编写一个有效的网站业务安全checklist。
一、安全策略1. 网站业务目标：明确网站的业务目标，并进行详细描述。
2. 安全政策制定：制定适合网站业务的安全政策，包括对用户信息的保护、系统访问的控制等。
3. 风险评估和管理：评估网站存在的潜在风险，并制定相应的风险管理措施。
4. 安全团队建设：组建专业的安全团队，负责网站业务的安全管理与监控。
二、身份验证和访问控制1. 用户注册和登录：确保用户注册和登录过程的安全性，包括密码复杂度要求、验证码验证等。
2. 权限管理：根据不同的用户角色，设置不同的权限，确保用户只能访问其可授权的信息和功能。
3. 强制访问控制：对敏感功能和关键数据进行强制访问控制，仅限制有权限的用户进行操作。
4. 反欺诈机制：设置反欺诈机制，识别并阻止恶意用户的访问。
三、数据保护1. 数据备份：定期备份网站数据，确保在数据丢失或受损时可以进行恢复。
2. 数据加密：对用户敏感信息进行加密存储，确保数据在传输和存储过程中的安全性。
3. 安全审计和监控：建立安全审计和监控机制，及时监测网站数据的异常行为和未授权访问。
4. 安全域隔离：根据业务需求，将不同的业务数据进行隔离，确保数据的安全性和完整性。
四、应用安全1. 安全编码实践：开发人员应采用安全编码规范，避免常见的安全漏洞，如跨站脚本攻击、SQL注入等。
2. 应用程序更新和维护：定期更新和维护应用程序，确保修复已知的安全漏洞和问题。
3. 安全漏洞扫描：定期进行安全漏洞扫描，及时发现和修复漏洞，避免被黑客利用。
4. 文件上传和下载：对上传和下载功能进行安全性验证，防止上传恶意文件和非法下载。
WCA验厂社会责任审核文件清单（中英文对照）社会责任审核所需之文件（中国）Document Checklist for CSR Audit (China)Revision: June 2012WCA审核程序包括：审核前会议，设施巡察，查阅文件，员工面谈及总结会议。
Audit procedures includes: Opening Meeting, Facility Tour, Documents review, Employee Interview and Closing Meeting.请准备以下文件的正本予以审核，并恳请允许复印样本，谢谢！Please prepare the original documentation listed below for verification and sample photocopying, thanks!1.工商营业执照（副本）Business Registration (Official Duplicate)2.工卡或考勤记录（过去十二个月），包括在职与离职人员。
如果是使用电子考勤，审核员可能需要从电脑直接审阅考勤记录，审阅是会在企业职员协助下进行。
Timecards or Attendance Records (Last 12 Months), including active employees and resignation employees. If electronics time card is used, the auditor may need to review the time record directly from the computer, with the assistance from the facility staff.3.工资表（过去十二个月），包括在职与离职人员。
如果工资是通过银行转账发放，请同时提供银行转账记录。
En Route CPDLC Quick Reference GuideFlight Plan Requirementso Verify Reg Number or Flight ID in Item 7o Include in Item 10a “J4” to indicate VDL Mode 2 capabilityo Verify REG/ and CODE/ in Item 18o Include in Item 18 for En Route CPDLC:•DCL and En Route:•File “DAT/1FANSE”, or “DAT/1FANSER”*•May substitute “DAT/1FANSE2PDC” or“DAT/1FANSER2PDC”* for PDC as secondarypreference•En Route only:•File “DAT/FANSE”, or “DAT/FANSER”**FANSER for aircraft with STAR loading issuesOn CPDLC LOGON STATUS PAGE/MENUo Verify•Registration Number•Flight IDo LOAD Flight Plan:•Departure Airport•Destination Airport•Route•SID/ODP & Dept. Runway•STARLogon for DCL or CPDLC Serviceso Log on using “KUSA”•DCL Airports: EDT - 30 minutes•Other Airports: EDT - 5 minutesDo not enter any input into the latency timer or “Max Uplink Delay” field.If a value remains from CPDLC use in a previous FIR, the pilot should clear the value upon entry to KUSA airspace.If network coverage is available, the logon is accepted on the ground. Otherwise, the logon is accepted once airborne and within network coverage.o Successful log on –CDA/ATC CTR shows “KUSA”o Do not re-log on if CDA/ATC CTR shows “KUSA”Initiation & Management of En Route CPDLC Services o Start of in-flight CPDLC services begins with welcome message:“CONFIRM CPDLC CONTACT WITH KUSA.ROGER/ACCEPT THIS MESSAGE”Except when departing a DCL airporto Respond to the welcome message withROGER/ACCEPT.CPDLC services transfer from ARTCC to ARTCCSuspended while operating in TRACON airspace.“NO COMM” or “DATALINK LOST”These indicate a temporary loss of datalink communications with the ground.o Verify CDA/ACT CTR is still “KUSA”.o If CDA/ACT CTR is “KUSA”, no immediate action is required. DO NOT RE-LOGON.o Follow published aircraft procedures, if available.Await re-connection with the ground. Use voice forATC communications until reconnection is confirmed.o If the NO COMM state continues for 16 minutes, then the active CPDLC session will terminate and theCDA will clear.o If CDA/ACT CTR does not show “KUSA”, attempt re-log on. If not successful, contact ATC via voice. Avionics resets/reboots may sever the aircrafts ATC link with the ground while still appearing to be active. Recommended Pilot/Flight Crew CPDLC Procedures o Every CPDLC message sent by ATC requires aresponse.o Respond as soon as possible to all CPDLC messages.o Respond appropriately:•ACCEPT/WILCO/ROGER•REJECT/UNABLE•STANDBY▪If STANDBY is selected, follow with anACCEPT/REJECT or WILCO/UNABLE response.