Failure to comply with this Section and Section 3.13 of the RFP releases the Lead State, NASPO ValuePoint, and Participating Entities from any obligation or liability arising from the inadvertent release of Offeror information.
Carahsoft Technology Corporation (“Carahsoft”) respectfully requests that section 6.3 Financials of Carahsoft’s response be treated as a trade secret under the Utah Uniform Trade Secrets Act, Utah Code § 13-24-2 and submits this justification in accordance with Utah Code 63-G-2-305 demonstrating that its audited financials should be treated as a trade secret under Utah’s Uniform Trade Secrets Act. Additionally, Carahsoft is claiming the same confidentiality of the Consensus Assessments Initiative Questionnaire provided in relation to DocuSign and FireEye offerings, as well as the Cloud Controls Matrix for DocuSign.
Carahsoft has marked this attachment as “confidential” in accordance with the RFP instructions by including all confidential data into the Confidential, Protected, or Proprietary Information in our response.
Carahsoft is claiming confidentiality for these specific Consensus Assessments Initiative Questionnaires and Cloud Controls Matrix because releasing these documents would cause irreparable damage and would create the potential for cyber security breach. While portions of this information are in the public domain, the information contained within is not represented or assimilated this way in any other format.
Carahsoft’s Audited Financial Data satisfies the three-part test of the Utah Uniform Trade Secrets Act as set forth below and should therefore be treated as confidential and by the Utah Division of Purchasing and should not subject to public disclosure as provided in Utah Code § 63G-2-305.
1. Carahsoft’s Audited Financial Data is a “compilation” within the meaning of Utah Code § 13-24-2(4).
Carahsoft’s Audited Financial Data is a compilation of all of the Company’s financial data and results for 2014.
While some aspects of this information may be available, the compilation of this information is unique and the result of sustained and distinct effort by the Company’s financial staff and its accountants.
2. As required by Utah Code § 13-24-2(4)(a) Carahsoft derives independent economic value, actual or potential, from its Audited Financial Data not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from its disclosure or use.
Carahsoft is a leading distributor of technology products and services to public sector customers such as the State of Utah, and throughout the United States and Canada. Sales in this market are intensely and deliberately competitive, with each sale subject to a structured bidding process in which low price is frequently the deciding factor on which contract award is based. Competition in this market is fierce, with competitors regularly competing with one another for federal, state, county and city business.
SOLICITATION # CH16012
184
Carahsoft’s competitors closely monitor this market, and regularly attempt to gain financial and other information about Carahsoft and other competing vendors. Allowing Carahsoft’s competitors access to this compilation of financial data by releasing it in response to a public records request will damage Carahsoft’s competitive position because it will provide competitors insight into Carahsoft’s financial structure, including compensation, overhead costs, rental rates, profit margins and the like. Indeed, allowing insight into compensation may violate individual employees’ expectations of privacy. Once competitors have this access and insight, they can use it to undercut Carahsoft in the marketplace, damaging Carahsoft’s business with its customers and its suppliers, and inflicting economic hardship upon the Company.
For these reasons, Carahsoft does not itself disclose its Audited Financial Data except when required by law to do so. For example, Carahsoft discloses its financial information in filing its periodic tax returns—disclosure of which is prohibited by applicable state and federal law. In this regard, we note that Carahsoft is a privately owned company. Therefore, Carahsoft does not publicly report its financial results to the United States Securities and Exchange Commission.
3. Carahsoft uses reasonable efforts to maintain the secrecy of its Audited Financial Data.
The third part of the Utah Uniform Trade Secret Act’s test for trade secret treatment is whether the information “…is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.” Utah Code § 13-24-2(4)(b).
Carahsoft satisfies this test because it takes reasonable steps to maintain the secrecy of its financial information.
As noted above, Carahsoft is a privately held company and therefore does not report its financial results publically to either its shareholders or the Securities and Exchange Commission. This is in contrast to public companies such as IBM or AT&T who report financial results quarterly as a matter of public record.
Even within Carahsoft’s business operations itself, Carahsoft’s management strictly limits disclosure of this information to a few carefully selected employees, and then only on a “need to know” basis in connection with their work assignments. Indeed, each Carahsoft employee signs a Confidentiality Agreement agreeing not to disclose this information.
Conclusion
Based on the forgoing, Carahsoft believes it has demonstrated that its Audited Financial Data, Consensus Assessments Initiative Questionnaires, and Cloud Controls Matrix are trade secret as defined in Utah Code § 23- 24-2 . It is a compilation the content of which affords Carahsoft a competitive advantage. Carahsoft’s competition cannot readily discern it by proper means. Moreover, Carahsoft itself treats this information as a trade secret even within its own business operations.
Should there be a public records request for this information, Carahsoft respectfully requests that the State afford Carahsoft’s requested confidential information and documents trade secret protection in accordance with Utah law and deny the request. In the event that the State determines to release the requested confidential data, Carahsoft requests that you notify us promptly so that we may provide further justification for trade secret protection of this confidential data.
CLAIM OF BUSINESS CONFIDENTIALITY
Pursuant to Utah Code Annotated, Subsections 63G-2-305(1) and (2), and in accordance with Section 63G-2-309, Carahsoft Technology Corporation (company name) asserts a claim of business confidentiality to protect the following information submitted as part of this solicitation.
Pricing/Cost Proposals may not be classified as confidential or protected and will be considered public information. An entire proposal cannot be identified as “PROTECTED”, “CONFIDENTIAL” or “PROPRIETARY”.
Non-public financial statements
Specific employee name and contact information
Specific customer information, client lists, or subscription lists Other (specify): Consensus Assessments Initiative Questionnaires and Cloud Controls Matrix
This claim is asserted because this information requires protection as it includes:
trade secrets as defined in Utah Code Annotated Section 13-24-2 ("Trade secret" means information, including a formula, pattern, compilation, program, device, method, technique, or process, that: (a) derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from its disclosure or use; and (b) is the subject of efforts that are reasonable under the circumstances to maintain its secrecy).
commercial information or non-individual financial information obtained from a person if: (a) disclosure of the information could reasonably be expected to result in unfair competitive injury to the person submitting the information or would impair the ability of the governmental entity to obtain necessary information in the future; [and] (b) the person submitting the information has a greater interest in prohibiting access than the public in obtaining access.
This statement of reasons supporting the claim of business confidentiality applies to the following information in this proposal:
Page Paragraph Reason
187-204,
Technical
Response
Template
All See Confidential, Trade Secret, & Proprietary Information Explanation
Exhibit 1-
DocuSign
Excel
N/A See Confidential, Trade Secret, & Proprietary Information Explanation
Exhibit 1-
FireEye
Excel
N/A See Confidential, Trade Secret, & Proprietary Information Explanation
Exhibit 2-
DocuSign
Excel
N/A See Confidential, Trade Secret, & Proprietary Information Explanation
Please use additional sheets if needed.
You will be notified if a record claimed to be protected herein under Utah Code Annotated § 63G-2-305(1) or (2) is classified public or if the governmental entity determines that the record should be released after weighing interests under Utah Code Annotated § 63G-2-201(5)(b) or Utah Code Annotated § 63G-2-401(6). See Utah Code Annotated § 63G-2-309.
Signed: Robert R. Moore, Vice President
On behalf of (company): Carahsoft Technology Corporation Date: March 10, 2016
(Revision 6/4/2015)
SOLICITATION # CH16012
185
EXCEPTIONS AND/OR ADDITIONS TO THE
STANDARD TERMS AND CONDITIONS
Proposed exceptions and/or additions to the Master Agreement Terms and Conditions, including the exhibits, must be submitted in this section. Offeror must provide all proposed exceptions and/or additions, including an Offeror’s terms and conditions, license agreements, or service level agreements in Microsoft Word format for redline editing.
Offeror must also provide the name, contact information, and access to the person(s) that will be directly involved in terms and conditions negotiations. If there are no exceptions or additions to the Master Agreement Terms and Conditions, write “None” in this section.
The point of contact who will be directly involved in terms and conditions negotiations is Jack Dixon – Contract Specialist. He can be reached at – 703.230.7545 / [email protected].
32. Transition Assistance:
a. The Contractor shall reasonably cooperate with other parties in connection with all Services to be delivered under this Master Agreement, including without limitation any successor service provider to whom a Purchasing Entity’s Data is transferred in connection with the termination or expiration of this Master Agreement. The Contractor shall assist a Purchasing Entity in exporting and extracting a Purchasing Entity’s Data, in a format usable without the use of the Services and as agreed by a Purchasing Entity, at no additional cost to the Purchasing Entity. Any transition services requested by a Purchasing Entity involving additional knowledge transfer and support may be subject to a separate transition Statement of Work.
b. A Purchasing Entity and the Contractor shall, when reasonable, create a Transition Plan Document identifying the transition services to be provided and including a Statement of Work if applicable. c. The Contractor must maintain the confidentiality and security of a Purchasing Entity’s Data during the transition services and thereafter as required by the Purchasing Entity.
Carahsoft takes exception to section 32 – Transition Assistance and request it includes the following.
9.4 RETURN OF CUSTOMER DATA. Carahsoft shall provide Customer Data in its standard database export format, excluding the any Core Technology, to Customer upon Customer’s written request and at no additional cost to Customer, provided that Carahsoft receives such request from Customer within forty-five (45) days following the expiration or termination of a provided service. If Carahsoft has not received a request within the foregoing time frame, Carahsoft shall have no obligation to maintain or provide any Customer Data and shall thereafter, unless legally prohibited, have the right to delete all Customer Data in its systems or otherwise in its possession or under its control and delete Customer’s instances of any provided service.
Carahsoft takes exception to Section 13 – Indemnification. Carahsoft requests that Indemnification from the state to the customer under a certain set of circumstances.
SOLICITATION # CH16012
186
IN SUMMARY
Carahsoft Technology Corporation appreciates the opportunity to offer this solution for the State of Utah’s initiative.
The Carahsoft Team has proposed a superior and cost-effective solution that fully complies with the State of Utah’s requirements set forth in Solicitation # CH16012. We understand the importance of your project goals, and we are confident you will benefit from this solution and our expertise.
Carahsoft looks forward to the opportunity to speak with you regarding the details of this proposal, as well as the opportunity to work with the State of Utah on this project.
SOLICITATION # CH16012
187
SUPPLEMENTAL INFORMATION
Please find below Carahsoft’s supplemental information.
SOLICITATION # CH16012
188
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
Carahsoft Technology Corporation
Financial Statements with
Independent Auditors' Report
December 31, 2013
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Accompanying Notes and Auditors' Report
-3-
CONFIDENTIAL PROPRIETARY INFORMATION
See Accompanying Notes and Auditors' Report
-4-
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
-5-
See Accompanying Notes and Auditors' Report
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Accompanying Notes and Auditors' Report
-6-
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Auditors’ Report
- 7 -
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Auditors’ Report
- 8 -
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Auditors’ Report
- 9 -
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Auditors’ Report
- 10 -
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
Carahsoft Technology Corporation
Financial Statements with
Independent Auditor’s Report
December 31, 2014
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Accompanying Notes and Auditor's Report
-3-
CONFIDENTIAL PROPRIETARY INFORMATION
See Accompanying Notes and Auditor's Report
-4-
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
-5-
See Accompanying Notes and Auditor's Report
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Accompanying Notes and Auditor's Report
-6-
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Auditor’s Report
- 7 -
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Auditor’s Report
- 8 -
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Auditor’s Report
- 9 -
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Auditor’s Report
- 10 -
SECURITY AND HOSTING OVERVIEW
June 2015
Security and Hosting Overview June 2015
P a g e 2 | 21
Table of Contents
1 INTRODUCTION.......................................................................................................................................4
1.1 SCOPE OF OPERATIONS ...................................................................................................................5
1.2 SECURITY MANAGEMENT ................................................................................................................6
1.2.1 SECURITY POLICIES, STANDARDS AND PROCEDURES ....................................................................................6
1.2.2 RISK MANAGEMENT ..............................................................................................................................6
1.2.3 ASSESSMENTS .......................................................................................................................................7
1.3 APPLICATION SECURITY ...................................................................................................................8
1.3.1 ENCRYPTION.........................................................................................................................................8
1.3.2 DATABASE SEGMENTATION.....................................................................................................................8
1.3.3 DOCUMENT ENVELOPES .........................................................................................................................8
1.3.4 PAGE-LEVEL ACCESS CHECKING ...............................................................................................................9
1.3.5 URL ENCRYPTION..................................................................................................................................9
1.3.6 ACTIVITY LOGGING ................................................................................................................................9
1.3.7 APPLICATION TESTING............................................................................................................................9
1.3.8 PASSWORD MANAGEMENT...................................................................................................................10
1.3.9 EMAIL APPROVALS...............................................................................................................................10
1.3.10 APPLICATION PENETRATION TESTING....................................................................................................11
1.4 PHYSICAL SECURITY ......................................................................................................................11
1.4.1 INTERNET DATA CENTER CONSTRUCTION ................................................................................................11
1.4.2 ACCESS CONTROL ................................................................................................................................11
1.4.3 MAN TRAPS .......................................................................................................................................12
1.4.4 KEY CONTROL .....................................................................................................................................12
1.4.5 ALARM SYSTEM...................................................................................................................................12
1.4.6 CLOSED CIRCUIT TELEVISION SYSTEM......................................................................................................12
1.4.7 BACKGROUND CHECKS .........................................................................................................................12
1.4.8 HOSTING FACILITY SECURITY PERSONNEL ................................................................................................13
1.5 NETWORK SECURITY.....................................................................................................................13
1.5.1 REDUNDANT COMPONENTS ..................................................................................................................13
1.5.2 PRIVATE VIRTUAL LANS .......................................................................................................................13
1.5.3 FIREWALL...........................................................................................................................................13
1.5.4 24/7 MONITORING.............................................................................................................................14
1.5.5 ENTERPRISE SIEM...............................................................................................................................14
1.5.6 NETWORK PEN TESTING .......................................................................................................................14
1.6 DATA MANAGEMENT ...................................................................................................................14
1.6.1 DATA BACKUPS AND REPLICATION..........................................................................................................14
1.6.2 DATA ARCHIVING ................................................................................................................................14
1.6.3 DATA DELETION ..................................................................................................................................15
1.6.4 DATA USAGE ......................................................................................................................................15
1.6.5 DATA SCRUBBING................................................................................................................................16
1.6.6 DATA ACCESS .....................................................................................................................................17 Security and Hosting Overview June 2015
P a g e 3 | 21
1.6.7 DATA LOSS PREVENTION.......................................................................................................................18
1.6.8 CUSTOMER TERMINATION ....................................................................................................................18 2 RELEASE MANAGEMENT.......................................................................................................................19
2.1 RELEASE MANAGEMENT PROCESS....................................................................................................19 3 DISASTER RECOVERY AND BUSINESS CONTINUITY PLAN .....................................................................21
3.1 DISASTER RECOVERY ....................................................................................................................21
3.2 BUSINESS CONTINUITY ..................................................................................................................21 Security and Hosting Overview June 2015
P a g e 4 | 21
1 Introduction
This document provides a general overview of the SAP Fieldglass security and hosting infrastructure. It is effective as of the revision date indicated below. However, as security needs continue to evolve, the specific information relating to the topics covered may be subject to change over time.
Security
The SAP Fieldglass solution was architected to be the most reliable and secure Vendor Management System available today.
SAP Fieldglass is proud to offer our customers, subject to review and acceptance by our audit partner, the following assurances:
ISO 27001 certified since 2011
SSAE 16/ISAE 3402 Type 2 SOC1 audits conducted since 2005 SSAE 16 Type 2 SOC2 audits in the Trust Services Principles for:
Security – the system is protected, both logically and physically, against unauthorized access
Availability – the system is available for operation and use as committed or agreed to
Processing Integrity – system processing is complete, accurate, timely, and authorized
Confidentiality – information that is designated as “confidential” is protected as committed or agreed
SSAE 16 Type 1 SOC2 audit in the Trust Services Principle for Privacy (Type 2 audit scheduled for Q3 2015)
Annual third party pen testing of our network and application This document provides an understanding of how SAP Fieldglass handles the following areas across its global operations:
Scope of Operations
Security Management
Application Security
Physical Security
Network Security
Data Management
Release Management
Disaster Recovery
Business Continuity
Security and Hosting Overview June 2015
P a g e 7 | 21
Compliance
As an element of our ISO 27001 compliance, SAP Fieldglass conducts an enterprise-wide risk assessment. Key individuals from every department are interviewed so that risks can be identified. Risks are then evaluated and entered into a risk treatment plan. This plan is managed by the Security team with oversight by the Security Steering Committee. The Security Steering Committee meets on a quarterly basis.
1.2.3 Assessments
SAP Fieldglass periodically assesses the security controls to review the effectiveness of each control in addressing risk. If SAP Fieldglass’ assessment suggests a need for changes, the baseline standard may be changed to include additional controls.
Internal Audit
SAP Fieldglass conducts quarterly internal audits for critical controls. Evidence is reviewed by our Sr. Compliance Analyst and a formal assessment report is prepared. Failed controls are made visible by this process so they can be remediated. Executive sign off on the internal audit reports is required.
External Audit
SAP Fieldglass also contracts with third parties on an annual basis to perform formal security audits on the following:
ISO 27001 surveillance audit
SSAE 16/ISAE 3402 Type 2 SOC1 audit
SSAE 16 Type 2 SOC2 audits in the Trust Services Principles for:
Security
Availability
Processing Integrity
Confidentiality
SSAE 16 Type 1 SOC2 audit in the Trust Services Principle for Privacy (Type 2 audit scheduled for Q3 2015)
Network penetration test
Application penetration test
These assessments allow SAP Fieldglass to maintain an appropriate security posture in order to protect the company and its systems, as well as its customers’ data.
We are currently working with our third party audit partner in bringing our EU datacenters into scope for our 2015 ISO 27001 audit and SSAE 16/ISAE 3402 Type 2 SOC1 and SOC2 examinations.
Security and Hosting Overview June 2015
P a g e 8 | 21
1.3 Application Security
Our application provides application-level security through a combination of encryption, page-level access checking, document envelopes, and activity logging. Application security is handled through a combination of programming checks, application server configuration, and database server configuration. SAP Fieldglass uses 128-bit SSL (HTTPS) encryption for all data transmissions over the public Internet, including data shared between the product and end users and data shared between the product and back-end systems.
Passwords are encrypted using a one-way hash with salt based on the SHA-256 encryption algorithm. The hash value is saved within the database; not the password.
The base SAP Fieldglass application does not require data that would require breach notifications if compromised. If the customer chooses to store sensitive data, custom fields may be defined by the customer that can be encrypted with AES-256. These fields can also be optionally masked from view while entering and viewing the fields in the application.
1.3.1 Encryption
By default, the application utilizes SSL encryption for all data transmissions over the public Internet.
In addition, the SAP Fieldglass hosted application encrypts sensitive data stored on the database so that only properly authorized users (or systems) will be able to decrypt the data. Because no state information is stored on the application server, in the unlikely event of unauthorized access to the database, the sensitive data is still encrypted.
1.3.2 Database Segmentation
SAP Fieldglass is a SaaS and utilizes a multi-tenancy database. Each customer is assigned a unique company code. Every record written to the database is keyed using this company code. After a user authenticates into the system, a session ID is generated which holds vital information about the user including their company code, user role, and data visibility restrictions. The session ID is cached server side to eliminate any ability for a malicious user to modify its contents.
1.3.3 Document Envelopes
Throughout the system, there are a number of events that generate “documents.” These are digital representations of their real-world counterparts. For example, job postings, work orders, time sheets, and invoices are all represented in the system as documents.
Each document in the system has an accompanying digital envelope that stores all access to that document. For example, when a job posting is created, an envelope entry is added for creation that records the date, time, and person. When it is submitted, another entry is added recording the date, time, and person.
Security and Hosting Overview June 2015
P a g e 9 | 21
1.3.4 Page-Level Access Checking
The application has been designed so that every single web page checks for access rights before displaying itself. Additionally, each page performs a second check to ensure that an authorized user will only have access to those data elements and functionality that has been expressly authorized by the system administrator.
The post-authentication session ID that is generated and cached server-side is validated prior to showing each page. SAP Fieldglass stores a non-persistent cookie in the browser and compares back to the server-side session ID. If they no longer match due to malicious activity, the user is redirected to a “You are not authorized” page.
Authorization is handled through the use of user-defined User Roles. User Roles provide the customer, through its designated administrators, the flexibility to specify the type of access given to a member of that user group based on the definitions configured by the administrator. The User Role controls what areas of the application are accessible to the user group and what actions they can perform in those areas (e.g. job posting create, time sheet approve, etc.).
1.3.5 URL Encryption
SAP Fieldglass does not pass any sensitive data in its URL query strings. Parameters that are used to identify users in the system are protected by anonymizing the field variable and then encrypting the associated value using AES-256.
1.3.6 Activity Logging
As users access the system, all of their business significant activities are tracked and logged including failed login attempts, successful logins, approvals, submissions, etc. This activity log provides a full audit trail of what actions a particular user performed within the system and the timestamp as well.
1.3.7 Application Testing
Upon request, SAP Fieldglass will provide customers with a sandbox environment where system testing can occur outside of production. This is useful when testing out configuration changes, new integrations, and/or new reports prior to making the changes live in the customer’s production instance.
Upon request, customer’s data can be anonymized. SAP Fieldglass has the ability to scrub the data such that it is unrecognizable. Data element replacement is accomplished by an automated SAP Fieldglass utility that replaces the customer’s company code, user names, business units, cost centers, and sites from a store of random variables. Any or all of these elements may be chosen for replacement.
Sensitive data that has been designated by the customer to be stored in the SAP Fieldglass application is encrypted with AES-256. The encryption and decryption keys are different between production and test environments and are different between the US and EU datacenters. These keys are stored in the corporate password vault and are accessible only by the Database Administrators and the Lead Architect.
Security and Hosting Overview June 2015
P a g e 10 | 21
Once customer testing has been completed, the Environment Management team (a team within Professional Services) destroys the environment. The database is purged and the VM is returned into circulation.
1.3.8 Password Management
The SAP Fieldglass application provides each customer the ability to define a Password Policy. This policy contains custom-defined password rules that each user in the customer’s instance must adhere to. The policy provides 20 different password rules such as minimum length, user lockout preference (hard lockout vs. time-based reset), days to expiration, minimum password age, etc. Also included is the ability to specify a regex pattern(s). This pattern dictates the password value syntax that each user must follow.
When customer chooses to use a test instance (“sandbox”), all user password values remain unchanged from their production values. All passwords and visibility restrictions remain unchanged to ensure that users in the test instance are not able to gain access to data they’re not privileged to see in production. Also, the password policy that is enforced in in the production instance is also enforced in the test instance.
New user invitations are sent via email. Recipients enter their 1-time passcode and are then forced to specify a new password that complies with the customer’s password policy rules. User invitations expire after 21-days.
1.3.9 Email Approvals
In order to better support our growing mobile workforce, SAP Fieldglass offers customers a supplementary method for approving their work items. Via email, approvers are able to submit their approval or rejection response by simply replying to the approval work item that was sent to them. This method has been proven to reduce approval cycle times by several days since the approver does not have to be in the office. This feature has been architected with the following security controls:
Only the original recipient can approve/reject the work item. If the recipient forwards the email to another person, the system will not accept the response. Email spoofing is not a risk. A unique ID is generated for each approval request. This unique ID along with the person ID of the intended recipient is stored encrypted with AES-256. So even if the email address sending the approval/rejection response is legitimate but the sender is not, the system will detect this anomaly and not accept the response.
A SAP Fieldglass approver can identify another user as their Proxy and/or Delegate when they will be out of the office and unable to handle the approval requests. By design, neither of these roles receive approval work items via email. So only the original recipient can ever submit an approval/rejection response via email. If the customer created custom fields where sensitive information is stored encrypted, those fields and associated values are not allowed to be selected for inclusion in these email approval notifications.
The system audit trail is updated with all user actions including approval/rejection activities via email. This audit trail is accessible by privileged customer users and can be used to monitor user activity.
Security and Hosting Overview June 2015
P a g e 11 | 21
In order to compromise the security of our email approval feature, a malicious user would need to hack into another user’s email account, locate the SAP Fieldglass approval request email, and then submit the approval/rejection response.
1.3.10 Application Penetration Testing
SAP Fieldglass uses a combination of manual and automated testing to ensure the application is secure. Various automated commercial tools are used prior to each major release of the SAP Fieldglass system (three times per year).
On an annual basis, SAP Fieldglass engages a 3rd party security company to conduct pen testing services against our application. This is in addition to SAP Fieldglass’ own internal penetration testing efforts.
SAP Fieldglass has several test environments available for customers to conduct their own application penetration testing if requested.
1.4 Physical Security
The SAP Fieldglass data center provides physical security through its secure hosted facilities. The application is hosted within a secure unmarked cage. SAP Fieldglass manages everything from the cage in. Meaning, SAP Fieldglass manages all servers, devices, and software in the cage. The hosting provider provides physical security, internet connectivity, and HVAC.
1.4.1 Internet Data Center Construction
Exterior perimeter walls, doors and windows are constructed of materials that afford UL Standard #752, Level V Ballistic Protection.
1.4.2 Access Control
The data center uses an Access Control System (ACS), which supports a networked card reader and alarm system. The ACS uses proximity card readers to control access into perimeter doors, shipping/receiving areas, storerooms and other areas. Biometric hand scanners are installed to control access into the network control center, telecommunications node room and customer vaults. Additional access control measures include:
Designated with signage as controlled access areas
Areas within the internet data center are designated as restricted Access into the internet data center and restricted areas is controlled by biometric hand scanners, and is limited to authorized personnel Card access badges or contractor/visitor badges are required to gain entry All employees, customers, vendors, contractors and visitors must be sponsored by a facilities pre-approved sponsor to gain access Visitors are escorted at all times within the controlled access area perimeter Security and Hosting Overview June 2015
P a g e 12 | 21
1.4.3 Man Traps
The system includes the following key features:
Anti-passback
Integrated metal & explosive detection
Video monitored / recorded
Two-way intercom audio to Security Control Room
Level V ballistic protection
Weight sensors limit entry to one person at a time (no tailgating) ADA compliant
Intrusion / tampering alarm monitoring by Security Control Room Integrated card access & biometric access control systems limits access to persons verified by hand geometry
All systems are supported by redundant power management system (generators).
1.4.4 Key Control
Facilities security staff is the custodian of all security and cage keys. These keys are maintained and tracked through a comprehensive issue, retrieval, audit, and storage process. The listing of all customers, customer employees and cage assignments is updated in real-time maintained to ensure that cage access is restricted to authorized personnel.
1.4.5 Alarm System
The ACS is used to monitor and log security alarms. The ACS monitors all:
Perimeter doors
Restricted Area doors
Shipping / receiving doors
1.4.6 Closed Circuit Television System
Facilities employ an extensive closed circuit television system to monitor the exterior and interior of the internet data center. Exterior cameras provide views of critical support equipment and perimeter doors. Interior cameras are positioned to monitor all internet data center aisle ways, requests for entry and entry into the internet data center, shipping / receiving areas, high-security vaults and the internet data center lobby. All cameras are recorded on digital video recorders 24 x 7.
1.4.7 Background Checks
SAP Fieldglass requires background checks be performed at the time of hiring on all personnel. These background checks are performed by a nationally recognized third party company. SAP Fieldglass initiates the background check request for all potential employees and independent consultants. If the independent contractor is placed through Security and Hosting Overview June 2015
P a g e 13 | 21
an agency, the agency will conduct a background check and confirm with Human Resources whether the results were completed with/without discrepancies. If the independent contractor is placed directly, SAP Fieldglass will conduct the background check.
Background checks include the following:
Social Security Trace
Statewide & National Criminal Report (7 years)
Sex Offender Registry & Terrorist Watch
Compliance Authorities Database Checks – Global (OFAC level verification) Education verification
Employment verification (7 years)
Global Sanctions & Prohibited Parties
Credit (only for specific finance roles)
1.4.8 Hosting Facility Security Personnel
The security office duties include:
Response to calls for assistance
Security facility inspections
Fire and safety patrols
Shipping / receiving security
Physical security audits and assessments
1.5 Network Security
The SAP Fieldglass network infrastructure includes redundant components, firewalls, and 24/7 monitoring.
1.5.1 Redundant Components
Most network components are internally redundant. For example, routers have redundant power supplies; servers have redundant drives, power supplies, and NIC cards.
Additionally, all network components are redundant to provide redundancy and security in the event of a component failure.
1.5.2 Private Virtual LANs
The application network architecture has been designed with multiple private virtual LANs using redundant Cisco routers. Every major network layer is placed on its own virtual LAN with rules about which protocols and ports are accessible.
1.5.3 Firewall
SAP Fieldglass has implemented dual-vendor redundant firewalls between the public internet and the SAP Fieldglass private network, as well as between each virtual LAN. This Security and Hosting Overview June 2015
P a g e 14 | 21
firewall has been configured to enforce protocols and ports that are able to cross LANs with a default deny stance.
1.5.4 24/7 Monitoring
SAP Fieldglass provides 24/7 monitoring of suspicious activity. Any failure is promptly reported and, after an initial analysis, escalated to the next appropriate level.
1.5.5 Enterprise SIEM
Our security incident and event management (SIEM) tool has been configured to collect logs and events from all systems and devices within the SAP Fieldglass network.
Forwarders are used to collect, filter, normalize and forward relevant data to an Indexer.
Each installation listens for Syslog data and actively pulls WMI information from its respective environment. Security related issues are monitored and alerted on where required.
1.5.6 Network Pen Testing
On an annual basis, SAP Fieldglass engages a 3rd party security company to conduct pen testing services on our network.
1.6 Data Management
1.6.1 Data Backups and Replication
SAP Fieldglass has a highly available backup solution that guarantees data can be restored as expediently as possible. Our solution performs a continuous replication of data to our passive production hosting facility. SAP Fieldglass takes incremental SQL backups every 15 minutes and full backups on a nightly basis. Backups are transferred to the passive production hosting environment over a secure channel. SAP Fieldglass’ solution offers continuous protection of customer data geographically without imposing performance degradation or scaling limitations. Data is encrypted both at rest and in transit with AES256.
Data backups and replication are performed between the active and passive production environments. The US-based active production environment replicates data to the USbased passive environment. Likewise, The EU-based active production environment replicates data to the EU-based passive environment.
Also refer to section 3.1 Disaster Recovery.
1.6.2 Data Archiving
Data is archived throughout the year. Eligible transactional and reporting data are moved from the active database to an archive database after 24 months. Archived data can be accessed only by customer users with a user role of Administrator. Archive data is accessed using the same login screen and user interface that is used to access current data. Reports can also be generated using archive data from the standard interface.
Security and Hosting Overview June 2015
P a g e 15 | 21
The criteria for archiving data are as follows:
Data remains in the active database for 24 months, at which point eligible data is moved to the archive database.
Data remains in the active report database for 24 months, at which point eligible data is moved to the archive report database.
Archiving begins with the worker. When a worker’s end date is more than 24 months old, the worker and all associated data including the worker’s work orders, job seeker record, job posting, time sheets, expense sheets, and payment-related items such as invoices are archived.
The archive process is run as a batch job on a weekly basis to move data from the active databases to the archive databases.
Data cannot be moved back from the archive database to the active database.
SAP Fieldglass does not delete data from its archive databases and has data older than 7 years. In the future, if SAP Fieldglass decides to delete archived data, we will ensure that a minimum 7 years of data is retained.
1.6.3 Data Deletion
Data deletion occurs only when required by a customer. SAP Fieldglass’ data deletion capabilities allow customers to remain compliant with data privacy, data protection, and other related data directives.
Deletion logic is based solely on a customer’s business requirements. A custom script is developed by SAP Fieldglass.
Results are verified in a non-production environment by both SAP Fieldglass and the customer prior to executing in production.
A “Preservation” flag is available for use. Customers can set this flag on any data to override logic that would otherwise delete the data. This is useful during times when litigation or eDiscovery efforts are in progress and certain data must be preserved.
Script execution frequency is determined by the customer.
SAP Fieldglass is contractually obligated to retain at least 7 years of data for customers.
1.6.4 Data Usage
Customer data is required in non-production environments for various reasons:
Second level help desk support for customer defect investigation and resolution.
Supporting customer requests for updating data, whether it be for desired changes or corrections for data modified by the customer in error. Customer sandboxes – these are non-production environments configured only with the customer’s data (customer’s data is “sliced” out from the multitenancy production database). These sandboxes are required for many Security and Hosting Overview June 2015
P a g e 16 | 21
reasons, including testing of new or changed integration connectors, reports, and/or application configuration changes such as revised approval workflows. New application features can also be turned on and reviewed in the sandbox before turning on in the live production instance. Any data deletion scripts that are developed between the customer and SAP Fieldglass must be tested in a non-production environment prior to executing in production.
Customer Preview testing – this is an opportunity for customers to gain early access to a future upgrade of the SAP Fieldglass application. This allows customers to gain confidence that the system is working as expected prior to the release date. Customer participation is optional.
SAP Fieldglass regression testing – the SAP Fieldglass application is offered in a Software as a Service (SaaS) model. One of the services we provide is testing of the application prior to each production release. To ensure a customer’s configuration, integrations, and reports are working as expected with the new codebase, SAP Fieldglass Quality Assurance uses a scrubbed production copy of the database in our regression testing. Regression testing is where we execute test cases against the current production codebase and the future codebase using a common data input. Output files from each test are compared to ensure any changes are expected.
Customers may opt out of this process. However, all responsibility in ensuring the customer’s SAP Fieldglass instance is properly working and maintained is transferred to the customer.
To date, all SAP Fieldglass customers have declined to assume this responsibility.
1.6.5 Data Scrubbing
In order to properly service our customers, access to production data is required. All customer data is classified as Confidential. SAP Fieldglass takes every possible precaution to ensure data is protected from unauthorized access and misuse.
Data is protected in the following ways:
First names and last names of buyers, suppliers, and workers are anonymized by replacing with a test value.
Email addresses of buyers, suppliers, and workers are changed to a single false email address such as qatest8@SAP Fieldglass.com which is configured to automatically purge all email sent to it.
Buyer and supplier company names are anonymized.
Any custom fields created by the customer remain unchanged. Custom fields that contain sensitive data are encrypted with AES-256 and optionally display masked when entering and displaying values in the user interface. There is no way to decrypt these values since the decryption keys between production and test are different. Keys are stored in the corporate password vault and
Security and Hosting Overview June 2015
P a g e 19 | 21
2 Release Management
2.1 Release Management Process
The SAP Fieldglass Release Management team is responsible for the management of all delivables required in upgrading the production SAP Fieldglass system. This team is comprised of key members from the Development, Quality Assurance, Product Management, Professional Services, and executive teams. SAP Fieldglass customers benefit from our release management in that the release deployment schedule repeats itself year over year; releases are deployed over the same weekends of predetermined months.
SAP Fieldglass has several different release types:
Major Releases
In the US, Major releases occur on the second Fridays in March, July, and November. In the EU, Major releases occur on the third Fridays in March, July, and November These releases can include new product features, new or changed functionality, user experience enhacements, and changes to the user interface. These are our most formal releases and the only type of release that requires an extended maintenance window.
The Release Manager and the Release Management team closely monitor all phases of the Software Development Lifecycle and analyze PKIs at each phase transition. Release notes are provided as well as an opportunity for customers to optionally participate in a customer preview opportunity. This is where users can log into a non-production environment that is running the future codebase. The benefit of participating is that customers can gain confidence the system is behaving as expected prior to the official release date.
Minor Releases
Minor releases occur on the second Fridays in January, May and September.
These releases do not require the formalities of major releases. This type of release is used when deploying customer-specific product features and integrations to production.
These releases are deployed to both US and EU customers at the same time.
Service Packs
Serivce packs are deployed as required to resolve product defects. These releases are deployed to both US and EU customers at the same time.
Security and Hosting Overview June 2015
P a g e 20 | 21
All releases are deployed to production by a central deployment team located in the US.
During the deployment process, the codebase is replaced with the new codebase and data transformation scripts are executed. During this process, customer data is not viewed or accessed. Upon completion of the deploy, the Quality Assurance team executes a post-deploy verification checklist to ensure the system is ready for general availability.
One such verification is verifying an MD5 hash to ensure the certified codebase was installed in production without modification. Test companies are used in conducting all testing.
Security and Hosting Overview June 2015
P a g e 21 | 21
3 Disaster Recovery and Business Continuity Plan
3.1 Disaster Recovery
SAP Fieldglass maintains a disaster recovery plan with backup, hardware repair, and data restoration, along with the ability to bring up the SAP Fieldglass application at a hot backup site in the event of a declared disaster (as described in the SAP Fieldglass disaster recovery plan) where the primary site is destroyed or disabled. This plan is tested on a yearly basis. Lessons learned are recorded in the test results and the plan is adjusted and improved accordingly.
SAP Fieldglass has the concept of active and passive production hosting facilities. The active environment is the live production hosted facility that all SAP Fieldglass users are actively using. The passive environment is a hot production hosting environment. Our data replication solution ensures that the passive environment is ready at anytime to be failed over to. In a disaster scenario, SAP Fieldglass changes the DNS to the passive hosting center’s set of IPs. Users are then seamlessly routed to the other datacenter. There is not multi-day data migration that has to occur due to the ongoing data replication that is in place.
SAP Fieldglass proactively conducted a datacenter failover from the active datacenter to the passive datacenter in April 2015. The entire failover process was conducted in just over 8 hours with zero data loss. SAP Fieldglass plans to repeat this proactive datacenter failover between 1 and 3 times per year.
Also refer to section 1.6.1 Data Backups and Replication.
3.2 Business Continuity
The primary objective of our business continuity plan (BCP) is to enable SAP Fieldglass to recover all functions within their respective Recovery Time Objectives (RTOs) after any type of disruption occurs which prevents SAP Fieldglass personnel from engaging in ongoing business operations. A Recovery Point Objective (RPOs) has also been defined to identify our tolerance for any data loss. This Plan is designed to support the employees responsible for leading recovery efforts to enable SAP Fieldglass to resume daily operations following a disruption.
A business impact analysis (BIA) has been developed to fully quantify and prioritize restoration of mission-critical processes.
Privacy Policies and Procedures
Revision History
Virtru’s Privacy Policies and Procedures were adopted as of [Date].
Name
Virtru’s Privacy Policies and Procedures were revised as of [Date].
Name
Virtru’s Privacy Policies and Procedures were revised as of [Date].
Name
Virtru’s Privacy Policies and Procedures were revised as of [Date].
Name
Virtru’s Privacy Policies and Procedures were revised as of [Date].
Name
Virtru’s Privacy Policies and Procedures were revised as of [Date].
Name
Rev.2015.8.6
Table of Contents
Revision History
Company
Document Control
Security Document Library
Management and Protection of Personally‐Identifiable Information Overview:
Purpose:
Applicability:
Definitions:
Policy:
Enforcement:
Administrative Requirements for HIPAA Implementation
Overview:
Purpose:
Applicability:
Policy:
Documentation Requirements:
Enforcement:
Minimum Necessary Standard
Overview:
Purpose:
Applicability:
Policy:
Procedures:
Enforcement:
Business Associate Agreements
Overview:
Purpose:
Applicability:
Policy:
Enforcement:
Business Associate Subcontractor Agreements
Overview:
Purpose:
Applicability:
Policy:
Enforcement:
Receipt, Use and Disclosure of Personally‐Identifiable Information Overview:
Purpose:
Applicability:
Special Definition:
Policy:
Procedures:
Enforcement:
Complaint Process
Rev.2015.8.25
2 O
verview:
Purpose:
Applicability:
Policy:
Procedures:
Enforcement:
ScannerandFaxPolicy
Overview:
Purpose:
Applicability:
Special Definitions
CorporatePolicies:
Procedure:
Enforcement:
ScannerPolicy
Overview:
Purpose:
Applicability:
Special Definitions
CorporatePolicies:
Procedure:
Enforcement:
TrainingPolicy
Overview:
Purpose:
Applicability:
Policy:
Enforcement:
Rev.2015.8.25
3 I. Company
Virtrumay be referred to as “Company.”
A. Document Control
A staff copy of this document is available with the VirtruPrivacy Officer, Will Ackerly, [email protected] or (202) 577‐3683.
B. Security Document Library
These policies and procedures and related privacy and security practice information will be kept in our Security Documentation Library (SDL). The Library is located in Google Drive and backed up to a local NAS.
Outdated and superseded materials from the Security Documentation Library (or Notebook) will be kept in an archive (the Security Documentation Archive) for at six (6) years after the date when they are first outdated or superseded.
II. Management and Protection of PersonallyIdentifiable Information A. Overview
The Privacy Rules place certain restrictions on the acquisition, use and disclosure of Personally‐Identifiable Information (PII). These policies establish the minimum care with which PII in the custody of Virtrupersonnel must be maintained.
B. Purpose
The purpose of this document is to provide basic instruction to all Virtru employees regarding the management and protection of Personally‐Identifiable Information.
C. Applicability
This policy applies to all Virtruemployees, which are defined for the purposes of this document to be employees of all current and future subsidiaries of Virtru.
D. Definitions
Covered Entity means a health plan, a health care clearinghouse, or a health care provider that transmits any health information in electronic form relating to any covered transaction.
PersonallyIdentifiable Information (PII) means any information about an individual maintained by Virtru, including:
1. Any information that can be used to distinguish or trace an individual‘s identity, such as name, social security number, date and place of birth, mother‘s maiden name, or biometric records; and
Rev.2015.8.25
4 2. Any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information
Treatment, Payment and Health Care Operations (TPO) include all the following:
1. Treatment means the provision, coordination, or management of health care and related services, consultation between providers relating to an individual, or referral of an individual to another provider for health care.
2. Payment means activities undertaken to obtain or provide reimbursement for health care, including determinations of eligibility or coverage, billing, collections activities, medical necessity determinations and utilization review.
3. Health Care Operations includes functions such as quality assessment and improvement activities, reviewing competence or qualifications of healthcare professionals, conducting or arranging for medical review, legal services and auditing functions, business planning and development, and general business and administrative activities including the creation of de‐identified health information as defined by these regulations.
Disclosure means the release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information.
Use means, with respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information.
Personal Representative means a person who has authority under applicable law to make decisions related to health care on behalf of an adult or an emancipated minor, or the parent, guardian, or other person who is authorized under law to make health care decisions on behalf of an un‐emancipated minor.
Employees means all employees of Virtruas well as its temporary employees, interns, independent contractors, trainees, and other persons in the performance of work for the Company, its offices, programs or facilities.
Privacy Rules means the rules adopted by various state and federal agencies to implement the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and regulations promulgated under this Act as well as those obligations that arise under the privacy and security standards adopted by the Health Insurance Marketplaces, pursuant to 45 C.F.R. §155.260.
E. Policy
For details on specific requirements, refer to the appropriate policies in this manual as indicated in [brackets].
Rev.2015.8.25
5 1. Generally: Personally‐Identifiable Information shall not be obtained, used or disclosed except as permitted or required by law.
2. Permitted and Required Uses and Disclosures: Personally‐Identifiable Information may or shall be disclosed as follows:
a) To the individual
b) To carry out TPO activities as allowed under HIPAA and/or pursuant to and in compliance with a current and valid Authorization [Receipt, Use and Disclosure of PersonallyIdentifiable Information].
c) In keeping with a Business Associate Agreement [Business Associate Agreement].
d) As otherwise allowed or required under the HIPAA Rules or other federal and/or state laws concerning privacy of information that is used by Virtruin the course of its business operations.
3. Minimum Necessary: Generally, when obtaining, using or disclosing Personally‐Identifiable Information, or when requesting PII from another entity, reasonable efforts must be made to limit the PII used or disclosed to the minimum necessary to accomplish the intended purpose. However, the Privacy rules were not intended to severely complicate business processes and Virtrumay, where appropriate, use a single format to provide data containing PII for our various services [Minimum Necessary Standard].
4. De‐identified Personally‐Identifiable Information: PII may be considered not to be individually identifiable in the following circumstances:
a) The following identifiers of the individual (and relatives, employers or household members) are removed. (This is the “Safe Harbor” method that Virtruwill generally use.)
Names
Information relating to the individual's geographic subdivision if it contains fewer than 20,000 people
Elements of dates (except year) directly related to the individual All ages and elements of dates that indicate age for individuals over 89, unless aggregated into a single category of age 90 and older Telephone numbers
Fax numbers
Rev.2015.8.25
6 Email addresses
Social Security Numbers
Medical record numbers
Health plan beneficiary numbers
Account numbers
Certificate or license numbers
Vehicle identifiers and serial numbers, including license plate numbers Device identifiers and serial numbers
Web Universal Resource Locators (URLs)
Internet Protocol (IP) address numbers
Biometric identifiers; full face photographic images
Any other unique identifying number, characteristic or code. b) As allowed in the Privacy Rules, Virtrushall provide a number of longitudinal identifiers in the de‐identified data. These identifiers shall not allow identification of the individual who is the subject of this data in that:
1) These identifiers will be encrypted using industry level encryption techniques
2) The method of encryption shall not be divulged to the receiver of the de‐identified data
5. Complaint Process: Virtruhas put into place a process for individuals to make complaints about our Privacy Policies and Procedures and/or our compliance with those Policies and Procedures.
