AODA, Customer Service Standard (CSS) Policy, Commitment Statement & Multi Year Plan
Introduction
In accordance with the Ontarians with Disability Act (ODA, 2001) and the Accessibility for Ontarians with Disability Act (AODA, 2005), Caseware International Inc., and its related companies (hereinafter collectively referred to as “Caseware”) has developed a policy to ensure that persons with disabilities have equal access to our services in a way that respects their dignity and independence.
The following policies, procedures and practices are guided by the fundamental principles underlying the Customer Service Standard (CSS) (Regulation 429/07), and we are committed to ensuring that the Policy is carefully observed by all employees and any third party that provides goods and services on our behalf.
Mission Statement
Caseware International Inc. is committed to providing accessible service to personas with disabilities, and will make reasonable efforts to ensure that this Policy and related policies and procedures are consistent with the following principles as prescribed in the Customer Services Standard (CSS):
(a) We will provide goods or services in a manner that respects the dignity and independence of persons with disabilities.
- We will provide integrated services to persons with disabilities wherever possible and will provide alternate measures where necessary, whether temporarily or on a permanent basis, to enable a person with a disability to obtain, use or benefit from the goods or services.
- We will provide equal opportunity to persons with disabilities to obtain, use and benefit from the goods or services.
Providing Goods and Services to People with Disabilities
1. Communication
When communicating with persons with disability, Caseware will take into account the particular individual’s needs and circumstances. Caseware employees, agents and thirds parties who communicate with customers will be trained on how to interact and communicate with people with various types of disabilities in order to ensure that Caseware provides responsive and effective communication. All communication shall be provided in a manner that respects the dignity and independence of persons with disabilities.
2. Assistive Devices
Persons with disabilities shall be permitted to obtain, use or benefit from goods and services through the use of their own assistive devices. We will ensure that our employees are trained and familiar with various assistive devices that may be used by persons with disabilities while accessing our good or services.
In the event that a person with a disability is hindered from accessing any goods or services offered, Caseware will use its best efforts to accommodate the person by offering the use of another assistive device that is available or attempt to deliver the same service in another way.
3. Telephone Services
Caseware is committed to providing fully accessible telephone service to our members. We will train employees to communicate over the telephone in clear and plain language and to speak clearly and slowly. If telephone communication provides a barrier to a person with a disability, we will be available to communicate in writing, by e-mail, by fax or by other electronic means.
4. Billing
We are committed to providing accessible invoices to all of our customers and will make every effort to provide alternative formats of invoices in a timely manner upon request.
Use of Services Animals and Support Persons
1. Service Animals
Caseware is committed to welcoming persons with disabilities who are accompanied by a service animal on the parts of our premises that are open to the public. If a service animal is excluded by law, we will suggest appropriate alternatives and provide assistance in order to ensure that the person is able to access, obtain, use or benefit from Caseware’s services where possible.
Caseware will train employees on how to interact with customers who are accompanied by service animals.
2. Support Persons
Any person with a disability who is accompanied by a Support Person will be allowed to access any services provided by Caseware with his or her Support Person. We will not prevent a person with a disability who is accompanied by a Support Person from having access to his or her Support Person.
Where there are barriers to access or attendance by a Support Person, Caseware will seek to facilitate access to ensure the participation of persons with disabilities.
Notice of Temporary Disruptions
Although Caseware is aware that that the operation of its services and facilities is important to its customers and that persons with disabilities rely on certain services and facilities provided by Caseware, temporary disruptions in services and facilities may occur from time to time.
Caseware will provide notice when there is a temporary disruption in those services or facilities that persons with disabilities may rely on. This notice will include information about the reason for the disruption, its anticipated duration, and, if applicable, a description of alternative facilities or services that may be available. Notice of service disruptions will be provided as soon as reasonably practicable after Caseware is made aware of the disruption, or in advance in the case of planned disruptions.
Notice will be provided by a variety of methods, depending on the circumstances, and may include postings in conspicuous places at the office, in other facilities of the building (i.e. the lobby), on our website or by any other means that will reasonably ensure that the notice reaches those persons potentially affected by the temporary disruption in a manner that is accessible to them.
