This approach means that the transfer between active and standby data centers is being regularly executed as part of standard operating procedures – ensuring that when it is needed to address a failure, the transfer will be successful and service disruption minimized.
See the “ServiceNow Security, Operations, and Compliance White Paper” included with this response for more information.
Docusign Each component of our trusted platform - Hardware & Infrastructure, Systems & Operations, Applications & Access, and Transmission & Storage - undergoes tremendous security scrutiny.
HARDWARE & INFRASTRUCTURE
Three geo-dispersed, SSAE 16 audited datacenters
Near real-time secure data replication and encrypted archival 365x24x7 on-site security
Annual Business Continuity Planning (BCP) & Disaster Recovery (DR) testing Third-party penetration testing
SYSTEMS & OPERATIONS
Physically and logically separate networks
Two-factor, encrypted VPN access
Professional, commercial grade firewalls and border routers Distributed Denial of Service (DDoS) mitigation
Active monitoring and alerting
APPLICATIONS & ACCESS
Formal code reviews and vulnerability mitigation by third parties Application level Advanced Encryption Standard (AES) 256 bit encryption Key Management & Encryption Program
Enterprise-class malware protection
Digital audit trail
Multiple authentication mechanisms
TRANSMISSION & STORAGE
Secure, private SSL 256 bit viewing session
Anti-tampering controls
Signature verification of signing events
Unalterable, systematic capture of signing data
Digital certificate technology
Customer configurable data retention program
#2..
- 613 -
SOLICITATION # CH16012
162
QTS QTS cloud utilizes alternate telecommunications services from both TW Telecom and NTT America that reduces the likelihood of experiencing a single point of failure.
QTS's failover facilities in RIC1 and ATL1 are a carrier-class and carrier-neutral datacenter with multiple Internet Service Providers. QTS-FC can establish connectivity with another service provider with 24 hours in the event of an unrecoverable catastrophic connectivity failure of QTSFC’s primary/secondary provider.
SAP Ariba Ariba has implemented two sites within each region. In North America the sites are currently located in San Jose, California and Sterling, VA. In Europe the sites are located in St. Leon-Rot, Germany and Amsterdam, Netherlands.
The act of failing over from one site to another has a design goal for its Recovery Time Objective (RTO) of no more than four hours. The design goal for the Recovery Point Objective (RPO) is five minutes.
Disaster recovery options are included for all Ariba Cloud Services. In the event of a fail-over to the disaster recovery site, no customer changes are required as all URLs that customers use to reach the applications will continue to work. Ariba will notify customers via their email addresses in the event of unplanned downtime.
Internally, Ariba uses a documented system recovery plan that outlines the approach and steps for recovering the applications. This document defines roles and responsibilities in the event of disaster:
Local Ariba staff maintains the hardware remotely.
Ariba maintains the application software.
Processes are in place to keep database and fileservers in sync between primary and backup data centers.
The failover process of all parts of the infrastructure is automated.
In the event of a catastrophe, Ariba will declare the primary data center “down” and locally the script will be run to switchover and start the applications at the remote data center.
Ariba tests power outage backup scenarios and the Disaster Recovery Plan on a periodic basis to ensure it is up-to-date, successful, and effective.
Fieldglass We host and manage the Fieldglass system within secure Internet data centers provided by CenturyLink in Elk Grove, IL, and our disaster recovery center provided by Equinix in San Jose, CA. Both are managed by Server Central which is a Tier 4 hosting provider and a Tier 1 data provider (see the note below).
All systems are ""mission-critical loads"" supported by IDC Redundant Power Management System (UPS, generators etc.).
Note: Data centers can be classified by tiers, with Tier 1 being the most basic and inexpensive, and Tier 4 being the most robust and costly. According to definitions from the Uptime Institute and the latest draft of TIA/EIA-942 (Telecommunications Infrastructure Standard for Data Centers), a Tier 1 data center is not required to have redundant power and cooling infrastructures. It needs only a lock for security and can tolerate up to 28.8 hours of downtime per year. In contrast, a Tier 4 data center must have redundant systems for power and cooling, with multiple distribution paths that are active and fault tolerant. Furthermore, access should be controlled with biometric readers and single-person entryways, gaseous fire suppression is required, the cabling infrastructure should have a redundant backbone, and the facility can permit no more than 0.4 hours of downtime per year.
Tier 1 or 2 is usually sufficient for enterprise data centers that primarily serve users within a corporation. Financial data centers are typically Tier 3 or 4 because they are critical to our economic stability and, therefore, must meet #2..
- 614 -
SOLICITATION # CH16012
163
higher standards set by our government. Public data centers that provide disaster recovery/backup services are also built to higher standards.
Hanna Infrastructure setup:
* Standby SAP HEC systems at DR failover site will be shutdown / not useable during regular operations.
* WAN connectivity & special requirements (e.g. acceleration services) fall into the responsibil-ity of the customer.
* Customer must have independent network connections to both DR sites. * All DR-relevant systems are going to be installed according to the Adaptive Computing (AC) principle (virtual hostnames + virtual IP addresses HSR will be used to replicate data from Primary to DR site for HANA solutions, similarly Sybase Replication Server (SRS) will be used to replicate data from Primary to DR site for ASE based solutions. For more information, please refer to attached Business Continuity document
SuccessFactors Our infrastructure architecture is designed with high availability in mind, and engineered for resiliency. All major components are redundant, including power, HVAC, fire suppression, and the physical components of our network.
Production data centers have strict access controls, and are continuously staffed and monitored to help prevent acts of sabotage or vandalism. All production data centers are ANSI/EIA/TIA-942Tier III/IV facilities, and are ISO 27001 certified.
Production data centers are also geographically dispersed to help prevent a single event from affecting more than one data center. In the event a production data center has an outage we failover to an alternate data center in the same geographic region to minimize impact to customers.
Our Cloud Operations teams are also geographically dispersed, working in offices in the US, Europe, South America, and India. Should an office be impacted by an environmental event or pandemic, other offices can continue operations.
Aspects of the plan are described in the SOC reports, Disaster Recovery Plan (“DRP”) and Business Continuity Plan (“BCP”) solutions are dependent on several factors. The customer may be responsible for parts of the recovery/continuity activities
VMware VMware IaaS Services
VMware offers several technologies to provide redundancy, failover capability and the ability to run large scale applications independently in case one data center is lost. vCloud Air is built upon infrastructure that is architected for High Availability leveraging proven vSphere High Availability (HA), vSphere vMotion, and VMware Distributed Resource Scheduler (DRS). These technologies allow participating entities to migrate live workloads and/or automatically restart VMs in the event of host maintenance or unexpected issues. These technologies also maintain a consistently high level of performance for all tenants.
VMWare vSphere vMotion enables migration of live VMs to transfer your workloads during maintenance, without downtime. Unlike other cloud providers, VMWare ensures that tenants are not impacted by standard maintenance. VMware performs vMotion migrations for maintenance behind the scenes for its tenants in vCloud Air during maintenance windows without disrupting tenant applications.
vMotion is also used to seamlessly migrate VMs from an on-premises environment to vCloud Air and back. Today, vCloud Air is one of only a few major cloud vendors that uses live migration to do maintenance. This capability will enable NASPO participating entities to perform live migrations to move thier applications to and from the cloud for maintenance and other purposes. This #2..
- 615 -
SOLICITATION # CH16012
164
technology inherently prevents the lock-in experienced when migrating to cloud services offered by others.
VMware Dynamic Resource Scheduler continuously monitors CPU and memory utilization across a cluster of vSphere hosts, allocating resources among VMs and rebalancing performance during high-volume peak times. This is performed 24x7 within the VMware vCloud Air environment.
VMware vSphere High Availability delivers the availability required by most applications running in VMs, independent of the operating system and application running in it. Whether participating entities leverage Microsoft Windows or Linux; off-the-shelf or custom developed application; single VMs or many, HA provides uniform, failover protection against hardware and operating system outages within vCloud Air.
HA can:
• Monitor VMware vSphere hosts and VMs to detect hardware and guest operating system failures.
• Restart VMs on other vSphere hosts in the cluster without manual intervention when a server outage is detected.
• Reduce application downtime by automatically restarting VMs upon detection of an operating system failure.
Other cloud providers require you to build availability in to your application. In the best case scenario, this is as simple as including a load balancer in front of multiple VMs in the same tier to achieve basic high availability.
However, often the technologies of other cloud service providers requires a complete redesign of the hosted application, and often network devices such as load balancers are offered at an additional cost, unlike vCloud Air.
vCloud Air was built to run hosted applications as-is, providing availability down to a single VM instance, and balancing resources across multiple tenant needs with DRS. Unlike other clouds, with vCloud Air and vCGS, participating entities are not required to rebuild thier application to get the flexibility and agility that cloud can provide. Of course, vCloud Air customers usually do not just stop at moving applications to vCloud Air. Once in the cloud they start to explore features like our Advanced Networking Services and using APIs, automation, and CI/CD tools to deliver services faster. And, where it makes sense, customers do look at application redesigns as well, but with vCloud Air it is not because they must redesign to ensure the application is always available.
VMWare AirWatch
AirWatch features active-passive configurations for high availability and redundancy with all components made to failover with minimal downtime. Load balancing capabilities are deployed across multiple data centers to ensure immediate server pick up, ensuring zero end user downtime. AirWatch also incorporates replication technology featuring SQL log shipping or network SAN byte replication to prevent data loss.
FireEye Varies by service and customer deployment. Will be defined during engagement setup.
VirtueStream Virtustream’s U.S. based data centers are located in Washington, DC, Las Vegas, and San Francisco. All data centers meet the highest industry standard in terms of operational protocol and have redundancy built into all layers of the physical infrastructure. Core microVM’s, which are used for mission-critical workloads, provide reserved compute capacity and automatic storage replication so that these systems can be failed over to a secondary data center and have access to the compute capacity required in the event of a catastrophic outage at the primary data center.
8.16 Solution Administration
8.16.1 Ability of the Purchasing Entity to fully manage identity and user accounts.
CA APM Customer has full control over all user accounts #2..
- 616 -
SOLICITATION # CH16012
165
MAA CA MAA provides user management self-service to customers to manage their own accounts and create accounts for other users.
CA Agile The customer is responsible for managing the lifecycle of all user accounts.
ASM The Purchasing Entity can manage their account and create sub-accounts within ASM.
Google Comply
AODocs Comply
Virtru Virtru does not have an identity system. We federate authentication to Oauth and Email loop verification.
Salesforce Identity Management
Logon is form-based. When users log into the Salesforce application, they submit a username and password, which are sent to Salesforce via an TLS-encrypted session. Security features are developed by Salesforce and built into the application. Third-party packages are not used for development or implementation of security internal to the application.
In addition, single sign-on and two-factor authentication may be used to authenticate users. Some organizations prefer to use an existing single sign-on capability to simplify and standardize their user authentication. You have two options to implement single sign-on—federated authentication using Security Assertion Markup Language (SAML) or delegated authentication.
Federated authentication using Security Assertion Markup Language (SAML) allows you to send authentication and authorization data between affiliated but unrelated Web services. This enables you to sign-on to Salesforce from a client application. Federated authentication using SAML is enabled by default for your organization.
Delegated authentication single sign-on enables you to integrate Salesforce with an authentication method that you choose. This enables you to integrate authentication with your LDAP (Lightweight Directory Access Protocol) server, or perform single sign-on by authenticating using a token instead of a password. You manage delegated authentication at the profile level, allowing some users to use delegated authentication, while other users continue to use their Salesforce-managed password. Delegated authentication is set by profile, not organization wide. You must request that this feature be enabled by Salesforce.
Salesforce can be configured to utilize Active Directory directly via Delegated Authentication, or indirectly via Federated Identity using either SAML 1.1, or SAML 2.0. Additionally your users can be loaded from information drawn from your Active Directory servers and modifications made in Active Directory can be propagated into Salesforce.
Customers can use their own SAML Identity Provider, or license one directly from Salesforce with our Identity Connect product.
User Accounts
All users and application-level security are defined and maintained by the organization administrator, and not by Salesforce. The organization administrator is appointed by the customer.
An organization's sharing model sets the default access that users have to each other's data.
There are four sharing models: Private, Public Read Only, Public Read/Write, and Public Read/Write/Transfer. There are also several sharing model elements: Profiles, Roles, Hierarchy, Record Types, Page Layouts, and Field Level security.
ServiceNow Customers manage their own instances, including assigning users, defining user roles and profiles, and administrating the system. ServiceNow does not have access to the Customer’s instances. The ServiceNow wiki has all ServiceNow documentation available. #2..
- 617 -
SOLICITATION # CH16012
166
Docusign Yes, DocuSign allows the purchasing entity to mange identities and user accounts.
DocuSign for Enterprise is customizable to meet the administrative needs of the largest organizations. Full administration rights give you total control over document custody and retention policies, how signers sign or adopt signatures, user authentication and more. The branding tools ensure recipients can easily identify documents from your organization.
QTS 24x7x365 Operations Staff - Let QTS provide the expertise and experienced staff to monitor and manage your data center facility. Never again worry about staff turnover or whether your technologists are current with data center best practices.
SAP Hanna Yes
VMware VMware IaaS Services
VMware management infrastructure requires 2-factor authentication and multiple layers of access control. vCloud Air customers have the ability to provide access to their designated users. User account management is maintained by the customer.
control. vCloud Air customers have the ability to provide access to their designated users. User account management is maintained by the customer.
VMWare AirWatch
The Purchasing entity has the ability to fully manage identity and user accounts for administrators and end users through the web console. Customers can optionally integrate with AD/LDAP to inherit your existing structure and policies.
FireEye User identity and account settings are controlled within the administration sections of the FireEye cloud solutions.
VirtueStream Virtustream can provide solution for managed solution for Active Directory or LDAP. As standard, we provide support for managing the VM itself and all OS support. However, our typical use case is, customer manages the users and related activities, as Virtustream might not be aware of internal HR elements of User Management.
8.16.2 Ability to provide anti-virus protection, for data stores.
CA APM AWS provides protection/virus scanning for data at rest MAA Logical security is provided by ClamAV Antivirus.
CA Agile We have ClamAV installed on all Linux hosts and TrendMicro for Windows hosts.
ASM Logical security is provided by ClamAV Antivirus.
Google Comply
AODocs N/A
Virtru AlienVault IDS is used to perform virus and vulnerability scans.
Salesforce Salesforce runs antivirus software on the production systems that store, transmit or process customer information. The Anti-virus scans host filesystems (not customer data). The antivirus software checks for virus definition updates daily. Other controls are also used to address malware such as hardening the Operating System of our servers, firewall configuration to ensure only required ports are open and all others denied, and use of intrusion detection systems. Access to these systems is restricted to authorized personnel and all these systems, as well as the host platforms, are monitored in real time through a security monitoring system.
The application only accepts http and https traffic, but Salesforce does not restrict the file types users can upload. Salesforce does not modify or clean any customer data; the system stores the information provided in an encoded format within the database. It is recommended that customers run updated antivirus and antimalware solutions to help mitigate these threats. The production system receives inbound mail as part of the workflow functionality, but this does not pose any threat to our network, application, or users. No code in the email can be executed or transferred, #2..
- 618 -
SOLICITATION # CH16012
167
eliminating the malicious software risk. Email sent from the Salesforce system is not currently scanned for viruses.
ServiceNow If Customers want to schedule an antivirus software scan on certain computers after a pre-defined number of days, Customer would define a model-based plan with a duration-based maintenance schedule. This would do the scan automatically to those models defined in the Planned Maintenance area.
Docusign Yes, DocuSign maintains enterprise-class malware protection.
QTS Yes - 24x7x365, dependable and detailed support
SAP Hanna Yes
VMware VMware IaaS Services
Anti-virus software is installed on all development, domain and production hardware devices owned and operated by VMware, which hold company data, passwords, or keys. These devices maintain the most recent version of the anti-virus software signature file.
VMWare AirWatch
AirWatch has installed a best-in-class, continuously-updated anti-virus suite on servers in the SaaS environment
FireEye FireEye employs a multi-layered, continuously monitored and engaged set of active defenses to provide anti-virus protection for customer data stores that both meet and exceed traditional approaches. FireEye, and our customers, not only are prepared to reactively withstand attacks from known virus vectors, but since FireEye and our MVX technology is literally, continuously, and securely detonating viruses and other advanced malware on the way to our customer’s data stores, FireEye proactively defends from zero day and other emergent attacks as they happen.
VirtueStream Virtustream offers Anti-Virus protection based on per virtual machine, per month charge.
8.16.3 Ability to migrate all Purchasing Entity data, metadata, and usage data to a successor Cloud Hosting solution provider.
Carahsoft will work with each Participating Entity to develop a cost effective plan to assist in the migration and implementation of their data into the new service that has been selected.
8.16.4 Ability to administer the solution in a distributed manner to different participating entities.
Carahsoft will view each Participating Entity as a separate customer and privileges can be assigned for control access even within the individual services.
8.16.5 Ability to apply a participating entity's defined administration polices in managing a solution.
Each Participating Entity will have the ability to work with Carahsoft and the Service Provider to identify defined administration policies to mangage the solution.
8.17 Hosting and Provisioning
8.17.1 Documented cloud hosting provisioning processes, and your defined/standard cloud provisioning stack.
CA APM CA SaaS Ops has a well defined Service Introduction and update process, including review boards, staged rollouts and followups to ensure service integrity. Our cloud provisioning stack is tied to AWS EC2 services, and includes S3 and RDS for storage; RHEL instances for the applications; route 53 DNS services; cloudfront for monitoring; and ELB for load balancing
#2..
- 619 -
SOLICITATION # CH16012
168
MAA Automation tools are used to install and configure MAA software on CA infrastructure.
SOP documents are used by CA internally.
CA Agile All new systems should be provisions according to our baseline standards and we use configuration management tools to ensure all systems are created with the same standards.
ASM Automation tools are used to install and configure ASM software on CA infrastructure.
SOP documents are used by CA internally.
Google Google has administrative document and Google Deployment Guides accessible on the web.
AODocs This is not applicable to Google.
Virtru Ubuntu AMIs provisioned using terraform and configured by Ansible Salesforce Cloud Hosting and Provisioning
Salesforce’s deployment model is a “public” cloud infrastructure, as defined by NIST 800-145. In the Salesforce Government Cloud, an agency dynamically provisions computing resources over the Internet on our multi-tenant infrastructure. This is a cost effective deployment model for agencies as it gives them the flexibility to procure only the computing resources they need and delivers all services with consistent availability, resiliency, security, and manageability.
Salesforce provides market leading PaaS and SaaS solutions and is a multitenant cloud-based subscription service. Multi-tenant cloud solutions provide a single, shared infrastructure, one code base, one platform that is all centrally managed, with platform-based API to support all integration traffic, and multiple release upgrades included as part of the subscription service. Multi-tenancy and the Cloud Computing model remove unneeded tasks from the process of delivering, managing, and integrating software. Salesforce customers will not need to maintain any hardware or software. Without multiple versions to support, integrations don’t break during updates; they are simply updated automatically. As a result, both the initial integration and its continued maintenance are simplified. More resources can be focused on creating a better product, with a faster cycle of innovation, instead of having to manage the complexity of many different versions to support a vast installed base.
Salesforce's position as an online service enables us to roll out all levels of improvement, from patch releases to major upgrades, that are largely transparent to the end users. When a bug is fixed and tested, it is rolled out to the application as part of regular maintenance; the nature of the service prevents special patches and code branches for individual customers, so all fixes can potentially benefit all customers.
The Salesforce Services is delivered using a world-class data center infrastructure. Each customer's org is hosted from a primary and secondary production data center, with near real-time replication occurring between the two sites.
Salesforce is a pure multi-tenant web application. No software or infrastructure is required by the customer other than a computer, browser and internet connection or a mobile device. User Administration and ProvisioningUser provisioning and management is performed by the customer through the Salesforce Administrative Setup environment. Users, their profiles, permissions and passwords may be managed, edited, activated and deactivated as needed by those with appropriate permissions. An administrator with appropriate privileges can manage session timeout, password policies, IP range login restrictions, delegated authentication/SSO, and requirements as part of this process. On first time login or password reset request, users are required to change their passwords to gain access.
ServiceNow ServiceNow includes all documentation on the wiki at wiki.servicenow.com.
Docusign DocuSign hosts customer accounts in its own data centers managed by DocuSign. Upon a new contract executed with a customer, DocuSign provisions a customer account based on the #2..
- 620 -
SOLICITATION # CH16012
169
contract terms. A designated point of contact becomes the default primary administrator who then adds additional users and other admin tasks. DocuSign's cloud stack is defined in architecture documents available under separate confidential disclosure.
QTS
SAP Ariba Our solutions are offered and delivered in a true subscription-based model and shared service (multi-tenant) offering. There is no software to install, no hardware to buy, no maintenance or support costs and no need to hire consultants or tech specialists to run the system. We deploy and manage the infrastructure. Customers only need a web browser for access. Subscriptions include system maintenance, automatic upgrades, enhancements and application of service packs, Level 1– 3 help desk support, professional services and best practices built directly into the application.
Fieldglass Fieldglass maintains its own platforms and follows a mature change control process for introducing new systems to the hosted environments.
Hanna The Managed Service includes the following:
• Infrastructure operations management: monitoring, patching, software updates & maintenance up to the OS Layer
• OS management: monitoring, patching, updates, and maintenance of the specific OS
• Network and system administration
• HANA database platform operations includes: space management revision management , security management , hardware configuration management, backup & recovery, change management coordination
• Health check services, proactive monitoring, capacity management • SAP Technical Application Basis Operations (incl. SAP Basis) • Monitoring
• Troubleshooting – Incident Management Level 2 and 3
• Patch Management
• Housekeeping
• Backup/Recovery
SuccessFactors We offer a cloud based solution. Our application is standardized on the J2EE technology stack with the majority of our software written in industry-standard software programming languages, such as Java.
We also make extensive use of Web 2.0 technologies, such as AJAX and Flash, for improved usability and performance and to deliver a rich and highly interactive experience. Our hardware consists primarily of industry standard web servers, application servers, database servers and storage and networking equipment.
Customers share the network security infrastructure, web servers, application servers and database instance, and each customer has their own set of database tables that are logically partitioned in the database containing its own unique database schema. Each company instance can be completely exported out of the database without affecting any other customer.
The application utilizes the JAVA and J2EE industry standards. Integration is supported through .CSV, XML and web services standards.
The application is portable to any platform and is deployed on Apache (Solaris) Web Servers, JBOSS Application Servers, and Veritas High Availability Cluster Servers, and utilizes Cisco Networking.
VMware VMware IaaS Services
An interface that allows users to select from a catalog of pre built OS images and allows them to provision on the fly.
#2..
- 621 -
SOLICITATION # CH16012
170
VMWare AirWatch
AirWatch uses industry recognized tools and follow best practices to deploy, configure, and maintain server images. We do not apply customer-supplied templates and do not share templates with customers.
Our Information Security team identifies applicable security standards and the AirWatch Server Team creates a secure baseline image for deployment throughout the SaaS environment.
Due to FOIA restrictions, additional information regarding capacity planning and image creation/safeguarding cannot be disclosed at this time.
FireEye This is not applicable as each of FireEye’s offerings are classified as SaaS.
8.17.2 Provide tool sets at minimum for:
1. Deploying new servers (determining configuration for both stand alone or part of an existing server farm, etc.)
CA APM New servers are predefined by the CA SaaS Ops toolchain, and automated using AWS tooling to be able to bring up/down servers on demand MAA Same as above.
CA Agile We utilize configuration management tools to ensure consistent configuration across our servers.
ASM Same as above.
Google 1. This is not applicable to Google. Capacity planning and server deployment is fully managed by Google.
2. This is not applicable. With the Google IaaS solutions all server images are provided by Google.
3. With respect to the SaaS offfering, Google Apps, if customers have not selected the Google Apps Unlimited option which offers unlimited storage, they have options to upgrade. With respect to the PaaS/IaaS offering, Google Cloud Platform, storage space is allocated dynamically based on actual usage demand.
4. SaaS, Google Apps includes numerous administrative tools to monitor end user and administrator activites."
AODocs This is not applicable.
Virtru AMIs provisioned using terraform and configured by Ansible to include all configuration parameters
Salesforce This is not applicable. These services while applicable to IaaS are not applicable to PaaS/SaaS where all of the infrastructure is managed by Salesforce as the Cloud Service Provider. These services are included and managed as part of the Salesforce subscription service and not directly exposed to the customer.
The multitenant architecture and secure logical controls address separation of customer data.
There are no dedicated servers used for individual customers. The Salesforce Services infrastructure is divided into a modular architecture based on “Instance”. Each Instance is capable of supporting several thousand customers in a secure and efficient manner. Services are grouped within each Instance; with app, search, and database elements contained. There are appropriate controls in place to ensure that any given customer’s org (application) is not compromised. The service has been designed to accomplish this and is robustly tested on an ongoing basis by both Salesforce and its customers.
An instance consists of a database instance run on clustered database servers and physical storage subsystems. Each server has been allocated a different volume group so it can fail over to its backup server within the instance independently of the others. As scalability needs dictate, #2..
- 622 -
SOLICITATION # CH16012
171
additional database instances can be brought online (the application already provides for this). For additional server capacity, one or more databases could be moved onto its own database server.
ServiceNow ServiceNow has read and understands this requirement. ServiceNow supports only a SaaS environment so there is no on-premise offering.
SAP Ariba Operating systems when installed through default means and with default settings are typically not secure and often include applications and services not required. Ariba has standardized operating systems' installations based on best practices. Ariba servers are configured with just the applications and services required to run the server as designed. Services not required are disabled and binary files not required for operation are removed, which reduces the total number of vulnerabilities a system may have.
Ariba standardized installation process also ensures that all servers of the same type are configured exactly the same, utilizing a process that initiates an upgrade to system binaries across all systems. Based on the system type, the configuration will remain the same. If one server type needs to receive a patch for a vulnerable binary file, that patch is pushed to all systems of that particular server type. If that binary exists on all systems, it is patched across all systems. Patches are then included in the build process as well so that future systems built are in compliance with security standards. Ariba uses this configuration process to 'harden' the operating system prior to implementing additional controls as detailed below.
Fieldglass Fieldglass uses group policy to ensure the configuration of all servers match our security requirements.
Hanna HEC is a private cloud offering where servers configurations are discussed and approved by customer prior to deployment.
SuccessFactors We apply hardening in line with ISO 27k standards and audit key areas in the SOC 2 Type 2 report. Audit reports are available to customers and prospects upon completion of an NDA.
VMware VMware IaaS Services
vCloud Hybrid Service provides an interface that allows users to select from a catalog of pre-built OS images and allows them to provision on the fly.
vRealize Automation is the next level for provisioning, delivering, and managing IT services on VMware vSphere infrastructure as well as VMware vCloud Air all with a unified management experience. It provides governance and blueprints to deliver services from on premise into vCloud Air.
Customers can integrate vCloud Air with vRealize Automation. In this setup, users access vCloud Air primarily through the vRealize Automation service catalog which handles authentication to the service itself. vRealize Automation supports
VMWare AirWatch
AirWatch uses industry recognized tools and follow best practices to deploy, configure, and maintain server images. We do not apply customer-supplied templates and do not share templates with customers.
Due to FOIA restrictions, additional information regarding capacity planning and image creation/safeguarding cannot be disclosed at this time.
FireEye This is not applicable as each of FireEye’s offerings are classified as SaaS.
VirtueStream Virtustream offers on-demand self-service portal where State of Utah can deploy new servers as stand-alone or part of a server farm.
2. Creating and storing server images for future multiple deployments CA APM Servers are brought up on demand
#2..
- 623 -
SOLICITATION # CH16012
172
MAA Same as above.
CA Agile We utilize configuration management tools to ensure consistent configuration across our servers.
ASM Same as above.
Virtru Provisioning system automatically persists all past AMIs for ability to roll-back Salesforce This is not applicable. These services while applicable to IaaS are not applicable to PaaS/SaaS where all of the infrastructure is managed by Salesforce as the Cloud Service Provider. These services are included and managed as part of the Salesforce subscription service and not directly exposed to the customer.
ServiceNow ServiceNow has read and understands this requirement. ServiceNow supports only a SaaS environment so there is no on-premise offering.
SAP Ariba Ariba has standard 'realms' which are default versions of the various configurations the Ariba on-demand products can be setup for each customer with one test and one production instance. Ariba maintains all hardware, software, realms and entitlements taking the burden off our customers and suppliers whilst providing a platform to configure to each company's needs and business processes
Fieldglass Fieldglass uses virtual servers within our hosted environments uses the hardening configurations to maintain the right level of security.
Hanna HEC is a private cloud offering where servers configurations are discussed and approved by customer prior to deployment.
VMware VMware IaaS Services
We also allow for template and gold master images to be stored on-premise and deployed to the cloud as well as storage of templates and master images in vCloud Director catalogs in in vCloud Air
VMWare AirWatch
Our Information Security team identifies applicable security standards and the AirWatch Server Team creates a secure baseline image for deployment throughout the SaaS environment.
Due to FOIA restrictions, additional information regarding capacity planning and image creation/safeguarding cannot be disclosed at this time.
FireEye This is not applicable as each of FireEye’s offerings are classified as SaaS.
VirtueStream Virtustream offers server images, templates, or other methods (OVF and blueprints) for multiple deployments as part of standard solution.
3. Securing additional storage space
CA APM AWS EC2 storage is elastic, and can be expanded on demand MAA Virtual storage can be added when needed.
CA Agile We have redundant systems for all critical infrastructure and have the ability to add additional storage if deemed necessary.
ASM Additional storage is added manually.
AODocs AODocs storage is based on Google Apps Drive storage and with respect to the SaaS offfering, Google Apps, if customers have not selected the Google Apps Unlimited option which offers unlimited storage, they have options to upgrade.
Virtru New hardware added at Cloudant
Salesforce Salesforce provides extensive storage capabilities. Storage is divided into two categories: file storage and data storage. File storage includes files in attachments, the Documents tab, the Files tab, the File field, Salesforce CRM Content, Chatter (including user photos), and Site.com assets.
Data storage includes the following entities/records stored within the Salesforce application:
Accounts, Article types, Article type translations, Campaigns, Campaign Members, Cases, Case #2..
- 624 -
SOLICITATION # CH16012
173
Teams, Contacts, Contracts, Custom objects, Email messages, Events, Forecast items, Google docs, Ideas, Leads, Notes, Opportunities, Opportunity Splits, Orders, Quotes, Quote Template Rich Text Data, Solutions, Tags: Tag applications, Tags: Unique tags, and Tasks.
For file storage, Unlimited Edition is allocated a per-user limit multiplied by the number of users in the organization plus an additional per-organization allocation. For example, an Unlimited Edition organization with 600 users receives 1,211 GB of file storage, or 2 GB per user multiplied by 600 users plus an additional 11 GB.
For data storage, Unlimited Edition is allocated either 1 GB or a per-user limit, whichever is greater. For example, an Unlimited Edition organization with 10 users receives 1 GB because 10 users multiplied by 20 MB per user is 200 MB, which is less than the 1 GB minimum.
Additional storage can be purchased, or files can be exported and archived outside of Salesforce, thus freeing up file storage space.
ServiceNow ServiceNow has read and understands this requirement. ServiceNow supports only a SaaS environment so there is no on-premise offering.
QTS Services that scale to meet your web and IT infrastructure needs - QTS offers space options from single cabinets to multi-rack cages to private suites. Coupled with configurable primary and redundant power options to run your infrastructure, QTS Colocation services can be scaled to support your near term growth requirements and future expansion.
SAP Ariba We carefully monitor all network interfaces. Internally we are well below capacity on our most congested interconnects. To the internet we use Border Gateway Protocol to peer with redundant Internet Service Provider’s and manage the bandwidth accordingly.
Fieldglass As a software-as-a-service (SaaS), Fieldglass automatically and transparently handles the scaling and redundancy for customers based on SLAs governing performance and availability. Fieldglass monitors application servers, database servers, bandwidth, and infrastructure for average and maximum utilization with Orion. Current utilization averages approximately 20 percent across all components with a goal of scaling the component vertically or horizontally (depending on the specific component) upon reaching a 60 percent threshold). All systems are scalable either horizontally or vertically to handle capacity requirements. This includes but is not limited to web servers, database servers, and storage.
Hanna HEC is a private cloud offering where servers configurations are discussed and approved by customer prior to deployment.
VMware VMware IaaS Services
Additional storage can be purchased and provisioned in 48 hours.
VMWare AirWatch
Our Information Security team identifies applicable security standards and the AirWatch Server Team creates a secure baseline image for deployment throughout the SaaS environment.
Due to FOIA restrictions, additional information regarding capacity planning and image creation/safeguarding cannot be disclosed at this time.
FireEye This is not applicable as each of FireEye’s offerings are classified as SaaS.
4. Monitoring tools for use by each jurisdiction’s authorized personnel – and this should ideally cover components of a public (respondent hosted) or hybrid cloud (including Participating entity resources).
#2..
- 625 -
SOLICITATION # CH16012
174
CA APM all SaaS based instances are monitored by CA SaaS Ops. With Hybrid deployments, customers can manage the on premise components of the deployment using their own tooling or CA products
MAA MAA is monitored internally as well as externally using multiple tools recognized within industry.
CA Agile Access to monitoring tools is provisions according to the principle of least priviledge and is only granted based upon business need.
ASM ASM uses Nimsoft Monitor, third-party open source monitoring tools, and ASM itself to monitor the health of ASM internal services and servers.
AODocs AODocs includes numerous administrative tools to monitor end user and administrator activites.
Virtru Dtrace, CloudWatch, CloudTrail, Logstache, ElasticSearch, Kibana, DataDog Salesforce Trust.salesforce.com is the Salesforce community’s home for real-time information on system performance and security. On this site you'll find:
ズ Live and historical data on system performance
ズ Up-to-the minute information on planned maintenance
ズ Phishing, malicious software, and social engineering threats ズ Best security practices for your organization
ズ Information on how we safeguard your data
System Overview
In addition to our Trust site (http://trust.salesforce.com/trust/status), you will also have access to a System Overview, which will help Salesforce customers monitor performance and usage of their own Salesforce org. This overview includes:
Schema - # and % of custom objects and data storage
Business Logic - # and % of Rules, Apex triggers and classes, as well as % of code used Licenses
API Usage - # and % of requests in the last 24 hours
User Interface - # and % of custom apps, sites, flows, custom tabs and pages Portal
The above list is of all the possible metrics that Salesforce customers may have in their system overview.
ServiceNow ServiceNow has read and understands this requirement. ServiceNow supports only a SaaS environment so there is no on-premise offering.
QTS Alert Logic’s Threat Manager Intrusion Detection System (IDS) and Vulnerability Scanning functionality are designed to monitor, detect, report and alert on adverse security issues on behalf of our customers. Within this process there are a number of both automated and manual processes which are supported by our SIEM software (‘The Expert System’) as well as our Network Security Analysts in our Security Operations Center (SOC). Threat Manager is the Alert Logic IDS and VA scan product. It includes the physical or virtual appliances and software tools used to analyze the customer’s infrastructure and monitor that infrastructure for attacks.
ActiveWatch is the managed aspect of Threat Manager, providing 24 x 7 monitoring and incident response operations from the Alert Logic SOC.
Threat Manager's Expert System identifies valid security events and suppresses false positives through a patented multifactor correlation process. Every security event monitored by its global network of threat sensors is analyzed in real time. When the Expert System determines that a set of events comprise a valid security threat, an incident is created and escalated according to severity via email or through an Alert Logic Network Security Analyst. This approach dramatically #2..
- 626 -
SOLICITATION # CH16012
175
reduces false positives and keeps analysts and customers focused on real, actionable incidents.
In addition, Alert Logic’s security research team continuously monitors threat data and tunes the Expert System to respond to the most current threats.
SAP Ariba Within our solution, specific logging takes place that is viewable by the customer administrator or their designee. Audit logs produced through use of the solution are considered customer data and are maintained within the customer's instance of the database. These logs are retained so long as the customer has an active contract with us.
As a user control consideration, customers are responsible for monitoring the proper entry of data to the solution and reviewing reports generated by the system.