•Select REPORTo When appropriate, for multi-crewed aircraft:•Independently & silently review an uplinkedCPDLC message sent to the aircraft.•Agree on content & intent of CPDLC message.•Confirm change & take the action: FMS or Flight Guidance Mode change, etc.•Confirm & agree before sending a CPDLCresponse, report, or request to ATC.ATC CPDLC Reportso ATC can request a REPORT using CPDLC (e.g.,CONFIRM ASSIGNED ALTITUDE, CONFIRM SPEED).o Respond using the pre-formatted REPORT page. Pilot Requests Using CPDLCo Send only these pre-formatted REQUESTS via CPDLC to ATC:•REQUEST [altitude]•REQUEST BLOCK [altitude] TO [altitude]•REQUEST CLIMB TO [altitude]•REQUEST DESCENT TO [altitude]•REQUEST VOICE CONTACT•REQUEST DIRECT TO [position] –position mustbe on the current ATC assigned route•EMERGENCY MESSAGESo DO NOT send any other pre-formatted REQUESTS.They are not currently supported.o Send ONLY ONE REQUEST with each CPDLC message. CPDLC Route Messageso Route clearances issue via CPDLC:•PROCEED DIRECT TO [position]Direct-to-fix•CLEARED TO [position] VIA [routeclearance]Re-Route to a fix on your current cleared route •CLEARED [routeclearance]Full Route Clearance – Replaces entire flightplan•AT [position] CLEARED [routeclearance]Replaces everything after the specified ATpositiono Load route clearance sent by ATC into the FMS •Select LOAD, APPLY, or INSERT new route intothe FMS•Manually insert Departure Procedures•Manually insert Arrival Procedures, whenrequiredo Review new route clearance•If acceptable, activate the new route clearance in the FMS, respond ACCEPT/WILCO•If not acceptable, respond REJECT/UNABLE CPDLC Altitude/Speed Messageso Use CPDLC to request a single altitude or block altitude.o An altimeter setting will be included with any CPDLC altitude uplink containing an altitude below FL180.o Respond to a CONFIRM ASSIGNED ALTITUDE or CONFIRM ASSIGNED SPEED request:•Select & send REPORT CPDLC Termination, Transfer, & Log Offo“CPDLC NOT IN USE UNTIL FURTHERNOTIFICATION”•Indicates En Route CPDLC is not in use•CDA/ACT CTR remains “KUSA”•No CPDLC messages except•EMERGENCY REPORTS can be sento CPDLC sessions are automatically transferredbetween the U.S. domestic airspace andinternational FIR when CPDLC is used in bothairspaces.o If CPDLC is not in use in the receiving FIR, or the aircraft is not eligible for CPDLC services, CPDLCservices are terminated at handoff.o In the off-nominal case in which two or moremessages are not received, it is recommended toterminate the CPDLC session and use voice contactfor the remainder of the flight.o An indication of an undelivered message may be a voice contact from ATC to disregard/unable aclearance that has not been received.CPDLC Emergency Messageso VOICE REMAINS PRIMARY FOR EMERGENCYCOMMUNICATIONS.o Pilots may send a CPDLC EMERGENCY REPORT to ATC if voice is not available.o ATC will receive the CPDLC report but will notacknowledge it using CPDLC. ATC will attempt tocontact the aircraft via voice.o FREE TEXT can be used only with EMERGENCYmessages, but only as a one-way aircraft toground link – e.g., in case of loss of VHF voice radiocapability.HELPFUL REMINDERS:NEVER USE FREE TEXT EXCEPT FOR AN EMERGENCY.VOICE REMAINS PRIMARY FOR EMERGENCYCOMMUNICATIONS.ALWAYS REVERT TO VOICE TO CLARIFY IF THERE IS CONFUSION.。
WCA - Audit Document Checklist-Business Practice (Eng.) WCA-D02 (Issue No.: 08; Issue Date: 29 May 2018)Please prepare the ORIGINAL documentation listed below for audit/verification.请准备以下文件正本供核查1.1 applicable) and hazardous waste treatment supplier (If applicable).被审核方，劳动派遣公司（如适用），危险废弃物处理商（如适用）的营业执照。
1.2 Authorization document of management representative for social compliance management including EHS and labor management社会责任管理者代表的委任书，包括健康安全环境和劳工的管理者代表。