6. Documentation: Virtrumust maintain written or electronic copies of all policies and procedures, communications, actions, activities or designations as are required to be documented under this manual for a period of six (6) years from the later of the date of creation or the last effective date.
F. Enforcement
An employee found to have violated this policy shall be subject to disciplinary action, up to and including termination of employment. In the case where inappropriate access or use or disclosure of Personally‐Identifiable Information was or may have been involved, such individuals may additionally be reported to the appropriate enforcement agencies. [Sanction Policy]
Rev.2015.8.25
7 III. Administrative Requirements for HIPAA Implementation A. Overview
The Privacy Rules require that a Business Associate have in place appropriate administrative safeguards to protect the privacy of Personally‐Identifiable Information.
B. Purpose
To provide instructions regarding Virtru's obligations relating to the implementation of administrative requirements of the Privacy Rules.
C. Applicability
This policy applies to all Virtruemployees, which is defined for the purposes of this document to be employees of all current and future subsidiaries of Virtru.
D. Policy
1. Personnel Designations: Virtruhas designated and documented designations of the following:
a. Will Ackerly has been designated as the Privacy Officer. 1) He is responsible for the development and implementation of corporate‐wide policies and procedures relating to the safeguarding of Personally‐Identifiable Information.
2) He will also be responsible for receiving complaints relating to Personally‐Identifiable Information and for providing information about the Company'sprivacy practices.
b. Persons with access to Personally‐Identifiable Information are listed by title and department including a listing of individuals’ names on the Risk Assessment; and will be updated if Virtrumakes any major changes to processes, staff, programming or company location; or at a minimum annually. Virtruwill retain the previous listing for a period of not less than six (6) years.
2. Training Requirements: Virtrushall document the following training actions:
All Virtruemployees shall receive training on applicable policies and procedures relating to Personally‐Identifiable Information as necessary and appropriate for such persons to carry out their functions within the Company. a. Each new employee shall receive the training as described above within 30 days after joining Virtru.
Rev.2015.8.25
8 b. Each employee whose functions are impacted by a material change in the policies and procedures relating to Personally‐Identifiable Information, or by a change in position or job description, shall receive the training as described above within 30 days after the change becomes effective. c. Complaints handled by Committee...
3. Safeguards: Virtrushall have in place appropriate Administrative, Technical, and Physical Safeguards to reasonably safeguard Personally‐Identifiable Information from intentional or unintentional unauthorized receipt, use or disclosure.
4. Complaint process: Virtrushall have in place a process for individuals to make complaints about the Company's HIPAA Policies and Procedures and/or Virtru's compliance with those Policies and Procedures, and shall document all complaints received and the disposition of each complaint. (See Complaint Process)
5. Sanctions:Our Privacy Policies call for our workforce that has access to Personally‐Identifiable Information to perform certain duties and to refrain from certain actions. Failure to do so will be sanctioned according to the policy below.
These sanctions apply to the designated workforce members including managers, supervisors, and staff who have access to Personally‐Identifiable Information.
It is intended as guidance for our business management in sanctioning information security policy infractions. We reserve the right to implement sanctions differently if, in our judgment, the situation warrants it.
We define a serious infraction as one that results in known significant damage or that threatens imminent significant damage. Other infractions are simple infractions.
First security infraction
If the infraction is:
a. A simple infraction, and
b. The first infraction in the last 3 years
The sanction will be retraining the workforce member on the appropriate policy/procedure and placement of a written letter of reprimand in the employee file. The letter will notify the person of the nature of this infraction and of sanctions for future potential infractions.
Second security infraction or first serious infraction
If the infraction is:
a. A serious infraction, or
Rev.2015.8.25
9 b. The second infraction of either type within 3 years The sanction will include a written letter of reprimand that is given to the person at fault, placement of a copy of the letter in the employee file, and one week’s suspension without pay. The letter will notify the person of the nature of this infraction and of sanctions for future potential infractions.
Third security infraction or second serious infraction
If the infraction is:
a. A second serious infraction within 3 years, or
b. A third infraction of any type within 3 years.
The sanction will be dismissal from the workforce.
Virtru makes exceptions for disclosures made by employees who qualify as whistleblowers or certain crime victims.
6. Mitigation efforts required: Virtru, to the extent practicable, shall mitigate any harmful effects of unauthorized uses or disclosures of Personally‐Identifiable Information by the Companyor any of its Business Associate Subcontractors.
7. Prohibition on intimidating or retaliatory acts: Neither Virtrunor any employee shall intimidate, threaten, coerce, discriminate against, or take other retaliatory action against any individual for the exercise of their rights or participation in any process relating to HIPAA compliance, or against any person for filing a complaint with the Secretary of the U.S. Department of Health and Human Services, participating in an investigation, compliance review, proceeding or hearing, or engaging in reasonable opposition to any act or practice that the person in good faith believes to be unlawful under the Privacy Rules as long as the action does not involve disclosure of Personally‐Identifiable Information in violation of the regulations.
Virtrushall document the following actions relating to its policies and procedures:
a. Required policies and procedures: Virtrushall implement policies and procedures to assure appropriate safeguarding of
Personally‐Identifiable Information in its operations.
b. Changes to policies and procedures: Virtrushall change its policies and procedures as necessary and appropriate to conform to changes in law or regulation. Virtrumay also make changes to policies and procedures at other times as long as the policies and procedures are still in compliance with applicable law. Where necessary, Virtrushall make correlative changes in its Privacy Notice.
Rev.2015.8.25
10 E. Documentation Requirements
Virtrumust maintain the required policies and procedures in written or electronic form, and must maintain written or electronic copies of all communications, actions, activities or designations as are required to be documented hereunder, or otherwise under the Privacy Rules, for a period of six (6) years from the later of the date of creation or the last effective date.
F. Enforcement
Any employee found to have violated this policy shall be subject to disciplinary action, up to and including termination of employment. In the case where inappropriate access, use or disclosure of Personally‐Identifiable Information was or may have been involved, such individuals may additionally be reported to the appropriate enforcement agencies.
IV. Minimum Necessary Standard
A. Overview
The Privacy Rules place certain restrictions on the receipt, use and disclosure of Personally‐Identifiable Information in regards to the amount reasonably necessary to accomplish the task being performed. However, the Privacy Rules also allow Personally‐Identifiable Information to be disclosed for business appropriate needs.
The policies developed by Virtruwill follow this business appropriate philosophy as well as that of administrative simplification, which is the subsection of the HIPAA law under which the Privacy Rule was developed. Virtrushall use standard data formats for information acquisition or disclosure and tailor these formats to contain a business reasonable minimum necessary amount of Personally‐Identifiable Information. The Company’spolicies establish the minimum necessary use provisions for Personally‐Identifiable Information in the custody of Virtruemployees.
B. Purpose
To issue instructions regarding Virtru’sobligations relating to the Privacy Rules to obtain, use and disclose only the minimum amount of Personally‐Identifiable Information (PHI) necessary to accomplish the intended purpose.
C. Applicability
This policy applies to all Virtruemployees, which is defined for the purposes of this document to be employees of all current and future subsidiaries of the Company.
D. Policy
Virtruwill make reasonable efforts to ensure that the Minimum Necessary amount of Personally‐Identifiable Information is disclosed, used, or requested to accomplish the intended purpose. Exceptions to the Minimum Necessary Standard include disclosures:
1. To the individual who is the subject of the information; Rev.2015.8.25
11 2. Made pursuant to an authorization provided by the individual;
3. To healthcare providers for treatment purposes;
4. Required for compliance with the standardized HIPAA transactions;
5. Made to the Secretary of HHS or his agent pursuant to a privacy investigation;
6. Otherwise required by the Privacy Rules or other law.
Employees shall be trained on the policies and procedures developed to apply these principles to the use or disclosure of, or requests for Personally‐Identifiable Information.
E. Procedures
The following procedures will be implemented to ensure that this policy is enforced effectively across all parts of Virtru.
1. Each user of a system which accesses Personally‐Identifiable Information shall be identified and the classes or types of PII to which access is needed and any conditions appropriate to such access will be established. It will be the responsibility of the Privacy Officer to maintain this information using the Employee Access Request Form [Forms for Employees] and System Access Log [Change Control Logs for Security].
2. Reasonable efforts will be taken to limit the access of each user of Personally‐Identifiable Information to the amount needed to carry out the individual’s duties. These efforts will include internal use of PII.
3. For situations where Personally‐Identifiable Information disclosure occurs on a routine and recurring basis, the PII disclosed will be limited to the amount of information reasonably necessary to achieve the purpose of the disclosure.
4. Requests for disclosures that are not routine and recurring and thereby covered by Virtrustandard procedures (other than to the individual, the Secretary of HHS or his agent, or where required by law) shall be reviewed by the Privacy Officer to determine that the Minimum Necessary Standard is applied to the extent reasonable.
5. Questions regarding these procedures should be directed to the VirtruPrivacy Officer, Will Ackerly, [email protected], or (202) 577‐3683.
F. Enforcement
An employee found to have violated this policy shall be subject to disciplinary action, up to and including termination of employment. In the case where inappropriate access or use or disclosure of Personally‐Identifiable Information was or may have been involved, such individuals may additionally be reported to the appropriate enforcement agencies.
Rev.2015.8.25
12 V. Business Associate Agreements
A. Overview
The Privacy Rules impose certain requirements on Business Associates who create, receive, use or disclose Personally‐Identifiable Information on behalf of their Covered Entity partners. Vitru must comply with the requirements in this section.
B. Purpose
To provide instructions to all Virtruemployees regarding the necessity of and the requirements for Business Associate Agreements relating to Covered Entities.
C. Applicability
This policy applies to all Virtruemployees, which is defined for the purposes of this document to be employees of all current and future subsidiaries of Virtru.
D. Policy
1. Generally: A Covered Entity may disclose Personally‐Identifiable Information to Virtru, or allow Virtru to create or receive PII on the Covered Entity’s behalf.
Virtru will appropriately safeguard the PII obtained from the Covered Entity.
Virtruwill document these assurances through a written agreement.
2. Content Requirements: The agreement between the Covered Entity and Virtru must meet the following requirements, as applicable:
a. Establish permitted and required uses or disclosures of Personally‐Identifiable Information that are consistent with those authorized for the Covered Entity, except that the agreement may permit Virtru to use or disclose Personally‐Identifiable Information for its own management and administration if such use or disclosure is required by law, or Virtru provides reasonable assurance to the Covered Entity to which the Personally‐Identifiable Information is disclosed that the confidentiality of the PII will be maintained.
b. Provide that Virtru will:
1. Not use or disclose the Personally‐Identifiable Information except as authorized under the agreement or required by law.
2. Use safeguards to prevent unauthorized use or disclosure.
3. Report unauthorized uses or disclosures to the Covered Entity.
Rev.2015.8.25
13 4. Pass on the same obligations relating to protection of Personally‐Identifiable Information to any subcontractors.
5. Make Personally‐Identifiable Information available for access by the Covered Entity in accordance with relevant law and policy.
6. Make Personally‐Identifiable Information available to the Covered Entity for amendment, and incorporate any approved amendments to Personally‐Identifiable Information, in accordance with relevant law and policy.
7. Make information available for the provision of an accounting of uses and disclosures in accordance with relevant law and policy.
8. Make its internal practices, books and records relating to its receipt or creation of Personally‐Identifiable Information available to the Secretary of HHS for purposes of determining Virtru’s compliance with Privacy Rules.
9. Authorize termination of the agreement by the Covered Entity upon a material breach by Virtru.
3. Compliance Responsibilities: Virtru agrees to report any use or disclosure of Personally‐Identifiable Information not permitted by this agreement and any successful security incident to Covered Entity within a commercially reasonable period, but in no event later than within thirty (30) business days, after it is discovered.
E. Enforcement
An employee found to have violated this policy shall be subject to disciplinary action, up to and including termination of employment. In the case where inappropriate access or use of Personally‐Identifiable Information was or may have been involved, these individuals may additionally be reported to the appropriate law enforcement agencies.
VI. Business Associate Subcontractor Agreements
A. Overview
The Privacy Rules impose certain requirements on Business Associate Subcontractors who create, receive, use or disclose Personally‐Identifiable Information on behalf of Virtru. All Business Associate Subcontractors of Virtru must comply with the requirements in this section.
B. Purpose
To provide instructions to all Virtruemployees regarding the necessity of and the requirements for Business Associate Subcontractor Agreements relating to Business Associate Subcontractors who receive, use or disclosure Personally‐Identifiable Information on behalf of Virtru.
Rev.2015.8.25
14 C. Applicability
This policy applies to all Virtruemployees and Business Associate Subcontractors, which are defined for the purposes of this document to be employees of all current and future subsidiaries of Virtruand the Business Associate Subcontractor.
D. Policy
1. Generally: Virtrumay disclose Personally‐Identifiable Information to a Business Associate Subcontractor, or allow a Business Associate Subcontractor to create or receive PII on Virtru’s behalf, if adequate assurances are obtained by Virtru that the Business Associate Subcontractor will appropriately safeguard the PII. Virtru must document these assurances through a written agreement. This requirement does not apply with respect to:
a. Disclosures made to a provider concerning the individual's treatment, payment or health care operations; or
b. Uses or disclosures made to a governmental agency for purposes of public benefit eligibility or enrollment determinations where such company is authorized by law to make these determinations.
2. Content Requirements: The agreement between Virtruand a Business Associate Subcontractor must meet the following requirements, as applicable:
a. Establish permitted and required uses or disclosures of Personally‐Identifiable Information that are consistent with those authorized for the entity, except that the agreement may permit the Business Associate Subcontractor to use or disclose Personally‐Identifiable Information for its own management and administration if such use, or disclosure is required by law, or the Business Associate Subcontractor obtains reasonable assurance from the entity to which the Personally‐Identifiable Information is disclosed that the confidentiality of the PII will be maintained.
b. Provide that the Business Associate Subcontractor will:
1) Not use or disclose the Personally‐Identifiable Information except as authorized under the agreement or required by law.
2) Use safeguards to prevent unauthorized use or disclosure. 3) Report unauthorized uses or disclosures to Virtru.
4) Pass on the same obligations relating to protection of Personally‐Identifiable Information to any subcontractors or agents. 5) Make Personally‐Identifiable Information available for access by Virtru, in accordance with relevant law and policy.
Rev.2015.8.25
15 6) Make Personally‐Identifiable Information available to Virtrufor amendment, and incorporate any approved amendments to PII, in accordance with relevant law and policy.
7) Make information available to Virtrufor the provision of an accounting of uses and disclosures in accordance with relevant law and policy. 8) Make its internal practices, books and records relating to its receipt or creation of Personally‐Identifiable Information available to the Secretary of HHS for purposes of determining the Business Associate Subcontractor’s compliance with Privacy Rules.
9) If feasible, return or destroy all Personally‐Identifiable Information upon termination of contract; if any PII is retained, continue to extend the full protections specified herein as long as the PII is maintained. 10)Authorize termination of the agreement by the entity upon a material breach by the Business Associate Subcontractor.
3. Compliance Responsibilities: If Virtruknows of a pattern or practice of the Business Associate Subcontractor that amounts to a material violation of the Agreement, Virtru and the Business Associate Subcontractor must attempt to cure the breach to end the violation, and if unsuccessful, terminate the agreement. If terminating the Agreement is not feasible, Virtrumust report the problem to the Secretary of HHS.
E. Enforcement
An employee of Virtruor an employee of the Business Associate Subcontractor found to have violated this policy shall be subject to disciplinary action, up to and including termination of employment. In the case where inappropriate access or use of Personally‐Identifiable Information was or may have been involved, these individuals may additionally be reported to the appropriate law enforcement agencies.
VII. Receipt, Use and Disclosure of PersonallyIdentifiable Information A. Overview
The Privacy Rules impose certain requirements on Covered Entities and Business Associates who create, receive, use or disclose Personally‐Identifiable Information on behalf of their Covered Entity partners.
B. Purpose
To provide instructions to all Virtruemployees regarding the receipt, uses and disclosures of Personally‐Identifiable Information, which are permitted or required by HIPAA.
C. Applicability
This policy applies to all Virtruemployees, which is defined for the purposes of this document to be employees of all current and future subsidiaries of the Company.
Rev.2015.8.25
16 D. Special Definition
Public Health Authority means a governmental company or authority, or a person or entity acting under a grant of authority from or a contract with such a public company, including the employees or agents of the public company, its contractors and those to whom it has granted authority, that is responsible for public health matters as part of its official mandate.
E. Policy
State and federal law permit and require certain receipt, uses and disclosures of Personally‐Identifiable Information such as those related to Business Associate Agreements. Additional uses and/or disclosures are allowed or required that related to public responsibility that require no agreement or authorization on the part of the individual who is the subject of the PII. It is the policy of Virtruto obtain, use and disclose PII only as permitted and/or required by law or regulation including the following situations:
1. Treatment, Payment or Healthcare Operations: Personally‐Identifiable Information may be used or disclosed for the purposes of providing treatment, payment or healthcare operations. Such disclosures will be made only as allowed by and pursuant to prevailing state and federal law. a. Discussions involving Personally‐Identifiable Information shall be conducted only in appropriate business areas including but not limited to offices, conference rooms and other non‐public areas; b. Conducted only for the purpose of fulfilling a legitimate business need; and
c. Conducted with regard to and in compliance with the “Minimum Necessary Standard.” [Minimum Necessary Standard]
2. Contained in a Business Associate Agreement: For permitted and required uses or disclosures of Personally‐Identifiable Information that are consistent with those authorized by the Covered Entity in a Business Associate Agreement.
3. Required by Law: Personally‐Identifiable Information may be used or disclosed to the extent such use or disclosure complies with and is limited to the requirements of such law.
4. Abuse and Neglect: Except for reports of child abuse or neglect, Personally‐Identifiable Information about an individual believed to be a victim of abuse, neglect, or domestic violence may be disclosed to a governmental authority authorized to receive such reports if the individual agrees or the reporting entity believes, in the exercise of professional judgment, that the disclosure is necessary to prevent serious physical harm. If the individual lacks the capacity to agree, disclosure may be made if not intended for use against the individual and delaying disclosure would materially hinder law Rev.2015.8.25
17 enforcement activity. The individual whose Personally‐Identifiable Information has been released must be promptly informed that the report was made unless doing so would place the individual at risk of serious harm.
5. Judicial Proceedings: Personally‐Identifiable Information may be disclosed in response to a court order.
6. Law Enforcement: Personally‐Identifiable Information may be disclosed for the following law enforcement purposes and under the specified conditions:
a. Pursuant to court order or as otherwise required by law, i.e. laws requiring the reporting of certain types of wounds or injuries b. Decedent's Personally‐Identifiable Information may be disclosed to alert law enforcement to the death if entity suspects that death resulted from criminal conduct
7. Serious Threats to Health or Safety: Consistent with applicable law and ethical standards, Personally‐Identifiable Information may be used or disclosed if the entity believes in good faith that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to a person or the public, and disclosure is to someone reasonably able to prevent or lessen the threat, or the disclosure is to law enforcement authorities to identify or apprehend an individual who has admitted to violent criminal activity that likely caused serious harm to the victim or who appears to have escaped from lawful custody. Disclosures of admitted participation in a violent crime are limited to the individual's statement of participation and are not permitted when the information is learned in the course of treatment to affect the propensity to commit the subject crime, or through counseling, or therapy or a request to initiate the same.
8. Specialized Government Functions: National Security and Intelligence:
Personally‐Identifiable Information may be disclosed to authorized federal officials for the conduct of lawful intelligence, counter‐intelligence, and other activities authorized by the National Security Act.(45 CFR 164.512(k)(2))
9. Protective Services: Personally‐Identifiable Information may be disclosed to authorized federal officials for the provision of protective services to the President, foreign heads of state, and others designated by law, and for the conduct of criminal investigations of threats against such persons. (45 CFR 164.512(k)(3));
10. Public Benefits: Personally‐Identifiable Information relevant to administration of a government program providing public benefits may be disclosed to another governmental program providing public benefits serving the same or similar populations as necessary to coordinate program functions or improve administration and management of program functions.
Rev.2015.8.25
18 11. Workers' Compensation: Personally‐Identifiable Information may be disclosed as authorized and to the extent necessary to comply with laws relating to workers' compensation and other similar programs.
F. Procedures
The following procedures will be implemented to ensure that this policy is enforced effectively across all parts of Virtru.
Any request for disclosure of Personally‐Identifiable Information, 1) pursuant to a court order, warrant or subpoena; 2) by a law enforcement agent; 3) by a public health authority; or 4) by a national security, intelligence or other federal company, must be directed to the Privacy Officer and the CEO for review and action. Any such request will include an acknowledgement of receipt to insure that the document was actually received by the appropriate corporate individual and will retain a copy of the request. If the acknowledgement is not received within two working days of submitting to the appropriate corporate individual, then the request will be resubmitted to the Privacy Officer and CEO.
G. Enforcement
An employee found to have violated this policy shall be subject to disciplinary action, up to and including termination of employment. In the case where inappropriate access, use or disclosure of Personally‐Identifiable Information was or may have been involved, such individuals may additionally be reported to the appropriate enforcement agencies.
VIII. Complaint Process
A. Overview
The Privacy Rules require that Virtruprovide a process for individuals to make complaints concerning the Company's policies and procedures required by these regulations and document all complaints received, and the dispositions of these complaints, if any.
B. Purpose
To issue instructions regarding Virtruobligations relating to the Privacy Rules to provide a process for individuals to complain about the Company’s policies and procedures and the requirement to document complaints received and the disposition of these complaints.
C. Applicability
This policy applies to all Virtruemployees, which is defined for the purposes of this document to be employees of all current and future subsidiaries of Virtru.
Rev.2015.8.25
19 D. Policy
Virtrushall maintain a process to receive complaints from individuals about Company Privacy Policies and Procedures, for complaints from individuals who believe their privacy rights have been violated and from employees or Business Associate Subcontractors who believe that Virtruis not abiding by its policies and procedures and/or assurances concerning Personally‐Identifiable Information. This process shall include the following:
1. Any complaints or questions should be submitted to the Privacy Officer or his assistant.
2. All service and complaint issues will be stored in the Desk.com app.
Virtrushall work in good faith to resolve complaints received to the satisfaction of the submitter, where possible.
E. Procedures
The following procedures will be implemented to ensure that this policy is enforced effectively across all parts of Virtru.
1. Complaints shall be submitted in writing on paper or electronically.
2. Complaints shall be entered into the complaint tracking system either automatically or by the individual designated to provide information on the Companycomplaint process. and when manually entered shall be in the exact words provided by the submitter.
3. The VirtruPrivacy Officer shall investigate complaints and make a determination as to whether or not the complaint has merit.
4. The VirtruPrivacy Officer shall present complaints received to Virtru’s senior executive for immediate action.
5. If the Privacy Officer has completed the investigation of the complaint and made a determination, such determination shall be presented to the Virtru Executive Board
6. If the investigation has not been completed nor a provisional determination made by the Privacy Officer, it shall be the prerogative of the senior executive to make a summary determination or to direct the Privacy Officer to continue with the investigation and to report on the complaint at the next scheduled meeting.
If a determination is made that Virtruis in violation of the privacy provisions of the Privacy Rules or that changes are needed in the Privacy Policies or Business Associate Agreement to clarify the allowed practices of Virtru, the VirtruCEO and Privacy Officer shall determine the actions that the Companyshall take.
Rev.2015.8.25
20 Complaint determinations and actions that Virtrutakes pursuant to such complaints, if any, shall be reported to the submitter of the complaint, if such person is known.
Privacy Officer, or his designated agent, shall update the complaint tracking system with the findings of the Privacy Officer’s investigation, any determination made, direction or actions of the VirtruCEO and Privacy Officer with regard to the complaint, and a copy of any information provided to the submitter in response to their complaint.
F. Enforcement
Any employee found to have violated this policy shall be subject to disciplinary action, up to and including termination of employment. In the case where inappropriate access, use or disclosure of Personally‐Identifiable Information was or may have been involved, such individuals may additionally be reported to the appropriate enforcement agencies.
IX. Fax Policy
A. Overview
The Privacy Rules require that Virtruimplement appropriate administrative, technical, and physical safeguards to protect the privacy of Personally‐Identifiable Information.
B. Purpose
To provide instructions to all Virtruemployees regarding the use of faxes with respect to Personally‐Identifiable Information and the measures necessary to maintain an adequate level of security for such information. This policy defines rules necessary to achieve this level of protection. These standards are designed to minimize the potential exposure to Virtrufrom damages, which may result from unauthorized disclosure of Personally‐ Identifiable Information through facsimile use.
C. Applicability
This policy applies to all Virtruemployees, which is defined for the purposes of this document to be employees of all current and future subsidiaries of Virtru.
D. Special Definitions
Fax: An electronic facsimile of a document stored as a series of zeroes and ones (binary data) that can be transmitted like normal computer data. When received by a fax machine, the incoming stream is translated into dots creating a representation of the original document.
Inappropriate Disclosure: The intentional or unintentional revealing of Personally‐Identifiable Information to people who do not have a need to know such information.
Rev.2015.8.25
21 E. Corporate Policies
Employees must exercise utmost caution when sending faxes to parties outside of Virtru.
Faxes containing Personally‐Identifiable Information should only be received on and sent to user or departmental specific fax machines and not to systems that have general access.
In cases where Personally‐Identifiable Information is received from outside on a non‐ departmental specific fax machine, the receiving department shall notify the Virtru Privacy Officer of the source of such information. The employee shall communicate the approved fax number to the external entity and record such actions. Should PHI be disclosed by fax to an inappropriate party, Virtrushall, to the extent possible, remediate such disclosures.
All fax documents sent by Virtruemployees shall contain the following statement:
This fax is intended for the individual/individuals or entity/entities named above and may be covered by copyrights, business partner confidentiality agreements, non‐disclosures or other legally binding instruments. If you are not the intended recipient, do not read, copy, use or disclose the contents of this communication to others. Immediately notify the sender by reply fax, destroy all hard copies and delete this document from all systems. Thank you! F. Procedure
In the cases where data that contains Personally‐Identifiable Information is disclosed by fax machine use to an inappropriate party, the following procedure shall be followed:
1. The receiving party shall be contacted by telephone at the earliest opportunity and requested to destroy the fax without reading.
2. The name of the company, the person contacted, the date and time shall be recorded as well as any comments made by the person receiving such calls.
3. A fax shall also be sent to the receiving party containing the same instructions as detailed for the phone call requesting a return fax message indicating that the requested action was taken.
4. The cause of the inappropriate disclosure shall be determined and reported to the VirtruPrivacy Officer.
Methods to prevent a reoccurrence of the inappropriate disclosure shall be formulated and put into place.
Any additional actions prescribed by regulations shall be performed to the extent possible.
G. Enforcement
Any employee found to have violated this policy shall be subject to disciplinary action, up to and including termination of employment. In the case where inappropriate access, use Rev.2015.8.25
22 or disclosure of Personally‐Identifiable Information was or may have been involved, such individuals may additionally be reported to the appropriate enforcement agencies.
X. Scanner Policy
A. Overview
The Privacy Rules require that Virtruimplement appropriate administrative, technical, and physical safeguards to protect the privacy of Personally‐Identifiable Information.
B. Purpose
To provide instructions to all Virtruemployees regarding the use of scanners with respect to Personally‐Identifiable Information and the measures necessary to maintain an adequate level of security for such information. This policy defines rules necessary to achieve this level of protection. These standards are designed to minimize the potential exposure to Virtrufrom damages, which may result from unauthorized disclosure of Personally‐Identifiable Information.
C. Applicability
This policy applies to all Virtruemployees, which is defined for the purposes of this document to be employees of all current and future subsidiaries of Virtru.
D. Special Definitions
Scanner: An electronic copy of a document stored as a series of zeroes and ones (binary data) that can be transmitted like normal computer data. When received by a computer, the incoming stream is translated into dots creating a representation of the original document.
Inappropriate Disclosure: The intentional or unintentional revealing of Personally‐Identifiable Information to people who do not have a need to know such information.
E. Corporate Policies
Employees must exercise utmost caution when scanning and transmitting these documents to their devices and parties outside of Virtru. Scans containing Personally‐Identifiable Information should only be received on and sent to user or departmental specific computer in an encrypted format, or sent using Virtru’sencrypted email application.
F. Procedure
In the case where scanned data that contains Personally‐Identifiable Information is disclosed to an inappropriate party, the following procedure shall be followed:
1. The receiving party shall be contacted by telephone at the earliest opportunity and requested to destroy the scan without reading.
Rev.2015.8.25
23 2. The name of the company, the person contacted, the date and time shall be recorded as well as any comments made by the person receiving such calls.
3. The cause of the inappropriate disclosure shall be determined and reported to the VirtruPrivacy Officer.
Methods to prevent a reoccurrence of the inappropriate disclosure shall be formulated and put into place. Any additional actions prescribed by regulations shall be performed to the extent possible.
G. Enforcement
Any employee found to have violated this policy shall be subject to disciplinary action, up to and including termination of employment. In the case where inappropriate access, use or disclosure of Personally‐Identifiable Information was or may have been involved, such individuals may additionally be reported to the appropriate enforcement agencies.
XI. Training Policy
A. Overview
The Privacy Rules require that Virtrutrain their employees on the requirements of our Privacy Policies and Procedures developed to protect the Personally‐Identifiable Information to which employees are provided access. The Companyhas determined that all employees of Virtrushall be trained on Privacy so that we can provide the necessary assurances for the protection of Personally‐Identifiable Information to our clients, vendors and business partners as required under the Privacy Rules.
B. Purpose:
To provide instructions to all Virtruemployees regarding the requirement for HIPAA training.
C. Applicability
This policy applies to all Virtruemployees, which is defined for the purposes of this document to be employees of all current and future subsidiaries of Virtru.
D. Policy
1. General: It is the policy of the Companythat all employees of Virtruand its current and future subsidiaries be trained on Privacy and the Company policies and procedures created to protect Personally‐Identifiable Information.
2. Duty Specific Training: Privacy training shall be appropriate to the tasks that each employee performs. In the case where an employee does not come into contact with Personally‐Identifiable Information as a normal course of the employee’s duties, the employee shall be trained on the corporate policies and procedures.
Rev.2015.8.25
24 3. New Employees: New employees shall be trained on the corporate policies and procedures as part of their normal employment process and shall be trained on our Privacy Policies and Procedures, if applicable, within 30 days of being employed by Virtru. The Assistant ISO, Jordan Duggan, shall document this training and provide the Privacy Officer with documentation of this training within the 30‐day period.
4. Transfers: When an employee transfers from one department to another, the employee shall be trained on our Privacy Policies and Procedures within 30 days of being assigned. Jordan Duggan shall document this training and provide the Privacy Officer with documentation of this training, within the 30‐day period.
5. Material Change in Policies and Procedures: when a material change in the policies and procedures occurs, each employee shall receive training on such changes within 30 days of the implementation of the change. Jordan Duggan shall document this training and provide the Privacy Officer with documentation of this training, within the 30‐day period.
E. Enforcement
Any employee found to have violated this policy shall be subject to disciplinary action, up to and including termination of employment. In the case where inappropriate access, use or disclosure of Personally‐Identifiable Information was or may have been involved, such individuals may additionally be reported to the appropriate enforcement agencies.
Rev.2015.8.25
25 Security Policies and Procedures
{After choosing where you will store your Security Documents, delete either the Libraryor {Notebook} option throughout this document.}
Revision History
Virtru’s Security Policies and Procedures were adopted as of [Date].
Name
Virtru’s Security Policies and Procedures were modified as of [Date].
Name
Virtru’s Security Policies and Procedures were modified as of [Date].
Name
Virtru’s Security Policies and Procedures were modified as of [Date].
Name
Virtru’s Security Policies and Procedures were modified as of [Date].
Name
Virtru’s Security Policies and Procedures were modified as of [Date].
Name
Rev.2015.8.6
1 Security Policies and Procedures
Table of Contents
Virtru
Document control
B. Security Document Library
II. Preface and Background Material
Overview
B. Policy
III. Key Concepts
Information Security Principles
Confidentiality
Integrity
Availability
Provability
Definitions
Information Security Policy
Privacy Policy
Acceptable Use Policy for IT Systems Users
Employment Policies
IV. Using These Standards
Audience – Who will use this document
Technology and business process providers should comply with these Standards as a matter of contractual obligation
Employees and Business units within Virtru should comply, unless a Risk Assessment has been done and a deviation is approved by the ISO
How the document is used
Review of existing controls, procedures and tools against the Standards Documenting compliance or deviations
Gap Analysis to determine where improvements are needed A Risk Assessment to validate that the improvements are justified against the costs of the controls and the value of the information involved Creation of a plan to close the gaps OR signoff of a deviation Documentation of the new controls, procedures and tools C. Maintaining this document
V. Roles and Responsibilities
A. Rules for ownership of information
B. Information users
C. Information Security Officer
Manage awareness programs relating to security and privacy topics Maintain a central record of exceptions to this Standards document Manage changes to this Standards document
Rev.2015.8.6
2 Security Policies and Procedures
Provide leadership relating to new security risks, controls and technologies Oversee and approve the sharing and reuse of Personal Identifiable Information (PII) collected by or processed by the company
VI. Information Classifications and Requirements
Overview
B. The Security classification process
IT platforms such as servers and workstations
IT applications including database transaction processing and email Data sets
Paper copies of information
Information types typically known to workforce members, such as customer information
Development, acquisition or deployment of software
Connections of computers or networks to outside systems or networks Granting of access to any outside organizations
C. The classes of information for Security and Privacy
Data Types
Company‐owned data that relates to such areas as corporate financials, employment records, payroll, etc.
Setting requirements for business continuity
Required uptime for the information asset
Required restoration time if the data must be restored
Required frequency of backups
Requirements for storage of backups
Requirements for testing of the recovery process
Enforcement
VII. Handling Rules for the Information Classifications Overview
Inventory of Information Assets and Electronic Asset Management Log Rules for access to information assets
VIII. Access Control Policy
Overview
Access levels
Granting access
The ISO will provide accounts with the matching technical privileges and give the workforce member the account information including a one‐time‐use password that the user must change to a private password upon first use of the account.
1. Only the person assigned to an account will be allowed to use that account.
Vendors, contractors and other outsiders
Individuals
Policy
Rev.2015.8.6
3 Security Policies and Procedures
IX. Rules by Data Classification
Public/unclassified data
B. Private/internal data
C. Confidential or protected data
D. Managing data sources
E. Retention of media
Agent of Record letters and Letters of Authorization requests are held for no less than ninety (90) days
New Business Group documents are held for no less than ninety (90) days General documents are held for no less than ninety (90) days Banking statements are held for seven (7) years
Workforce member records are held for seven (7) years
F. Sanitization of Media
G. Information sharing and privacy
H. Release of company information
X. Risk Analysis and Management
Risk reviews
B. Risk management
Increasing a protection to a level higher than what is listed in this document Improving oversight or monitoring of the risk to limit impact and minimize response time
Limiting transactions or other events to minimize the possible impact of the risk event
XI. IDs and Accounts
User IDs
B. ID and account creation
Expiration dates for the User ID
Renewal process for the User ID
Documentation of the role, business process and job function relating to the User ID C. Account management
Application Specific IDs
XII. Authentication and Passwords
Overview
Password format
Rules
XIII. Authorization and Rights Management
General Access Roles
Super Admin Access: Access to all front and backend products as well as product metrics
Admin Access: Access to all front end products as well as product metrics General Access: Access to product metrics
Rev.2015.8.6
4 Security Policies and Procedures
Low Access: Access to corporate email, sales, and marketing data only Amazon Web Services (AWS)
Cloudant
Github
ELK Stack
Mixpanel
Kissmetrics
Salesforce
Access Rules
Limiting access to datasets and types
Limiting access to operating systems
Limiting times of access
Temporary Privileged Users and Accounts
D. Assignment and Revocation Procedure
An Employee Access Log for all new hires and/or workforce member change of status.
An Exit Checklist for all terminations.
E. Logout After Inactivity
XIV. Breaches or Impermissible Uses/Disclosures
Definitions
Penetrations of systems, applications, networks or databases Denial of service attacks
Misuse or mishandling of assets
Virus or other malware contamination
Transaction errors
Breaches of confidentiality agreements or contracts
Legal or regulatory violations
XV. Breach Response
A. Overview
Confidential Reporting:
Calling (may leave voice message) the ISO or AISO
Sending an email to the ISO or AISO, or;
XVI. Personnel Security
Screening for newly hired personnel, third parties, vendors Professional qualifications
Identity checks
Criminal checks
Confirmation of academic and professional experience
B. Training and Awareness
Managing malicious software (e.g. viruses)
Using workstation(s) securely
Rev.2015.8.6
5 Security Policies and Procedures
Managing passwords and
Monitoring and reporting suspicious use of account(s)
C. Terms of employment
D. Acknowledgement
E. Exit process for users
Relinquish all access to control devices
Report all User IDs in use by the person
Relinquish all information stored, whether on paper or on backup media Relinquish all information processing devices, including workstations, all Virtru‐owned mobile devices and others
All systems access will be revoked.
Security Sanction Policy
First Security Infraction
A simple infraction, and
The first infraction in the last 3 years
Second Security Infraction or First Serious Infraction
A serious infraction, or
The second infraction of either type within 3 years
Third Security Infraction or Second Serious Infraction
A second serious infraction within 3 years, or
A third infraction of any type within 3 years
The sanction will be dismissal from the workforce.
XVII. Legal and Regulatory Issues
Legal processes
Copyrights and licenses
C. Export controls
XVIII. Malware and Antivirus
Definitions
Operating system anti‐malware requirements
Macintosh, Linux and iPhones:
PC Operating Systems:
Android and Windows Phone Operating Systems:
Affiliates
Infected devices
Employees’ Requirements
Workforce members will not load software on our Company’s information equipment without permission from the ISO.
Workforce members will not open electronic files from unfamiliar sources.
Enforcement
XIX. Change Control Logs
Preface
Rev.2015.8.6
6 Security Policies and Procedures
B. Policy
Sufficient information is available for proper investigation of use, misuse, incidents and performance
User ID, event type, date and time are maintained
Time is according to a known time stamp so that events across systems can be coordinated
4. End‐to‐end accountability is always maintained
Changes to operating systems, application code or other tools Backup and restore events
Changes affecting any cryptographic keys or devices
Stop or start of critical processes
Transaction failure, retry or duplication
KissMetrics
Segment.io
Sendgrid
XX. Encryption
Preface
Application Encryption Policy
Key Rotation Policy
D. Device Encryption Policy
Mac OS Devices:
Windows OS Devices:
Linux OS Devices
Android Devices
Windows Phone
iPhone
E. Wi‐Fi network encryption
F. Email encryption
G. Enforcement
XXI. Assessments and Testing
Overview
B. Penetration testing
Operating systems
Applications
Databases
C. Vulnerability assessment testing
A new system, application or network is installed inside the Company Changes are made to firewalls, VPNs or other security control tools Changes are made to a web server’s operating system
Changes are made to email servers
Configuration changes are made to databases
Rev.2015.8.6
7 Security Policies and Procedures
Configuration changes are made to critical applications Changes are made to encryption scheme(s)
D. Wireless access testing
E. Password testing
XXII. Use of Email, Internet, Messaging, Public Sites, Blogs, Social Media Policy
Sexually explicit material
Confidential, Private or Protected Information or Internal Use material, except as meets the Handling Rules section
Viruses
Threats
Inappropriate or unlawful language, including:
Offensive language
Language inappropriate for the Company environment
Discriminatory or harassing language
Tools usable for hacking, password cracking, vulnerability scanning or penetration testing
XXIII. Hardware
Definitions
B. Policy
C. Asset management
D. Enforcement
XXIV. Networks
Overview
Denial of service attacks
Improper access
Virus infections
Unauthorized software installations, email, FTP or other improper usage Administration of network and communications connections Operations of all devices
Monitoring
Timely review of audit logs and response to alerts or alarms Review of unusual patterns of usage or activity
Monitoring
Access control and physical security
Access limited to authorized personnel only
Physical security, including RFID or passcode controlled locks, are in place Modifications, updates
Documentation
Network design
Segmentation
Rev.2015.8.6
8 Security Policies and Procedures
Firewalls
Internet
Approved by the ISO
Periodically reviewed and tested for vulnerabilities
Protected by firewalls, intrusion detection systems and anti‐malware tools VPN‐remote access
Wireless
Telework Policy
Patching of systems and applications
Network hardening
XXV. Physical and Environmental Protections
Definitions
Computing centers
Network connection points
Media storage locations
Locations containing platforms which carry high‐value or critical information or transactions
B. Secure Sites Policy
Media libraries
Electrical supplies and controls
Environmental and mechanical controls
XXVI. Physical Security Policy
A. Entry Policy
Loss of RFID key
Mobile devices
D. Video monitoring
Alarm system
Fire protection
XXVII. Software
Overview
B. Acquisition of software
C. Open Source Software
It is not used in a production environment OR
Prior to use it is fully tested, documented and Virtru’s personnel are assigned to support it. Checks to be performed include:
The source of the software is documented
URL
Project lead
Contributors
The ISO approves of the use
D. Documentation
Rev.2015.8.6
9 Security Policies and Procedures
E. Change control and maintenance
F. Operating Systems
G. Applications
Access control
Authorization
Information classification
Storage controls
Backup and restoration
Confidentiality and integrity requirements
Audit logs
Privacy, export control and other such requirements
H. Asset management for software
I. Enforcement
XXVIII. Removable Media Device Policy
Purpose
B. Scope
C. Definitions
D. Policy
E. Using Removable Media Devices
F. Exceptions
G. Refusal
H. Enforcement
Application Recovery Plan
Overview
Scope
Data durability and reliability
Encryption
Load balancing
Restoration of data
G. Testing and revision of plan
Network Attached Storage and Workstation Backup Plan
Overview
Policy
Backup software
Remote backups
Local backups
Encryption of backups
Restoring data
H. Enforcement
Information Integrity Management Policy
Overview
Rev.2015.8.6
10 Security Policies and Procedures
B. Policy
Security Incident Management Policy
Overview
Procedures
C. Policy
Security Plan Review Policy
Overview
Procedures
Appendices
Change Logs
B. Information Security Committee
Rev.2015.8.6
11 Security Policies and Procedures
I. Virtru
Virtrumay be referred to as “Company.”
A. Document control
A staff copy of this document is available with the Information Security Officer (ISO), Will Ackerly, [email protected] (202) 577‐3683, and Assistant Information Security Officer(AISO), Jordan Duggan, [email protected] (202) 577‐3683.
B. Security Document Library
These policies and procedures and related security practice information will be kept in our Security Documentation Library(SDL). The SDLis located in google drive and backup to the Synology NAS.
Documentation about security practices (logs of activities, etc.) will either be kept in this SDL (or Notebook) or in a short file in the SDL that will describe where the security practice documentation resides. The intended result is that anyone with access to the SDL will be able to locate any piece of documentation associated with our security program.
Outdated and superseded materials from the SDL will be kept in an archive (the Security Documentation Archive) for at least seven (7) years after the date when they are first outdated or superseded.
II. Preface and Background Material
A. Overview
It is vital to the reputation and profitability of Virtruthat our information and our clients' information, in all forms, be protected from unauthorized use, modification, loss, copying, etc. This document sets out the default standards, which must be met to ensure that control.
Our information may exist on paper, in voice systems, on IT systems and networks, in the minds of our people, and in other forms. The information which needs protection includes, but is not limited to:
1. Client information (both for customer companies and for people as individuals)
2. Financial information, including credit cards, salaries, banking, transactions and more
3. Medical information of all types
4. Companypatents, business plans and other intellectual property Rev.2015.8.6
12 Security Policies and Procedures
5. Companybusiness records and planning materials, including our customer list, marketing and sales efforts, product line plans and more
6. Copyrighted materials, both which our Companycreates and those which we obtain under license from others
B. Policy
Compliance with these standards is mandatory. Any deviation from these standards must be approved beforehand by the ISO.
III. Key Concepts
A. Information Security Principles
The protection of information can be described in several key dimensions:
1. Confidentiality
2. Integrity
3. Availability
4. Provability
In this document, the standards given are the Companydefaults. They must be applied where appropriate, but always balanced against the cost of implementing the control, and the value of the information involved.
B. Definitions
To prevent confusion, these are the definitions used throughout this document.
Policies: Corporate documents which set out Virtru’sposition regarding business processes, behavior of personnel and similar topics. Policies are a high‐level statement of Virtru’sposition. Some of Virtru’spolicies, which relate to information security are:
1. Information Security Policy
2. Privacy Policy
3. Acceptable Use Policy for IT Systems Users
4. Employment Policies
Standards: Rules that must be followed to enable an effective information security program. Compliance with the Standards is mandatory, but deviation is possible if approved by the ISO.