Fieldglass Fieldglass has a comprehensive set of performance monitoring tools in place.
Some tools are built in the application and some are external.
The Fieldglass application captures every page hit and the time it takes to respond. It captures the server response time and the client rendering time separately. The average page times are available to be seen by privileged users through the application. The user can drill down to the hour or minute or a single request for analysis. The information can be displayed by time range for all users, by company, or even for an individual user.
Orion Network Monitoring watches more than 1,000 different points of interest on the production infrastructure. These monitors include, but are not limited to, the following: CPU, Memory, I/O, Capacity and Synthetic Transactions. These monitors along with our custom application performance monitors are used to produce and comply with customer SLA requirements.
Fieldglass also uses Splunk Enterprise Security for event/audit log collection and correlation. Events and logs are retained online for 90 days and offline for two years.
Alerts are generated and reviewed as they occur.
Hanna SAP HEC uses Solution Manager for monitoring the infrastructure end to end.
Hybris SAP Hybris offers continuous 24/7 systems monitoring in-place, which automatically notifies you, SAP Hybris support and optionally your designated implementation partner in the event of any monitored system problem. Tools used for monitoring include HP Sitescope and Nagios. This service ensures quick response times to emergency problems. Standard monitors are in place for basic site availability. Customer can utilize additional 3rd party monitoring services should it wish to add additional monitoring. Upon request, monthly or quarterly reviews are offered to review performance over the period. When a system problem occurs, in addition to monitor alerts sent to the customer, SAP Hybris support may send emails to a designated customer notification email address to provide status, updates or further detailed information. In addition, a support ticket would be created which would include such information.
SuccessFactors The application logs the following for every transaction: Event/transaction Time, Transaction ID, Event/transaction Type, Event/transaction Status (Result of the event; if failure, includes reason), Object Attributes (Describes the object affected by the event), Originator User ID (ID of the user who initiated the event or action), Subject ID, Process User ID, Account Number, Transaction Specific Elements.
The application audits changes to the major components. Examples of this are goal auditing and document auditing. The audit trail includes who made the change, the date of the change and the ability to see the data as it existed at #2..
- 627 -
SOLICITATION # CH16012
176
that point in time. The data in the audit log can be viewed with appropriate permissions.
We also provide an optional Audit Framework for additional audit logging capabilities. All audit logs within the application are accessible only by customers. Therefore, the review of application audit logs as well as retention periods for the application audit logs are the customer’s responsibility, and can be determined as per requirements
VMware VMware IaaS Services
The vCloud Hybrid Service infrastructure, including the top layer management stack, the customer management stack and the computing/storage/network hardware are monitored for availability, capacity and performance. Customers are responsible for monitoring their own VMs (OS, apps).
Customers can use on premise monitoring tools to manage and monitor their applications and OSes over VPN and direct connect.
VMWare AirWatch
The AirWatch Cloud Operations team monitors the SaaS environment. AirWatch follows the Fault, Configuration, Accounting, Performance, and Security (FCAPS) model to monitor the SaaS environment.
•We have configured the system to notify support personnel of any issues with key performance items
•Because the solution is built on industry-standard ASP.NET architecture, it integrates into existing management and monitoring tools. Administrators can configure log data storage to destinations such as Windows Event Viewer, SNMP traps, syslog, SMTP email alerts, etc. The solution also integrates directly with Microsoft SCCM.
The communication layer includes a complete infrastructure for API integration to third parties as well as a rich set of existing APIs, web services, single sign on and authentication protocols.
Integrate with security information and event management (SIEM) solutions for enhanced logging of events occurring in the console. Administrators can view events, filter by event type, category and module, and export events. Event logging settings can be configured based on severity levels, with the ability to send specific levels to external system via syslog integration.
FireEye This is not applicable as each of FireEye’s offerings are classified as SaaS.
8.18 Trial and Testing Periods (Pre- and Post- Purchase)
8.18.1 Describe your testing and training periods that your offer for your service offerings.
Training and testing periods will vary based on the Service provider as well as the complexity of the request that is made by the Purchasing Entity. Some of the services can be functional within a few days and some will take a few months for full implementation.
8.18.2 Describe how you intend to provide a test and/or proof of concept environment for evaluation that verifies your ability to meet mandatory requirements.
Upon Request, Carahsoft will provide access to any of the Cloud Technologies proposed. The precise Access to the technology may be in a limited or “DEMO” fashion. Access will be to an extent that the State may complete any necessary tests or verifications that may be required. Instructions on precisely how each technology will be accessed will be provided upon request. All of the proposed technologies are currently live/ active and support many customers. A specific instance of the requested technology would be stood up within the cloud framework to support this request. As this will be occurring within a production, the creation of the instance is a quick and straight forward process not requiring any sort of extraordinary effort.
#2..
- 628 -
SOLICITATION # CH16012
177
8.18.3 Offeror must describe what training and support it provides at no additional cost.
Carahsoft provides the customer with free training for specific deals on a case by case basis. This can include free installation, training, and maintenance for high value customers who purchase Carahsoft’s solution through the NASPO contract vehicle. In addition, Carahsoft will provide webinars with basic training on a quarterly basis, made available to any Purchasing Entity who wishes to participate.
8.19 Integration and Customization
8.19.1 Describe how the Solutions you provide can be integrated to other complementary applications, and if you offer standard-based interface to enable additional integrations.
The integration into other applications will vary base on the Service Provider, however it is standard practice to allow for open AIs for integration development. For example Connecting Salesforce to an existing enterprise application is a common and frequently performed task. Integration options range from native Web Services support (APIs, outbound workflow, etc.) to import/export utilities to middleware integration via packaged connectors to toolkits for Java, .NET, and other open platforms. Our solution provides the ability to call out to virtually all common APIs, to enable synchronization, push / pull, and mash-ups with external apps/systems. Salesforce itself is based on web-service based APIs that in turn simplify access to Salesforce data from external systems. API-based integration is heavily leveraged by our customers.
8.19.2 Describe the ways to customize and personalize the Solutions you provide to meet the needs of specific Purchasing Entities.
The Service Providers customization options are very extensive and highly configurable. For example The Salesforce Platform offers a core set of technologies that not only power the Salesforce SaaS products, but also allows your Agency to build custom apps, connect data from any system, and manage it from anywhere. The Salesforce Platform allows customers to build apps fast with just a few clicks, designed for desktop and mobile devices, all from a single canvas. The Salesforce Platform has been given top ratings by Gartner, Forrester, & Info-Tech Research. To help IT deliver apps faster, the Salesforce Platform offers a simple yet powerful set of declarative, point-and-click tools that anyone can use to achieve business goals at lightning speed. Without writing code, developers and business users alike can quickly and easily create custom apps on the Salesforce Platform with complex business logic and beautiful user interfaces designed specific to every screen. Salesforce Lightning Builder tools allows your Agency to work in alignment with agile development methodologies as IT meet business demands faster. The Platform uses open APIs based on industry standards such as REST and SOAP to make it easy for your Agency to build apps that integrate with legacy systems. For more complex applications, developers can leverage the Apex programming language. Apex is an object-oriented, on-demand language. It is like Java, with similar syntax and notation, and is strongly-typed, compiled on demand, and fully integrated into the Platform. All of the application services come right out of the box, from a powerful workflow engine to API services, integration services, authentication, event log framework, analytics, and collaboration.
8.20 Marketing Plan
Describe your how you intend to market your Solutions to NASPO ValuePoint and Participating Entities.
Carahsoft offers deep experience in public sector marketing. Our dedicated team plans, promotes and executes more than 2,000 public-sector marketing campaigns and events each year, including contractspecific promotional activities. These include but are not limited to:
News announcements
#2..
- 629 -
SOLICITATION # CH16012
178
Social media promotion (Twitter, Linked In, Facebook, Carahsoft Community) Website content/reciprocal links (Carahsoft website page; content for contract sponsor page) Marketing materials (FAQs, contract overviews, solution spec sheets, powerpoint slides) Training documents
Co-branded tradeshow graphics, giveaways, display materials Tradeshow participation (national, state and local government and education shows) Digital and print ads
Webinars
Email campaigns
Proactive marketing opportunity tar available through:
o National Coalition for Public Procurement (NCPP) – publicprocurementcoalition.org o Institute for Public Procurement (NIGP) – nigp.org
o National Association of Counties (NACo) – naco.org
o The United States Conference of Mayors – usmayors.org o National League of Cities – nlc.org
o National Governors Association – nga.org
o Relevant State Associations
8.21 Related Value-Added Services to Cloud Solutions
Describe the valued-added services that you can provide as part of an awarded contract, e.g. consulting services pre- and post- implementation. Offerors may detail professional services in the RFP limited to assisting offering activities with initial setup, training and access to the services.
In addition to Carahsoft's quoting and configuration expertise, we also have a wide range of Service Provider implementation partners that we leverage to work with Purchasing Entities in order to ensure successful adoption and deployment within a Purchasing Entity. We will help to identity needs for initial setup, training and access to the services so that it is all available at the best prices from one source to the Purchasing Entity.
8.22 Supporting Infrastructure
8.22.1 Describe what infrastructure is required by the Purchasing Entity to support your Solutions or deployment models.
The Service Providers that are being proposed operate on their own secure infrastructure. The Purchasing Entities will only need an internet connection to access the services.
8.22.2 If required, who will be responsible for installation of new infrastructure and who will incur those costs?
The Service Providers maintain all costs for updating and building new infrastructures.
8.23 Alignment of Cloud Computing Reference Architecture Clarify how your architecture compares to the NIST Cloud Computing Reference Architecture, in particular, to describe how they align with the three domains e.g. Infrastructure as a Service (IaaS), Software as a Service (SaaS), and Platform as a Service (PaaS).
CA APM The SaaS portal runs in Amazon Web Services.
MAA CA MAA is a SaaS service.
CA Agile Only SaaS is being offered via a public cloud
#2..
- 630 -
SOLICITATION # CH16012
179
ASM As a monitoring service, ASM is considered to be SaaS.
Virtru The capability provided to the consumer is to use the provider’s applications running on a cloud infrastructure2 . The applications are accessible from various client devices through either a thin client interface, such as a web browser (e.g., web-based email), or a program interface. The consumer does not manage or control the underlying cloud infrastructure including network, servers, operating systems, storage, or even individual application capabilities, with the possible exception of limited userspecific application configuration settings.
Salesforce Salesforce’s deployment model is a “public” cloud infrastructure, as defined by NIST 800-145. In the Salesforce Government Cloud, an agency dynamically provisions computing resources over the Internet on our multi-tenant infrastructure. This is a cost effective deployment model for agencies as it gives them the flexibility to procure only the computing resources they need and delivers all services with consistent availability, resiliency, security, and manageability.
Salesforce was the first Cloud Service Provider to attain FedRAMP Authority to Operate for both Software as a Service (SaaS) and Platform as a Service (PaaS), consistent with the FedRAMP moderate baseline controls. Salesforce does not provide IaaS as a direct service offering to our customers, it is an underlying part of our PaaS and SaaS offerings.
Salesforce Government Cloud
In May 23, 2014 Salesforce achieved a FedRAMP Agency Authority to Operate at the moderate impact level (as described in FIPS 199 and 200) issued by Health and Human Services (HHS) for the Salesforce Government Cloud. Additionally, on May 15, 2015, HHS, as the FedRAMP authorizing agency, approved the Salesforce Government Cloud authorization package that was updated based on annual attestation requirements and updates to the FedRAMP baseline which is FISMA compliant and based on the current release of NIST SP 800-53 Rev. 4.
Testing for the ATO was performed by a third party assessment organization (3PAO). The Salesforce Government Cloud information system and authorization boundary, is comprised of the Force.com Platform, Salesforce Services (Sales Cloud, Service Cloud, Chatter), and the backend infrastructure (servers, network devices, databases, storage arrays) that support the operations of these products, referred to as the General Support System (GSS).
To obtain compliance with FedRAMP, Salesforce conducted security assessment and authorization activities in accordance with FedRAMP guidance, NIST SP 800-37, and HHS guidance. As part of this process Salesforce documented a System Security Plan (SSP) for the Salesforce Government Cloud service offering. The SSP is developed in accordance with NIST SP 800-18, Guide for Developing Federal Information System Security Plans. The SSP identifies control implementations for the GSS and in-scope customer facing products (Force.com Platform, Salesforce Services) according to the FedRAMP moderate baseline and HHS security control parameters. A security assessment of the information system was conducted by a third party assessment organization (3PAO) in accordance with NIST 800-53A and FedRAMP requirements.
The security assessment testing determined the adequacy of the management, operational, and technical security controls used to protect the confidentiality, integrity, and availability of the Salesforce service and the customer data it stores, transmits and processes.
To maintain compliance with FedRAMP, Salesforce conducts continuous monitoring. Continuous monitoring includes ongoing technical vulnerability detection and remediation, remediation of open compliance related findings, and at least annual independent assessment of a selection of security controls by 3PAO. As part of our FedRAMP annual assessment, Salesforce is now aligned with NIST SP 800-53, Rev. 4 controls.
ServiceNow ServiceNow’s architecture aligns with Software as a Service (SaaS). #2..
- 631 -
SOLICITATION # CH16012
180
Docusign DocuSign’s DTM® solution is ISO 27001:2013 certified and many of the ISO 27001:2013 controls are mapped to the NIST 800-53 requirements; we can provide additional information upon request.
SAP Ariba Our solutions are offered and delivered in a true subscription-based model and shared service (multi-tenant) offering. There is no software to install, no hardware to buy, no maintenance or support costs and no need to hire consultants or tech specialists to run the system. We deploy and manage the infrastructure. Customers only need a web browser for access. Subscriptions include system maintenance, automatic upgrades, enhancements and application of service packs, Level 1– 3 help desk support, professional services and best practices built directly into the application.
Fieldglass Fieldglass is offered in a SaaS model. We follow the public cloud model identified by NIST. All customers access the same Fieldglass application version in a multi-tenancy database. The system is hosted in a secure hosting facility. Fieldglass manages everything from the cage in including all servers, devices, wiring, software, and configuration. Fieldglass uses the Cloud Security Alliance framework to measure itself against the recommended controls, in addition to ISO 27001 and SOC 2 controls in the Trust Services Principles of Security, Availability, Processing Integrity, Confidentiality, and Privacy.
Hanna HEC is a private cloud offering from SAP that provides fully 'managed' Infrastructure as a Service (IaaS) following NIST Cloud Computing Reference Architetcure.
Hybris The SAP Hybris Commerce, Cloud Edition is a Private Cloud Managed Service that offers a best practice multichannel commerce platform built on hybris accelerator technology, running in SAP Hybris own datacenters with a pay as you grow subscription model.
SuccessFactors Our IT architecture is aligned with ISO 27002. We are Safe Harbor certified and in alignment with BS10012 and ISO 20000 for Service Delivery. We demonstrate an on-going commitment to protecting the confidentiality, integrity and availability (“CIA”) of data from internal and external threats, making us a reliable and secure system provider.
Our secure multi-tenant Software as a Service (SaaS) platform is designed for availability, security, scalability, and performance. Industry best practices and standards are adopted and incorporated.
Our Network also complies with the Authority to Operate as a Moderate Risk Federal Information System by the Office of Personnel Management and Department of Homeland Security; NIST SP800-53 Security Controls; EU Privacy Directive 95/46/EC for EU and non-EU customer data; Payment Card Industry (PCI) Data Security Standard (DSS) v 2.0; Safe Harbor.
We provide privacy compliant data center facilities not only in the United States but also as a Member State of the European Union (EU) or a state of the European Economic Area (EEA). Currently, such data centers are certified for ISO27001, ISO9001 and PCI-DSS compliance.
Our security services provide complete and thorough monitoring of all traffic on the network on a 24x7x365 basis, and include security technology, alert services and incident management support. We are audited twice annually to SSAE16 (US) or ISAE 3402 (international) accounting standards. #2..
- 632 -
SOLICITATION # CH16012
181
VMware See section 8.1.1 for additional details.
Due to FOIA restrictions, we cannot share specific infrastructure details or architecture diagrams at this time. We can provide sample architecture diagrams under NDA to participating entities during task order negotiations as required.
VMWare AirWatch
AirWatch partners with co-located and cloud-hosted Tier III data centers to support of SaaS offering.
Due to FOIA restrictions, we cannot share specific infrastructure details or architecture diagrams at this time. We can provide sample deployments as under NDA to participating entities during task order negotiations as required.
FireEye Each of the FireEye cloud solutions are classified as Software as a Service (SaaS) and leverage a private cloud deployment model. With respect to the NIST Cloud Computing Reference Architecture, the following actors are integral to the overall design of the solutions:
Actor Definition
Cloud Consumer Customer organizations who have purchased FireEye cloud solutions
Cloud Provider FireEye
Cloud Carrier
Internet service providers and organizations
who have been contracted to host FireEye
cloud solutions.
A Cloud Broker is not leveraged in the FireEye cloud offerings. FireEye has contracted independent service auditors for evaluating controls relevant to security and confidentiality, however this occurs on an as-needed basis.
VirtueStream Virtustream solution is fully NIST compliant for Essential Characteristics, as the Infrastructure as a Service (IaaS) Service Model, with all deployment options – Private Cloud, Community Cloud, Public and Hybrid Cloud. To that extent:
1.Virtustream IaaS provides a self-service portal called xStream, where users can access, view, edit, provision, and modify compute, storage, network and application services based on granular Role Based Access Control, which can be integrated with Active Directory or LDAP.
2.Virtustream IaaS provides Broad Network Access, where it can provide landing zone for any private network (Point-to-Point, Virtual Private Label Switching, Multi-Protocol Label Switching, or Direct Connect), public network (Internet, Trusted Internet Connectivity as landing zone, IPSEC VPN and SSL VPN) and also extranet connectivity (shared network, i.e, Cloud Connect, Cloud Exchange, NetBond, etc.) which is growing rapidly as option for connecting cloud resources.
3.Key to Virtustream solution is its proprietary and patented solution of uVM technology, which is effectively a granular solution for resource pooling, providing application performance, pay for consumption only and segregate resources for security and compliance, but aggregate for cost efficiency. In addition, Virtustream is currently one of very few Cloud Service Provider with capabilities for Geo-Fencing and Geo-Tagging of the virtual machines to a specific data center, and getting down to cluster and host machine level.
4.Virtustream’s self-service portal, ticketing system and also the Technical Account Manager, who is the single point of contact for State of Utah allows for provisioning and deprovisioning of resources and services. In addition, Virtustream is uniquely positioned to provide application level provisioning as part of its standard automation and orchestration tool.
5.The fundamental of Virtustream solution is based on uVM Technology, which is very unique in terms of billing. Virtustream solution takes average consumption of compute resources, and State of Utah would only pay for actual resources based on a monthly average. This is in comparison #2..
- 633 -
SOLICITATION # CH16012
182
with traditional cloud solution, where the billing is based on allocation of resources in T-Shirt size (Micro, S, M, L, XL, XXL), and if the server is up, consumer of the cloud pays, but when it is down, they don’t. In case of the Virtustream solution, customer only pays based on the average of vCPU, RAM, IOPS and Network I/O; the key is average, not aggregate and based on consumption not allocation. In addition, all storage, security, application management services are offered as a monthly fee, based on the VMs; also, Virtustream can provide consultative and project support based on time and materials.
6.The deployment of Virtustream cloud can be on-premise or private based on purchase of its Cloud Management Platform, Community Cloud based on its IaaS, Public Cloud based on its IaaS and Hybrid cloud based on its ability to provide software and IaaS combined. #2..
- 634 -
SOLICITATION # CH16012
183
CONFIDENTIALが PROTECTEDが OR PROPRIETARY
INFORMATION
All confidential, protected or proprietary Information must be included in this section of proposal response.
Do not incorporate protected information throughout the Proposal. Rather, provide a reference in the proposal response directing Lead State to the specific area of this protected Information section.
If there is no protected information, write “None” in this section.
Failure to comply with this Section and Section 3.13 of the RFP releases the Lead State, NASPO ValuePoint, and Participating Entities from any obligation or liability arising from the inadvertent release of Offeror information.
Carahsoft Technology Corporation (“Carahsoft”) respectfully requests that section 6.3 Financials of Carahsoft’s response be treated as a trade secret under the Utah Uniform Trade Secrets Act, Utah Code ß 13-24-2 and submits this justification in accordance with Utah Code 63-G-2-305 demonstrating that its audited financials should be treated as a trade secret under Utah’s Uniform Trade Secrets Act. Additionally, Carahsoft is claiming the same confidentiality of the Consensus Assessments Initiative Questionnaire provided in relation to DocuSign and FireEye offerings, as well as the Cloud Controls Matrix for DocuSign.
Carahsoft has marked this attachment as “confidential” in accordance with the RFP instructions by including all confidential data into the Confidential, Protected, or Proprietary Information in our response.
Carahsoft is claiming confidentiality for these specific Consensus Assessments Initiative Questionnaires and Cloud Controls Matrix because releasing these documents would cause irreparable damage and would create the potential for cyber security breach. While portions of this information are in the public domain, the information contained within is not represented or assimilated this way in any other format.
Carahsoft’s Audited Financial Data satisfies the three-part test of the Utah Uniform Trade Secrets Act as set forth below and should therefore be treated as confidential and by the Utah Division of Purchasing and should not subject to public disclosure as provided in Utah Code ß 63G-2-305.
1. Carahsoft’s Audited Financial Data is a “compilation” within the meaning of Utah Code § 13-24-2(4).
Carahsoft’s Audited Financial Data is a compilation of all of the Company’s financial data and results for 2014.
While some aspects of this information may be available, the compilation of this information is unique and the result of sustained and distinct effort by the Company’s financial staff and its accountants.
2. As required by Utah Code ß 13-24-2(4)(a) Carahsoft derives independent economic value, actual or potential, from its Audited Financial Data not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from its disclosure or use.
Carahsoft is a leading distributor of technology products and services to public sector customers such as the State of Utah, and throughout the United States and Canada. Sales in this market are intensely and deliberately competitive, with each sale subject to a structured bidding process in which low price is frequently the deciding factor on which contract award is based. Competition in this market is fierce, with competitors regularly competing with one another for federal, state, county and city business. #2..
- 635 -
SOLICITATION # CH16012
184
Carahsoft’s competitors closely monitor this market, and regularly attempt to gain financial and other information about Carahsoft and other competing vendors. Allowing Carahsoft’s competitors access to this compilation of financial data by releasing it in response to a public records request will damage Carahsoft’s competitive position because it will provide competitors insight into Carahsoft’s financial structure, including compensation, overhead costs, rental rates, profit margins and the like. Indeed, allowing insight into compensation may violate individual employees’ expectations of privacy. Once competitors have this access and insight, they can use it to undercut Carahsoft in the marketplace, damaging Carahsoft’s business with its customers and its suppliers, and inflicting economic hardship upon the Company.
For these reasons, Carahsoft does not itself disclose its Audited Financial Data except when required by law to do so. For example, Carahsoft discloses its financial information in filing its periodic tax returns—disclosure of which is prohibited by applicable state and federal law. In this regard, we note that Carahsoft is a privately owned company. Therefore, Carahsoft does not publicly report its financial results to the United States Securities and Exchange Commission.
3. Carahsoft uses reasonable efforts to maintain the secrecy of its Audited Financial Data.
The third part of the Utah Uniform Trade Secret Act’s test for trade secret treatment is whether the information “…is the subject of efforts that are reasonable under the circumstances to maintain its secrecy.” Utah Code § 13-24-2(4)(b).
Carahsoft satisfies this test because it takes reasonable steps to maintain the secrecy of its financial information.
As noted above, Carahsoft is a privately held company and therefore does not report its financial results publically to either its shareholders or the Securities and Exchange Commission. This is in contrast to public companies such as IBM or AT&T who report financial results quarterly as a matter of public record.
Even within Carahsoft’s business operations itself, Carahsoft’s management strictly limits disclosure of this information to a few carefully selected employees, and then only on a “need to know” basis in connection with their work assignments. Indeed, each Carahsoft employee signs a Confidentiality Agreement agreeing not to disclose this information.
Conclusion
Based on the forgoing, Carahsoft believes it has demonstrated that its Audited Financial Data, Consensus Assessments Initiative Questionnaires, and Cloud Controls Matrix are trade secret as defined in Utah Code ß 23- 24-2 . It is a compilation the content of which affords Carahsoft a competitive advantage. Carahsoft’s competition cannot readily discern it by proper means. Moreover, Carahsoft itself treats this information as a trade secret even within its own business operations.
Should there be a public records request for this information, Carahsoft respectfully requests that the State afford Carahsoft’s requested confidential information and documents trade secret protection in accordance with Utah law and deny the request. In the event that the State determines to release the requested confidential data, Carahsoft requests that you notify us promptly so that we may provide further justification for trade secret protection of this confidential data.
#2..
- 636 -
CLAIM OF BUSINESS CONFIDENTIALITY
Pursuant to Utah Code Annotated, Subsections 63G-2-305(1) and (2), and in accordance with Section 63G-2-309, Carahsoft Technology Corporation (company name) asserts a claim of business confidentiality to protect the following information submitted as part of this solicitation.
Pricing/Cost Proposals may not be classified as confidential or protected and will be considered public information. An entire proposal cannot be identified as “PROTECTED”, “CONFIDENTIAL” or “PROPRIETARY”.
Non-public financial statements
Specific employee name and contact information
Specific customer information, client lists, or subscription lists Other (specify): Consensus Assessments Initiative Questionnaires and Cloud Controls Matrix
This claim is asserted because this information requires protection as it includes:
trade secrets as defined in Utah Code Annotated Section 13-24-2 ("Trade secret" means information, including a formula, pattern, compilation, program, device, method, technique, or process, that: (a) derives independent economic value, actual or potential, from not being generally known to, and not being readily ascertainable by proper means by, other persons who can obtain economic value from its disclosure or use; and (b) is the subject of efforts that are reasonable under the circumstances to maintain its secrecy).
commercial information or non-individual financial information obtained from a person if: (a) disclosure of the information could reasonably be expected to result in unfair competitive injury to the person submitting the information or would impair the ability of the governmental entity to obtain necessary information in the future; [and] (b) the person submitting the information has a greater interest in prohibiting access than the public in obtaining access.
This statement of reasons supporting the claim of business confidentiality applies to the following information in this proposal:
Page Paragraph Reason
187-204,
Technical
Response
Template
All See Confidential, Trade Secret, & Proprietary Information Explanation
Exhibit 1-
DocuSign
Excel
N/A See Confidential, Trade Secret, & Proprietary Information Explanation
Exhibit 1-
FireEye
Excel
N/A See Confidential, Trade Secret, & Proprietary Information Explanation
Exhibit 2-
DocuSign
Excel
N/A See Confidential, Trade Secret, & Proprietary Information Explanation
Please use additional sheets if needed.
You will be notified if a record claimed to be protected herein under Utah Code Annotated ß 63G-2-305(1) or (2) is classified public or if the governmental entity determines that the record #2..
- 637 -
should be released after weighing interests under Utah Code Annotated ß 63G-2-201(5)(b) or Utah Code Annotated ß 63G-2-401(6). See Utah Code Annotated ß 63G-2-309.
Signed: Robert R. Moore, Vice President
On behalf of (company): Carahsoft Technology Corporation Date: March 10, 2016
(Revision 6/4/2015)
#2..
- 638 -
SOLICITATION # CH16012
185
EXCEPTIONS ANDっOR ADDITIONS TO THE
STANDARD TERMS AND CONDITIONS
Proposed exceptions and/or additions to the Master Agreement Terms and Conditions, including the exhibits, must be submitted in this section. Offeror must provide all proposed exceptions and/or additions, including an Offeror’s terms and conditions, license agreements, or service level agreements in Microsoft Word format for redline editing.
Offeror must also provide the name, contact information, and access to the person(s) that will be directly involved in terms and conditions negotiations. If there are no exceptions or additions to the Master Agreement Terms and Conditions, write “None” in this section.
The point of contact who will be directly involved in terms and conditions negotiations is Jack Dixon – Contract Specialist. He can be reached at – 703.230.7545 / [email protected].
32. Transition Assistance:
a. The Contractor shall reasonably cooperate with other parties in connection with all Services to be delivered under this Master Agreement, including without limitation any successor service provider to whom a Purchasing Entity’s Data is transferred in connection with the termination or expiration of this Master Agreement. The Contractor shall assist a Purchasing Entity in exporting and extracting a Purchasing Entity’s Data, in a format usable without the use of the Services and as agreed by a Purchasing Entity, at no additional cost to the Purchasing Entity. Any transition services requested by a Purchasing Entity involving additional knowledge transfer and support may be subject to a separate transition Statement of Work.
b. A Purchasing Entity and the Contractor shall, when reasonable, create a Transition Plan Document identifying the transition services to be provided and including a Statement of Work if applicable. c. The Contractor must maintain the confidentiality and security of a Purchasing Entity’s Data during the transition services and thereafter as required by the Purchasing Entity.
Carahsoft takes exception to section 32 – Transition Assistance and request it includes the following.
9.4 RETURN OF CUSTOMER DATA. Carahsoft shall provide Customer Data in its standard database export format, excluding the any Core Technology, to Customer upon Customer’s written request and at no additional cost to Customer, provided that Carahsoft receives such request from Customer within forty-five (45) days following the expiration or termination of a provided service. If Carahsoft has not received a request within the foregoing time frame, Carahsoft shall have no obligation to maintain or provide any Customer Data and shall thereafter, unless legally prohibited, have the right to delete all Customer Data in its systems or otherwise in its possession or under its control and delete Customer’s instances of any provided service.
Carahsoft takes exception to Section 13 – Indemnification. Carahsoft requests that Indemnification from the state to the customer under a certain set of circumstances.
#2..
- 639 -
SOLICITATION # CH16012
186
IN SUMMARY
Carahsoft Technology Corporation appreciates the opportunity to offer this solution for the State of Utah’s initiative.
The Carahsoft Team has proposed a superior and cost-effective solution that fully complies with the State of Utah’s requirements set forth in Solicitation # CH16012. We understand the importance of your project goals, and we are confident you will benefit from this solution and our expertise.
Carahsoft looks forward to the opportunity to speak with you regarding the details of this proposal, as well as the opportunity to work with the State of Utah on this project. #2..
- 640 -
SOLICITATION # CH16012
187
SUPPLEMENTAL INFORMATION
Please find below Carahsoft’s supplemental information. #2..
- 641 -
SOLICITATION # CH16012
188
#2..
- 642 -
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
Carahsoft Technology Corporation
Financial Statements with
Independent Auditors' Report
December 31, 2013 Carahsoft Confidential - State of Utah #2..
- 643 -
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
Carahsoft Technology Corporation
Table of Contents
Title Page
Independent Auditors' Report 1-2
Financial Statements
Balance Sheet 3
Statement of Income 4
Statement of Shareholder’s Equity 5
Statement of Cash Flows 6
Notes to Financial Statements 7-10 Carahsoft Confidential - State of Utah #2..
- 644 -
Carahsoft Confidential - State of Utah
#2..
- 645 -
Carahsoft Confidential - State of Utah
#2..
- 646 -
Current Assets
Cash and cash equivalents $ 57,508,890
Accounts receivable, net 230,858,892
Prepaid expenses and Other Current Assets 181,147
Total Current Assets 288,548,929
Property and Equipment
Property and equipment 656,388
Less: accumulated depreciation and amortization (385,790) Property and Equipment, Net 270,598
Other Assets
Deposits 18,667
Total Assets $ 288,838,194
Current Liabilities
Accounts payable $ 235,561,345
Sales tax payable 274,076
Accrued expenses 19,710,325
Total Liabilities 255,545,746
Shareholder's Equity
Common stock, $0.01 par value, 1,000 shares authorized; 100 shares issued and outstanding 1
Additional paid-in capital 16,823,635
Retained earnings 16,468,812
Total Shareholder's Equity 33,292,448
Total Liabilities and Shareholder's Equity $ 288,838,194 All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Accompanying Notes and Auditors' Report
-3-
Carahsoft Technology Corporation
Balance Sheet
December 31, 2013
Assets
Liabilities and Shareholder's Equity
CONFIDENTIAL PROPRIETARY INFORMATION
Carahsoft Confidential - State of Utah
#2..
- 647 -
Revenue $ 1,724,988,403
Cost of Goods Sold 1,653,993,173
Gross Margin 70,995,230
Operation Expenses 67,382,570
Income from Operations 3,612,660
Other Income & Expense
Interest Income 814,902
Total Other Income 814,902
Net Income $ 4,427,562
See Accompanying Notes and Auditors' Report
-4-
Carahsoft Technology Corporation
Statement of Income
December 31, 2013
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
Carahsoft Confidential - State of Utah
#2..
- 648 -
Additional Total
Common Paid-in Retained Shareholder's
Stock Capital Earnings Equity
Balance at December 31, 2012 $ 1 $ 16,823,635 $ 12,041,250 $ 28,864,886 Net income for the year ended
December 31, 2013 - - 4,427,562 4,427,562
Balance at December 31, 2013 $ 1 $ 16,823,635 $ 16,468,812 $ 33,292,448
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
-5-
See Accompanying Notes and Auditors' Report
Carahsoft Technology Corporation
Statement of Shareholder's Equity
December 31, 2013
Carahsoft Confidential - State of Utah
#2..
- 649 -
Cash Flows from Operating Activities:
Net Income $ 4,427,562
Adjustments to reconcile net income to net cash
used in operating activities:
Depreciation and amortization 135,000
Increase/decrease in operating assets and liabilities:
Accounts receivable, net (13,896,459)
Prepaid expenses and other current assets (152,726)
Accounts payable 37,525,376
Sales tax payable 78,847
Accrued expenses (38,255,630)
Net Cash Used In Operating Activities (10,138,030)
Cash Flows From Investing Activities:
Purchases of property and equipment (100,947)
Net Decrease in Cash (10,238,977)
Cash and Cash Equivalents at the Beginning of the Year 67,747,867 Cash and Cash Equivalents at the End of the Year $ 57,508,890
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
Carahsoft Technology Corporation
Statement of Cash Flows
Year Ended December 31, 2013
See Accompanying Notes and Auditors' Report
-6-
Carahsoft Confidential - State of Utah
#2..
- 650 -
Carahsoft Technology Corporation
Notes to the Financial Statements
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Auditors’ Report
- 7 -
Note 1: Organization
Carahsoft Technology Corporation (“Technology” or “the Company”) was incorporated under the laws of the State of Maryland. The Company is a software reseller and provides information technology solutions to the U.S. Federal Government as well as State and Local Agencies and Commercial organizations. Technology is a wholly owned subsidiary of Carahsoft, Inc. The parent company charges Technology a management fee for certain administrative and support services.
Note 2: Summary of Significant Accounting Policies
Cash Equivalents
The Company considers its demand deposits and money market funds to be cash equivalents in the statement of cash flows.
The Company maintains its funds with certain financial institutions in amounts that generally exceed the Federal Deposit Insurance Corporation (FDIC) insurance limitation of $250,000. At year-end, the Company maintained bank balances of approximately $73,745,000 that exceeded insured levels.
Accounts Receivable
Receivables are stated at amounts estimated by management to be the net realizable value. The Company charges off accounts receivable when it becomes apparent based upon age or customer circumstances that amounts will not be collected.
Allowance for Doubtful Accounts
The allowance for doubtful accounts is established through charges to the provision for bad debts. The Company evaluates the adequacy of the allowance for doubtful accounts on a periodic basis. The evaluation includes historical trends in collections and write-offs, management’s judgment of the probability of collecting accounts and management’s evaluation of business risk. An allowance in the amount of $38,000 has been established for the year ended December 31, 2013.
Revenue Recognition Carahsoft Confidential - State of Utah Revenue is recognized under the accrual method at the time the goods are shipped. #2..
- 651 -
Carahsoft Technology Corporation
Notes to the Financial Statements
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Auditors’ Report
- 8 -
Note 2: Summary of Significant Accounting Policies - continued Property and Equipment
Property and equipment is stated at cost. Depreciation and amortization is computed using the straight-line method over the estimated useful lives of three to seven years.