1.3List of all subcontractors (if applicable)分包商清单（如适用）2.1厂规或员工手册，包括以下方面2.1.1Recruitment policy/procedure招聘政策2.1.2Disciplinary policy/procedure and its records纪律处分程序2.1.3Related training records of policy/procedure in social management system社会责任管理体系相关政策程序培训记录2.2Employment / Labor contracts劳动合同2.3Union or employee representative committee procedure/records工会和员工代表委员会程序/记录。
2.4Collective bargaining agreement (if applicable)集体谈判协议（如适用）。
2.5 Employee Roster and Personnel records include resignation records, Young worker resignation and health examination (if applicable)人事花名册及个人档案包括离职记录，未成年工注册及体检记录（如适用）。
2.6Foreign employees work permits and approval letter from government (if applicable)外籍员工许可证和政府批文（如适用）。
2.7Agency workers agreement(if applicable)中介工人协议（如适用）。
2.8Dispatched employees’ personal files with ID Card Copy, Labor Contract(if applicable)劳务派遣工人的个人档案，包括身份证复印件和劳动合同。
（如适用）。
3.1 temporary employees, dispatch employees, etc.所有工人过去12个月的工资记录，包括临时工和劳务派遣工。
3.1.1Payroll register with employee signature (if wages paid in cash)有员工本人签名的工资表（现金发放）。
3.1.2Bank statement corresponding to payroll register (if wages paid by bank deposit)银行工资转账回单（银行卡发放）。
3.2 Time card / Attendance records (recent 12 months) of all current employees and former employees including temporary employees, dispatch employees, etc.所有工人过去12个月的考勤记录，包括临时工和劳务派遣工。
3.3Production records (tickets/sheet) (recent 12 months) (if applicable)生产记录(过去12个月如适用)。
3.4 Local minimum wage standard (if applicable) and/or Government Labor Law notice (if applicable)当地政府最低工资标准文件或政府通知书（如适用）。
3.5 Special waivers from local government regarding working hours arrangement (if applicable)当地政府就工作时间的特殊批文（如适用）。
3.6Wages / Working hour Policy/Procedure and related training records工资工时政策程序培训记录。
3.7 Employees’ social insurance receipt, name list and certificate of social insurance of all employees.社会保险收据，名单和社会保险凭证。
4.1 breaks, etc.)怀孕女工保护程序（包括非有毒有害和低体力劳动强度工作，延长休息时间等）。
4.2Fire safety inspection / certificates and building permit for facility / dormitory buildings 厂房和宿舍的消防检查报告或合格证明及建筑/施工许可证。
4.3Rent or lease contract (applicable if facility is rented or leased)厂房租赁协议（如果厂房是租赁使用的）。
4.4Facility building layout/evacuation plan厂房平面图/疏散图。
4.5 Overall emergency procedure and its records including Fire drill records, emergency drill records for chemical management应急处置程序和记录，包括消防演习记录，化学品应急演习记录。
4.6Work-related accident/injury procedure and its records工伤事故记录及工伤记录等。
4.7 Occupational hazards factors report (if applicable) and Occupation health examination report (if applicable)职业危害因素检测报告（如适用）和职业病体检报告（如适用）。
4.8List of main production machine types and total number of machines (if applicable)主要设备清单和所有设备数量（如适用）。
4.9 List of all chemicals used and/or stored, corresponding MSDS and any relevantprocedures/records related to chemical use/storage such as hazardous chemicalemergency response plan and records所有使用和储存的化学危险品清单，相应的MSDS程序和记录，和危险化学品应急处理计划和记录。
4.10Health and safety program and training records健康安全程序培训记录。
4.11 Canteen or eating facilities hygiene certificate such as Kitchen hygiene permit/license, and cook/kitchen staff health certificate(厨房)食品经营许可证（原餐饮服务许可证）及厨工健康证。
4.12 Certificates/Permit/Licenses related to Special appliances and its operator, special operations license (Such as electrician).特种设备登记检验和特种设备操作工、特种作业工人上岗证(如：电工等)。
5.1 training records to all employees.书面的社会责任政策和相关程序及记录，包括所有员工的培训记录。
6.1 applicable)环境管理程序和证书比如ISO14001证书（如适用）。
6.2 Environmental certificates/Permits and documents (if applicable) such as Environmental Impact Assessment (EIA) related documents, Acceptance check of environmental protection of Construction Projects and etc.环境证书及许可文件（如适用），比如环境影响评价相关文件，环境保护及建设项目竣工验收报告。
6.3Hazardous waste disposal records.危险废弃物处理记录。
7.1 e.g. business integrity & anti-corruption, fair competition (optional if Business Practicemodule is applicable in the assessment, not applicable for WCA-Integrity) and dataprotection (optional if Business Practice module is applicable in the assessment, not applicable for WCA-Integrity) including (but not limited) to the following:任何书面政策或程序去规范公司和员工的商业道德规范。