Standards define the minimum baseline procedures, practices and configurations for systems, applications, controls, networks and related topics. Standards are designed to provide a single reference point for use during software development and adoption, Rev.2015.8.6
13 Security Policies and Procedures
installation of systems and tools, and during the contracts process with vendors and service providers. Standards do not, however, give detailed command‐line instructions on how to meet the Virtru’s policies. Those are given in the guidelines.
Guidelines: Built for each application and platform; to be followed when implementing that particular tool. A Guideline may vary a bit from one implementation to another, as long as the Security Standards are met and justification is given and properly documented.
Combined, these three levels of documents provide a method for Virtruto audit itself and ensure proper controls are in place, without excess cost or risk. They also provide a means for Virtruto explain to regulators, examiners, external auditors or investors how our Companyis safe, trustworthy and efficient.
IV. Using These Standards
A. Audience – Who will use this document
This document applies to Virtru’semployees, business units and any Business Associate Subcontractor supporting Virtru:
1. Technology and business process providers should comply with these Standards as a matter of contractual obligation
2. Employees and Business units within Virtru should comply, unless a Risk Assessment has been done and a deviation is approved by the ISO
B. How the document is used
This Standards document is a reference point to ensure a consistent framework of protections is in place. Implementing these standards involves:
1. Review of existing controls, procedures and tools against the Standards
2. Documenting compliance or deviations
3. Gap Analysis to determine where improvements are needed
4. A Risk Assessment to validate that the improvements are justified against the costs of the controls and the value of the information involved
5. Creation of a plan to close the gaps OR signoff of a deviation
6. Documentation of the new controls, procedures and tools No signoff or approvals are needed if a level of protection higher than what is given in this Standard is determined to be needed for a given information asset.
Rev.2015.8.6
14 Security Policies and Procedures
C. Maintaining this document
This document must be reviewed at least once a year or anytime there are significant changes in software or security. Updates must be made to keep it in accord with Virtru’s overall business goals and risk position. The document will be reviewed by the ISO or AISO. Any updates, improvements or suggestions should be sent to the ISO.
V. Roles and Responsibilities
A. Rules for ownership of information
The information and systems provided by Virtruto workforce members, contractors and representatives are owned by Virtru, which also determines appropriate usage and access rules. All data on Virtru’ssystems and networks is owned by Virtru, with the exception of software that the ISO has approved to be open sourced or otherwise transferred to another entity through code escrow or code exchange and/or trade.
In this document, the words ‘information owner’ refer to the person who owns the responsibility for the information. The information itself remains the property of Virtru.
B. Information users
Every user of Virtru’sinformation must protect that information and ensure that it is used for Virtru’sbusiness purposes only. Any incidents or questionable issues in the security of our information must be reported to the ISO or AISO.
Information users may not assign access rights, authorize destruction or copying of information, or change the protections given to information assets. Information users must comply with all laws, regulations and Virtru’spolicies and procedures.
C. Information Security Officer
Virtru’sISO and AISO will:
1. Manage awareness programs relating to security and privacy topics
2. Maintain a central record of exceptions to this Standards document
3. Manage changes to this Standards document
4. Provide leadership relating to new security risks, controls and technologies
5. Oversee and approve the sharing and reuse of Personal Identifiable Information (PII) collected by or processed by the company See Appendices for further information and Information Security Committee for a current listing of members.
Rev.2015.8.6
15 Security Policies and Procedures
VI. Information Classifications and Requirements
A. Overview
Information is classified by system to ensure that the controls applied to it are sufficient and also to ensure that the controls applied do not impair Virtru’sbusiness, ability to compete or Virtru’simage.
All information must have a classification for security and must have requirements set for business continuity.
B. The Security classification process
Each information asset will go through the following classification process. Information assets include, but are not limited to:
1. IT platforms such as servers and workstations
2. IT applications including database transaction processing and email
3. Data sets
4. Paper copies of information
5. Information types typically known to workforce members, such as customer information
In general, an information asset includes both the raw information itself (paper, oral or data entry), the location where it resides, the business processes which handle it and the systems and tools that handle it.
Information assets will also be reviewed during:
1. Development, acquisition or deployment of software
2. Connections of computers or networks to outside systems or networks
3. Granting of access to any outside organizations
The security classification of an information asset is assigned according to the highest of these dimensions. As an example, if an asset is regulated by law, then it needs the highest classification, even if the asset is not critical to the Company’s business.
C. The classes of information for Security and Privacy
This policy applies to all workforce members, management, contractors, vendors, business partners and any other parties who have access to Company or client data.
Rev.2015.8.6
16 Security Policies and Procedures
Data Types
The security classification of an information asset is assigned according to the highest of these dimensions. As an example, if an asset is regulated by law, then it needs the highest classification, even if the asset is not critical to Virtru’sbusiness. Virtrudeals with two main kinds of data:
1. Companyowned datathat relates to such areas as corporate financials, employment records, payroll, etc.
2. Personally Identifiable Information (PII) that is the property of our clients or workforce members, such as Protected Health Information, social security numbers, credit card information, contact information, etc.
D. Setting requirements for business continuity
The requirements for an information asset relating to business continuity are not set by classification, but are specific to that asset. They include:
1. Required uptime for the information asset
2. Required restoration time if the data must be restored
3. Required frequency of backups
4. Requirements for storage of backups
5. Requirements for testing of the recovery process
The default requirements for business continuity are listed in the information handling rules’ section. See Handling rules for the information classifications in this document and Disaster Recovery Plan for detailed information.
This section outlines the basic rules for handling information types according to the classifications. More specific standards for platforms, processes and networks appear in each topic section of this standards document.
E. Enforcement
It is the responsibility of everyone who works at Virtruto protect our data. Even unintentional abuse of classified data will be considered punishable in accordance with the extent and frequency of the abuse.
Rev.2015.8.6
17 Security Policies and Procedures
VII. Handling Rules for the Information Classifications A. Overview
This section outlines the basic rules for handling information types according to the classifications. More specific standards for platforms, processes and networks appear in each topic section of this standards document.
B. Inventory of Information Assets and Electronic Asset Management Log An inventory is maintained of all significant information assets belonging to, or used by Virtru. This inventory includes:
1. Serial numbers/license numbers
2. MAC Addresses
3. Model
4. Device Type
5. Manufacturer
6. The information owner
7. Username
8. Location
9. OS Version
10. The custodian of the information and repository location (database, file cabinet, etc.)
11. Purpose in our systems
12. Asset value in dollars or other suitable measurement
13. The sensitivity of the asset, due to regulations, laws, customer expectations or other requirements
14. Requirements for the asset regarding availability, uptime, etc.
15. Contact information for one or more parties who can repair, restore, replace, or recover this asset. Examples are hardware/software vendors, IT support vendors, and/or staff members
This asset list contains information that is restricted to executives and super‐admins, and therefore is stored securely on the Synology NAS, which itself is backed up to AWS Glacier.
This inventory will be reviewed and updated quarterly, or as new assets and devices are added. Logs are maintained as the Inventory of Information Assets Log and the Rev.2015.8.6
18 Security Policies and Procedures
Organizational Chart/Electronic Asset Management Log. A current copy of this inventory will be kept at a separate location as described in our Disaster Recovery Plan.
C. Rules for access to information assets
If any given security incident involves a breach of Personally Identifiable Information (PII), the ISO will follow our security policies and Incident and Breach Policy for handling such a breach.
If a security incident includes the potential that personal information may have been obtained by unauthorized individuals, the ISO will work with the client to notify affected persons of this event, in compliance with relevant federal and/or state law.
See also Breaches or Impermissible Uses/Disclosures within these Security Policies and Procedures.
VIII. Access Control Policy
A. Overview
This policy defines how Virtrumanages access to electronic information and systems.
Virtruprovides access to electronic data relative to the workforce member’s job requirement. We limit access to categories of data and systems that each person needs to do his/her job. We require that each workforce member restrict his/her access to only those specific records and functions needed to carry out his/her job. For the purposes of this policy workforce members are anyone in Virtruwho has access to Personally Identifiable Information (PII).
B. Access levels
The ISO will qualify the workforce member to have one of these forms of access based on the job role (in order of increasing access permissiveness):
1. Low Access to Corporate Email and Salesforce Data
2. General Access to product metrics
3. Admin Access to all front end products as well as product metrics
4. Super Admin Access to all front and backend products as well as product metrics The access will match the person’s job responsibilities The ISO will keep a record of the type of access provided to each workforce member. The record will include a date and justification and will be kept in our Employee Access Request Log in the Security Documentation Library.
Rev.2015.8.6
19 Security Policies and Procedures
The granting of access to Business Associate Subcontractors will be done in the same way as it is done for workforce members.
C. Granting access
The ISO will provide accounts with the matching technical privileges and give the workforce member the account information including a one‐time‐use password that the user must change to a private password upon first use of the account.
1. Only the person assigned to an account will be allowed to use that account.
2. Each time a user logs in to a system, a log will be maintained by that specific program with the following information
a) When the user accessed the system
b) What information the user accessed while in the program c) Tracking will be done by using the User ID and IP Address d) The ISO will maintain this log for a period of 1 year
3. The ISO and AISO will each have a special account that allows them to create new accounts. The accounts will be used:
a) In an emergency when all other accounts have been disabled or locked out; b) To either reset the passwords on locked accounts; or c) To create new accounts that provide needed access.
4. When a change in the role of a workforce member requires a change in access privileges, the ISO will reassess the needs and provide new access privileges based on the policy in Access Levels in this section.
a) If a workforce member leaves Virtru, the ISO will remove that member’s access as soon as the access is no longer needed.
b) If a workforce member takes a leave of absence and is not expected to require access, the ISO will disable the workforce member’s account when he/she leaves and re‐enable it upon his/her return to work. c) For other people who work around protected electronic information but are not qualified to access it, the ISO will decide which of the following two steps to take:
1) Train the person to understand his/her responsibilities 2) Supervise while he/she is exposed to the data
d) For cases in which the provision of individual accounts is not feasible {e.g. access by any one person of a large help desk staff of a vendor}, the ISO will make:
1) A serially reusable account and provide a one‐time‐use password to the vendor’s representative for each time that access is needed; and
Rev.2015.8.6
20 Security Policies and Procedures
2) The password will be changed by the ISO on the account after each use of the account to a value not known to the vendor.
D. Vendors, contractors and other outsiders
Any outside organization that wishes to gain access to our or our client’s Private/Internal, Confidential or Protected information must:
1. Sign a Business Associate Subcontractor Agreement; AND
2. Be willing and able to show that their privacy and security controls are at least as stringent as Virtru’scontrols.
See Business Associate Subcontractor Agreement for details of Agreement.
A written history of incidents reported by Business Associate Subcontractors (BAS) will be maintained. If the ISO becomes aware of a pattern of activity in which the BAS is not carrying out the contractually required safeguards, then the ISO will do one of the following:
1. Attempt to remedy this failure
2. Terminate the contract, if attempt to remedy is not feasible
3. Report the situation to the U.S. Secretary of Health and Human Services, if terminating the contract is not feasible.
If any given security incident involves a breach of Personally Identifiable Information, the ISO will follow our privacy policies and incident management plan for handling such a breach.
If a security incident reported by a BAS includes the potential that personal information may have been obtained by unauthorized individuals, the ISO will work with the BAS to notify affected persons of this event in compliance with relevant federal and/or state law.
See also Breaches or Impermissible Uses/Disclosures within these Security Policies and Procedures.
E. Individuals
Individual persons who work for such an organization must also be bound to the outside organization’s controls. Such individuals must:
1. Have Business Associates Subcontractor Agreement with their own company; OR
2. Have a contract with their company; AND
3. Have appropriate background checks and bonding in place.
Rev.2015.8.6
21 Security Policies and Procedures
F. Policy
Virtruwill not knowingly accept any confidential information belonging to third parties until that information is reviewed against our protections and the appropriate agreements put into place and signed by the information owner. The agreements should include all requirements for controls over the third‐party information and the processes to be followed.
IX. Rules by Data Classification
A. Public/unclassified data
This type of information does not require special marking or storage, except to ensure that it is available when needed. It does need to be kept safe from unauthorized modification.
B. Private/internal data
Access is granted on a need‐to‐know basis, as authorized by the manager of the user of the information. Some types of jobs are automatically granted access to data in this class.
Paper products and backup media containing this type of information must be stored and handled in a secure manner. This includes:
1. Printing this class of information only to a known printers located in secure areas on secure networks.
2. Encrypting or physically securing backup media
3. Keeping paper copies of information locked or otherwise secured This class of information is not released to anyone outside Virtruwithout a non‐disclosure agreement, a Business Associate Subcontractor Agreement, and/or without the approval of the information owner. Private/Internal use information must not be transmitted across any unsecured outside network or path without proper controls. This means encryption for files and emails or secured packaging for paper copies.
C. Confidential or protected data
Access to this type of information is on a need‐to‐know basis, as approved by the ISO or information owner.
This class of information is not released to anyone outside the Company without a non‐disclosure agreement and without the approval of the information owner.
Rev.2015.8.6
22 Security Policies and Procedures
Confidential or Protected information must not be transmitted across any unsecured outside network or path without proper controls. This means encryption for files and emails, or secured packaging for paper copies.
Paper products and backup media containing this type of information must be stored and handled in a secure manner. This includes:
1. Printing this class of information only to a known, secure printer
2. Encrypting and physically securing backup media
3. Keeping paper copies of information locked or otherwise secured D. Managing data sources
The key to managing Virtru’sbusiness’ media and documents is to first consider the source of the information, then the media type. Virtru’smedia and documents containing Protected Information (PHI, CJIS, or other) require protection from inception through disposition. Regardless of the owner relationship, the Company will be cognizant of the following Media Types:
1. Hard Copy:paper printouts, printer and facsimile ribbons, drums, etc.
2. Electronic:the bits and bytes contained on hard drives, flash drives, phones and tablets.
E. Retention of media
Retention: The length of time documentation and/or information is retained according to the level of confidentiality and to the business continuity requirements. System/ information owners should consult with the ISO to ensure compliance with the record retention regulations.
Virtru’s hard copy record retention policy is as follows:
We will digitize and encrypt these records for secure storage on the Synology NAS, which will be backed up to AWS Glacier.
Virtru’selectronic record retention policy is as follows:
1. Agent of Record letters and Letters of Authorization requests are held for no less than ninety (90) days
2. New Business Group documents are held for no less than ninety (90) days
3. General documents are held for no less than ninety (90) days
4. Banking statements are held for seven (7) years
5. Workforce member records are held for seven (7) years Rev.2015.8.6
23 Security Policies and Procedures
F. Sanitization of Media
When media (hard copy and electronic) becomes obsolete, is no longer required or no longer usable, it is critical that proper sanitization is accomplished.
Sanitization Types
Disposal: the act of discarding media. This is often done via recycling paper containing “non‐confidential” material.
Reinitializing:Re‐formatting drives so information cannot be retrieved by recovery utilities or any other forms including keystroke recovery attempts. This is achieved by overwriting the disk with zeros for no less than one (1) time.
Purging: exposing the magnetic media to a strong magnetic field in order to disrupt the recorded magnetic domains, this is also known as degaussing.
Destroying: destruction of media so it cannot be reused as its original purpose.
Virtru’selectronic disposal policy is as follows:
1. Hard‐drives are purged, reinitialize or destroyed
2. CD or DVD disks are destroyed
3. Flash drives are re‐initialized or destroyed
4. Backup tapes are purged, reinitialized or destroyed
Any systems that are leased must be securely sanitized of all Company data prior to being returned to the leasing company. Any additional media (e.g. hard drives, USB drives etc.) will be reformatted then written with zeros for no less than one (1) time to ensure that the data contained on the media has been destroyed.
Virtrushall maintain appropriate records of sanitization. This entails validating how, where and when media is sanitized. See Media Sanitization.
G. Information sharing and privacy
In most cases the sharing and reuse of Personally Identifiable Information is governed by law, regulation and customer expectation. To ensure Virtrumeets those requirements, no Personally Identifiable Information will be shared with outside companies, vendors or personnel without written approval from the ISO.
Personally Identifiable Information includes:
1. Names
2. Addresses
Rev.2015.8.6
24 Security Policies and Procedures
3. Phone Numbers
4. Email Address
5. Dates of birth
6. Social Security Numbers
7. Ages
8. Gender
9. Personal Financial Information
10. Personal Medical Information
11. Criminal History Information
12. Personal Employment Information
13. Personal Buying Histories
14. IP Addresses
Aggregated and statistical data developed from this personal information is not personally identifiable and, thus, does not need the approval of the ISO for sharing and re‐use.
Virtruwill comply with all applicable laws and regulations regarding the privacy of personal information, including such laws as:
1. Health Insurance and Portability and Accountability Act (HIPAA)
2. Health Information Technology for Economic and Clinical Health (HITECH)
3. Family Educational Rights and Privacy Act (FERPA)
4. Criminal Justice Information Systems (CJIS)
5. Federal Information Security Management Act (FISMA)
Virtru’s workforce members, contractors, vendors and suppliers may come into possession of Personally Identifiable Information as a part of their relationship with Virtru. Each person must comply with all laws, regulations and policies and ensure such information is properly protected.
H. Release of company information
Virtru’sinformation may only be released with the approval of the ISO or the information owner. This includes the posting of Virtru’sinformation of any type onto bulletin board systems, public networks, social media or other open sharing tools. Any information released must contain proper copyright, trademark, disclaimer and patent notices as appropriate.
X. Risk Analysis and Management
Risks to Virtru’sassets and environment should be addressed proactively rather than reactively. The controls applied to the risks must also be periodically reviewed to ensure the controls are working properly and efficiently.
Rev.2015.8.6
25 Security Policies and Procedures
A. Risk reviews
The job of reviewing risks and setting requirements for controls is the ISO’s. Risks should be reviewed or assessed when:
1. Developing or deploying new applications, systems, networks or software
2. When significant changes are made to that same list
3. When business processes change
4. When Virtruenters a new geographical area of business
5. When Virtruenters a new line of business
6. When incidents occur or new risks emerge
7. When new regulations or standards are set
B. Risk management
Risks may be accepted, avoided or mitigated.
Acceptingthe risk is appropriate when the cost of avoiding or mitigating the risk is greater than the expected loss. The losses considered should include the less tangible items such as Virtru’s reputation, loss of market share and loss of public trust in Virtru.
Acceptance of a risk requires complete documentation of the risk analysis and approval by the information owner.
Avoidingthe risk is appropriate when the cost of insurance is less than the cost of incremental controls. However, basic controls must always be in place.
Mitigating the risk is appropriate in most situations. These situations are those where compensating controls are possible, cost‐effective and manageable. These mitigating controls may include:
1. Increasing a protection to a level higher than what is listed in this document
2. Improving oversight or monitoring of the risk to limit impact and minimize response time
3. Limiting transactions or other events to minimize the possible impact of the risk event
The method chosen for managing the risk (acceptance, avoidance, mitigation) must match the business value and costs involved and must be approved by the information owner.
For further detail, see the Risk Management Policy and the Disaster Recovery Plan.
Rev.2015.8.6
26 Security Policies and Procedures
XI. IDs and Accounts
A. User IDs
Each user shall be assigned a unique identification, called the User ID. This User ID is not considered to be sensitive, unless the User ID relates to an authentication process, systems or application management role.
On sensitive systems or applications the User ID should not be easily identifiable, thus making unauthorized usage more difficult.
Sharing of User IDs is not permitted, unless justified by business requirements and approved by the ISO. For any such shared User ID, the password will be shared using LastPass, and the password will not be shared with the additional user. If this password is shared, it must be changed immediately after the User ID is used to keep the shared User ID from becoming generally available and a risk to Virtru.
Guest and anonymous User IDs are not allowed, unless the system involved is not connected to any of Virtru’snetworks and the system does not have any Company information on it. Typically, these guest or anonymous User IDs are only used during development or during marketing/sales demonstrations.
B. ID and account creation
User IDs are only to be created following a process approved by the information owner.
This User ID creation process should include:
1. Expiration dates for the User ID
2. Renewal process for the User ID
3. Documentation of the role, business process and job function relating to the User ID
User IDs are to be created for the purpose needed and not in a manner to compromise segregation of duties.
A record of all User IDs and their owners will be maintained by the ISO. See the Change Control Logs for Securityfor further detail.
Rev.2015.8.6
27 Security Policies and Procedures
C. Account management
A periodic check will be made of all User IDs and any redundant, dormant or unused IDs will be removed. The ISO must review the privileges set up for User IDs no less than once every year.
D. Application Specific IDs
Application Specific IDs and logins are used in support of automated applications, transactions, processes or batch jobs. These have non‐expiring passwords.
1. Application Specific IDs must not be used by individuals.
2. Application Specific IDs must be created only with the approval of the ISO, must be documented and have strictly limited access rights.
3. Application Specific IDs must not have ad hoc or interactive capabilities on the applications, systems, transactions or data involved.
XII. Authentication and Passwords
A. Overview
All systems, applications, databases or other information repositories shall require users to authenticate themselves prior to granting access. Authentication may be via an approved password scheme or via an access control device. All systems that support 2‐factor authentication must have them enabled.
The authentication method used must suit the value of the information asset, matching the cost of the authentication method against the level of protection required. In general, administrative and other high‐value User or Service IDs will use the most secure methods of authentication.
B. Password format
Must be at least twenty (20) characters in length and must contain characters from all of the following four (4) categories:
1. English uppercase characters (A through Z)
2. English lowercase characters (a through z)
3. Base 10 digits (0 through 9)
4. Non‐alphabetic characters (for example, ! , @, #, $) Rev.2015.8.6
28 Security Policies and Procedures
C. Rules
Users are forced to create a new password every 3 months. Users must not write down on paper or store any passwords; they must also never share their passwords with other users. Software is provided to securely store user passwords, with encryption.
A maximum 5 attempts will be permitted prior to disabling the account. New passwords must be different from the previous three (3) passwords. Passwords must be changed immediately upon first use of a new ID. Passwords must never be stored or transmitted in clear text. Systems must not echo back the password as it is entered.
Passwords must not be retained by any system or application longer than is needed to grant access. Initial passwords must be transmitted separately from the ID.
XIII. Authorization and Rights Management
A. General Access Roles
Access roles are defined as:
1. Super Admin Access: Access to all front and backend products as well as product metrics
2. Admin Access: Access to all front end products as well as product metrics
3. General Access: Access to product metrics
4. Low Access: Access to corporate email, sales, and marketing data only Amazon Web Services (AWS)
Users who have access to AWS have Super Admin Access. User sessions will expire after one (1) hour of inactivity
Cloudant
Users who have access to Cloudant have Super Admin Access. User sessions do not automatically time out, the user is required to log out at the end of a session.
Github
Users who have access to Github have General Access. User sessions do not automatically time out, the user is required to log out at the end of a session.
ELK Stack
Users who have access to ELK Stack have Admin Access. User sessions do not automatically time out, the user is required to log out at the end of a session.
Rev.2015.8.6
29 Security Policies and Procedures
Mixpanel
Users who have access to Mixpanel have General Access. User sessions do not automatically time out, the user is required to log out at the end of a session.
Kissmetrics
Users who have access to Kissmetrics have General Access. User sessions do not automatically time out, the user is required to log out at the end of a session.
Salesforce
Users who have access to Salesforce have General Access. User sessions automatically time out after twenty (20) minutes.
Segment.io
Users who have access to Segment.io have General Access. User sessions do not automatically time out, the user is required to log out at the end of a session.
B. Access Rules
User IDs and accounts must be authorized to access only those elements needed for the user’s role, including:
1. Limiting access to datasets and types
2. Limiting access to operating systems
3. Limiting times of access
Access to operating systems, ad hoc transaction capabilities, software development tools, and other system devices must be controlled and limited to only those User IDs which require that access.
Segregation of duties shall be established for all information asset controls to minimize the possibility that one person is responsible for an entire asset.
A user (and hence User ID) that changes role or job function must have access rights updated to match the new job role or function. Any changes will be documented in the Responsibility Change Log.
C. Temporary Privileged Users and Accounts
Temporary privileged users are defined as those who:
1. Have any control over security tools on an application, system or network
2. Can update operating systems or similar tools
3. Can directly modify data within a database or application
4. Have any special capabilities built in by the vendor of the application software, operating system or platform
Rev.2015.8.6
30 Security Policies and Procedures
Access at a temporary privileged user level shall be granted only on a need‐to‐know, need‐to‐perform basis, and then only to the assets required. Temporary privileged user access shall only be granted to those supporting Virtru’sapplications, networks and systems.
D. Assignment and Revocation Procedure
The ISO shall electronically complete:
1. An Employee Access Log for all new hires and/or workforce member change of status.
2. An Exit Checklist for all terminations.
E. Logout After Inactivity
The ISO shall verify that all users have activated a password‐protected screensaver that automatically prevents unauthorized users from viewing or accessing electronic protected information from any system or device that can be used to access electronic information systems. After a maximum of 10 minutes of inactivity the system should log off and lock the device, making information inaccessible. Once logged off a user must re‐enter a password to gain access to electronic protected information.
XIV. Breaches or Impermissible Uses/Disclosures
A. Definitions
Incident is defined as any breach of security, privacy, continuity, legal or regulatory controls over information assets of any type. Examples of such incidents include but are not limited to:
1. Penetrations of systems, applications, networks or databases
2. Denial of service attacks
3. Misuse or mishandling of assets
4. Virus or other malware contamination
5. Transaction errors
6. Breaches of confidentiality agreements or contracts
7. Legal or regulatory violations
Breach is defined as an impermissible access, use or disclosure, which compromises the privacy or security of PHI.
Rev.2015.8.6
31 Security Policies and Procedures
D. Acknowledgement
All users shall be required to sign an acknowledgement after being trained on Virtru’s security and privacy policies.
E. Exit process for users
Upon exiting employment or any relationship with Virtru, all users who have been granted access to any information asset shall:
1. Relinquish all access to control devices
2. Report all User IDs in use by the person
3. Relinquish all information stored, whether on paper or on backup media
4. Relinquish all information processing devices, including workstations, all Virtru‐owned mobile devices and others
All systems access will be revoked.
The ISO will verify termination is completed, and document this procedure has been followed. See Exit Checklist.
F. Security Sanction Policy
Virtru’ssecurity policies call for the workforce that has access to electronic Protected Employee or Client Data and others to perform certain duties and to refrain from certain actions. Failure to do so will be sanctioned according to the policy below.
If the infraction involves the unauthorized use or disclosure of electronic Protected Employee or Client Data, the sanctions below apply to the designated workforce members including managers, supervisors, and staff who have access to Protected Employee or Client Data.
We define a serious infraction as one that results in known significant damage or that threatens imminent significant damage. Other infractions are simple infractions. The process below is intended as guidance for our business management in sanctioning Security Policies and Procedure infractions. We reserve the right to implement sanctions differently if, in our judgment, the situation warrants it.
First Security Infraction
If the infraction is:
1. A simple infraction, and
2. The first infraction in the last 3 years
The sanction will be retraining the workforce member on the appropriate policy/procedure and placement of a written letter of reprimand in the employee file.
Rev.2015.8.6
34 Security Policies and Procedures
The letter will notify the person of the nature of this infraction and of sanctions for future potential infractions.
Second Security Infraction or First Serious Infraction
If the infraction is:
1. A serious infraction, or
2. The second infraction of either type within 3 years
The sanction will include a written letter of reprimand that is given to the person at fault, placement of a copy of the letter in the employee file, and one week’s suspension without pay. The letter will notify the person of the nature of this infraction and of sanctions for future potential infractions.
Third Security Infraction or Second Serious Infraction
If the infraction is:
1. A second serious infraction within 3 years, or
2. A third infraction of any type within 3 years
The sanction will be dismissal from the workforce.
XVII. Legal and Regulatory Issues
A. Legal processes
Responses to subpoenas, deposition requests and other legal issues will be referred to and handled by the CEO. The ISO will not respond to such legal processes without company legal counsel.
B. Copyrights and licenses
Virtrumay have agreements in place governing the use and handling of software, information and other tools that are owned by other entities. All users and information owners will comply with those agreements.
Users are responsible for complying with copyrights regarding any material obtained via the Internet. This includes files, graphics, software, audio and video materials.
Users may not agree to a new copyright license, unless given permission by the ISO.
Licensed software must be used in accordance with the license agreement and only the number of copies licensed must be created or used.
Rev.2015.8.6
35 Security Policies and Procedures
C. Export controls
Information may not be exported across country boundaries without prior written approval of the Company’s ISO.
XVIII. Malware and Antivirus
A. Definitions
AntiMalware: malicious software that may reside on a computer, steal information or cause destruction. This can include a virus, trojan horse, keylogger, hijacker or dialer.
Sandbox: A highly controlled area where programs and software can be tested before being allowed access to the rest of the system.
B. Operating system antimalware requirements
Macintosh, Linux and iPhones:
Virtruhas determined that software for anti‐malware scanning on Macintosh, Linux and iPhones is not necessary due to the low probability of encountering malware, the demand on computer processing power, and loss of productivity by the user. This policy will be reviewed annually or as needed to determine if this is still valid.
PC Operating Systems:
Data entering Virtru’sWindow‐based systems must be subject to an up‐to‐date anti‐malware scanning tool that is scheduled to run at regular intervals. In addition, all emails, attachments, disks, backup media, USB memory devices and other data carrying tools must be scanned before they are downloaded or allowed access to the system. All incoming data must be sandboxed by the anti‐malware program before it is allowed access to the system. The anti‐malware pattern files must be regularly updated.
Android and Windows Phone Operating Systems:
All such devices must have anti‐malware tools in place prior to being connected to Virtru’s networks. These systems must be subject to an up‐to‐date anti‐malware scanning tool that is scheduled to run at regular intervals. In addition, all emails, attachments, and SD cards must be scanned before they are downloaded or allowed access to the system.
C. Affiliates
Virtruand all of its affiliates, contractors, consultants, vendors, representatives or other service providers must make certain that adequate controls are in place to guarantee that data coming from their systems and networks is free from malware.
Rev.2015.8.6
36 Security Policies and Procedures
D. Infected devices
The ISO will use approved tools to monitor and remove malicious software from Virtru’sassets. Virus‐infected computers, tablets or phones must be removed from the network immediately until they are verified as virus‐free.
E. Employees’ Requirements
1. Workforce members will not load software on our Company’sinformation equipment without permission from the ISO.
2. Workforce members will not open electronic files from unfamiliar sources.
3. Will exercise best practices when using the Virtrunetwork. The employee will not:
a. Circumvent user authentication on any device
b. Sniff network traffic
c. Access data, servers, or accounts they are not authorized to access d. Cause a disruption of servers
e. Violate copyright law by transmitting copyrighted pictures, music, video and/or software
f. Export or import software, technical information, encryption software, or technology in violation of international or regional export control laws
g. Use the Internet or network in a manner that violates Virtru’s Security Policies, or local laws
h. Intentionally introducing malicious code; including, but not limited to, viruses, worms, Trojan horses, e‐mail bombs, spyware, adware, and keyloggers
The workforce will be trained to know and carry out these malware protections. The ISO will generally provide permissions as required above only for actions that are intended for our Company’s business and only under conditions that limit the potential for the introduction of malware.
F. Enforcement
Any activities with the intention to create and/or distribute malicious programs into Virtru’snetworks (e.g., viruses, worms, Trojan Horses, e‐mail bombs, etc.) are prohibited, and user will be subject to Virtru’sSanction Policy, and will be reported to the proper state and federal authorities.
Rev.2015.8.6
37 Security Policies and Procedures
XIX. Change Control Logs
A. Preface
The ISO is required to maintain logs of systems that document any changes and access users may have to sensitive systems. The following are the retention policies for these logs.
B. Policy
Audit logs will be retained for at least one (1) year in raw format, preferably electronic, to preserve evidence. Audit logs must be configured to prevent overflow, erasure or tampering. Audit logs will be configured to record information such that:
1. Sufficient information is available for proper investigation of use, misuse, incidents and performance
2. User ID, event type, date and time are maintained
3. Time is according to a known time stamp so that events across systems can be coordinated
4. End‐to‐end accountability is always maintained
Events to be recorded include, but are not limited to:
1. Login and activity by any other privileged accounts
2. Changes to operating systems, application code or other tools
3. Backup and restore events
4. Changes affecting any cryptographic keys or devices
5. Stop or start of critical processes
6. Transaction failure, retry or duplication
All systems and tools involved in the protection process are required to always have change logs enabled and properly configured. This includes:
1. Firewalls
2. Email servers
3. Anti‐malware tools especially the administration tools
4. Security administration tools such as password resets and account modifications
5. Monitoring tools
6. Routers and other network devices
7. Github
8. Amazon Web Servers (AWS)
Rev.2015.8.6
38 Security Policies and Procedures
9. IBM Cloudant
10. SalesForce
11. Elk Stack
12. Mixpanel
13. KissMetrics
14. Segment.io
15. Sendgrid
16. Customer.io
Logs will be reviewed and analyzed by delegates of the ISO.
Reports of problems and incidents will follow the incident reporting method, listed in the Incident and Breach Policy.
XX. Encryption
A. Preface
Encryption is the process of encoding messages of information is such a way that only authorized parties can read it.
B. Application Encryption Policy
Virtruencrypts all client data using NIST‐approved cryptographic modules. Virtru uses AES 256 encryption for its application. Virtru’skey length requirements shall be reviewed annually as part of the yearly security review and upgraded as technology allows.
The use of proprietary encryption algorithms is not allowed for any purpose, unless reviewed by qualified experts outside of the vendor in question and approved by the ISO.
C. Key Rotation Policy
Virtrurequires the following key rotation policy to protect all external systems. The following is the list of policies for the following keys:
1. Secure Socket Layer (SSL)Keys
Virtruuses SSL keys to enable Transport Layer Security (TLS) traffic between clients and Virtru’sservers.
Rotation Policy
Rev.2015.8.6
39 Security Policies and Procedures
Rotation of SSL Keys is done upon SSL Key expiration. They are set to expire at 1 (one) year and rotated at that time. If there is an incident or the security keys are thought to be compromised, the keys will be rotated immediately.
2. Secure Shell (SSH) Keys
The SSH keys provide a layer of authentication to get into the production servers.
SSH Keys are used as the authentication mechanism to remotely login to a server.
They are also used as the first factor of authentication to assume root access on the production servers. Each developer has his/her own SSH key and is responsible for keeping this key secure.
Rotation Policy
All SSH keys are rotated at a minimum of every three (3) months. If there is an incident or the SSH keys are thought to be compromised, keys will be rotated immediately.
3. Amazon Web Services (AWS) Access Keys
Unique AWS Access Keys are given to each developer with a unique AWS Login.
This allows the developer to make Application Protocol Interface (API) calls to AWS.
Currently, 1‐2 AWS Access keys exist per developer. Where are these stored? How do you know how many keys each developer has?
Rotation Policy
These keys are rotated at a minimum of every 90 days. If there is an incident or the AWS keys are thought to be compromised, keys will be rotated immediately
4. Application Keys
Virtruuses these keys to encrypt sensitive key data stored in the CouchDB database managed by IBM. There is only one copy of this key.
Rotation Policy
No rotation requirement.
Backup Policy
Backup of the key is kept with Virtru’s Super Administrators.
The export of encryption technologies is restricted by the U.S. government. Residents of countries other than the United States should make themselves aware of the encryption technology laws of the country in which they reside.
Rev.2015.8.6
40 Security Policies and Procedures
D. Device Encryption Policy
Virtrurequires devices have encryption enabled for any files, folders, drives, databases, or other stored data that may have sensitive information including protected personally identifiable information.
The implementation of any encryption scheme is performed by the user and the deployment of the encryption tool, including all keys, must meet industry best practices and be properly documented. Currently the minimum standard is 128‐Bit encryption.
Encryption keys will be managed by the user and a log will be maintained by the ISO.
Mac OS Devices:
Mac OS devices that store Protected Information (PHI, CJIS, etc), are required to use full disk encryption using FileVault 2. Users must provide a copy of their key to the ISO; both will maintain the key in a secure location.
For devices that do not store Protected Information (PHI, CJIS, etc), full disk encryption is at the discretion of the user. However, if this is used, a copy of the encryption key will be stored by both the user and the ISO in a secure location.
Windows OS Devices:
Windows OS devices that store Protected Information (PHI, CJIS, etc) are required to use full disk encryption with the program Bitlocker. The encryption key will be maintained in a secure location by both the user and the ISO.
For devices that do not store Protected Information (PHI, CJIS, etc), full disk encryption is at the discretion of the user. However, if this is used, a copy of the encryption key will be stored by both the user and the ISO in a secure location.
Linux OS Devices
Linux OS devices that store Protected Information (PHI, CJIS, etc) are required to use full disk encryption. This will be encrypted at a minimum of 128 bit encryption.
The encryption key will be maintained in a secure location by both the user and the ISO.
For devices that do not store Protected Information (PHI, CJIS, etc), full disk encryption is at the discretion of the user. However, if this is used, a copy of the encryption key will be stored by both the user and the ISO in a secure location.
Rev.2015.8.6
41 Security Policies and Procedures
Android Devices
All Android devices that store Protected Information (PHI, CJIS, etc) will have encryption turned on and will be password protected at all times. The encryption key will be maintained in a secure location by both the user and the ISO.
Windows Phone
All Windows Phones that store Protected Information (PHI, CJIS, etc) will have encryption turned on and will be password protected at all times. The encryption key will be maintained in a secure location by both the user and the ISO. iPhone
iPhones are natively encrypted. These devices are required to be password protected and/or biometrically protected at all times.
E. WiFi network encryption
All wireless access points owned by Virtru are required to be protected using Wi‐Fi Protected Access 2 with Advanced Encryption Standard (WPA2‐AES). This password will be changed quarterly and will not be shared with users that are not employees or authorized Business Associates. Any outside users are required to use guest access points.
Employees that access Virtruresources from home are required to use Wi‐Fi Protected Access 2 with Advanced Encryption Standard (WPA2‐AES) to protect their devices.
This password should be changed quarterly.
F. Email encryption
Virtru requires the use of its secure, encrypted email service to communicate with our employees about their Personally Identifiable Information, and to communicate any sensitive data. All email communication that includes personally identifiable data, and potentially sensitive data will be encrypted.
Virtruuses only its secure, encrypted email service to communicate with clients about their Personally Identifiable Information.
Virtruforbids the use of chat, texting or instant messaging programs by devices that store PHI.
G. Enforcement
Any workforce member found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.
See Sanction Policy.
Rev.2015.8.6
42 Security Policies and Procedures
XXI. Assessments and Testing
A. Overview
The Security Rule of HIPAA mandates that covered entities implement appropriate information security policies and procedures to protect PI from "reasonably anticipated threats and hazards."
B. Penetration testing
Penetration testing of all servers containing PII will be conducted monthly by internal personnel, and by an external 3rd party at least annually or whenever there is a major system update. Testing shall validate the security of:
1. External connections
2. Operating systems
3. Applications
4. Databases
5. Network controls
6. Security procedures, including monitoring and incident response C. Vulnerability assessment testing
Vulnerability assessments will be conducted periodically on all network‐connected systems devices. Any vulnerability found must be corrected in a timely manner.
Vulnerability assessments also shall be conducted when:
1. A new system, application or network is installed inside the Company
2. Changes are made to firewalls, VPNs or other security control tools
3. Changes are made to a web server’s operating system
4. Changes are made to email servers
5. Configuration changes are made to databases
6. Configuration changes are made to critical applications
7. Changes are made to encryption scheme(s)
NOTE:Vulnerability and penetration tests will not be conducted except with the prior approval of the ISO. No user will have vulnerability or penetration testing tools loaded onto any Company system without prior permission from the ISO.
D. Wireless access testing
Testing of wireless access points (war‐driving) shall occur regularly, to cover all wireless access points under the control of Virtru.
Rev.2015.8.6
43 Security Policies and Procedures
E. Password testing
Password cracking software shall be run periodically to validate the enforcement of password rules.
F. 3rd Party Security Management
A comprehensive list of 3rd parties with which the company does business with shall be maintained. Any 3rd party who handles or holds sensitive data or who provides a service which is critical to operations shall be required to assert that their own security practices and procedures meet or exceed that of the company’s. Each 3rd party shall be assessed for conformance annually.
XXII. Use of Email, Internet, Messaging, Public Sites, Blogs, Social Media A. Policy
Confidential, Private or Protected information and Internal Use information must not be transmitted across any unsecured outside network or path without proper controls.
Virtrurequires encryption for files and emails, or secured packaging for paper copies.
Users are responsible for ensuring that their use of these tools complies with all of Virtru’spolicies, and with applicable laws and regulations. This includes all employment policies such as sexual harassment, stalking, ethics and appropriate use.
These tools may not be used to access, send or receive, store or display:
1. Sexually explicit material
2. Confidential, Private or Protected Information or Internal Use material, except as meets the Handling Rules section
3. Viruses
4. Threats
5. Inappropriate or unlawful language, including:
a. Offensive language
b. Language inappropriate for the Companyenvironment
6. Discriminatory or harassing language
7. Tools usable for hacking, password cracking, vulnerability scanning or penetration testing
These tools are the property of Virtruand are to be used only for Virtru’s business.
Access may be unavailable at any time, at the Company’s discretion. Users must not assume that access to these tools will be available for incidental personal use.
Rev.2015.8.6
44 Security Policies and Procedures
All content transmitted over these tools is the property of Virtru. Content, including emails, may be inspected by Virtru. Such inspections will occur with the approval of the ISO or of the Companylegal department. Virtrumay monitor, filter or block content on these tools.
Users of blogs, social media sites such as Facebook, and other such tools must follow the guidelines outlined in Virtru’sSocial Media Policy. See Social Media Policy.
Users of blogs, social media sites such as Facebook, and other such tools must not represent their comments as coming from, or being representative of, the business or opinions of Virtru.
XXIII. Hardware
A. Definitions
Workstations: PCs, desktop computers, tablets and mobile computing devices that are located at Virtru’shome office, or at remote locations. These devices are easily attacked and therefore must have access controls and anti‐malware as specified in those sections of this document.
Servers: Devices that may or may not be housed at Virtrulocations. Regardless of their location, these must secured in a manner that prevents them from being physically accessed without the appropriate level of security clearance.
B. Policy
A current copy of the Organizational Chart/Electronic Asset Management Log (Risk Assessment) will be kept at an off site location so it can be accessed quickly in the case of theft, fire, flood or other events that may make inventory information useful.
The ISO will keep a log of events noting when a physical security mechanism is repaired, replaced, installed, removed, modified, or maintained. This Maintenance Log will contain the: who, what, when, where, and why of the change and be kept in the Security Documentation Library.
Users of these devices are required to ensure that all appropriate protections are in place, including:
1. Physical security to prevent theft or misuse
2. Access controls suitable for the class of information on the device
3. Anti‐malware
4. Keeping the devices locked to a desk or other secure location when outside Rev.2015.8.6
45 Security Policies and Procedures
D. Enforcement
Any workforce member found to have violated this policy may be subject to disciplinary action, up to and including termination of employment. See Sanction Policy.
XXIV. Networks
A. Overview
Virtru’snetworks and devices shall designed, deployed and operated in a manner so as to provide proper levels of protection for the data being accessed and transported.
Significant changes in network designs must be piloted before deployment.
Mechanisms must be in place to alert the ISO of possible attacks and breaches, to include:
1. Denial of service attacks
2. Improper access
3. Virus infections
4. Unauthorized software installations, email, FTP or other improper usage Analysis must be conducted at least annually to validate the failure mode and recovery for all devices, network circuits and protocols. See Change Logs for details.
Responsibilities must be defined for:
1. Administration of network and communications connections
2. Operations of all devices
3. Monitoring
4. Timely review of audit logs and response to alerts or alarms
5. Review of unusual patterns of usage or activity
To minimize risks, any network connections or network segments should be disconnected when not in use.
B. Monitoring
Virtruuses AlienVault’s Unified Security Management System to monitor all traffic on their network. Notifications are set to alert the IT staff of any unusual traffic and vulnerabilities, as well as log any security events that may occur.
C. Access control and physical security
Sites where Virtru’snetwork equipment or communications lines exist are considered to be high‐value and are subject to the access control and physical security rules Rev.2015.8.6
47 Security Policies and Procedures
outlined in the Physical Security section of this document. In general, these rules will require:
1. Access limited to authorized personnel only
2. Physical security, including RFID or passcode controlled locks, are in place D. Modifications, updates
Changes to the network architecture which affect the protections must be approved by the ISO. Examples of such changes include firewalls, wireless configurations, ports and proxies.
E. Documentation
The ISO shall maintain an accurate set of documentation of the networks and their components. This documentation is considered to be highly valuable and will be classified “Protected”.
F. Network design
The goal for network design is to facilitate Virtru’sbusiness, while still providing protection for Companyassets.
G. Segmentation
Virtru’snetworks will be segmented, in order to limit access to Confidential and Protected Information, without impacting the Company’s business. There will be a guest network that will have no access to Virtru’sNetwork Attached Storage, and other vital network resources.
H. Firewalls
Virtru’snetwork and workstations in the DC office is protected using the Fortinet FortiGate 100D Firewall appliance. This device is configured to monitor and log all unusual traffic and warn Virtruof any network irregularities or attacks.
Definitions
Firewall: A part of the computer operating system or network that is designed to block unauthorized access while permitting outward communication. There are two different types of firewalls.
