Privacy

Information Security Policy (I.S.P.)

1 Introduction

According to standard definitions, an Information Security Policy is a set of rules enacted by an organization to ensure that all users or networks of the IT structure within the organization’s domain abide by the regulations regarding the security of data stored digitally within the boundaries where the organization stretches its authority. Attaining this goal involves setting up an Information Security Policy for the organization and ensuring its adherence. The ISP is governing the protection of information, which is an asset that the organization needs to protect. Information may be printed, written, spoken, or visually explained.

1. The organization has a formal information protection program based on an accepted industry framework that is reviewed and updated as needed. The organization has adopted  the NIST as a framework and ISO 27001 standard  for its security posture, in addition to covering the  HITRUST and PCI/DSS  certifications. The SOC 2 Type II report is issued annually. External audit is performed annually.
2. The adherence to these compliance artifacts are audited yearly and documented in the  05M04  Service Organization Controls, where controls from these different artifacts are mapped.
3. Upper management along with the Information Security Steering Group (ISSG) are committed to be engaged and participate in the approval process of all policies by approving and signing such. Members of the ISSG are defined as IAW 07F18 Information Management Structure.
4. User security roles and responsibilities are clearly defined and communicated.
5. The organization formally addresses the purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance requirements for its human resources security protection program. 
6. Sanctions are fairly applied to employees following violations of the information security policies once a breach is verified and includes consideration of multiple factors. The organization documents personnel involved in incidents, steps taken, and the timeline associated with those steps, steps taken for notification, the rationale for discipline, and the final outcome for each incident.
7. Notifies the manager within  24 hours when a formal sanction process is initiated, identifying the individual sanctioned and the reason for the sanction. Further, the organization includes specific procedures for license, registration, and certification denial or revocation and other disciplinary action. In addition, a Corrective Action Request (CAR) and/or disciplinary action may be created if deemed necessary IAW 10P01 Corrective Action SOP.
8. Record of employees involved in security incident(s) is maintained with the resulting outcome from the investigation.

2 Purpose

The organization has implemented the ISP with the goal of identifying, assessing, and taking steps to avoid or to mitigate risk to the organization’s information assets. Information security is achieved by implementing a suitable set of controls, including policies, organizational structures and software, and hardware functions.  

2.1 Security Objectives (ISO 27001 5.1)

The ISSG has established security  objectives to:

1. Confidentiality
2. Availability
3. Integrity

The  security objectives are monitored and analyzed yearly and recorded IAW the 05M01 CMS. These controls are established, implemented, monitored and controlled to ensure that the specific security and business objectives of the organization are met. The same is executed in conjunction with ISO 9001 and ISO 27001 processes implemented by the organization.

1. To implement and properly maintain a robust information security function, the organization recognizes the importance of:
2. Understanding the information security requirements and the need to establish policies and objectives for information security;
3. Understanding, assessing, and measuring risks posed to and by the organization’s information assets;
4. Implementing and operating controls to manage the organization’s information security risks in the context of overall business risks;
5. Ensuring all employees, external vendors, and consultants of the organization are aware of their responsibilities as regards assets protection and security and to understand the importance of any legal and regulatory requirements. 
6. Monitoring and reviewing the performance and effectiveness of information security policies and controls; and
7. Continually improving the assessments, measurements, and changes that affect risk.
8. Developing an Information Security Policy that captures the mission of the organization.
9. Establishing information security objectives.
10. Conducting management reviews, as a minimum on an annual basis, to evaluate the organization’s progress.
11. Ensuring the Information Security Management System is integrated within our processes.
12. Ensuring the ISO reviews the expenditure and security compliance  on the infrastructure, architecture and development.
13. Ensuring that sufficient resources are always available.
14. Communicating the importance of effective compliance management and Information Security Management System.
15. Ensuring that Information Security Policy achieves its intended results.
16. Engaging, directing, and supporting our employees to help contribute to the effectiveness of the Information Security Policy
17. Promoting improvement.
18. Supporting other relevant management roles to demonstrate their leadership as it applies to their areas of responsibility.

3 Scope

1. This policy and all related documentation apply to the Information Security Management System (ISMS)  as it relates to the translation, localization and transcreation of content IAW 06F04 ISMS Statement of Applicability.
   It applies to the staff working from the office in Miami, Florida as well as all the remote staff, vendors, and clients that interact with the Language Vault application.
2. The organization processes information with the help of third party providers, all of which hold their SOC 2 Type II reports and ISO 27001 Certifications. All operations are done remotely through the help of dual factor authentication (2FA) protected desktop as a service and a web application that exhibits IP protection, 2FA and custom security policies per client.
   All departments that intervene in the delivery of services are covered in this scope including but not limited to Operations, Accounting, and IT personnel.
3. Ultimately our stakeholders, vendors, staff members and clients are all protected by the scope of the CMS.
4. All the information assets provided by clients and delivered by vendors and staff members are covered in this scope to satisfy their information assurance needs. To that end the CMS focuses on product development, delivery of services, people, and processes that the organization can control but also that we recommend our constituents to leverage .