Training of Staff
Caseware will ensure that all employees, agents and third parties who interact with customers on its behalf receive AODA Customer Service Standard Training. Further, training shall be provided on an ongoing basis whenever changes are made to this Policy to ensure that this Policy is properly implemented at all times.
Training will include the following:
- An overview of the purposes of the Accessibility for Ontarians with Disabilities Act, 2005 and the requirements of the Customer Service Standard;
- Training on how to interact and communicate with people with various types of disabilities;
- Training on how to interact with people with disabilities who use an assistive device or require the assistance of a service animal or a support person;
- Training on how to use equipment or assistive devices available at the office or otherwise provided by Caseware that may help with the provision of goods or services to a person with disability;
- Training on what to do if a person with a disability is having difficulty in accessing Caseware’s goods and services; and
- Training on Caseware’s current policies, practices and procedures relating to the Customer Service Standard.
Caseware will keep records of the training provided, including the dates on which training was received and the names and number of participants.
Feedback Process
Customers who wish to provide feedback on the way Caseware provides goods and services to people with disabilities in a manner they deem most convenient to them. For example, a person may provide feedback, by completing a Customer Feedback Form, or by contacting the AODA Compliance Officer in person, by mail, phone, email or by diskette.
The author of the feedback will be provided a response in the format requested (or the most appropriate format where no request was made) outlining actions taken. Caseware shall make best efforts to respond to feedback within five (5) business days. Complaints will be addressed according to our organization’s regular complaint management procedures.
Any Enquiries related to this policy and any feedback should be directed to Caseware’s AODA Compliance Officer:
Email:
legalreview@caseware.com
Address:
Caseware International Inc.
351 King St E Suite 1100,
Toronto, ON
M5A 2W4
Multi-Year Accessibility Plan
This 2014-21 accessibility plan outlines the policies and actions that Caseware International Inc. will put in place to improve opportunities for people with disabilities.
Statement of Commitment
We at Caseware are committed to making our offices and services accessible. We want to create an environment that promotes inclusion and accessibility.
Our goal is to communicate effectively with persons with disabilities in a manner that takes into account circumstances, special needs; including the use of assistive devices. We are working toward ensuring that our policies, practices and procedures are consistent with the core principles of dignity, respect and independence.
Caseware encourages a workplace in which all employees can reach their full potential. We are committed to reaching through barriers to attract the brightest, most innovative and dedicated people to join our family.
This is an ongoing process, and we welcome your comments and suggestions regarding the accessibility of our services.
Accessible Emergency Information
Caseware International Inc. is committed to providing the customers and clients with publicly available emergency information in an accessible way upon request. We will also provide employees with disabilities with individualized emergency response information when necessary.
Training
Caseware International Inc. will provide training to employees, volunteers and other staff members on Ontario’s accessibility laws and on the Human Rights Code as it relates to people with disabilities. Training will be provided in a way that best suits the duties of employees, volunteers and other staff members. Please refer to our policy on the Customer Service Standard (CSS Policy).
Caseware International Inc. will take the following steps to ensure employees are provided with the training needed to meet Ontario’s accessible laws by January 1, 2015:
At present, every employee identified in the “Training of Staff” section outlined in our CSS policy has complied with training.
Any future hires in these departments will be required to complete AODA training.
Information and communications
Caseware International Inc. is committed to meeting the communication needs of people with disabilities. We will take the following steps to make all new websites and content conform with WCAG 2.0, Level A by January 1, 2014:
We will work with our marketing team to have any new content comply with WCAG 2.0 requirements
Existing web content will undergo conformity. We will aim to have our website comply with WCAG 2.0 level AA by Jan 1, 2021.
Caseware International Inc. will take the following steps to ensure existing feedback processes are accessible to people with disabilities upon request by January 1, 2015:
We have updated our CSS Policy (below) to include multiple methods to provide feedback (telephone, fax, email, mail and drop in)
Caseware International Inc. will take the following steps to make sure all publicly available information is made accessible upon request by January 1, 2016:
We will work with our documentation team to ensure information can be provided in alternative formats.