1. Software Firewall:Part of the operating system or can be a software add‐on.
2. Hardware Firewall: Built into a router or a stand alone device. All computing devices will access a network through this point.
Firewall Settings
1. Whitelisting: Blocks all incoming traffic, and only allows traffic from good, or known IP addresses. The user will be required to authorize connections to their device.
Rev.2015.8.6
48 Security Policies and Procedures
2. Blacklisting: Authorizes all traffic as a default, and the user is responsible for denying unauthorized connections to their computing device from unrecognized or unknown IP addresses.
Software Firewall Policy
Virtrurequires every device to have their internal software firewall activated at all times, and set to only allow whitelisted traffic. This will require the user to authorize any connections to their device. Any workforce member found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.
I. Internet
Connections to the Internet must be:
1. Approved by the ISO
2. Periodically reviewed and tested for vulnerabilities
3. Protected by firewalls, intrusion detection systems and anti‐malware tools Some Internet tools, such as FTP, Internet Relay Chat, Telnet and Remote Procedure Call are restricted in use and must be approved for use by the ISO.
J. VPNremote access
Virtual private networks (VPNs) will be used for traffic flowing over public networks to ensure the proper level of protection of Virtru’sdata.
K. Wireless
All wireless connections must have WPA2 with Advanced Encryption Standard (AES) turned on. This applies to all networks for Virtru’shome office, and all telecommuting employees.
L. Telework Policy
If a staff member is allowed to telework/telecommute, they must comply with the Virtru’s various employment policies, remote security measures and use the provided web portal via HTTPs, VPN and SSL. They must also make sure their home WI‐FI is encrypted properly.
If they are accessing sites while on an unsecure router, they must make sure the sites they visit have a valid SSL certificate before proceeding.
M. Patching of systems and applications
Microsoft Windows OS Patches
Rev.2015.8.6
49 Security Policies and Procedures
To manage the patching of Microsoft Windows operating systems (OS), Windows Software Update Service (WSUS) is used. The WSUS server automatically checks for patches once a day not during business hours. Then downloaded patches are manually released from the WSUS server to be downloaded and applied on the workstations. The ISO will evaluate all patches before they are applied; workstations will not automatically download OS patches from the WSUS server and updates will not be automatically installed. Installation of OS patches is done within a planned downtime.
Apple OS Patches
All Macintosh Operating System (OS) patching will be done through the App Store, and is the responsibility of the individual user to install. These should be applied within one (1) week of release from Apple.
Linux OS Patches
These patches should be applied and tested in an app staging environment before they are applied systemwide. The User is required to document where they received the patch, who downloaded it, what version of patching they are using, and when the patch was applied to the system. This documentation should be submitted to the ISO upon completion of the patching.
iPhone iOS Patching
All iPhone (OS) patching will be done through the App Store, and is the responsibility of the individual user to install. The device should be fully backed up prior to installing these patches either in the cloud or locally. All backups are required to be encrypted and password protected. These patches should be applied within one (1) week of release from Apple.
Android Phone Patching
All Android patching will be done through the Google Play Store, and is the responsibility of the individual user to install. The device should be fully backed up prior to installing these patches either in the cloud or locally. All backups are required to be encrypted and password protected. These patches should be applied within one (1) week of release from Google.
Windows Phone Patching
All Windows Phone patching will be done through the Windows Phone Store, and is the responsibility of the individual user to install. The device should be fully backed up prior to installing these patches either in the cloud or locally. All backups are required to be encrypted and password protected. These patches should be applied within one (1) week of release from Windows.
Rev.2015.8.6
50 Security Policies and Procedures
Patching of applications is done on a weekly basis, unless a zero‐day exploit is found in an application that is used within the domain. If such an exploit is found and a patch is released for said exploit, an emergency planned downtime will be called for at the conclusion of the business day to patch the application in question.
N. Network hardening
Upon adding new devices to the network, installation procedures and set‐up must be followed. Hardening will be done on network devices as well as systems (e.g. laptops, workstations and servers) and handled by the ISO or AISO.
Hardening will be broken down into the following categories which include, but are not limited to:
1. Preparation and installation
2. Updates to: software, firmware and hardware
3. Setting of appropriate account and auditing rules
4. Setting of appropriate security rules
5. Turning on the internal firewall
6. Turning on full disk encryption (If device will have access to PHI)
7. Other internal operations such as:
a. Installation of appropriate software for workstation, server or laptop The ISO will notify all affected staff when making changes to the hardening policy and will update the Security Policies and Procedures at that time. Written approval for hardening procedures above and beyond what is currently mandated is not necessary.
XXV. Physical and Environmental Protections
A. Definitions
Secure sites: These are locations that require the highest level of protection. These sites include:
1. Computing centers
2. Network connection points
3. Media storage locations
4. Locations containing platforms which carry high‐value or critical information or transactions
Rev.2015.8.6
51 Security Policies and Procedures
Physical Security: These may occur within Virtruwhere the overall building is operated to a lower level of security, but a certain area is more controlled due to documents, assets or processes which occur in that area.
B. Secure Sites Policy
Secure sites shall be established for all computing centers and other locations where there is a concentration of high‐value or sensitive information, systems or networks.
Sites will be designed and operated according to best practices and in consideration of threats appropriate to the site such as hurricanes, tornados, power outages and intruders.
This standard is not to be construed as a complete list of requirements for a secure site.
It should be used in conjunction with expert advice, architects, fire marshals, OSHA and other regulations.
Separate, isolated areas will be created within the secure site for:
1. Media libraries
2. Electrical supplies and controls
3. Environmental and mechanical controls
Access to these sub‐areas will be on a need‐only basis. Critical assets and operations must be conducted in a secured area or secured site, with protections implemented in accordance with the risks and value of the assets, information and operations.
C. Data Centers
All data centers used by the company must provide proof that they meet or exceed the security requirements and standards of the company.
XXVI. Physical Security Policy
A. Entry Policy
All Virtru’sworkforce members are allowed access to the physical site at any time of the day, and any day of the week. The site is secured with an electronic door lock that accepts RFID cards and a numeric passcode. RFID cards are issued by the ISO or AISO by request and after approval.
B. Loss of RFID key
If a workforce member loses their RFID key, they will notify the ISO or AISO as soon as possible so the key may be deactivated. Any workforce member found to have violated Rev.2015.8.6
52 Security Policies and Procedures
this policy may be subject to disciplinary action, up to and including termination of employment. See Sanction Policy.
C. Mobile devices
Mobile devices (laptops, netbook, tablets, iPhones, iPads, etc.) must have the appropriate encryption. Devices must have a power‐on password or PIN, data encryption, auto‐lock and role‐based access per user. See BYOD Policy (Forms for Employees).
D. Video monitoring
Virtru’s main office is monitored by a video camera. The data is stored in the Network Attached Storage which is physically secured in a locked cage in the IT closet. This data is stored for up to one (1) month.
E. Alarm system
Virtru’s main office is monitored by an alarm system. It is attached to all doors and windows, and requires a 4‐digit pin plus a modifier to deactivate. Once triggered, there is a 45‐second delay before the local authorities, ISO and CEO are notified by the monitoring company. ADT is the company that is responsible for monitoring Virtru’s main office.
The alarm pin code is changed quarterly, or at the time that an employee is fired or leaves the Company.
Virtrurequires that this alarm be set by the last person to exit the office, and should be active anytime there is not an authorized employee on the premises.
F. Fire protection
Fire protection meet all regulations, including federal, state and local. Fire extinguishers shall be deployed in accordance with regulations of OSHA and fire inspectors. Periodic testing of alarms, fire extinguishers and fire evacuation procedures shall be conducted.
XXVII. Software
A. Overview
This section outlines the standards applying to operating systems, applications, databases and other software tools.
Rev.2015.8.6
53 Security Policies and Procedures
B. Acquisition of software
It is up to the developer to decide which software tools they will require for their workstation. All regulated software will only be download from trusted sources, such as the Apple App Store, Windows Store, or directly from reputable websites, etc.
Unregulated software is allowed, but must be fully documented and approved for use by the ISO. Documentation will include:
1. The source of the software
2. When it was downloaded
3. Who downloaded it for use and;
4. The date the ISO approved the use of the software
All software for Windows OS devices is required to be screened for malware prior to installation.
Any unauthorized software must be approved and validated, or removed.
Users of workstations, netbooks, wireless and other personal devices must not install unapproved software.
C. Open Source Software
The use of open source shareware or open source freeware may only occur if:
1. It is not used in a production environment OR
2. Prior to use it is fully tested, documented and Virtru’spersonnel are assigned to support it. Checks to be performed include:
a. Verify usage license (no strong or weak copyleft licenses) b. Review open CVEs and available patches
c. Perform internal security evaluation
d. Flag for external security evaluation during next penetration test
3. The source of the software is documented
a. URL
b. Project lead
c. Contributors
d. Whether the project is actively maintained
4. The ISO approves of the use
D. Documentation
Documentation for sensitive applications and the operating systems which run those systems shall be stored securely. Backups of all documentation shall be maintained off Rev.2015.8.6
54 Security Policies and Procedures
site. Access to the documentation for sensitive applications and the operating systems will be on a need‐to‐use basis.
E. Change Control and Maintenance
All proposed changes to production systems must be registered in the companies issue tracking system. Changes shall be categorized as standard, normal, or emergency.
Standard changes are those that are performed frequently and considered low risk.
Standard changes are reviewed quarterly and pre‐approved for the following quarter.
Normal changes are those which are not performed frequently and may pose some risk to the business. Each normal change must be reviewed by a minimum of two super‐admins, the CTO and/or VP of engineering prior to being made. Reviewers are responsible for assessing the impact of the change in regards to the functionality, availability, durability, and security of the system. If a consensus among reviewers is reached, the proposed change is sized, sorted, and executed through the standard engineering workflow. Emergency changes are those that are required to rectify some form of degradation of the system. Emergency changes must be reviewed by a minimum of two super‐admins. If a consensus is reached, emergency changes can bypass the standard engineering workflow and be made immediately. All changes to production systems must be captured in the company’s issue tracking system without exception.
F. Operating Systems
Only approved operating systems will be loaded onto Virtru‐owned assets. Before major upgrades to systems, authorization by the ISO and AISO will be required.
Default settings must be reviewed prior to installation to identify any security vulnerabilities. These settings will be communicated with all workforce members, or they will surrender their devices to the ISO or AISO for configuration.
G. Applications
All applications, whether developed or purchased, must comply with Virtru’spolicies and protection standards. The information owner is responsible for ensuring that these requirements are included during the development or acquisition of software.
The protection requirements for applications include:
Rev.2015.8.6
55 Security Policies and Procedures
1. Access control
2. Authorization
3. Information classification
4. Storage controls
5. Backup and restoration
6. Confidentiality and integrity requirements
7. Audit logs
8. Privacy, export control and other such requirements
All product associated applications must use HTTPS to communicate with all remote hosts, both Virtru hosted services and external third parties. HTTP and other non‐encrypted communications are not allowed under any scenario.
Virtru applications shall treat user credentials with the utmost sensitivity and must follow security best practices for storing and transmitting user credentials. All credentials which are shared with a client device must be sent over HTTPS or another encrypted communication channel. All user credentials which are stored in a data store, must be stored in a benign state so that leakage of information from the data store does not compromise user accounts.
All application logs must be sent to a central logging cluster for aggregation and analysis.
H. Configuration Management
Where possible, Virtru applications and infrastructure follow an immutable paradigm.
All changes to production infrastructure and application code is deployed on a brand new Amazon Machine Image (AMI). This allows all changes which are deployed to be tracked and audited. This also means that no configuration or application code will be modified on a production instance. All application servers have osquery installed and configured to monitor key files on the system for any change (File Integrity Monitoring). Any changes to configuration are logged and sent to AWS Cloudwatch Logs, where they trigger an alarm and cause an email to be sent to the Virtru DevOps team for further investigation.
Where possible, Virtru utilizes Terraform, Ansible, and other similar tools to define their infrastructure as code. This allows the production infrastructure to be versioned in a git repository and easily audited for change over time.
I. Asset management for software
The ISO is responsible for maintaining an inventory of software; as such it shall employ software to aid in the management of software assets.
Rev.2015.8.6
56 Security Policies and Procedures
J. Enforcement
Any workforce member found to have violated these policies may be subject to disciplinary action, up to and including termination of employment. See Sanction Policy.
XXVIII. Removable Media Device Policy
A. Purpose
The purpose of this policy is to minimize the risk of loss or exposure of Confidential or Protected Information maintained by Virtruwhen it is stored, transferred or accessed on a removable media device. This policy also aims to reduce the risk of acquiring malware infections on computers operated by Company. Any questions or comments about this policy should be directed to the ISO
B. Scope
This policy covers all removable media that contains Virtru’sdata or that is connected to Virtru’snetwork.
C. Definitions
Removable media: devices or media that is readable and/or writable by the end user and are able to be moved from computer to computer without modification to the computer. This includes flash memory devices such as thumb drives, SD cards, cameras, MP3 players or any other storage medium; removable hard drives (including hard drive‐based MP3 players); optical disks such as CD and DVD disks.
Encryption: a procedure used to convert data from its original form to a format that is unreadable and/or unusable to anyone without the tools/information needed to reverse the encryption process.
Malware: software of malicious intent/impact such as viruses, worms, and spyware.
D. Policy
Workforce members may use removable media in their work computers if they take all reasonable and prudent measures to ensure the safety and confidentiality of all information that is downloaded to any removable media or portable device E. Using Removable Media Devices
PHI should be stored on removable media only when required in the performance of assigned duties or when responding to legitimate requests for information. When Rev.2015.8.6
57 Security Policies and Procedures
Protected and Confidential information is stored on removable media, it must be encrypted in accordance with Virtru’sEncryption Standards.
The workforce member shall take all reasonable and prudent measures to physically secure all removable media or to portable devices. Users shall not open or attempt to open the encasement of any removable media or portable devices nor otherwise circumvent any lock system that secures the device or its components. Users should take reasonable measures to secure device at all time and report any lost or stolen removable media or portable devices immediately.
Workforce members may not copy information or other sensitive data onto personal devices, unless approved by management in conjunction with the Confidentiality Agreement for Employees.
F. Exceptions
Exceptions to this policy may be requested on a case‐by‐case basis by petition to the ISO.
G. Refusal
Virtrureserves the right to refuse the ability to connect removable media devices to the Company network if such media is being used in such a way that puts Virtru’s systems, data, users and customers at risk.
H. Enforcement
Anyone found to have violated this policy may be subject to disciplinary action, up to and including suspension of access to technology resources or termination of employment. A violation of this policy by a temporary worker, contractor or vendor may result in action up to and including termination of their contract or assignment with Virtru.
XXIX. Application Recovery Plan
A. Overview
Virtru backs up of all production data hourly and stores it remotely on two separate Amazon Web Server (AWS) Accounts. These backups are a combination of both differential and full backups. These backups are durable a the same rate as S3 data, each snapshot is 99.99999% durable.
B. Scope
These policies apply to all production servers and data that Virtruis responsible for maintaining on behalf of our clients.
Rev.2015.8.6
58 Security Policies and Procedures
C. Data durability and reliability
Virtruuses Amazon S3 to provide a highly durable storage infrastructure designed for mission‐critical and primary data storage. Amazon S3 redundantly stores data in multiple facilities and on multiple devices within each facility. To increase durability, Amazon S3 synchronously stores Virtru’sdata across multiple facilities before confirming that the data has been successfully stored. In addition, Amazon S3 calculates checksums on all network traffic to detect corruption of data packets when storing or retrieving data. Amazon S3 performs regular, systematic data integrity checks and is automatically self‐healing.
D. Encryption
Virtruuses Server‐side encryption to protect data at rest. Server‐side encryption with Amazon S3‐managed encryption keys (SSE‐S3) employs strong multi‐factor encryption by encrypting each object with a unique key. As an additional safeguard, it encrypts the key itself with a master key that it regularly rotates. Amazon S3 server‐side encryption uses 256‐bit Advanced Encryption Standard (AES‐256) to encrypt Virtru’sdata.
E. Load balancing
Virtruuses Amazon Web Services’ Elastic Load Balancing (ELB) to automatically distribute incoming application traffic, to automatically route traffic across multiple instances. and multiple Availability Zones. This is used to insure that only healthy servers are receiving traffic.
F. Restoration of data
Restoration of production data is done on an as‐needed basis. The following employees are responsible for restoration of the application if it is needed:
1. Reuven Gonzales, Lead Developer, or
2. Conor Gilsenan, Developer Ops.
The needed backup data will not be restored “on top of” the current “bad” data. The restores will be redirected to a new location, and first verified. Upon verification, the “bad” data will be removed from the drive, and stored and relabeled as “old data.” Then the backup data will replace the “old data” on the drive. Once the restored data has been verified once more, the “old data” will be destroyed.
G. Testing and revision of plan
Once every quarter, after doing a full backup, Virtruwill recover the saved data. During hours when the business is closed, we will operate the application using this recovered data in a test mode. The tests will consist of a set of tasks that are designed to exercise the main system functions to confirm that the data is usable and as up‐to‐date as we expected given the backups that were used to do the recovery. This testing process Rev.2015.8.6
59 Security Policies and Procedures
should take an hour. The restore process should take an hour or two, once the files are retrieved.
If the process does not work as documented in our policy, it will be updated to reflect the actual procedure we need to implement to achieve successful recovery and operation.
Whenever we make changes to software or hardware, we will create/update and test using our Inventory of Devices/Software Assets and store this checklist in the Security Documentation Library.
XXX. Network Attached Storage and Workstation Backup Plan A. Overview
Virtrurecognizes that the backup and maintenance of data in the Network Attached Storage (NAS) and individual workstations are critical to operations. It is essential that certain basic standard practices be followed to ensure that data files are backed up on a regular basis.
B. Policy
Virtruwill be using a Synology DS1515+ Network Attached Storage for backing up all workstations, firewall logs, and video surveillance footage. This data will also be backed up to a Amazon Web Services Glacier account.
C. Backup software
Virtruuses Cloud Station software to perform all backups. This will be installed on all workstations and must not be disabled by the user for more than one (1) business day.
The software will maintain one month of file versions for restoring purposes D. Remote backups
Virtruwill provide a Virtual Private Network (VPN) for employees to login to for backing up their devices. Credentials for the VPM will be provided to remote employees, and they will be expected to configure their devices properly. If they are unsure, or have issue in setup, the IT department will be available for configuration assistance.
E. Local backups
Virtruencourages all users to do daily local backups of their data. These backups are to be encrypted using the encryption standards listed below. Any local backups must be surrendered at the time an employee no longer is employed by Virtru.
Rev.2015.8.6
60 Security Policies and Procedures
F. Encryption of backups
The backups of data will be encrypted on the NAS using AES 256 bit encryption. Any local backups that employees make must be encrypted at a minimum of 256 bit encryption.
G. Restoring data
In the event that a workstation fails, is stolen, or is damaged whether physically or by malware. It is the policy of Virtruthat this device will be replaced within 24 hours. The IT department will be responsible for reprovisioning this device, and testing that the workstation is functioning properly before giving the device to the employee.
H. Enforcement
Anyone found to have violated this policy may be subject to disciplinary action, up to and including suspension of access to technology resources or termination of employment. A violation of this policy by a temporary worker, contractor or vendor may result in action up to and including termination of their contract or assignment with Virtru.
XXXI. Information Integrity Management Policy
A. Overview
The other policies in this document contribute to the integrity of the data in our systems. Notably, the Data Backup Plan, the Access Control Policy, and the Malware Management Policy contribute to data integrity. In addition to these, we add the following policy elements.
B. Policy
Virtruwill configure our applications software to use the available edits on data that is entered into our systems. These edits will check for internal data consistency, reasonableness of data, and logical relations among data items.
XXXII. Security Incident Management Policy
A. Overview
Virtrurecognizes that, despite having reasonable security safeguards, we may have security incidents.
B. Procedures
To manage these incidents, Virtruwill do the following:
Rev.2015.8.6
61 Security Policies and Procedures
1. We will train each workforce member to recognize the common telltale signs of a security incident. When a member of the workforce detects one of these signs, he/she will be responsible for notifying the ISO.
2. The ISO will maintain a set of tests to detect events in the system logs that may indicate security incidents. These tests will be written into a script and run against the system log on a daily basis or whenever needed. The tests currently are:
a) Account creation/deletion
b) High volume of unsuccessful logon attempts
c) Alerts from our malware monitoring systems
d) High volume of file or database access/creation/deletion activity for the time of day, or for day of the week
e) Account activity at unusual times of the day or night f) Absence of expected log records of activity when expected g) Unusual level of record access for a given account
h) Daily logs will be tested by the firewall in real time, i) User data will be reviewed weekly
j) Logs for the past month will be retained. When anomalies are discovered, the script will provide a report that is immediately brought to the attention of the ISO or designee as a potential security incident. k) Account lock out due to excessive password retry failure.
The ISO will determine, in consultation with others if needed, whether an event is a security incident.
If an event is a security incident, the ISO (or designee) will proceed to contain and repair damage from the incident by working with staff, vendors, and Business Associates as needed. The security incident will be tracked in JIRA and treated as an application defect. A log of relevant actions taken to contain and repair the damage will be stored in JIRA. The permanent home of this log will be in the Security Documentation Library. The ISO will determine if the event involves a workforce member action that is covered under the sanction policy and will follow that policy. The ISO will determine if the event represents a security incident for which a Business Associate is responsible. If so, the ISO will follow our Incident and Breach Policy in this area.
Rev.2015.8.6
62 Security Policies and Procedures
C. Policy
If an event is a security incident, the ISO (or designee) will proceed to contain and repair damage from the incident by working with staff, vendors, and Business Associate relations in order to further deter future incidents of the same type.
XXXIII. Security Plan Review Policy
A. Overview
We recognize that our underlying security risk will change and our ability to manage this risk will improve over time. To ensure that we adjust our policies and procedures to take these two factors into account, we will review our Security Policies and Procedures annually. The ISO will lead this review and involve others as needed.
Documentation of the review will be contained in a document called Annual Security Review and restored in the Security Documentation Library{or Notebook}.
B. Procedures
At a minimum, the review process will consist of:
1. Evaluating changes in the last year that may affect our Security Policy. These will include changes in:
a) Number, sizes or locations of our business sites
b) Our workforce size and composition
c) Hardware/software
d) State or federal laws that apply to us
e) Type of medical insurance that we provide
2. Reading each Policy to determine whether or not the changes may affect it and/or the practices driven by the Policy. We will make a list of changes that need to be made, then write a paragraph describing how.
3. Creating a list of changes in Policies and/or Procedures that our Company will carry out.
4. Developing and implementing any changes in our Policies and Procedures on a timely basis.
Rev.2015.8.6
63 Security Policies and Procedures
Rev.2015.8.6
64 Security Policies and Procedures
Appendices
Rev.2015.8.6
65 Security Policies and Procedures
A. Change Logs
The Change Logs are logs and reports that are reviewed, at a minimum, twice a year. It provides information on programs available and which employees have access to which programs. The actual logs are found in the Change Control Logs for Securitysection of the documents.
1. Annual Security Review
2. Application/Database Change
3. Employee Access
4. Incident ‐ Disaster
5. Maintenance
6. Media Sanitization
7. Operating System Changes Audit
8. Organizational Chart/Electronic Asset Management
9. Network Change
10. Physical Entry Access
11. Responsibility Change
Rev.2015.8.6
66 Disaster Recovery Plan for Virtru
We define a disaster as any event that affects our information systems and, as a result, substantially interferes with the operations of our business. Examples are fire, flood, hardware failure of critical elements (servers), software failures, theft, chemical/radiation hazard, and sabotage. Our definition of recovering from a disaster is taking all the actions needed to restore the systems to their normal operational state. Our plan to recover from disasters is described below.
1. What we will do to prepare to perform a disaster recovery:
A. We will train the workforce to recognize and report a disaster.
B. We will organize the workforce responsibilities so that during a recovery we are not dependent on only one person for any critical step.
C. We will report disasters to the ISO and AISO. The ISO will make the formal determination as to whether or not to classify the event as a disaster.
D. We will store paper backup copies of key disaster related documents with the offsite backups. These documents will include a List of Support Contacts – vendor, reseller, and/or support group contact information for all of our software and hardware.
E. We will keep an Inventory of Device/Software Assets for [Name of Business]–– a detailed checklist for each asset, such as the server, PCs, the router, network switch, databases, and software programs containing tasks that must be completed to recover that asset. The list will include key data about the device including a party responsible for the recovery whose role is to diagnose and, if needed, repair, replace, and/or rebuild a device.
F. We will have current copies of system data and software available at the off site location, as our data backup plan specifies. 1 2. Once the ISO (or designee) has certified a disaster, we will:
A. Use the ISO or designee to facilitate the recovery. The facilitator will direct the recovery process, coordination and communication of the actions of the various parties that are involved in the recovery.
B. Determine which devices/software (e.g. servers, PCs, power units, AC units) are not functioning normally, conferring with the appropriate staff, vendors, and other support personnel to make this determination. When in doubt about the status of the device, we will either use a test that is described in the IT Assets Recovery Checklist for the device/system or depend on the recovery responsible party to make this determination.
C. Review the Inventory of Device/Software Assets for the devices to be recovered. Each checklist will have as an initial task, “Contact the appropriate parties responsible for restoring the devices/software to be recovered.“ Guidance and other recovery activities from these parties are key contributors to the recovery process.
D. After all of the non‐functioning assets have been restored, follow the instructions in the part of the Emergency Operations Plan that deals with what to do when the system is available again.
2 Organization
Emergency Planning & Crisis Management Team (EPCMT):
● Will Ackerly, CTO & ISO
● Jordan Duggan, VP of Product & Development & AISO
● Reuven Gonzales, Director of Operations
● Conor Gilsenan, Operations Developer
● Zack Nelson, Director of Development
Primary Disaster coordination handled through:
Crisis Manager 1:
Reuven Gonzales, Director of Operations
Cell: (949) 878‐6154
[email protected]
Crisis Manager 2:
Conor Gilsenan, Operations Developer
Cell: 973‐986‐6650
[email protected]
Other Members’ Contact Information
● Zack Nelson 443‐834‐3791
● Payam Abedi 703‐656‐6227
● Tyler Biscoe 301‐642‐8844
● Jon Gilpen 303‐358‐6689
● Jason Ghent 803‐658‐6645
OffSite Meeting Location
Used if team needs to meet to formulate an action plan.
If primary location is not accessible, we may need to operate from an of site locations such as:
Employees’ Home Offices
Jack Rose Restaurant
Extended off‐site locations will be determined after assessing the severity of the disaster.
3 Disaster Recovery Timeframes
Maximum Tolerable Downtime (MTD)
The total amount of time our company is willing to accept for an outage or disruption, including all impact considerations. This guides our Crisis Management Team in determining the selection of an appropriate recovery method, and the depth of detail which will be required when developing recovery procedures, including their scope and content.
Recovery Point Objective (RPO)
This is the point in time, prior to a disaster or disruptive event, which our company has accepted for data loss. RPO determines the frequency of our data backups. When determining RPO, we need to consider how much newly entered data we can afford to lose. Therefore, if RPO is set to 4 hours, then we must have of site backups maintained every 4 hours.
Recovery Time Objective (RTO)
RTO determines the target time for recommencement of business activity. The Crisis Management Team will determine what business functions (i.e. telecommunications, web servers, etc.) should be restored based on priority.
Working Recovery Time (WRT)
This is the time our company will spend recovering lost data and work backlog, and testing and verifying data and systems. WRT usually is the difference between MTD and RTO.
4 (See next page)
5 Disaster Timeframe Expectations
Internal Network
The server and network must be functioning in order for any of our other information systems to function. We could afford to be without the server/network for ten (10) minutes without materially affecting our business. If the server/network is down for longer than ten (10) minutes, staff will switch over the mobile tethering, or will go to an approved location to continue their work.
Production Servers
Production servers must be functioning at all times in order for our applications to work. We cannot afford to be without the production servers without materially affecting our business. Traffic will be automatically routed to another server via Amazon Web Services’ Elastic Load Balancing.
Workstations
If a workstation crashes, we can easily use another one with only modest inconvenience. Ideally, we would like to replace/restore a workstation within 72 hours.
Printer and Fax
We have two multifunction printers. We can lose all printers for up to a week with little effect on data flow.
Email and Web Browser
Currently, we can function for no more than 10 minutes without email or web browsing. We will tether devices via smartphones after that time.
Wireless Network
We have a wireless network and the office depends on it for routine transactions. A backup router is available; it is preconfigured and encrypted using WPA2‐AES.
IT Resources
We depend on the availability of certain employees and our IT service provider to diagnose and fix problems quickly. A chain of contacts is available in this document.
Power and HVAC Equipment
We depend on external power and environmental equipment (especially our AC unit) to maintain the power and environmental support for our system. Failure of either of these systems could inhibit the use of our IT systems, and could also stop us from doing business. These failures are not IT‐specific risks. We are comfortable enough with the track record of these services not to need more than a short term UPS to allow us to smoothly shut the network down in the event of a sustained power outage. We have to yearly revisit the question of whether or not we need 6 more power/environmental backup to ensure that the satellite site will able to operate even if power/cooling at the main site is out.
7 Disaster Timeframes Table
{This is a sample. Please fill in according to Virtru’s standards. Functions can include departments, as listed below, or they can include more specific tasks, such as invoicing.}
Minor Disaster Major Disaster
Function MTD RTO WRT RPO MTD RTO WRT RPO
Physical Security
(office/suite)
1 hour 30 minutes 30 minutes 4 hours 1 hour 30 minutes 30 minutes 4 hours IT (server, hardware,
equipment)
Sales and Marketing
Administration
HR
8 EVACUATION PLAN ‐ during business hours:
For a disaster where you will need to leave the building:
If a disaster happens during normal business hours all Company employees will meet at Jack Rose Restaurant, 2007 18th St NW, Washington, DC 20009.
This will prevent Company employees from being in the way of emergency crews. A head count by managers will determine if all staff members have fully exited the building.
Headcount numbers will be brought to the ISO or CEO.
If the disaster happens after the meeting location has closed, employees will wait outside of the same address.
For a disaster where you will need to stay in the building:
If a disaster happens during normal business hours, all Company employees will meet in the Basement. A head count will determine if all staff members have fully exited the suite. See above for head count procedures. {Please fill in the appropriate personnel for the following responsibilities} Office/Evacuation Managers Assembly Managers
Will Ackerly John Ackerly
John Ackerly as Backup Will Ackerly as Backup
System Shutdown Manager Back‐up System Shutdown Manager Jordan Duggan Jordan Duggan
Will Ackerly as Backup Will Ackerly as Backup
9 Critical Operation Priority List
If or when a disaster happens, certain contacts will need to be made.
Operation Employee in Charge Action Plan
Current enrollment
processes (any
pending business)
Will Ackerly
Notify carriers of current situation—give cell
number if needed.
Communications Will Ackerly eBlast to client list
IT—phones, faxes,
e‐mail
John Ackerly Set up remote office
Payroll‐Banking
issues‐Commissions
John Ackerly
Notify payroll/banking institutions of disaster
and action plan
10 Potential Purchase List
If or when a disaster happens, certain items may need to be replaced:
1. 3 UPS (Uninterruptible Power Supply)(s)(Batteries)
2. Network Attached Storage (NAS)
3. Network Switch(s)
4. Network cable(s)
5. Power cable(s)
6. Power strip(s)
7. Monitor(s) / Monitor Cable(s)
8. Keyboard(s) / Mouse(s)
9. Firewall
10. Workstation(s) / Laptop(s)
11. Phone(s) & Headsets
12. Security Camera
13. Electronic Door Lock
14. Video Conference Microphones
15. Minifridge
16. Projector
17. Software
a. OSX
b. Windows
c. Acrobat
d. Office Suite
18. Paper
a. Printer paper
b. Sticky notes
c. New Checks
19. Multifunction Color Printer
20. Office Furniture/Equipment
21. Carrier (Marketing) Supplies
22. Office Supplies
11 Fire Plan
12 EVACUATION PLAN ‐ FIRE!
If the fire alarm goes off during business hours, evacuate the building immediately. If you discover a fire or smell heavy smoke inside building:
DO NOT ATTEMPT TO FIGHT THE FIRE!!
1. Pull fire alarm, evacuate the building and call 911 on the way out of the building
2. Perform head count at the designated assembly point
○ If anyone is missing, call their emergency contacts to determine if the missing individual has made contact with them. If they have not, alert the authorities.
3. Action Plan ‐ developed by EPCMT
○ Re‐open based on damage
○ If the office must remain closed:
■ Notify employees and/or employees emergency contacts. ■ If there is any impact to customer operations, email all clients with a status update and recovery plan.
NOTE: First Aid kit located in the drawer of the white cabinet located to the right of the spiral staircase.
13 Earthquake Plan
14 EVACUATION PLAN ‐ Earthquake!
During an Earthquake
● DO NOT USE THE ELEVATOR DURING AN EMERGENCY EVACUATION. ● If you're indoors, stay there. Get under ‐‐ and hold onto ‐‐a desk or table, or stand against an interior wall. Stay clear of exterior walls, glass, heavy furniture, fireplaces and appliances. The kitchen is a particularly dangerous spot. If you’re in an office building, stay away from windows and outside walls and do not use the elevator.
● If you're outside, get into the open. Stay clear of buildings, power lines or anything else that could fall on you.
After an Earthquake
● Perform head count at the designated assembly point
○ If anyone is missing, call their emergency contacts to determine if the missing individual has made contact with them. If they have not, alert the authorities.
● Shut down systems, if time permits, see Emergency Shutdown Procedures ○ Check for fire or fire hazards. If you smell gas, shut off the main gas valve. If there's evidence of damage to electrical wiring, shut off the power at the control box.
○ If the phone is working, only use it in case of emergency. Likewise, avoid driving if possible to keep the streets clear for emergency vehicles.
15 ○ Be aware that items may fall out of cupboards or closets when the door is opened, and also that chimneys can be weakened and fall with a touch. Check for cracks and damage to the roof and foundation of your home.
○ Listen to the radio for important information and instructions.
Remember that aftershocks, sometimes large enough to cause damage in their own right, generally follow large quakes.
○ If you leave home, leave a message telling friends and family your location.
● Action Plan ‐ developed by EPCMT
○ Re‐open based on damage
○ If the office must remain closed:
■ Notify employees and/or employees emergency contacts. ■ If there is any impact to customer operations, email all clients with a status update and recovery plan.
NOTE: First Aid kit located in the drawer of the white cabinet located to the right of the spiral staircase.
16 Tornado Plan
17 EVACUATION PLAN ‐ Tornado!
If the city or county signal a tornado warning, move away from the perimeter of the building and any exterior glass.
DO NOT USE ANY ELEVATORS DURING AN EMERGENCY EVACUATION.
1. Move to the basement of the office suite.
2. Shutdown systems, if time permits, see Emergency Shutdown Procedures
3. Perform head count at the designated assembly point
○ If anyone is missing, call their emergency contacts to determine if the missing individual has made contact with them. If they have not, alert the authorities.
4. Action Plan ‐ developed by EPCMT
○ Re‐open based on damage
○ If the office must remain closed:
■ Notify employees and/or employees emergency contacts. ■ If there is any impact to customer operations, email all clients with a status update and recovery plan.
NOTE: First Aid kit located in the drawer of the white cabinet located to the right of the spiral staircase.
18 Flood Plan
19 EVACUATION PLAN ‐ Flood!
1. Evaluate the situation
○ Shutdown systems routine, see Emergency Shutdown Procedures ○ Perform head count
■ If anyone is missing, call their emergency contacts to determine if the missing individual has made contact with them. If they have not, alert the authorities.
2. Action Plan ‐ developed by EPCMT
○ Remain open ‐ based on damage or location
■ Relocate staff within suite
■ Evaluate IT requirements
○ Close ‐ send staff home
■ Re‐open based on damage
■ If the office must remain closed:
● Notify employees and/or employees emergency
contacts.
● If there is any impact to customer operations, email all clients with a status update and recovery plan.
20 After Hours Plan
21 EVACUATION PLAN ‐ after business hours
If the building is in a disastrous state after working hours, the EPCMTwill notify employees. See Virtru Phone Tree.
If reopeningon a workday at the primary location:
1. Verify location is safe for operations ‐ including systems
2. Communications
a. Emergency Contact List
b. Client Blast
If NOTreopeningon the following workday at the primary location:
1. The EPCMTmust decide estimated length of time we will not be able to function
a. If less than or equal to one day, office is closed.
i. [Name of Business] will open the following work day ii. Verify location is safe for operations
iii. Communications
1. Emergency Contact List
2. Client Blast
2. If office needs to move to secondary location or close for a shortperiod of time.
a. The EPCMTmeets to develop a plan of action
b. Determine the validity of systems
i. If valid, move critical systems to secondary location ii. If not valid, retrieve necessary items and contact suppliers for new systems
1. Restore systems from backups
2. Restore connectivity
a. Skeleton crew of selected staff members
(possibly several from each department)
22 c. Communications
i. Emergency Contact List
ii. Client Blast
3. If office needs to move to secondary location or close for a longer period
of time:
a.The EPCMTmeets to develop a plan of action
b. Determine the validity of Systems
i. If valid, move critical systems to secondary location ii. If not valid, retrieve necessary items and contact suppliers for new systems
1. Restore systems from backups
2. Restore connectivity
ii. Determine staff needs ‐ full or partial capacity
iii. Communications
1. Emergency Contact List
2. Client Blast
23 Emergency Contact List
24 Emergency Shutdown
Procedures
26 If an electrocution occurs while working in server room, staff will pull all of the UPS cords from the outlet by the interior door. If that outlet is inaccessible due to fire or victim’s position, staff will shut off the power at the breaker, located in the basement on the wall to the left of the TV.
If there is a fire within the building or suite, staff should concentrate on notifying authorities.
If there is severe flooding that threatens to affect the server room, staff will shutdown and unplug all equipment and move it to the second story platform of the suite.
27 March 10, 2016
State of Utah Division of Purchasing
3150 State Office Building
Capitol Hill
Salt Lake City, Utah 84114
Mr. Hughes:
As a privately owned company, Carahsoft Technology Corp. does not report to D&B. As such, the information in D&B is incorrect. To support you to determine that we have the financial resource to perform the contract we provide you the following information.
We are a stable, conservative and profitable company. Carahsoft continues to grow as noted by our year over year revenue below:
2010 $820 Million
2011 $1.12 Billion
2012 $1.46 Billion
2013 $1.81 Billion
2014 $2.45 Billion
2015 $3 Billion
We currently employ close to 500 employees.
To support you to determine that we have the financial resource to perform the contract we provide you the following information:
We maintain a $25M line of credit available (currently 100% available) with Xenith Bank. I have included a recent banking clarification letter from Xenith.
Mr. Joe Humphries is the Regional President and can be reached at 703-869-3610 if you need any information from him.
We have received numerous accolades including:
For the 6th consecutive year CRN’s 2012 Fast Growth List Washington Business Journal’s 2012 List of Largest Government Contractors in Metro DC Third consecutive year Washington SmartCEO magazine’s 2012 Future 50 list which recognizes the metro areas fastest growing companies.
Should you require additional details please call me and I can discuss our confidential financial information with you or provide you trade references that can further assist you.
Sincerely,
Jillian Dewey Szczepanek
Controller
3/1/2016 A0Docs Terms of Service- Version published on the Web Site https://docs.google.com/document/d/176pdFCOVCRYHpWwVeStsol1fA-6KLQe6x4nQlxky24/pub 1/7 AODocs Terms of Service - Version published on the Web Site
TERMS OF SERVICE
These Terms of Service ("Terms") are a legal agreement between Altirnao, Inc., herein "Altirnao", having an office and place of business at 221 Kearny Street, Suite 300, San Francisco, CA 94108, USA, and the person or entity agreeing to the terms herein ("Customer", "You" or "you"). By using or accessing any part of A0Docs (the "Service"), You agree that You have read, understand, and agree to be bound by all of the terms and conditions contained herein. If You do not agree to these Terms, You must not use or access the Service. If You are entering into this Terms on behalf of a company, You represent that You have the authority to bind that company to these Terms. If You have purchased a license to use A0Docs through an Altirnao reseller, You also agrees to comply with the terms of any agreement between You and such reseller. In the event of an inconsistency between these Terms and any such reseller agreements, these Terms shall control.
Description of Service
AODocs is an online document management solution for Google Apps. The Service is offered and provided subject to these Terms and solely for Your business purposes. You may connect to the Service using any Internet browser supported by the Service.
The Service requires one or more Google Apps for Business account that will be the owner(s) of all files stored and managed by the Service. The Service stores all the files that it stores and manages for You in the Google Drive account(s) that You will assign to AODocs when You deploy AODocs. You understand and acknowledge that You are solely responsible for obtaining the Internet access and all equipment necessary to use the Service, for appropriately configuring Your Google Apps account(s) and for allocating a sufficient number of accounts and sufficient Google Drive storage space to allow proper operation of the Service, as per the recommendation of Altirnao's technical support or product documentation. You also understand and agree that content you store through your use of the Service will be made available to Google as part of Google providing the Google Apps service. All fees associated with the foregoing shall be paid by You.
Modifications
To these Terms: Altirnao reserves the right to update and change the Terms of Service upon notice from time to time. You will be provided notice of any such modification by electronic mail or by the publishing of such on the website http://www.aodocs .com/terms-of-service . You may terminate your use of the Service if the Terms are modified in a manner that substantially affects your rights in connection with use of the Service. Your continued use of the Service after any such changes shall constitute your consent to such changes. You can review the most current version of the Terms of Service at any time at http://www.aodocs.com/terms -of-service .
To the Service: Altirnao may make changes to the Service from time to time. Altirnao will notify you of any material changes or modifications. Any updates, upgrades, additions or new features to the Service, including the release of new tools and resources, shall be subject to these Terms and may require you to agree to additional terms and conditions.
Attachment E
3/1/2016 A0Docs Terms of Service- Version published on the Web Site https://docs.google.com/document/d/176pdFCOVCRYHpWwVeStsol1fA-6KLQe6x4nQlxky24/pub 2/7 Use of the Service
Access to Service: Access to the Service is only available to the Customer and the end users ("Users") to whom Customer has purchased individual user licenses and granted access.
Upon registration with Altirnao, Customer will specify the email address of a Google Apps account (the "Account"), which will be granted access to the Service. Customer is solely responsible for granting the Service access to Customer's Google Apps files and revoking such access when Customer ceases use of the Service. Customer is responsible for maintaining the confidentiality of Customer's password. Customer agrees not to share its password with anyone other than Users, let anyone else access its password or do anything else that might jeopardize the security of its password. Customer agrees to notify Altirnao if Customer's password is lost, stolen or disclosed to an unauthorized third party, if there is any unauthorized use of its password or Account, or if Customer learns of any other breach of security in relation to the Service. Customer is solely responsible for any and all activities that occur through the use of Customer's Account.
License to Customer: Subject to Customer's compliance with these Terms and the Google Acceptable Use Policy (available at https ://cloud.google .com/terms/aup ), including, without limitation, Customer's payment of all applicable fees, Altirnao hereby grants Customer a limited, revocable, non-transferable non-exclusive, non-sublicensable license to access and use the Service, solely for Customer's own internal use, and not for timesharing, application service provider or service bureau use.
Customer is at all times fully responsible and liable for all acts and omissions by Users to whom Customer has granted access to the Service and Customer agrees to indemnify Altirnao for all claims and losses related to any such acts and/or omissions.
Each user license ordered by Customer is specific to the email address of only one User and, once granted to that User, may not be transferred or reassigned to any other user unless the User originally granted the license will no longer use the Service. Any such transfer or reassignment is permanent and Licensee shall not permit the original User to use the Service after such User's license has been used by a different User.
Altirnao reserves the right to terminate unpaid Accounts and Accounts that are inactive for a continuous period of ninety (90) days. In the event of any termination, all data associated with such Account will be deleted and Customer shall be responsible for revoking the Service's access to Customer's Google Apps domain data and files. Altirnao will provide Customer with prior notice of such termination and will send a data backup to Customer by email. In case of Accounts with more than one User, if at least one of the Users is active, the Account will not be considered inactive.
Restrictions on Use
Restrictions on Use of AODocs: In addition to all other terms and conditions contained herein, you shall not and shall not permit others to:
1. copy, modify, adapt, translate or otherwise create derivative works of the Service;
2. reverse engineer, decompile, disassemble or otherwise attempt to discover the source code of the Service;
3. rent, lease, sell, assign or otherwise transfer rights in or to the Service;
4. remove any proprietary notices or labels from the Service;
5. use, post, transmit or introduce any device, software or routine which interferes or 3/1/2016 A0Docs Terms of Service- Version published on the Web Site https://docs.google.com/document/d/176pdFCOVCRYHpWwVeStsol1fA-6KLQe6x4nQlxky24/pub 417 attempts to interfere with the operation of the Service.
6. use the Service for spamming or any other illegal or unauthorized purpose or engage in illegal or deceptive trade practices; or
7. otherwise use of the Service in violation of any laws in your jurisdiction (including but not limited to copyright laws).