Depreciation expense for the year ended December 31, 2013, was $135,000.
Prepaid Expenses
Prepaid expenses consist of prepaid marketing, software purchases and other operating expenses.
Income Taxes
The Company has elected to be taxed under the provisions of Subchapter S of the Internal Revenue Code (IRC). Accordingly, all income tax liabilities are the responsibility of the Parent Company.
Concentrations
Approximately 54% of the Company’s revenue is concentrated with three vendors.
Use of Estimates
Management uses estimates and assumptions in preparing these financial statements in accordance with U.S. generally accepted accounting principles. Those estimates and assumptions affect the reported amounts of assets and liabilities, the disclosure of contingent assets and liabilities, and the reported revenues and expenses. Actual results could vary from the estimates that were used.
Subsequent Events
The date to which events occurring after December 31, 2013, the date of the most recent balance sheet, have been evaluated for possible adjustment to the financial statements or disclosure is April 29, 2014, which is the date on which the financial statements were Carahsoft Confidential - State of Utah available to be issued.
#2..
- 652 -
Carahsoft Technology Corporation
Notes to the Financial Statements
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Auditors’ Report
- 9 -
Note 3: Accounts Receivable
Accounts Receivable at December 31, 2013, consisted of the following:
Billed Receivables $ 230,896,892
Less: allowance for doubtful accounts (38,000)
$ 230,858,892
Note 4: Lines of Credit
The Company has lines of credit available from a financial institution that have a combined maximum borrowing limit of $25,000,000. The lines were secured by cash, and substantially all of the Company’s assets. There were no borrowings against any of these lines at December 31, 2013.
Two of these lines of credit bear interest at prime + ½ percent and expire October 31, 2014. The other line bears interest at the prime rate and expires October 31, 2014. There was no interest expense for the year. As part of the line of credit agreements, the Company must comply with certain financial covenants. At year end, the Company was in compliance with all financial covenants.
Note 5: Retirement Plan
The Company has a 401(k) defined contribution retirement plan (the Plan) covering all eligible employees. Participants may make voluntary contributions to the Plan up to the maximum amount allowed by law. The Company may make discretionary matching and profit sharing contributions to the Plan. Participants are immediately vested in their contributions while Company contributions to the Plan vest 25% each year after the first year of service. The Company contributed approximately $337,000 to the Plan for the year ended December 31, 2013.
Note 6: Operating Leases
The Company leases office space under an operating lease that expires in May 2016. The office lease calls for rent escalations. Rent expense, including common area and other Carahsoft Confidential - State of Utah related expenses, for the year ended December 31, 2013 was approximately $638,000. #2..
- 653 -
Carahsoft Technology Corporation
Notes to the Financial Statements
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Auditors’ Report
- 10 -
Note 6: Operating Leases - continued
Future minimum lease payments under all operating leases are as follows:
2014 $ 462,458
2015 476,370
2016 200,927
Total $ 1,139,755
Note 7: Legal Matters
From time to time and in the ordinary course of business, the Company is involved in various legal matters. The Company does not expect any material unfavorable outcome as a result of these legal matters. Carahsoft Confidential - State of Utah #2..
- 654 -
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
Carahsoft Technology Corporation
Financial Statements with
Independent Auditor’s Report
December 31, 2014 Carahsoft Confidential - State of Utah #2..
- 655 -
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
Carahsoft Technology Corporation
Table of Contents
Title Page
Independent Auditor’s Report 1-2
Financial Statements
Balance Sheet 3
Statement of Income 4
Statement of Shareholder’s Equity 5
Statement of Cash Flows 6
Notes to Financial Statements 7-10 Carahsoft Confidential - State of Utah #2..
- 656 -
Carahsoft Confidential - State of Utah
#2..
- 657 -
Carahsoft Confidential - State of Utah
#2..
- 658 -
Current Assets
Cash and cash equivalents $ 62,441,330
Accounts receivable, net 254,996,232
Prepaid expenses and Other Current Assets 2,603,637
Total Current Assets 320,041,199
Property and Equipment
Property and equipment 722,669
Less: accumulated depreciation and amortization (535,790) Property and Equipment, Net 186,879
Other Assets
Deposits 18,667
Total Assets $ 320,246,745
Current Liabilities
Accounts payable $ 262,659,304
Sales tax payable 81,981
Due to Parent 12,145,114
Accrued expenses 6,024,208
Total Liabilities 280,910,607
Shareholder's Equity
Common stock, $0.01 par value, 1,000 shares authorized; 100 shares issued and outstanding 1
Additional paid-in capital 16,823,635
Retained earnings 22,512,502
Total Shareholder's Equity 39,336,138
Total Liabilities and Shareholder's Equity $ 320,246,745 All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Accompanying Notes and Auditor's Report
-3-
Carahsoft Technology Corporation
Balance Sheet
December 31, 2014
Assets
Liabilities and Shareholder's Equity
CONFIDENTIAL PROPRIETARY INFORMATION
Carahsoft Confidential - State of Utah
#2..
- 659 -
Revenue $ 2,276,200,166
Cost of Goods Sold 2,181,503,353
Gross Margin 94,696,813
Operation Expenses 89,661,323
Income from Operations 5,035,490
Other Income
Interest Income 1,008,200
Total Other Income 1,008,200
Net Income $ 6,043,690
See Accompanying Notes and Auditor's Report
-4-
Carahsoft Technology Corporation
Statement of Income
December 31, 2014
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
Carahsoft Confidential - State of Utah
#2..
- 660 -
Additional Total
Common Paid-in Retained Shareholder's
Stock Capital Earnings Equity
Balance at December 31, 2013 $ 1 $ 16,823,635 $ 16,468,812 $ 33,292,448 Net income for the year ended
December 31, 2014 - - 6,043,690 6,043,690
Balance at December 31, 2014 $ 1 $ 16,823,635 $ 22,512,502 $ 39,336,138
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
-5-
See Accompanying Notes and Auditor's Report
Carahsoft Technology Corporation
Statement of Shareholder's Equity
December 31, 2014
Carahsoft Confidential - State of Utah
#2..
- 661 -
Cash Flows from Operating Activities:
Net Income $ 6,043,690
Adjustments to reconcile net income to net cash
provided by operating activities:
Depreciation and amortization 150,000
Increase/decrease in operating assets and liabilities:
Increase in Accounts receivable, net (24,137,340)
Increase in Prepaid expenses and other current assets (2,422,490) Increase in Accounts payable 27,097,959
Decrease in Sales tax payable (192,095)
Decrease in Accrued expenses (1,541,003)
Net Cash Provided by Operating Activities 4,998,721
Cash Flows From Investing Activities:
Purchases of property and equipment (66,281)
Net Increase in Cash and Cash Equivalents 4,932,440
Cash and Cash Equivalents at the Beginning of the Year 57,508,890 Cash and Cash Equivalents at the End of the Year $ 62,441,330
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
Carahsoft Technology Corporation
Statement of Cash Flows
Year Ended December 31, 2014
See Accompanying Notes and Auditor's Report
-6-
Carahsoft Confidential - State of Utah
#2..
- 662 -
Carahsoft Technology Corporation
Notes to the Financial Statements
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Auditor’s Report
- 7 -
Note 1: Organization
Carahsoft Technology Corporation (“Technology” or “the Company”) was incorporated under the laws of the State of Maryland. The Company is a software reseller and provides information technology solutions to the U.S. Federal Government as well as State and Local Agencies and Commercial organizations. Technology is a wholly owned subsidiary of Carahsoft, Inc. The parent company charges Technology a management fee for certain administrative and support services.
Note 2: Summary of Significant Accounting Policies
Cash Equivalents
The Company considers its demand deposits and money market funds to be cash equivalents in the statement of cash flows.
The Company maintains its funds with certain financial institutions in amounts that generally exceed the Federal Deposit Insurance Corporation (FDIC) insurance limitation of $250,000. At year-end, the Company maintained bank balances of approximately $135,000,000 that exceeded insured levels.
Accounts Receivable
Receivables are stated at amounts estimated by management to be the net realizable value. The Company charges off accounts receivable when it becomes apparent based upon age or customer circumstances that amounts will not be collected.
Allowance for Doubtful Accounts
The allowance for doubtful accounts is established through charges to the provision for bad debts. The Company evaluates the adequacy of the allowance for doubtful accounts on a periodic basis. The evaluation includes historical trends in collections and write-offs, management’s judgment of the probability of collecting accounts and management’s evaluation of business risk. An allowance in the amount of $38,000 has been established for the year ended December 31, 2014.
Revenue Recognition Carahsoft Confidential - State of Utah Revenue is recognized under the accrual method at the time the goods are shipped. #2..
- 663 -
Carahsoft Technology Corporation
Notes to the Financial Statements
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Auditor’s Report
- 8 -
Note 2: Summary of Significant Accounting Policies - continued Property and Equipment
Property and equipment is stated at cost. Depreciation and amortization is computed using the straight-line method over the estimated useful lives of three to seven years.
Depreciation expense for the year ended December 31, 2014, was $150,000.
Prepaid Expenses
Prepaid expenses consist of prepaid marketing, software purchases and other operating expenses.
Income Taxes
The Company has elected to be taxed under the provisions of Subchapter S of the Internal Revenue Code (IRC). Accordingly, all income tax liabilities are the responsibility of the Parent Company.
Concentrations
Approximately 96% of the Company’s revenue is concentrated with five vendors.
Use of Estimates
Management uses estimates and assumptions in preparing these financial statements in accordance with U.S. generally accepted accounting principles. Those estimates and assumptions affect the reported amounts of assets and liabilities, the disclosure of contingent assets and liabilities, and the reported revenues and expenses. Actual results could vary from the estimates that were used.
Subsequent Events
The date to which events occurring after December 31, 2014, the date of the most recent balance sheet, have been evaluated for possible adjustment to the financial statements or disclosure is April 3, 2015, which is the date on which the financial statements were Carahsoft Confidential - State of Utah available to be issued.
#2..
- 664 -
Carahsoft Technology Corporation
Notes to the Financial Statements
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Auditor’s Report
- 9 -
Note 3: Accounts Receivable
Accounts Receivable at December 31, 2014, consisted of the following:
Billed Receivables $ 255,034,232
Less: allowance for doubtful accounts (38,000)
$ 254,996,232
Note 4: Lines of Credit
The Company has lines of credit available from a financial institution that have a combined maximum borrowing limit of $25,000,000. The lines were secured by cash, and substantially all of the Company’s assets. There were no borrowings against any of these lines at December 31, 2014.
Two of these lines of credit bear interest at prime + ½ percent and expire November 30, 2015. The other line bears interest at the prime rate and expires November 30, 2015.
There was no interest expense for the year. As part of the line of credit agreements, the Company must comply with certain financial covenants. At year end, the Company was in compliance with all financial covenants.
Note 5: Retirement Plan
The Company has a 401(k) defined contribution retirement plan (the Plan) covering all eligible employees. Participants may make voluntary contributions to the Plan up to the maximum amount allowed by law. The Company may make discretionary matching and profit sharing contributions to the Plan. Participants are immediately vested in their contributions while Company contributions to the Plan vest 25% each year after the first year of service. The Company accrued a contribution of $315,000 to the Plan for the year ended December 31, 2014.
Note 6: Operating Leases
The Company leases office space under an operating lease that expires in May 2015. The office lease calls for rent escalations. Rent expense, including common area and other related expenses, for the year ended December 31, 2014 was approximately $709,000.
Future minimum lease payments total $270,000 for 2015. Subsequent to year end, the Company signed a new 5 year lease agreement through April 2020, with total lease payments through the end of the lease of approximately $3,200,000.
Carahsoft Confidential - State of Utah
#2..
- 665 -
Carahsoft Technology Corporation
Notes to the Financial Statements
CONFIDENTIAL PROPRIETARY INFORMATION
All information contained in these documents is considered confidential and proprietary for the use of only the intended receiver.
See Auditor’s Report
- 10 -
Note 7: Concentrations and Contingencies
Taxable years ended December 31, 2011 through December 31, 2013 are subject to federal and other jurisdictions’ tax authority examinations. If the Company were to be audited, management is of the opinion that no significant liability will result from these actions.
Note 8: Legal Matters
From time to time and in the ordinary course of business, the Company is involved in various legal matters. The Company does not expect any material unfavorable outcome as a result of these legal matters. Carahsoft Confidential - State of Utah #2..
- 666 -
SECURITY AND HOSTING OVERVIEW
June 2015
#2..
- 667 -
Security and Hosting Overview June 2015
P a g e 2 | 21
Table of Contents
1 INTRODUCTION ....................................................................................................................................... 4
1.1 SCOPE OF OPERATIONS ...................................................................................................................5
1.2 SECURITY MANAGEMENT ................................................................................................................6
1.2.1 SECURITY POLICIES, STANDARDS AND PROCEDURES .................................................................................... 6
1.2.2 RISK MANAGEMENT .............................................................................................................................. 6
1.2.3 ASSESSMENTS ....................................................................................................................................... 7
1.3 APPLICATION SECURITY ...................................................................................................................8
1.3.1 ENCRYPTION......................................................................................................................................... 8
1.3.2 DATABASE SEGMENTATION..................................................................................................................... 8
1.3.3 DOCUMENT ENVELOPES ......................................................................................................................... 8
1.3.4 PAGE-LEVEL ACCESS CHECKING ............................................................................................................... 9
1.3.5 URL ENCRYPTION.................................................................................................................................. 9
1.3.6 ACTIVITY LOGGING ................................................................................................................................ 9
1.3.7 APPLICATION TESTING............................................................................................................................ 9
1.3.8 PASSWORD MANAGEMENT...................................................................................................................10
1.3.9 EMAIL APPROVALS...............................................................................................................................10
1.3.10 APPLICATION PENETRATION TESTING....................................................................................................11
1.4 PHYSICAL SECURITY ......................................................................................................................11
1.4.1 INTERNET DATA CENTER CONSTRUCTION ................................................................................................11
1.4.2 ACCESS CONTROL ................................................................................................................................11
1.4.3 MAN TRAPS .......................................................................................................................................12
1.4.4 KEY CONTROL .....................................................................................................................................12
1.4.5 ALARM SYSTEM...................................................................................................................................12
1.4.6 CLOSED CIRCUIT TELEVISION SYSTEM......................................................................................................12
1.4.7 BACKGROUND CHECKS .........................................................................................................................12
1.4.8 HOSTING FACILITY SECURITY PERSONNEL ................................................................................................13
1.5 NETWORK SECURITY.....................................................................................................................13
1.5.1 REDUNDANT COMPONENTS ..................................................................................................................13
1.5.2 PRIVATE VIRTUAL LANS .......................................................................................................................13
1.5.3 FIREWALL...........................................................................................................................................13
1.5.4 24/7 MONITORING.............................................................................................................................14
1.5.5 ENTERPRISE SIEM ...............................................................................................................................14
1.5.6 NETWORK PEN TESTING .......................................................................................................................14
1.6 DATA MANAGEMENT ...................................................................................................................14
1.6.1 DATA BACKUPS AND REPLICATION..........................................................................................................14
1.6.2 DATA ARCHIVING ................................................................................................................................14
1.6.3 DATA DELETION ..................................................................................................................................15
1.6.4 DATA USAGE ......................................................................................................................................15
1.6.5 DATA SCRUBBING................................................................................................................................16
1.6.6 DATA ACCESS .....................................................................................................................................17 #2..
- 668 -
Security and Hosting Overview June 2015
P a g e 3 | 21
1.6.7 DATA LOSS PREVENTION.......................................................................................................................18
1.6.8 CUSTOMER TERMINATION ....................................................................................................................18 2 RELEASE MANAGEMENT .......................................................................................................................19
2.1 RELEASE MANAGEMENT PROCESS....................................................................................................19 3 DISASTER RECOVERY AND BUSINESS CONTINUITY PLAN .....................................................................21
3.1 DISASTER RECOVERY ....................................................................................................................21
3.2 BUSINESS CONTINUITY ..................................................................................................................21 #2..
- 669 -
Security and Hosting Overview June 2015
P a g e 4 | 21
1 Introduction
This document provides a general overview of the SAP Fieldglass security and hosting infrastructure. It is effective as of the revision date indicated below. However, as security needs continue to evolve, the specific information relating to the topics covered may be subject to change over time.
Security
The SAP Fieldglass solution was architected to be the most reliable and secure Vendor Management System available today.
SAP Fieldglass is proud to offer our customers, subject to review and acceptance by our audit partner, the following assurances:
ISO 27001 certified since 2011
SSAE 16/ISAE 3402 Type 2 SOC1 audits conducted since 2005 SSAE 16 Type 2 SOC2 audits in the Trust Services Principles for:
Security に the system is protected, both logically and physically, against unauthorized access
Availability に the system is available for operation and use as committed or agreed to
Processing Integrity に system processing is complete, accurate, timely, and authorized
Confidentiality に ｷﾐaﾗヴﾏ;デｷﾗﾐ デｴ;デ ｷゲ SWゲｷｪﾐ;デWS ;ゲ さIﾗﾐaｷSWﾐデｷ;ﾉざ ｷゲ ヮヴﾗデWIデWS ;ゲ committed or agreed
SSAE 16 Type 1 SOC2 audit in the Trust Services Principle for Privacy (Type 2 audit scheduled for Q3 2015)
Annual third party pen testing of our network and application This document provides an understanding of how SAP Fieldglass handles the following areas across its global operations:
Scope of Operations
Security Management
Application Security
Physical Security
Network Security
Data Management
Release Management
Disaster Recovery
Business Continuity
#2..
- 670 -
Security and Hosting Overview June 2015
P a g e 5 | 21
1.1 Scope of Operations
SAP Fieldglass has global operations located in the following regions:
United States
Business office
SAP Fieldglass
111 N. Canal Street
Suite 600
Chicago, IL 60606
Active and passive datacenters
Century Link
2425 Busse Road
Elk Grove Village, IL 60007
Equinix / ServerCentral
1735 Lundy Avenue
San Jose, CA 95131
APAC
Business office
SAP Fieldglass
Suite 5, 48 Lovett Street
Manly Vale
NSW 2094
Australia
European Union
Business office
SAP Fieldglass
One Valentine Place
London
SE1 8QH
United Kingdom
#2..
- 671 -
Security and Hosting Overview June 2015
P a g e 6 | 21
Active and passive datacenters
ServerCentral c/o Equinix
Laarderhoogtweg 57
1101EB Amsterdam, Netherlands
ServerCentral c/o Telehouse North
14 Coriander Avenue
London E14 2AA United Kingdom
TｴW デWヴﾏゲ さ;Iデｷ┗Wざ ;ﾐS さヮ;ゲゲｷ┗Wざ SWゲｷｪﾐ;デW ┘ｴｷIｴ ﾗa デｴW ヮヴﾗS┌Iデｷﾗﾐ ｴﾗゲデｷﾐｪ environments is being used as the primary (active) and which is being used as the backup (passive or disaster recovery). These designations are not static and SAP Fieldglass will occasionally fail over the active hosting environment to the passive hosting environment.
This practice ensures that SAP Fieldglass is capable and ready in the unlikely event a disaster occurs and we need to fail over to the passive site.
1.2 Security Management
SAP Fieldglassげ “WI┌ヴｷデ┞ TW;ﾏ ｷゲ ヴWゲヮﾗﾐゲｷHﾉW aﾗヴ ｷﾏヮﾉWﾏWﾐデｷﾐｪ ;ﾐS ﾏ;ｷﾐデ;ｷﾐｷﾐｪ デｴW security controls to ensure that SAP Fieldglass information systems are secure. SAP Fieldglass has based its security program on industry standards and best practices. For our established datacenters, these practices are audited annually by a third party with results available to customers in October.
1.2.1 Security Policies, Standards and Procedures
SAP Fieldglass maintains a comprehensive set of policies that define the information security goals and objectives. Each policy may be supported by a standard that dictates the required security requirements to ensure the uniform application of technologies and processes.
1.2.2 Risk Management
SAP Fieldglass manages risk by the identification of threats and vulnerabilities to its information systems and through a control selection process. Controls selected fall into the following categories:
Policy
Physical and Environmental Security
Organizational Security
Communications and Operations Management
Acceptable Use
Access Control
Third Party Access
Information Systems Acquisition, Development and Maintenance Asset Management
Incident Management
Personnel Security
#2..
- 672 -
Security and Hosting Overview June 2015
P a g e 7 | 21
Compliance
As an element of our ISO 27001 compliance, SAP Fieldglass conducts an enterprise-wide risk assessment. Key individuals from every department are interviewed so that risks can be identified. Risks are then evaluated and entered into a risk treatment plan. This plan is managed by the Security team with oversight by the Security Steering Committee. The Security Steering Committee meets on a quarterly basis.
1.2.3 Assessments
SAP Fieldglass periodically assesses the security controls to review the effectiveness of each control in addressing risk. If SAP Fieldglassげ ;ゲゲWゲゲﾏWﾐデ ゲ┌ｪｪWゲデゲ ; ﾐWWS aﾗヴ Iｴ;ﾐｪWゲ, the baseline standard may be changed to include additional controls.
Internal Audit
SAP Fieldglass conducts quarterly internal audits for critical controls. Evidence is reviewed by our Sr. Compliance Analyst and a formal assessment report is prepared. Failed controls are made visible by this process so they can be remediated. Executive sign off on the internal audit reports is required.
External Audit
SAP Fieldglass also contracts with third parties on an annual basis to perform formal security audits on the following:
ISO 27001 surveillance audit
SSAE 16/ISAE 3402 Type 2 SOC1 audit
SSAE 16 Type 2 SOC2 audits in the Trust Services Principles for:
Security
Availability
Processing Integrity
Confidentiality
SSAE 16 Type 1 SOC2 audit in the Trust Services Principle for Privacy (Type 2 audit scheduled for Q3 2015)
Network penetration test
Application penetration test
These assessments allow SAP Fieldglass to maintain an appropriate security posture in order to protect the company and its systems, as well as its customersげ S;デ;.
We are currently working with our third party audit partner in bringing our EU datacenters into scope for our 2015 ISO 27001 audit and SSAE 16/ISAE 3402 Type 2 SOC1 and SOC2 examinations.
#2..
- 673 -
Security and Hosting Overview June 2015
P a g e 8 | 21
1.3 Application Security
Our application provides application-level security through a combination of encryption, page-level access checking, document envelopes, and activity logging. Application security is handled through a combination of programming checks, application server configuration, and database server configuration. SAP Fieldglass uses 128-bit SSL (HTTPS) encryption for all data transmissions over the public Internet, including data shared between the product and end users and data shared between the product and back-end systems.
Passwords are encrypted using a one-way hash with salt based on the SHA-256 encryption algorithm. The hash value is saved within the database; not the password.
The base SAP Fieldglass application does not require data that would require breach notifications if compromised. If the customer chooses to store sensitive data, custom fields may be defined by the customer that can be encrypted with AES-256. These fields can also be optionally masked from view while entering and viewing the fields in the application.
1.3.1 Encryption
By default, the application utilizes SSL encryption for all data transmissions over the public Internet.
In addition, the SAP Fieldglass hosted application encrypts sensitive data stored on the database so that only properly authorized users (or systems) will be able to decrypt the data. Because no state information is stored on the application server, in the unlikely event of unauthorized access to the database, the sensitive data is still encrypted.
1.3.2 Database Segmentation
SAP Fieldglass is a SaaS and utilizes a multi-tenancy database. Each customer is assigned a unique company code. Every record written to the database is keyed using this company code. After a user authenticates into the system, a session ID is generated which holds vital information about the user including their company code, user role, and data visibility restrictions. The session ID is cached server side to eliminate any ability for a malicious user to modify its contents.
1.3.3 Document Envelopes
Tｴヴﾗ┌ｪｴﾗ┌デ デｴW ゲ┞ゲデWﾏが デｴWヴW ;ヴW ; ﾐ┌ﾏHWヴ ﾗa W┗Wﾐデゲ デｴ;デ ｪWﾐWヴ;デW さSﾗI┌ﾏWﾐデゲくざ TｴWゲW are digital representations of their real-world counterparts. For example, job postings, work orders, time sheets, and invoices are all represented in the system as documents.
Each document in the system has an accompanying digital envelope that stores all access to that document. For example, when a job posting is created, an envelope entry is added for creation that records the date, time, and person. When it is submitted, another entry is added recording the date, time, and person.
#2..
- 674 -
Security and Hosting Overview June 2015
P a g e 9 | 21
1.3.4 Page-Level Access Checking
The application has been designed so that every single web page checks for access rights before displaying itself. Additionally, each page performs a second check to ensure that an authorized user will only have access to those data elements and functionality that has been expressly authorized by the system administrator.
The post-authentication session ID that is generated and cached server-side is validated prior to showing each page. SAP Fieldglass stores a non-persistent cookie in the browser and compares back to the server-side session ID. If they no longer match due to malicious ;Iデｷ┗ｷデ┞が デｴW ┌ゲWヴ ｷゲ ヴWSｷヴWIデWS デﾗ ; さYﾗ┌ ;ヴW ﾐﾗデ ;┌デｴﾗヴｷ┣WSざ ヮ;ｪWく Authorization is handled through the use of user-defined User Roles. User Roles provide the customer, through its designated administrators, the flexibility to specify the type of access given to a member of that user group based on the definitions configured by the administrator. The User Role controls what areas of the application are accessible to the user group and what actions they can perform in those areas (e.g. job posting create, time sheet approve, etc.).
1.3.5 URL Encryption
SAP Fieldglass does not pass any sensitive data in its URL query strings. Parameters that are used to identify users in the system are protected by anonymizing the field variable and then encrypting the associated value using AES-256.
1.3.6 Activity Logging
As users access the system, all of their business significant activities are tracked and logged including failed login attempts, successful logins, approvals, submissions, etc. This activity log provides a full audit trail of what actions a particular user performed within the system and the timestamp as well.
1.3.7 Application Testing
Upon request, SAP Fieldglass will provide customers with a sandbox environment where system testing can occur outside of production. This is useful when testing out configuration changes, new integrations, and/or new reports prior to making the changes ﾉｷ┗W ｷﾐ デｴW I┌ゲデﾗﾏWヴげゲ ヮヴﾗS┌Iデｷﾗﾐ ｷﾐゲデ;ﾐIWく
Uヮﾗﾐ ヴWケ┌Wゲデが I┌ゲデﾗﾏWヴげゲ S;デ; I;ﾐ HW ;ﾐﾗﾐ┞ﾏｷ┣WSく SAP Fieldglass has the ability to scrub the data such that it is unrecognizable. Data element replacement is accomplished by an automated SAP Fieldglass ┌デｷﾉｷデ┞ デｴ;デ ヴWヮﾉ;IWゲ デｴW I┌ゲデﾗﾏWヴげゲ Iﾗﾏヮ;ﾐ┞ IﾗSWが ┌ゲWヴ ﾐ;ﾏWゲが business units, cost centers, and sites from a store of random variables. Any or all of these elements may be chosen for replacement.
Sensitive data that has been designated by the customer to be stored in the SAP Fieldglass application is encrypted with AES-256. The encryption and decryption keys are different between production and test environments and are different between the US and EU datacenters. These keys are stored in the corporate password vault and are accessible only by the Database Administrators and the Lead Architect. #2..
- 675 -
Security and Hosting Overview June 2015
P a g e 10 | 21
Once customer testing has been completed, the Environment Management team (a team within Professional Services) destroys the environment. The database is purged and the VM is returned into circulation.
1.3.8 Password Management
The SAP Fieldglass application provides each customer the ability to define a Password Policy. This policy contains custom-defined password rules that each user in the I┌ゲデﾗﾏWヴげゲ ｷﾐゲデ;ﾐIW ﾏ┌ゲデ adhere to. The policy provides 20 different password rules such as minimum length, user lockout preference (hard lockout vs. time-based reset), days to expiration, minimum password age, etc. Also included is the ability to specify a regex pattern(s). This pattern dictates the password value syntax that each user must follow.
When customer chooses to use a test instance ふさゲ;ﾐSHﾗ┝ざぶが ;ﾉﾉ ┌ゲWヴ ヮ;ゲゲ┘ﾗヴS ┗;ﾉ┌Wゲ remain unchanged from their production values. All passwords and visibility restrictions remain unchanged to ensure that users in the test instance are not able to gain access to S;デ; デｴW┞げヴW ﾐﾗデ ヮヴｷ┗ｷﾉWｪWS デﾗ ゲWW in production. Also, the password policy that is enforced in in the production instance is also enforced in the test instance.
New user invitations are sent via email. Recipients enter their 1-time passcode and are then forced to specify a new password that complies ┘ｷデｴ デｴW I┌ゲデﾗﾏWヴげゲ password policy rules. User invitations expire after 21-days.
1.3.9 Email Approvals
In order to better support our growing mobile workforce, SAP Fieldglass offers customers a supplementary method for approving their work items. Via email, approvers are able to submit their approval or rejection response by simply replying to the approval work item that was sent to them. This method has been proven to reduce approval cycle times by several days since the approver does not have to be in the office. This feature has been architected with the following security controls:
Only the original recipient can approve/reject the work item. If the recipient forwards the email to another person, the system will not accept the response. Email spoofing is not a risk. A unique ID is generated for each approval request. This unique ID along with the person ID of the intended recipient is stored encrypted with AES-256. So even if the email address sending the approval/rejection response is legitimate but the sender is not, the system will detect this anomaly and not accept the response.
A SAP Fieldglass approver can identify another user as their Proxy and/or Delegate when they will be out of the office and unable to handle the approval requests. By design, neither of these roles receive approval work items via email. So only the original recipient can ever submit an approval/rejection response via email. If the customer created custom fields where sensitive information is stored encrypted, those fields and associated values are not allowed to be selected for inclusion in these email approval notifications.
The system audit trail is updated with all user actions including approval/rejection activities via email. This audit trail is accessible by privileged customer users and can be used to monitor user activity.
#2..
- 676 -
Security and Hosting Overview June 2015
P a g e 11 | 21
In order to compromise the security of our email approval feature, a malicious user would ﾐWWS デﾗ ｴ;Iﾆ ｷﾐデﾗ ;ﾐﾗデｴWヴ ┌ゲWヴげゲ email account, locate the SAP Fieldglass approval request email, and then submit the approval/rejection response.
1.3.10 Application Penetration Testing
SAP Fieldglass uses a combination of manual and automated testing to ensure the application is secure. Various automated commercial tools are used prior to each major release of the SAP Fieldglass system (three times per year).
On an annual basis, SAP Fieldglass engages a 3rd party security company to conduct pen testing services against our application. This is in addition to SAP Fieldglassげ ﾗ┘ﾐ ｷﾐデWヴﾐ;ﾉ penetration testing efforts.
SAP Fieldglass has several test environments available for customers to conduct their own application penetration testing if requested.
1.4 Physical Security
The SAP Fieldglass data center provides physical security through its secure hosted facilities. The application is hosted within a secure unmarked cage. SAP Fieldglass manages everything from the cage in. Meaning, SAP Fieldglass manages all servers, devices, and software in the cage. The hosting provider provides physical security, internet connectivity, and HVAC.
1.4.1 Internet Data Center Construction
Exterior perimeter walls, doors and windows are constructed of materials that afford UL Standard #752, Level V Ballistic Protection.
1.4.2 Access Control
The data center uses an Access Control System (ACS), which supports a networked card reader and alarm system. The ACS uses proximity card readers to control access into perimeter doors, shipping/receiving areas, storerooms and other areas. Biometric hand scanners are installed to control access into the network control center, telecommunications node room and customer vaults. Additional access control measures include:
Designated with signage as controlled access areas
Areas within the internet data center are designated as restricted Access into the internet data center and restricted areas is controlled by biometric hand scanners, and is limited to authorized personnel Card access badges or contractor/visitor badges are required to gain entry All employees, customers, vendors, contractors and visitors must be sponsored by a facilities pre-approved sponsor to gain access Visitors are escorted at all times within the controlled access area perimeter #2..
- 677 -
Security and Hosting Overview June 2015
P a g e 12 | 21
1.4.3 Man Traps
The system includes the following key features:
Anti-passback
Integrated metal & explosive detection
Video monitored / recorded
Two-way intercom audio to Security Control Room
Level V ballistic protection
Weight sensors limit entry to one person at a time (no tailgating) ADA compliant
Intrusion / tampering alarm monitoring by Security Control Room Integrated card access & biometric access control systems limits access to persons verified by hand geometry
All systems are supported by redundant power management system (generators).
1.4.4 Key Control
Facilities security staff is the custodian of all security and cage keys. These keys are maintained and tracked through a comprehensive issue, retrieval, audit, and storage process. The listing of all customers, customer employees and cage assignments is updated in real-time maintained to ensure that cage access is restricted to authorized personnel.
1.4.5 Alarm System
The ACS is used to monitor and log security alarms. The ACS monitors all:
Perimeter doors
Restricted Area doors
Shipping / receiving doors
1.4.6 Closed Circuit Television System
Facilities employ an extensive closed circuit television system to monitor the exterior and interior of the internet data center. Exterior cameras provide views of critical support equipment and perimeter doors. Interior cameras are positioned to monitor all internet data center aisle ways, requests for entry and entry into the internet data center, shipping / receiving areas, high-security vaults and the internet data center lobby. All cameras are recorded on digital video recorders 24 x 7.
1.4.7 Background Checks
SAP Fieldglass requires background checks be performed at the time of hiring on all personnel. These background checks are performed by a nationally recognized third party company. SAP Fieldglass initiates the background check request for all potential employees and independent consultants. If the independent contractor is placed through #2..
- 678 -
Security and Hosting Overview June 2015
P a g e 13 | 21
an agency, the agency will conduct a background check and confirm with Human Resources whether the results were completed with/without discrepancies. If the independent contractor is placed directly, SAP Fieldglass will conduct the background check.
Background checks include the following:
Social Security Trace
Statewide & National Criminal Report (7 years)
Sex Offender Registry & Terrorist Watch
Compliance Authorities Database Checks に Global (OFAC level verification) Education verification
Employment verification (7 years)
Global Sanctions & Prohibited Parties
Credit (only for specific finance roles)
1.4.8 Hosting Facility Security Personnel
The security office duties include:
Response to calls for assistance
Security facility inspections
Fire and safety patrols
Shipping / receiving security
Physical security audits and assessments
1.5 Network Security
The SAP Fieldglass network infrastructure includes redundant components, firewalls, and 24/7 monitoring.
1.5.1 Redundant Components
Most network components are internally redundant. For example, routers have redundant power supplies; servers have redundant drives, power supplies, and NIC cards.
Additionally, all network components are redundant to provide redundancy and security in the event of a component failure.
1.5.2 Private Virtual LANs
The application network architecture has been designed with multiple private virtual LANs using redundant Cisco routers. Every major network layer is placed on its own virtual LAN with rules about which protocols and ports are accessible.
1.5.3 Firewall
SAP Fieldglass has implemented dual-vendor redundant firewalls between the public internet and the SAP Fieldglass private network, as well as between each virtual LAN. This #2..
- 679 -
Security and Hosting Overview June 2015
P a g e 14 | 21
firewall has been configured to enforce protocols and ports that are able to cross LANs with a default deny stance.
1.5.4 24/7 Monitoring
SAP Fieldglass provides 24/7 monitoring of suspicious activity. Any failure is promptly reported and, after an initial analysis, escalated to the next appropriate level.
1.5.5 Enterprise SIEM
Our security incident and event management (SIEM) tool has been configured to collect logs and events from all systems and devices within the SAP Fieldglass network.
Forwarders are used to collect, filter, normalize and forward relevant data to an Indexer.
Each installation listens for Syslog data and actively pulls WMI information from its respective environment. Security related issues are monitored and alerted on where required.
1.5.6 Network Pen Testing
On an annual basis, SAP Fieldglass engages a 3rd party security company to conduct pen testing services on our network.
1.6 Data Management
1.6.1 Data Backups and Replication
SAP Fieldglass has a highly available backup solution that guarantees data can be restored as expediently as possible. Our solution performs a continuous replication of data to our passive production hosting facility. SAP Fieldglass takes incremental SQL backups every 15 minutes and full backups on a nightly basis. Backups are transferred to the passive production hosting environment over a secure channel. SAP Fieldglassげ ゲﾗﾉ┌デｷﾗﾐ ﾗaaWヴゲ continuous protection of customer data geographically without imposing performance degradation or scaling limitations. Data is encrypted both at rest and in transit with AES256.