Requests can be sent to the compliance officer listed in our CSS Policy.
Employment
Caseware International Inc. is committed to fair and accessible employment practices.
We will take the following steps to notify the public and staff that, when requested, we will accommodate people with disabilities during the recruitment and assessment processes and when people are hired:
Providing accommodation so long as it does not create an undue financial hardship
Caseware’s Accommodation Policy
The purpose of the Accommodation Policy is to ensure that we provide accommodation to employees, clients and potential applicants in accordance with the Ontario Human Rights Code. By providing accommodation, we are helping to create an inclusive environment.
Anyone requiring accommodation may direct their requests to the People & Culture department by emailing legalreview@caseware.com or calling 416-867-9504 ext 1294. Written requests are also welcomed. Anyone requesting accommodation will be required to identify their needs and to provide information about capabilities and restrictions in order to validate requests for accommodation.
People & Culture will assess all requests on a case by case basis and will explore options for accommodation. All accommodation-related information will be kept confidential except where disclosure is necessary.
If you have identified an accessibility barrier, we want to know. Please contact us below.
In the event of a service disruption, we will notify the public of the service disruption and alternatives available. Please also refer to our CSS Policy.
For more information
For more information on this accessibility plan or to request an alternative format, please contact:
Email:
legalreview@caseware.com
Address:
Caseware International Inc.
351 King St E Suite 1100,
Toronto, ON
M5A 2W4
Modification to the Policy and Related Policies
Caseware is committed to developing customer service policies that respect and promote the dignity and independence of people with disabilities. All of Caseware’s policies and procedures will be developed or updated in such a manner as to respect and promote the dignity and independence of persons with disabilities.
Application and Interface Security
Our Software Development Life Cycle (SDLC) ensures that our applications and programming interfaces (APIs) are designed, deployed, and tested in accordance with leading industry standards – such as OWASP, ISO, and SOC – and adhere to legal, statutory, or regulatory compliance obligations.
You will be onboarded once all agreements and policies are accepted for usage of the service. You are responsible for ensuring your usage of Caseware Cloud is in compliance with applicable laws and regulations.
Legal specifics can be found in the Cloud Services Agreement here.
Our policies and procedures have been established and are maintained in support of data security to include confidentiality, integrity, and availability across multiple system interfaces, jurisdictions, and business functions to prevent improper disclosure, alteration, or destruction.
Audit Assurance and Compliance
Independent audits are conducted by registered 3rd parties as part of our compliance program for ISO 27001 and SOC 2 for our Cloud services. We also have an internal audit program, external penetration testing and regularly scheduled internal vulnerability testing. Vulnerability test results are shared with customers as outlined in the Client Initiated Testing Policy. The results of these processes are tracked through our improvements process. The methodology and tools used to conduct penetration testing is tailored to each assessment for specific targets and attacker profiles. SOC 2 reports are provided under NDA to clients. Our SOC 3 Report is available in PDF format here.
Production data is stored on Amazon Web Services (AWS). The application handles logical separation of client data through database isolation. Data that is transferred to and from our service (including backups) is 100% encrypted over an SSL connection (AES-256-bit – the same strength used in online banking). Data transmission occurs between client and server, and databases. Controls are in place for secure and encrypted bulk data transfers. There are no email transmissions. For more information on security, see: https://www.casewarecloud.com/security.html. Our legal team monitors our regulatory obligations. Please refer to our Cloud Services agreement for legal requirements here.
Business Continuity Management and Operational Resilience
Caseware has a consistent unified framework for business continuity planning and has established, documented, and adopted this to ensure all business continuity plans are consistent in addressing priorities for testing, maintenance, and information security requirements.