8. use the Service for High Risk Activities;
9. process or store any content on or through the Service that is subject to the International Traffic in Arms Regulations maintained by the Department of State.
10. if you are (or become) a Covered Entity or Business Associate, as defined in the Health Insurance Portability and Accountability Act ("HIPAA"), use the Service for any purpose or in any manner involving Protected Health Information (as defined in HIPAA) unless you have received prior written consent to such use from both Google and Altirnao.
11. use the Service as a way to circumvent your obligation to provision one Google Apps End User Account for each User.
This list of prohibitions provides examples and is not complete or exclusive.
Restrictions on Use of Google Apps: You understand and agree that your use of the Service requires the use of Google Apps. You agree that you shall not and shall not permit others to:
copy, modify, create a derivative work of, reverse engineer, decompile, translate, disassemble, or otherwise attempt to extract the source code of Google Apps or any component thereof; use the Google Apps or any component thereof for uses such as the operation of nuclear facilities, air traffic control, or life support systems, where the use or failure of Google Apps or any component thereof could lead to death, personal injury, or environmental damage; sublicense, resell, or distribute Google Apps or any component thereof; use Google Apps or any component thereof to create, train, or improve (directly or indirectly) a substantially similar product or service, including any machine translation engine; access Google Apps or any component thereof in a manner intended to avoid incurring fees; use Google Apps or any component thereof to operate or enable any telecommunications service or in connection with any application that allows end users to place calls to or to receive calls from any public switched telephone network; or
process or store any data that is subject to the International Traffic in Arms Regulations maintained by the U.S Department of State or any other applicable law.
Altirnao reserves the right to suspend or terminate your access to Service with or without cause and with or without notice, for any reason or no reason, or for any action that Altirnao determines is inappropriate or disruptive to the Service or to any other user of this Service.
Google may suspend your Google Apps account if: (a) your use of Google Apps is in violation of Google's Acceptable Use Policy, which could disrupt: (i) Google Apps; (ii) other users' use of Google Apps; or (iii) the Google network or servers used to provide Google Apps services; or
(b) there is unauthorized third party access to Google Apps.
You acknowledge and agree that Altirnao, in its sole discretion, with or without notice, may establish or revise from time to time general practices and limits concerning your use of the 3/1/2016 A0Docs Terms of Service- Version published on the Web Site https://docs.google.com/document/d/176pdFCOVCRYHpWwVeStsol1fA-6KLQe6x4nQlxky24/pub 417 Service, including without limitation, establishing the maximum number of Google Drive operations that can be done on your behalf in a given period of time. In addition, Altirnao may limit, without notice, the volume of e-mail forwarding or file downloading from the Service in response to unreasonable activity (such as spamming).
Altirnao may report to law enforcement authorities any actions that may be illegal, and any reports it receives of such conduct. When legally required or at Altirnao's discretion, Altirnao will cooperate with law enforcement agencies in any investigation of alleged illegal activity associated with the Service or on the Internet.
Unauthorized use of any trademarked, copyrighted or patented materials contained in the Service may violate certain laws and regulations.
You agree to indemnify and hold Altirnao and its officers, directors, employees, affiliates, agents, licensors, and business partners harmless from and against any and all costs, damages, liabilities, and expenses (including attorneys' fees and costs of defense) Altirnao or any other indemnified party suffers in relation to, arising from, or for the purpose of avoiding, any claim or demand from a third party that your use of this Service or the use of Service by any person using your Account (including without limitation, Your Content (as defined below)) violates any applicable law or regulation, or the copyrights, trademark rights or other rights of any third party.
Suspension
Altirnao reserves the right to suspend or terminate Customer's access to the Service with or without notice if Altirnao reasonably determines that:
(a) there is a threat or attack on the Service (including a denial of service attack) or other event that may create a risk to the Service, Altirnao, Customer, or any user of the Service; (b) Customer's or its users' use of the Service or Customer Content disrupts or poses a security risk to the Service or any user of the Service, may harm Altirnao's systems, or may subject Altirnao or any third party to liability;
(c) Customer or any User is using the Service for fraudulent or illegal activities; (d) Customer or any User is causing performance disruptions in the Service or in Google Drive by using the Service in a way that is not recommended in the performance guidelines published in the Service's documentation or by ignoring performance recommendations provided by Altirnao's technical support;
(e) subject to applicable law, Customer has ceased to continue Customer's business in the ordinary course, made an assignment for the benefit of creditors or similar disposition of its assets, or become the subject of any bankruptcy, reorganization, liquidation, dissolution or similar proceeding;
(f) Customer or any User is using the Service or other Altirnao property in breach of this Agreement;
or (g) Customer is in default of its payment obligations hereunder (collectively, "Service Suspensions"). Altirnao will make commercially reasonable efforts, circumstances permitting, to provide written notice of any Service Suspension to Customer, and to provide updates regarding resumption of Customer's access to the Service following any Service Suspension.
Subscription terms
Customer agrees to pay the subscription fee applicable to Customers and its Users use of the Service. Such fees will be paid on a periodic basis as agreed to Altirnao or to your Altirnao reseller as agreed when you registered for the Service. 3/1/2016 A0Docs Terms of Service- Version published on the Web Site https://docs.google.com/document/d/176pdFCOVCRYHpWwVeStsol1fA-6KLQe6x4nQlxky24/pub 517 In case of non-payment for any reason (including, if applicable, Altirnao's inability to charge your credit card or other payment method for any reason) or any violation of these Terms, Altirnao shall be entitled - without liability -to immediately suspend Customer's and Users' access to the Service. If you purchase your license to use the Service from Altirnao, you hereby expressly agree that Altirnao is permitted to bill you for the applicable fees, any applicable tax and any other charges you may incur in connection with your use of the Service, or charge such fees to your credit card or other payment method designated on your initial registration with the Altirnao at regular intervals for the remainder of the term of these Terms. If you cancel your Account at any time, you will not receive any refund.
Customer agrees that Customer's paid use of the Service is neither contingent on the delivery of any future functionality or features nor dependent on any oral or written public or private comments made by Altirnao or any Altirnao reseller regarding future functionality or features.
Intellectual Property
Customer hereby acknowledges and agrees that, subject to the limited rights granted hereunder, Altirnao (or its licensors) own all legal right, title and interest in and to the Service, including, without limitation, any Intellectual Property Rights or other proprietary rights which exist in the Service (whether such rights are registered or unregistered, and wherever in the world those rights may exist) ("Our Technology"). For purposes of these Terms, "Intellectual Property Rights" means, on a worldwide basis, any and all now known or hereafter known (a) rights associated with works of authorship including copyrights and moral rights, (b) trademark and trade name rights and similar rights, (c) trade secret rights, (d) patent rights and other industrial property rights, (e) intellectual and industrial property rights of every other kind and nature and however designated, whether arising by operation of law or otherwise, and (f) all registrations, applications, renewals, extensions, continuations, divisions, or reissues thereof now or hereafter existing, made, or in force (including any rights in any of the foregoing).
Our Technology may not be copied, modified, reproduced, republished, posted, transmitted, sold, offered for sale, or redistributed in any way without our prior written permission and the prior written permission of our applicable licensors. You must abide by all copyright notices, information, or restrictions contained in or attached to any of Our Technology. Nothing in these Terms of Use grants you any right to receive delivery of a copy of Our Technology or to obtain access to Our Technology except as generally and ordinarily permitted through the Service according to these Terms. Furthermore, nothing in these Terms of Use will be deemed to grant, by implication, estoppel or otherwise, a license to Our Technology. Certain of the names, logos, and other materials displayed on the Service constitute trademarks, trade names, service marks or logos ("Marks") of Altirnao or other entities. You are not authorized to use any such Marks.
Ownership of all such Marks and the goodwill associated therewith remains with and will inure to us or those other entities. To the extent indicated, any use of third party software provided in connection with the Service will be governed by such third parties' licenses and not by these Terms of Service. Furthermore, any comments, ideas and/or reports about the Service that you provide to us, whether in written or electronic form ("Feedback"), shall be considered our proprietary and confidential information, and you hereby irrevocably transfer and assign to us all intellectual property rights embodied in or arising in connection with such Feedback, and any other rights or claims that you may have with respect to any such Feedback.
Ownership & Privacy
As between You and Altirnao, you retain all right, title and interest in any and all data, files, attachments, text, images, personally identifiable information, and other content that You and Your Users upload or submit to the Service (collectively, "Your Content"). You may not upload, post or otherwise make available through the Service any material protected by copyright, 3/1/2016 A0Docs Terms of Service- Version published on the Web Site https://docs.google.com/document/d/176pdFCOVCRYHpWwVeStsol1fA-6KLQe6x4nQlxky24/pub 617 trademark, or any other proprietary right -without the express permission of the owner of such copyright, trademark or other proprietary right owned by a third party, and the burden of determining whether any material is protected by any such right is on you. You shall have sole responsibility for the accuracy, quality, integrity, legality, reliability, appropriateness, and intellectual property ownership or right to use any and all of Your Content. You represent and warrant that you have all rights, permissions and consents necessary (a) to make Your Content available on or through the Service, and (b) to grant Altirnao the limited rights to use Your Content set forth in these Terms.
You agree that Altirnao may use Your Content to provide the Service and its features, including by making it available for viewing, download and modification by other Users with access rights to Your Content. You hereby grant Altirnao a non-exclusive, perpetual, royalty-free, worldwide license (including the right to sublicense through multiple tiers) to access, use, reproduce, distribute, store, transmit, modify, adapt, reformat, publicly display, publicly perform and create derivative works of Your Content as required for the purpose of providing the Service to you.
You understand and agree that Altirnao does not have the ability to grant or revoke the Service's access to Customer's Google Apps domain data and files or other content and materials stored in Customer's Google Apps account. Therefore, You are solely responsible for granting the Service access to such Google Apps files and revoking such access when You cease use of the Service. Altirnao shall not be responsible and shall have no liability for any damages that result from Your failure to grant or revoke such access.
You understand and agree that Altirnao may, notwithstanding any provision of any separate nondisclosure agreement that may have been executed between You and Altirnao, distribute and disclose Your Content (a) to your Users, and (b) to Altirnao's service providers who act on Altirnao's behalf in providing the Service. Altirnao's use of any personally identifiable information you provide through the Service is governed by our Privacy Policy. Your use of the Service indicates your acceptance of the terms of our Privacy Policy. You can review the most recent version of our Privacy Policy at http://www .altirnao .com/pr ivacy-policy/ .
You hereby consent that, if You choose to become a paying customer of the Service, Altirnao may identify You as a Altirnao customer (using Your name and logo) and generally describe the products or services it provides to You in its promotional materials, presentations, and proposals to other current and prospective customers.
If you cancel your Service subscription, your information is no longer used and Altirnao will delete your Account and data associated with your Account within ninety (90) days of your cancellation. Please note, however, that some information like billing and subscription may remain with us for accounting and legal reasons.
Availability.
Altirnao will make the Service available to You in accordance with the Service Level Agreement available online at https://www.aodocs.com/sla (the "SLA"). Altirnao does not make any representations or guarantees regarding uptime or availability of the Service unless specifically identified in the SLA. The Service may be unavailable at certain times as specified in the SLA, including during any unanticipated or unscheduled downtime or unavailability of all or any portion of the Service as a result of system failures or force majeure events.
Warranty Disclaimer
THE SERVICE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY
KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, IMPLIED
WARRANTIES OF TITLE, MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE 3/1/2016 A0Docs Terms of Service- Version published on the Web Site OR NON-INFRINGEMENT. ALTIRNAO MAKES NO WARRANTY THAT (I) THE SERVICE IS FREE OF VIRUSES OR OTHER HARMFUL COMPONENTS; (II) THE SERVICE WILL BE
ERROR-FREE OR UNINTERRUPTED (INCLUDING, WITHOUT LIMITATION,
INTERRUPTIONS THAT OCCUR IN THE CONTEXT OF REGULARLY SCHEDULED MAINTENANCE); (Ill) ANY INFORMATION OR ADVICE OBTAINED BY YOU IN CONNECTION WITH THE SERVICE WILL BE ACCURATE OR COMPLETE; OR (IV) THE RESULTS OF USING THE SERVICE WILL MEET YOUR REQUIREMENTS. SOME STATES
DO NOT ALLOW EXCLUSION OF AN IMPLIED WARRANTY, SO THIS DISCLAIMER MAY NOT APPLY TO CUSTOMER.
Limitation of Liability
IN NO EVENT SHALL ALTIRNAO BE LIABLE FOR ANY CONSEQUENTIAL, INCIDENTAL,
INDIRECT, SPECIAL, PUNITIVE, OR OTHER LOSS OR DAMAGE WHATSOEVER (INCLUDING BUT NOT LIMITED TO LOSS OF DATA, LOSS OF BUSINESS PROFITS,
BUSINESS INTERRUPTION, COMPUTER FAILURE, LOSS OF BUSINESS INFORMATION),
ARISING OUT OF OR CAUSED BY YOUR USE OF OR INABILITY TO USE THE SERVICE, EVEN IF ALTIRNAO HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. YOUR
SOLE AND EXCLUSIVE REMEDY FOR ANY DISPUTE WITH ALTIRNAO RELATED TO ANY OF THE SERVICE SHALL BE TERMINATION OF SUCH SERVICE. IN NO EVENT SHALL
ALTIRNAO'S ENTIRE LIABILITY TO YOU IN RESPECT OF ANY SERVICE, WHETHER DIRECT OR INDIRECT, EXCEED THE FEES PAID BY YOU TOWARDS SUCH SERVICE.
SOME STATES DO NOT ALLOW THE LIMITATION OR EXCLUSION OF LIABILITY FOR
INCIDENTAL OR CONSEQUENTIAL DAMAGES, SO THE LIMITATIONS OR EXCLUSIONS IN THIS PARAGRAPH MAY NOT APPLY TO CUSTOMER.
Other Terms
These Terms, their interpretation, performance or any breach thereof, will be construed in accordance with, and all questions with respect thereto will be determined by, the laws of the State of California. Both parties hereby irrevocably submit any disputes under these Terms to the jurisdiction of the courts located in the State of California.
Last Updated: February 11th, 2016
EAST\53456530.2
PublishedbyGoogleDrive-ReportAbuse-Updatedautomaticallyevery5minutes https://docs.google.com/document/d/176pdFCOVCRYHpWwVeStsol1fA-6KLQe6x4nQlxky24/pub 7/7 Version PS 1.0 Page 1 of 38 7/23/2014 10:36 AM
1. INTRODUCTION
Channel Foundation Agreement
U.S. Public Sector
1.1 This Channel Foundation Agreement (“Foundation Agreement”) specifies the terms and conditions agreed between CA and the Ordering Activity, as defined in GSA Order ADM4800.2G and as revised from time to time (“End User” or “Customer”) as a foundation for their relationship as further defined in the applicable Modules. Ordering Activity understands and agrees that Ordering Activity’s right to use the CA Offerings, ordered by Ordering Activity and submitted to CA by an Authorized CA Partner, is subject to Ordering Activity’s compliance with this Foundation Agreement and the relevant Module for such CA Offering. The Foundation Agreement and the Module(s) incorporated into the GSA Schedule contract for the CA Offering(s) purchased by Ordering Activity will govern orders from an Authorized CA Partner for Ordering Activity’s acquisition of the CA Offering and such terms shall remain binding upon both Ordering Activity and CA for that CA Offering absent mutual written agreement to thecontrary.
1.2 Modules to this Foundation Agreement include the Channel Software Module, , Channel SaaS Module, Channel Hardware Appliance Module, and Channel Education Module.
2. DEFINITION
2.1 “Agreement” means this Foundation Agreement, the applicable Module, and License Metric for the applicable CA Offering, and any document incorporated expressly therein or incorporating the foregoing by reference.
2.2 “Authorized CA Partner” means an entity having a valid, current authorization from CA to market, offer and resell to Ordering Activity the right to use the CA Offering. Ordering Activity may find information regarding authorized CA Partners here:
www.ca.com/partners.
2.3 “CA Offering” means the individual offering (such as software, services, software as a service etc.) made available by CA as defined in the Module and/or, License Metric.
2.4 “Confidential Information" means any information, maintained in confidence by the disclosing Party, communicated in written or oral form, marked as proprietary, confidential or otherwise so identified, that is exempt from disclosure under the Freedom of Information Act (FOIA), 5.U.S.C. §552(b) under one or more exemptions to that Act, and/or any information that by its form, nature, content or mode of transmission would to a reasonable recipient be deemed confidential or proprietary, including, without limitation, CA Offerings, Documentation, and any benchmark data and results produced.
2.5 “Documentation” means the documentation, technical product specifications and/or user manuals, published by CA or any entity within CA group of companies (each a CA entity) that is made generally available with CAOfferings.
2.6 “License Metric” means the specific criteria for measuring the usage of the CA Offering (such as MIPS, CPUs, tiers, servers, or users).
2.7 “Module” means the additional terms and conditions applicable to the CAOffering.
2.8 “Parties” means individually and or collectively CA and or the Ordering Activity.
2.9 “Prime Contractor” means the entity contracting directly with the Ordering Activity, if other than an Authorized CAPartner.
2.10 “Term” means the period for which Ordering Activity is authorized to use the CA Offering as specified in CA’s order with Ordering Activity’s chosen Authorized CA Partner or the Prime Contractor.
3. ORDERING AND DELIVERY
3.1 This Agreement applies to each specific CA Offering purchased by Ordering Activity from an Authorized CA Partner or Prime Contractor. Use of the CA Offerings, or of this Agreement to procure CA Offerings, by Ordering Activity’s Affiliates outside of the jurisdiction specified for Ordering Activity in the order between CA and the Authorized CA Partner or Prime Contractor is not permitted unless such Affiliate signs a participation agreement with CA to adopt and adhere to the terms of thisAgreement.
3.2 CA will deliver or make available a CA Offering to Ordering Activity only upon, and in accordance with, CA’s execution of an order with the Authorized CA Partner. Any terms that may appear on an Ordering Activity’s purchase order (including without limitation pre-printed terms), or as part of Ordering Activity’s order with an Authorized CA Partner or Prime Contractor, that conflict or vary from the terms and conditions of this Agreement shall not apply to CA and shall be deemed null and void unless otherwise required by law.
Version PS 1.0 Page 2 of 38 7/23/2014 10:36 AM
3.3 The CA Offering will be delivered by CA to Ordering Activity either by electronic delivery (ESD) or in tangible media in accordance with the terms of the GSA Schedule contract and the relevant purchase order. CA agrees to be responsible for all customs duties and clearances.
4. CONFIDENTIAL INFORMATION
4.1 The Parties agree that when receiving Confidential Information from the disclosing Party, that the receiving Party shall hold it in confidence and shall not disclose or use such information except as permitted under the Agreement. The receiving Party shall treat the disclosing Party’s Confidential Information confidentially and in the same manner as it treats its own proprietary and/or confidential information, which shall not be less than a reasonable standard of care, and the receiving Party shall use Confidential Information only for the purposes described in the Agreement. Confidential Information may be disclosed to receiving Party’s employees, agents, financial advisors, contractors and attorneys on a need-to know basis and the receiving Party shall ensure that such persons maintain such Confidential Information pursuant to the terms of the Agreement.
4.2 The receiving Party shall be permitted to disclose Confidential Information in connection with a judicial or administrative proceeding to the extent that such disclosure is required under applicable law or court order, provided that the receiving Party shall, where reasonably possible, give the disclosing Party prompt and timely written notice of any such proceeding and shall offer reasonable cooperation in any effort of the disclosing Party to obtain a protective order.
4.3 For the purposes of the Agreement, Confidential Information shall exclude: (i) information which the receiving Party has been authorized in writing by the disclosing Party to disclose without restriction; (ii) information which was rightfully in the receiving Party’s possession or rightfully known to it prior to receipt of such information from the disclosing Party; (iii) information which was rightfully disclosed to the receiving Party by a third Party having proper possession of such information, without restriction; (iv) information which is part of or enters the public domain without any breach of the obligations of confidentiality by the receiving Party; and (v) information which is independently developed by the receiving Party without use or reference to the disclosing Party’s Confidential Information.
4.4 Nothing in the Agreement will (i) preclude CA from using the ideas, concepts and know-how which are developed in the course of providing any CA Offerings to Ordering Activity or (ii) be deemed to limit CA’s rights to provide similar CA Offerings to other customers. Ordering Activity agrees that CA may use any feedback provided by Ordering Activity related to any CA Offering for any CA business purpose, without requiring consent including reproduction and preparation of derivative works based upon such feedback, as well as distribution of such derivative works.
4.5 To the extent permitted by the Federal Records Act, the receiving Party agrees, upon request of the disclosing party, to return to the disclosing Party all Confidential Information in its possession or certify the destruction thereof.
4.6 For CA software (including code) and Documentation, and Ordering Activity’s and/or CA’s Confidential Information expressly designated in writing as perpetually confidential, the obligations of this section are perpetual and shall survive termination. For all other Confidential Information, the foregoing obligations shall extend for five (5) years from the date of initialdisclosure.
5. FEES
5.1 The Parties acknowledge and agree that all terms governing the fees, payments, payment schedules, pricing and discounts for the applicable CA Offering procured by Ordering Activity under this Agreement are and shall be between solely Ordering Activity and their chosen Authorized CA Partner or Prime Contractor.
6. TITLE
6.1 CA retains all right, title, copyright, patent, trademark, trade secret and all other proprietary interests to all CA Offerings and any derivatives thereof. No title, copyright, patent, trademark, trade secret or other right of intellectual property not expressly granted under the Agreement is exchanged between the Parties.
7. WARRANTY
7.1 Each Party represents and warrants that it has the legal power to enter into the Agreement.
7.2 CA represents and warrants that it owns or otherwise has sufficient rights to grant Ordering Activity the rights defined in the Agreement.
8. INDEMNIFICATION
8.1 CA will indemnify any third party claims that Ordering Activity’s use of the specific CA Offering licensed or purchased by Ordering Activity under this Agreement infringes any valid US patent or copyright within the jurisdictions where Ordering Activity is authorized to use the CA Offering at the time of delivery. CA may, at its option and expense: (i) procure for Ordering Activity the Version PS 1.0 Page 3 of 38 7/23/2014 10:36 AM
right to continue to use the CA Offering; (ii) repair, modify or replace the CA Offering so that it is no longer infringing; or (iii) provide a pro-rated refund to the Authorized CA Partner of the fees paid for the CA Offering which gave rise to the indemnity calculated against the remainder of the Term from the date it is established that CA is notified of the third party claim. If the CA Offering is CA Software, and is licensed on a perpetual basis, an amortization schedule of three (3) years shall be used for the basis of the refund calculation.
8.2 CA shall have no liability: (i) in the event the allegation of infringement is a result of a modification of the CA Offering except a modification by CA, (ii) if the CA Offering is not being used in accordance with CA’s specifications, related documentation and guidelines, (iii) if the alleged infringement would be avoided or otherwise eliminated by the use of a CA published update or patch, (iv) if the alleged infringement is a result of use of the CA Offerings in combination with any third party product, or (v) if the applicable fees due for the specific CA Offering have not been paid by Ordering Activity or Prime Contractor to its Authorized CA Partner. The indemnifications contained herein shall not apply and CA shall have no liability in relation to any CA Offering produced by CA at the specific direction of Ordering Activity. THE FOREGOING PROVISIONS STATE THE ENTIRE LIABILITY AND OBLIGATIONS OF
CA REGARDING CLAIMS OF INFRINGEMENT, AND THE EXCLUSIVE REMEDY AVAILABLE TO ORDERING ACTIVITY WITH RESPECT TO
ANY ACTUAL OR ALLEGED INFRINGEMENT OR MISAPPROPRIATION OF ANY INTELLECTUAL PROPERTY OR OTHER PROPRIETARY RIGHTS.
8.3 CA shall indemnify Ordering Activity against all damages, fees, (including reasonable attorney’s fees) fines, judgments, costs and expenses finally awarded as a result of a third party action alleging a bodily injury or death which arises under the Agreement, provided that such liabilities are the proximate result of gross negligence or intentional tortuous conduct on the part ofCA.
8.4 The above indemnities are contingent upon: (i) Ordering Activity providing prompt notice of any claim of infringement and assistance in the defense thereof, (ii) CA’s right to consult with Ordering Activity at any time and to intervene in the proceedings through CA’s chosen counsel at CA’s expense, provided that Ordering Activity shall not have the right to settle any claim requiringCA to make a payment or to admit liability without CA’s prior written agreement , and (iii) Ordering Activity not taking any actions or failing to take actions that hinder the defense or settlement process.
9. LIMITATION OF LIABILITY
EXCEPT IN THE CASE OF A BREACH OF TITLE, INFRINGMENT OF CA’S INTELLECTUAL PROPERTY RIGHTS OR CONFIDENTIALITY, OR OF THIRD
PARTY CLAIMS ARISING UNDER THE INDEMNIFICATION SECTION, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW NEITHER PARTY (INCLUDING ANY OF CA’S SUPPLIERS) SHALL BE LIABLE FOR A) ANY INDIRECT, SPECIAL, CONSEQUENTIAL, INCIDENTAL, OR PUNITIVE
DAMAGES OF ANY NATURE, INCLUDING, BUT NOT NECESSARILY LIMITED TO, LOSS OF PROFIT, DAMAGES RELATING TO MONIES SAVED OR
FEES GENERATED AND OR ANY LOSS OF DATA BY USE OF ANY CA OFFERING, REGARDLESS OF WHETHER A PARTY WAS APPRISED OF THE POTENTIAL FOR SUCH DAMAGES; AND B) IN NO EVENT WILL A PARTY’S LIABILITY, EXCEED THE FEES PAID AND OR OWED TO CA FOR THE
THEN CURRENT INITIAL OR RENEWAL TERM FOR WHICH THE ORDERING ACTIVITY HAS PROCURED THE CA OFFERING OR AS FURTHER DEFINED IN THE MODULE. FURTHERMORE, TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, CA SHALL NOT INCUR ANY
LIABILITY FOR DEATH OR BODILY INJURY TO ANY THIRD PARTY UNLESS THE SAME ARISES FROM THE INTENTIONAL OR GROSSLY NEGLIGENT ACT(S) OF CA. This clause shall not impair the U.S. Government’s right to recover for fraud or crimes arising out of or related to this Agreement under any federal fraud statute, including the False Claims Act, 31 U.S.C. §§ 3729-3733.
10. TERM & TERMINATION
10.1 This Foundation Agreement shall continue in effect unless otherwise terminated in accordance with this section or as required pursuant to Federal Acquisition Regulation (FAR) 52.212-4 “Contract Terms and Conditions- Commercial Items” sections (l) “Termination for the Government’s Convenience” and (m) “Termination for Cause.”
10.2 In the event Ordering Activity elects to terminate an order for its convenience prior to the expiration of the then current term, and such order includes licenses for CA Software, Ordering Activity shall also, within a reasonable period of time, delete all copies of such software from its systems, including copies stored for archival purposes and either destroy or return them to CA. The foregoingshall not apply, however, where such licenses were perpetual and Ordering Activity, at the time of such termination, has paid all associated perpetual license fees.
10.3 Termination does not release either Party from any liability which, at the time of such termination, had already accrued to the other Party or which is attributable to a period prior to such termination, nor preclude either Party from pursuing any rights or remedies it may have under law or in equity with respect to any breach of this Foundation Agreement or the Agreement.
11. DISPUTE RESOLUTION
11.1 Prior to the initiation of formal dispute resolution procedures regarding any dispute, controversy, or claim arising out of the Agreement or interpretation thereof (a “Dispute”), the Parties shall first meet as often, and for such duration and as promptly as the Parties reasonably deem necessary to discuss the Dispute and negotiate in good faith in an effort to resolve it.
Version PS 1.0 Page 4 of 38 7/23/2014 10:36 AM
11.2 The provisions of paragraph 11.1 will not be construed to prevent a Party from instituting formal proceedings to the extent necessary to avoid the expiration of any applicable limitations period or to pursue equitable rights or injunctive remedies deemed reasonable necessary to protect its interests.
11.3 Disputes relating to the payments of fees, any third party products or services or otherwise relating to the terms and conditions of an order between an Authorized CA Partner and Ordering Activity, shall be between Ordering Activity and such Authorized CA Partner, or if applicable, between Ordering Activity and Prime Contractor, and Ordering Activity agrees that it shall have no right of contribution or other claim from or against CA by reason thereof.
12. GENERAL TERMS
12.1 Amendments. The terms of the Agreement may only be amended by mutual written agreement of theParties.
12.2 Force Majeure. Except for payment obligations and obligations pertaining to non-disclosure, notwithstanding any contrary provision in the Agreement, neither Party will be liable for any action taken, or any failure to take any action required to be taken, in the event and to the extent that the taking of such action or such failure arises out of causes beyond a Party’s control, including, without limitation, war, civil commotion, act of God, strike or other stoppage (whether partial or total) of labor, any law, decree, regulation or order of any government or governmental body (including any court ortribunal).
12.3 Order of Precedence. Any conflict or inconsistency among or between the terms and conditions of the documents comprising the Agreement shall be resolved according to the following order of precedence, in the order of the greatest control to the least: (1)U.S.
Federal law, (2) the relevant Module and(3) this Channel Foundation Agreement. Notwithstanding this Order of Precedence, unless expressly required by U.S. Federal law in subcontracts for commercial information technology, neither an Ordering Activity issued purchase order, nor the terms of an order between Ordering Activity and the Authorized CA Partner or Prime Contractor, shall modify the terms of the documents indicated herein.
12.4 Ordering Activity Data. If Ordering Activity transfers any personal data to CA as a requirement pursuant to any CA Offering, then Ordering Activity represents that (i) it is duly authorized to provide personal data to CA and it does so lawfully in compliance with relevant legislation, (ii) CA and any entity within the CA group of companies (each a "CA entity") or its subcontractors can process such data for the purposes of performing its obligations and (iii) CA may disclose such data to any CA entity and its subcontractors for this purpose and may transfer such data to countries outside of the country of origin. CA, Inc. is Safe Harbour certified and the CA Entities have committed to comply with relevant data protection/privacy legislation.
12.5 Import Export. Ordering Activity agrees that CA Offerings, Documentation, and or Confidential Information is subject to export controls of the United States of America and import controls of any other country in which such information may be used. Ordering Activity agrees to export, re-export or import such information only in compliance with such laws andcontrols.
12.6 Announcements. Neither Party may issue press releases relating to the Agreement without approving the content with the other Party. Either Party may include the name and logo of the other Party in lists of customers or vendors in accordance with the other Party's standard guidelines.
12.7 Counterparts. This Foundation Agreement and any Module, as applicable, may be signed in any number of counterparts by the Parties and each part shall be considered part of the whole and valid, legally binding document.
12.8 Notice. All notices hereunder shall be delivered to the other Party identified in the Agreement either personally, via certified mail, facsimile or overnight courier. If delivered personally, notice shall be deemed effective when delivered; if delivered via facsimile, notice shall be deemed effective upon electronic confirmation; and if delivered via certified mail or overnight courier, notice shall be deemed effective upon confirmation of delivery.
12.9 Headings. The section headings used herein are for information purposes only and shall not affect the interpretation of any provision of this Agreement.
12.10Validity. In the event any term or provision of the Agreement shall be held to be invalid, the same shall not affect in any respect whatsoever the validity of the remainder of the Agreement.
12.11Third Parties. This Agreement shall not create any rights in favor of, or any obligations owed by, any third party unless otherwise expressly defined in any Module. The Parties agree that any action arising from this Agreement shall solely be brought by Ordering Activity, the U.S. Government, or CA, unless otherwise permitted by law.
12.12Choice of Law. To the extent that federal law is not dispositive of a dispute hereunder, the laws of the State of New York (excluding its conflict of laws provisions) shall govern the construction and enforceability of the Agreement.
Version PS 1.0 Page 5 of 38 7/23/2014 10:36 AM
12.13Survival. Sections pertaining to Confidentiality, Title, Limitation of Liability, Termination, and Import Export shall survive termination of this Foundation Agreement.
12.14Entire Agreement. The Agreement and all documents incorporated by reference therein shall comprise the entire agreement as pertaining to the subject matter thereof and all other prior representations, proposals, and other such information exchanged by the Parties concerning the subject matter is superseded in their entirety by the Agreement.
Version PS 1.0 Page 6 of 38 7/23/2014 10:36 AM
Channel SaaS Module
1. INTRODUCTION
U.S. Public Sector
1.1. This Module for Software as a Service (“SaaS Module”) specifies terms and conditions which apply to Software as a Service that CA will provide to Ordering Activity.
1.2. This SaaS Module incorporates by reference the terms of the Foundation Agreement. Any capitalized terms used in this SaaS Module shall have the meanings given in the Foundation Agreement unless otherwise provided herein.
2. DEFINITIONS
2.1. “Ordering Activity Data” means information stored in the SaaS database.
2.2. “Force Majeure Event” means an event of Force Majeure as defined in the Foundation Agreement and/or delays caused by an internet service provider or hosting facility that results in data center outages resulting from causes not within CA’scontrol.
2.3. “ISO 27001” means an Information Security Management System standard published by the International Organization for Standardization (ISO). This particular standard specifies a management system that is intended to bring information security under explicit management control and mandates specific requirements when this standard is met.
2.4. “Production” means the “live” environment of SaaS provided to process data on a real-time basis.
2.5. “Production Availability” means, for purposes of measuring the Service Level, the aggregate number of minutes during the month in which the SaaS is available for Production access and use by Ordering Activity.
2.6. “SaaS” means the online version of the CA Software specified in the Authorized CA Partner’s order with CA for access to and usage by its customers via a website(s) environment.
2.7. “SAS 70 Type II” means the standards used by an independent auditor that employs procedures, policies and controls of SAS 70 TypeI to verify and validate that the organization is following those procedures regarding control objectives, activities and control over information technology, and related processes.
2.8. “SaaS Support” means support of the underlying CA software so it operates materially in accordance with theDocumentation.
2.9. “Sandbox” means a development or test environment that is not Production.
2.10. “Scheduled Downtime” means planned downtime of SaaS availability where CA provides notice to Ordering Activity at least 72 hours in advance.
2.11. “Service Level” means as described in the section entitled: Service Level Commitments.
2.12. “Subscription Term” means the period of the Ordering Activity’s subscription to the SaaS as specified in the Authorized CA Partner’s order with CA.
2.13. “Users” means the number of individuals authorized to access and use of SaaS by Ordering Activity and who have been provided user identifications and passwords by Ordering Activity (or by CA at Ordering Activity's request), measured by CA on an aggregate monthly basis by the amount of User Logins. Users may include Ordering Activity and Affiliate’s employees and independent contractors that agree to be bound by terms and conditions no less restrictive than those contained herein and are acting on behalf of Ordering Activity and not a third party.
2.14. “User Logins” means the initial and standard login screen where a User is required to enter its user ID and thepassword.
3. SAAS OFFERING
3.1. CA shall provide SaaS to Ordering Activity during the Subscription Term directly or through a third party SaaS provider in accordance with the terms of the Agreement.
3.2. CA hereby provides Ordering Activity a non-transferable and non-exclusive right to access and use SaaS for the sole purpose of supporting its internal business use. A new User may replace a former User who no longer requires access to, or use of, the SaaS.
Users may be Ordering Activity employees, Ordering Activity third party consultants, contractors or agents, which third parties may Version PS 1.0 Page 7 of 38 7/23/2014 10:36 AM
access and use the SaaS solely for the benefit of Ordering Activity’s internal business purposes in accordance with the provisions of this Agreement.
3.3. Ordering Activity acknowledges and agrees that in order for CA to effectively provide SaaS, Ordering Activity may be required to provide necessary information and shall not delay, prevent or interfere with CA’s provision of SaaS.
4. FEES & RENEWAL
4.1. Ordering Activity may access SaaS for solely the number and type of Users specified in the Authorized CA Partner’s order with CA.
Additional Users, or an additional SaaS offering, if available, shall require Ordering Activity to procure with CA or an Authorized CA Partner (whether directly or through a Prime Contractor) for such users or offering. Unless otherwise agreed by CA, (i) additional Users may be purchased only in increments of 50 Users; and (ii) such additional User subscriptions shall be coterminous with the expiration of the Subscription Term.
4.2. CA may with notice prior to any renewal, replace the Ordering Activity ordered SaaS with replacement, underlying software that is generally available to customers with alternative, materially similar, functionality.
4.3. The fees for SaaS subscription are not contingent upon the delivery of any future functionality or features of the CASoftware.
5. ORDERING ACTIVITY DATA
5.1. Ordering Activity exclusively owns all rights, title and interest in and to all Ordering Activity Data. Ordering Activity Data shall be considered to be Confidential Information under the Agreement. CA shall not access Ordering Activity’s User accounts, or Ordering Activity Data, except (i) in the course of data center business operations if required, (ii) in response to SaaS or technical issues or (iii) at Ordering Activity’s specific request as reasonably required in the provision of SaaS. CA will segregate Ordering Activity’s Datafrom other customers’ data.
5.2. CA operates and maintains a disaster recovery procedure. In case of a Force Majeure Event, Ordering Activity acknowledges and agrees that Ordering Activity Data may not be recoverable and accepts responsibility for re-entry of suchdata.
5.3. Ordering Activity Data will be returned to the Ordering Activity at the end of the Subscription Term or at the termination of the SaaS subscription in the manner described in the SaaS Documentation.
6. SECURITY
6.1. CA shall adhere to SAS 70 Type II audit compliance criteria and data security procedures which meet ISO 27001 status during the Subscription Term.
6.2. CA shall comply with CA’s security policy and procedures, which policies and procedures are designed to provide and maintain commercially reasonable safeguards against the destruction, loss or alteration of, or unauthorized access to or use of the Ordering Activity Data in CA’s possession or control and which safeguards are, at a minimum, no less rigorous than those maintained by CA for its own information of a similar nature.
6.3. Ordering Activity Data shall be stored pursuant to CA’s data security procedures, which shall be provided to Ordering Activity upon request. Except as required herein, CA will not be responsible for any unauthorized access to, or alteration, theft or destruction of Ordering Activity Data, unless caused as a result of CA’s negligence or intentional misconduct, in which case restoring or recovery of Ordering Activity Data shall be limited to the most recent back-up of Ordering Activity Data. CA is not responsible for loss of Ordering Activity Data arising from Ordering Activity’s: (i) transmission of data in contravention of the User Guide; or (ii) failure to act on any CA provided communication.
6.4. CA shall comply with the applicable EU member states’ implementation of the Directive 95/46/EC (“Directive”) governing the processing of personal data as defined specifically in the Directive and CA, Inc. is Safe Harbour certified.
6.5. Ordering Activity or an independent third party may audit CA’s operations within the applicable data center to verify CA’s compliance with the security and technical provisions defined in this Module. The audit may take place, no more than once annually, upon thirty (30) days prior written notice subject to Ordering Activity or its independent third party having executed a CA confidentiality agreement and stating the purpose and scope of the request. Such audit shall be conducted during normal business hours in a manner that does not disrupt business operations.
7. INITIATION AND SUPPORT PROCESSES
7.1. The following processes apply to the SaaS:
i. CA will send an email to Ordering Activity's technical contact identified in the Authorized CA Partner’s order with CA setting out the SaaS URL(s) and other information necessary for initial use of the SaaS. Ordering Activity shall provide information as requested within 7 days of receiving the email.
Version PS 1.0 Page 8 of 38 7/23/2014 10:36 AM
ii. Customer will utilize the CA Support website, or other site or notification mechanism as CA may designate from time to time, to notify CA of SaaS availability issues, request other in-scope technical support assistance, or for Customer's to provide feedback or approvals on requests as applicable.
8. SAAS SUPPORT
8.1. The Ordering Activity shall be provided with SaaS Support during the Subscription Term.
8.2. For any SaaS Support requests, Ordering Activity should be prepared to provide to SaaS Support personnel, all pertinent information, in English, including but not limited to, Ordering Activity number or site identification number, incident severity, SaaS/software name, area of SaaS (Production or Sandbox), incident description, and a technical contact familiar with Ordering Activity’s environment or the problem to be solved. Ordering Activity must use reasonable efforts to communicate with CA in order to verify the existence of the problem and provide information about the conditions under which the problem could beduplicated.
8.3. Upon receiving Ordering Activity’s technical contact information, SaaS Support will be provided in a timely and professional manner by qualified support engineers as defined below:
i. Access to CA help desk and the ability to open and manage support incidents via CA support online or bytelephone. ii. Production environment support: 24x7 for severity 1 incidents; normal business hours for severities 2-4. iii. Sandbox environment support: Normal business hours for incidents of all severities. iv. Access to CA support website (currently: http://support.ca.com) for 24x7x365 online support and access to CA software product and documentation, global user communities and regional user groups, FAQs, samples, webcast recordings and demos, usage tips, technical updates and HYPER notifications, as such are made available by CA. v. Interactive remote diagnostic support allowing CA support engineers to troubleshoot an incident securely through a real-time browser-based remote control feature.
vi. Additional support such as file storage, point in time backup, periodic file refresh and basic reporting may be available at CA’s discretion according to the SaaS provided.
Any additional support requirements are only by prior written agreement withCA.
8.4. In order to respond to an issue raised through SaaS Support, CA may request Ordering Activity to upgrade to appropriate operating systems and or third party applications as required in order to properly operate and access the SaaS offering. Any such upgrades or installations shall be at the Ordering Activity’s sole option and discretion. The costs associated with any upgrades required and any such installations are not included as SaaS Support and all such costs shall be the responsibility of the OrderingActivity.
9. ORDERING ACTIVITY RESPONSIBILITIES
9.1. Ordering Activity is responsible for all activities that occur in, or are related to, User accounts including the data, information stored or transmitted when accessing SaaS.
9.2. Because Ordering Activity may integrate or utilize third party links to other software, hardware or other service which are associated with, or otherwise available through SaaS, Ordering Activity agrees that it and its Users shall use such third party links in their sole discretion. CA shall have no responsibility or liability with respect to such third party links used by Ordering Activity’s or Users' or for any act or omission of any such third party provider.
9.3. Ordering Activity shall not: (i) make SaaS available to any third party not authorized, other than to Users or as otherwise contemplated by this Agreement; (ii) send or store code that can harm or result in damage to the SaaS offering (including but not limited to malicious code and malware); (iii) wilfully interfere with or disrupt the integrity of SaaS or the data contained therein; (iv) attempt to gain unauthorized access to the SaaS or its related system or networks; (v) use SaaS to provide services to external end users and or to process data other than Ordering Activity’s as an outsourcer, service bureau or consultant without written permission provided by CA.
10. WARRANTY
10.1. CA warrants that (i) SaaS shall perform materially in accordance with the applicable SaaS Documentation and (ii) that SaaS will be available online according to the performance levels described in the Service Levels defined in this SaaSModule.
10.2. EXCEPT AS EXPRESSLY SET FORTH ABOVE, TO THE EXTENT PERMITTED BY LAW, NO OTHER WARRANTIES, WHETHER EXPRESS OR
IMPLIED, INCLUDING, WITHOUT LIMITATION, THIRD PARTY WARRANTIES, IMPLIED WARRANTIES OF MERCHANTABILITY,SUITABILITY
OR SATISFACTORY QUALITY, OR THE WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE ARE MADE BY CA AND CA MAKES NO
WARRANTIES HEREUNDER WITH RESPECT TO ANY HARDWARE EQUIPMENT OR THIRD PARTY SOFTWARE WHICH CA MAY USE TO PROVIDE THE SAAS.
Version PS 1.0 Page 9 of 38 7/23/2014 10:36 AM
10.3. Ordering Activity warrants that (i) it has the right to transmit any data or information as may be required for the purposes of accessing SaaS (ii) it will ensure compliance to the Agreement by itself and its Users and (iii) it is responsible for all activities that occur in User accounts, (iv) it shall not misuse SaaS through sending spam or otherwise duplicative or unsolicited messages or store infringing, obscene, threatening, or otherwise unlawful material that is harmful to children or violates third party privacy rights.
11. WARRANTY REMEDY
11.1. In the event of a breach of the Warranty by CA, CA may in consultation with Ordering Activity (i) use reasonable efforts consistent with industry standards to cure the defect as defined in CA Support process outlined in this SaaS Module and or (ii) Ordering Activity may exercise its rights to termination as defined under the Service Level Commitment section below and qualify for a refund as defined therein and or (iii) mutually agree with Ordering Activity to terminate the subscription and provide a pro-rata refund to the Authorized CA Partner calculated on the number of months left remaining on the Subscription Term. Warranty remedies are conditioned upon (i) any error or defect complained of is reasonably reproducible by CA, (ii) the breach is not attributable in whole or in part to any non-CA product(s) or service(s).
12. SERVICE LEVEL COMMITTMENT
12.1. Service Levels: The following Service Levels will apply to the applicable SaaS offering during the applicable SubscriptionTerm:
i. Production Availability of SaaS 99.5% on a monthly basis. If Production Availability falls below 99%, it shall be considered a minor failure; and if Production Availability falls below 98%, it shall be considered a major failure.