Data backups and replication are performed between the active and passive production environments. The US-based active production environment replicates data to the USbased passive environment. Likewise, The EU-based active production environment replicates data to the EU-based passive environment.
Also refer to section 3.1 Disaster Recovery.
1.6.2 Data Archiving
Data is archived throughout the year. Eligible transactional and reporting data are moved from the active database to an archive database after 24 months. Archived data can be accessed only by customer users with a user role of Administrator. Archive data is accessed using the same login screen and user interface that is used to access current data. Reports can also be generated using archive data from the standard interface. #2..
- 680 -
Security and Hosting Overview June 2015
P a g e 15 | 21
The criteria for archiving data are as follows:
Data remains in the active database for 24 months, at which point eligible data is moved to the archive database.
Data remains in the active report database for 24 months, at which point eligible data is moved to the archive report database.
AヴIｴｷ┗ｷﾐｪ HWｪｷﾐゲ ┘ｷデｴ デｴW ┘ﾗヴﾆWヴく WｴWﾐ ; ┘ﾗヴﾆWヴげゲ WﾐS S;デW ｷゲ ﾏﾗヴW デｴ;ﾐ ヲヴ ﾏﾗﾐデｴゲ ﾗﾉSが デｴW ┘ﾗヴﾆWヴ ;ﾐS ;ﾉﾉ ;ゲゲﾗIｷ;デWS S;デ; ｷﾐIﾉ┌Sｷﾐｪ デｴW ┘ﾗヴﾆWヴげゲ ┘ﾗヴﾆ orders, job seeker record, job posting, time sheets, expense sheets, and payment-related items such as invoices are archived.
The archive process is run as a batch job on a weekly basis to move data from the active databases to the archive databases.
Data cannot be moved back from the archive database to the active database.
SAP Fieldglass does not delete data from its archive databases and has data older than 7 years. In the future, if SAP Fieldglass decides to delete archived data, we will ensure that a minimum 7 years of data is retained.
1.6.3 Data Deletion
Data deletion occurs only when required by a customer. SAP Fieldglassげ S;デ; SWﾉWデｷﾗﾐ capabilities allow customers to remain compliant with data privacy, data protection, and other related data directives.
DWﾉWデｷﾗﾐ ﾉﾗｪｷI ｷゲ H;ゲWS ゲﾗﾉWﾉ┞ ﾗﾐ ; I┌ゲデﾗﾏWヴげゲ business requirements. A custom script is developed by SAP Fieldglass.
Results are verified in a non-production environment by both SAP Fieldglass and the customer prior to executing in production.
A さPreservationざ aﾉ;ｪ ｷゲ ;┗;ｷﾉ;HﾉW aﾗヴ ┌ゲWく C┌ゲデﾗﾏWヴs can set this flag on any data to override logic that would otherwise delete the data. This is useful during times when litigation or eDiscovery efforts are in progress and certain data must be preserved.
Script execution frequency is determined by the customer.
SAP Fieldglass is contractually obligated to retain at least 7 years of data for customers.
1.6.4 Data Usage
Customer data is required in non-production environments for various reasons:
Second level help desk support for customer defect investigation and resolution.
Supporting customer requests for updating data, whether it be for desired changes or corrections for data modified by the customer in error. Customer sandboxes に these are non-production environments configured ﾗﾐﾉ┞ ┘ｷデｴ デｴW I┌ゲデﾗﾏWヴげゲ S;デ; ふI┌ゲデﾗﾏWヴげゲ S;デ; ｷゲ さゲﾉｷIWSざ ﾗ┌デ aヴﾗﾏ デｴW ﾏ┌ﾉデｷtenancy production database). These sandboxes are required for many #2..
- 681 -
Security and Hosting Overview June 2015
P a g e 16 | 21
reasons, including testing of new or changed integration connectors, reports, and/or application configuration changes such as revised approval workflows. New application features can also be turned on and reviewed in the sandbox before turning on in the live production instance. Any data deletion scripts that are developed between the customer and SAP Fieldglass must be tested in a non-production environment prior to executing in production.
Customer Preview testing に this is an opportunity for customers to gain early access to a future upgrade of the SAP Fieldglass application. This allows customers to gain confidence that the system is working as expected prior to the release date. Customer participation is optional.
SAP Fieldglass regression testing に the SAP Fieldglass application is offered in a Software as a Service (SaaS) model. One of the services we provide is testing ﾗa デｴW ;ヮヮﾉｷI;デｷﾗﾐ ヮヴｷﾗヴ デﾗ W;Iｴ ヮヴﾗS┌Iデｷﾗﾐ ヴWﾉW;ゲWく Tﾗ Wﾐゲ┌ヴW ; I┌ゲデﾗﾏWヴげゲ configuration, integrations, and reports are working as expected with the new codebase, SAP Fieldglass Quality Assurance uses a scrubbed production copy of the database in our regression testing. Regression testing is where we execute test cases against the current production codebase and the future codebase using a common data input. Output files from each test are compared to ensure any changes are expected.
Customers may opt out of this process. However, all responsibility in ensuring the I┌ゲデﾗﾏWヴげゲ SAP Fieldglass instance is properly working and maintained is transferred to the customer.
To date, all SAP Fieldglass customers have declined to assume this responsibility.
1.6.5 Data Scrubbing
In order to properly service our customers, access to production data is required. All customer data is classified as Confidential. SAP Fieldglass takes every possible precaution to ensure data is protected from unauthorized access and misuse.
Data is protected in the following ways:
First names and last names of buyers, suppliers, and workers are anonymized by replacing with a test value.
Email addresses of buyers, suppliers, and workers are changed to a single false email address such as qatest8@SAP Fieldglass.com which is configured to automatically purge all email sent to it.
Buyer and supplier company names are anonymized.
Any custom fields created by the customer remain unchanged. Custom fields that contain sensitive data are encrypted with AES-256 and optionally display masked when entering and displaying values in the user interface. There is no way to decrypt these values since the decryption keys between production and test are different. Keys are stored in the corporate password vault and #2..
- 682 -
Security and Hosting Overview June 2015
P a g e 17 | 21
access is limited to only select senior members of the technology team. This access list is reviewed quarterly by the internal audit team and by a third party in our annual SSAE 16 / ISAE 3402 Type 2 SOC1 and SOC2 audits.
The data scrubbing process is:
A backup of the data is taken at the location where the source database resides
Data is filtered where only the most recent 3 months of data remain Data is scrubbed as described above
Data is then securely transferred from the production system to the test system
Once scrubbed, all personally identifiable information (PII) has been removed and any sensitive custom field data cannot be read.
Our test systems reside in secure third party data centers with the same controls as our production data centers.
1.6.6 Data Access
Direct access to production data is required in specific cases. Access is provided based on business need and not by role alone. Access reviews are conducted monthly and reviews are subject to recurring quarterly reviews by the SAP Fieldglass internal audit team.
Executive review and sign off is performed for all quarterly reviews.
Access is required for the following puposes:
Professional Services Data Services team に this team receives ; I┌ゲデﾗﾏWヴげゲ master and/or worker data and executes data uploads into test and/or production environments. Once the data are successfully uploaded and customer has signed off on the accuracy and completeness of the upload, the data are destroyed.
First level help desk に when customers call our help desk, the caller may require the help desk agent to to view data or log in as the caller in order to help them with their problem. This is only performed when authorized by the caller.
SAP Fieldglass has help desk locations in the following regions:
United States
SAP Fieldglass
111 N. Canal Street
Suite 600
Chicago, IL 60606
#2..
- 683 -
Security and Hosting Overview June 2015
P a g e 18 | 21
Europe and APAC
Merlin-IT Hungary Information
Technology Services
Kft. Vagohid u. 2., 4034
Debrecen, Hungary
Merlin Information Systems Philippines Inc.
6th Floor C
ommerce and Industry Plaza Building,
McKinley Hill Cyberpark,
Taguig City, Philippines
The SAP Fieldglass Security team conducted an onsite security audit in 2014 at Merlin Hungary. Contractually, Merlin must meet SAP Fieldglassげ ゲWI┌ヴｷデ┞ ヴWケ┌ｷヴWﾏWﾐデゲく TｴW following security controls are in place:
Help desk agents are not able to cut/paste using their secured workstation.
External media including any USB drive is disabled.
Printing is not supported.
Help desk agents have been background checked by Merlin using SAP Fieldglassげ H;Iﾆｪヴﾗ┌ﾐS IｴWIﾆ ヴWケ┌ｷヴWﾏWﾐデゲ (see section 1.4.7 Background Checks).
1.6.7 Data Loss Prevention
Our DLP solution has been installed and configured for use on devices subject to exposure to sensitive information. It has been implemented to guard data at its endpoints and to ensure leakage of information classified as Confidential does not occur. Policies can be pushed from the central management console or pulled from an individual endpoint client. Client installs are configured to update (pull) policy changes every 90 minutes.
Our enterprise SIEM tool is configured to pull data in real time from the DLP database.
Dashboards are created to allow quick overviews of agent statuses/details, alert details, and logging details.
The SIEM is configured to notify the Security Team in real time when an alert is detected.
The Analyst then logs into the SIEM and investigates the alert to determine whether itげゲ legitimate or a false positive.
1.6.8 Customer Termination
If a customer were to terminate their contract with SAP Fieldglass, デｴW I┌ゲデﾗﾏWヴげゲ S;デ; could be sliced out of the production database and delivered to the customer on a media of their choice. The size of the data will determine what media is appropriate. #2..
- 684 -
Security and Hosting Overview June 2015
P a g e 19 | 21
2 Release Management
2.1 Release Management Process
The SAP Fieldglass Release Management team is responsible for the management of all delivables required in upgrading the production SAP Fieldglass system. This team is comprised of key members from the Development, Quality Assurance, Product Management, Professional Services, and executive teams. SAP Fieldglass customers benefit from our release management in that the release deployment schedule repeats itself year over year; releases are deployed over the same weekends of predetermined months.
SAP Fieldglass has several different release types:
Major Releases
In the US, Major releases occur on the second Fridays in March, July, and November. In the EU, Major releases occur on the third Fridays in March, July, and November These releases can include new product features, new or changed functionality, user experience enhacements, and changes to the user interface. These are our most formal releases and the only type of release that requires an extended maintenance window.
The Release Manager and the Release Management team closely monitor all phases of the Software Development Lifecycle and analyze PKIs at each phase transition. Release notes are provided as well as an opportunity for customers to optionally participate in a customer preview opportunity. This is where users can log into a non-production environment that is running the future codebase. The benefit of participating is that customers can gain confidence the system is behaving as expected prior to the official release date.
Minor Releases
Minor releases occur on the second Fridays in January, May and September.
These releases do not require the formalities of major releases. This type of release is used when deploying customer-specific product features and integrations to production.
These releases are deployed to both US and EU customers at the same time.
Service Packs
Serivce packs are deployed as required to resolve product defects. These releases are deployed to both US and EU customers at the same time.
#2..
- 685 -
Security and Hosting Overview June 2015
P a g e 20 | 21
All releases are deployed to production by a central deployment team located in the US.
During the deployment process, the codebase is replaced with the new codebase and data transformation scripts are executed. During this process, customer data is not viewed or accessed. Upon completion of the deploy, the Quality Assurance team executes a post-deploy verification checklist to ensure the system is ready for general availability.
One such verification is verifying an MD5 hash to ensure the certified codebase was installed in production without modification. Test companies are used in conducting all testing.
#2..
- 686 -
Security and Hosting Overview June 2015
P a g e 21 | 21
3 Disaster Recovery and Business Continuity Plan
3.1 Disaster Recovery
SAP Fieldglass maintains a disaster recovery plan with backup, hardware repair, and data restoration, along with the ability to bring up the SAP Fieldglass application at a hot backup site in the event of a declared disaster (as described in the SAP Fieldglass disaster recovery plan) where the primary site is destroyed or disabled. This plan is tested on a yearly basis. Lessons learned are recorded in the test results and the plan is adjusted and improved accordingly.
SAP Fieldglass has the concept of active and passive production hosting facilities. The active environment is the live production hosted facility that all SAP Fieldglass users are actively using. The passive environment is a hot production hosting environment. Our data replication solution ensures that the passive environment is ready at anytime to be failed over to. In a disaster scenario, SAP Fieldglass changes the DNS to the passive hosting IWﾐデWヴげゲ ゲWデ ﾗa IPゲく UゲWヴゲ ;ヴW デｴWﾐ ゲW;ﾏﾉWゲゲﾉ┞ ヴﾗ┌デWS デﾗ デｴW ﾗデｴWヴ S;デ;IWﾐデWヴく Tｴere is not multi-day data migration that has to occur due to the ongoing data replication that is in place.
SAP Fieldglass proactively conducted a datacenter failover from the active datacenter to the passive datacenter in April 2015. The entire failover process was conducted in just over 8 hours with zero data loss. SAP Fieldglass plans to repeat this proactive datacenter failover between 1 and 3 times per year.
Also refer to section 1.6.1 Data Backups and Replication.
3.2 Business Continuity
The primary objective of our business continuity plan (BCP) is to enable SAP Fieldglass to recover all functions within their respective Recovery Time Objectives (RTOs) after any type of disruption occurs which prevents SAP Fieldglass personnel from engaging in ongoing business operations. A Recovery Point Objective (RPOs) has also been defined to identify our tolerance for any data loss. This Plan is designed to support the employees responsible for leading recovery efforts to enable SAP Fieldglass to resume daily operations following a disruption.
A business impact analysis (BIA) has been developed to fully quantify and prioritize restoration of mission-critical processes.
#2..
- 687 -
Privacy Policies and Procedures
Revision History
Virtru’s Privacy Policies and Procedures were adopted as of [Date].
Name
Virtru’s Privacy Policies and Procedures were revised as of [Date].
Name
Virtru’s Privacy Policies and Procedures were revised as of [Date].
Name
Virtru’s Privacy Policies and Procedures were revised as of [Date].
Name
Virtru’s Privacy Policies and Procedures were revised as of [Date].
Name
Virtru’s Privacy Policies and Procedures were revised as of [Date].
Name
Rev.2015.8.6
#2..
- 688 -
Table of Contents
Revision History
Company
Document Control
Security Document Library
Management and Protection of Personally‐Identifiable Information Overview:
Purpose:
Applicability:
Definitions:
Policy:
Enforcement:
Administrative Requirements for HIPAA Implementation
Overview:
Purpose:
Applicability:
Policy:
Documentation Requirements:
Enforcement:
Minimum Necessary Standard
Overview:
Purpose:
Applicability:
Policy:
Procedures:
Enforcement:
Business Associate Agreements
Overview:
Purpose:
Applicability:
Policy:
Enforcement:
Business Associate Subcontractor Agreements
Overview:
Purpose:
Applicability:
Policy:
Enforcement:
Receipt, Use and Disclosure of Personally‐Identifiable Information Overview:
Purpose:
Applicability:
Special Definition:
Policy:
Procedures:
Enforcement:
Complaint Process
Rev.2015.8.25
2 #2..
- 689 -
Overview:
Purpose:
Applicability:
Policy:
Procedures:
Enforcement:
Scanner and Fax Policy
Overview:
Purpose:
Applicability:
Special Definitions
Corporate Policies:
Procedure:
Enforcement:
Scanner Policy
Overview:
Purpose:
Applicability:
Special Definitions
Corporate Policies:
Procedure:
Enforcement:
Training Policy
Overview:
Purpose:
Applicability:
Policy:
Enforcement:
Rev.2015.8.25
3 #2..
- 690 -
I. Company
Virtru may be referred to as “Company.”
A. Document Control
A staff copy of this document is available with the Virtru Privacy Officer, Will Ackerly, [email protected] or (202) 577‐3683.
B. Security Document Library
These policies and procedures and related privacy and security practice information will be kept in our Security Documentation Library (SDL). The Library is located in Google Drive and backed up to a local NAS.
Outdated and superseded materials from the Security Documentation Library (or Notebook) will be kept in an archive (the Security Documentation Archive) for at six (6) years after the date when they are first outdated or superseded.
II. Management and Protection of PersonallyIdentifiable Information A. Overview
The Privacy Rules place certain restrictions on the acquisition, use and disclosure of Personally‐Identifiable Information (PII). These policies establish the minimum care with which PII in the custody of Virtru personnel must be maintained.
B. Purpose
The purpose of this document is to provide basic instruction to all Virtru employees regarding the management and protection of Personally‐Identifiable Information.
C. Applicability
This policy applies to all Virtru employees, which are defined for the purposes of this document to be employees of all current and future subsidiaries of Virtru.
D. Definitions
Covered Entity means a health plan, a health care clearinghouse, or a health care provider that transmits any health information in electronic form relating to any covered transaction.
PersonallyIdentifiable Information (PII) means any information about an individual maintained by Virtru, including:
1. Any information that can be used to distinguish or trace an individual‘s identity, such as name, social security number, date and place of birth, mother‘s maiden name, or biometric records; and
Rev.2015.8.25
4 #2..
- 691 -
2. Any other information that is linked or linkable to an individual, such as medical, educational, financial, and employment information
Treatment, Payment and Health Care Operations (TPO) include all the following:
1. Treatment means the provision, coordination, or management of health care and related services, consultation between providers relating to an individual, or referral of an individual to another provider for health care.
2. Payment means activities undertaken to obtain or provide reimbursement for health care, including determinations of eligibility or coverage, billing, collections activities, medical necessity determinations and utilization review.
3. Health Care Operations includes functions such as quality assessment and improvement activities, reviewing competence or qualifications of healthcare professionals, conducting or arranging for medical review, legal services and auditing functions, business planning and development, and general business and administrative activities including the creation of de‐identified health information as defined by these regulations.
Disclosure means the release, transfer, provision of access to, or divulging in any other manner of information outside the entity holding the information.
Use means, with respect to individually identifiable health information, the sharing, employment, application, utilization, examination, or analysis of such information within an entity that maintains such information.
Personal Representative means a person who has authority under applicable law to make decisions related to health care on behalf of an adult or an emancipated minor, or the parent, guardian, or other person who is authorized under law to make health care decisions on behalf of an un‐emancipated minor.
Employees means all employees of Virtru as well as its temporary employees, interns, independent contractors, trainees, and other persons in the performance of work for the Company, its offices, programs or facilities.
Privacy Rules means the rules adopted by various state and federal agencies to implement the requirements of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and regulations promulgated under this Act as well as those obligations that arise under the privacy and security standards adopted by the Health Insurance Marketplaces, pursuant to 45 C.F.R. §155.260.
E. Policy
For details on specific requirements, refer to the appropriate policies in this manual as indicated in [brackets].
Rev.2015.8.25
5 #2..
- 692 -
1. Generally: Personally‐Identifiable Information shall not be obtained, used or disclosed except as permitted or required by law.
2. Permitted and Required Uses and Disclosures: Personally‐Identifiable Information may or shall be disclosed as follows:
a) To the individual
b) To carry out TPO activities as allowed under HIPAA and/or pursuant to and in compliance with a current and valid Authorization [Receipt, Use and Disclosure of PersonallyIdentifiable Information].
c) In keeping with a Business Associate Agreement [Business Associate Agreement].
d) As otherwise allowed or required under the HIPAA Rules or other federal and/or state laws concerning privacy of information that is used by Virtru in the course of its business operations.
3. Minimum Necessary: Generally, when obtaining, using or disclosing Personally‐Identifiable Information, or when requesting PII from another entity, reasonable efforts must be made to limit the PII used or disclosed to the minimum necessary to accomplish the intended purpose. However, the Privacy rules were not intended to severely complicate business processes and Virtru may, where appropriate, use a single format to provide data containing PII for our various services [Minimum Necessary Standard].
4. De‐identified Personally‐Identifiable Information: PII may be considered not to be individually identifiable in the following circumstances:
a) The following identifiers of the individual (and relatives, employers or household members) are removed. (This is the “Safe Harbor” method that Virtru will generally use.)
Names
Information relating to the individual's geographic subdivision if it contains fewer than 20,000 people
Elements of dates (except year) directly related to the individual All ages and elements of dates that indicate age for individuals over 89, unless aggregated into a single category of age 90 and older Telephone numbers
Fax numbers
Rev.2015.8.25
6 #2..
- 693 -
Email addresses
Social Security Numbers
Medical record numbers
Health plan beneficiary numbers
Account numbers
Certificate or license numbers
Vehicle identifiers and serial numbers, including license plate numbers Device identifiers and serial numbers
Web Universal Resource Locators (URLs)
Internet Protocol (IP) address numbers
Biometric identifiers; full face photographic images
Any other unique identifying number, characteristic or code. b) As allowed in the Privacy Rules, Virtru shall provide a number of longitudinal identifiers in the de‐identified data. These identifiers shall not allow identification of the individual who is the subject of this data in that:
1) These identifiers will be encrypted using industry level encryption techniques
2) The method of encryption shall not be divulged to the receiver of the de‐identified data
5. Complaint Process: Virtru has put into place a process for individuals to make complaints about our Privacy Policies and Procedures and/or our compliance with those Policies and Procedures.
6. Documentation: Virtru must maintain written or electronic copies of all policies and procedures, communications, actions, activities or designations as are required to be documented under this manual for a period of six (6) years from the later of the date of creation or the last effective date.
F. Enforcement
An employee found to have violated this policy shall be subject to disciplinary action, up to and including termination of employment. In the case where inappropriate access or use or disclosure of Personally‐Identifiable Information was or may have been involved, such individuals may additionally be reported to the appropriate enforcement agencies. [Sanction Policy]
Rev.2015.8.25
7 #2..
- 694 -
III. Administrative Requirements for HIPAA Implementation A. Overview
The Privacy Rules require that a Business Associate have in place appropriate administrative safeguards to protect the privacy of Personally‐Identifiable Information.
B. Purpose
To provide instructions regarding Virtru's obligations relating to the implementation of administrative requirements of the Privacy Rules.
C. Applicability
This policy applies to all Virtru employees, which is defined for the purposes of this document to be employees of all current and future subsidiaries of Virtru.
D. Policy
1. Personnel Designations: Virtru has designated and documented designations of the following:
a. Will Ackerly has been designated as the Privacy Officer. 1) He is responsible for the development and implementation of corporate‐wide policies and procedures relating to the safeguarding of Personally‐Identifiable Information.
2) He will also be responsible for receiving complaints relating to Personally‐Identifiable Information and for providing information about the Company's privacy practices.
b. Persons with access to Personally‐Identifiable Information are listed by title and department including a listing of individuals’ names on the Risk Assessment; and will be updated if Virtru makes any major changes to processes, staff, programming or company location; or at a minimum annually. Virtru will retain the previous listing for a period of not less than six (6) years.
2. Training Requirements: Virtru shall document the following training actions:
All Virtru employees shall receive training on applicable policies and procedures relating to Personally‐Identifiable Information as necessary and appropriate for such persons to carry out their functions within the Company. a. Each new employee shall receive the training as described above within 30 days after joining Virtru.
Rev.2015.8.25
8 #2..
- 695 -
b. Each employee whose functions are impacted by a material change in the policies and procedures relating to Personally‐Identifiable Information, or by a change in position or job description, shall receive the training as described above within 30 days after the change becomes effective. c. Complaints handled by Committee...
3. Safeguards: Virtru shall have in place appropriate Administrative, Technical, and Physical Safeguards to reasonably safeguard Personally‐Identifiable Information from intentional or unintentional unauthorized receipt, use or disclosure.
4. Complaint process: Virtru shall have in place a process for individuals to make complaints about the Company's HIPAA Policies and Procedures and/or Virtru's compliance with those Policies and Procedures, and shall document all complaints received and the disposition of each complaint. (See Complaint Process)
5. Sanctions: Our Privacy Policies call for our workforce that has access to Personally‐Identifiable Information to perform certain duties and to refrain from certain actions. Failure to do so will be sanctioned according to the policy below.
These sanctions apply to the designated workforce members including managers, supervisors, and staff who have access to Personally‐Identifiable Information.
It is intended as guidance for our business management in sanctioning information security policy infractions. We reserve the right to implement sanctions differently if, in our judgment, the situation warrants it.
We define a serious infraction as one that results in known significant damage or that threatens imminent significant damage. Other infractions are simple infractions.
First security infraction
If the infraction is:
a. A simple infraction, and
b. The first infraction in the last 3 years
The sanction will be retraining the workforce member on the appropriate policy/procedure and placement of a written letter of reprimand in the employee file. The letter will notify the person of the nature of this infraction and of sanctions for future potential infractions.
Second security infraction or first serious infraction
If the infraction is:
a. A serious infraction, or
Rev.2015.8.25
9 #2..
- 696 -
b. The second infraction of either type within 3 years
The sanction will include a written letter of reprimand that is given to the person at fault, placement of a copy of the letter in the employee file, and one week’s suspension without pay. The letter will notify the person of the nature of this infraction and of sanctions for future potential infractions.
Third security infraction or second serious infraction
If the infraction is:
a. A second serious infraction within 3 years, or
b. A third infraction of any type within 3 years.
The sanction will be dismissal from the workforce.
Virtru makes exceptions for disclosures made by employees who qualify as whistleblowers or certain crime victims.
6. Mitigation efforts required: Virtru, to the extent practicable, shall mitigate any harmful effects of unauthorized uses or disclosures of Personally‐Identifiable Information by the Company or any of its Business Associate Subcontractors.
7. Prohibition on intimidating or retaliatory acts: Neither Virtru nor any employee shall intimidate, threaten, coerce, discriminate against, or take other retaliatory action against any individual for the exercise of their rights or participation in any process relating to HIPAA compliance, or against any person for filing a complaint with the Secretary of the U.S. Department of Health and Human Services, participating in an investigation, compliance review, proceeding or hearing, or engaging in reasonable opposition to any act or practice that the person in good faith believes to be unlawful under the Privacy Rules as long as the action does not involve disclosure of Personally‐Identifiable Information in violation of the regulations.
Virtru shall document the following actions relating to its policies and procedures:
a. Required policies and procedures: Virtru shall implement policies and procedures to assure appropriate safeguarding of
Personally‐Identifiable Information in its operations.
b. Changes to policies and procedures: Virtru shall change its policies and procedures as necessary and appropriate to conform to changes in law or regulation. Virtru may also make changes to policies and procedures at other times as long as the policies and procedures are still in compliance with applicable law. Where necessary, Virtru shall make correlative changes in its Privacy Notice.
Rev.2015.8.25
10 #2..
- 697 -
E. Documentation Requirements
Virtru must maintain the required policies and procedures in written or electronic form, and must maintain written or electronic copies of all communications, actions, activities or designations as are required to be documented hereunder, or otherwise under the Privacy Rules, for a period of six (6) years from the later of the date of creation or the last effective date.
F. Enforcement
Any employee found to have violated this policy shall be subject to disciplinary action, up to and including termination of employment. In the case where inappropriate access, use or disclosure of Personally‐Identifiable Information was or may have been involved, such individuals may additionally be reported to the appropriate enforcement agencies.
IV. Minimum Necessary Standard
A. Overview
The Privacy Rules place certain restrictions on the receipt, use and disclosure of Personally‐Identifiable Information in regards to the amount reasonably necessary to accomplish the task being performed. However, the Privacy Rules also allow Personally‐Identifiable Information to be disclosed for business appropriate needs.
The policies developed by Virtru will follow this business appropriate philosophy as well as that of administrative simplification, which is the subsection of the HIPAA law under which the Privacy Rule was developed. Virtru shall use standard data formats for information acquisition or disclosure and tailor these formats to contain a business reasonable minimum necessary amount of Personally‐Identifiable Information. The Company’s policies establish the minimum necessary use provisions for Personally‐Identifiable Information in the custody of Virtru employees.
B. Purpose
To issue instructions regarding Virtru’s obligations relating to the Privacy Rules to obtain, use and disclose only the minimum amount of Personally‐Identifiable Information (PHI) necessary to accomplish the intended purpose.
C. Applicability
This policy applies to all Virtru employees, which is defined for the purposes of this document to be employees of all current and future subsidiaries of the Company.
D. Policy
Virtru will make reasonable efforts to ensure that the Minimum Necessary amount of Personally‐Identifiable Information is disclosed, used, or requested to accomplish the intended purpose. Exceptions to the Minimum Necessary Standard include disclosures:
1. To the individual who is the subject of the information; Rev.2015.8.25
11 #2..
- 698 -
2. Made pursuant to an authorization provided by the individual;
3. To healthcare providers for treatment purposes;
4. Required for compliance with the standardized HIPAA transactions;
5. Made to the Secretary of HHS or his agent pursuant to a privacy investigation;
6. Otherwise required by the Privacy Rules or other law.
Employees shall be trained on the policies and procedures developed to apply these principles to the use or disclosure of, or requests for Personally‐Identifiable Information.
E. Procedures
The following procedures will be implemented to ensure that this policy is enforced effectively across all parts of Virtru.
1. Each user of a system which accesses Personally‐Identifiable Information shall be identified and the classes or types of PII to which access is needed and any conditions appropriate to such access will be established. It will be the responsibility of the Privacy Officer to maintain this information using the Employee Access Request Form [Forms for Employees] and System Access Log [Change Control Logs for Security].
2. Reasonable efforts will be taken to limit the access of each user of Personally‐Identifiable Information to the amount needed to carry out the individual’s duties. These efforts will include internal use of PII.
3. For situations where Personally‐Identifiable Information disclosure occurs on a routine and recurring basis, the PII disclosed will be limited to the amount of information reasonably necessary to achieve the purpose of the disclosure.
4. Requests for disclosures that are not routine and recurring and thereby covered by Virtru standard procedures (other than to the individual, the Secretary of HHS or his agent, or where required by law) shall be reviewed by the Privacy Officer to determine that the Minimum Necessary Standard is applied to the extent reasonable.
5. Questions regarding these procedures should be directed to the Virtru Privacy Officer, Will Ackerly, [email protected], or (202) 577‐3683.
F. Enforcement
An employee found to have violated this policy shall be subject to disciplinary action, up to and including termination of employment. In the case where inappropriate access or use or disclosure of Personally‐Identifiable Information was or may have been involved, such individuals may additionally be reported to the appropriate enforcement agencies.
Rev.2015.8.25
12 #2..
- 699 -
V. Business Associate Agreements
A. Overview
The Privacy Rules impose certain requirements on Business Associates who create, receive, use or disclose Personally‐Identifiable Information on behalf of their Covered Entity partners. Vitru must comply with the requirements in this section.
B. Purpose
To provide instructions to all Virtru employees regarding the necessity of and the requirements for Business Associate Agreements relating to Covered Entities.
C. Applicability
This policy applies to all Virtru employees, which is defined for the purposes of this document to be employees of all current and future subsidiaries of Virtru.
D. Policy
1. Generally: A Covered Entity may disclose Personally‐Identifiable Information to Virtru, or allow Virtru to create or receive PII on the Covered Entity’s behalf.
Virtru will appropriately safeguard the PII obtained from the Covered Entity.
Virtru will document these assurances through a written agreement.
2. Content Requirements: The agreement between the Covered Entity and Virtru must meet the following requirements, as applicable:
a. Establish permitted and required uses or disclosures of Personally‐Identifiable Information that are consistent with those authorized for the Covered Entity, except that the agreement may permit Virtru to use or disclose Personally‐Identifiable Information for its own management and administration if such use or disclosure is required by law, or Virtru provides reasonable assurance to the Covered Entity to which the Personally‐Identifiable Information is disclosed that the confidentiality of the PII will be maintained.
b. Provide that Virtru will:
1. Not use or disclose the Personally‐Identifiable Information except as authorized under the agreement or required by law.
2. Use safeguards to prevent unauthorized use or disclosure.
3. Report unauthorized uses or disclosures to the Covered Entity.
Rev.2015.8.25
13 #2..
- 700 -
4. Pass on the same obligations relating to protection of Personally‐Identifiable Information to any subcontractors.
5. Make Personally‐Identifiable Information available for access by the Covered Entity in accordance with relevant law and policy.
6. Make Personally‐Identifiable Information available to the Covered Entity for amendment, and incorporate any approved amendments to Personally‐Identifiable Information, in accordance with relevant law and policy.
7. Make information available for the provision of an accounting of uses and disclosures in accordance with relevant law and policy.
8. Make its internal practices, books and records relating to its receipt or creation of Personally‐Identifiable Information available to the Secretary of HHS for purposes of determining Virtru’s compliance with Privacy Rules.
9. Authorize termination of the agreement by the Covered Entity upon a material breach by Virtru.
3. Compliance Responsibilities: Virtru agrees to report any use or disclosure of Personally‐Identifiable Information not permitted by this agreement and any successful security incident to Covered Entity within a commercially reasonable period, but in no event later than within thirty (30) business days, after it is discovered.
E. Enforcement
An employee found to have violated this policy shall be subject to disciplinary action, up to and including termination of employment. In the case where inappropriate access or use of Personally‐Identifiable Information was or may have been involved, these individuals may additionally be reported to the appropriate law enforcement agencies.
VI. Business Associate Subcontractor Agreements
A. Overview
The Privacy Rules impose certain requirements on Business Associate Subcontractors who create, receive, use or disclose Personally‐Identifiable Information on behalf of Virtru. All Business Associate Subcontractors of Virtru must comply with the requirements in this section.
B. Purpose
To provide instructions to all Virtru employees regarding the necessity of and the requirements for Business Associate Subcontractor Agreements relating to Business Associate Subcontractors who receive, use or disclosure Personally‐Identifiable Information on behalf of Virtru.
Rev.2015.8.25
14 #2..
- 701 -
C. Applicability
This policy applies to all Virtru employees and Business Associate Subcontractors, which are defined for the purposes of this document to be employees of all current and future subsidiaries of Virtru and the Business Associate Subcontractor.
D. Policy
1. Generally: Virtru may disclose Personally‐Identifiable Information to a Business Associate Subcontractor, or allow a Business Associate Subcontractor to create or receive PII on Virtru’s behalf, if adequate assurances are obtained by Virtru that the Business Associate Subcontractor will appropriately safeguard the PII. Virtru must document these assurances through a written agreement. This requirement does not apply with respect to:
a. Disclosures made to a provider concerning the individual's treatment, payment or health care operations; or
b. Uses or disclosures made to a governmental agency for purposes of public benefit eligibility or enrollment determinations where such company is authorized by law to make these determinations.
2. Content Requirements: The agreement between Virtru and a Business Associate Subcontractor must meet the following requirements, as applicable:
a. Establish permitted and required uses or disclosures of Personally‐Identifiable Information that are consistent with those authorized for the entity, except that the agreement may permit the Business Associate Subcontractor to use or disclose Personally‐Identifiable Information for its own management and administration if such use, or disclosure is required by law, or the Business Associate Subcontractor obtains reasonable assurance from the entity to which the Personally‐Identifiable Information is disclosed that the confidentiality of the PII will be maintained.
b. Provide that the Business Associate Subcontractor will:
1) Not use or disclose the Personally‐Identifiable Information except as authorized under the agreement or required by law.
2) Use safeguards to prevent unauthorized use or disclosure. 3) Report unauthorized uses or disclosures to Virtru.
4) Pass on the same obligations relating to protection of Personally‐Identifiable Information to any subcontractors or agents. 5) Make Personally‐Identifiable Information available for access by Virtru, in accordance with relevant law and policy.
Rev.2015.8.25
15 #2..
- 702 -
6) Make Personally‐Identifiable Information available to Virtru for amendment, and incorporate any approved amendments to PII, in accordance with relevant law and policy.
7) Make information available to Virtru for the provision of an accounting of uses and disclosures in accordance with relevant law and policy. 8) Make its internal practices, books and records relating to its receipt or creation of Personally‐Identifiable Information available to the Secretary of HHS for purposes of determining the Business Associate Subcontractor’s compliance with Privacy Rules.
9) If feasible, return or destroy all Personally‐Identifiable Information upon termination of contract; if any PII is retained, continue to extend the full protections specified herein as long as the PII is maintained. 10)Authorize termination of the agreement by the entity upon a material breach by the Business Associate Subcontractor.