Requirements for business continuity plans include the following:
- Defined purpose and scope, aligned with relevant dependencies
- Accessible to and understood by those who will use them
- Owned by a named person(s) who is responsible for their review, update, and approval
- Defined lines of communication, roles, and responsibilities
- Detailed recovery procedures, manual work-around, and reference information
- Method for plan invocation
Our business continuity and security incident response plans are tested at planned intervals or upon significant organizational or environmental changes. Incident response plans involve impacted customers (tenant) and other business relationships that represent critical intra-supply chain business process dependencies.
Our service is hosted on Amazon’s AWS and utilities services and environmental conditions (for example, water, power, temperature and humidity controls, telecommunications, and internet connectivity) are secured, monitored, maintained, and tested for continual effectiveness at planned intervals to ensure protection from unauthorized interception or damage, and are designed with automated failover or other redundancies in the event of planned or unplanned disruptions.
Our cloud service is completely virtual and hosted on Amazon Web Services (AWS). Amazon is also ISO and SOC2 compliant and responsible for restricting access to facilities housing the productions systems to authorized individuals. AWS is also responsible for environmental protection and preventative maintenance over production systems. AWS has published further details here: https://aws.amazon.com/compliance/data-center/controls. These certifications address physical security, system availability, network and IP backbone access, customer provisioning and problem management. Physical access and environmental controls are managed and controlled by AWS. AWS physical protection assurance information can be found at: https://aws.amazon.com/compliance.
Caseware has aligned our security program to ISO 27001 and we have business continuity processes in place to address disruptions to critical services. We monitor all cloud instances for performance and availability and incorporate the following:
- Identify critical products and services
- Identify all dependencies, including processes, applications, business partners, and third party service providers
- Understand threats to critical products and services
- Determine impacts resulting from planned or unplanned disruptions and how these vary over time
- Establish the maximum tolerable period for disruption
- Establish priorities for recovery
- Establish recovery time objectives for resumption of critical products and services within their maximum tolerable period of disruption
- Estimate the resources required for resumption
Customers can see our real-time operational status at our status page here: https://caseware.statuspage.io/.
We maintain a central system for documentation and train all staff on processes. Procedures include change management, security processes, roles and responsibilities of internal users. Our procedures are updated on an as needed basis and revision histories are logged. Additionally, policies and procedures shall include defined roles and responsibilities supported by regular workforce training.
Caseware maintains a records and retention policy for Cloud services. The retention policy is not client-specific. Backup and recovery procedures are documented and automated alerts are sent daily to operations staff. Backup and recovery measures have been incorporated into business continuity planning and tested accordingly for effectiveness. See the retention policy for each category of records below.
System transaction logs
Description: Database journals and other logs used for database recovery.
Retention period: 30 days.
Reason for retention: Based on backup and recovery strategy.
Allowable storage media: Electronic.
Audit logs
Description: Security logs, for example, records of logon/logoff and permission changes.
Retention period: 30 days.
Reason for retention: Maximum period of delay before forensic investigation.
Allowable storage media: Electronic.
Operational procedures
Description: Records associated with the completion of operational procedures.
Retention period: 2 years.
Reason for retention: Maximum period elapsed regarding dispute.
Allowable storage media: Electronic.
Customer
Description: Customer backups.
Retention period: 90 days.
Reason for retention: Data protection requirement.
Allowable storage media: Electronic.
Change Control and Configuration Management
Change management controls have been established for any new development and/or acquisition of new data, physical or virtual applications, infrastructure network and systems components, or any corporate, operations and/or data center facilities have been pre-authorized by the organization’s business leadership or other accountable business role or function. Our SDLC has a defined quality change control and testing process with established baselines, testing, and release standards which focus on system availability, confidentiality and integrity of systems and services.
Policies and procedures have been established, and supporting business processes and technical measures implemented, to restrict the installation of unauthorized software on organizationally-owned or managed user end-point devices and IT infrastructure network and systems components within the production cloud environment. Our change management policies and procedures include managing the risks associated with applying changes to business-critical or customer impacting applications and system-system interface (API) designs and configurations. Technical measures have also been implemented to provide assurance that all changes directly correspond to a registered change request, business-critical or customer, and/or authorization by, the customer as per agreement prior to deployment.