12.2. Ordering Activity will be provided monthly electronic reports regarding Service Levels and follow the procedure set outbelow:
i. CA will investigate missed Service Levels through determining the root cause of the issue then using commercially reasonable efforts to correct the issue and advising Ordering Activity as reasonably requested by Ordering Activity of the status of efforts being undertaken with respect to the issue;
ii. Provide Ordering Activity reasonable evidence to Ordering Activity that the cause of the issue is being corrected or will be corrected and
iii. In the event of a minor failure, Ordering Activity is entitled to 2 additional days of the applicable SaaS offering at no additional charge. In the event of a major failure, Ordering Activity is entitled to 5 additional days of the applicable SaaS offering at no additional charge.
12.3. Pursuant to FAR 52.212-4(l), Ordering Activity may terminate for convenience its subscription to SaaS without incurring any additional charges or termination fees. In the event of such termination for convenience CA shall refund to the CA AuthorizedPartner that portion of the fees paid which have not yet been applied towards SaaS as of the effective date of termination. Any such refund herein shall be Ordering Activity’s sole and exclusive remedy under this SaaS Module with respect to CA only and CA shall have no further liability arising out of the applicable SaaS subscription, and shall not impact termination of any other Module or the Foundation Agreement. This section does not limit the rights or remedies of the Ordering Activity under FAR 52.212-4(m), Termination for cause.The following events shall be excluded from the calculation of any Service Level failures: (i) Force Majeure Event; (ii) outages due to Scheduled Downtime such as upgrading data center infrastructure; (iii) outages based on Ordering Activity networks or domain name server issues; (iv) Ordering Activity’s configuration, scripting, coding; (v) internet outages; (vi) Ordering Activity outages requested by Ordering Activity (vii) Ordering Activity changes to its environment which hinder SaaS production and (viii) inability for Ordering Activity to log in due to use of Lightweight Directory Access Protocol (LDAP) to control authentication.
13. NIMSOFT SaaS
13.1. The following sections of this Module are not applicable to Nimsoft Saastransactions:
i. 2.2;
ii. 2.3;
iii. 2.7;
iv. 5.2;
v. 6.1;
vi. 6.5 and
vii. 12.2;
13.2. The following sections of this Module are modified or added as follows for Nimsoft SaaS (On-Demand) transactions to the extent consistent with U.S. Federal law:
Version PS 1.0 Page 10 of 38 7/23/2014 10:36 AM
i. Section 7.1 ii: “Ordering Activity will utilize the Nimsoft CA Support website, or other site or notification mechanism as CA may designate from time to time, to notify CA of SaaS availability issues, request other in-scope technical support assistance, or for Ordering Activity to provide feedback or approvals on requests as applicable.” ii. Section 8.1: “The Ordering Activity shall be provided with SaaS Support pursuant ot the terms of http://www.nimsoft.com/content/dam/nimsoft/documents/un-secure/agreements/nimsoft-us-support-agreement.pdf during the Subscription term.”
iii. Section 10.1: “CA warrants that (i) SaaS shall perform materially in accordance with the applicable SaaS Documentation for a period of 60 days from the commencement of the Term and (ii) that SaaS will be available online according to the performance levels described in the Service Levels defined in this SaaS Module. iv. Add the following as Section 15:
“15. REPORTING AND AUDIT
Reports. Ordering Activity agrees to prepare and submit monthly reports to the Authorized CA Partner and CA that shall include, without limitation, information detailing the use of SaaS pursuant to the license metrics applicable to SaaS (“Report”). Ordering Activity shall submit each Report to the Authorized CA Partner and CA on the fifteenth day of each calendar month.
Overage. If the Report shows the Ordering Activity has exceeded the Authorized Use Limitation at any time during a month, such Report shall constitute a basis for a claim to the relevant Contracting Officer pursuant to the Contract Disputes Act and FAR 52.233-1.
In no event may the SaaS quantity be lowered below the original numberordered.
14. GENERAL TERMS.
14.1. Any conflict or inconsistency among or between the terms and conditions of the documents comprising the Agreement shall be resolved according to the following order of precedence, in the order of the greatest control to the least: (1) U.S. Federal law, (2) this Channel SaaS Module and (3) the Channel Foundation Agreement. Notwithstanding the foregoing, unless expressly required by U.S.
Federal law in subcontracts for commercial information technology, neither an Ordering Activity issued purchase order, nor the terms of an order between Ordering Activity and the Authorized CA Partner or Prime Contractor, shall modify the terms of the documents indicated herein.
Version PS 1.0 Page 11 of 38 7/23/2014 10:36 AM
1. INTRODUCTION
Channel Hardware Appliance Module
U.S. Public Sector
1.1. This Module for the Hardware Appliance (“Hardware Appliance Module”) specifies terms and conditions which apply to theHardware Appliance which CA will provide to Ordering Activity.
1.2. This Hardware Appliance Module incorporates by reference the terms of the Foundation Agreement. Any capitalized terms used in this Hardware Appliance Module shall have the meanings given in the Foundation Agreement unless otherwise providedherein.
2. DEFINITIONS
2.1. “Hardware” means a single CA-supplied third party physical server or device.
2.2. “Hardware Appliance” means Hardware that is bundled with and operates the CA Software licensed by Ordering Activity and preinstalled on the Hardware.
3. APPLIANCE OFFERING
3.1. CA shall provide the Hardware Appliance specified in the Authorized CA Partner’s order with CA.
3.2. The terms for license and support for the underlying CA Software is covered separately under the SoftwareModule.
4. FEES
4.1. Ordering Activity may order Hardware Appliance with, and pay the associated fees and other charges to an Authorized CA Partner or Prime Contractor. CA will deliver to Ordering Activity the Hardware Appliance specified in the Authorized CA Partner’s order with CA.
4.2. Upon CA’s receipt of payment from the Authorized CA Partner, Ordering Activity will own the Hardware free of any liens or encumbrances.
5. WARRANTY
5.1. Upon the purchase of a Hardware Appliance, CA will pass through to the Ordering Activity the applicable Hardware warranty. Such warranty will be provided for a period of twelve (12) months or more depending on the type of Hardware Appliance purchased. A copy of the applicable third party support warranty coverage is available under the “Get Support” section of CA’s Support website located at https://support.ca.com.
6. WARRANTY REMEDY
6.1. To address a warranty issue on the Hardware, CA will provide Ordering Activity telephone assistance to access the third party Hardware support to address support issues with the Hardware.
6.2. Except for procuring third party warranty coverage for the Hardware as described above, the Hardware is provided on an “AS IS” basis and CA makes no warranties, and disclaims any and all express or implied warranties (including but not limited to warranties of merchantability or satisfactory quality or fitness for a particular purpose), with respect to the Hardware. None of the warranties specified in the Foundation Agreement or any other agreement shall apply to the Hardware.
7. ORDERING ACTIVITY REQUIREMENTS
7.1. Ordering Activity is solely responsible for use of the Hardware, including assuring proper supported environment configuration, CA software installation, and operating methods in accordance with the Hardware specifications andDocumentation.
7.2. CA will not support modifications to the Hardware nor will it support the Hardware if Ordering Activity fails to comply with the terms of the Agreement to the extent such failure causes the Hardware’s failure to perform in substantial accordance with the applicable Hardware documentation.
7.3. CA shall have no obligation to replace the Hardware, or provide additional hardware, in cases where future Versions or Releases (as such terms are defined in the Software Module) of the CA Software require an upgrade of or addition to suchHardware.
8. GENERAL TERMS
8.1. Any conflict or inconsistency among or between the terms and conditions of the documents comprising the Agreement shallbe resolved according to the following order of precedence, in the order of the greatest control to the least: (1) U.S. Federal law, (2) this Channel Hardware Appliance Module and (3) the Channel Foundation Agreement. Notwithstanding the foregoing, unless expressly required by U.S. Federal law in subcontracts for commercial information technology, neither an Ordering Activity issued purchase Version PS 1.0 Page 12 of 38 7/23/2014 10:36 AM
order, nor the terms of an order between Ordering Activity and the Authorized CA Partner or Prime Contractor, shall modify the terms of the documents indicatedherein.
Version PS 1.0 Page 13 of 38 7/23/2014 10:36 AM
1. INTRODUCTION
Channel Education Module
U.S. Public Sector
1.1. This Module for Education (“Education Module”) specifies terms and conditions which apply to Education that CA will provide to Ordering Activity.
1.2. This Education Module incorporates by reference the terms of the Foundation Agreement. Any capitalized terms used in this Education Module shall have the meanings given in the Foundation Agreement unless otherwise provided herein.
2. DEFINITIONS
2.1. “Attendees” mean the participants authorized by Ordering Activity to attend or participate in the Education offerings as indicated in the Transaction Document.
2.2. “Course Materials” means any Education content provided to Ordering Activity in any media form pursuant to a Transaction Document, including without limitation, all publications, courseware, training manuals and materials, user guides, web portals, or virtual labs provided by CA or a CA subcontractor.
2.3. “Education” means any standard or customized education offerings, training or instruction, or related services, provided by CA or a CA subcontractor in any format or location, including without limitation, (i) instructor led training, including at CA or Ordering Activity site(s), (ii) virtual training, including online classes, courses, or course catalogues and/or (iii) class room training or testing, at a CA or third party training facility.
3. EDUCATION OFFERING
3.1. CA shall provide the Education as specified in the Authorized CA Partner’s order with CA.
3.2. CA may require the registration or pre-registration of Attendees in order to attend or access the applicable Education. Ordering Activity acknowledges that CA reserves the right to refuse entry or access to any individual that cannot authenticate their registration or authorization for such Education.
4. FEES AND CANCELLATION
4.1. The Parties acknowlede and agree that all terms governing the fees, payments, payment schedules, pricing and discounts for the applicable CA Offering procured by Ordering Activity under this Agreement are and shall be between solely Ordering Activity and their chosen Authorized CA Partner or Prime Contractor.
4.2. If CA cancels a class due to unforeseen circumstances, or low enrollment, CA will provide as much advance notice as possible but no less than ten (10) business days prior to the class in which case Ordering Activity may reschedule the class to an alternative time.
4.3. Cancellation in writing by Ordering Activity must be provided at least ten (10) business days prior to the class. If such notice is not given CA may charge Authorized CA Partner up to 100% of the fees for the class. If fees are pre-paid, no refund will be provided to the Authorized CA Partner
4.4. Neither party shall be liable for any travel related fees or expenses incurred by the other party in relation to Education which such party has properly cancelled in compliance with this section.
5. INTELLECTUAL PROPERTY RIGHTS
5.1. CA grants to Ordering Activity, a non-exclusive, non-transferable license to use the Course Materials for the internal use of the Ordering Activity, but limited to the specific Attendees and subject to terms of the Agreement. Ordering Activity shall be responsible for all use of the Education and Course Materials by its Attendees.
6. WARRANTY
6.1. If CA provides an instructor, the delivery of the Course Offering shall be provided in a professional, workman-likemanner.
6.2. EXCEPT AS SET FORTH IN THIS SECTION, NO OTHER WARRANTIES, WHETHER EXPRESS OR IMPLIED, INCLUDING, WITHOUT
LIMITATION, THIRD PARTY WARRANTIES, THE IMPLIED WARRANTIES OF MERCHANTABILITY OR SUITABILITY AND/OR THE WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE ARE MADE BY CA.
7. WARRANTY REMEDY
Version PS 1.0 Page 14 of 38 7/23/2014 10:36 AM
7.1. In the event of a breach of the Warranty section, Ordering Activity’s remedy shall be, at CA’s discretion and in consultation with Ordering Activity, to re-perform the Education at no additional charge to the Ordering Activity. These remedies are contingent upon the alleged breach not resulting from Ordering Activity’s failure to abide by its obligations or to conform to the Course Materials.
8. GENERAL TERMS
Any conflict or inconsistency among or between the terms and conditions of the documents comprising the Agreement shall be resolved according to the following order of precedence, in the order of the greatest control to the least: (1) U.S. Federal law, (2) this Channel Education Module and (3) the Channel Foundation Agreement. Notwithstanding the foregoing, unless expressly required by U.S. Federal law in subcontracts for commercial information technology, neither an Ordering Activity issued purchase order, nor the terms of an order between Ordering Activity and the Authorized CA Partner or Prime Contractor, shall modify the terms of the documents indicated herein.
Version PS 1.0 Page 15 of 38 7/23/2014 10:36 AM
1. INTRODUCTION
Channel Software Module
U.S. Public Sector
1.1. This Module for CA Software (“Software Module”) specifies terms and conditions which apply to CA Software that CA will license to Ordering Activity and the Support that applies.
1.2. This Software Module incorporates by reference the terms of the Foundation Agreement. Any capitalized terms used in this Software Module shall have the meanings given in the Foundation Agreement unless otherwise provided herein.
2. DEFINITION
2.1. “Access” means use of CA Software remotely by an Authorized End User.
2.2. “Authorized End Users” means Ordering Activity as well as its employees and support contractors (but excluding any outsourcer, facilities management providers, managed service provider, or application service provider) that are bound by terms and conditions no less restrictive than those contained herein and are acting on behalf of Ordering Activity and not a third party.
2.3. “Authorized Use Limitation” means the quantity of the CA Software authorized by CA in accordance with the License Metric specified in the order between CA and the Authorized CA Partner.
2.4. “CA Software” means the computer software programs, either provided individually or packaged as a software appliance, made generally available and licensed to a Ordering Activity under this Module, including all Versions, Releases, provided as part of Support if applicable.
2.5. “Distributed” means the CA Software designated as distributed that is generally used for indepedent usage across individuals systems or hardware based on the Licensed Metric in a decentralized form of computing.
2.6. “Mainframe” means CA Software designated as mainframe that is generally used for a large capacity processor that provides links to users through less powerful devices such as workstations or terminals based on the Licensed Metric in a centralized form of computing.
2.7. “Maintenance” means the provision of new Releases made available while on active Support or new Versions if applicable to the generally available CA Software licensed by Ordering Activity.
2.8. “Perpetual License” means a license to use CA Software for an indefinite period subject to compliance with theAgreement.
2.9. “Release” means a general available release of a CA software product, which may contain minor new software product functionality, code, or compatibility and incorporates all previous fixes (if any exist) since the last Version. Typically, a Release requires a new installation, rather than an overlay to the already installed software. Unless otherwise specified by CA for a particular product, a Release is tied to the preceding Version and is typically designated by a number to the right of the decimal point such as 1.1, 1.2, 1.3, etc.
2.10. “Subscription” or “UMF” (Usage and Maintenance Fee) license means a license to use CA Software for a specific period of timewhich shall include Support unless otherwise specified by CA in its order with the Authorized CA Partner.
2.11. “Support” means the provision of technical support and Maintenance provided for a particular CA Software as specified in the Authorized CA Partner’s order with CA.
2.12. “Territory” is the location where Ordering Activity is authorized to install the CA Software as specified in the Authorized CA Partner’s order with CA or the Prime Contractor.
2.13. “Version” means a release of a CA Software Product that contains major changes in software product functionality, code, or compatibility and incorporates the previous release (if one has occurred), fixes and service Packs (if they have occurred). Typically, a Version requires a new installation, rather than an overlay to the already installed software. Unless otherwise specified by CA for a particular product, a Version is designated by the number to the left of the decimal point such as 1.0, 2.0, 3.0, etc.
3. SOFTWARE OFFERING & OBLIGATIONS
3.1. CA grants the Ordering Activity a limited, non-exclusive, non-transferable license, for the Term:
3.1.1. install and deploy the CA Software in the Territory up to the Authorised Use Limitation.
3.1.2. permit its Authorized End Users Access to the CA Software for Ordering Activity’s and Affiliates’ internal business wherever located. Ordering Activity hereby expressly agrees that a breach by an Authorized End User of the Agreement shall be considered to be a breach by and the responsibility of the Ordering Activity.
Version PS 1.0 Page 16 of 38 7/23/2014 10:36 AM
3.1.3. make a reasonable number of copies of the CA Software for disaster recovery “cold standby”, backup and archival purposes.
Use of such copies is limited to testing Ordering Activity’s disaster recovery procedures and effectiveness and as is necessary during any reasonable period subsequent to the occurrence of an actual disaster during which Ordering Activity cannot operate the CA Software.
3.1.4. relocate CA Software to a new Ordering Activity location within the Territory upon prior written notice.
3.2. The specifications and specified operating environment information of the CA Software may be found in the Documentation accompanying the CA Software, if available (e.g., a user manual, user guide, or readme.txt or notice.txtfile).
3.3. Upon request by CA, Ordering Activity agrees to provide records reasonably requested by CA to verify its compliance with the Authorized Use Limitation during the period in which Ordering Activity is licensed to use the CA Software and for a period of twelve (12) months after expiration including certified copies of statements or records as applicable. Such reports will be based on the License Metric for the CA Software ordered for Customer byCA.
3.4. The grant of license is contingent upon Ordering Activity’s compliance with the following obligations set out under this provision:
Ordering Activity agrees, that it shall not: (i) access or use any portion of the CA Software not expressly authorized by CA or the Documentation of the CA Software; (ii) cause or permit de-compilation, reverse engineering, or otherwise translate all or any portion of the CA Software; (iii) modify, unbundle, or create derivative works of the CA Software and/or Documentation; (iv) rent, sell, lease, assign, transfer or sublicense the CA Software or use the CA Software to provide hosting, service bureau, on demand or outsourcing services for the benefit of a third party; (v) remove any proprietary notices, labels, or marks on or in any copy of the CA Software or Documentation; (vi) use the CA Software beyond the Authorized Use Limitation.
3.5. CA reserves the right, on reasonable notice to the Ordering Activity and subject to any security measures the Ordering Activity deems appropriate, to conduct an audit remotely or onsite of Ordering Activity and/or its Affiliates facilities to verify Ordering Activity’s compliance with the terms of the Agreement. CA agrees that such audit shall be conducted during regular business hours at Ordering Activity's offices and CA shall endeavor to conduct such audit so as not to interfere unreasonably with Ordering Activity's activities and/or use an independent third party to conduct the audit subject to terms of non-disclosure ifrequired.
3.6. All rights not specifically granted hereunder are expressly reserved.
4. SUPPORT OFFERING
4.1. If Support is purchased by Ordering Activity, CA will provide Ordering Activity with technical support for the CA Software, according to the Support specified in the Authorized CA Partner’s order with CA, to operate according to the Documentation, help desk support and Maintenance for the CA Software based on Support guidelines as described on http://www.support.ca.com.
4.2. In order to initiate an issue, Ordering Activity will provide CA sufficient information so that CA can provide assistance to Ordering Activity in a timely manner.
4.3. CA will provide a minimum of twelve months prior written notice to Ordering Activity if CA ceases to provide new Versions or Releases for a CA Software product.
4.4. CA will renew Support for Ordering Activity’s use of the CA Software upon its acceptance of an order with an Authorized CA Partner for such Support.
5. THIRD PARTY TERMS
The CA Software may contain third-party software components. Ordering Activities are advised to review any additional terms, notices, and/or information applicable to third-party software components, which are available at https://support.ca.com/prodinfo/tpterms.
6. PERFORMANCE WARRANTY
6.1. For Distributed Software. CA warrants that the CA Software will operate materially in accordance with the applicable specifications set forth within the Documentation for a period of ninety (90) days after delivery of the CA Software to Ordering Activity subject to Ordering Activity’s compliance with the Agreement.
6.2. For Mainframe Software. CA warrants that the Mainframe Software will operate materially in accordance with the applicable specifications set forth within the Documentation for the Term, subject to Ordering Activity’s compliance with the Agreement.
7. PERFORMANCE WARRANTY REMEDY
7.1. If CA has breached either warranty set forth in the section entitled: Performance Warranty, Ordering Activity’s remedy is for CA to, in consultation with Ordering Activity, to either (i) use reasonable efforts consistent with industry standards to cure the defect, or (ii) replace the CA Software(s) with one that materially complies with the Documentation, or (iii) mutually agree to terminate the license Version PS 1.0 Page 17 of 38 7/23/2014 10:36 AM
and provide a pro-rata refund to the Authorized CA Partner of the license fees paid and or Support fees. If option (iii) applies, the prorata refund shall be calculated on the number of months left remaining on the Term of the applicable Transaction Document or if the CA Software is licensed under a Perpetual License, using (only for purposes of a refund calculation) an amortization schedule of three (3) years.
7.2. Warranty remedies are conditioned upon (i) any error or defect complained of is reasonably reproducible by CA, (ii) the CA Software is not modified and is being used in accordance with CA Documentation, and (iii) the breach is not attributable in whole or in part to any non-CA product(s) or service(s).
7.3. THE ABOVE WARRANTIES ARE THE SOLE WARRANTIES PROVIDED BY CA. NO OTHER WARRANTIES, INCLUDING THAT THE CA
SOFTWARE IS ERROR FREE, WHETHER EXPRESS OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THE IMPLIED WARRANTIES OF
MERCHANTABILITY, NONINFRINGEMENT, OR SUITABILITY AND/OR THE WARRANTY OF FITNESS FOR A PARTICULAR PURPOSE ARE MADE BY CA.
8. ACCEPTANCE
8.1 All CA Software is deemed accepted upon issuance of an order to CA from CA AuthorizedPartner.
9. VIRTUALIZATION
When CA Software is used on multiple machines (physical and “virtual”), each such use of the CA Software shall be counted for the purposes of determining the Authorized Use Limitation for that CA Software. A “virtual” PC or server environment is created where Virtual Machine Technology (which applies to both client and server hardware) is used to enable multiple instances of an operating system(s) to run on a single computersimultaneously.
10. NEW PRODUCT LANGUAGE AND DISTRIBUTED CA SOFTWARE EXCLUSION
10.1 In addition to and separate from unspecified upgrades and enhancements to be provided as maintenance under the initial Term specified in the order with Authorized CA Partner (together with any extension(s) or renewal(s) thereof, the “Term” for purposes of this section), in the event CA develops a new release of a mainframe CA Software that it designates and makes generally available as a new product (typically containing new functions in addition to or different from existing functionality (a “New Product”), then upon CA’s receipt of Ordering Activity’s written request and without additional charge, such currently unspecified mainframe New Product shall be made available for use by the Ordering Activity during the Term, on the same basis as applies to such mainframe CA Software, even if CA then determines to charge a separate license fee for the mainframe New Product to CA’s other licensees.
10.2 Such rights shall not extend to any Hardware provided under this Agreement. Notwithstanding anything to the contrary in the Agreement by and between the parties hereto (i) the Distributed CA Software herein shall not be construed as a “New Product” for the purposes of any prior agreement between the parties; and (ii) the provisions of any “New Product” provision in any prior agreement shall not apply tothe distributed CA Software herein or any subsequent license for CA Software.
11. NIMSOFT ON PREMISE
11.1. The following terms are modified or added for all Nimsoft transactions to the extent consistent with U.S. Federallaw:
11.1.1.Section 2.4: “Nimsoft Software” means the computer software programs, made generally available and licensed to a Ordering Activity under this Module, including all Versions, Releases, provided as part of Support if applicable.”
11.1.2.Section 4.1: “If Support is purchased by Ordering Activity, CA will provide Ordering Activity with technical support for the Nimsoft Software, according to the Support specified in the Authorized CA Partner’s order with CA, to operate according tothe Documentation, help desk support and Maintenance for the Nimsoft Software pursuant to the following:
http://www.nimsoft.com/content/dam/nimsoft/documents/un-secure/agreements/nimsoft-us-support-agreement.pdf.”
11.1.3.Add as Section 15: “15. REPORTS. Ordering Activity agrees to prepare and submit monthly reports to the CA Authorized Reseller and CA that shall include, without limitation, information detailing the use of the Nimsoft Software pursuant to the license metrics applicable to the Software (“Report”). Ordering Activity shall submit each Report to CA Authorized Reseller and CA on the fifteenth day of each calendar month.”
11.1.4.Add as Section 16: “16. OVERAGE. If the Report shows the Ordering Activity has exceeded the Authorized Use Limitation at any time during a month, such Report shall constitute the basis for a claim to the relevant Contracting Officer pursuant to the Contract Disputes Act and FAR 52.233-1. In no event may the Perpetual License or Subscription License quantity be lowered below the original number ordered.”
12. GENERAL TERMS
12.1. Any conflict or inconsistency among or between the terms and conditions of the documents comprising the Agreement shall be resolved according to the following order of precedence, in the order of the greatest control to the least: (1) U.S. Federal law, (2) this Version PS 1.0 Page 18 of 38 7/23/2014 10:36 AM
Channel Software Module and (3) the Channel Foundation Agreement. Notwithstanding the foregoing, unless expressly required by U.S. Federal law in subcontracts for commercial information technology, neither an Ordering Activity issued purchase order, nor the terms of an order between Ordering Activity and the Authorized CA Partner or Prime Contractor, shall modify the terms of the documents indicated herein.
Version PS 1.0 Page 19 of 38 7/23/2014 10:36 AM
Attachment A to Channel Software Module
Definitions and License Metrics
APPLICABILITY
The following definitions and License Metrics shall apply to the CA Software licensed by Ordering Activity to the extent such terms and/or CA Software are included in Ordering Activity’s agreement with Authorized CA Partner or Prime Contractor:
Arcot
“Tier Servers” means single server of any tier up to and including Tier 9 Server. “Server” shall designate a specialized computer or a serial of processors assigned to store and to distribute information to and from Customer’s personal computer (workstations). Linked to a company network, it enables a shared access to the files and a printing service support. "User" means a single person listed in any Customer directory or network storage location whose access and use rights can be authenticated, authorized, or administered by the CA Software. Unless otherwise specified, a User shall not be counted more than once or on a concurrent basis.
CA Access Control Premium Edition
“Managed Device” means a virtual or physical machine to which the CA Software controls access.
CA Access Control Privileged User Password Management(PUPM) “Managed Device” means a virtual or physical system or application whose privileged account passwords are being managed by theCA Software, including but not limited to operating system instances, databases, applications, Command Line Interface Software Development Kits, Open Database Connectivity/Java Database Connectivity applications, Windows services and managed tasks, and managed configuration files. When CA Software is used (i) in connection with a Managed Device or (ii) in connection with a virtual or physical system or application that leverages or interoperates with a Managed Device (a “Password Consumer System or Application”), each such use of the CA Software shall be counted for the purposes of determining the Authorized UseLimitation.
CA Automation Suite for Data Centers
A “Physical Socket” means an electrical component attached to a printed circuit board (“PCB”) and electrically interconnects acentral processing unit (“CPU”) and PCB. A CPU is the specialized integrated circuit that executes binary programs and performs most logical functions or calculations. One physical CPU may have up to twelve (12) processing cores. CA Configuration Automation program is included in the delivery of CA Automation Suite for Data Centers for use in server environments managed under CA Automation Suite for Data Centers license.
Use of this program with server environments not managed by CA Automation Suite for Data Centers requires a separate license for additional fees. Systems Performance for Infrastructure Manager (SystemEDGE) and Virtual Assurance for Infrastructure Manager AIMS components are included in the delivery of the CA Automation Suite for Data Centers for use only with this product. Use of these components with other CA products requires a separate license for additional fees.CA IT Client Management solution consists of CA Software Delivery, CAAsset Management, CA Remote Control programs and is included in the delivery of the CA Automation Suite for Data Centers. Customer may only use these components to manage server class machines, including virtual machines. Use of these programs for managing desktops, laptops and other client devices requires separate licenses for additional fees.CA Asset Intelligence and CA Patch Manager programs are included in the delivery of the CA Automation Suite for Data Centers. Customer may only use these components to manage server class machines, including virtual machines. Use of these programs for managing desktops, laptops and other client devices requires separate licenses for additional fees.CA Process Automation program is included in the delivery of CA Automation Suite for Data Centers. CA Process Automation includes two Orchestrators, all non-Premium Connectors, unlimited Agents and 75 Concurrent Processes per Orchestrator. Additional Orchestrators and Premium Connectors are available as an add-on option at additional cost. “Agent” means a single installation of the agent software component of the CA Process Automation program on a specific operating system which can be identified as unique host identification on a physical or virtual hardware server. “Orchestrator” means a single installation of the Orchestrator software component of the CA Process Automation program on a specific operating system which can be identified as unique host identification on a physical or virtual hardware server. This installation can be a stand-alone Orchestrator or as a node of a new or existing clustered Orchestrator. “Connector" is the software program connecting the CA Process Automation program with specific named third party software or other CA software. For example, CA Process Automation Connector For CA Service Desk connects CA Process Automation with CA Service Desk. Each Connector may only be usedto connect the CA Software with the specific named third party software or CA software program. “Premium Connector” means a Connector identified by CA in the Order Form. “Process instance” means a single copy of a Process definition that has been scheduled to run (Queued state), is running (Running state), or has completed running (Failed or Completed state) on a particular “Orchestrator”.
Version PS 1.0 Page 20 of 38 7/23/2014 10:36 AM
“Concurrent Processes” means the number of CA Process Automation Process instances that are marked in the Running state within an Orchestrator at any given time.
CA AutoSys Workload Automation
“Instance” means the number of copies of CA AutoSys Workload Automation installed in your physical and/or virtual environment.
CA Clarity Project & Portfolio Manager
"CA Software" means the CA Clarity Project and Portfolio Manager (also known as CA Clarity PPM). CA Clarity PPM is licensed by Environment and the number of Users (Manager, Team Member or Viewer). Customer is granted the right to install and use CA Clarity PPM in not more than three (3) Environments, of which only one (1) may be a production Environment. An “Environment” can consist of any or all of the following, provided that all of the servers in the Environment function as one logical Environment: one or more application servers, search servers, report servers, background servers, and/or database servers. Typical examples of Environments include production Environments,development Environments and test Environments. A production Environment is a computer system used to process an organization's daily work on a realtime operation, not systems used only for development and testing. "Manager User" means Customer's designated users who have full use of and access to the functions within CA Clarity PPM. "Team Member User" means Customer’s designated users who have limited rights to the functions within CA Clarity PPM, and may only (i) view data and run reports in all licensed products; (ii) collaboratively participate in processes, discussions and document sharing and receive notifications in all licensed products; (iii) view project tasks and calendars, and report and approve time and project status; and (iv) enter and view status of ideas. "View Only User" means Customer’s designated users who have limited rights to the functions within CA Clarity PPM and may only (i) view data and run reports; (ii) originate idea workflows, and participate in the continuation of those workflows.
CA Client Automation
A "Managed System" is any physical or virtual computer system that can host an operating system, including, but not limited to, a desktop computer or laptop computer, used by an end-user as part of their job function to access data, applications and resources, that is administered or managed by CA Client Automation by way of a management infrastructure, whether a CA management agent resides on the system or not.
This includes laptops, desktops and virtual desktops running Windows, Macintosh and Linux operating systems, and it excludesWindows Servers, Linux Servers and UNIX systems. The management infrastructure components, such as Domain Manager, Scalability Server, and System Engine, that run on server platforms do not require a separate license, except if these systems themselves are being managed by an active agent for purposes other than serving as the CA Client Automation management infrastructure.
CA Client Automation consists of:
CA IT Client Manager
CA Patch Manager
CA Desktop Migration Manager
CA Asset Intelligence
CA Workflow for CA IT Client Manager (it is included in the delivery of CA Client Automation for use only for automating workflows inside CA Client Automation and between CA Client Automation and other softwareprograms) CA Configuration Automation:
The CA Software is licensed by the number of Physical Sockets. A “Physical Socket” means an electrical component attached to a printed circuit board (“PCB”) and electrically interconnects a central processing unit (“CPU”) and PCB. A CPU is the specialized integrated circuit that executes binary programs and performs most logical functions or calculations. One physical CPU may have up to twelve (12) processing cores.
CA Database Performance
CA Database Performance is licensed by the number of CPUs when used as a distributed product. “CPU” means a central processing unit which is the specialized integrated circuit that executes binary programs and performs most logical functions or calculations. A dual-core central processing unit is considered a single CPU. Note that because of the use of multi-core CPUs and virtual server environments, the calculation of CPUs for licensing purposes described below will not always equate to the number of physical CPUs in the environment. A virtual server environment is created where virtual machine technology (which applies to both client and server hardware) is used to enable multiple instances of an operating system(s) to run on a single computer simultaneously. With the Authorized Use Limitation as “CPU” or “Processor”, the calculation with respect to the number of CPUs on an individual server is determined as follows:
Version PS 1.0 Page 21 of 38 7/23/2014 10:36 AM
1. For non-virtual server environments, for any server with databases monitored by the CA Software with single CPUs (including, for the avoidance of doubt, dual-core CPUs), count the number of CPUs. For any server with databases monitored by the CA Software with greater than dual-core CPUs, count all cores of the CPUs. Divide the number of cores by two (2) and round up to the next whole number.
2. For virtual server environments, for any server with single CPUs (including, for the avoidance of doubt, dual-core CPUs), count the number of CPUs. For any server with greater than dual-core CPUs, count all cores of the CPUs. Divide the number of cores by two (2) and round up to the next whole number. Determine the maximum percentage of the server CPU capacity that is allocated by the Virtual Machine Technology to any operating system instance containing databases(s) monitored by the CA Software, and multiply this percentage by the number of CPUs. Multiply the resulting number by one and a half (1.5X) and round up to the next whole number.
3. For mixed server environments, for each server perform the calculations for CPUs as set forth above in subparagraphs (1) and (2) and add these amounts together to determine the aggregate number of CPUs.
CA Systems Performance for Infrastructure Managers (formerly known as “CA SystemEdge”) is a separate program included in the delivery of CA Database Performance. Customers can use this program only for communication with other CA Technologies tools and/or monitoring CA Technologies software systems only. Full functionality of the program to monitor and manage servers requires a separate license with additional fees.
CA DLP
CA DLP includes CA DLP Enterprise Suite, CA DLP Platform & Surveillance, CA DLP Endpoint, CA DLP Stored Data, CA DLP Message Server and CA DLP Network. CA DLP Network and CA DLP Enterprise Suite (which includes CA DLP Network) require and may only be used on a licensed CA DLP Network Appliance.
“CA DLP Network Appliance” means the hardware that operates the CA DLP Network. "User" means a single person, or identity, listed in any Customer directory or network storage location whose access and use rights can be authenticated, authorized, or administered by the CA Software. Unless specified on the Order Form, a User shall not be counted more than once or a concurrent basis. If an Appliance is included with the CA Software, Support for an Appliance is provided in accordance with the CA Appliance Hardware Policy published on CA Support Online located at http://support.ca.com.
CA Enterprise Log Manager
“Agent” means a single installation of the agent software on a specific operating system instance which can be identified as a unique host identification on a hardware server. A hardware server may have multiple operating system instances installed on it (through partitioning or virtualization). Each instance of the operating system on a partitioned/virtualized server must license an agent if required for job scheduling purposes. “Node” means, in a communications system, a network junction or connection point. Any system or device connected to a network is also called a node or cluster. “Server” means a single physical or virtual computer which processes data using one or more central processing units, and which is owned, leased or otherwise controlled byCustomer.
CA ESP Workload Automation
(MIPS Based license. Operating System is IBMz/OS)
CA ESP Workload Automation is licensed by the specified number of MIPS (the “Authorized Use Limitation in MIPS”). “MIPS”means millions of instructions per second. The MIPS capacity of a computer shall be calculated by reference to CA's published schedules of the MIPS capacity and if a computer isn’t listed then the manufacturer’s published specifications should apply. In the event that any particular computer is not accounted for on CA's schedule, the manufacturer's published specification of MIPS capacity shall control. Further, in the event a special purpose processor, designed to perform one or more dedicated functions, is being used as a general purpose processor, CA shall treat such processor as a general purpose processor for purposes of calculating Authorized Use Limitation in MIPS. "Customer Site" means the site(s) specified at the time of licensing the CA Software or the Customer Address if no Customer Site has been indicated. Customer may use the CA Software only on the specific computers upon which the CA Software is installed to run at the Customer Site or on computers which are linked, connected to and/or which can remotely access such computers, irrespective of the platform designations of the hardware or operating systems, provided that such computer is capable of accessing, using, executing or benefiting from the CA Software, subject to the aggregate MIPS capacity not exceeding the Authorized Use Limitation in MIPS.
Version PS 1.0 Page 22 of 38 7/23/2014 10:36 AM
CA Fast Unload for DistributedDatabases:
The CA Software is licensed by the number of servers. “Server” means a single physical or virtual computer which processes data using one or more central processing units, and which is owned, leased or otherwise controlled by Customer.
CA Federation Manager:
(a) “Federate” means to link or bind two or more entities together, enabling identity, account, attribute, authentication, and authorization federation across different trust realms.
(b) “Federation” means a relationship or an association between a specific system entity’s identified users, partners oraccounts. (c) “Federation Partner” means an internal or external entity (i) for which a unique federation configuration is required in order to join a Federation, and (ii) with whom Customer interoperates using Federation Manager, with or without SAML AA. (d) “Federation Partnership Licensee” means the Federation Partner designated by Customer as licensed to use SAML AA or Federation Manager in accordance with the provisions of the Agreement and who has agreed in writing to Customer terms andconditions substantially similar to the Federation Manager and SAML AA license provisions contained herein, as well as the confidentiality provisions contained in the Agreement. Such Federation Partnership Licensee shall not have any right to further copy, distribute, or otherwise transfer such software or any rights therein, notwithstanding any provision of the Agreement to the contrary. With regard solely to such Federation Partner’s use of the Licensed Programs in accordance herewith, the term “Customer” in the Agreement includessuch Federation Partner.
(e) “Federation User” means any user who is allowed to use a Federation via the specific configuration of Federation Manager that Customer deploys. A Federation User shall not be counted more than once or on a concurrent basis.
CA GEN ENC Cross-Gen Opt Linux
“Server” means a single physical or virtual computer which processes data using one or more central processing units, and which is owned, leased or otherwise controlled by Customer. "User" means a single person listed in any Customer directory or network storage location whose access and use rights can be authenticated, authorized, or administered by the CA Software. Unless otherwise specified, a User shall not be counted more than once or on a concurrent basis. “Non Tier Servers” means single server of any tier up to and including Tier 9 Server.
CA GEN Implementation Toolset
“Server” means a single physical or virtual computer which processes data using one or more central processing units, and which is owned, leased or otherwise controlled by Customer. "User" means a single person listed in any Customer directory or network storage location whose access and use rights can be authenticated, authorized, or administered by the CA Software. Unless otherwise specified, a User shall not be counted more than once or on a concurrent basis. “Non Tier Servers” means single server of any tier up to and including Tier 9 Server.
CA GEN TRANSACTIONEnabler
“Server” means a single physical or virtual computer which processes data using one or more central processing units, and which is owned, leased or otherwise controlled by Customer. "User" means a single person listed in any Customer directory or network storage location whose access and use rights can be authenticated, authorized, or administered by the CA Software. Unless otherwise specified, a User shall not be counted more than once or on a concurrent basis. “Non Tier Servers” means single server of any tier up to and including Tier 9 Server.
CA GEN TRANSACTION Enabler User Fnl
“Server” means a single physical or virtual computer which processes data using one or more central processing units, and which is owned, leased or otherwise controlled by Customer. "User" means a single person listed in any Customer directory or network storage location whose access and use rights can be authenticated, authorized, or administered by the CA Software. Unless otherwise specified, a User shall not be counted more than once or on a concurrent basis. “Non Tier Servers” means single server of any tier up to and including Tier 9 Server.
Version PS 1.0 Page 23 of 38 7/23/2014 10:36 AM
CA GEN WRKSTN Cross-Gen Linux
“Server” means a single physical or virtual computer which processes data using one or more central processing units, and whichis owned, leased or otherwise controlled by Customer. "User" means a single person listed in any Customer directory or network storage location whose access and use rights can be authenticated, authorized, or administered by the CA Software. Unless otherwise specified, a User shall not be counted more than once or on a concurrent basis. “Non Tier Servers” means single server of any tier up to and including Tier 9 Server.
CA Identity Manager
"User" means a single person listed in any Customer directory or network storage location whose access and use rights canbe authenticated, authorized, or administered by CA Identity Manager. Unless otherwise specified, a User shall not be counted more than once or on a concurrent basis. "Internal User" is an intranet User defined as an employee or contractor of the Customer. CAIdentity Manager may be used for Customer's internal use only, by the Internal Users on Customer's local area network and client/server system or a HTTP-based Web server infrastructure. Internal Users licensed hereunder may not be aggregated by a Customer contractor withany users of CA Identity Manager separately licensed by such contractor. "External User" is either an extranet or internet User defined as an employee of Customer's authorized third parties, which may be Customer's customers, clients, or consumers, on internet website(s) owned by, or under the control of, Customer. External Users licensed hereunder may not be aggregated by a Customer’s vendor or business partner with any Users of CA Identity Manager separately licensed by such vendor orpartner.
CA Infrastructure Insight
"Device” means a network-connected device that is managed by the CA Software and uses an Internet Protocol ("IP") address, including but not limited to IP and hybrid telephony devices, routers, appliances, hubs, physical servers, single-flow interfaces, andphysical machines, but excluding endpoint devices such as IP telephones. When the Authorized Use Limitation is “Device”, the calculation with respect to the number of Licenses is determined asfollows:
a. For network-connected devices, for any device with up to five (5) IPflow interfaces, count the number of devices. For any device with greater than five (5) IPflow interfaces, count the total number of IPflow interfaces. Divide the number of IPflow interfaces by five (5) and round up to the next wholenumber.
b. For network-connected devices, for any device with up to two hundred (200) ports, count the number of devices. For any device with greater than two hundred (200) ports, count the total number of ports. Divide the number of ports by two hundred (200) and round up to the next whole number.
For avoidance of doubt, when a single network-connected device, has greater than five (5) IPflow interfaces and greater than two hundred (200) ports, the device is included in the license count that results in the highest number of licenses. For example, a device with fifty (50) IPflow interfaces and six hundred (600) ports would be included in the license count based upon the number of IPflow interfaces (50/5 = 10 licenses while 600/200 = 3 licenses).
CA Infrastructure Insight consists of CA Spectrum Infrastructure Manager and CA NetQoS ReporterAnalyzer.
CA Database Performance is included in the delivery of CA Infrastructure Insight for use only for monitoring the databases included in CA Infrastructure Insight. Full functionality of CA Database Performance to monitor other databases requires a separate license for additional fees.
CA Systems Performance for Infrastructure Managers is included in the delivery of CA Infrastructure Insight for use only for provisioning and performance monitoring of the systems that are running CA Infrastructure Insight. Full functionality of CA Systems Performance for Infrastructure Managers requires a separate license for additionalfees.
If an Appliance is included with the CA Software, Support for a CA-provided physical server platform hardware appliance which is bundled with and used to operate one or more pre-installed licensed CA software products is provided in accordance with the CA Appliance Hardware Policy published on CA Support Online located athttp://support.ca.com.
CA Infrastructure Management
"Device” means a network-connected device that is managed by the CA Software and uses an Internet Protocol ("IP") address, including but not limited to IP and hybrid telephony devices, routers, appliances, hubs, physical servers, single-flow interfaces, andphysical machines, but excluding endpoint devices such as IP telephones. When the Authorized Use Limitation is “Device”, the calculation with respect to the number of Licenses is determined asfollows:
Version PS 1.0 Page 24 of 38 7/23/2014 10:36 AM
a. For network-connected devices, for any device with up to five (5) IPflow interfaces, count the number of devices. For any device with greater than five (5) IPflow interfaces, count the total number of IPflow interfaces. Divide the number of IPflow interfaces by five (5) and round up to the next wholenumber.
b. For network-connected devices, for any device with up to two hundred (200) ports, count the number of devices. For any device with greater than two hundred (200) ports, count the total number of ports. Divide the number of ports by two hundred (200) and round up to the next whole number.
For avoidance of doubt, when a single network-connected device, has greater than five (5) IPflow interfaces and greater than two hundred (200) ports, the device is included in the license count that results in the highest number of licenses. For example, a device with fifty (50) IPflow interfaces and six hundred (600) ports would be included in the license count based upon the number of IPflow interfaces (50/5 = 10 licenses while 600/200 = 3 licenses).
CA Infrastructure Management consists of CA Spectrum Infrastructure Manager, CA eHealth Performance Manager and CA NetQoS ReporterAnalyzer.
CA Database Performance is included in the delivery of CA Infrastructure Management for use only for monitoring the databases included in CA Infrastructure Management. Full functionality of CA Database Performance to monitor other databases requires a separate license for additional fees.
CA Systems Performance for Infrastructure Managers is included in the delivery of CA Infrastructure Management for use onlyfor provisioning and performance monitoring of the systems that are running CA Infrastructure Management. Full functionality of CA Systems Performance for Infrastructure Managers requires a separate license for additional fees.
If an Appliance is included with the CA Software, Support for a CA-provided physical server platform hardware appliance which is bundled with and used to operate one or more pre-installed licensed CA software products is provided in accordance with the CA Appliance Hardware Policy published on CA Support Online located athttp://support.ca.com.