3. Compliance Responsibilities: If Virtru knows of a pattern or practice of the Business Associate Subcontractor that amounts to a material violation of the Agreement, Virtru and the Business Associate Subcontractor must attempt to cure the breach to end the violation, and if unsuccessful, terminate the agreement. If terminating the Agreement is not feasible, Virtru must report the problem to the Secretary of HHS.
E. Enforcement
An employee of Virtru or an employee of the Business Associate Subcontractor found to have violated this policy shall be subject to disciplinary action, up to and including termination of employment. In the case where inappropriate access or use of Personally‐Identifiable Information was or may have been involved, these individuals may additionally be reported to the appropriate law enforcement agencies.
VII. Receipt, Use and Disclosure of PersonallyIdentifiable Information A. Overview
The Privacy Rules impose certain requirements on Covered Entities and Business Associates who create, receive, use or disclose Personally‐Identifiable Information on behalf of their Covered Entity partners.
B. Purpose
To provide instructions to all Virtru employees regarding the receipt, uses and disclosures of Personally‐Identifiable Information, which are permitted or required by HIPAA.
C. Applicability
This policy applies to all Virtru employees, which is defined for the purposes of this document to be employees of all current and future subsidiaries of the Company.
Rev.2015.8.25
16 #2..
- 703 -
D. Special Definition
Public Health Authority means a governmental company or authority, or a person or entity acting under a grant of authority from or a contract with such a public company, including the employees or agents of the public company, its contractors and those to whom it has granted authority, that is responsible for public health matters as part of its official mandate.
E. Policy
State and federal law permit and require certain receipt, uses and disclosures of Personally‐Identifiable Information such as those related to Business Associate Agreements. Additional uses and/or disclosures are allowed or required that related to public responsibility that require no agreement or authorization on the part of the individual who is the subject of the PII. It is the policy of Virtru to obtain, use and disclose PII only as permitted and/or required by law or regulation including the following situations:
1. Treatment, Payment or Healthcare Operations: Personally‐Identifiable Information may be used or disclosed for the purposes of providing treatment, payment or healthcare operations. Such disclosures will be made only as allowed by and pursuant to prevailing state and federal law. a. Discussions involving Personally‐Identifiable Information shall be conducted only in appropriate business areas including but not limited to offices, conference rooms and other non‐public areas; b. Conducted only for the purpose of fulfilling a legitimate business need; and
c. Conducted with regard to and in compliance with the “Minimum Necessary Standard.” [Minimum Necessary Standard]
2. Contained in a Business Associate Agreement: For permitted and required uses or disclosures of Personally‐Identifiable Information that are consistent with those authorized by the Covered Entity in a Business Associate Agreement.
3. Required by Law: Personally‐Identifiable Information may be used or disclosed to the extent such use or disclosure complies with and is limited to the requirements of such law.
4. Abuse and Neglect: Except for reports of child abuse or neglect, Personally‐Identifiable Information about an individual believed to be a victim of abuse, neglect, or domestic violence may be disclosed to a governmental authority authorized to receive such reports if the individual agrees or the reporting entity believes, in the exercise of professional judgment, that the disclosure is necessary to prevent serious physical harm. If the individual lacks the capacity to agree, disclosure may be made if not intended for use against the individual and delaying disclosure would materially hinder law Rev.2015.8.25
17 #2..
- 704 -
enforcement activity. The individual whose Personally‐Identifiable Information has been released must be promptly informed that the report was made unless doing so would place the individual at risk of serious harm.
5. Judicial Proceedings: Personally‐Identifiable Information may be disclosed in response to a court order.
6. Law Enforcement: Personally‐Identifiable Information may be disclosed for the following law enforcement purposes and under the specified conditions:
a. Pursuant to court order or as otherwise required by law, i.e. laws requiring the reporting of certain types of wounds or injuries b. Decedent's Personally‐Identifiable Information may be disclosed to alert law enforcement to the death if entity suspects that death resulted from criminal conduct
7. Serious Threats to Health or Safety: Consistent with applicable law and ethical standards, Personally‐Identifiable Information may be used or disclosed if the entity believes in good faith that the use or disclosure is necessary to prevent or lessen a serious and imminent threat to a person or the public, and disclosure is to someone reasonably able to prevent or lessen the threat, or the disclosure is to law enforcement authorities to identify or apprehend an individual who has admitted to violent criminal activity that likely caused serious harm to the victim or who appears to have escaped from lawful custody. Disclosures of admitted participation in a violent crime are limited to the individual's statement of participation and are not permitted when the information is learned in the course of treatment to affect the propensity to commit the subject crime, or through counseling, or therapy or a request to initiate the same.
8. Specialized Government Functions: National Security and Intelligence:
Personally‐Identifiable Information may be disclosed to authorized federal officials for the conduct of lawful intelligence, counter‐intelligence, and other activities authorized by the National Security Act.(45 CFR 164.512(k)(2))
9. Protective Services: Personally‐Identifiable Information may be disclosed to authorized federal officials for the provision of protective services to the President, foreign heads of state, and others designated by law, and for the conduct of criminal investigations of threats against such persons. (45 CFR 164.512(k)(3));
10. Public Benefits: Personally‐Identifiable Information relevant to administration of a government program providing public benefits may be disclosed to another governmental program providing public benefits serving the same or similar populations as necessary to coordinate program functions or improve administration and management of program functions.
Rev.2015.8.25
18 #2..
- 705 -
11. Workers' Compensation: Personally‐Identifiable Information may be disclosed as authorized and to the extent necessary to comply with laws relating to workers' compensation and other similar programs.
F. Procedures
The following procedures will be implemented to ensure that this policy is enforced effectively across all parts of Virtru.
Any request for disclosure of Personally‐Identifiable Information, 1) pursuant to a court order, warrant or subpoena; 2) by a law enforcement agent; 3) by a public health authority; or 4) by a national security, intelligence or other federal company, must be directed to the Privacy Officer and the CEO for review and action. Any such request will include an acknowledgement of receipt to insure that the document was actually received by the appropriate corporate individual and will retain a copy of the request. If the acknowledgement is not received within two working days of submitting to the appropriate corporate individual, then the request will be resubmitted to the Privacy Officer and CEO.
G. Enforcement
An employee found to have violated this policy shall be subject to disciplinary action, up to and including termination of employment. In the case where inappropriate access, use or disclosure of Personally‐Identifiable Information was or may have been involved, such individuals may additionally be reported to the appropriate enforcement agencies.
VIII. Complaint Process
A. Overview
The Privacy Rules require that Virtru provide a process for individuals to make complaints concerning the Company's policies and procedures required by these regulations and document all complaints received, and the dispositions of these complaints, if any.
B. Purpose
To issue instructions regarding Virtru obligations relating to the Privacy Rules to provide a process for individuals to complain about the Company’s policies and procedures and the requirement to document complaints received and the disposition of these complaints.
C. Applicability
This policy applies to all Virtru employees, which is defined for the purposes of this document to be employees of all current and future subsidiaries of Virtru.
Rev.2015.8.25
19 #2..
- 706 -
D. Policy
Virtru shall maintain a process to receive complaints from individuals about Company Privacy Policies and Procedures, for complaints from individuals who believe their privacy rights have been violated and from employees or Business Associate Subcontractors who believe that Virtru is not abiding by its policies and procedures and/or assurances concerning Personally‐Identifiable Information. This process shall include the following:
1. Any complaints or questions should be submitted to the Privacy Officer or his assistant.
2. All service and complaint issues will be stored in the Desk.com app.
Virtru shall work in good faith to resolve complaints received to the satisfaction of the submitter, where possible.
E. Procedures
The following procedures will be implemented to ensure that this policy is enforced effectively across all parts of Virtru.
1. Complaints shall be submitted in writing on paper or electronically.
2. Complaints shall be entered into the complaint tracking system either automatically or by the individual designated to provide information on the Company complaint process. and when manually entered shall be in the exact words provided by the submitter.
3. The Virtru Privacy Officer shall investigate complaints and make a determination as to whether or not the complaint has merit.
4. The Virtru Privacy Officer shall present complaints received to Virtru’s senior executive for immediate action.
5. If the Privacy Officer has completed the investigation of the complaint and made a determination, such determination shall be presented to the Virtru Executive Board
6. If the investigation has not been completed nor a provisional determination made by the Privacy Officer, it shall be the prerogative of the senior executive to make a summary determination or to direct the Privacy Officer to continue with the investigation and to report on the complaint at the next scheduled meeting.
If a determination is made that Virtru is in violation of the privacy provisions of the Privacy Rules or that changes are needed in the Privacy Policies or Business Associate Agreement to clarify the allowed practices of Virtru, the Virtru CEO and Privacy Officer shall determine the actions that the Company shall take.
Rev.2015.8.25
20 #2..
- 707 -
Complaint determinations and actions that Virtru takes pursuant to such complaints, if any, shall be reported to the submitter of the complaint, if such person is known.
Privacy Officer, or his designated agent, shall update the complaint tracking system with the findings of the Privacy Officer’s investigation, any determination made, direction or actions of the Virtru CEO and Privacy Officer with regard to the complaint, and a copy of any information provided to the submitter in response to their complaint.
F. Enforcement
Any employee found to have violated this policy shall be subject to disciplinary action, up to and including termination of employment. In the case where inappropriate access, use or disclosure of Personally‐Identifiable Information was or may have been involved, such individuals may additionally be reported to the appropriate enforcement agencies.
IX. Fax Policy
A. Overview
The Privacy Rules require that Virtru implement appropriate administrative, technical, and physical safeguards to protect the privacy of Personally‐Identifiable Information.
B. Purpose
To provide instructions to all Virtru employees regarding the use of faxes with respect to Personally‐Identifiable Information and the measures necessary to maintain an adequate level of security for such information. This policy defines rules necessary to achieve this level of protection. These standards are designed to minimize the potential exposure to Virtru from damages, which may result from unauthorized disclosure of Personally‐ Identifiable Information through facsimile use.
C. Applicability
This policy applies to all Virtru employees, which is defined for the purposes of this document to be employees of all current and future subsidiaries of Virtru.
D. Special Definitions
Fax: An electronic facsimile of a document stored as a series of zeroes and ones (binary data) that can be transmitted like normal computer data. When received by a fax machine, the incoming stream is translated into dots creating a representation of the original document.
Inappropriate Disclosure: The intentional or unintentional revealing of Personally‐Identifiable Information to people who do not have a need to know such information.
Rev.2015.8.25
21 #2..
- 708 -
E. Corporate Policies
Employees must exercise utmost caution when sending faxes to parties outside of Virtru.
Faxes containing Personally‐Identifiable Information should only be received on and sent to user or departmental specific fax machines and not to systems that have general access.
In cases where Personally‐Identifiable Information is received from outside on a non‐ departmental specific fax machine, the receiving department shall notify the Virtru Privacy Officer of the source of such information. The employee shall communicate the approved fax number to the external entity and record such actions. Should PHI be disclosed by fax to an inappropriate party, Virtru shall, to the extent possible, remediate such disclosures.
All fax documents sent by Virtru employees shall contain the following statement:
This fax is intended for the individual/individuals or entity/entities named above and may be covered by copyrights, business partner confidentiality agreements, non‐disclosures or other legally binding instruments. If you are not the intended recipient, do not read, copy, use or disclose the contents of this communication to others. Immediately notify the sender by reply fax, destroy all hard copies and delete this document from all systems. Thank you! F. Procedure
In the cases where data that contains Personally‐Identifiable Information is disclosed by fax machine use to an inappropriate party, the following procedure shall be followed:
1. The receiving party shall be contacted by telephone at the earliest opportunity and requested to destroy the fax without reading.
2. The name of the company, the person contacted, the date and time shall be recorded as well as any comments made by the person receiving such calls.
3. A fax shall also be sent to the receiving party containing the same instructions as detailed for the phone call requesting a return fax message indicating that the requested action was taken.
4. The cause of the inappropriate disclosure shall be determined and reported to the Virtru Privacy Officer.
Methods to prevent a reoccurrence of the inappropriate disclosure shall be formulated and put into place.
Any additional actions prescribed by regulations shall be performed to the extent possible.
G. Enforcement
Any employee found to have violated this policy shall be subject to disciplinary action, up to and including termination of employment. In the case where inappropriate access, use Rev.2015.8.25
22 #2..
- 709 -
or disclosure of Personally‐Identifiable Information was or may have been involved, such individuals may additionally be reported to the appropriate enforcement agencies.
X. Scanner Policy
A. Overview
The Privacy Rules require that Virtru implement appropriate administrative, technical, and physical safeguards to protect the privacy of Personally‐Identifiable Information.
B. Purpose
To provide instructions to all Virtru employees regarding the use of scanners with respect to Personally‐Identifiable Information and the measures necessary to maintain an adequate level of security for such information. This policy defines rules necessary to achieve this level of protection. These standards are designed to minimize the potential exposure to Virtru from damages, which may result from unauthorized disclosure of Personally‐Identifiable Information.
C. Applicability
This policy applies to all Virtru employees, which is defined for the purposes of this document to be employees of all current and future subsidiaries of Virtru.
D. Special Definitions
Scanner: An electronic copy of a document stored as a series of zeroes and ones (binary data) that can be transmitted like normal computer data. When received by a computer, the incoming stream is translated into dots creating a representation of the original document.
Inappropriate Disclosure: The intentional or unintentional revealing of Personally‐Identifiable Information to people who do not have a need to know such information.
E. Corporate Policies
Employees must exercise utmost caution when scanning and transmitting these documents to their devices and parties outside of Virtru. Scans containing Personally‐Identifiable Information should only be received on and sent to user or departmental specific computer in an encrypted format, or sent using Virtru’s encrypted email application.
F. Procedure
In the case where scanned data that contains Personally‐Identifiable Information is disclosed to an inappropriate party, the following procedure shall be followed:
1. The receiving party shall be contacted by telephone at the earliest opportunity and requested to destroy the scan without reading.
Rev.2015.8.25
23 #2..
- 710 -
2. The name of the company, the person contacted, the date and time shall be recorded as well as any comments made by the person receiving such calls.
3. The cause of the inappropriate disclosure shall be determined and reported to the Virtru Privacy Officer.
Methods to prevent a reoccurrence of the inappropriate disclosure shall be formulated and put into place. Any additional actions prescribed by regulations shall be performed to the extent possible.
G. Enforcement
Any employee found to have violated this policy shall be subject to disciplinary action, up to and including termination of employment. In the case where inappropriate access, use or disclosure of Personally‐Identifiable Information was or may have been involved, such individuals may additionally be reported to the appropriate enforcement agencies.
XI. Training Policy
A. Overview
The Privacy Rules require that Virtru train their employees on the requirements of our Privacy Policies and Procedures developed to protect the Personally‐Identifiable Information to which employees are provided access. The Company has determined that all employees of Virtru shall be trained on Privacy so that we can provide the necessary assurances for the protection of Personally‐Identifiable Information to our clients, vendors and business partners as required under the Privacy Rules.
B. Purpose:
To provide instructions to all Virtru employees regarding the requirement for HIPAA training.
C. Applicability
This policy applies to all Virtru employees, which is defined for the purposes of this document to be employees of all current and future subsidiaries of Virtru.
D. Policy
1. General: It is the policy of the Company that all employees of Virtru and its current and future subsidiaries be trained on Privacy and the Company policies and procedures created to protect Personally‐Identifiable Information.
2. Duty Specific Training: Privacy training shall be appropriate to the tasks that each employee performs. In the case where an employee does not come into contact with Personally‐Identifiable Information as a normal course of the employee’s duties, the employee shall be trained on the corporate policies and procedures.
Rev.2015.8.25
24 #2..
- 711 -
3. New Employees: New employees shall be trained on the corporate policies and procedures as part of their normal employment process and shall be trained on our Privacy Policies and Procedures, if applicable, within 30 days of being employed by Virtru. The Assistant ISO, Jordan Duggan, shall document this training and provide the Privacy Officer with documentation of this training within the 30‐day period.
4. Transfers: When an employee transfers from one department to another, the employee shall be trained on our Privacy Policies and Procedures within 30 days of being assigned. Jordan Duggan shall document this training and provide the Privacy Officer with documentation of this training, within the 30‐day period.
5. Material Change in Policies and Procedures: when a material change in the policies and procedures occurs, each employee shall receive training on such changes within 30 days of the implementation of the change. Jordan Duggan shall document this training and provide the Privacy Officer with documentation of this training, within the 30‐day period.
E. Enforcement
Any employee found to have violated this policy shall be subject to disciplinary action, up to and including termination of employment. In the case where inappropriate access, use or disclosure of Personally‐Identifiable Information was or may have been involved, such individuals may additionally be reported to the appropriate enforcement agencies.
Rev.2015.8.25
25 #2..
- 712 -
Security Policies and Procedures
{After choosing where you will store your Security Documents, delete either the Library or {Notebook} option throughout this document.}
Revision History
Virtru’s Security Policies and Procedures were adopted as of [Date].
Name
Virtru’s Security Policies and Procedures were modified as of [Date].
Name
Virtru’s Security Policies and Procedures were modified as of [Date].
Name
Virtru’s Security Policies and Procedures were modified as of [Date].
Name
Virtru’s Security Policies and Procedures were modified as of [Date].
Name
Virtru’s Security Policies and Procedures were modified as of [Date].
Name
Rev.2015.8.6
1 #2..
- 713 -
Security Policies and Procedures
Table of Contents
Virtru
Document control
B. Security Document Library
II. Preface and Background Material
Overview
B. Policy
III. Key Concepts
Information Security Principles
Confidentiality
Integrity
Availability
Provability
Definitions
Information Security Policy
Privacy Policy
Acceptable Use Policy for IT Systems Users
Employment Policies
IV. Using These Standards
Audience – Who will use this document
Technology and business process providers should comply with these Standards as a matter of contractual obligation
Employees and Business units within Virtru should comply, unless a Risk Assessment has been done and a deviation is approved by the ISO
How the document is used
Review of existing controls, procedures and tools against the Standards Documenting compliance or deviations
Gap Analysis to determine where improvements are needed A Risk Assessment to validate that the improvements are justified against the costs of the controls and the value of the information involved Creation of a plan to close the gaps OR signoff of a deviation Documentation of the new controls, procedures and tools C. Maintaining this document
V. Roles and Responsibilities
A. Rules for ownership of information
B. Information users
C. Information Security Officer
Manage awareness programs relating to security and privacy topics Maintain a central record of exceptions to this Standards document Manage changes to this Standards document
Rev.2015.8.6
2 #2..
- 714 -
Security Policies and Procedures
Provide leadership relating to new security risks, controls and technologies Oversee and approve the sharing and reuse of Personal Identifiable Information (PII) collected by or processed by the company
VI. Information Classifications and Requirements
Overview
B. The Security classification process
IT platforms such as servers and workstations
IT applications including database transaction processing and email Data sets
Paper copies of information
Information types typically known to workforce members, such as customer information
Development, acquisition or deployment of software
Connections of computers or networks to outside systems or networks Granting of access to any outside organizations
C. The classes of information for Security and Privacy
Data Types
Company‐owned data that relates to such areas as corporate financials, employment records, payroll, etc.
Setting requirements for business continuity
Required uptime for the information asset
Required restoration time if the data must be restored
Required frequency of backups
Requirements for storage of backups
Requirements for testing of the recovery process
Enforcement
VII. Handling Rules for the Information Classifications Overview
Inventory of Information Assets and Electronic Asset Management Log Rules for access to information assets
VIII. Access Control Policy
Overview
Access levels
Granting access
The ISO will provide accounts with the matching technical privileges and give the workforce member the account information including a one‐time‐use password that the user must change to a private password upon first use of the account.
1. Only the person assigned to an account will be allowed to use that account.
Vendors, contractors and other outsiders
Individuals
Policy
Rev.2015.8.6
3 #2..
- 715 -
Security Policies and Procedures
IX. Rules by Data Classification
Public/unclassified data
B. Private/internal data
C. Confidential or protected data
D. Managing data sources
E. Retention of media
Agent of Record letters and Letters of Authorization requests are held for no less than ninety (90) days
New Business Group documents are held for no less than ninety (90) days General documents are held for no less than ninety (90) days Banking statements are held for seven (7) years
Workforce member records are held for seven (7) years
F. Sanitization of Media
G. Information sharing and privacy
H. Release of company information
X. Risk Analysis and Management
Risk reviews
B. Risk management
Increasing a protection to a level higher than what is listed in this document Improving oversight or monitoring of the risk to limit impact and minimize response time
Limiting transactions or other events to minimize the possible impact of the risk event
XI. IDs and Accounts
User IDs
B. ID and account creation
Expiration dates for the User ID
Renewal process for the User ID
Documentation of the role, business process and job function relating to the User ID C. Account management
Application Specific IDs
XII. Authentication and Passwords
Overview
Password format
Rules
XIII. Authorization and Rights Management
General Access Roles
Super Admin Access: Access to all front and backend products as well as product metrics
Admin Access: Access to all front end products as well as product metrics General Access: Access to product metrics
Rev.2015.8.6
4 #2..
- 716 -
Security Policies and Procedures
Low Access: Access to corporate email, sales, and marketing data only Amazon Web Services (AWS)
Cloudant
Github
ELK Stack
Mixpanel
Kissmetrics
Salesforce
Access Rules
Limiting access to datasets and types
Limiting access to operating systems
Limiting times of access
Temporary Privileged Users and Accounts
D. Assignment and Revocation Procedure
An Employee Access Log for all new hires and/or workforce member change of status.
An Exit Checklist for all terminations.
E. Logout After Inactivity
XIV. Breaches or Impermissible Uses/Disclosures
Definitions
Penetrations of systems, applications, networks or databases Denial of service attacks
Misuse or mishandling of assets
Virus or other malware contamination
Transaction errors
Breaches of confidentiality agreements or contracts
Legal or regulatory violations
XV. Breach Response
A. Overview
Confidential Reporting:
Calling (may leave voice message) the ISO or AISO
Sending an email to the ISO or AISO, or;
XVI. Personnel Security
Screening for newly hired personnel, third parties, vendors Professional qualifications
Identity checks
Criminal checks
Confirmation of academic and professional experience
B. Training and Awareness
Managing malicious software (e.g. viruses)
Using workstation(s) securely
Rev.2015.8.6
5 #2..
- 717 -
Security Policies and Procedures
Managing passwords and
Monitoring and reporting suspicious use of account(s)
C. Terms of employment
D. Acknowledgement
E. Exit process for users
Relinquish all access to control devices
Report all User IDs in use by the person
Relinquish all information stored, whether on paper or on backup media Relinquish all information processing devices, including workstations, all Virtru‐owned mobile devices and others
All systems access will be revoked.
Security Sanction Policy
First Security Infraction
A simple infraction, and
The first infraction in the last 3 years
Second Security Infraction or First Serious Infraction
A serious infraction, or
The second infraction of either type within 3 years
Third Security Infraction or Second Serious Infraction
A second serious infraction within 3 years, or
A third infraction of any type within 3 years
The sanction will be dismissal from the workforce.
XVII. Legal and Regulatory Issues
Legal processes
Copyrights and licenses
C. Export controls
XVIII. Malware and Antivirus
Definitions
Operating system anti‐malware requirements
Macintosh, Linux and iPhones:
PC Operating Systems:
Android and Windows Phone Operating Systems:
Affiliates
Infected devices
Employees’ Requirements
Workforce members will not load software on our Company’s information equipment without permission from the ISO.
Workforce members will not open electronic files from unfamiliar sources.
Enforcement
XIX. Change Control Logs
Preface
Rev.2015.8.6
6 #2..
- 718 -
Security Policies and Procedures
B. Policy
Sufficient information is available for proper investigation of use, misuse, incidents and performance
User ID, event type, date and time are maintained
Time is according to a known time stamp so that events across systems can be coordinated
4. End‐to‐end accountability is always maintained
Changes to operating systems, application code or other tools Backup and restore events
Changes affecting any cryptographic keys or devices
Stop or start of critical processes
Transaction failure, retry or duplication
KissMetrics
Segment.io
Sendgrid
XX. Encryption
Preface
Application Encryption Policy
Key Rotation Policy
D. Device Encryption Policy
Mac OS Devices:
Windows OS Devices:
Linux OS Devices
Android Devices
Windows Phone
iPhone
E. Wi‐Fi network encryption
F. Email encryption
G. Enforcement
XXI. Assessments and Testing
Overview
B. Penetration testing
Operating systems
Applications
Databases
C. Vulnerability assessment testing
A new system, application or network is installed inside the Company Changes are made to firewalls, VPNs or other security control tools Changes are made to a web server’s operating system
Changes are made to email servers
Configuration changes are made to databases
Rev.2015.8.6
7 #2..
- 719 -
Security Policies and Procedures
Configuration changes are made to critical applications Changes are made to encryption scheme(s)
D. Wireless access testing
E. Password testing
XXII. Use of Email, Internet, Messaging, Public Sites, Blogs, Social Media Policy
Sexually explicit material
Confidential, Private or Protected Information or Internal Use material, except as meets the Handling Rules section
Viruses
Threats
Inappropriate or unlawful language, including:
Offensive language
Language inappropriate for the Company environment
Discriminatory or harassing language
Tools usable for hacking, password cracking, vulnerability scanning or penetration testing
XXIII. Hardware
Definitions
B. Policy
C. Asset management
D. Enforcement
XXIV. Networks
Overview
Denial of service attacks
Improper access
Virus infections
Unauthorized software installations, email, FTP or other improper usage Administration of network and communications connections Operations of all devices
Monitoring
Timely review of audit logs and response to alerts or alarms Review of unusual patterns of usage or activity
Monitoring
Access control and physical security
Access limited to authorized personnel only
Physical security, including RFID or passcode controlled locks, are in place Modifications, updates
Documentation
Network design
Segmentation
Rev.2015.8.6
8 #2..
- 720 -
Security Policies and Procedures
Firewalls
Internet
Approved by the ISO
Periodically reviewed and tested for vulnerabilities
Protected by firewalls, intrusion detection systems and anti‐malware tools VPN‐remote access
Wireless
Telework Policy
Patching of systems and applications
Network hardening
XXV. Physical and Environmental Protections
Definitions
Computing centers
Network connection points
Media storage locations
Locations containing platforms which carry high‐value or critical information or transactions
B. Secure Sites Policy
Media libraries
Electrical supplies and controls
Environmental and mechanical controls
XXVI. Physical Security Policy
A. Entry Policy
Loss of RFID key
Mobile devices
D. Video monitoring
Alarm system
Fire protection
XXVII. Software
Overview
B. Acquisition of software
C. Open Source Software
It is not used in a production environment OR
Prior to use it is fully tested, documented and Virtru’s personnel are assigned to support it. Checks to be performed include:
The source of the software is documented
URL
Project lead
Contributors
The ISO approves of the use
D. Documentation
Rev.2015.8.6
9 #2..
- 721 -
Security Policies and Procedures
E. Change control and maintenance
F. Operating Systems
G. Applications
Access control
Authorization
Information classification
Storage controls
Backup and restoration
Confidentiality and integrity requirements
Audit logs
Privacy, export control and other such requirements
H. Asset management for software
I. Enforcement
XXVIII. Removable Media Device Policy
Purpose
B. Scope
C. Definitions
D. Policy
E. Using Removable Media Devices
F. Exceptions
G. Refusal
H. Enforcement
Application Recovery Plan
Overview
Scope
Data durability and reliability
Encryption
Load balancing
Restoration of data
G. Testing and revision of plan
Network Attached Storage and Workstation Backup Plan
Overview
Policy
Backup software
Remote backups
Local backups
Encryption of backups
Restoring data
H. Enforcement
Information Integrity Management Policy
Overview
Rev.2015.8.6
10 #2..
- 722 -
Security Policies and Procedures
B. Policy
Security Incident Management Policy
Overview
Procedures
C. Policy
Security Plan Review Policy
Overview
Procedures
Appendices
Change Logs
B. Information Security Committee
Rev.2015.8.6
11 #2..
- 723 -
Security Policies and Procedures
I. Virtru
Virtru may be referred to as “Company.”
A. Document control
A staff copy of this document is available with the Information Security Officer (ISO), Will Ackerly, [email protected] (202) 577‐3683, and Assistant Information Security Officer(AISO), Jordan Duggan, [email protected] (202) 577‐3683.
B. Security Document Library
These policies and procedures and related security practice information will be kept in our Security Documentation Library (SDL). The SDL is located in google drive and backup to the Synology NAS.
Documentation about security practices (logs of activities, etc.) will either be kept in this SDL (or Notebook) or in a short file in the SDL that will describe where the security practice documentation resides. The intended result is that anyone with access to the SDL will be able to locate any piece of documentation associated with our security program.
Outdated and superseded materials from the SDL will be kept in an archive (the Security Documentation Archive) for at least seven (7) years after the date when they are first outdated or superseded.
II. Preface and Background Material
A. Overview
It is vital to the reputation and profitability of Virtru that our information and our clients' information, in all forms, be protected from unauthorized use, modification, loss, copying, etc. This document sets out the default standards, which must be met to ensure that control.
Our information may exist on paper, in voice systems, on IT systems and networks, in the minds of our people, and in other forms. The information which needs protection includes, but is not limited to:
1. Client information (both for customer companies and for people as individuals)
2. Financial information, including credit cards, salaries, banking, transactions and more
3. Medical information of all types
4. Company patents, business plans and other intellectual property Rev.2015.8.6
12 #2..
- 724 -
Security Policies and Procedures
5. Company business records and planning materials, including our customer list, marketing and sales efforts, product line plans and more
6. Copyrighted materials, both which our Company creates and those which we obtain under license from others
B. Policy
Compliance with these standards is mandatory. Any deviation from these standards must be approved beforehand by the ISO.
III. Key Concepts
A. Information Security Principles
The protection of information can be described in several key dimensions:
1. Confidentiality
2. Integrity
3. Availability
4. Provability
In this document, the standards given are the Company defaults. They must be applied where appropriate, but always balanced against the cost of implementing the control, and the value of the information involved.
B. Definitions
To prevent confusion, these are the definitions used throughout this document.
Policies: Corporate documents which set out Virtru’s position regarding business processes, behavior of personnel and similar topics. Policies are a high‐level statement of Virtru’s position. Some of Virtru’s policies, which relate to information security are:
1. Information Security Policy
2. Privacy Policy
3. Acceptable Use Policy for IT Systems Users
4. Employment Policies
Standards: Rules that must be followed to enable an effective information security program. Compliance with the Standards is mandatory, but deviation is possible if approved by the ISO.
Standards define the minimum baseline procedures, practices and configurations for systems, applications, controls, networks and related topics. Standards are designed to provide a single reference point for use during software development and adoption, Rev.2015.8.6
13 #2..
- 725 -
Security Policies and Procedures
installation of systems and tools, and during the contracts process with vendors and service providers. Standards do not, however, give detailed command‐line instructions on how to meet the Virtru’s policies. Those are given in the guidelines.
Guidelines: Built for each application and platform; to be followed when implementing that particular tool. A Guideline may vary a bit from one implementation to another, as long as the Security Standards are met and justification is given and properly documented.
Combined, these three levels of documents provide a method for Virtru to audit itself and ensure proper controls are in place, without excess cost or risk. They also provide a means for Virtru to explain to regulators, examiners, external auditors or investors how our Company is safe, trustworthy and efficient.
IV. Using These Standards
A. Audience – Who will use this document
This document applies to Virtru’s employees, business units and any Business Associate Subcontractor supporting Virtru:
1. Technology and business process providers should comply with these Standards as a matter of contractual obligation
2. Employees and Business units within Virtru should comply, unless a Risk Assessment has been done and a deviation is approved by the ISO
B. How the document is used
This Standards document is a reference point to ensure a consistent framework of protections is in place. Implementing these standards involves:
1. Review of existing controls, procedures and tools against the Standards
2. Documenting compliance or deviations
3. Gap Analysis to determine where improvements are needed
4. A Risk Assessment to validate that the improvements are justified against the costs of the controls and the value of the information involved
5. Creation of a plan to close the gaps OR signoff of a deviation
6. Documentation of the new controls, procedures and tools No signoff or approvals are needed if a level of protection higher than what is given in this Standard is determined to be needed for a given information asset.
Rev.2015.8.6
14 #2..
- 726 -
Security Policies and Procedures
C. Maintaining this document
This document must be reviewed at least once a year or anytime there are significant changes in software or security. Updates must be made to keep it in accord with Virtru’s overall business goals and risk position. The document will be reviewed by the ISO or AISO. Any updates, improvements or suggestions should be sent to the ISO.
V. Roles and Responsibilities
A. Rules for ownership of information
The information and systems provided by Virtru to workforce members, contractors and representatives are owned by Virtru, which also determines appropriate usage and access rules. All data on Virtru’s systems and networks is owned by Virtru, with the exception of software that the ISO has approved to be open sourced or otherwise transferred to another entity through code escrow or code exchange and/or trade.
In this document, the words ‘information owner’ refer to the person who owns the responsibility for the information. The information itself remains the property of Virtru.
B. Information users
Every user of Virtru’s information must protect that information and ensure that it is used for Virtru’s business purposes only. Any incidents or questionable issues in the security of our information must be reported to the ISO or AISO.
Information users may not assign access rights, authorize destruction or copying of information, or change the protections given to information assets. Information users must comply with all laws, regulations and Virtru’s policies and procedures.
C. Information Security Officer
Virtru’s ISO and AISO will:
1. Manage awareness programs relating to security and privacy topics
2. Maintain a central record of exceptions to this Standards document
3. Manage changes to this Standards document
4. Provide leadership relating to new security risks, controls and technologies
5. Oversee and approve the sharing and reuse of Personal Identifiable Information (PII) collected by or processed by the company See Appendices for further information and Information Security Committee for a current listing of members.
Rev.2015.8.6
15 #2..
- 727 -
Security Policies and Procedures
VI. Information Classifications and Requirements
A. Overview
Information is classified by system to ensure that the controls applied to it are sufficient and also to ensure that the controls applied do not impair Virtru’s business, ability to compete or Virtru’s image.
All information must have a classification for security and must have requirements set for business continuity.
B. The Security classification process
Each information asset will go through the following classification process. Information assets include, but are not limited to:
1. IT platforms such as servers and workstations
2. IT applications including database transaction processing and email
3. Data sets
4. Paper copies of information
5. Information types typically known to workforce members, such as customer information
In general, an information asset includes both the raw information itself (paper, oral or data entry), the location where it resides, the business processes which handle it and the systems and tools that handle it.
Information assets will also be reviewed during:
1. Development, acquisition or deployment of software
2. Connections of computers or networks to outside systems or networks
3. Granting of access to any outside organizations
The security classification of an information asset is assigned according to the highest of these dimensions. As an example, if an asset is regulated by law, then it needs the highest classification, even if the asset is not critical to the Company’s business.
C. The classes of information for Security and Privacy
This policy applies to all workforce members, management, contractors, vendors, business partners and any other parties who have access to Company or client data.
Rev.2015.8.6
16 #2..
- 728 -
Security Policies and Procedures
Data Types
The security classification of an information asset is assigned according to the highest of these dimensions. As an example, if an asset is regulated by law, then it needs the highest classification, even if the asset is not critical to Virtru’s business. Virtru deals with two main kinds of data:
1. Companyowned data that relates to such areas as corporate financials, employment records, payroll, etc.
2. Personally Identifiable Information (PII) that is the property of our clients or workforce members, such as Protected Health Information, social security numbers, credit card information, contact information, etc.
D. Setting requirements for business continuity
The requirements for an information asset relating to business continuity are not set by classification, but are specific to that asset. They include:
1. Required uptime for the information asset
2. Required restoration time if the data must be restored
3. Required frequency of backups
4. Requirements for storage of backups
5. Requirements for testing of the recovery process
The default requirements for business continuity are listed in the information handling rules’ section. See Handling rules for the information classifications in this document and Disaster Recovery Plan for detailed information.
This section outlines the basic rules for handling information types according to the classifications. More specific standards for platforms, processes and networks appear in each topic section of this standards document.
E. Enforcement
It is the responsibility of everyone who works at Virtru to protect our data. Even unintentional abuse of classified data will be considered punishable in accordance with the extent and frequency of the abuse.