Data Security and Information Lifecycle Management
Caseware has policies and procedures and supporting business processes and technical measures in place to inventory and maintain data flows within the SaaS network and systems for each geographic location. Controls are in place to ensure that data is placed in the geographic area determined by the client. Subscriber data within the production cloud environment resides on two-tier architecture and is not directly accessible from the internet.
Our security policy defines four levels of data classification: confidential, restricted, operational, and public. All data stored within the production cloud infrastructure is considered confidential, which is our highest level of security and only authorized staff have access to this environment. Logical access to the production cloud environment is restricted to the operations team alone.
All subscriber data is stored in the production cloud environment. Use of customer data in non-production environments is controlled through secure data-handling processes, which require explicitly documented approval from the customers whose data is affected, and must comply with legal and regulatory requirements for scrubbing of sensitive data elements.
There is a designated operations team responsible for all operational functions regarding the infrastructure and storage with assigned responsibilities that have been defined, documented, and communicated.
Caseware Cloud is hosted on Amazon web servers around the world. Upon subscribing to the Caseware Cloud Services, CWC informs clients of the jurisdiction in which the server that has been allocated to host your Subscriber Data and Personal Information is located. You may consent to such allocation, or refuse a server so allocated.
For performance reasons, we’ll typically set you up in:
- United States/North Virginia if you’re located in the United States or South America
- Canada/Montreal if you’re located in Canada
- Australia/New South Wales if you’re located in the Asia-Pacific region
- Ireland/Leinster if you’re located in any other region
Data center Security
The production infrastructure is completely hosted within Amazon’s AWS. AWS is responsible for restricting access to facilities housing the production systems to authorized individuals. AWS is also responsible for environmental protection and preventative maintenance over production systems. Physical access is controlled by AWS at the perimeter and at building ingress points. Full details can be found here: https://aws.amazon.com/whitepapers/#security. AWS has published further details here: https://aws.amazon.com/compliance/data-center/controls/.
Our production infrastructure is completely hosted within Amazon’s AWS. AWS has SOC 2 reports, which are reviewed annually. AWS governance processes can be found here: https://aws.amazon.com/compliance/.
Encryption and Key Management
Our cryptography policies and procedures are designed to support business process. Technical measures have been implemented based on business requirements for protection of data at rest and data in transit as per applicable legal, statutory, and regulatory compliance obligations.
Our cryptography policy requires all encryption keys to have identifiable owners within the organization. The cryptographic key lifecycle management ensures access controls are in place for secure key generation, exchange and storage, including segregation of keys used for encrypted data or sessions.
Data stored at the server level (data-at-rest) is encrypted using the industry standard AES-256 algorithm. Data that is transferred to and from our service (data-in-transit) is encrypted via TLS with ephemeral key exchange and use industry-accepted strong cipher suites. Certificates use a minimum of 2048-bit key strength with SHA-2 or stronger signature algorithm. Private keys are generated and stored in our secrets management systems. They are deployed and used on production systems as needed via our change control process. Certificates are obtained through a reputable vendor and follow the built-in and industry standard renewal/rotation process based on expiry or revocation as needed.
Governance and Risk Management
Security risk assessments are completed at least annually and consider the following:
- Awareness of where sensitive data is stored and transmitted across applications, databases, servers, and network infrastructure
- Compliance with defined retention periods
- Data classification and protection from unauthorized use, access, loss, destruction, and falsification
We have implemented an Information Security Management System based on ISO 27001 and SOC 2 controls. Our ISMS includes the following areas insofar as they relate to the characteristics of the business:
- Information Security Policy (this document)
- Access Control Policy
- Availability Management
- Clean Desk Policy
- Cryptography Policy
- IS Supplier Management Policy
- Logging and Monitoring Policy
- Mobile Device Policy
- Network Security Policy
- Password Management Policy
- Patch Management Policy
- Software Policy
- Technical Vulnerability Management Policy
- Risk Assessment Methodology
- Malware, Email and ISMS Policy
- Internet Acceptable Use Policy
- Penetration Testing Policy
- Teleworking Policy
- Records Retention and Protection
Department managers are responsible for maintaining awareness of, and complying with, security policies, procedures, and standards that are relevant to their area of responsibility.