CA Infrastructure Performance
"Device” means a network-connected device that is managed by the CA Software and uses an Internet Protocol ("IP") address, including but not limited to IP and hybrid telephony devices, routers, appliances, hubs, physical servers, single-flow interfaces, andphysical machines, but excluding endpoint devices such as IP telephones. When the Authorized Use Limitation is “Device”, the calculation with respect to the number of Licenses is determined asfollows:
a. For network-connected devices, for any device with up to five (5) IPflow interfaces, count the number of devices. For any device with greater than five (5) IPflow interfaces, count the total number of IPflow interfaces. Divide the number of IPflow interfaces by five (5) and round up to the next wholenumber.
b. For network-connected devices, for any device with up to two hundred (200) ports, count the number of devices. For any device with greater than two hundred (200) ports, count the total number of ports. Divide the number of ports by two hundred (200) and round up to the next whole number.
For avoidance of doubt, when a single network-connected device, has greater than five (5) IPflow interfaces and greater than two hundred (200) ports, the device is included in the license count that results in the highest number of licenses. For example, a device with fifty (50) IPflow interfaces and six hundred (600) ports would be included in the license count based upon the number of IPflow interfaces (50/5 = 10 licenses while 600/200 = 3 licenses).
CA Infrastructure Performance consists of CA eHealth Performance Manager and CA NetQoS ReporterAnalyzer.
CA Database Performance is included in the delivery of CA Infrastructure Performance for use only for monitoring the databases included in CA Infrastructure Performance. Full functionality of CA Database Performance to monitor other databases requires a separate license for additional fees.
CA Systems Performance for Infrastructure Managers is included in the delivery of CA Infrastructure Performance for use onlyfor provisioning and performance monitoring of the systems that are running CA Infrastructure Performance. Full functionality of CA Systems Performance for Infrastructure Managers requires a separate license for additional fees.
If an Appliance is included with the CA Software, Support for a CA-provided physical server platform hardware appliance which is bundled with and used to operate one or more pre-installed licensed CA software products is provided in accordance with the CA Appliance Hardware Policy published on CA Support Online located athttp://support.ca.com.
Version PS 1.0 Page 25 of 38 7/23/2014 10:36 AM
CA Insight Database Performance Manager
“Server” means a single physical or virtual computer which processes data using one or more central processing units, and whichis owned, leased or otherwise controlled by Customer.CA Systems Performance for Infrastructure Managers (formerly known as “CA System Edge”) Limited Use, is a separate program included in the delivery of CA Insight Database Performance Manager. The customers can use this program only for communication with other CA Technologies tools and/or monitoring CA Technologies Software systems only.Full functionality of the program to monitor and manage servers requires a separate license with additional fees.
CA IT Asset Manager
“CA Software” means the CA IT Asset Manager and CA Software Compliance Manager. A "Managed System" is any physical orvirtual desktop, laptop, server, and tablet computer that may be tracked and/or managed by the CA Software, based upon user-supplied unique designations to identify such computers, regardless of use purpose including non-production, spares, or disaster recovery. If the optional component CA Software Compliance Content Subscription is listed on the applicable Order Form, Customer is granted a term license to use such content with CA Software Compliance Manager or CA IT Asset Manager beginning on the Term Start Date and ending on the Term End Date. The subscription fees for CA Software Compliance Content Subscription include the right to receive content updates during the Term of the content subscription. Such license for CA Software Compliance Content Subscription shall renew at the option of the Ordering Activity and be extended for successive periods equivalent to the original subscription Term, subject to theparties' agreement concerning fees to be paid during each such extended term. Use of the CA Software is limited as to severalcomponents included unless separately licensed. Software technology for Software Distribution, Remote Control and Asset Discovery and Inventory (CA IT Client Management) are included with CA Software Compliance Manager and CA IT Asset Manager, however the only authorized use is the ability to import Microsoft SMS 2003 or Microsoft SystemCenter Configuration Manager 2007 through the CA Asset Converter for Microsoft SMS, importing inventory from other third party discovery tools using the Asset Collector technology and CA IT Client Manager technology. Explicitly, Customer is not licensed to use the software distribution, remote control technologies as well as the full asset inventory and discovery agents. Use of the CA Software or CA Software Compliance Content Subscription is not a substitute for Customer’s compliance with any laws (including but not limited to any act, statute, regulation, requirement, rule, standard, directive, administrative order, executive order, etc. (collectively, “Laws”)). Customer should consult with competent legal counsel regarding any such Laws. Use of the CA Software or CA Software Compliance Content Subscription is not a substitute for Customer’s compliance with its contractual obligations. The CA Software and CA Software Compliance Content Subscription require Customer to (i) manuallyor electronically enter or (ii) make decisions regarding software license data and other information for purposes of tracking authorized use, compliance with its software license contractual obligations and other information (“Data Entry”). Notwithstanding the provisions of any warranty to the contrary, CA makes no warranty with respect to the CA Software or CA Software Compliance Content Subscription failure, error, omission or inaccuracy to the extent that any such failure, error, omission or inaccuracy relates, in whole or in part, to Data Entry errors, omissions, decisions, inaccuracies, misinterpretations or otherwise.
CA IT Client Manager
"Managed System" is any physical or virtual computer system that can host an operating system, including, but not limited to, a desktop computer, server, or laptop computer, that is administered or managed by the CA Software (IT Client Manager / IT Inventory Manager) by way of a CA management agent, whether it resides on the asset or not. A “Non-CA managed system” has their inventory gathered by a non-CA management agent; however, the information about that asset is still stored in the Management Database (MDB). Thisasset information may have been obtained using the SMS Connector or Asset Collector. If Customer is licensed for CA IT Client Manager Patch Subscription, Customer is granted a term license to use such program with CA IT Client Manager beginning on the Term Start Date and ending on the End Date for the subscription term. The term license for the CA IT Client Manager Patch Subscription shall renew at the Ordering Activity’s option and be extended for successive periods equivalent to the original term, subject to the parties' agreement concerning fees to be paid during each extendedterm.
CA Mainframe for IBM Rational Developer for System z Unit Test (CA Mainframe Suite for RDz UT):
a) Additional license rights to the CA software program(s) referenced below (“CA Software”) are provided under the following terms and conditions in addition to any terms and conditions referenced (i) on the Order Form entered into by you and the CA entity (“CA”) through which you obtained a license for the CA Software and (ii) in the software license agreement between you and CA for the CA Software. These terms shall be effective from the effective date of the Order Form. b) Program Name: CA Mainframe Suite for IBM Rational Developer for System z Unit Test (“RDz UT”) Version PS 1.0 Page 26 of 38 7/23/2014 10:36 AM
c) Specified Operating Environment
The license rights set forth herein apply only to CA Software separately licensed from CA for the z/OS environment and for use hereunder only in the IBM RDz UT environment.
d) CA Software
CA Software for IBM RDz UT Environment:
CA 1™ Tape Management, CA TLMS® TapeManagement
CA ACF2™, CA ACF2™ Option for DB2
CA Aion® Business Rules Expert
CA Auditor for z/OS, CA Cleanup
CA Bundl®
CA Cleanup
CA Compliance Manager forz/OS
CA Database Management for DB2 forz/OS
CA Database Management for IMS forz/OS
CA Datacom®
CA Deliver™
CA Disk™ Backup and Restore
CA Dispatch™
CA Easytrieve®
CA Endevor® Software Change Manager
CA FileMaster™ Plus, CA FileMaster™ PlusIMS
CA Gen
CA Gener/OL
CA IDMS™
CA InterTest™ for CICS, CA InterTest™ Batch
CA JCLCheck™ Workload Automation
CA JobTrac™ Job Management
CA Librarian®
CA Mainframe Application Tuner
CA Mainframe Software Manager™
CA NetMaster® File Transfer Management, CA NetMaster® Network Automation, CA NetMaster® Network Management for SNA, CA NetMaster® Network Management for TCP IP
CA Optimizer®/II
CA Panvalet®
CA Roscoe®
Version PS 1.0 Page 27 of 38 7/23/2014 10:36 AM
CA Scheduler® Job Management
CA Spool™
CA SymDump® Batch, CA SymDump® for CICS
CA Telon®
CA Top Secret®, CA Top Secret® Option forDB2
CA UFO™
CA View®
CA Workload Automation CA 7® Edition, CA Workload Automation ESP Edition, CA Workload Automation Restart Option EE, CA Workload Automation Restart Option for z/OS Schedulers
CA XCOM™ Data Transport®
e) Licensing Model and Terms
The license rights set forth herein authorize you to use CA Software for which you are separately licensed only in the IBM RDz UT environment for non-production purposes. During the term of this license, you must also be licensed to use the IBM RDz UT environment. Use of the CA Software in any other environment or in the RDz UT environment for production purposes is expressly prohibited. This restriction does not change your existing license rights to use the CA Software in a production environment. A production environment is a computer system used to process an organization's daily work on a real-time operation and is not a system used only for development and testing. During the term of this license, if you license additional CA Software, the license rights granted herein apply to such subsequently licensed CASoftware.
The license rights are provided on a “per Seat” basis. “Seat” means a single person or identity whose access and use rights can be authenticated, authorized, or administered, or who has the ability to view content aggregated or managed by the CA Software. In general, a Seat shall not be counted more than once or on a concurrent (logged-in) basis. One Seat license shall authorize you to use any of the CA Software for which you are separately licensed in the RDz UT environment. The term of this license (the “Term”) is the lesser of: (i) one (1) year; (ii) the term end date for the applicable separately licensed CA Software; or (iii) the term end date for your use of the IBM RDz UT environment. Any termination under clauses (ii) or (iii) immediately above shall not result in refund of any license fees paid hereunder. Subject to the limitations set forth in clauses (i) (ii) and (iii) immediately above, any renewal or extension of the license term for the separately licensed CA Software or the IBM RDz UT environment, as the case may be, shall continue the Term of this agreement for the period identified above. If you have multiple CA Software products with different term end dates, the license rights granted herein terminate as to each specific CA Software product in the lesser of one (1) year or when the applicable term license for such CA Software ends. Termination of license rights hereunder shall not terminate your license to any CA Software product.
CA does not provide support for the CA Software in the RDz UT environment. Any issues with the CA Software in the RDz UT environment must be reproduced by you in the z/OS environment and reported as such through CA Technologies normal support process for the CA Software.
CA NetQoSNetVoyant
"Device” means a network-connected device that is managed by the CA Software and uses an Internet Protocol ("IP") address, including but not limited to IP and hybrid telephony devices, routers, appliances, hubs, physical servers, single-flow interfaces, andphysical machines. Endpoint devices used solely as IP telephones are not considered to be Devices, unless the CA Software is specifically licensed by the number of phones. For the purposes of CA NetQoS Unified Communication Monitor only, endpoint devices used solely asIP telephones are considered to be Devices. When the Authorized Use Limitation is “Device”, the calculation with respect to the number of Licenses is determined asfollows:
1. For network-connected devices, in non-virtual server environments, for any device with up to five (5) IPflow interfaces, count the number of devices. For any device with greater than five (5) IPflow interfaces, count the total number of IPflow interfaces. Divide the number of IPflow interfaces by five (5) and round up to the next whole number.
Version PS 1.0 Page 28 of 38 7/23/2014 10:36 AM
2. For network-connected devices, in non-virtual server environments, for any device with up to two hundred (200) ports, count the number of devices. For any device with greater than two hundred (200) ports, count the total number of ports. Divide the number of ports by two hundred (200) and round up to the next whole number.
For avoidance of doubt, when a single network-connected device, in non-virtual environments, has greater than five (5) IPflow interfaces and greater than two hundred (200) ports, the device is included in the license count that results in the highest number of licenses. For example, a device with fifty (50) IPflow interfaces and six hundred (600) ports would be included in the license count based upon the number of IPflow interfaces (50/5 = 10 licenses while 600/200 = 3licenses).
CA NetQoS Reporter Analyzer
"Device” means a network-connected device that is managed by the CA Software and uses an Internet Protocol ("IP") address, including but not limited to IP and hybrid telephony devices, routers, appliances, hubs, physical servers, single-flow interfaces, andphysical machines. Endpoint devices used solely as IP telephones are not considered to be Devices, unless the CA Software is specifically licensed by the number of phones. For the purposes of CA NetQoS Unified Communication Monitor only, endpoint devices used solely asIP telephones are considered to be Devices. When the Authorized Use Limitation is “Device”, the calculation with respect to the number of Licenses is determined asfollows:
1. For network-connected devices, in non-virtual server environments, for any device with up to five (5) IPflow interfaces, count the number of devices. For any device with greater than five (5) IPflow interfaces, count the total number of IPflow interfaces. Divide the number of IPflow interfaces by five (5) and round up to the next whole number.
2. For network-connected devices, in non-virtual server environments, for any device with up to two hundred (200) ports, count the number of devices. For any device with greater than two hundred (200) ports, count the total number of ports. Divide the number of ports by two hundred (200) and round up to the next whole number.
For avoidance of doubt, when a single network-connected device, in non-virtual environments, has greater than five (5) IPflow interfaces and greater than two hundred (200) ports, the device is included in the license count that results in the highest number of licenses. For example, a device with fifty (50) IPflow interfaces and six hundred (600) ports would be included in the license count based upon the number of IPflow interfaces (50/5 = 10 licenses while 600/200 = 3licenses).
CA RegFort:
CA RegFort is licensed by the number of Users orIssuance. "User" means a single person, or identity, listed in any Customer directory or network storage location whose access and use rights can be authenticated, authorized, or administered by CA RegFort or who has the ability to view content aggregated or managed by CA RegFort. In general, a user shall not be counted more than once or on a concurrent (logged-in)basis. “Issuance” means any activity in the life cycle of a Public Key Infrastructure credential that is managed by CA RegFort, including, but not limited to, creation of a new credential, revocation, renewal, re-issue or update of the credential. “RegFort Client” means a portion of CA RegFort which enables end-users to interface with smartcards and tokens.
Limited License Grant. In addition to the rights granted in the applicable license agreement, CA grants Customer and its affiliates a nonexclusive license to distribute RegFort Client to end-users. Customer may use Customer’s logo and name with the RegFort Client. No title to or ownership of the RegFort Client is transferred toCustomer.
CA RiskFort:
CA RiskFort is licensed by the number ofUsers.
"User" means a single person, or identity, listed in any Customer directory or network storage location whose access and use rights can be authenticated, authorized, or administered by CA RiskFort or who has the ability to view content aggregated or managed by CA RiskFort.
In general, a user shall not be counted more than once or on a concurrent (logged-in)basis.
Version PS 1.0 Page 29 of 38 7/23/2014 10:36 AM
CA Role and Compliance Manager
"User" means a single person listed in any Customer directory or network storage location whose access and use rights canbe authenticated, authorized, or administered by the CA Software. Unless otherwise specified, a User shall not be counted more than once or on a concurrent basis. An "Internal User" is an intranet User defined as an employee or contractor of the Customer. CA Roleand Compliance Manager may be used for Customer's internal use only, by the Internal Users on Customer's local area networkand client/server system or a HTTP-based Web server infrastructure. Internal Users licensed hereunder may not be aggregated by a Customer contractor with any users of CA Role and Compliance Manager separately licensed by such contractor. An "External User" is either an extranet or internet User defined as an employee of Customer's authorized third parties, which may be Customer's customers, clients, or consumers, on internet website(s) owned by, or under the control of, Customer. External Users licensed hereunder may not be aggregated by a Customer’s vendor or business partner with any Users of CA Role and Compliance Manager separately licensed by such vendor or partner.
CA Server Automation
“Physical Socket” means an electrical component attached to a printed circuit board (“PCB”) and electrically interconnects a central processing unit (“CPU”) and PCB. A CPU is the specialized integrated circuit that executes binary programs and performs most logical functions or calculations. One physical CPU may have up to twelve (12) processing cores.
CA Systems Performance for Infrastructure Manager (SystemEDGE) and CA Virtual Assurance for Infrastructure ManagerAIMS components are included in the delivery of the CA Server Automation for use only with this product. Use of these components with other CA products requires a separate license for additionalfees.
CA IT Client Management solution consists of CA Software Delivery, CA Asset Management, CA Remote Control programs and is included in the delivery of the CA Server Automation. Customer may only use these components to manage server class machines, including virtual machines. Use of these programs for managing desktops, laptops and other client devices requires separate licenses for additional fees.
CA Asset Intelligence and CA Patch Manager programs are included in the delivery of the CA Server Automation. Customer may only use these components to manage server class machines, including virtual machines. Use of these programs for managing desktops, laptops and other client devices requires separate licenses for additionalfees.
CA Service Desk Manager
"CA Software" and “SDM” mean the CA Service Desk Manager – Analyst License, CA Service Desk Manager - Full License, or CA CMDB Manager Servers described herein in object code form. CA Service Desk Manager-Full License and CA Service DeskManager-Analyst License are licensed on a Concurrent Analyst basis. In CA Service Desk Manager-Full License, CA Service Desk Manager-Analyst License, the authorized users are assigned various roles based upon the functions needed to accomplish designated tasks. "Concurrent Analyst", in the context of CA Service Desk Manager, means a software license that is based on the number of simultaneous (concurrent) users accessing the program. For the purpose of SDM, all roles (for example: Analyst, Manager, Administrator), and programmatic API and/or web services calls require a license. The Software does not prohibit additional users from access, but does log a license exception for auditing purposes. Customer is entitled to have the specified number of Concurrent Analysts access CA Service Desk Manager simultaneously. For CA Service Desk Manager-Full License, CA Service Desk Manager-Analyst License, You are also licensed for End-User Self-Service, which is granted to the employee and customer roles to allow for the creation, modification, and closure of a ticket on their own behalf, but not on behalf of someone else. CA Service Desk Manager-Full License includes a limited entitlement to CA Cohesion, and use of CA Cohesion is restricted to a maximum of one hundred (100) Managed Servers. Use for additional Servers requires additional licenses for CA CMDB Managed Server. CA Service Desk Manager-Analyst License does not include the CA Cohesion entitlement. CA CMDB Managed Servers is licensed by the number of Servers. "Managed Servers" means a virtual or physical Server managed by CA Software. “Server” means a single physical or virtual computer which processes data using one or more central processing units, and which is owned, leasedor otherwise controlled by Customer.
CA Service Desk Manager includes a limited entitlement to CA Business Intelligence. This entitlement is restricted to use within the context of reporting for SDM only. Specifically, SDM reports created using CA Business Intelligence may access and incorporate data created by, derived from, or used by SDM or third party data sources, provided that such data facilitates or augments data for Customer's use of SDM.
Version PS 1.0 Page 30 of 38 7/23/2014 10:36 AM
CA Service Desk Manager includes a limited entitlement to CA Process Management for Workflows. This entitlement is restricted to use within the context of Workflows associated with SDM only. This entitlement includes: the Service Desk Manager connector; three (3) Custom Operators; and five (5) Agents. This entitlement does not include any Premium Connectors. Multiple Orchestrators canbe deployed with the constraints specified herein. There are no license limitations on the number of concurrent processes per Orchestrator.
For the purpose of CA Process Management for Workflows, "Agent" means a single installation of the agent software component of the CA Process Management for Workflows on a specific operating system which can be identified as a unique host identification on a physical or virtual hardware server.
For the purpose of CA Process Management for Workflows, "Connector" is the software program connecting CA Process Management for Workflows with specifically named third-party software or other CA software. For example, "CA Process Management for Workflows Connector for CA Service Desk Manager" connects CA Process Management for Workflows with CA Service Desk Manager. Each Connector may only be used to connect the CA Software with the specific named third-party software or CA software program.
For the purpose of CA Process Management for Workflows, "Custom Operator" means a type of automation object within the CA Process Management for Workflows that can be created to enhance, modify, or restrict the capabilities of an existing "Connector".
For the purpose of CA Process Management for Workflows, "Orchestrator" means a single installation of the Orchestrator software component of CA Process Management for Workflows on a specific operating system which can be identified as a uniquehost identification on a physical or virtual hardware server. This installation can be a stand-alone Orchestrator or as a node of a new or existing clusteredOrchestrator.
CA SiteMinder
"User" means a single person listed in any Customer directory or network storage location whose access and use rights canbe authenticated, authorized, or administered by the CA Software. Unless otherwise specified, a User shall not be counted more than once or on a concurrent basis. An "Internal User" is an intranet User defined as an employee or contractor of the Customer. CA SiteMinder may be used for Customer's internal use only, by the Internal Users on Customer's local area network and client/server system or a HTTP-based Web server infrastructure. Internal Users licensed hereunder may not be aggregated by a Customer contractor with any users ofCA SiteMinder separately licensed by such contractor. An "External User" is either an extranet or internet User defined as an employee of Customer's authorized third parties, which may be Customer's customers, clients, or consumers, on internet website(s) owned by, or under the control of, Customer. External Users licensed hereunder may not be aggregated by a Customer’s vendor or businesspartner with any Users of CA SiteMinder separately licensed by such vendor orpartner.
CA SOA Security Manager<br /><br />"Secured Web Service" means a software system designed to support interoperablemachine-tomachine interaction over a network which needs to be secured from unauthorized access, software routines or components that is or are intended to disable, erase, or otherwise harm software, equipment, or data, or cause other similar damage. This web service can be a URI or web services End point defined in a WSDL file. "URI" (Uniform Resource Identifier) means a compact string of characters for identifying an abstract or physical resource. “End point” means a specific location for accessing a web service using a specific protocol and data format. "WSDL" (Web Service Definition Language) means an XML (Extensible Markup Language) format for describing network services as a set of endpoints operating on messages containing either document-oriented or procedure-oriented information. "User" means a single person, application or identity listed in any Customer directory or network storage location whose access and use rights canbe authenticated, authorized, or administered by the CA Software or who has the ability to view content aggregated or managed by CA SOA Security Manager. In general, a user shall not be counted more than once or on a concurrent (logged-in) basis.
CA SOA Security Manager withGateway
CA SOA Security Manager is licensed in number of Secured Web Services and Users. CA SOA Security Gateway is licensed in number of Instances. "Secured Web Service" means a software system designed to support interoperable machine-to-machine interaction over a network which needs to be secured from unauthorized access, software routines or components that is or are intended to disable, erase, Version PS 1.0 Page 31 of 38 7/23/2014 10:36 AM
or otherwise harm software, equipment, or data, or cause other similar damage. This web service can be a URI or web services End point defined in a WSDL file. "URI" (Uniform Resource Identifier) means a compact string of characters for identifying an abstract or physical resource. “End point” means a specific location for accessing a web service using a specific protocol and data format. "WSDL" (Web Service Definition Language) means an XML (Extensible Markup Language) format for describing network services as a set of endpoints operating on messages containing either document-oriented or procedure-oriented information. "User" means a singleperson, application or identity listed in any Customer directory or network storage location whose access and use rights can be authenticated, authorized, or administered by CA SOA Security Manager or who has the ability to view content aggregated or managed by CA SOA Security Manager. In general, a user shall not be counted more than once or on a concurrent (logged-in) basis. "Installation" means the number of copies of CA SOA Security Manager installed in the Customer’s physical and/or virtual environment.
CA Spectrum Infrastructure Manager
"Managed Network Device” means a virtual or physical network-connected device with less than 200 ports that is managed byCA Spectrum Infrastructure Manager and uses an Internet Protocol ("IP") address, including but not limited to IP and hybridtelephony devices, routers, appliances, hubs, virtual or physical servers, and virtual or physical machines, but excluding endpoint devices such as IP telephones.
CA Spectrum Service Assurance
“Site” or “Installation” means use of CA Spectrum Service Assurance in a data center comprised of one or more CPUs conforming to the following conditions: Two or more CPUs will be considered part of the same site if (i) the CPUs are located in a single building, (ii) each CPU shares access to data storage and peripheral devices with one or more of the other CPUs without requiring any programming interface to another CPU, and (iii) the CPUs function as a data processing facility under common data processing operations supervision. Use of CA Spectrum Service Assurance on two or more CPUs will be considered multiple and separate sites if all of the foregoing conditions of a single site are not satisfied, regardless of (i) whether they occupy different floors or locations in the same building or share the same mailing location address, or (ii) the extent to which the CPUs are integrated within a network or serve a functional role as part of a larger data processing organization. Customer is granted the right to deploy CA Spectrum Service Assurance at the Sites with the addresses listed in the Order Form. Customer may change and amend the addresses of the Sites by notice to CA providing that the total number of Sites listed does not exceed the number listed in the Order Form. “Connection” means a data source indicated by CA SpectrumService Assurance to have a connector status of “Online”. A Connection may consist of a connection to a CA Software product (i.e. CA Wily, CA Spectrum), a third party product (i.e. HPOV), or a custom application. “Data source” means any software application that provides data to CA Spectrum Service Assurance.
CA SYSVIEW for CA Wily APM
Customer is granted a limited license to use CA SYSVIEW for CA Wily APM solely for the integration with CA Wily APM or CA Wily Introscope 8.2 or above (“CA Wily”). With this license, Customer is only authorized to install, configure and use CA SYSVIEW for CA Wily APM components to support its authorized use with CA Wily to provide mainframe performance metrics to CA Wily and trace transactions tagged by CA Wily that perform activity on the mainframe. Customer may not use CA SYSVIEW for CA Wily APM for other purposes. Any additional use requires a separate non-restricted license. In the event Customer chooses to increase its Authorized Use for CA Wily, Customer must also increase its Authorized Use for CA SYSVIEW for CA Wily APM and pay all applicable additional license and maintenance fees related thereto in order to use CA SYSVIEW for CA Wily APM with such increased CA Wily capacity. Additional use of CA Wily without obtaining a separate non-restricted license may be the basis for filing a claim with the relevant Contracting Officer under the Contract Disputes Act and FAR 52.233-1.
CA TSreorg for DistributedDatabases
“Server” means a single physical or virtual computer which processes data using one or more central processing units, and which is owned, leased or otherwise controlled by Customer.
Version PS 1.0 Page 32 of 38 7/23/2014 10:36 AM
CA Virtual Assurance
“Physical Socket” means an electrical component attached to a printed circuit board (“PCB”) and electrically interconnects a central processing unit (“CPU”) and PCB. A CPU is the specialized integrated circuit that executes binary programs and performs most logical functions or calculations. One physical CPU may have up to twelve (12) processing cores.
If an Appliance is included with the CA Software, Support for an Appliance is provided in accordance with the CA Appliance Hardware Policy published on CA Support Online located athttp://support.ca.com.
CA Virtual Automation
“Physical Socket” means an electrical component attached to a printed circuit board (“PCB”) and electrically interconnects a central processing unit (“CPU”) and PCB. A CPU is the specialized integrated circuit that executes binary programs and performs most logical functions or calculations. One physical CPU may have up to twelve (12) processing cores.
CA Virtual Configuration
“Physical Socket” means an electrical component attached to a printed circuit board (“PCB”) and electrically interconnects a central processing unit (“CPU”) and PCB. A CPU is the specialized integrated circuit that executes binary programs and performs most logical functions or calculations. One physical CPU may have up to twelve (12) processing cores.
CA Virtual Performance Management (CAVPM)
“CPU” or “Processor” means central processing unit which is the specialized integrated circuit that executes binary programs and performs most logical functions or calculations. A Processor may not exceed a maximum of 12 processing cores.
CA WebFort:
CA WebFort is licensed by the number of User Credentials andUsers. “Credential” means an attestation of qualification, competence, or authority issued to a User by the CA Software. "User" means a single person, or identity, listed in any Customer directory or network storage location whose access and use rights can be authenticated, authorized, or administered by CA WebFort or who has the ability to view content aggregated or managed by CA WebFort.
In general, a user shall not be counted more than once or on a concurrent (logged-in)basis. “User Credentials” means the number of Credentials set forth on the Order Form to be issued to the Users who are authorized to access and use CA WebFort. Each User may have more than one credential for different verification methods. “ArcotID Client” or “ArcotOTP Client” means portions of CA WebFort which enable end-users to use the ArcotID and ArcotOTP credentials.
Limited License Grant. In addition to the rights granted in the applicable license agreement, CA grants Customer and its affiliates a nonexclusive license to distribute the ArcotID Client or ArcotOTP Client to end users. Customer may use Customer’s logo and name with the ArcotID Client or ArcotOTP Client. No title to or ownership of the ArcotID Client or ArcotOTP Client is transferred to Customer.
CA Wily Application Performance Management v9 (CA WilyAPMv9) CA Wily APMv9 is licensed by (1) the number of CPUs when used as a distributed product or by (2)(a) millions of service units (“MSUs”) and number of System z Application Assist Processors (“zAAPs”) and number of System z Integrated Information Processors (“zIIPs”) or (b) number of integrated facilities for Linux (“IFLs”), when used in the mainframe environment. “CPU” means a central processing unit which is the specialized integrated circuit that executes binary programs and performs most logical functions or calculations. A dual-core central processing unit is considered a single CPU. Note that because of the use of multi-core CPUs and virtual server environments,the calculation of CPUs for licensing purposes described below will not always equate to the number of physical CPUs in the environment. A virtual server environment is created where virtual machine technology (which applies to both client and server hardware) is used to enable multiple instances of an operating system(s) to run on a single computer simultaneously (“Virtual Machine Technology”). When the Version PS 1.0 Page 33 of 38 7/23/2014 10:36 AM
Authorized Use Limitation is “CPU” or “Processor”, the calculation with respect to the number of CPUs on an individual server is determined asfollows:
1. For non-virtual server environments, for any server with applications monitored by the CA Software with single CPUs (including, for the avoidance of doubt, dual-core CPUs), count the number of CPUs. For any server with applications monitored by the CA Software with greater than dual-core CPUs, count all cores of the CPUs. Divide the number of cores by two (2) and round up to the next whole number.
2. For virtual server environments, for any server with single CPUs (including, for the avoidance of doubt, dual-core CPUs), count the number of CPUs. For any server with greater than dual-core CPUs, count all cores of the CPUs. Divide the number of cores by two (2) and round up to the next whole number. Determine the maximum percentage of the server CPU capacity that is allocated by the Virtual Machine Technology to any operating system instance containing application(s) monitored by the CA Software, and multiply this percentage by the number of CPUs. Multiply the resulting number by one and a half (1.5X) and round up to the next whole number.
3. For mixed server environments, for each server perform the calculations for CPUs as set forth above in subparagraphs (1) and (2) and add these amounts together to determine the aggregate number of CPUs.
When the Authorized Use Limitation is “MSUs”, “zAAPs”, or “zIIPs” (i) the MSUs shall be calculated by totaling the MSU capacity for all logical partitions, or LPARs, that run an application monitored by the CA Software, (ii) the zAAPs shall be calculated by totaling the number of zAAP engines attached to such LPARs, and (iii) the zIIPs shall be calculated by totaling the number of zIIP engines attached to such LPARs. An “LPAR” means the division of a computer’s processors, memory, and storage into multiple sets of resources so that each set of resources is operated independently with its own physical or virtual operating system instance and applications.
When the Authorized Use Limitation is “IFLs”, the IFLs shall be calculated by totaling the number of IFL engines that run an application monitored by the CA Software.
CA Wily Transaction Impact Monitor (“TIM”) “Software Appliance” means the software running TIM on Customer’s network feed to capture http/https transactions necessary for the Customer Experience analysis portion of CA Wily APMv9. Customer is responsible for providing hardware on which to run the TIM Software Appliance that meets CA’s specifications. Customer must license a copy of the TIM Software Appliance for each physical server (regardless of the number of CPUs) on which a TIM Software Appliance will be installed and configured.
CA Wily Application Performance Management (CA WilyAPM) CA Wily APM is licensed by (1) the number of CPUs when used as a distributed product or by (2)(a) millions of service units (“MSUs”) and number of System z Application Assist Processors (“zAAPs”) and number of System z Integrated Information Processors (“zIIPs”) or (b) number of integrated facilities for Linux (“IFLs”), when used in the mainframe environment. “CPU” means a central processing unit which is the specialized integrated circuit that executes binary programs and performs most logical functions or calculations. A dual-core central processing unit is considered a single CPU. Note that because of the use of multi-core CPUs and virtual server environments,the calculation of CPUs for licensing purposes described below will not always equate to the number of physical CPUs in the environment. A virtual server environment is created where virtual machine technology (which applies to both client and server hardware) is used to enable multiple instances of an operating system(s) to run on a single computer simultaneously. When the Authorized Use Limitation is “CPU” or “Processor”, the calculation with respect to the number of CPUs on an individual server is determined as follows:
1. For non-virtual server environments, for any server with applications monitored by the CA Software with single CPUs (including, for the avoidance of doubt, dual-core CPUs), count the number of CPUs. For any server with applications monitored by the CA Software with greater than dual-core CPUs, count all cores of the CPUs. Divide the number of cores by two (2) and round up to the next whole number.
2. For virtual server environments, for any server with single CPUs (including, for the avoidance of doubt, dual-core CPUs), count the number of CPUs. For any server with greater than dual-core CPUs, count all cores of the CPUs. Divide the number of cores by two (2) and round up to the next whole number. Determine the maximum percentage of the server CPU capacity that is allocated by the Virtual Machine Technology to any operating system instance containing application(s) monitored by the CA Software, and multiply this percentage by the number of CPUs. Multiply the resulting number by one and a half (1.5X) and round up to the next whole number.
3. For mixed server environments, for each server perform the calculations for CPUs as set forth above in subparagraphs (1) and (2) and add these amounts together to determine the aggregate number of CPUs.
Version PS 1.0 Page 34 of 38 7/23/2014 10:36 AM
When the Authorized Use Limitation is “MSUs”, “zAAPs”, or “zIIPs” (i) the MSUs shall be calculated by totaling the MSU capacity for all logical partitions, or LPARs, that run an application monitored by the CA Software, (ii) the zAAPs shall be calculated by totaling the number of zAAP engines attached to such LPARs, and (iii) the zIIPs shall be calculated by totaling the number of zIIP engines attached to such LPARs. An “LPAR” means the division of a computer’s processors, memory, and storage into multiple sets of resources so that each set of resources is operated independently with its own physical or virtual operating system instance and applications.
When the Authorized Use Limitation is “IFLs”, the IFLs shall be calculated by totaling the number of IFL engines that run an application monitored by CA Wily APM.
An Appliance is a CA-supplied physical server (“Hardware”) that is bundled with and used to operate the CA Software licensedby Customer which is pre-installed on the Hardware. Support is provided in accordance with the CA Appliance Hardware Policy published on CA Support Online located at http://support.ca.com. Customer must acquire at least one license (per CPU, MSU or IFL) in order to purchase a CA Wily Transaction Impact Monitor (“TIM”) or CA Wily Transaction Event & Statistics Server (“TESS”). Both a TIM and a TESS are required for any production installation. CA Wily Solutions for Lab Environments (“Wily LAB”) is a single Appliance that contains TIM and TESS capabilities but is not supported for a production environment. The Wily LAB system includes one CPU license for CA Wily APM at no additional charge.
CA Wily Customer Experience Manager (CA Wily CEM)
CA Wily CEM is licensed by (1) the number of CPUs when used as a distributed product or by (2)(a) millions of service units (“MSUs”) and number of System z Application Assist Processors (“zAAPs”) and number of System z Integrated Information Processors (“zIIPs”) or(b) number of integrated facilities for Linux (“IFLs”), when used in the mainframe environment. “CPU” means a central processing unit which is the specialized integrated circuit that executes binary programs and performs most logical functions or calculations. A dual-core central processing unit is considered a single CPU. Note that because of the use of multi-core CPUs and virtual server environments,the calculation of CPUs for licensing purposes described below will not always equate to the number of physical CPUs in the environment. A virtual server environment is created where virtual machine technology (which applies to both client and server hardware) is used to enable multiple instances of an operating system(s) to run on a single computer simultaneously (“Virtual Machine Technology”). When the Authorized Use Limitation is “CPU” or “Processor”, the calculation with respect to the number of CPUs on an individual server is determined asfollows:
1. For non-virtual server environments, for any server with applications monitored by the CA Software with single CPUs (including, for the avoidance of doubt, dual-core CPUs), count the number of CPUs. For any server with applications monitored by the CA Software with greater than dual-core CPUs, count all cores of the CPUs. Divide the number of cores by two (2) and round up to the next whole number.
2. For virtual server environments, for any server with single CPUs (including, for the avoidance of doubt, dual-core CPUs), count the number of CPUs. For any server with greater than dual-core CPUs, count all cores of the CPUs. Divide the number of cores by two (2) and round up to the next whole number. Determine the maximum percentage of the server CPU capacity that is allocated by the Virtual Machine Technology to any operating system instance containing application(s) monitored by the CA Software, and multiply this percentage by the number of CPUs. Multiply the resulting number by one and a half (1.5X) and round up to the next whole number.
3. For mixed server environments, for each server perform the calculations for CPUs as set forth above in subparagraphs (1) and (2) and add these amounts together to determine the aggregate number of CPUs.
When the Authorized Use Limitation is “MSUs”, “zAAPs”, or “zIIPs” (i) the MSUs shall be calculated by totaling the MSU capacity for all logical partitions, or LPARs, that run an application monitored by the CA Software, (ii) the zAAPs shall be calculated by totaling the number of zAAP engines attached to such LPARs, and (iii) the zIIPs shall be calculated by totaling the number of zIIP engines attached to such LPARs. An “LPAR” means the division of a computer’s processors, memory, and storage into multiple sets of resources so that each set of resources is operated independently with its own physical or virtual operating system instance and applications.
When the Authorized Use Limitation is “IFLs”, the IFLs shall be calculated by totaling the number of IFL engines that run an application monitored by the CA Software.
An Appliance is a CA-supplied physical server (“Hardware”) that is bundled with and used to operate the CA Software licensed by Customer which is pre-installed on the Hardware. Support is provided in accordance with the CA Appliance Hardware Policy published on CA Support Online located at http://support.ca.com. Customer must acquire at least one license (per CPU, MSU or IFL) in order to purchase a CA Wily Transaction Impact Monitor (“TIM”) or CA Wily Transaction Event & Statistics Server (“TESS”). Both a TIM and a TESS are required for any production installation. CA Wily Solutions for Lab Environments (“Wily LAB”) is a single appliance that containsTIM and TESS capabilities but is not supported for a production environment. The Wily LAB system includes one CPU license for CA Wily CEM at no additional charge.
Version PS 1.0 Page 35 of 38 7/23/2014 10:36 AM
CA Wily Introscope
CA Wily Introscope is licensed by (1) the number of CPUs when used as a distributed product or by (2)(a) millions of service units (“MSUs”) and number of System z Application Assist Processors (“zAAPs”) and number of System z Integrated Information Processors (“zIIPs”) or (b) number of integrated facilities for Linux (“IFLs”), when used in the mainframe environment. “CPU” means a central processing unit which is the specialized integrated circuit that executes binary programs and performs most logical functions or calculations. A dual-core central processing unit is considered a single CPU. Note that because of the use of multi-core CPUs and virtual server environments,the calculation of CPUs for licensing purposes described below will not always equate to the number of physical CPUs in the environment. A virtual server environment is created where virtual machine technology (which applies to both client and server hardware) is used to enable multiple instances of an operating system(s) to run on a single computer simultaneously (“Virtual Machine Technology”). When the Authorized Use Limitation is “CPU” or “Processor”, the calculation with respect to the number of CPUs on an individual serveris determined asfollows:
1. For non-virtual server environments, for any server with applications monitored by the CA Software with single CPUs (including, for the avoidance of doubt, dual-core CPUs), count the number of CPUs. For any server with applications monitored by the CA Software with greater than dual-core CPUs, count all cores of the CPUs. Divide the number of cores by two (2) and round up to the next whole number.
2. For virtual server environments, for any server with single CPUs (including, for the avoidance of doubt, dual-core CPUs), count the number of CPUs. For any server with greater than dual-core CPUs, count all cores of the CPUs. Divide the number of cores by two (2) and round up to the next whole number. Determine the maximum percentage of the server CPU capacity that is allocated by the Virtual Machine Technology to any operating system instance containing application(s) monitored by the CA Software, and multiply this percentage by the number of CPUs. Multiply the resulting number by one and a half (1.5X) and round up to the next whole number.
3. For mixed server environments, for each server perform the calculations for CPUs as set forth above in subparagraphs (1) and (2) and add these amounts together to determine the aggregate number of CPUs.
When the Authorized Use Limitation is “MSUs”, “zAAPs”, or “zIIPs” (i) the MSUs shall be calculated by totaling the MSU capacity for all logical partitions, or LPARs, that run an application monitored by the CA Software, (ii) the zAAPs shall be calculated by totaling the number of zAAP engines attached to such LPARs, and (iii) the zIIPs shall be calculated by totaling the number of zIIP engines attached tosuch LPARs. An “LPAR” means the division of a computer’s processors, memory, and storage into multiple sets of resources so that each set of resources is operated independently with its own physical or virtual operating system instance and applications. When the Authorized Use Limitation is “IFLs”, the IFLs shall be calculated by totaling the number of IFL engines that run an application monitored by the CA Software.
CA Workload Automation
“Instance” means the number of copies of the CA Software installed in the Customer physical and/or virtual environment.
CA XCOM Data Transport for Windows Family Server
“Server” means a single physical or virtual computer which processes data using one or more central processing units, and which is owned, leased or otherwise controlled by Customer.
CA eHealth Performance Manager
"Managed Network Device” means a virtual or physical network-connected device with less than 200 ports that is managed by the CA Software and uses an Internet Protocol ("IP") address, including but not limited to IP and hybrid telephony devices, routers, appliances, hubs, virtual or physical servers, and virtual or physical machines, but excluding endpoint devices such as IP telephones.
Mainframe CPU CA Software only
The CA Software is licensed by the specified number and model of CPU (the “Authorized Use Limitation”). “CPU” shall mean the central processing unit(s) capable of running the CA Software. Customer may only use CPUs specified when licensing the licenses herein and upon which the CA Software is installed and runs ("Designated CPUs"). Customer may change the Designated CPU on providing writtennotice to CA provided that such replacement CPU is of the same or lower CPU tier/power rating to the Designated CPU (save that Customer may Version PS 1.0 Page 36 of 38 7/23/2014 10:36 AM
require an authorization key from CA in order to commence use of such CPU). Should Customer wish to add to the number of Designated CPUs or upgrade the then current Designated CPU(s) to a CPU with greater tier/power rating, Customer may elect to do so by providing CA with prior written notice of such additional CPU and/or upgrade to the Designated CPU(s) and by executing an order form to effect such addition/change and purchasing the applicablelicense.
Mainframe MIPS CA Software only
The CA Software is licensed by the specified number of MIPS (the “Authorized Use Limitation in MIPS”). “MIPS” means millionsof instructions per second. The MIPS capacity of a computer shall be calculated by reference to CA's published schedules of the MIPS capacity and if a computer isn’t listed then the manufacturer’s published specifications should apply. Further, in the event a special purpose processor, designed to perform one or more dedicated functions, is being used as a general purpose processor, CA shalltreat such processor as a general purpose processor for purposes of calculating Authorized Use Limitation in MIPS. "Customer Site" means the site(s) specified at the time of licensing the CA Software or the Customer Address if no Customer Site has been indicated. Customer may use the CA Software only on the specific computers upon which the CA Software is installed to run at the Customer Site or on computers which are linked, connected to and/or which can remotely access such computers, irrespective of the platform designations ofthe hardware or operating systems, provided that such computer is capable of accessing, using, executing or benefiting from the CA Software, subject to the aggregate MIPS capacity not exceeding the Authorized Use Limitation in MIPS.
Mainframe MSU CA Software only
The CA Software is licensed by the specified number of MSU (the “Authorized Use Limitation in MSU”). “MSU” means millions of service units. The MSU capacity shall be calculated with the aggregate computing power (expressed in millions of service units) by reference to CA’s published schedules of the MSU capacity and if a computer isn’t listed then the manufacturer’s published specifications shall apply of all computers upon which the CA Software is installed to run at the Customer Site ("Customer Site" means the site(s) specified at the time of licensing the CA Software or the Customer Address if no Customer Site has been indicated) or computers which are linked, connected to and/or which can remotely access such computers, irrespective of the platform designations of the hardware or operatingsystems, provided that such computer is capable of accessing, using, executing or benefiting from the CA Software. Customer may use the CA Software subject to the aggregate MSU Capacity not exceeding the Authorized Use Limitation in MSU.
Pervasive Software:
The Pervasive Software is licensed by either by the number of Server or Users. Pervasive Software may be used to build integrations that connect to any authorized CA Clarity environment.
Pervasive Data Integrator Engine/Agent for CA Clarity PPM* is licensed by the number of Servers. * includes one User license of Pervasive Data Integrator Analyst Studio for CA ClarityPPM Pervasive Data Integrator Analyst Studio for CA Clarity PPM is licensed by the number of Users.
Pervasive Data Profiler Engine for CA Clarity PPM is licensed by the number of Servers.
Pervasive Data Profiler Analyst Studio for CA Clarity PPM is licensed by the number ofUsers. “Server” means a single physical or virtual computer which processes data using one or more central processing units, and which is owned, leased or otherwise controlled by Customer.
“User” means a single person listed in any Customer directory or network storage location whose access and use rights canbe authenticated, authorized, or administered by the Pervasive Software. Unless otherwise specified, a User shall not be counted more than once or on a concurrent basis.
CA Process Automation:
CA Software means the CA Process Automation software described herein in object code formonly.