Rev.2015.8.6
17 #2..
- 729 -
Security Policies and Procedures
VII. Handling Rules for the Information Classifications A. Overview
This section outlines the basic rules for handling information types according to the classifications. More specific standards for platforms, processes and networks appear in each topic section of this standards document.
B. Inventory of Information Assets and Electronic Asset Management Log An inventory is maintained of all significant information assets belonging to, or used by Virtru. This inventory includes:
1. Serial numbers/license numbers
2. MAC Addresses
3. Model
4. Device Type
5. Manufacturer
6. The information owner
7. Username
8. Location
9. OS Version
10. The custodian of the information and repository location (database, file cabinet, etc.)
11. Purpose in our systems
12. Asset value in dollars or other suitable measurement
13. The sensitivity of the asset, due to regulations, laws, customer expectations or other requirements
14. Requirements for the asset regarding availability, uptime, etc.
15. Contact information for one or more parties who can repair, restore, replace, or recover this asset. Examples are hardware/software vendors, IT support vendors, and/or staff members
This asset list contains information that is restricted to executives and super‐admins, and therefore is stored securely on the Synology NAS, which itself is backed up to AWS Glacier.
This inventory will be reviewed and updated quarterly, or as new assets and devices are added. Logs are maintained as the Inventory of Information Assets Log and the Rev.2015.8.6
18 #2..
- 730 -
Security Policies and Procedures
Organizational Chart/Electronic Asset Management Log. A current copy of this inventory will be kept at a separate location as described in our Disaster Recovery Plan.
C. Rules for access to information assets
If any given security incident involves a breach of Personally Identifiable Information (PII), the ISO will follow our security policies and Incident and Breach Policy for handling such a breach.
If a security incident includes the potential that personal information may have been obtained by unauthorized individuals, the ISO will work with the client to notify affected persons of this event, in compliance with relevant federal and/or state law.
See also Breaches or Impermissible Uses/Disclosures within these Security Policies and Procedures.
VIII. Access Control Policy
A. Overview
This policy defines how Virtru manages access to electronic information and systems.
Virtru provides access to electronic data relative to the workforce member’s job requirement. We limit access to categories of data and systems that each person needs to do his/her job. We require that each workforce member restrict his/her access to only those specific records and functions needed to carry out his/her job. For the purposes of this policy workforce members are anyone in Virtru who has access to Personally Identifiable Information (PII).
B. Access levels
The ISO will qualify the workforce member to have one of these forms of access based on the job role (in order of increasing access permissiveness):
1. Low Access to Corporate Email and Salesforce Data
2. General Access to product metrics
3. Admin Access to all front end products as well as product metrics
4. Super Admin Access to all front and backend products as well as product metrics The access will match the person’s job responsibilities The ISO will keep a record of the type of access provided to each workforce member. The record will include a date and justification and will be kept in our Employee Access Request Log in the Security Documentation Library.
Rev.2015.8.6
19 #2..
- 731 -
Security Policies and Procedures
The granting of access to Business Associate Subcontractors will be done in the same way as it is done for workforce members.
C. Granting access
The ISO will provide accounts with the matching technical privileges and give the workforce member the account information including a one‐time‐use password that the user must change to a private password upon first use of the account.
1. Only the person assigned to an account will be allowed to use that account.
2. Each time a user logs in to a system, a log will be maintained by that specific program with the following information
a) When the user accessed the system
b) What information the user accessed while in the program c) Tracking will be done by using the User ID and IP Address d) The ISO will maintain this log for a period of 1 year
3. The ISO and AISO will each have a special account that allows them to create new accounts. The accounts will be used:
a) In an emergency when all other accounts have been disabled or locked out; b) To either reset the passwords on locked accounts; or c) To create new accounts that provide needed access.
4. When a change in the role of a workforce member requires a change in access privileges, the ISO will reassess the needs and provide new access privileges based on the policy in Access Levels in this section.
a) If a workforce member leaves Virtru, the ISO will remove that member’s access as soon as the access is no longer needed.
b) If a workforce member takes a leave of absence and is not expected to require access, the ISO will disable the workforce member’s account when he/she leaves and re‐enable it upon his/her return to work. c) For other people who work around protected electronic information but are not qualified to access it, the ISO will decide which of the following two steps to take:
1) Train the person to understand his/her responsibilities 2) Supervise while he/she is exposed to the data
d) For cases in which the provision of individual accounts is not feasible {e.g. access by any one person of a large help desk staff of a vendor}, the ISO will make:
1) A serially reusable account and provide a one‐time‐use password to the vendor’s representative for each time that access is needed; and
Rev.2015.8.6
20 #2..
- 732 -
Security Policies and Procedures
2) The password will be changed by the ISO on the account after each use of the account to a value not known to the vendor.
D. Vendors, contractors and other outsiders
Any outside organization that wishes to gain access to our or our client’s Private/Internal, Confidential or Protected information must:
1. Sign a Business Associate Subcontractor Agreement; AND
2. Be willing and able to show that their privacy and security controls are at least as stringent as Virtru’s controls.
See Business Associate Subcontractor Agreement for details of Agreement.
A written history of incidents reported by Business Associate Subcontractors (BAS) will be maintained. If the ISO becomes aware of a pattern of activity in which the BAS is not carrying out the contractually required safeguards, then the ISO will do one of the following:
1. Attempt to remedy this failure
2. Terminate the contract, if attempt to remedy is not feasible
3. Report the situation to the U.S. Secretary of Health and Human Services, if terminating the contract is not feasible.
If any given security incident involves a breach of Personally Identifiable Information, the ISO will follow our privacy policies and incident management plan for handling such a breach.
If a security incident reported by a BAS includes the potential that personal information may have been obtained by unauthorized individuals, the ISO will work with the BAS to notify affected persons of this event in compliance with relevant federal and/or state law.
See also Breaches or Impermissible Uses/Disclosures within these Security Policies and Procedures.
E. Individuals
Individual persons who work for such an organization must also be bound to the outside organization’s controls. Such individuals must:
1. Have Business Associates Subcontractor Agreement with their own company; OR
2. Have a contract with their company; AND
3. Have appropriate background checks and bonding in place.
Rev.2015.8.6
21 #2..
- 733 -
Security Policies and Procedures
F. Policy
Virtru will not knowingly accept any confidential information belonging to third parties until that information is reviewed against our protections and the appropriate agreements put into place and signed by the information owner. The agreements should include all requirements for controls over the third‐party information and the processes to be followed.
IX. Rules by Data Classification
A. Public/unclassified data
This type of information does not require special marking or storage, except to ensure that it is available when needed. It does need to be kept safe from unauthorized modification.
B. Private/internal data
Access is granted on a need‐to‐know basis, as authorized by the manager of the user of the information. Some types of jobs are automatically granted access to data in this class.
Paper products and backup media containing this type of information must be stored and handled in a secure manner. This includes:
1. Printing this class of information only to a known printers located in secure areas on secure networks.
2. Encrypting or physically securing backup media
3. Keeping paper copies of information locked or otherwise secured This class of information is not released to anyone outside Virtru without a non‐disclosure agreement, a Business Associate Subcontractor Agreement, and/or without the approval of the information owner. Private/Internal use information must not be transmitted across any unsecured outside network or path without proper controls. This means encryption for files and emails or secured packaging for paper copies.
C. Confidential or protected data
Access to this type of information is on a need‐to‐know basis, as approved by the ISO or information owner.
This class of information is not released to anyone outside the Company without a non‐disclosure agreement and without the approval of the information owner.
Rev.2015.8.6
22 #2..
- 734 -
Security Policies and Procedures
Confidential or Protected information must not be transmitted across any unsecured outside network or path without proper controls. This means encryption for files and emails, or secured packaging for paper copies.
Paper products and backup media containing this type of information must be stored and handled in a secure manner. This includes:
1. Printing this class of information only to a known, secure printer
2. Encrypting and physically securing backup media
3. Keeping paper copies of information locked or otherwise secured D. Managing data sources
The key to managing Virtru’s business’ media and documents is to first consider the source of the information, then the media type. Virtru’s media and documents containing Protected Information (PHI, CJIS, or other) require protection from inception through disposition. Regardless of the owner relationship, the Company will be cognizant of the following Media Types:
1. Hard Copy: paper printouts, printer and facsimile ribbons, drums, etc.
2. Electronic: the bits and bytes contained on hard drives, flash drives, phones and tablets.
E. Retention of media
Retention: The length of time documentation and/or information is retained according to the level of confidentiality and to the business continuity requirements. System/ information owners should consult with the ISO to ensure compliance with the record retention regulations.
Virtru’s hard copy record retention policy is as follows:
We will digitize and encrypt these records for secure storage on the Synology NAS, which will be backed up to AWS Glacier.
Virtru’s electronic record retention policy is as follows:
1. Agent of Record letters and Letters of Authorization requests are held for no less than ninety (90) days
2. New Business Group documents are held for no less than ninety (90) days
3. General documents are held for no less than ninety (90) days
4. Banking statements are held for seven (7) years
5. Workforce member records are held for seven (7) years Rev.2015.8.6
23 #2..
- 735 -
Security Policies and Procedures
F. Sanitization of Media
When media (hard copy and electronic) becomes obsolete, is no longer required or no longer usable, it is critical that proper sanitization is accomplished.
Sanitization Types
Disposal: the act of discarding media. This is often done via recycling paper containing “non‐confidential” material.
Reinitializing: Re‐formatting drives so information cannot be retrieved by recovery utilities or any other forms including keystroke recovery attempts. This is achieved by overwriting the disk with zeros for no less than one (1) time.
Purging: exposing the magnetic media to a strong magnetic field in order to disrupt the recorded magnetic domains, this is also known as degaussing.
Destroying: destruction of media so it cannot be reused as its original purpose.
Virtru’s electronic disposal policy is as follows:
1. Hard‐drives are purged, reinitialize or destroyed
2. CD or DVD disks are destroyed
3. Flash drives are re‐initialized or destroyed
4. Backup tapes are purged, reinitialized or destroyed
Any systems that are leased must be securely sanitized of all Company data prior to being returned to the leasing company. Any additional media (e.g. hard drives, USB drives etc.) will be reformatted then written with zeros for no less than one (1) time to ensure that the data contained on the media has been destroyed.
Virtru shall maintain appropriate records of sanitization. This entails validating how, where and when media is sanitized. See Media Sanitization.
G. Information sharing and privacy
In most cases the sharing and reuse of Personally Identifiable Information is governed by law, regulation and customer expectation. To ensure Virtru meets those requirements, no Personally Identifiable Information will be shared with outside companies, vendors or personnel without written approval from the ISO.
Personally Identifiable Information includes:
1. Names
2. Addresses
Rev.2015.8.6
24 #2..
- 736 -
Security Policies and Procedures
3. Phone Numbers
4. Email Address
5. Dates of birth
6. Social Security Numbers
7. Ages
8. Gender
9. Personal Financial Information
10. Personal Medical Information
11. Criminal History Information
12. Personal Employment Information
13. Personal Buying Histories
14. IP Addresses
Aggregated and statistical data developed from this personal information is not personally identifiable and, thus, does not need the approval of the ISO for sharing and re‐use.
Virtru will comply with all applicable laws and regulations regarding the privacy of personal information, including such laws as:
1. Health Insurance and Portability and Accountability Act (HIPAA)
2. Health Information Technology for Economic and Clinical Health (HITECH)
3. Family Educational Rights and Privacy Act (FERPA)
4. Criminal Justice Information Systems (CJIS)
5. Federal Information Security Management Act (FISMA)
Virtru’s workforce members, contractors, vendors and suppliers may come into possession of Personally Identifiable Information as a part of their relationship with Virtru. Each person must comply with all laws, regulations and policies and ensure such information is properly protected.
H. Release of company information
Virtru’s information may only be released with the approval of the ISO or the information owner. This includes the posting of Virtru’s information of any type onto bulletin board systems, public networks, social media or other open sharing tools. Any information released must contain proper copyright, trademark, disclaimer and patent notices as appropriate.
X. Risk Analysis and Management
Risks to Virtru’s assets and environment should be addressed proactively rather than reactively. The controls applied to the risks must also be periodically reviewed to ensure the controls are working properly and efficiently.
Rev.2015.8.6
25 #2..
- 737 -
Security Policies and Procedures
A. Risk reviews
The job of reviewing risks and setting requirements for controls is the ISO’s. Risks should be reviewed or assessed when:
1. Developing or deploying new applications, systems, networks or software
2. When significant changes are made to that same list
3. When business processes change
4. When Virtru enters a new geographical area of business
5. When Virtru enters a new line of business
6. When incidents occur or new risks emerge
7. When new regulations or standards are set
B. Risk management
Risks may be accepted, avoided or mitigated.
Accepting the risk is appropriate when the cost of avoiding or mitigating the risk is greater than the expected loss. The losses considered should include the less tangible items such as Virtru’s reputation, loss of market share and loss of public trust in Virtru.
Acceptance of a risk requires complete documentation of the risk analysis and approval by the information owner.
Avoiding the risk is appropriate when the cost of insurance is less than the cost of incremental controls. However, basic controls must always be in place.
Mitigating the risk is appropriate in most situations. These situations are those where compensating controls are possible, cost‐effective and manageable. These mitigating controls may include:
1. Increasing a protection to a level higher than what is listed in this document
2. Improving oversight or monitoring of the risk to limit impact and minimize response time
3. Limiting transactions or other events to minimize the possible impact of the risk event
The method chosen for managing the risk (acceptance, avoidance, mitigation) must match the business value and costs involved and must be approved by the information owner.
For further detail, see the Risk Management Policy and the Disaster Recovery Plan.
Rev.2015.8.6
26 #2..
- 738 -
Security Policies and Procedures
XI. IDs and Accounts
A. User IDs
Each user shall be assigned a unique identification, called the User ID. This User ID is not considered to be sensitive, unless the User ID relates to an authentication process, systems or application management role.
On sensitive systems or applications the User ID should not be easily identifiable, thus making unauthorized usage more difficult.
Sharing of User IDs is not permitted, unless justified by business requirements and approved by the ISO. For any such shared User ID, the password will be shared using LastPass, and the password will not be shared with the additional user. If this password is shared, it must be changed immediately after the User ID is used to keep the shared User ID from becoming generally available and a risk to Virtru.
Guest and anonymous User IDs are not allowed, unless the system involved is not connected to any of Virtru’s networks and the system does not have any Company information on it. Typically, these guest or anonymous User IDs are only used during development or during marketing/sales demonstrations.
B. ID and account creation
User IDs are only to be created following a process approved by the information owner.
This User ID creation process should include:
1. Expiration dates for the User ID
2. Renewal process for the User ID
3. Documentation of the role, business process and job function relating to the User ID
User IDs are to be created for the purpose needed and not in a manner to compromise segregation of duties.
A record of all User IDs and their owners will be maintained by the ISO. See the Change Control Logs for Security for further detail.
Rev.2015.8.6
27 #2..
- 739 -
Security Policies and Procedures
C. Account management
A periodic check will be made of all User IDs and any redundant, dormant or unused IDs will be removed. The ISO must review the privileges set up for User IDs no less than once every year.
D. Application Specific IDs
Application Specific IDs and logins are used in support of automated applications, transactions, processes or batch jobs. These have non‐expiring passwords.
1. Application Specific IDs must not be used by individuals.
2. Application Specific IDs must be created only with the approval of the ISO, must be documented and have strictly limited access rights.
3. Application Specific IDs must not have ad hoc or interactive capabilities on the applications, systems, transactions or data involved.
XII. Authentication and Passwords
A. Overview
All systems, applications, databases or other information repositories shall require users to authenticate themselves prior to granting access. Authentication may be via an approved password scheme or via an access control device. All systems that support 2‐factor authentication must have them enabled.
The authentication method used must suit the value of the information asset, matching the cost of the authentication method against the level of protection required. In general, administrative and other high‐value User or Service IDs will use the most secure methods of authentication.
B. Password format
Must be at least twenty (20) characters in length and must contain characters from all of the following four (4) categories:
1. English uppercase characters (A through Z)
2. English lowercase characters (a through z)
3. Base 10 digits (0 through 9)
4. Non‐alphabetic characters (for example, ! , @, #, $) Rev.2015.8.6
28 #2..
- 740 -
Security Policies and Procedures
C. Rules
Users are forced to create a new password every 3 months. Users must not write down on paper or store any passwords; they must also never share their passwords with other users. Software is provided to securely store user passwords, with encryption.
A maximum 5 attempts will be permitted prior to disabling the account. New passwords must be different from the previous three (3) passwords. Passwords must be changed immediately upon first use of a new ID. Passwords must never be stored or transmitted in clear text. Systems must not echo back the password as it is entered.
Passwords must not be retained by any system or application longer than is needed to grant access. Initial passwords must be transmitted separately from the ID.
XIII. Authorization and Rights Management
A. General Access Roles
Access roles are defined as:
1. Super Admin Access: Access to all front and backend products as well as product metrics
2. Admin Access: Access to all front end products as well as product metrics
3. General Access: Access to product metrics
4. Low Access: Access to corporate email, sales, and marketing data only Amazon Web Services (AWS)
Users who have access to AWS have Super Admin Access. User sessions will expire after one (1) hour of inactivity
Cloudant
Users who have access to Cloudant have Super Admin Access. User sessions do not automatically time out, the user is required to log out at the end of a session.
Github
Users who have access to Github have General Access. User sessions do not automatically time out, the user is required to log out at the end of a session.
ELK Stack
Users who have access to ELK Stack have Admin Access. User sessions do not automatically time out, the user is required to log out at the end of a session.
Rev.2015.8.6
29 #2..
- 741 -
Security Policies and Procedures
Mixpanel
Users who have access to Mixpanel have General Access. User sessions do not automatically time out, the user is required to log out at the end of a session.
Kissmetrics
Users who have access to Kissmetrics have General Access. User sessions do not automatically time out, the user is required to log out at the end of a session.
Salesforce
Users who have access to Salesforce have General Access. User sessions automatically time out after twenty (20) minutes.
Segment.io
Users who have access to Segment.io have General Access. User sessions do not automatically time out, the user is required to log out at the end of a session.
B. Access Rules
User IDs and accounts must be authorized to access only those elements needed for the user’s role, including:
1. Limiting access to datasets and types
2. Limiting access to operating systems
3. Limiting times of access
Access to operating systems, ad hoc transaction capabilities, software development tools, and other system devices must be controlled and limited to only those User IDs which require that access.
Segregation of duties shall be established for all information asset controls to minimize the possibility that one person is responsible for an entire asset.
A user (and hence User ID) that changes role or job function must have access rights updated to match the new job role or function. Any changes will be documented in the Responsibility Change Log.
C. Temporary Privileged Users and Accounts
Temporary privileged users are defined as those who:
1. Have any control over security tools on an application, system or network
2. Can update operating systems or similar tools
3. Can directly modify data within a database or application
4. Have any special capabilities built in by the vendor of the application software, operating system or platform
Rev.2015.8.6
30 #2..
- 742 -
Security Policies and Procedures
Access at a temporary privileged user level shall be granted only on a need‐to‐know, need‐to‐perform basis, and then only to the assets required. Temporary privileged user access shall only be granted to those supporting Virtru’s applications, networks and systems.
D. Assignment and Revocation Procedure
The ISO shall electronically complete:
1. An Employee Access Log for all new hires and/or workforce member change of status.
2. An Exit Checklist for all terminations.
E. Logout After Inactivity
The ISO shall verify that all users have activated a password‐protected screensaver that automatically prevents unauthorized users from viewing or accessing electronic protected information from any system or device that can be used to access electronic information systems. After a maximum of 10 minutes of inactivity the system should log off and lock the device, making information inaccessible. Once logged off a user must re‐enter a password to gain access to electronic protected information.
XIV. Breaches or Impermissible Uses/Disclosures
A. Definitions
Incident is defined as any breach of security, privacy, continuity, legal or regulatory controls over information assets of any type. Examples of such incidents include but are not limited to:
1. Penetrations of systems, applications, networks or databases
2. Denial of service attacks
3. Misuse or mishandling of assets
4. Virus or other malware contamination
5. Transaction errors
6. Breaches of confidentiality agreements or contracts
7. Legal or regulatory violations
Breach is defined as an impermissible access, use or disclosure, which compromises the privacy or security of PHI.
Rev.2015.8.6
31 #2..
- 743 -
Security Policies and Procedures
XV. Breach Response
A. Overview
Virtru will maintain an effective method so that all information users, custodians and owners can readily report incidents.
Incidents will be reported to the person’s immediate manager or the ISO. Once the ISO has been notified, said Officer will then follow the directions in the Incident and Breach Policy.
The ISO will investigate incidents and will log or report significant losses or threats immediately. The appropriate authorities will be contacted by the ISO depending on the severity of incident.
Incidents involving misuse by workforce members will be investigated by the ISO.
Depending on the severity of the incident, the Emergency Contact list may provide additional contacts. See the Emergency Contact List located in the Disaster Recovery Plan.
Confidential Reporting:
Confidential reporting may be done either by:
1. Calling (may leave voice message) the ISO or AISO
2. Sending an email to the ISO or AISO, or;
3. Google Form for anonymous reporting
XVI. Personnel Security
A. Screening for newly hired personnel, third parties, vendors Proper verification checks must be made prior to granting any new workforce member, contractor, vendor, agent or affiliate access to Private, Internal, Confidential or Protected information. These verification checks will meet the requirements set forth by the Company and may include:
Rev.2015.8.6
32 #2..
- 744 -
Security Policies and Procedures
1. Professional qualifications
2. Identity checks
3. Criminal checks
4. Confirmation of academic and professional experience The ISO is responsible for ensuring that background checks are made biannually on parties who are not newly hired workforce members. A third party will conduct background checks.
B. Training and Awareness
Virtru will provide security awareness training to each new member of our workforce with access to electronic Company‐owned or private data (Refer to Data Types information Classifications) whose activities in the business we directly control. The training will be provided prior to that person assuming his/her duties. The training is designed to inform the person of his/her responsibilities under Virtru’s security policies. At a minimum, this training will include the workforce member’s role in:
1. Managing malicious software (e.g. viruses)
2. Using workstation(s) securely
3. Managing passwords and
4. Monitoring and reporting suspicious use of account(s) Virtru’s employees will also be trained annually on Virtru’s Policies and Procedures. A record of successful completion of this training and annual retraining will be kept online by Total HIPAA Compliance.
Within 30 days of starting, individuals who are employed as developers will receive training on the security measures and mechanisms used to protect the company’s systems and service. All new developers will be required to take and pass online training modules covering secure coding when using Node.js. Developers who will be managing or developing operational aspects of the company’s systems will also be required take the Security Operations on AWS training course from Amazon.
A record of training will be kept of training that lists the employee, type of training, date of completion, the employee’s signature, and an admins signature asserting successful completion of the training.
C. Terms of employment
Compliance with Virtru’s policies regarding security and privacy are a condition of employment.
Rev.2015.8.6
33 #2..
- 745 -
Security Policies and Procedures
D. Acknowledgement
All users shall be required to sign an acknowledgement after being trained on Virtru’s security and privacy policies.
E. Exit process for users
Upon exiting employment or any relationship with Virtru, all users who have been granted access to any information asset shall:
1. Relinquish all access to control devices
2. Report all User IDs in use by the person
3. Relinquish all information stored, whether on paper or on backup media
4. Relinquish all information processing devices, including workstations, all Virtru‐owned mobile devices and others
All systems access will be revoked.
The ISO will verify termination is completed, and document this procedure has been followed. See Exit Checklist.
F. Security Sanction Policy
Virtru’s security policies call for the workforce that has access to electronic Protected Employee or Client Data and others to perform certain duties and to refrain from certain actions. Failure to do so will be sanctioned according to the policy below.
If the infraction involves the unauthorized use or disclosure of electronic Protected Employee or Client Data, the sanctions below apply to the designated workforce members including managers, supervisors, and staff who have access to Protected Employee or Client Data.
We define a serious infraction as one that results in known significant damage or that threatens imminent significant damage. Other infractions are simple infractions. The process below is intended as guidance for our business management in sanctioning Security Policies and Procedure infractions. We reserve the right to implement sanctions differently if, in our judgment, the situation warrants it.
First Security Infraction
If the infraction is:
1. A simple infraction, and
2. The first infraction in the last 3 years
The sanction will be retraining the workforce member on the appropriate policy/procedure and placement of a written letter of reprimand in the employee file.
Rev.2015.8.6
34 #2..
- 746 -
Security Policies and Procedures
The letter will notify the person of the nature of this infraction and of sanctions for future potential infractions.
Second Security Infraction or First Serious Infraction
If the infraction is:
1. A serious infraction, or
2. The second infraction of either type within 3 years
The sanction will include a written letter of reprimand that is given to the person at fault, placement of a copy of the letter in the employee file, and one week’s suspension without pay. The letter will notify the person of the nature of this infraction and of sanctions for future potential infractions.
Third Security Infraction or Second Serious Infraction
If the infraction is:
1. A second serious infraction within 3 years, or
2. A third infraction of any type within 3 years
The sanction will be dismissal from the workforce.
XVII. Legal and Regulatory Issues
A. Legal processes
Responses to subpoenas, deposition requests and other legal issues will be referred to and handled by the CEO. The ISO will not respond to such legal processes without company legal counsel.
B. Copyrights and licenses
Virtru may have agreements in place governing the use and handling of software, information and other tools that are owned by other entities. All users and information owners will comply with those agreements.
Users are responsible for complying with copyrights regarding any material obtained via the Internet. This includes files, graphics, software, audio and video materials.
Users may not agree to a new copyright license, unless given permission by the ISO.
Licensed software must be used in accordance with the license agreement and only the number of copies licensed must be created or used.
Rev.2015.8.6
35 #2..
- 747 -
Security Policies and Procedures
C. Export controls
Information may not be exported across country boundaries without prior written approval of the Company’s ISO.
XVIII. Malware and Antivirus
A. Definitions
AntiMalware: malicious software that may reside on a computer, steal information or cause destruction. This can include a virus, trojan horse, keylogger, hijacker or dialer.
Sandbox: A highly controlled area where programs and software can be tested before being allowed access to the rest of the system.
B. Operating system antimalware requirements
Macintosh, Linux and iPhones:
Virtru has determined that software for anti‐malware scanning on Macintosh, Linux and iPhones is not necessary due to the low probability of encountering malware, the demand on computer processing power, and loss of productivity by the user. This policy will be reviewed annually or as needed to determine if this is still valid.
PC Operating Systems:
Data entering Virtru’s Window‐based systems must be subject to an up‐to‐date anti‐malware scanning tool that is scheduled to run at regular intervals. In addition, all emails, attachments, disks, backup media, USB memory devices and other data carrying tools must be scanned before they are downloaded or allowed access to the system. All incoming data must be sandboxed by the anti‐malware program before it is allowed access to the system. The anti‐malware pattern files must be regularly updated.
Android and Windows Phone Operating Systems:
All such devices must have anti‐malware tools in place prior to being connected to Virtru’s networks. These systems must be subject to an up‐to‐date anti‐malware scanning tool that is scheduled to run at regular intervals. In addition, all emails, attachments, and SD cards must be scanned before they are downloaded or allowed access to the system.
C. Affiliates
Virtru and all of its affiliates, contractors, consultants, vendors, representatives or other service providers must make certain that adequate controls are in place to guarantee that data coming from their systems and networks is free from malware.
Rev.2015.8.6
36 #2..
- 748 -
Security Policies and Procedures
D. Infected devices
The ISO will use approved tools to monitor and remove malicious software from Virtru’s assets. Virus‐infected computers, tablets or phones must be removed from the network immediately until they are verified as virus‐free.
E. Employees’ Requirements
1. Workforce members will not load software on our Company’s information equipment without permission from the ISO.
2. Workforce members will not open electronic files from unfamiliar sources.
3. Will exercise best practices when using the Virtru network. The employee will not:
a. Circumvent user authentication on any device
b. Sniff network traffic
c. Access data, servers, or accounts they are not authorized to access d. Cause a disruption of servers
e. Violate copyright law by transmitting copyrighted pictures, music, video and/or software
f. Export or import software, technical information, encryption software, or technology in violation of international or regional export control laws
g. Use the Internet or network in a manner that violates Virtru’s Security Policies, or local laws
h. Intentionally introducing malicious code; including, but not limited to, viruses, worms, Trojan horses, e‐mail bombs, spyware, adware, and keyloggers
The workforce will be trained to know and carry out these malware protections. The ISO will generally provide permissions as required above only for actions that are intended for our Company’s business and only under conditions that limit the potential for the introduction of malware.
F. Enforcement
Any activities with the intention to create and/or distribute malicious programs into Virtru’s networks (e.g., viruses, worms, Trojan Horses, e‐mail bombs, etc.) are prohibited, and user will be subject to Virtru’s Sanction Policy, and will be reported to the proper state and federal authorities.
Rev.2015.8.6
37 #2..
- 749 -
Security Policies and Procedures
XIX. Change Control Logs
A. Preface
The ISO is required to maintain logs of systems that document any changes and access users may have to sensitive systems. The following are the retention policies for these logs.
B. Policy
Audit logs will be retained for at least one (1) year in raw format, preferably electronic, to preserve evidence. Audit logs must be configured to prevent overflow, erasure or tampering. Audit logs will be configured to record information such that:
1. Sufficient information is available for proper investigation of use, misuse, incidents and performance
2. User ID, event type, date and time are maintained
3. Time is according to a known time stamp so that events across systems can be coordinated
4. End‐to‐end accountability is always maintained
Events to be recorded include, but are not limited to:
1. Login and activity by any other privileged accounts
2. Changes to operating systems, application code or other tools
3. Backup and restore events
4. Changes affecting any cryptographic keys or devices
5. Stop or start of critical processes
6. Transaction failure, retry or duplication
All systems and tools involved in the protection process are required to always have change logs enabled and properly configured. This includes:
1. Firewalls
2. Email servers
3. Anti‐malware tools especially the administration tools
4. Security administration tools such as password resets and account modifications
5. Monitoring tools
6. Routers and other network devices
7. Github
8. Amazon Web Servers (AWS)
Rev.2015.8.6
38 #2..
- 750 -
Security Policies and Procedures
9. IBM Cloudant
10. SalesForce
11. Elk Stack
12. Mixpanel
13. KissMetrics
14. Segment.io
15. Sendgrid
16. Customer.io
Logs will be reviewed and analyzed by delegates of the ISO.
Reports of problems and incidents will follow the incident reporting method, listed in the Incident and Breach Policy.
XX. Encryption
A. Preface
Encryption is the process of encoding messages of information is such a way that only authorized parties can read it.
B. Application Encryption Policy
Virtru encrypts all client data using NIST‐approved cryptographic modules. Virtru uses AES 256 encryption for its application. Virtru’s key length requirements shall be reviewed annually as part of the yearly security review and upgraded as technology allows.
The use of proprietary encryption algorithms is not allowed for any purpose, unless reviewed by qualified experts outside of the vendor in question and approved by the ISO.
C. Key Rotation Policy
Virtru requires the following key rotation policy to protect all external systems. The following is the list of policies for the following keys:
1. Secure Socket Layer (SSL)Keys
Virtru uses SSL keys to enable Transport Layer Security (TLS) traffic between clients and Virtru’s servers.
Rotation Policy
Rev.2015.8.6
39 #2..
- 751 -
Security Policies and Procedures
Rotation of SSL Keys is done upon SSL Key expiration. They are set to expire at 1 (one) year and rotated at that time. If there is an incident or the security keys are thought to be compromised, the keys will be rotated immediately.
2. Secure Shell (SSH) Keys
The SSH keys provide a layer of authentication to get into the production servers.
SSH Keys are used as the authentication mechanism to remotely login to a server.
They are also used as the first factor of authentication to assume root access on the production servers. Each developer has his/her own SSH key and is responsible for keeping this key secure.
Rotation Policy
All SSH keys are rotated at a minimum of every three (3) months. If there is an incident or the SSH keys are thought to be compromised, keys will be rotated immediately.
3. Amazon Web Services (AWS) Access Keys
Unique AWS Access Keys are given to each developer with a unique AWS Login.
This allows the developer to make Application Protocol Interface (API) calls to AWS.
Currently, 1‐2 AWS Access keys exist per developer. Where are these stored? How do you know how many keys each developer has?
Rotation Policy
These keys are rotated at a minimum of every 90 days. If there is an incident or the AWS keys are thought to be compromised, keys will be rotated immediately
4. Application Keys
Virtru uses these keys to encrypt sensitive key data stored in the CouchDB database managed by IBM. There is only one copy of this key.
Rotation Policy
No rotation requirement.
Backup Policy
Backup of the key is kept with Virtru’s Super Administrators.
The export of encryption technologies is restricted by the U.S. government. Residents of countries other than the United States should make themselves aware of the encryption technology laws of the country in which they reside.
Rev.2015.8.6
40 #2..
- 752 -
Security Policies and Procedures
D. Device Encryption Policy
Virtru requires devices have encryption enabled for any files, folders, drives, databases, or other stored data that may have sensitive information including protected personally identifiable information.
The implementation of any encryption scheme is performed by the user and the deployment of the encryption tool, including all keys, must meet industry best practices and be properly documented. Currently the minimum standard is 128‐Bit encryption.
Encryption keys will be managed by the user and a log will be maintained by the ISO.
Mac OS Devices:
Mac OS devices that store Protected Information (PHI, CJIS, etc), are required to use full disk encryption using FileVault 2. Users must provide a copy of their key to the ISO; both will maintain the key in a secure location.
For devices that do not store Protected Information (PHI, CJIS, etc), full disk encryption is at the discretion of the user. However, if this is used, a copy of the encryption key will be stored by both the user and the ISO in a secure location.
Windows OS Devices:
Windows OS devices that store Protected Information (PHI, CJIS, etc) are required to use full disk encryption with the program Bitlocker. The encryption key will be maintained in a secure location by both the user and the ISO.
For devices that do not store Protected Information (PHI, CJIS, etc), full disk encryption is at the discretion of the user. However, if this is used, a copy of the encryption key will be stored by both the user and the ISO in a secure location.
Linux OS Devices
Linux OS devices that store Protected Information (PHI, CJIS, etc) are required to use full disk encryption. This will be encrypted at a minimum of 128 bit encryption.
The encryption key will be maintained in a secure location by both the user and the ISO.
For devices that do not store Protected Information (PHI, CJIS, etc), full disk encryption is at the discretion of the user. However, if this is used, a copy of the encryption key will be stored by both the user and the ISO in a secure location.
Rev.2015.8.6
41 #2..
- 753 -
Security Policies and Procedures
Android Devices
All Android devices that store Protected Information (PHI, CJIS, etc) will have encryption turned on and will be password protected at all times. The encryption key will be maintained in a secure location by both the user and the ISO.
Windows Phone
All Windows Phones that store Protected Information (PHI, CJIS, etc) will have encryption turned on and will be password protected at all times. The encryption key will be maintained in a secure location by both the user and the ISO. iPhone
iPhones are natively encrypted. These devices are required to be password protected and/or biometrically protected at all times.
E. WiFi network encryption
All wireless access points owned by Virtru are required to be protected using Wi‐Fi Protected Access 2 with Advanced Encryption Standard (WPA2‐AES). This password will be changed quarterly and will not be shared with users that are not employees or authorized Business Associates. Any outside users are required to use guest access points.
Employees that access Virtru resources from home are required to use Wi‐Fi Protected Access 2 with Advanced Encryption Standard (WPA2‐AES) to protect their devices.
This password should be changed quarterly.
F. Email encryption
Virtru requires the use of its secure, encrypted email service to communicate with our employees about their Personally Identifiable Information, and to communicate any sensitive data. All email communication that includes personally identifiable data, and potentially sensitive data will be encrypted.
Virtru uses only its secure, encrypted email service to communicate with clients about their Personally Identifiable Information.
Virtru forbids the use of chat, texting or instant messaging programs by devices that store PHI.
G. Enforcement
Any workforce member found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.
See Sanction Policy.
Rev.2015.8.6
42 #2..