Risk acceptance levels have been defined within the risk management methodology and all risks are mitigated to an acceptable level with reasonable resolution time frames and stakeholder approval.
Our information security policies and procedures are posted and available for review by all impacted staff and external business relationships. The Information Security Steering Committee is responsible for developing, maintaining, and enforcing our service’s information security policies. The information security policy is reviewed annually and approved by the Information Security Steering Committee. Executive and line management provide support for information security through clearly documented direction and commitment, and shall ensure action has been assigned. There is a senior member of management who is responsible for information security governance and operations, including protection of customer data – this role reports to the CFO.
Policy reviews are conducted annually by the Information Security Steering Committee or as a result of changes to the organization to ensure its continuing alignment with the security strategy, effectiveness, accuracy, relevance, and applicability to legal, statutory, or regulatory compliance obligations.
Formal risk assessments are performed annually and in conjunction with any changes to information systems to determine the likelihood and impact of all identified risks. The likelihood and impact associated with inherent and residual risk is determined independently, considering all risk categories based on audit results, threat and vulnerability analysis, and regulatory compliance. Risk assessment results can include updates to security policies, procedures, standards, and controls to ensure that they remain relevant and effective. The results of risk assessments are:
- Reported to senior management who then partake in a risk treatment process
- Updated in a risk register
- Prioritized based on possible impact to production systems
Our HR has a defined screening process for all staff. Reference checks are obtained with respect to all employees at time of hiring, with criminal and credit background checks for those who perform operational roles with the product cloud environment. All staff are required to sign a confidentiality agreement prior to employment to ensure protection of client information for the protection of data. Information security awareness training is provided during employee onboarding. Specific training is provided for developers on secure coding practices. Formal records are maintained for completion of internal staff training. Employee terminations and position changes are initiated by department managers. Our HR team reviews these requests and submits the request through our ticketing system for de-provisioning and provisioning requirements. Our HR team has an employee departure process to ensure all equipment is returned and accounts terminated to ensure that access to production environments is removed.
A security awareness training program has been established for all contractors, third-party users, and employees and is mandated. All individuals with access to confidential and restricted data receive appropriate awareness training and regular updates in organizational procedures, processes, and policies relating to their job function relative to the organization. Roles and responsibilities of contractors, employees, and third-party users are documented as they relate to information assets and security.
User responsibilities are defined within job descriptions for all staff and they are made aware of their roles and responsibilities for:
- Maintaining awareness and compliance with established policies and procedures and applicable legal, statutory, or regulatory compliance obligations
- Maintaining a safe and secure working environment
- Report any suspicious activity if detected
We have a clear screen policy which requires that unattended workspaces do not have openly visible sensitive documents and user computing sessions had been disabled after an established period of inactivity.
We have an Access Control policy in place that specifies how to manage access control to all system components and sensitive information in the organization. Policies governing acceptable use or access to subscriber data and metadata is included in the Caseware privacy policy (https://www.caseware.com/privacy-statement/). Caseware collects, uses and discloses information only for the following purposes:
- To verify your identity
- To provide you with the Caseware Cloud Services
- To contact you for the purposes of product information, service updates, billing notifications, or notifications relating to the Caseware Cloud Services
- To monitor and/or improve system usage, server and software performance
- To assist with technical support issues
- To comply with any laws, regulations, court orders, subpoenas or other legal process of investigation and to protect CWC, its Affiliates and other individuals from harm
- To improve and enhance CWC Service offerings
Identity and Access Management
Policies and procedures have been established to store and manage identity information about every person who accesses the production cloud infrastructure and to determine their level of access. Access control policies and procedures have been established, and supporting business processes and technical measures implemented, for restricting user access as per defined segregation of duties to address business risks associated with a user-role conflict of interest. The access control repository is managed by the provider. We use a privileged identity manager and password management system.