Version PS 1.0 Page 37 of 38 7/23/2014 10:36 AM
“Agent” means a single installation of the agent software component of the CA Software on a specific operating system which can be identified as a unique host identification on a physical or virtual hardwareserver. “Orchestrator” means a single installation of the Orchestrator software component of the CA Software on a specific operating system which can be identified as a unique host identification on a physical or virtual hardware server. This installation can be a stand-alone Orchestrator or as a node of a new or existing clusteredOrchestrator. "Connector" is the software program connecting the CA Software with specific named third party software or other CA software. For example, CA Process Automation Connector For CA Service Desk connects CA Process Automation with CA Service Desk. Each Connector may only be used to connect the CA Software with the specific named third party software or CA software program. “Premium Connector” means a Connector identified as “Premium” byCA. “Custom Operator” means a type of automation object within the CA Process Automation Orchestrator that can be created to enhance, modify, or restrict the capabilities of an existing“Connector”. “Process” means a type of automation object within CA Process Automation Orchestrator that contains connectors and other logical constructs that define a set of actions that will take place when the “Process” is executed by the Orchestrator. “Process instance” means a single copy of a Process definition that has been scheduled to run (Queued state), is running (Running state), or has completed running (Failed or Completed state) on a particular “Orchestrator”. “Concurrent Processes” means the number of CA Process Automation Process instances that are marked in the Running state within an Orchestrator at any given time.
“Power Pack” means a combination of Process definitions, Premium Connectors, Custom Operators and other automation objects that are packaged together to implement a specific solution.
The CA Software is licensed in different editions, as set forth in this Order Form, which authorizes the use of the specified number of Orchestrators, Agents, Connectors, and Concurrent processes(the "Authorized Use Limitation"). The various editions are:
CA Process Automation Player License includes: one Orchestrator, forty Agents, all non-Premium Connectors, and two hundred Concurrent Processes per Orchestrator. This license requires the purchase of either a “Power Pack” or a Services contract for the implementation of a solution that will be executed by the Player. No new automation objects may be created with the Player License. Only modifications of the purchased Power Packs and any Services delivered content is allowed.
CA Process Automation Express License includes: two Orchestrators, forty Agents, all non-Premium Connectors, and seventy-five Concurrent Processes perOrchestrator.
CA Process Automation Standard License includes: two Orchestrators, unlimited Agents, three Premium Connectors, all non-Premium Connectors, and two hundred Concurrent Processes perOrchestrator.
CA Process Automation Enterprise License includes: unlimited Orchestrators, unlimited Agents, twenty Premium Connectors, all nonPremium Connectors, and four hundred and seventy-five Concurrent Processes perOrchestrator.
Version PS 1.0 Page 38 of 38 7/23/2014 10:36 AM
CA Process Automation Level 1 Orchestrator includes: one Orchestrator and seventy-five Concurrent Processes per Orchestrator.
CA Process Automation Level 2 Orchestrator includes: two Orchestrators and two hundred Concurrent Processes per Orchestrator.
CA Process Automation Level 3 Orchestrator includes: three Orchestrators and four hundred and seventy-five Concurrent Processes per Orchestrator.
CA Process Automation Premium Connector License includes the right to use a Premium Connector to connect to a single instance of the target application orsystem.
CA Process Management for Workflows License includes: unlimited Orchestrators, five Agents, and three Custom Operators. No Premium connectors are available for purchase with this license. The only CA product connectors that are available are those associated with the product(s) providing the entitlement. This is a limited use entitlement and its use is restricted to the context of Workflows associated with the CA product(s) providing the entitlement. The component limits are not cumulative across multiple instances of the license at any individual customer.
The number of concurrent processes executing on any licensed Orchestrator may be exceeded as long as the total number of concurrent processes executing on all licensed Orchestrators is not exceeded. For example, if the license is for two Orchestrators with seventy-five Concurrent Processes per Orchestrator, one hundred Concurrent Processes could be utilized on one Orchestrator so long as only fifty Concurrent Processes are utilized on the secondOrchestrator.
Server:
“Server” means a single physical or virtual computer which processes data using one or more central processing units, and which is owned, leased or otherwise controlled by Customer.
CA Virtual Assurance for Infrastructure Managers and CA System Performance for Infrastructure Managers “Physical Socket” means an electrical component attached to a printed circuit board (“PCB”) and electrically interconnects a central processing unit (“CPU”) and PCB. A CPU is the specialized integrated circuit that executes binary programs and performs most logical functions or calculations. One physical CPU may have up to twelve (12) processing cores.
DOCUSIGN, INC.
CORPORATE SUBSCRIBER TERMS AND CONDITIONS v121008
These Terms and Conditions are incorporated by this reference into the Order Form (collectively referred to as the “Agreement”) entered into by DocuSign, Inc. (“DocuSign”) and the customer identified in the Order Form (“Subscriber”).
1. DEFINITIONS
“Account” means a unique account established by Subscriber to enable its Authorized Users to access and use the Subscription Service and, where applicable, other DocuSign Products. “Authorized User” means any employee of Subscriber, identified by a unique email address and user name, who is registered under the Account; provided that no two persons may register or use the Subscription Service as the same Authorized User. “Consulting Services” means any additional professional services to be delivered by DocuSign, such as integration consulting or assistance, custom development, training, and transition services, that are set forth in an Order Form or Work Order as described in Section 15.
“DocuSign API” means the application programming interface that supports interoperation of applications with the Subscription Service.
“DocuSign Products” means the products and services identified on an Order Form, which may include the Subscription Service, the Repository Services, the Consulting Services and any other DocuSign offerings. “eContract” refers to a contract, notice, disclosure, or other record or document deposited into the System by Subscriber for Processing using the SubscriptionService.
“Envelope” means an electronic record containing one or more eContracts consisting of a single page or a group of pages of data uploaded to theSystem.
“Order Form” means a standard DocuSign order form or any other document separately and specifically approved by DocuSign that describes the DocuSign Products to be purchased by Subscriber and is signed by both parties. “Personal Data” means any of the following: (a) nonpublic personally identifiable information, including driver’s license numbers, national identification numbers such as social security account numbers, credit card numbers, digital identity certificates; (b) personally identifiable financial information regarding a consumer (i) provided by a consumer to a financial institution, (ii) resulting from any transaction with the consumer or any service performed for the consumer by a financial institution, or (iii) otherwise obtained by the financial institution, including any list, description, or other grouping of consumers (and publicly available information pertaining to them) that is derived using any nonpublic personal information; (c) personally identifiable medical or health-relatedinformation.
“Process” means any operation or set of operations performed upon Subscriber’s data, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, accessing, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction. "Repository Services" means the Contract Repository or eVaulting Services, each as defined in the Terms and Conditions for Repository Services (available at http://www.docusign.com/company/terms-and-conditions/eoriginal/v121005), that are made the subject of an Order Form.
“Specifications” means the technical specifications set forth in the “Subscription Service Specifications” available at http://docusign.com/company/specifications.
“Subscription Service” means DocuSign’s on-demand electronic signature service, which provides online display, certified delivery, acknowledgement, electronic signature, and storage services for eContracts via the Internet. “System” refers to the software systems and programs, communication and network facilities, and hardware and equipment used by DocuSign or its agents to provide the Subscription Service. “Term” means the period of effectiveness of this Agreement, as described in more detail in Section 9 below. “Transaction Data” means the metadata associated with an Envelope and maintained by DocuSign for the purpose of establishing a digital audit trail, such as transaction history, image hash value, method and time of Envelope deletion, sender and recipient names, email addresses and signatureIDs.
2. THE SUBSCRIPTION SERVICE
2.1 During the Term and subject to these Terms and Conditions, DocuSign will provide the Subscription Service in accordance with the Specifications, and Subscriber will have the right to obtain an Account and register its Authorized Users, who may access and use the Subscription Service. The right to use the Subscription Service is: (a) limited to its Authorized Users (accordingly, Subscriber may not resell or otherwise provide or assist with the provision of the Subscription Service to any third party); and (b) conditioned on Subscriber’s acknowledgement and agreement with the following:
i) Nothing in this Agreement will be construed to make DocuSign a party to any eContract, and DocuSign makes no representation or warranty regarding the transactions sought to be effected by anyeContract; ii) DocuSign maintains no control of or access to the contents of any eContract, and so the content, quality, and format of any eContract is at all times in the exclusive control and responsibility of Subscriber; iii) If Subscriber elects to use optional features designed to verify the identity of the intended recipient of an eContract (“Authentication Measures”), DocuSign will apply only those Authentication Measures (if any) selected by the Subscriber, but makes no representations or warranties about the appropriateness of any Authentication Measure and further, assumes no liability for the inability or failure by the intended recipient or other party to satisfy the Authentication Measure or to circumvent it; iv) Certain types of agreements and documents are excepted from electronic signature laws, such that they cannot be legally formed by electronic signatures, and additionally, various agencies may have promulgated specific regulations that apply to electronic signatures and electronic records. DocuSign assumes no responsibility to determine whether any particular eContract is an exception to applicable electronic signature laws, or whether it is subject to any particular agency promulgations, or whether it can be legally formed by electronic signatures;
v) Subscriber is solely responsible for making available to third parties (including all parties to its eContracts) all contracts, documents, and other records required by applicable law, including, without limitation, electronic signature laws and other laws that may require records relating to a transaction to be retained or made accessible for a certain period of time; vi) Certain laws or regulations impose special requirements with respect to electronic transactions involving one or more “consumers,” such as (among others) requirements that the consumer consent to the method of contracting and/or that the consumer be provided with a copy, or access to a copy, of a paper or other non-electronic, written record of the transaction.
DocuSign assumes no responsibility to: (A) determine whether any particular transaction involves a consumer; (B) furnish or obtain any such consents or to determine if any such consents have been withdrawn; (C) provide any information or disclosures in connection with any attempt to obtain any such consents; (D) provide legal review of, or to update or correct any information or disclosures currently or previously given; (E) provide any such copies or access except as expressly provided in the Specifications for all transactions, consumer or otherwise; or (F) otherwise to comply with any such special requirements; and vii) Subscriber expressly undertakes to determine whether any consumer is involved in any eContract presented by its Authorized Users for Processing, and, if so, to comply with all requirements imposed by law on such eContracts or their formation.
3. SUBSCRIPTION PLANS AND USAGE PRICING
3.1 The pricing, features and options of the DocuSign Products selected by Subscriber are set forth in the Order Form. The Subscription Service is sold on a subscription basis and may be limited by usage (“Envelope Allowance”), or by the number of Authorized Users (“Seats”), or both. Optional features, such as Authentication Measures or fax-back services, may be purchased on a periodic or per-use basis.
3.2 If Subscriber selects an Envelope Allowance Subscription, then Subscriber is allowed to send the number of Envelopes in the Envelope Allowance specified in the Order Form during the Term. All Envelopes sent in excess of the EnvelopeAllowance will incur a per-Envelope charge that will be invoiced within 30 days of the date first incurred. The total number ofEnvelopes used is based on the sum of all Envelopes that have been sent for signature or for certified delivery from the Account. An Envelope will be deemed consumed at the time it is sent by an Authorized User, whether or not it has been received by the recipients or the recipients have performed any actions upon any eContract in theEnvelope.
3.3 If Subscriber selects a Seat Subscription, then Subscriber is allowed to manually send Envelopes from the number of Seats specified in the Order Form during the Term. A Seat is defined as a natural person manually preparing andsending Envelopes, and excludes the Processing of Envelopes using automated batch or bulk sending operations, or the use of the DocuSign API for sending Envelopes. If the number of Envelopes sent from a particular Seat or a group of Seats is abusive and/or unduly burdensome (indicating automated Processing), DocuSign will promptly notify Subscriber and the parties will review the use-case scenario as well as any continued monitoring and additional Seats that may be required to be purchased. The number of Seats is determined by the total number of active Authorized Users listed in the membership of an Account at any one time. No two individuals may log onto or use the Subscription Service as the same Authorized User, but Subscriber may unregister or deactivate Authorized Users and replace them with other Authorized Users without penalty, so long as the number of active Authorized Users registered at any one time is equal to or less than the number of Seats purchased. The addition by Subscriber of more Authorized Users than the number of Seats purchased in an Order Form will result in an additional charge for one Seat per additional Authorized User for the remainder of the Term, to be invoiced immediately.
4. ADDITIONAL SUBSCRIBER RESPONSIBILITIES
4.1 Subscriber agrees that it will not use or permit the use of the Subscription Service to send unsolicited mass mailings outside its organization, it being understood that the term “unsolicited mass mailings” includes all statutory and other common definitions, including all Commercial Electronic Marketing Messages as defined in the U.S. CAN SPAMAct.
4.2 Subscriber agrees that it is solely responsible for the nature and content of all materials, works, data, statements, and other visual, graphical, video, written or audible communications of any nature submitted by any Authorized User or otherwise Processed through its Account.
4.3 Subscriber further agrees not to use or permit the use of the Subscription Service: (a) to communicate any message or material that is defamatory, harassing, libelous, threatening, or obscene; (b) in a way that violates or infringes upon the intellectual property rights or the privacy or publicity rights of any person or entity or that may otherwise be unlawful or give rise to civil or criminal liability (other than contractual liability of the parties under eContracts Processed through the Subscription Service); (c) in any manner that is likely to damage, disable, overburden, or impair the System or the Subscription Service or interfere in any way with the use or enjoyment of the Subscription Service by others; or (d) in any way that constitutes or encourages conduct that could constitute a criminal offense.
4.4 Although DocuSign does not monitor the content Processed through the Subscription Service, DocuSign may at any time suspend any use of the Subscription Service and/or remove or disable any content as to which DocuSign reasonably and in good faith believes is in violation of this Agreement. DocuSign agrees to provide Subscriber with notice of any suchsuspension or disablement before its implementation unless such suspension or disablement is necessary to comply with legal process or prevent imminent harm to DocuSign’s System, the Subscription Service or any third party, in which case DocuSign will notify Subscriber of such suspension or disablement as soon as reasonably practicable thereafter.
5. INTELLECTUAL PROPERTY AND TRADEMARK LICENSE
5.1 DocuSign is the owner of various intellectual property and technology rights associated with the Subscription Service, its document management, digital signature, and notary system, including patent, copyright, trade secret, and trademark and service mark rights. Except for the rights expressly granted in this Agreement, DocuSign does not license or transfer to Subscriber or any Authorized User or other third party any of DocuSign’s technology or other intellectual property or technology rights. All right, title, and interest in and to DocuSign’s technology and intellectual property will remain solely with DocuSign.
Subscriber agrees that it will not, directly or indirectly, reverse engineer, decompile, disassemble, or otherwise attempt to derive source code or other trade secrets from or about any of the DocuSign Products or DocuSign’s technology. DocuSign agrees that data and information provided by Subscriber under this Agreement shall remain, as between Subscriber and DocuSign, owned by Subscriber.
5.2 DocuSign hereby grants to users and licensees of its products and services a limited, revocable, nonexclusive and nontransferable right to use DocuSign’s regular trade names, trademarks, titles and logos (“Licensed Marks”) solely for purposes of identifying DocuSign’s products and services. Details of this trademark license are available at:
http://www.docusign.com/trademark-license.
6. CUSTOMER SUPPORT
DocuSign will provide customer support to Subscriber in accordance with the package that is identified on the Order Form, as further detailed at http://www.docusign.com/products/support-plans.
7. eCONTRACT STORAGE AND DELETION
7.1 DocuSign will store in accordance with the Specifications all completed eContracts sent by Subscriber until the termination or expiration of the Agreement, unless otherwise directed by Subscriber. Copies of stored eContracts may be retrieved by Subscriber at any time during that period, provided that following the expiration or termination of the Agreement, Subscriber may request DocuSign’s assistance in retrieving completed eContracts still remaining on the System pursuant to the transition services terms described in Section9.4.
7.2 Prior to the expiration or termination of this Agreement, Subscriber may elect to purchase post-expiration or posttermination storage services for their completed eContracts. Where Subscriber opts not to purchase storage services, all copies of eContracts may be deleted by DocuSign without prior notice after the period available for transition services has expired pursuant to the terms described in Section 9.4. Subscriber may, at its option and wholly at Subscriber’s risk, direct that any eContract be deleted at a time stated by Subscriber and prior to the end of theTerm.
7.3 DocuSign may at its sole discretion delete an uncompleted eContract from the System immediately and without notice upon earlier of: a) expiration of the Envelope (where Subscriber has established an expiration for such Envelope, not to exceed 365 days); or b) expiration of the Term.
7.4 DocuSign will retain the Transaction Data permanently, provided that any Transaction Data that constitutes Confidential Information of Subscriber will at all times maintain that status and DocuSign will comply with its obligations in Section 13.
8. FEES AND PAYMENT TERMS
8.1 Subscriber will pay DocuSign the amounts set forth in each Order Form. An Order Form is not binding until it isexecuted by both DocuSign and Subscriber, at which point it will be deemed to be incorporated into this Agreement. Unless otherwise specified in an applicable Order Form, the first invoice will be submitted to Subscriber within 30 days after the Order Start Date, and Subscriber will pay all amounts due within 30 days of the date of the applicableinvoice.
8.2 If Subscriber’s usage under an Envelope Allowance Subscription exceeds the Envelope Allowance prior to the end of the Term, the unpaid balance of the Order Form for such Envelope Allowance Subscription shall become immediately due and payable.
8.3 Any undisputed amount not paid when due will be subject to finance charges equal to 1.5% of the unpaid balance per month or the highest rate permitted by applicable usury law, whichever is less, determined and compounded daily from the date due until the date paid. Subscriber will reimburse any costs or expenses (including reasonable attorneys’ fees) incurred by DocuSign to collect any undisputed amount that is not paid when due. DocuSign may accept any check or payment in any amount without prejudice to DocuSign’s right to recover the balance of the amount due or to pursue any other right or remedy.
Amounts due to DocuSign under this Agreement may not be withheld or offset by Subscriber for any reason against amounts due or asserted to be due to Subscriber from DocuSign. All amounts payable under this Agreement are denominated inUnited States dollars, and Subscriber will pay all such amounts in United States dollars.
8.4 Taxes. Other than federal and state net income taxes imposed on DocuSign by the United States, Subscriber will bearall taxes, duties, and other governmental charges (collectively, “taxes”) resulting from this Agreement or transactions conducted in relation to this Agreement or the DocuSign Products. If a tax is imposed on DocuSign by a jurisdiction outside the United States, Subscriber will not be obligated to bear that tax to the extent: (a) the tax is allowable as a credit against the United States federal income taxes of DocuSign; (b) Subscriber reduces such tax to the extent possible, giving effect to the applicable Income Tax Convention between the United States and other jurisdictions; and (c) Subscriber furnishes DocuSign with such evidence as the United States taxing authorities may require to claim the credit. Subscriber will pay any additional taxes as are necessary to ensure that the net amounts received and retained by DocuSign after all such taxes are paid are equal to the amounts that DocuSign would have been entitled to in accordance with this Agreement as if the taxes did notexist.
9. TERM AND TERMINATION
9.1 Term. Unless sooner terminated as stated below, and subject to Section 17 with respect to Work Orders (as defined below), the effectiveness of this Agreement will commence upon the Order Start Date and will continue for the term specified on the Order Form (the “Term”).
9.2 Termination for Cause. If either party commits a material breach or default in the performance of any of its obligations under this Agreement, then the other party may terminate this Agreement by giving the defaulting party written notice of termination if the material breach or default in performance is not cured within 30 days after the defaulting party receives notice thereof. Without limiting the foregoing, any failure by Subscriber to timely pay to DocuSign any amounts owing under this Agreement will constitute a material breach of this Agreement. If Subscriber fails to timely pay any amounts due for servicesto be performed by DocuSign, then without limitation to any of its other rights or remedies, DocuSign may suspend performance of such services until it receives all amounts due.
9.3 Post-Termination Obligations. If this Agreement expires or is terminated for any reason: (a) Subscriber will pay to DocuSign any amounts required to be paid under this Agreement that have accrued prior to, and remain unpaid as of, the date of termination or expiration (including Subscription fees, which become due upon termination of this Agreement as set forth in an Order Form, and any one-time or recurring fees through the end of the billing cycle in which termination occurs); (b) any and all liabilities accrued prior to the effective date of the termination will survive; (c) Subscriber will destroy all copies of DocuSign software, documentation, and materials within five business days of such termination, and immediately thereafter, if requested by DocuSign, provide DocuSign with a written certification signed by an authorized Subscriber representative certifying that all copies of software, documentation, and materials have been destroyed; (d) licenses to use DocuSign software and the provision of DocuSign services will immediately end; and (e) the parties’ rights and obligations under Sections 1, 7.4, 9.3, 9.4, 10.3, and 11 through 14 will survive.
9.4 Transition Services. Upon expiration or termination of this Agreement for any reason, at Subscriber’s request and at DocuSign’s then-current standard professional services rates plus expenses, DocuSign shall provide reasonable transition services for a period not to exceed 90 days to assist Subscriber in moving Subscriber’s data to another provider or exporting eContracts to external media. As part of such transition services, DocuSign shall at a minimum transfer, and cause any ofits independent contractors to transfer, all data and electronic files associated with the Subscription Service. At itsthen-current standard professional services rates, DocuSign shall at Subscriber’s request further cooperate with Subscriber in the development of a transition plan and shall use reasonable efforts to assist Subscriber and/or another service provider in the transition. DocuSign may at its discretion require advance payment or other adequate security for payment as DocuSignmay consider appropriate in connection with or as a condition to the provision of services described in this section.
10. WARRANTIES AND DISCLAIMERS
10.1 DocuSign Warranties. DocuSign represents and warrants that: (a) the Subscription Service as delivered toSubscriber and used in accordance with the Specifications will not infringe on any United States patent, copyright or trade secret; (b) the Subscription Service shall be performed in accordance with the Specifications in their then-current form at the time of the provision of such Subscription Service; (c) any DocuSign Products that are software shall be free of harmful or illicit code, trapdoors, viruses, or other harmful features; (d) the proper use of the Subscription Service by Subscriber in accordance with the Specifications and applicable law in the formation of an eContract not involving any consumer will be sufficient under the Electronic Signatures in Global and National Commerce Act, 15 U.S.C. §§ 7001 et seq. (the “ESIGN Act”) to support the validity of such formation, to the extent provided in the ESIGN Act; (e) the proper use of the Subscription Service by Subscriber in accordance with the Specifications and applicable law in the formation of an eContract involving a consumer will be sufficient under the ESIGN Act to support the validity of such formation, to the extent provided in the ESIGN Act, so long as and provided that Subscriber complies with all special requirements for consumer eContracts, including and subject to those referenced in Section 2.1(vi) and (vii) above; and (f) DocuSign has implemented information security policies and safeguards to preserve the security, integrity, and confidentiality of Personal Data and to protect against unauthorized access and anticipated threats or hazards thereto, that meet the objectives of the Interagency Guidelines Establishing Standards for Safeguarding Customer Information as set forth in Section 501 (b) of the Gramm-Leach-Bliley Act.
10.2 Mutual Warranties. Each party represents and warrants to the other that: (a) this Agreement has been dulyexecuted and delivered and constitutes a valid and binding agreement enforceable against such party in accordance with its terms; (b) no authorization or approval from any third party is required in connection with such party’s execution, delivery, or performance of this Agreement; and (c) the execution, delivery, and performance of this Agreement does not violate the laws of any jurisdiction or the terms or conditions of any other agreement to which it is a party or by which it is otherwise bound.
10.3 Disclaimer. EXCEPT FOR THE EXPRESS REPRESENTATIONS AND WARRANTIES STATED IN SECTIONS 10.1 AND 10.2 ABOVE (WHICH ARE NOT APPLICABLE TO CONSULTING SERVICES), DOCUSIGN MAKES NO ADDITIONAL
REPRESENTATION OR WARRANTY OF ANY KIND -- WHETHER EXPRESS, IMPLIED IN FACT OR BY OPERATIONOF LAW, OR STATUTORY -- AS TO ANY MATTER WHATSOEVER. DOCUSIGN EXPRESSLY DISCLAIMS ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE. DOCUSIGN DOES NOTWARRANT
THAT THE DOCUSIGN PRODUCTS (INCLUDING CONSULTING SERVICES OR RELATED DELIVERABLES, IF ANY), ARE OR WILL BE ERROR-FREE, WILL MEET SUBSCRIBER’S REQUIREMENTS, OR BE TIMELY OR SECURE. SUBSCRIBER
WILL NOT HAVE THE RIGHT TO MAKE OR PASS ON ANY REPRESENTATION OR WARRANTY ON BEHALFOF DOCUSIGN TO ANY THIRD PARTY.
11. INDEMNIFICATION
11.1 By DocuSign. DocuSign will defend Subscriber, and its employees, directors, agents, and representatives (“Indemnified Party”) from any actual or threatened third party claim arising from: (a) any breach by DocuSign of its confidentiality obligations in Section 13, and/or (b) alleged infringement by DocuSign of any third party intellectual property rights (each a “Subscriber Claim”).
11.2 By Subscriber. Subscriber will defend DocuSign, and its employees, directors, agents, and representatives (“Indemnified Party”) from any actual or threatened third party claim arising from: (a) any breach by Subscriber of its confidentiality obligations in Section 13, and/or (b) alleged infringement by Subscriber of any third party intellectual property rights, and/or (c) the content submitted by any Authorized User or otherwise Processed through Subscriber’s Account (each a “DocuSign Claim”).
11.3 Procedures. The parties’ respective indemnification obligations above are conditioned on: (a) the Indemnified Party gives the Indemnifying Party prompt written notice of the Subscriber Claim or DocuSign Claim (as the case may be, a “Claim”); (b) the Indemnifying Party has full and complete control over the defense and settlement of the Claim; (c) the Indemnified Party provides assistance in connection with the defense and settlement of the Claim as the Indemnifying Party may reasonably request; and (d) the Indemnified Party complies with any settlement or court order made in connection with the Claim. The Indemnifying Party will indemnify the Indemnified Party against: (i) all damages, costs, and attorneys’ fees finally awarded against any of them in any Claim under this Section 11; (ii) all out-of-pocket costs (including reasonable attorneys’ fees) reasonably incurred by any of them in connection with the defense of the Claim (other than attorneys’ fees and costs incurred without the Indemnifying Party’s consent after it has accepted defense of such Claim); and (iii) if any Claim arising under this Section 11 is settled by the Indemnifying Party or with its approval, then the Indemnifying Party will pay any amounts to any third party agreed to by the Indemnifying Party in settlement of any suchClaims.
12. LIMITATIONS OF LIABILITY
12.1 Disclaimer of Consequential Damages. EXCEPT WITH RESPECT TO INDEMNIFICATION OBLIGATIONSOF SECTION 11, NOTWITHSTANDING ANYTHING TO THE CONTRARY CONTAINED IN THIS AGREEMENT, NEITHER PARTY
WILL, UNDER ANY CIRCUMSTANCES, BE LIABLE TO THE OTHER PARTY FOR CONSEQUENTIAL, INCIDENTAL,
SPECIAL, OR EXEMPLARY DAMAGES ARISING OUT OF OR RELATED TO THE TRANSACTIONS CONTEMPLATED
UNDER THIS AGREEMENT (INCLUDING WITH RESPECT TO CONSULTING SERVICES, IF ANY), INCLUDING, BUT NOT
LIMITED TO, LOST PROFITS OR LOSS OF BUSINESS, EVEN IF APPRISED OF THE LIKELIHOOD OF SUCH DAMAGES OCCURRING.
12.2 Cap on Liability. EXCEPT WITH RESPECT TO INDEMNIFICATION OBLIGATIONS OF SECTION 11, UNDER NO CIRCUMSTANCES WILL EITHER PARTY’S TOTAL LIABILITY OF ALL KINDS ARISING OUT OF OR RELATED TO THIS
AGREEMENT (INCLUDING, BUT NOT LIMITED TO, WARRANTY CLAIMS AND WITH RESPECT TOCONSULTING
SERVICES, IF ANY), REGARDLESS OF THE FORUM AND REGARDLESS OF WHETHER ANY ACTION OR CLAIM IS
BASED ON CONTRACT, TORT, OR OTHERWISE, EXCEED THE TOTAL AMOUNT PAID BY SUBSCRIBER TO DOCUSIGN UNDER THIS AGREEMENT DURING THE 12 MONTHS PRECEDING THE DATE OF THE ACTION OR CLAIM.
12.3 Independent Allocations of Risk. EACH PROVISION OF THIS AGREEMENT THAT PROVIDES FOR A LIMITATION
OF LIABILITY, DISCLAIMER OF WARRANTIES, OR EXCLUSION OF DAMAGES REPRESENTS AN AGREED ALLOCATION OF THE RISKS OF THIS AGREEMENT BETWEEN THE PARTIES. THIS ALLOCATION IS REFLECTED IN THE PRICING
OFFERED BY DOCUSIGN TO SUBSCRIBER AND IS AN ESSENTIAL ELEMENT OF THE BASIS OF THE BARGAIN BETWEEN THE PARTIES. EACH OF THESE PROVISIONS IS SEVERABLE AND INDEPENDENT OF ALL OTHER
PROVISIONS OF THIS AGREEMENT, AND EACH OF THESE PROVISIONS WILL APPLY EVEN IF THE WARRANTIES IN THIS AGREEMENT HAVE FAILED OF THEIR ESSENTIAL PURPOSE.
13. CONFIDENTIALITY
13.1 “Confidential Information” means any trade secrets or other information of DocuSign or Subscriber, whether of a technical, business, or other nature (including, without limitation, in the case of DocuSign, DocuSign software and related information, and in the case of Subscriber, Personal Data and eContracts), that is disclosed to the other party (the “Recipient”).
Confidential Information does not include any information that: (a) was known to Recipient prior to receiving it from the disclosing party; (b) is independently developed by Recipient without use of or reference to any Confidential Information of the other party; (c) is acquired by Recipient from another source that did not receive it in confidence from the other party to this Agreement; or (d) is or becomes part of the public domain through no fault or action ofRecipient.
13.2 Restricted Use and Nondisclosure. During and after the Term, Recipient will: (a) use the Confidential Informationof the other party solely for the purpose for which it is provided; (b) not disclose such Confidential Information to a third party; and (c) protect such Confidential Information from unauthorized use and disclosure to the same extent (but using no less than a reasonable degree of care) that it protects its own Confidential Information of a similar nature.
13.3 Required Disclosure. If Recipient is required by law to disclose Confidential Information of the other party or theterms of this Agreement, Recipient must give prompt written notice of such requirement before such disclosure and assist the disclosing party to obtain where reasonably available an order protecting the Confidential Information from public disclosure.
13.4 Return of Materials. Except for as provided in Section 7.4, upon written request by the disclosing party, Recipientwill destroy or deliver to the disclosing party all of the disclosing party’s Confidential Information that Recipient may have in its possession or control.
13.5 Ownership. Recipient acknowledges that, as between the parties, all Confidential Information it receives from the disclosing party, including all copies thereof in Recipient’s possession or control, in any media, is proprietary to and exclusively owned by the disclosing party. Nothing in this Agreement grants Recipient any right, title or interest in or to any of the disclosing party’s Confidential Information. Recipient’s incorporation of the disclosing party’s Confidential Information into any of its own materials shall not render Confidential Information non-confidential.
13.6 Remedies. Recipient acknowledges that any actual or threatened violation of this confidentiality provision may cause irreparable, non-monetary injury to the disclosing party, the extent of which may be difficult to ascertain, and therefore agrees that the disclosing party shall be entitled to seek injunctive relief in addition to all remedies available to the disclosing party at law and/or in equity. Absent written consent of the disclosing party, the burden of proving that the disclosing party’sConfidential Information is not, or is no longer, confidential or a trade secret shall be on theRecipient.
13.7 Existing Obligations. The obligations in this Section 13 are in addition to, and supplement, each party’s obligations of confidentiality under applicable law and/or under any nondisclosure or other agreement between the parties.
14. GENERAL
14.1 Relationship. At all times, the parties are independent actors, and are not the agent or representative of the other. This Agreement is not intended to create a joint venture, partnership, or franchise relationship, or give rise to any third party beneficiary. Subscriber must not represent to anyone that Subscriber is an agent of DocuSign or is otherwise authorized tobind or commit DocuSign in any way without DocuSign’s prior authorization.
14.2 Assignability. Subscriber may not assign its rights, duties, or obligations under this Agreement without DocuSign’s prior written consent. If consent is given, this Agreement will bind Subscriber’s successors and assigns. Any attempt by Subscriber to transfer its rights, duties, or obligations under this Agreement except as expressly provided in this Agreement is void.
Notwithstanding the foregoing, either party may assign this Agreement to a successor of its business without the other party’s consent.
14.3 Nonsolicitation. During the Term of this Agreement and for a period of one year thereafter, Subscriber will not,directly or indirectly, employ or solicit the employment or services of a DocuSign employee or independent contractor without the prior written consent of DocuSign.
14.4 Notices. Any notice required or permitted to be given in accordance with this Agreement will be effective if it is inwriting and sent using: (a) the “acknowledge receipt” function of the Subscription Service; (b) by certified or registered mail; or (c) insured courier, to the appropriate party at the address set forth on the Order Form. Either party may change its address for receipt of notice by notice to the other party in accordance with this Section. Notices are deemed given upon receipt if delivered using the Subscription Service, two business days following the date of mailing, or one business day following delivery to a courier.
14.5 Force Majeure. Except for any payment obligations, neither party will be liable for, or be considered to be in breach ofor default under this Agreement on account of, any delay or failure to perform as required by this Agreement as a result of any cause or condition beyond such party’s reasonable control, so long as such party uses all commercially reasonable efforts to avoid or remove such causes of non-performance or delay.
14.6 Dispute Resolution. In the event of any dispute regarding any right or obligation under this Agreement, the aggrieved party shall notify the other party in a writing describing the dispute (“Notice of Dispute”). Upon receipt of the Notice ofDispute, the parties shall arrange a meeting between their representatives. Over a period not to exceed 10 business days after receipt of Notice of Dispute (“Period”), the parties shall engage in good faith negotiations to resolve such dispute. If the parties’ representatives are unable to resolve the dispute at such meetings during the Period, then each party may seek any remedies available to it in law or equity. Notwithstanding the foregoing, either party may seek injunctive relief at any time. Each party hereby irrevocably waives, to the fullest extent permitted by law, any and all right to trial by jury in any legal proceeding arising out of or relating to this Agreement.
14.7 Governing Law. This Agreement will be interpreted, construed, and enforced in all respects in accordance with thelocal laws of the State of Washington, U.S.A., without reference to its choice of law rules to the contrary. The provisions of the1980 U.N. Convention on Contracts for the International Sale of Goods are expressly excluded and do not apply to this Agreement.
Any legal action by Subscriber arising under this Agreement must be initiated within two years after the cause of action arises.
14.8 Waiver. The waiver by either party of any breach of any provision of this Agreement does not waive any other breach.
The failure of any party to insist on strict performance of any covenant or obligation in accordance with this Agreement will not be a waiver of such party’s right to demand strict compliance in the future, nor will the same be construed as a novation of this Agreement.
14.9 Severability. If any part of this Agreement is found to be illegal, unenforceable, or invalid, the remaining portions of this Agreement will remain in full force and effect. If any material limitation or restriction on the grant of any license toSubscriber under this Agreement is found to be illegal, unenforceable, or invalid, the license will immediatelyterminate.
14.10 Counterparts. This Agreement may be executed in any number of identical counterparts, notwithstanding that the parties have not signed the same counterpart, with the same effect as if the parties had signed the same document. All counterparts will be construed as and constitute the same agreement.
14.11 Entire Agreement. This Agreement is the final and complete expression of the agreement between these parties regarding the DocuSign Products. This Agreement supersedes, and the terms of this Agreement govern, all previous oraland written communications regarding these matters. This Agreement may be changed only by a written agreement signed byan authorized agent of both parties.
---------------------------------------------------------------------------------------------------------------------------------------------------------------------------
ADDITIONAL TERMS AND CONDITIONS FOR CONSULTING SERVICES The following additional terms and conditions apply to Consulting Services, if any, that are made the subject of an Order Form.
15. SERVICES, WORK ORDERS, AND CHANGE ORDERS
15.1 Services. Subject to the terms and conditions of this Agreement, DocuSign will, if ordered as providedhereunder, perform for Subscriber certain Consulting Services.
15.2 Work Orders. The specific details of the Consulting Services to be performed will be determined on a per-project basis, and the details for each project will be described in a Work Order that is executed by both parties (called the “Work Order” for purposes of the Consulting Services). An Order Form that lists a DocuSign standard training or consulting package as a DocuSign Product constitutes a Work Order. Once executed by both parties, each Work Order will be a unique agreementthat incorporates the terms of this Agreement and stands alone with respect to all other Order Forms. If there is a conflictbetween the terms of this Agreement and the terms of a Work Order, the terms of this Agreement will control unless the Work Order states that a specific provision of this Agreement will be superseded by a specific provision of the Work Order.
15.3 Change Orders. Unless otherwise specified in a Work Order, Subscriber may reasonably request in writing thatrevisions be made with respect to the Consulting Services or deliverables set forth in that Work Order (“Change Order”). If a Change Order recites revisions that materially increase the scope of the Consulting Services or the effort required to deliver deliverables under the applicable Work Order, then within 10 business days after DocuSign’s receipt of the Change Order, DocuSign will deliver to Subscriber a written, revised Work Order reflecting DocuSign’s reasonable determination of the revised Consulting Services, deliverables, delivery schedule, payment schedule, and adjusted fees or fee estimates, if any, that will apply to the implementation of the revisions. If Subscriber approves the revised Work Order, then the parties will execute it, andupon execution, the revised Work Order will supersede the then-existing Work Order. If Subscriber does not approve the revised Work Order within 10 business days after its receipt by Subscriber, the then-existing Work Order will remain in full force and effect, and DocuSign will have no further obligation with respect to the applicable ChangeOrder.
16. PERFORMANCE OF CONSULTING SERVICES
16.1 Project Management. For each project described in a Work Order, each party will designate a single point of contact within its organization to manage the project (“Project Leader”). The Project Leaders will meet as necessary to managethe Consulting Services to be performed under a Work Order. Disputes will be escalated to more senior executives if theProject Leaders are unable to resolve a problem. DocuSign’s Project Leader will provide Subscriber’s Project Leader with regular reports on the status of the Consulting Services at least once permonth.
16.2 Performance Standard. DocuSign warrants to Subscriber that the Consulting Services will be performed in a goodand workmanlike manner in accordance with standard industry practice and the applicable Work Order, including any specifications in such Work Order. DocuSign will complete the Consulting Services, including the delivery of any deliverables, inaccordance with the schedule of times and milestones specified in the Work Order.
16.3 Fees. Unless otherwise specified in a Work Order, Subscriber will pay DocuSign for Consulting Services on atime-andmaterials basis at DocuSign’s then-current rates and under payment terms described in this Agreement (“Consulting Fees”).
16.4 Disclaimer. EXCEPT FOR WARRANTIES PROVIDED HEREIN OR EXPRESSLY IDENTIFIED AS SUCH IN A WORK
ORDER, THE CONSULTING SERVICES AND ANY RELATED DELIVERABLES WILL BE PROVIDED AS-IS AND WITHOUT WARRANTY OF ANY KIND. DOCUSIGN EXPRESSLY DISCLAIMS ALL IMPLIED WARRANTIES OF MERCHANTABILITY,
FITNESS FOR A PARTICULAR PURPOSE, AND NON-INFRINGEMENT AS TO ANY AND ALL CONSULTING SERVICES AND RELATED DELIVERABLES.
17. TERM AND TERMINATION OF WORK ORDERS
17.1 Term. Each Work Order is non-cancellable except pursuant to a Change Order, and will commence on thespecified effective date and will continue until each party’s obligations under the Work Order have been fulfilled or the Work Order is terminated as provided in the Work Order.
17.2 Effect of Termination. If any Work Order is terminated in accordance with this Section 17, then Subscriber will pay to DocuSign any Consulting Fees and all other payment obligations accrued and payable for the Consulting Services performed under the terminated Work Order through the effective date of the termination. If a Work Order is terminated for any reason other than for material breach by DocuSign, Subscriber will pay to DocuSign all Consulting Fees due under the Work Order had the Work Order not been terminated and had the Consulting Services been fully performed in accordance with the schedule then in effect, which amount owing will be evidenced in a final termination invoice to be provided by DocuSign to Subscriber. The amount of Consulting Services Fees specified in such termination invoice from DocuSign will be final and binding on the parties, absent manifest error.
18. PROPRIETARY RIGHTS
18.1 Subscriber Materials. Any materials provided by Subscriber to DocuSign specifically for use by DocuSign in thecourse of the Consulting Services (“Subscriber Materials”) will be used and disclosed solely as required to perform the Consulting Services. As between the parties, Subscriber will continue to own the SubscriberMaterials.
18.2 Inventions. Except as expressly set forth to the contrary in a Work Order, all works of authorship, inventions,discoveries, improvements, methods, processes, formulas, designs, techniques, and information: (a) conceived, discovered, developed or otherwise made by DocuSign, solely or in collaboration with others, in the course of performing the Consulting Services; or (b) that form all or part of a deliverable provided as part of the Consulting Services, whether developed as part of the Consulting Services or separately, but excluding Subscriber Materials (as defined in Section 18.1) (collectively, “Inventions”), will be the sole property of DocuSign. Upon and subject to final payment by Subscriber of all amounts owing to DocuSign,DocuSign hereby grants to Subscriber a nonexclusive, perpetual, worldwide, royalty-free license to use, copy, modify, and prepare derivative works of the Inventions solely for purposes of Subscriber’s internal business operations only.
FireEye Master Purchase Agreement (Rev. 8/2016)
MASTER PURCHASE AGREEMENT
This Master Purchase Agreement (this “Agreement”) is entered into as of [DATE] (the “Effective Date”) by and between FireEye (as defined below) and ______________________________, a _____________ corporation, with its principal place of business at ____________________________(“Customer”). This Agreement will govern Customer’s initial purchase of FireEye Offerings and any future orders by Customer as agreed between the parties in writing.
FireEye shall provide its Offerings pursuant to the terms and conditions below. For good and valuable consideration, the parties hereby agree as follows:
Structure and Order of Precedence. This Agreement provides the general terms under which the Customer may use FireEye’s various Offerings. The explicit rights for the Customer to use and receive Products, Support Services or Subscriptions or otherwise engage with specific FireEye Offerings are set forth in the applicable Exhibit. In the event of conflict between any of the terms in this Agreement and an Exhibit, the Exhibit shall govern.
GENERAL TERMS APPLICABLE TO ALL FIREEYE OFFERINGS
1. DEFINITIONS.
1.1 “Content Feed” means all intelligence and content feeds associated with Products, which may consist of inbound and outbound feeds that are part of FireEye’s Dynamic Threat Intelligence (DTI) Cloud, downloads of Indicators for use with Products, and/or intelligence provided as part of the Advanced Threat Intelligence (ATI) Subscription.
1.2 “Deliverables” means the written reports that are created specifically for Customer as a result of the Professional Services provided hereunder.
1.3 “Documentation” means the user manuals generally provided in writing by FireEye to end users of the Products and Subscriptions in electronic format, as amended from time to time by FireEye.
1.4 “FireEye” means (i) FireEye, Inc., a Delaware corporation with its principal place of business at 1440 McCarthy Blvd., Milpitas, CA, 95035 with respect to Offerings that are shipped to, deployed or rendered inside of North America (including the United States, Mexico, Canada and the Caribbean), Central America and South America (collectively, the “Americas”); or (ii) with respect to all Offerings that are shipped to, deployed or rendered outside of the Americas, FireEye Ireland Limited, a company incorporated under the laws of Ireland with principal place of business at 2 Park Place, City Gate Park, Mahon, Cork, Ireland. FireEye includes the operating divisions Mandiant and iSIGHT.
1.5 "FireEye Materials" means all FireEye proprietary materials, Deliverables, intellectual property related to Products or Subscriptions, (such as all rights in any software incorporated into a Product or Subscription, copyrights, and patent, trade secret and trademark rights related to Products, and screens associated with Products or Subscriptions), Documentation, any hardware and/or software used by FireEye in performing Services or providing Subscriptions, Content Feeds, FireEye’s processes and methods (including any forensic investigation processes and methods), Indicators of Compromise, materials distributed by FireEye during Training, and any FireEye templates and/or forms, including report and presentation templates and forms. FireEye Materials does not include Third Party Materials.
1.6 "Indicators of Compromise" or "Indicators" means specifications of anomalies, configurations, or other conditions that FireEye is capable of identifying within an information technology infrastructure, used by FireEye in performing Professional Services and providing Subscriptions.
1.7 “Intellectual Property Rights” means copyrights (including, without limitation, the exclusive right to use, reproduce, modify, distribute, publicly display and publicly perform the copyrighted work), trademark rights (including, without limitation, trade names, trademarks, service marks, and trade dress), patent rights (including, without limitation, the exclusive right to make, use and sell), trade secrets, moral rights, right of publicity, authors’ rights, contract and licensing rights, goodwill and all other intellectual property rights as may exist now and/or hereafter come into existence and all renewals and extensions thereof, regardless of whether such rights arise under the law of the United States or any other state, country or jurisdiction.
Confidential FireEye Rev. 8/2016