- 754 -
Security Policies and Procedures
XXI. Assessments and Testing
A. Overview
The Security Rule of HIPAA mandates that covered entities implement appropriate information security policies and procedures to protect PI from "reasonably anticipated threats and hazards."
B. Penetration testing
Penetration testing of all servers containing PII will be conducted monthly by internal personnel, and by an external 3rd party at least annually or whenever there is a major system update. Testing shall validate the security of:
1. External connections
2. Operating systems
3. Applications
4. Databases
5. Network controls
6. Security procedures, including monitoring and incident response C. Vulnerability assessment testing
Vulnerability assessments will be conducted periodically on all network‐connected systems devices. Any vulnerability found must be corrected in a timely manner.
Vulnerability assessments also shall be conducted when:
1. A new system, application or network is installed inside the Company
2. Changes are made to firewalls, VPNs or other security control tools
3. Changes are made to a web server’s operating system
4. Changes are made to email servers
5. Configuration changes are made to databases
6. Configuration changes are made to critical applications
7. Changes are made to encryption scheme(s)
NOTE: Vulnerability and penetration tests will not be conducted except with the prior approval of the ISO. No user will have vulnerability or penetration testing tools loaded onto any Company system without prior permission from the ISO.
D. Wireless access testing
Testing of wireless access points (war‐driving) shall occur regularly, to cover all wireless access points under the control of Virtru.
Rev.2015.8.6
43 #2..
- 755 -
Security Policies and Procedures
E. Password testing
Password cracking software shall be run periodically to validate the enforcement of password rules.
F. 3rd Party Security Management
A comprehensive list of 3rd parties with which the company does business with shall be maintained. Any 3rd party who handles or holds sensitive data or who provides a service which is critical to operations shall be required to assert that their own security practices and procedures meet or exceed that of the company’s. Each 3rd party shall be assessed for conformance annually.
XXII. Use of Email, Internet, Messaging, Public Sites, Blogs, Social Media A. Policy
Confidential, Private or Protected information and Internal Use information must not be transmitted across any unsecured outside network or path without proper controls.
Virtru requires encryption for files and emails, or secured packaging for paper copies.
Users are responsible for ensuring that their use of these tools complies with all of Virtru’s policies, and with applicable laws and regulations. This includes all employment policies such as sexual harassment, stalking, ethics and appropriate use.
These tools may not be used to access, send or receive, store or display:
1. Sexually explicit material
2. Confidential, Private or Protected Information or Internal Use material, except as meets the Handling Rules section
3. Viruses
4. Threats
5. Inappropriate or unlawful language, including:
a. Offensive language
b. Language inappropriate for the Company environment
6. Discriminatory or harassing language
7. Tools usable for hacking, password cracking, vulnerability scanning or penetration testing
These tools are the property of Virtru and are to be used only for Virtru’s business.
Access may be unavailable at any time, at the Company’s discretion. Users must not assume that access to these tools will be available for incidental personal use.
Rev.2015.8.6
44 #2..
- 756 -
Security Policies and Procedures
All content transmitted over these tools is the property of Virtru. Content, including emails, may be inspected by Virtru. Such inspections will occur with the approval of the ISO or of the Company legal department. Virtru may monitor, filter or block content on these tools.
Users of blogs, social media sites such as Facebook, and other such tools must follow the guidelines outlined in Virtru’s Social Media Policy. See Social Media Policy.
Users of blogs, social media sites such as Facebook, and other such tools must not represent their comments as coming from, or being representative of, the business or opinions of Virtru.
XXIII. Hardware
A. Definitions
Workstations: PCs, desktop computers, tablets and mobile computing devices that are located at Virtru’s home office, or at remote locations. These devices are easily attacked and therefore must have access controls and anti‐malware as specified in those sections of this document.
Servers: Devices that may or may not be housed at Virtru locations. Regardless of their location, these must secured in a manner that prevents them from being physically accessed without the appropriate level of security clearance.
B. Policy
A current copy of the Organizational Chart/Electronic Asset Management Log (Risk Assessment) will be kept at an off site location so it can be accessed quickly in the case of theft, fire, flood or other events that may make inventory information useful.
The ISO will keep a log of events noting when a physical security mechanism is repaired, replaced, installed, removed, modified, or maintained. This Maintenance Log will contain the: who, what, when, where, and why of the change and be kept in the Security Documentation Library.
Users of these devices are required to ensure that all appropriate protections are in place, including:
1. Physical security to prevent theft or misuse
2. Access controls suitable for the class of information on the device
3. Anti‐malware
4. Keeping the devices locked to a desk or other secure location when outside Rev.2015.8.6
45 #2..
- 757 -
Security Policies and Procedures
Virtru
5. Keeping control over backup media, as to minimize the possibility of theft or loss
6. Ensuring that the transport of these devices is secure and is safe from damage ‐ for example, these devices should only travel in padded containers and should be locked and shut down during transit
7. Keeping all operating systems and tools up‐to‐date, with all updates and patches. Specific requirements for these topics are in the appropriate sections of this document
Virtru’s devices must not be used by people who are not authorized, including family members and friends.
Software loaded onto such devices must follow the rules in the Software section of this document. In general, only approved software may be loaded, and shareware, games and other such software are not permitted.
International travel with these devices may require special approvals or configurations, especially in regards to encryption and licensed software. Before traveling internationally, users must contact the ISO to determine if such special considerations exist.
Connecting these devices to Virtru’s networks must follow the rules in the Networks section of this document. In general, all such devices must be approved prior to connecting.
Remote access from these devices to Virtru’s networks and devices must meet the controls specified in the Networks section of this document. In general, such access must be approved, and must have adequate controls over the security of information in transit.
Devices of these types that are owned by contractors, vendors or other third parties must meet all Virtru requirements prior to being connected.
C. Asset management
The ISO is responsible for maintaining an inventory of devices; as such he shall employ software to aid in the management of hardware and software asset. See Handling Rules for the information classifications
Rev.2015.8.6
46 #2..
- 758 -
Security Policies and Procedures
D. Enforcement
Any workforce member found to have violated this policy may be subject to disciplinary action, up to and including termination of employment. See Sanction Policy.
XXIV. Networks
A. Overview
Virtru’s networks and devices shall designed, deployed and operated in a manner so as to provide proper levels of protection for the data being accessed and transported.
Significant changes in network designs must be piloted before deployment.
Mechanisms must be in place to alert the ISO of possible attacks and breaches, to include:
1. Denial of service attacks
2. Improper access
3. Virus infections
4. Unauthorized software installations, email, FTP or other improper usage Analysis must be conducted at least annually to validate the failure mode and recovery for all devices, network circuits and protocols. See Change Logs for details.
Responsibilities must be defined for:
1. Administration of network and communications connections
2. Operations of all devices
3. Monitoring
4. Timely review of audit logs and response to alerts or alarms
5. Review of unusual patterns of usage or activity
To minimize risks, any network connections or network segments should be disconnected when not in use.
B. Monitoring
Virtru uses AlienVault’s Unified Security Management System to monitor all traffic on their network. Notifications are set to alert the IT staff of any unusual traffic and vulnerabilities, as well as log any security events that may occur.
C. Access control and physical security
Sites where Virtru’s network equipment or communications lines exist are considered to be high‐value and are subject to the access control and physical security rules Rev.2015.8.6
47 #2..
- 759 -
Security Policies and Procedures
outlined in the Physical Security section of this document. In general, these rules will require:
1. Access limited to authorized personnel only
2. Physical security, including RFID or passcode controlled locks, are in place D. Modifications, updates
Changes to the network architecture which affect the protections must be approved by the ISO. Examples of such changes include firewalls, wireless configurations, ports and proxies.
E. Documentation
The ISO shall maintain an accurate set of documentation of the networks and their components. This documentation is considered to be highly valuable and will be classified “Protected”.
F. Network design
The goal for network design is to facilitate Virtru’s business, while still providing protection for Company assets.
G. Segmentation
Virtru’s networks will be segmented, in order to limit access to Confidential and Protected Information, without impacting the Company’s business. There will be a guest network that will have no access to Virtru’s Network Attached Storage, and other vital network resources.
H. Firewalls
Virtru’s network and workstations in the DC office is protected using the Fortinet FortiGate 100D Firewall appliance. This device is configured to monitor and log all unusual traffic and warn Virtru of any network irregularities or attacks.
Definitions
Firewall: A part of the computer operating system or network that is designed to block unauthorized access while permitting outward communication. There are two different types of firewalls.
1. Software Firewall: Part of the operating system or can be a software add‐on.
2. Hardware Firewall: Built into a router or a stand alone device. All computing devices will access a network through this point.
Firewall Settings
1. Whitelisting: Blocks all incoming traffic, and only allows traffic from good, or known IP addresses. The user will be required to authorize connections to their device.
Rev.2015.8.6
48 #2..
- 760 -
Security Policies and Procedures
2. Blacklisting: Authorizes all traffic as a default, and the user is responsible for denying unauthorized connections to their computing device from unrecognized or unknown IP addresses.
Software Firewall Policy
Virtru requires every device to have their internal software firewall activated at all times, and set to only allow whitelisted traffic. This will require the user to authorize any connections to their device. Any workforce member found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.
I. Internet
Connections to the Internet must be:
1. Approved by the ISO
2. Periodically reviewed and tested for vulnerabilities
3. Protected by firewalls, intrusion detection systems and anti‐malware tools Some Internet tools, such as FTP, Internet Relay Chat, Telnet and Remote Procedure Call are restricted in use and must be approved for use by the ISO.
J. VPNremote access
Virtual private networks (VPNs) will be used for traffic flowing over public networks to ensure the proper level of protection of Virtru’s data.
K. Wireless
All wireless connections must have WPA2 with Advanced Encryption Standard (AES) turned on. This applies to all networks for Virtru’s home office, and all telecommuting employees.
L. Telework Policy
If a staff member is allowed to telework/telecommute, they must comply with the Virtru’s various employment policies, remote security measures and use the provided web portal via HTTPs, VPN and SSL. They must also make sure their home WI‐FI is encrypted properly.
If they are accessing sites while on an unsecure router, they must make sure the sites they visit have a valid SSL certificate before proceeding.
M. Patching of systems and applications
Microsoft Windows OS Patches
Rev.2015.8.6
49 #2..
- 761 -
Security Policies and Procedures
To manage the patching of Microsoft Windows operating systems (OS), Windows Software Update Service (WSUS) is used. The WSUS server automatically checks for patches once a day not during business hours. Then downloaded patches are manually released from the WSUS server to be downloaded and applied on the workstations. The ISO will evaluate all patches before they are applied; workstations will not automatically download OS patches from the WSUS server and updates will not be automatically installed. Installation of OS patches is done within a planned downtime.
Apple OS Patches
All Macintosh Operating System (OS) patching will be done through the App Store, and is the responsibility of the individual user to install. These should be applied within one (1) week of release from Apple.
Linux OS Patches
These patches should be applied and tested in an app staging environment before they are applied systemwide. The User is required to document where they received the patch, who downloaded it, what version of patching they are using, and when the patch was applied to the system. This documentation should be submitted to the ISO upon completion of the patching.
iPhone iOS Patching
All iPhone (OS) patching will be done through the App Store, and is the responsibility of the individual user to install. The device should be fully backed up prior to installing these patches either in the cloud or locally. All backups are required to be encrypted and password protected. These patches should be applied within one (1) week of release from Apple.
Android Phone Patching
All Android patching will be done through the Google Play Store, and is the responsibility of the individual user to install. The device should be fully backed up prior to installing these patches either in the cloud or locally. All backups are required to be encrypted and password protected. These patches should be applied within one (1) week of release from Google.
Windows Phone Patching
All Windows Phone patching will be done through the Windows Phone Store, and is the responsibility of the individual user to install. The device should be fully backed up prior to installing these patches either in the cloud or locally. All backups are required to be encrypted and password protected. These patches should be applied within one (1) week of release from Windows.
Rev.2015.8.6
50 #2..
- 762 -
Security Policies and Procedures
Patching of applications is done on a weekly basis, unless a zero‐day exploit is found in an application that is used within the domain. If such an exploit is found and a patch is released for said exploit, an emergency planned downtime will be called for at the conclusion of the business day to patch the application in question.
N. Network hardening
Upon adding new devices to the network, installation procedures and set‐up must be followed. Hardening will be done on network devices as well as systems (e.g. laptops, workstations and servers) and handled by the ISO or AISO.
Hardening will be broken down into the following categories which include, but are not limited to:
1. Preparation and installation
2. Updates to: software, firmware and hardware
3. Setting of appropriate account and auditing rules
4. Setting of appropriate security rules
5. Turning on the internal firewall
6. Turning on full disk encryption (If device will have access to PHI)
7. Other internal operations such as:
a. Installation of appropriate software for workstation, server or laptop The ISO will notify all affected staff when making changes to the hardening policy and will update the Security Policies and Procedures at that time. Written approval for hardening procedures above and beyond what is currently mandated is not necessary.
XXV. Physical and Environmental Protections
A. Definitions
Secure sites: These are locations that require the highest level of protection. These sites include:
1. Computing centers
2. Network connection points
3. Media storage locations
4. Locations containing platforms which carry high‐value or critical information or transactions
Rev.2015.8.6
51 #2..
- 763 -
Security Policies and Procedures
Physical Security: These may occur within Virtru where the overall building is operated to a lower level of security, but a certain area is more controlled due to documents, assets or processes which occur in that area.
B. Secure Sites Policy
Secure sites shall be established for all computing centers and other locations where there is a concentration of high‐value or sensitive information, systems or networks.
Sites will be designed and operated according to best practices and in consideration of threats appropriate to the site such as hurricanes, tornados, power outages and intruders.
This standard is not to be construed as a complete list of requirements for a secure site.
It should be used in conjunction with expert advice, architects, fire marshals, OSHA and other regulations.
Separate, isolated areas will be created within the secure site for:
1. Media libraries
2. Electrical supplies and controls
3. Environmental and mechanical controls
Access to these sub‐areas will be on a need‐only basis. Critical assets and operations must be conducted in a secured area or secured site, with protections implemented in accordance with the risks and value of the assets, information and operations.
C. Data Centers
All data centers used by the company must provide proof that they meet or exceed the security requirements and standards of the company.
XXVI. Physical Security Policy
A. Entry Policy
All Virtru’s workforce members are allowed access to the physical site at any time of the day, and any day of the week. The site is secured with an electronic door lock that accepts RFID cards and a numeric passcode. RFID cards are issued by the ISO or AISO by request and after approval.
B. Loss of RFID key
If a workforce member loses their RFID key, they will notify the ISO or AISO as soon as possible so the key may be deactivated. Any workforce member found to have violated Rev.2015.8.6
52 #2..
- 764 -
Security Policies and Procedures
this policy may be subject to disciplinary action, up to and including termination of employment. See Sanction Policy.
C. Mobile devices
Mobile devices (laptops, netbook, tablets, iPhones, iPads, etc.) must have the appropriate encryption. Devices must have a power‐on password or PIN, data encryption, auto‐lock and role‐based access per user. See BYOD Policy (Forms for Employees).
D. Video monitoring
Virtru’s main office is monitored by a video camera. The data is stored in the Network Attached Storage which is physically secured in a locked cage in the IT closet. This data is stored for up to one (1) month.
E. Alarm system
Virtru’s main office is monitored by an alarm system. It is attached to all doors and windows, and requires a 4‐digit pin plus a modifier to deactivate. Once triggered, there is a 45‐second delay before the local authorities, ISO and CEO are notified by the monitoring company. ADT is the company that is responsible for monitoring Virtru’s main office.
The alarm pin code is changed quarterly, or at the time that an employee is fired or leaves the Company.
Virtru requires that this alarm be set by the last person to exit the office, and should be active anytime there is not an authorized employee on the premises.
F. Fire protection
Fire protection meet all regulations, including federal, state and local. Fire extinguishers shall be deployed in accordance with regulations of OSHA and fire inspectors. Periodic testing of alarms, fire extinguishers and fire evacuation procedures shall be conducted.
XXVII. Software
A. Overview
This section outlines the standards applying to operating systems, applications, databases and other software tools.
Rev.2015.8.6
53 #2..
- 765 -
Security Policies and Procedures
B. Acquisition of software
It is up to the developer to decide which software tools they will require for their workstation. All regulated software will only be download from trusted sources, such as the Apple App Store, Windows Store, or directly from reputable websites, etc.
Unregulated software is allowed, but must be fully documented and approved for use by the ISO. Documentation will include:
1. The source of the software
2. When it was downloaded
3. Who downloaded it for use and;
4. The date the ISO approved the use of the software
All software for Windows OS devices is required to be screened for malware prior to installation.
Any unauthorized software must be approved and validated, or removed.
Users of workstations, netbooks, wireless and other personal devices must not install unapproved software.
C. Open Source Software
The use of open source shareware or open source freeware may only occur if:
1. It is not used in a production environment OR
2. Prior to use it is fully tested, documented and Virtru’s personnel are assigned to support it. Checks to be performed include:
a. Verify usage license (no strong or weak copyleft licenses) b. Review open CVEs and available patches
c. Perform internal security evaluation
d. Flag for external security evaluation during next penetration test
3. The source of the software is documented
a. URL
b. Project lead
c. Contributors
d. Whether the project is actively maintained
4. The ISO approves of the use
D. Documentation
Documentation for sensitive applications and the operating systems which run those systems shall be stored securely. Backups of all documentation shall be maintained off Rev.2015.8.6
54 #2..
- 766 -
Security Policies and Procedures
site. Access to the documentation for sensitive applications and the operating systems will be on a need‐to‐use basis.
E. Change Control and Maintenance
All proposed changes to production systems must be registered in the companies issue tracking system. Changes shall be categorized as standard, normal, or emergency.
Standard changes are those that are performed frequently and considered low risk.
Standard changes are reviewed quarterly and pre‐approved for the following quarter.
Normal changes are those which are not performed frequently and may pose some risk to the business. Each normal change must be reviewed by a minimum of two super‐admins, the CTO and/or VP of engineering prior to being made. Reviewers are responsible for assessing the impact of the change in regards to the functionality, availability, durability, and security of the system. If a consensus among reviewers is reached, the proposed change is sized, sorted, and executed through the standard engineering workflow. Emergency changes are those that are required to rectify some form of degradation of the system. Emergency changes must be reviewed by a minimum of two super‐admins. If a consensus is reached, emergency changes can bypass the standard engineering workflow and be made immediately. All changes to production systems must be captured in the company’s issue tracking system without exception.
F. Operating Systems
Only approved operating systems will be loaded onto Virtru‐owned assets. Before major upgrades to systems, authorization by the ISO and AISO will be required.
Default settings must be reviewed prior to installation to identify any security vulnerabilities. These settings will be communicated with all workforce members, or they will surrender their devices to the ISO or AISO for configuration.
G. Applications
All applications, whether developed or purchased, must comply with Virtru’s policies and protection standards. The information owner is responsible for ensuring that these requirements are included during the development or acquisition of software.
The protection requirements for applications include:
Rev.2015.8.6
55 #2..
- 767 -
Security Policies and Procedures
1. Access control
2. Authorization
3. Information classification
4. Storage controls
5. Backup and restoration
6. Confidentiality and integrity requirements
7. Audit logs
8. Privacy, export control and other such requirements
All product associated applications must use HTTPS to communicate with all remote hosts, both Virtru hosted services and external third parties. HTTP and other non‐encrypted communications are not allowed under any scenario.
Virtru applications shall treat user credentials with the utmost sensitivity and must follow security best practices for storing and transmitting user credentials. All credentials which are shared with a client device must be sent over HTTPS or another encrypted communication channel. All user credentials which are stored in a data store, must be stored in a benign state so that leakage of information from the data store does not compromise user accounts.
All application logs must be sent to a central logging cluster for aggregation and analysis.
H. Configuration Management
Where possible, Virtru applications and infrastructure follow an immutable paradigm.
All changes to production infrastructure and application code is deployed on a brand new Amazon Machine Image (AMI). This allows all changes which are deployed to be tracked and audited. This also means that no configuration or application code will be modified on a production instance. All application servers have osquery installed and configured to monitor key files on the system for any change (File Integrity Monitoring). Any changes to configuration are logged and sent to AWS Cloudwatch Logs, where they trigger an alarm and cause an email to be sent to the Virtru DevOps team for further investigation.
Where possible, Virtru utilizes Terraform, Ansible, and other similar tools to define their infrastructure as code. This allows the production infrastructure to be versioned in a git repository and easily audited for change over time.
I. Asset management for software
The ISO is responsible for maintaining an inventory of software; as such it shall employ software to aid in the management of software assets.
Rev.2015.8.6
56 #2..
- 768 -
Security Policies and Procedures
J. Enforcement
Any workforce member found to have violated these policies may be subject to disciplinary action, up to and including termination of employment. See Sanction Policy.
XXVIII. Removable Media Device Policy
A. Purpose
The purpose of this policy is to minimize the risk of loss or exposure of Confidential or Protected Information maintained by Virtru when it is stored, transferred or accessed on a removable media device. This policy also aims to reduce the risk of acquiring malware infections on computers operated by Company. Any questions or comments about this policy should be directed to the ISO
B. Scope
This policy covers all removable media that contains Virtru’s data or that is connected to Virtru’s network.
C. Definitions
Removable media: devices or media that is readable and/or writable by the end user and are able to be moved from computer to computer without modification to the computer. This includes flash memory devices such as thumb drives, SD cards, cameras, MP3 players or any other storage medium; removable hard drives (including hard drive‐based MP3 players); optical disks such as CD and DVD disks.
Encryption: a procedure used to convert data from its original form to a format that is unreadable and/or unusable to anyone without the tools/information needed to reverse the encryption process.
Malware: software of malicious intent/impact such as viruses, worms, and spyware.
D. Policy
Workforce members may use removable media in their work computers if they take all reasonable and prudent measures to ensure the safety and confidentiality of all information that is downloaded to any removable media or portable device E. Using Removable Media Devices
PHI should be stored on removable media only when required in the performance of assigned duties or when responding to legitimate requests for information. When Rev.2015.8.6
57 #2..
- 769 -
Security Policies and Procedures
Protected and Confidential information is stored on removable media, it must be encrypted in accordance with Virtru’s Encryption Standards.
The workforce member shall take all reasonable and prudent measures to physically secure all removable media or to portable devices. Users shall not open or attempt to open the encasement of any removable media or portable devices nor otherwise circumvent any lock system that secures the device or its components. Users should take reasonable measures to secure device at all time and report any lost or stolen removable media or portable devices immediately.
Workforce members may not copy information or other sensitive data onto personal devices, unless approved by management in conjunction with the Confidentiality Agreement for Employees.
F. Exceptions
Exceptions to this policy may be requested on a case‐by‐case basis by petition to the ISO.
G. Refusal
Virtru reserves the right to refuse the ability to connect removable media devices to the Company network if such media is being used in such a way that puts Virtru’s systems, data, users and customers at risk.
H. Enforcement
Anyone found to have violated this policy may be subject to disciplinary action, up to and including suspension of access to technology resources or termination of employment. A violation of this policy by a temporary worker, contractor or vendor may result in action up to and including termination of their contract or assignment with Virtru.
XXIX. Application Recovery Plan
A. Overview
Virtru backs up of all production data hourly and stores it remotely on two separate Amazon Web Server (AWS) Accounts. These backups are a combination of both differential and full backups. These backups are durable a the same rate as S3 data, each snapshot is 99.99999% durable.
B. Scope
These policies apply to all production servers and data that Virtru is responsible for maintaining on behalf of our clients.
Rev.2015.8.6
58 #2..
- 770 -
Security Policies and Procedures
C. Data durability and reliability
Virtru uses Amazon S3 to provide a highly durable storage infrastructure designed for mission‐critical and primary data storage. Amazon S3 redundantly stores data in multiple facilities and on multiple devices within each facility. To increase durability, Amazon S3 synchronously stores Virtru’s data across multiple facilities before confirming that the data has been successfully stored. In addition, Amazon S3 calculates checksums on all network traffic to detect corruption of data packets when storing or retrieving data. Amazon S3 performs regular, systematic data integrity checks and is automatically self‐healing.
D. Encryption
Virtru uses Server‐side encryption to protect data at rest. Server‐side encryption with Amazon S3‐managed encryption keys (SSE‐S3) employs strong multi‐factor encryption by encrypting each object with a unique key. As an additional safeguard, it encrypts the key itself with a master key that it regularly rotates. Amazon S3 server‐side encryption uses 256‐bit Advanced Encryption Standard (AES‐256) to encrypt Virtru’s data.
E. Load balancing
Virtru uses Amazon Web Services’ Elastic Load Balancing (ELB) to automatically distribute incoming application traffic, to automatically route traffic across multiple instances. and multiple Availability Zones. This is used to insure that only healthy servers are receiving traffic.
F. Restoration of data
Restoration of production data is done on an as‐needed basis. The following employees are responsible for restoration of the application if it is needed:
1. Reuven Gonzales, Lead Developer, or
2. Conor Gilsenan, Developer Ops.
The needed backup data will not be restored “on top of” the current “bad” data. The restores will be redirected to a new location, and first verified. Upon verification, the “bad” data will be removed from the drive, and stored and relabeled as “old data.” Then the backup data will replace the “old data” on the drive. Once the restored data has been verified once more, the “old data” will be destroyed.
G. Testing and revision of plan
Once every quarter, after doing a full backup, Virtru will recover the saved data. During hours when the business is closed, we will operate the application using this recovered data in a test mode. The tests will consist of a set of tasks that are designed to exercise the main system functions to confirm that the data is usable and as up‐to‐date as we expected given the backups that were used to do the recovery. This testing process Rev.2015.8.6
59 #2..
- 771 -
Security Policies and Procedures
should take an hour. The restore process should take an hour or two, once the files are retrieved.
If the process does not work as documented in our policy, it will be updated to reflect the actual procedure we need to implement to achieve successful recovery and operation.
Whenever we make changes to software or hardware, we will create/update and test using our Inventory of Devices/Software Assets and store this checklist in the Security Documentation Library.
XXX. Network Attached Storage and Workstation Backup Plan A. Overview
Virtru recognizes that the backup and maintenance of data in the Network Attached Storage (NAS) and individual workstations are critical to operations. It is essential that certain basic standard practices be followed to ensure that data files are backed up on a regular basis.
B. Policy
Virtru will be using a Synology DS1515+ Network Attached Storage for backing up all workstations, firewall logs, and video surveillance footage. This data will also be backed up to a Amazon Web Services Glacier account.
C. Backup software
Virtru uses Cloud Station software to perform all backups. This will be installed on all workstations and must not be disabled by the user for more than one (1) business day.
The software will maintain one month of file versions for restoring purposes D. Remote backups
Virtru will provide a Virtual Private Network (VPN) for employees to login to for backing up their devices. Credentials for the VPM will be provided to remote employees, and they will be expected to configure their devices properly. If they are unsure, or have issue in setup, the IT department will be available for configuration assistance.
E. Local backups
Virtru encourages all users to do daily local backups of their data. These backups are to be encrypted using the encryption standards listed below. Any local backups must be surrendered at the time an employee no longer is employed by Virtru.
Rev.2015.8.6
60 #2..
- 772 -
Security Policies and Procedures
F. Encryption of backups
The backups of data will be encrypted on the NAS using AES 256 bit encryption. Any local backups that employees make must be encrypted at a minimum of 256 bit encryption.
G. Restoring data
In the event that a workstation fails, is stolen, or is damaged whether physically or by malware. It is the policy of Virtru that this device will be replaced within 24 hours. The IT department will be responsible for reprovisioning this device, and testing that the workstation is functioning properly before giving the device to the employee.
H. Enforcement
Anyone found to have violated this policy may be subject to disciplinary action, up to and including suspension of access to technology resources or termination of employment. A violation of this policy by a temporary worker, contractor or vendor may result in action up to and including termination of their contract or assignment with Virtru.
XXXI. Information Integrity Management Policy
A. Overview
The other policies in this document contribute to the integrity of the data in our systems. Notably, the Data Backup Plan, the Access Control Policy, and the Malware Management Policy contribute to data integrity. In addition to these, we add the following policy elements.
B. Policy
Virtru will configure our applications software to use the available edits on data that is entered into our systems. These edits will check for internal data consistency, reasonableness of data, and logical relations among data items.
XXXII. Security Incident Management Policy
A. Overview
Virtru recognizes that, despite having reasonable security safeguards, we may have security incidents.
B. Procedures
To manage these incidents, Virtru will do the following:
Rev.2015.8.6
61 #2..
- 773 -
Security Policies and Procedures
1. We will train each workforce member to recognize the common telltale signs of a security incident. When a member of the workforce detects one of these signs, he/she will be responsible for notifying the ISO.
2. The ISO will maintain a set of tests to detect events in the system logs that may indicate security incidents. These tests will be written into a script and run against the system log on a daily basis or whenever needed. The tests currently are:
a) Account creation/deletion
b) High volume of unsuccessful logon attempts
c) Alerts from our malware monitoring systems
d) High volume of file or database access/creation/deletion activity for the time of day, or for day of the week
e) Account activity at unusual times of the day or night f) Absence of expected log records of activity when expected g) Unusual level of record access for a given account
h) Daily logs will be tested by the firewall in real time, i) User data will be reviewed weekly
j) Logs for the past month will be retained. When anomalies are discovered, the script will provide a report that is immediately brought to the attention of the ISO or designee as a potential security incident. k) Account lock out due to excessive password retry failure.
The ISO will determine, in consultation with others if needed, whether an event is a security incident.
If an event is a security incident, the ISO (or designee) will proceed to contain and repair damage from the incident by working with staff, vendors, and Business Associates as needed. The security incident will be tracked in JIRA and treated as an application defect. A log of relevant actions taken to contain and repair the damage will be stored in JIRA. The permanent home of this log will be in the Security Documentation Library. The ISO will determine if the event involves a workforce member action that is covered under the sanction policy and will follow that policy. The ISO will determine if the event represents a security incident for which a Business Associate is responsible. If so, the ISO will follow our Incident and Breach Policy in this area.
Rev.2015.8.6
62 #2..
- 774 -
Security Policies and Procedures
C. Policy
If an event is a security incident, the ISO (or designee) will proceed to contain and repair damage from the incident by working with staff, vendors, and Business Associate relations in order to further deter future incidents of the same type.
XXXIII. Security Plan Review Policy
A. Overview
We recognize that our underlying security risk will change and our ability to manage this risk will improve over time. To ensure that we adjust our policies and procedures to take these two factors into account, we will review our Security Policies and Procedures annually. The ISO will lead this review and involve others as needed.
Documentation of the review will be contained in a document called Annual Security Review and restored in the Security Documentation Library {or Notebook}.
B. Procedures
At a minimum, the review process will consist of:
1. Evaluating changes in the last year that may affect our Security Policy. These will include changes in:
a) Number, sizes or locations of our business sites
b) Our workforce size and composition
c) Hardware/software
d) State or federal laws that apply to us
e) Type of medical insurance that we provide
2. Reading each Policy to determine whether or not the changes may affect it and/or the practices driven by the Policy. We will make a list of changes that need to be made, then write a paragraph describing how.
3. Creating a list of changes in Policies and/or Procedures that our Company will carry out.
4. Developing and implementing any changes in our Policies and Procedures on a timely basis.
Rev.2015.8.6
63 #2..
- 775 -
Security Policies and Procedures
Rev.2015.8.6
64 #2..
- 776 -
Security Policies and Procedures
Appendices
Rev.2015.8.6
65 #2..
- 777 -
Security Policies and Procedures
A. Change Logs
The Change Logs are logs and reports that are reviewed, at a minimum, twice a year. It provides information on programs available and which employees have access to which programs. The actual logs are found in the Change Control Logs for Security section of the documents.
1. Annual Security Review
2. Application/Database Change
3. Employee Access
4. Incident ‐ Disaster
5. Maintenance
6. Media Sanitization
7. Operating System Changes Audit
8. Organizational Chart/Electronic Asset Management
9. Network Change
10. Physical Entry Access
11. Responsibility Change
Rev.2015.8.6
66 #2..
- 778 -
Security Policies and Procedures
B. Information Security Committee
Information Security Officer:
Will Ackerly
[email protected]
(202) 577‐3683
Information Security Committee:
Jordan Duggan
[email protected]
(919) 696‐7936
Reuven Gonzales, Director of Operations
Cell: (949) 878‐6154
[email protected]
Conor Gilsenan, Operations Developer
Cell: 973‐986‐6650
[email protected]
Rev.2015.8.6
67 #2..
- 779 -
Disaster Recovery Plan for Virtru
We define a disaster as any event that affects our information systems and, as a result, substantially interferes with the operations of our business. Examples are fire, flood, hardware failure of critical elements (servers), software failures, theft, chemical/radiation hazard, and sabotage. Our definition of recovering from a disaster is taking all the actions needed to restore the systems to their normal operational state. Our plan to recover from disasters is described below.
1. What we will do to prepare to perform a disaster recovery:
A. We will train the workforce to recognize and report a disaster.
B. We will organize the workforce responsibilities so that during a recovery we are not dependent on only one person for any critical step.
C. We will report disasters to the ISO and AISO. The ISO will make the formal determination as to whether or not to classify the event as a disaster.
D. We will store paper backup copies of key disaster related documents with the offsite backups. These documents will include a List of Support Contacts – vendor, reseller, and/or support group contact information for all of our software and hardware.
E. We will keep an Inventory of Device/Software Assets for [Name of Business]–– a detailed checklist for each asset, such as the server, PCs, the router, network switch, databases, and software programs containing tasks that must be completed to recover that asset. The list will include key data about the device including a party responsible for the recovery whose role is to diagnose and, if needed, repair, replace, and/or rebuild a device.
F. We will have current copies of system data and software available at the off site location, as our data backup plan specifies. 1 #2..
- 780 -
2. Once the ISO (or designee) has certified a disaster, we will:
A. Use the ISO or designee to facilitate the recovery. The facilitator will direct the recovery process, coordination and communication of the actions of the various parties that are involved in the recovery.
B. Determine which devices/software (e.g. servers, PCs, power units, AC units) are not functioning normally, conferring with the appropriate staff, vendors, and other support personnel to make this determination. When in doubt about the status of the device, we will either use a test that is described in the IT Assets Recovery Checklist for the device/system or depend on the recovery responsible party to make this determination.
C. Review the Inventory of Device/Software Assets for the devices to be recovered. Each checklist will have as an initial task, “Contact the appropriate parties responsible for restoring the devices/software to be recovered.“ Guidance and other recovery activities from these parties are key contributors to the recovery process.
D. After all of the non‐functioning assets have been restored, follow the instructions in the part of the Emergency Operations Plan that deals with what to do when the system is available again.
2 #2..
- 781 -
Organization
Emergency Planning & Crisis Management Team (EPCMT):
菌 Will Ackerly, CTO & ISO
菌 Jordan Duggan, VP of Product & Development & AISO
菌 Reuven Gonzales, Director of Operations
菌 Conor Gilsenan, Operations Developer
菌 Zack Nelson, Director of Development
Primary Disaster coordination handled through:
Crisis Manager 1:
Reuven Gonzales, Director of Operations
Cell: (949) 878‐6154
[email protected]
Crisis Manager 2:
Conor Gilsenan, Operations Developer
Cell: 973‐986‐6650
[email protected]
Other Members’ Contact Information
菌 Zack Nelson 443‐834‐3791
菌 Payam Abedi 703‐656‐6227
菌 Tyler Biscoe 301‐642‐8844
菌 Jon Gilpen 303‐358‐6689
菌 Jason Ghent 803‐658‐6645
OffSite Meeting Location
Used if team needs to meet to formulate an action plan.
If primary location is not accessible, we may need to operate from an offsite locations such as:
Employees’ Home Offices
Jack Rose Restaurant
Extended off‐site locations will be determined after assessing the severity of the disaster.
3 #2..
- 782 -
Disaster Recovery Timeframes
Maximum Tolerable Downtime (MTD)
The total amount of time our company is willing to accept for an outage or disruption, including all impact considerations. This guides our Crisis Management Team in determining the selection of an appropriate recovery method, and the depth of detail which will be required when developing recovery procedures, including their scope and content.