Access to, and use of, audit tools that interact with production cloud environment is segmented and restricted to prevent compromise and misuse of log data. User access to diagnostic and configuration ports are restricted to authorized individuals and applications.
Controls are in place to ensure only approved software is installed within the production cloud infrastructure.
Access to the organization’s own developed applications, program, or object source code, or any other form of intellectual property (IP), and use of proprietary software is controlled following the rule of least privilege based on job function as per established user access policies and procedures.
Caseware Cloud Service requires password authentication to access the base system. Once in the system, users must be assigned security roles to perform additional operations and access certain content. With security roles, you can control who has access to what content. Your organization is responsible for developing appropriate security policies around passwords and security roles using the security features provided in Caseware Cloud. Caseware provides access to clients, who then control their own users and administrative accounts, including provisioning and de-provisioning. Two-factor authentication is employed. User access is authorized and revalidated quarterly, to ensure the rule of least privilege based on job function. For identified access violations, remediation activities are followed based on the established user access policies and procedures. Timely de-provisioning (revocation or modification) of user access to data or managed applications, infrastructure systems, and network components, has been implemented as per established policies and procedures and based on user’s change in status such as termination of employment or other business relationship, job change, or transfer. The provider manages service account provisioning and de-provisioning. Service account authentication utilizes multi-factor authentication.
Infrastructure and Virtualization Security
Caseware Cloud deploys a SaaS-based endpoint detection and response security endpoint to all hosts within our infrastructure. All user, process, and network activity is collected and stored in the tamper-proof central location and analyzed in near real-time for suspicious behaviors as well as for manual forensics. Protection, retention, and lifecycle management of audit logs, adhere to applicable legal, statutory, or regulatory compliance obligations and provide unique user access accountability to detect potentially suspicious network behaviors and/or file integrity anomalies, that are required to support forensic investigative capabilities in the event of a security breach. Our tools have the capability to detect/prevent unauthorized or anomalous behavior based on network traffic or host activity. All authentication events, successful and failed, are logged.
Our production and non-production environments are separated to prevent unauthorized access or changes to information assets. Separation of the environments include logical separation and segregation of duties for personnel accessing these environments as part of their job duties.
Our production system and network environment is protected by centrally managed firewalls and ensures separation of production and non-production environments. Our production environment is designed, developed, deployed, and configured to ensure our operations team and clients user access is appropriately segmented from other client users, based on the following considerations:
- Established policies and procedures
- Isolation of business critical assets and/or sensitive user data and sessions that mandate stronger internal controls and high levels of assurance
- Compliance with legal, statutory, and regulatory compliance obligations
The production cloud infrastructure has a reliable and mutually agreed upon external time source that is used to synchronize the system clocks of all relevant information processing systems to facilitate tracing and reconstitution of activity timelines.
Supply Chain Management, Transparency, and Accountability
Policies and procedures have been implemented to ensure the consistent review of service agreements between providers and customers across the relevant supply chain. Reviews performed at least annually and identify non-conformance to established agreements. Any non-conformances are identified as actions to address service-level conflicts or inconsistencies.
Threat and Vulnerability Management
Policies and procedures have been established, and supporting business processes and technical measures implemented, to prevent the execution of malware within the production cloud environment or end user devices and IT infrastructure network and system components. Policies and procedures have been established, and supporting processes and technical measures implemented, for timely detection of vulnerabilities within organizationally-owned or managed applications, infrastructure network and system components. We also perform ongoing application and code vulnerability evaluations of our products and have dual peer reviews of all code changes to ensure the efficiency of implemented security controls. Our risk management methodology is used for prioritizing remediation of identified vulnerabilities. Changes are managed through our defined change management process for all vendor-supplied patches, configuration changes, or changes to our applications. Our anti-malware solution is centrally managed and runs on all systems. The anti-malware solution includes mechanisms for detecting or preventing phishing. Malware signature updates are deployed within 1 day of release.