Recovery Point Objective (RPO)
This is the point in time, prior to a disaster or disruptive event, which our company has accepted for data loss. RPO determines the frequency of our data backups. When determining RPO, we need to consider how much newly entered data we can afford to lose. Therefore, if RPO is set to 4 hours, then we must have offsite backups maintained every 4 hours.
Recovery Time Objective (RTO)
RTO determines the target time for recommencement of business activity. The Crisis Management Team will determine what business functions (i.e. telecommunications, web servers, etc.) should be restored based on priority.
Working Recovery Time (WRT)
This is the time our company will spend recovering lost data and work backlog, and testing and verifying data and systems. WRT usually is the difference between MTD and RTO.
4 #2..
- 783 -
(See next page)
5 #2..
- 784 -
Disaster Timeframe Expectations
Internal Network
The server and network must be functioning in order for any of our other information systems to function. We could afford to be without the server/network for ten (10) minutes without materially affecting our business. If the server/network is down for longer than ten (10) minutes, staff will switch over the mobile tethering, or will go to an approved location to continue their work.
Production Servers
Production servers must be functioning at all times in order for our applications to work. We cannot afford to be without the production servers without materially affecting our business. Traffic will be automatically routed to another server via Amazon Web Services’ Elastic Load Balancing.
Workstations
If a workstation crashes, we can easily use another one with only modest inconvenience. Ideally, we would like to replace/restore a workstation within 72 hours.
Printer and Fax
We have two multifunction printers. We can lose all printers for up to a week with little effect on data flow.
Email and Web Browser
Currently, we can function for no more than 10 minutes without email or web browsing. We will tether devices via smartphones after that time.
Wireless Network
We have a wireless network and the office depends on it for routine transactions. A backup router is available; it is preconfigured and encrypted using WPA2‐AES.
IT Resources
We depend on the availability of certain employees and our IT service provider to diagnose and fix problems quickly. A chain of contacts is available in this document.
Power and HVAC Equipment
We depend on external power and environmental equipment (especially our AC unit) to maintain the power and environmental support for our system. Failure of either of these systems could inhibit the use of our IT systems, and could also stop us from doing business. These failures are not IT‐specific risks. We are comfortable enough with the track record of these services not to need more than a short term UPS to allow us to smoothly shut the network down in the event of a sustained power outage. We have to yearly revisit the question of whether or not we need 6 #2..
- 785 -
more power/environmental backup to ensure that the satellite site will able to operate even if power/cooling at the main site is out.
7 #2..
- 786 -
Disaster Timeframes Table
{This is a sample. Please fill in according to Virtru’s standards. Functions can include departments, as listed below, or they can include more specific tasks, such as invoicing.}
Minor Disaster Major Disaster
Function MTD RTO WRT RPO MTD RTO WRT RPO
Physical Security
(office/suite)
1 hour 30 minutes 30 minutes 4 hours 1 hour 30 minutes 30 minutes 4 hours IT (server, hardware,
equipment)
Sales and Marketing
Administration
HR
8 #2..
- 787 -
EVACUATION PLAN ‐ during business hours:
For a disaster where you will need to leave the building:
If a disaster happens during normal business hours all Company employees will meet at Jack Rose Restaurant, 2007 18th St NW, Washington, DC 20009.
This will prevent Company employees from being in the way of emergency crews. A head count by managers will determine if all staff members have fully exited the building.
Headcount numbers will be brought to the ISO or CEO.
If the disaster happens after the meeting location has closed, employees will wait outside of the same address.
For a disaster where you will need to stay in the building:
If a disaster happens during normal business hours, all Company employees will meet in the Basement. A head count will determine if all staff members have fully exited the suite. See above for head count procedures. {Please fill in the appropriate personnel for the following responsibilities} Office/Evacuation Managers Assembly Managers
Will Ackerly John Ackerly
John Ackerly as Backup Will Ackerly as Backup
System Shutdown Manager Back‐up System Shutdown Manager Jordan Duggan Jordan Duggan
Will Ackerly as Backup Will Ackerly as Backup
9 #2..
- 788 -
Critical Operation Priority List
If or when a disaster happens, certain contacts will need to be made.
Operation Employee in Charge Action Plan
Current enrollment
processes (any
pending business)
Will Ackerly Notify carriers of current situation—give cell number if needed.
Communications Will Ackerly eBlast to client list
IT—phones, faxes,
e‐mail John Ackerly Set up remote office
Payroll‐Banking
issues‐Commissions
John Ackerly Notify payroll/banking institutions of disaster and action plan
10 #2..
- 789 -
Potential Purchase List
If or when a disaster happens, certain items may need to be replaced:
1. 3 UPS (Uninterruptible Power Supply)(s)(Batteries)
2. Network Attached Storage (NAS)
3. Network Switch(s)
4. Network cable(s)
5. Power cable(s)
6. Power strip(s)
7. Monitor(s) / Monitor Cable(s)
8. Keyboard(s) / Mouse(s)
9. Firewall
10. Workstation(s) / Laptop(s)
11. Phone(s) & Headsets
12. Security Camera
13. Electronic Door Lock
14. Video Conference Microphones
15. Minifridge
16. Projector
17. Software
a. OSX
b. Windows
c. Acrobat
d. Office Suite
18. Paper
a. Printer paper
b. Sticky notes
c. New Checks
19. Multifunction Color Printer
20. Office Furniture/Equipment
21. Carrier (Marketing) Supplies
22. Office Supplies
11 #2..
- 790 -
Fire Plan
12 #2..
- 791 -
EVACUATION PLAN ‐ FIRE!
If the fire alarm goes off during business hours, evacuate the building immediately. If you discover a fire or smell heavy smoke inside building:
DO NOT ATTEMPT TO FIGHT THE FIRE!!
1. Pull fire alarm, evacuate the building and call 911 on the way out of the building
2. Perform head count at the designated assembly point
禽 If anyone is missing, call their emergency contacts to determine if the missing individual has made contact with them. If they have not, alert the authorities.
3. Action Plan ‐ developed by EPCMT
禽 Re‐open based on damage
禽 If the office must remain closed:
峡 Notify employees and/or employees emergency contacts. 峡 If there is any impact to customer operations, email all clients with a status update and recovery plan.
NOTE: First Aid kit located in the drawer of the white cabinet located to the right of the spiral staircase.
13 #2..
- 792 -
Earthquake Plan
14 #2..
- 793 -
EVACUATION PLAN ‐ Earthquake!
During an Earthquake
菌 DO NOT USE THE ELEVATOR DURING AN EMERGENCY EVACUATION. 菌 If you're indoors, stay there. Get under ‐‐ and hold onto ‐‐a desk or table, or stand against an interior wall. Stay clear of exterior walls, glass, heavy furniture, fireplaces and appliances. The kitchen is a particularly dangerous spot. If you’re in an office building, stay away from windows and outside walls and do not use the elevator.
菌 If you're outside, get into the open. Stay clear of buildings, power lines or anything else that could fall on you.
After an Earthquake
菌 Perform head count at the designated assembly point
禽 If anyone is missing, call their emergency contacts to determine if the missing individual has made contact with them. If they have not, alert the authorities.
菌 Shut down systems, if time permits, see Emergency Shutdown Procedures 禽 Check for fire or fire hazards. If you smell gas, shut off the main gas valve. If there's evidence of damage to electrical wiring, shut off the power at the control box.
禽 If the phone is working, only use it in case of emergency. Likewise, avoid driving if possible to keep the streets clear for emergency vehicles.
15 #2..
- 794 -
禽 Be aware that items may fall out of cupboards or closets when the door is opened, and also that chimneys can be weakened and fall with a touch. Check for cracks and damage to the roof and foundation of your home.
禽 Listen to the radio for important information and instructions.
Remember that aftershocks, sometimes large enough to cause damage in their own right, generally follow large quakes.
ﾖ If you leave home, leave a message telling friends and family your location.
菌 Action Plan ‐ developed by EPCMT
禽 Re‐open based on damage
禽 If the office must remain closed:
峡 Notify employees and/or employees emergency contacts. 峡 If there is any impact to customer operations, email all clients with a status update and recovery plan.
NOTE: First Aid kit located in the drawer of the white cabinet located to the right of the spiral staircase.
16 #2..
- 795 -
Tornado Plan
17 #2..
- 796 -
EVACUATION PLAN ‐ Tornado!
If the city or county signal a tornado warning, move away from the perimeter of the building and any exterior glass.
DO NOT USE ANY ELEVATORS DURING AN EMERGENCY EVACUATION.
1. Move to the basement of the office suite.
2. Shutdown systems, if time permits, see Emergency Shutdown Procedures
3. Perform head count at the designated assembly point
禽 If anyone is missing, call their emergency contacts to determine if the missing individual has made contact with them. If they have not, alert the authorities.
4. Action Plan ‐ developed by EPCMT
禽 Re‐open based on damage
禽 If the office must remain closed:
峡 Notify employees and/or employees emergency contacts. 峡 If there is any impact to customer operations, email all clients with a status update and recovery plan.
NOTE: First Aid kit located in the drawer of the white cabinet located to the right of the spiral staircase.
18 #2..
- 797 -
Flood Plan
19 #2..
- 798 -
EVACUATION PLAN ‐ Flood!
1. Evaluate the situation
禽 Shutdown systems routine, see Emergency Shutdown Procedures 禽 Perform head count
峡 If anyone is missing, call their emergency contacts to determine if the missing individual has made contact with them. If they have not, alert the authorities.
2. Action Plan ‐ developed by EPCMT
禽 Remain open ‐ based on damage or location
峡 Relocate staff within suite
峡 Evaluate IT requirements
禽 Close ‐ send staff home
峡 Re‐open based on damage
峡 If the office must remain closed:
菌 Notify employees and/or employees emergency
contacts.
菌 If there is any impact to customer operations, email all clients with a status update and recovery plan.
20 #2..
- 799 -
After Hours Plan
21 #2..
- 800 -
EVACUATION PLAN ‐ after business hours
If the building is in a disastrous state after working hours, the EPCMT will notify employees. See Virtru Phone Tree.
If reopening on a workday at the primary location:
1. Verify location is safe for operations ‐ including systems
2. Communications
a. Emergency Contact List
b. Client Blast
If NOT reopening on the following workday at the primary location:
1. The EPCMT must decide estimated length of time we will not be able to function
a. If less than or equal to one day, office is closed.
i. [Name of Business] will open the following work day
ii. Verify location is safe for operations
iii. Communications
1. Emergency Contact List
2. Client Blast
2. If office needs to move to secondary location or close for a short period of time.
a. The EPCMT meets to develop a plan of action
b. Determine the validity of systems
i. If valid, move critical systems to secondary location ii. If not valid, retrieve necessary items and contact suppliers for new systems
1. Restore systems from backups
2. Restore connectivity
a. Skeleton crew of selected staff members
(possibly several from each department)
22 #2..
- 801 -
c. Communications
i. Emergency Contact List
ii. Client Blast
3. If office needs to move to secondary location or close for a longer period
of time:
a.The EPCMT meets to develop a plan of action
b. Determine the validity of Systems
i. If valid, move critical systems to secondary location ii. If not valid, retrieve necessary items and contact suppliers for new systems
1. Restore systems from backups
2. Restore connectivity
ii. Determine staff needs ‐ full or partial capacity
iii. Communications
1. Emergency Contact List
2. Client Blast
23 #2..
- 802 -
Emergency Contact List
24 #2..
- 803 -
Emergency services—call 911
Police 0000000000
Fire 0000000000
Poison Center 8002221222
Building
Building Owner 0000000000
Alarm Company 0000000000
Cleaning Company 0000000000
Technical Issues
Technologies Company 0000000000
WebsiteProgrammer 0000000000
Miscellaneous Internal Operations/Vendors
Staffing Companies 0000000000
UPS 0000000000
Bank 0000000000
401K Company 0000000000
Payroll Company 0000000000
25 #2..
- 804 -
Emergency Shutdown
Procedures
26 #2..
- 805 -
If an electrocution occurs while working in server room, staff will pull all of the UPS cords from the outlet by the interior door. If that outlet is inaccessible due to fire or victim’s position, staff will shut off the power at the breaker, located in the basement on the wall to the left of the TV.
If there is a fire within the building or suite, staff should concentrate on notifying authorities.
If there is severe flooding that threatens to affect the server room, staff will shutdown and unplug all equipment and move it to the second story platform of the suite.
27 #2..
- 806 -
CERTIFICATE OF REGISTRATION
Information Security Management System - ISO/IEC 27001:2013 The Certiication Body of BrightLine hereby certiies that the following organization operates an Information Security Management System that conforms to the requirements of ISO/IEC 27001:2013 ServiceNow, Inc.
for the following scope of registration
The scope of the ISO/IEC 27001:2013 certiication is limited to the information security management system (ISMS), which supports ServiceNow as a provider of cloud-based solutions that deine, structure, manage and automate services across the global enterprise, as well as all supporting resources including global data center operations and infrastructure, applications, end-user services, and product development, and in accordance with the Statement of Applicability, approved July 28, 2015. Assets within scope of the ISMS include: internal information assets, customer data, software, hardware, people, and physical assets to host, support and operate the cloud-based solutions. The data centers in the following locations house the infrastructure used to deliver the cloud-based solutions:
Virginia, California, Florida, Washington, Montreal, Toronto, London, Amsterdam, Geneva, Zurich, Sydney, Brisbane, Singapore, Hong Kong, São Paulo and Campinas. Additionally, ServiceNow uses Amazon Web Services (AWS) to host some ServiceWatch customers.
Excluded from the scope are all operations of third party data centers and AWS. the scope of this certiication includes the following locations:
Santa Clara (HQ): 3260 Jay Street, Santa Clara, California, 95054, United States San Diego: 4810 Eastgate Mall, San Diego, California, 92121, United States Kirkland: 4400 Carillon Point, Kirkland, Washington, 98033, United States Orlando: 3501 Quadrangle Blvd, Suite 150, Orlando, FL 32817, United States Amsterdam (EMEA HQ): Hoekenrode 3, 1102 BR Amsterdam, The Netherlands London: 3rd Floor, Future House, The Glanty, Egham, Surrey, TW20 9AH, United Kingdom Sydney: Level 21, 50 Bridge St, Sydney, New South Wales, 2000, Australia Issue Date
September 29, 2015
Expiration Date
September 28, 2018
Original Registration Date
December 17, 2012
Certiicate Version
Version 4
Certiicate Number: 1980700-4
CONDITIONS & LIMITATIONS:
1. The aforementioned organization has a perpetual responsibility to maintain compliance with ISO 27001:2013 during the period of certiication.
2. This certiicate is subject to the satisfactory completion of annual surveillance audits by BrightLine.
3. ISO 27001:2013 compliance audits are not designed to detect or prevent criminal activity or other acts that may result in an information security breach. As such, this certiication should not be construed as a guarantee or assurance that an organization is unsusceptible to information security breaches.
4. The information in this document is provided “AS IS”, without warranties of any kind. BrightLine expressly disclaims any representations and warranties, including, without limitation, the implied warranties of merchantability and itness for a particular purpose.
5. This certiicate is the property of BrightLine and is bound by the conditions of contract. The authenticity of this certiicate can be validated at www.BrightLine.com/Certiicate-Directory.
Christopher L. Schellman
President, BrightLine
1300 N. West Shore Blvd, Suite 240
Tampa, Florida 33607, United States
www.BrightLine.com
Authorized by:
#2..
- 807 -
Whether spurred by the need to increase eiciency, meet government mandates or deal with rapidly expanding data sets and workloads, more and more agencies are moving some or all of their applications or infrastructure to the cloud.
However, for many agencies, the most cost-efective, secure and eicient solution is a hybrid cloud model that allows them to not only leverage their existing investments in IT infrastructure, but also extend their systems seamlessly to the technology platform that best meets their needs.
VMware®, the global leader in virtualization and cloud infrastructure, and QTS, a trusted cloud operator and leading provider of hybrid cloud services and managed hosting for government agencies and enterprises, have partnered to deliver VMware vCloud® Government Service provided by Carpathia™ (A QTS Company).
vCLOUD GOVERNMENT SERVICE
QTS PRODUCTS & SERVICES
Compliant cloud solutions built for government agencies
KEY FEATURES
Robust Security and Compliance
ρ vCloud Government Service is a secure cloud platform that enables customers to maintain security and data protection that meets a broad range of regulations, standards, and best practices including FedRAMP, International Traic Arms Regulations (ITAR), FIPS 140-2, and AT 101 SOC Type 2.
Eiciency and Manageability
ρ Agencies can write, deploy, and manage applications in the cloud in the same way they do today, without making any changes or additional investments. With management tools consistent across on premises and cloud environments, you can accelerate application deployments, streamline the deployment and update process, leverage pre-built components, and reuse application models across environments, and clouds.
Seamless Network Integration
ρ vCloud Government Service is built on a seamless virtualized network that is quickly customizable to support your application and security needs. Network virtualization allows you to conigure your irewalls and network as if they were in your own data center so that you can replicate the network your applications need to operate. Get common identity and access management across your onsite and ofsite cloud locations.
vCloud Government Service is an enterprise-class hybrid cloud service designed to run new and existing applications in exactly the same way, giving government organizations application and data mobility. Being able to use existing people, processes, tools, and automation enables government organizations to focus on the beneits of the cloud to their mission, rather than taking time and resources to re-architect for new infrastructure. Federal organizations can securely extend their data centers to the cloud quickly and conidently, using an integrated cloud infrastructure with the security of a JAB-based FedRAMP Provisional Authorization.
ρ Outsource only those tasks you
don’t want to manage in-house
ρ Leverage our scalable, secure,
high-performing IaaS platform with
compliant managed solutions
ρ Reduce complexity and improve
operational eiciencies
ρ Expert engineers and support
team provides the right level of
support to meet your changing
business needs
ρ Improve security and compliance
support to meet your changing
business need
KEY BENEFITS
ρ Ease of Use – Leverage
your existing investments in
applications and infrastructure
and avoid the complexity of
re-architecting for public cloud
infrastructure
ρ Secure and Compliant – Secure
cloud platform, with security
controls designed to meet
the unique requirements of
government customers, most
notably the FedRAMP standards
ρ Hybrid – True hybrid cloud solution
enables both onsite and ofsite
IT environments to run new and
existing applications seamlessly
ρ Fastest Path to Cloud Value – Use
a common platform to leverage
internal and external cloud
resources without having to retrain
your staf, and lower overall costs
BENEFITS
#2..
- 808 -
QTS PRODUCTS & SERVICES
Why vCloud Government Service?
QTS Realty Trust, Inc. (NYSE: QTS)
is a leading provider of secure,
compliant data center solutions
and fully managed services, and
the owner of Carpathia Hosting, a
leading provider of hybrid cloud
services and managed hosting.
QTS’ integrated technology
service platform of custom data
center (C1), colocation (C2) and
cloud and managed services
(C3) provides lexible, scalable,
secure IT solutions for web and IT
applications. QTS’ Critical Facilities
Management (CFM) provides
increased eiciency and greater
performance for data center
owners and operators. QTS owns,
operates or manages 25 data
centers and bsupports more than
1,000 customers in North America,
Europe and Asia Paciic.
ABOUT QTS
vCloud Government Service has a FedRAMP Provisional Authority to Operate (P-ATO) and is generally available to U.S. government and defense organizations. It can be used for a variety of applications and workloads including:
ρ Test and development
ρ Packaged application hosting
ρ Backup and Disaster Recovery
ρ Web hosting and customer service
ρ On-demand data center expansion
Trusted Cloud Services
QTS is redeining the industry with trusted cloud services that leverage innovation to improve the lexibility, scalability, and cost-efectiveness of cloud services.
ρ We are a trusted cloud operator with past performance serving the government market -- including DoD, Civilian and Intelligence agencies -- across multiple programs and applications
ρ QTS data centers deliver the highest levels of security and compliance, and meet many compliance standards including FISMA, DIACAP, PCI, and HIPAA
ρ We hold a number of certiications and accreditations across multiple federal agencies and programs and support over 50 Federal systems holding active Authorizations to Operate (ATO)
Security
vCloud Government Service operates with a FedRAMP Provisional Authorization to Operate (P-ATO) issued by the Joint Authorization Board (JAB). Built with a defense in-depth strategy that puts our customers’ critical applications and data in the innermost ring, our people, processes and procedures ensure 100 percent compliance at implementation and through the lifecycle of the project.
Hybrid Options
vCloud Government Service is a true enterprise-class hybrid cloud service, ofering a seamless platform for migrating and managing workloads between dedicated virtualized environments, on-premise infrastructures, third-party data centers and the cloud. #2..
- 809 -
March 10, 2016
State of Utah Division of Purchasing
3150 State Office Building
Capitol Hill
Salt Lake City, Utah 84114
Mr. Hughes:
As a privately owned company, Carahsoft Technology Corp. does not report to D&B. As such, the information in D&B is incorrect. To support you to determine that we have the financial resource to perform the contract we provide you the following information.
We are a stable, conservative and profitable company. Carahsoft continues to grow as noted by our year over year revenue below:
2010 $820 Million
2011 $1.12 Billion
2012 $1.46 Billion
2013 $1.81 Billion
2014 $2.45 Billion
2015 $3 Billion
We currently employ close to 500 employees.
To support you to determine that we have the financial resource to perform the contract we provide you the following information:
We maintain a $25M line of credit available (currently 100% available) with Xenith Bank. I have included a recent banking clarification letter from Xenith.
Mr. Joe Humphries is the Regional President and can be reached at 703-869-3610 if you need any information from him.
We have received numerous accolades including:
For the 6th consecutive year CRN’s 2012 Fast Growth List Washington Business Journal’s 2012 List of Largest Government Contractors in Metro DC Third consecutive year Washington SmartCEO magazine’s 2012 Future 50 list which recognizes the metro areas fastest growing companies.
Should you require additional details please call me and I can discuss our confidential financial information with you or provide you trade references that can further assist you.
Sincerely,
Jillian Dewey Szczepanek
Controller
#2..
- 810 -
Credit Information
Risk Summary
Risk of Late Payment
Risk of late payment is based on the following
prioritized factors in addition to other information in D&B's files:
Proportion of slow payments in recent months
Higher risk industry based on delinquency rates for
this industry
Increase in proportion of delinquent payments in
recent payment experiences
Proportion of past due balances to total amount
owing
Evidence of open liens
Indications of slowness can be the result of disputes
over merchandise, skipped invoices, etc.
Payment Performance Trend
The payment performance trend for this company is
Increased . Payment Trend currently is Increased
compared to payments three months ago. The most
recent payment information in D&B's files is:
Payments currently: 11 days beyond terms
Payments 3 months ago: 19 DAYS BEYOND
terms
Industry average: 5 DAYS BEYOND terms
*Note: Payments to suppliers are averaged weighted
by dollar amounts.
Credit Limit Recommendation
Risk Category
High Aggressive Credit Limit
$0
Conservative Credit Limit
$0
Recommendation Date: 11/18/2015
Company Profile
Chief Executive:
DIRECTOR(S): THE OFFICER(S)
Type of Business: NA
Years in Business: NA
Annual Sales:
Line of Business:
Whol computers/peripherals
Carahsoft Technology Corp. DUNS: 08-836-5767
#2..
- 811 -
1000000000
Employees Total: 500
Legal Filings and Other Important Information
The public record items reported may have been paid, terminated, vacated or released prior to the date this data is transmitted. Accounts are sometimes placed for collection even though the existence or amount of the debt is disputed.
Bankruptcies: None
Judgements: 0
Liens: 3
Suits: None
Suits/Judgments/Liens Amounts: None
Negative Payment Experience: None
Negative Payment Experience
Amount:
None
Payments Placed for Collection: 0
Special Events
We currently do have any information to be displayed for this business.
This report is prepared and provided under contract for the exclusive use of This report may not be reproduced in whole or in part by any means of reproduction.
Payment Trends
Summary
Address:
1860 Michael Faraday Dr, Suite 100
Reston, VA 20190
D-U-N-S Number:
08-836-5767
Primary Industry SIC:
5045
Description:
Whol computers/peripherals
This is a single location.
Payment Activity
Indications of slowness can be the result of dispute over merchandise, skipped invoices, etc. Accounts are sometimes placed for collection even though the existence or amount of the debt is disputed.
Total payment Experiences in D&Bs
File: 48
Payments Within Terms:
(not dollar weighted) 72%
Total Placed For Collection: NA
Average Highest Credit: $2,379,615
Largest High Credit: $20,000,000
Highest Now Owing: $20,000,000
Highest Past Due: $4,000,000
#2..
- 812 -
PAYDEX® ®
PAYDEX ® Trends - This Company, 12 Months
This Company (73)
Based on payments collected over the last 12 months.
Current PAYDEX® for this Business is 73 , or equal to 11 days beyond terms terms The 12-month high is 73 , or equal to 11 DAYS BEYOND terms The 12-month low is 63 , or equal to 11 DAYS BEYOND terms PAYDEX ® Score Comparison - This Company to Primary Industry Comparison, 4 Quarters 3 Month PAYDEX®
When weighted by dollar amount,
payments to suppliers average 8 days beyond terms
terms.
Based on payments collected over the last 3 months
75 24 Month PAYDEX®
When weighted by dollar amount,
payments to suppliers average 11 days beyond terms
terms.
Based on payments collected over the last 24 months
73 #2..
- 813 -
My Company (73) Industry Median (77)
Industry Upper Quartile (80) Industry Median (70)
Based on payments collected over the last 4 quarters.
Current PAYDEX® for this Business is 73 , or equal to 11 days beyond terms Current PAYDEX® for this Business is 77 , or equal to 5 DAYS BEYOND terms Industry upper quartile represents the performance of the payers in the 75th percentile Industry lower quartile represents the performance of the payers in the 25th percentile Business Payment Habit by Amount of Credit Extended, 24 Months $ Credit Extended % of Payments Within Terms
Over 100,000 73%
50,000-100,000 100%
15,000-49,999 27%
5,000-14,999 73%
1,000-4,999 100%
under 1,000 100%
# Payment Experiences Total $ Dollar Amount
24 $90,200,000
1 $85,000
5 $110,000
4 $27,500
1 $2,500
3 $400
How to Read the D&B PAYDEX ® Score
Score Payment Habit Risk Interpretation
80 - 100 LOW risk of late payment
(averages prompt to 30 days within
terms)
50 - 79 MEDIUM risk of late payment
(averages 30 or less beyond terms)
0 - 49 HIGH risk of late payment
(averages 30 to 120 days beyond
terms)
#2..
- 814 -
©Dun & Bradstreet, Inc. 2015. All rights reserved.
#2..
- 815 -
Version 3.00
Effective: 09/01/2021
Technology Steering and Alignment Committee
Technology Project Proposal
Date: August 3, 2023
Project Sponsor: Rosene Nguyen
Department Name: Public Works
Division: Solid Waste
Project Name: Solid Waste Cloud Based Software
Project Manager: Michele Hunt
☐[Click or tap to enter a date.] Project review completed by Information Technology.
By: Click or tap here to enter text.
Proposed Project Description & Background:
Solid Waste is looking to purchase a cloud based software system for our tracking of data and code enforcement needs. Unlike other programs the City uses that are based on APN numbers our program need will be specific to addresses (meaning a building that might have unit a, b, c, d, etc.) We need to be able to track the City's Solid Waste Customers, their level of service, code violations, edible food reports, shared container service, and many other types of information that is required for state and local laws.
What problem is this project attempting to solve?
Right now this information is tracked in both Access and Excel. As you can imagine this makes for difficulties finding data at times as well as duplicated data and sometimes even data that's been deleted or corrupted due to human error. Access is not supported by the IT department and currently only Michele Hunt knows how to update and edit the database.
How long is this project estimated to take to completion? 6 months. 3 months of building from purchase to creation and then another 2-3 months to upload accurate data. Importing will be done inhouse to ensure data security.
What is the anticipated organizational impact of this project? (Examples: Staff hours needed, work that may be negatively impacted due to diversion of resources to this project, other projects that may be slowed or stopped due to this project.) Staff time for Michele will be diverted to development of program and importing of data, other staff will be delegated tasks while this is completed. This means work may be slower on some #2..
- 816 -
Date: August 3, 2023 Page 2 of 6
Project Sponsor: Rosene Nguyen Department: Public Works Project Name: Michele Hunt Division: Solid Waste
Version 3.0
Effective: 09/01/2021
tasks while this program is completed. Overall program implementation will not have a major effect on our daily tasks. Serving customers will always be our number one priority.
What are the alternatives to undertaking this project?
Continue with current process and Access Databases and excel spreadsheets. Since Michele Hunt is the only person who knows how to update the access database, when the data base crashs and she is not around, there is no one else from the City can help fix the data base.
Michele will be reiering at some point and we would like to ensure other supervisors are in the know on how to use the new software. Also, as mentioned about, IT department does not provide support with the Access database.
What other Departments, and who from those departments have you discussed this project with? What other departments may benefit from this project and how will each of those departments benefit?
No other departments have discussed this; other departments work off of a APN and Solid Waste needs to work with specific addresses when it comes to our services and verifying that each individual customer is provided the most efficient service.
Which specific element of the City’s Strategic Plan is this project related to? Goal J. Build a high-Prefomance organization
Is this project part of the City’s Smart City Strategic Plan? Yes If so, please explain how the project supports the City’s Smart City Strategy.
This program will help Solid Waste improve effiency and to deliver exceptional customer service to the City’s customers by way of tracking necessary Solid Waste programs, education and enforcement activities. And to ensure compliance with State regulations.
Identify any technology systems that this project will replace, if any.
Microsoft Access and Excel Datasheets and Reporting
Identify any technology systems that this project could possibly integrate with? GIS
#2..
- 817 -
Date: August 3, 2023 Page 3 of 6
Project Sponsor: Rosene Nguyen Department: Public Works Project Name: Michele Hunt Division: Solid Waste
Version 3.0
Effective: 09/01/2021
#2..
- 818 -
Date: August 3, 2023 Page 4 of 6
Project Sponsor: Rosene Nguyen Department: Public Works Project Name: Michele Hunt Division: Solid Waste
Version 3.0
Effective: 09/01/2021
Business Case
1. Describe how the project will be funded and the source of funding. If no funding is available, what financing options will be used to fund the project? Solid Waste will fund this program- 491-56010 and the first $100,000 has been budgeted for this, we are seeking grants to cover the remaining expected $100,000 or will do a budget adjustment to pull from our reserves. Solid Waste is an enterprise fund.
2. What is the estimated life or life cycle of the product(s) and/or services being recommended for purchase? How often will equipment need to be replaced and/or software need to be upgraded? What is the estimated cost of equipment replacement and/or software upgrades?
We will be paying for annual license. Estimated costis about $80,000 a year. We will be managing the software internally and we will have an agreement with the vendor to provide us with support when we need to
3. What business measures and/or benchmarks will be used to determine the progress and ongoing success of this project?
This program will track Solid Waste activities including reporting to the State how we are meeting the States SB1383 goals of 75% reduction. By tracking this information in 1 database, the report will be more effiecient and accurate. In addition, it will show where the City needs to implement more programs and education or enforcement (as needed) in order to meet these goals.
4. What is the estimated Return on Investment (ROI) and how will you measure the ROI? ROI will be measured by how much time spent vs how much time saved with having the new software. The new software will help us organize all of our data in one localized place, more people will be trained how to to access and build the database. Having a softwaste will help us run KPIs, track violations and hearings. The benefits of having a new software may result in an increase in revenue, improved employee productivity, and an increase in automation.
5. How will the City’s work and/or workforce change as a result of the project? (Increases/decreases) Describe in detail, the expected changes of the work and/or workforce (Include added operational work and support. Include any shifts in the workforce such as a decrease in workload in one area that is shifted to another area) This program will help Solid Waste be more efficient in tracking data and thus, allow more staff time to completing new assigned tasks. As the State moves to continue it’s goals of #2..
- 819 -
Date: August 3, 2023 Page 5 of 6
Project Sponsor: Rosene Nguyen Department: Public Works Project Name: Michele Hunt Division: Solid Waste
Version 3.0
Effective: 09/01/2021
0 waste by implementing programs, the need for more effiency in how we perform tasks is needed.
6. Complete the attached Cost/Benefit Worksheet to identify all One-Time and Ongoing costs and savings related to this project.
#2..
- 820 -
Date: August 3, 2023 Page 6 of 6
Project Sponsor: Rosene Nguyen Department: Public Works Project Name: Michele Hunt Division: Solid Waste
Type YEAR 1 YEAR 2 YEAR 3 YEAR 4 YEAR 5 TOTAL
ONE-TIME COSTS
Build out of Software $130,000.00 $ 130,000.00
$ -
$ -
$ -
$ -
$ -
TOTAL ONE-TIME COSTS $130,000.00 $0.00 $0.00 $0.00 $0.00 $ 130,000.00
ONGOING COSTS
Ongoing Internet Service (500mbps) $67,294.81 $67,294.81 $67,294.81 $67,294.81 $67,294.81 $ 336,474.05 $ -
$ -
$ -
$ -
$ -
TOTAL ONGOING COSTS $67,294.81 $67,294.81 $67,294.81 $67,294.81 $67,294.81 $ 336,474.05 TOTAL COSTS $197,294.81 $67,294.81 $67,294.81 $67,294.81 $67,294.81 $ 466,474.05
ONE-TIME SAVINGS
$ -
$ -
$ -
$ -
$ -
$ -
$ -
TOTAL ONE-TIME SAVINGS $0.00 $0.00 $0.00 $0.00 $0.00 $ -
ONGOING SAVINGS
$ -
$ -
$ -
$ -
$ -
$ -
TOTAL ONGOING SAVINGS $0.00 $0.00 $0.00 $0.00 $0.00 $ - TOTAL SAVINGS $0.00 $0.00 $0.00 $0.00 $0.00 $ -
NET COSTS / (SAVINGS) $197,294.81 $67,294.81 $67,294.81 $67,294.81 $67,294.81 $466,474.05 Technology Steering Committee Project Cost/Benefit Worksheet To Open - Double Click on Spreadsheet. To Close - ESC #2..
- 821 -
CITY OF MODESTO
COMMITTEE AGENDA REPORT
DATE OF MEETING:
April 29, 2024
Date: April 4, 2024
TO: Finance Committee
Nick Bavaro, Chair
Rosa Escutia-Braaton, Vice-Chair
David Wright, Member
THROUGH: Joseph P. Lopez, City Manager
FROM: Bill Sandhu, Director of Public Works
SUBJECT: Second Amendment to the Agreement with Clark Pest Control CONTACT: Gabe DaSilva, Facilities Manager, [email protected], 209-652-2579 DESCRIPTION:
Consider the Second Amendment for the city-wide pest control services to a revised total amount of $393,410 and extend the term of the Agreement from April 30, 2024, to April 30, 2026, and forwarding to Council for approval. (Funding Source: Building Maintenance ISF) STRATEGIC PLAN ELEMENT:
This action supports the 2020-2025 City of Modesto Strategic Plan Area of Focus: Governance and Service Delivery; “Build community trust in City government through responsive, transparent and efficient service delivery.”; Goal H: “Achieve long-term financial sustainability.” BACKGROUND:
Pest control services are provided at City owned facilities, structures, and other property at varying frequencies and service levels. It is expected that all pest management on City property will adhere to industry best practices, reduce, or eliminate pesticide applications to the maximum extent feasible, and include all reasonable measures to protect human and environmental health. Use of a city-wide agreement to provide pest control services takes advantage of “economies of scale” and reduces the overall cost to the City for this service.
On March 6, 2018, the Stanislaus County GSA posted an invitation for Bids #18-16-CB for Countywide Pest Control Services. The bid was sent to 27 vendors, resulting in 13 downloads of the bid documents. When bidding closed, GSA had received three responsive and responsible bids from pest control firms. After review, Clark Pest Control, Inc. (“Clark”) of Modesto, CA was determined to be the lowest-priced responsible and responsive bidder, and on July 31, 2018, the Board of Supervisors of Stanislaus County approved the Master Agreement with Clark Pest Control, Inc. No. 2018-0388, for countywide pest control services. #3..
- 822 -
Finance Committee, April 29, 2024
Second Amendment to the Agreement with Clark Pest Control