4 Security Policies Management

4.1 Security Policies Review 

1. Upper Management assigns a group; the ISSG  to ensure the effectiveness of the information protection program through program oversight; The organization’s approach to managing information security and its implementation are regularly reviewed by the members  of the ISSG and are communicated throughout the organization.
2. The ISO is appointed and is responsible for ensuring security processes are in place, communicated to all stakeholders, and consider and address organizational requirements.
3. Managers are required to review and accept information security-related policies and procedures on a yearly basis. At the time of review, they must agree that these policies and procedures have been consistently applied within their area of responsibility.
4. Annual compliance reviews are conducted.  The internal SOC audit 05M04 Service Organization Controls document is executed  IAW 09P01 Internal Audits SOP by the Compliance Officer. During this time, Policies, Procedures and Information systems are reviewed for compliance with the organization’s information security policies and standards. The organization has pursued a SOC 2 Type 2 report which is to be renewed yearly.
5. The results of independent security program reviews are recorded and reported to upper management initiating the review; and the results are maintained for a predetermined period of 6 years. Any findings identified  from External/Internal Audit are documented appropriately IAW 10P01 Corrective Action Request SOP.

4.2 Security Program Capital Planning 

Capital planning and investment requests include the resources needed to implement the security program, employ a business case; and the organization ensures the resources are available for expenditure as planned. The Management Review Meeting captures any additional resources needed and any improvement projects IAW 09P01 Management Review SOP. 

4.3 Roles and Responsibilities 

Within the Information Security Policy, roles and responsibilities have been defined and assigned to specific individuals or groups within its organization. The Management Team, including the Information Security Officer (ISO), has established an 07F18 Security Management Structure document. Information security responsibilities are clearly defined, maintained, and communicated. These responsibilities include the security of the organization’s information assets and information technology that are accessed, processed, communicated to, or managed by external parties.

1. Information Security Steering Group (ISSG): Responsible for information security in the organization to reduce risk exposure and ensure the organization’s activities do not introduce undue risk. The group is responsible for ensuring compliance with established security policies, processes, and initiatives, and with state and federal regulations. The ISSG is also responsible for reviewing security policies, assigning security roles, coordinating and reviewing the implementation of security across the organization. This group is also responsible for protecting assets from authorized access, disclosure, modification, destruction or interference. The following roles pertain to the ISSG:
   
   1. CEO: oversee on behalf of the board of directors that the security posture satisfies the needs of the business. The head of the ISSG sets the security posture across the organization and takes an active role. Is the owner of the 06F02 Risk and Opportunity Management Document and advises on actions that shall be taken regarding risks that have been identified to possibly impact existing vulnerabilities.
   2. VP of Internal Operations: oversee the operation teams and adherence to security requirements.
   3. CTO (Chief Technology Officer): Is the organization’s Senior-Level Information Security Official. Ensures the effectiveness of the information protection program through program oversight; establish and communicate the organization’s priorities for organizational mission, objectives, and activities; review and update of the organization’s security plan; ensure compliance with the security plan by the workforce; and evaluate and accept security risks on behalf of the organization. Advises the ISSG about privacy, security and compliance. The ISO develops, implements, and manages security matters. ultimately owns the organizational, physical and logical security. The ISO is responsible. 
2. Information Asset  Owner (IAO): Responsible for creating initial information classification, approving decisions regarding controls and access privileges, performing periodic reclassification, and ensuring regular reviews for value and updates to manage changes to risk. 
3. User: Responsible for complying with the provisions of policies and procedures.

   The table below uses the RACI (R= Responsible,  A= Accountable., C= Consulted, I= Informed) model for identifying roles and responsibilities during an organizational change process

   Area of Responsibility	ISSG	ISO	IAO	User
   Establish the Information Security Program (ISP)	A	R	C	N/A
   Implement and Operate the ISP	A	R	C	N/A
   Monitor and Review the ISP	A/R	R	C	N/A
   Maintain and Improve the ISP	A/R	R	C	N/A
   Management Responsibility	A/R	R	C	N/A
   Resource Management	A	R	I	N/A
   Provision of Resources	A/R	C	I	N/A
   Training, Awareness and Competence	A/R	R	C	I
   Internal ISP Audits	A/R	R	C	I
   Establish Controls	A	R	C	I
   Storage of Source Code	N/A	R	N/A	N/A
   Asset Protection from unauthorized access, disclosure, modification, destruction or interference
   Report of security event or risks	A/R	R	R	I

4. Managers: Managers ensure employees are aware of the relevance and importance of their activities and how they contribute to the achievement of information security objectives. They also ensure that employees are aware of and comply with all information security policies and procedures of the organization relevant to their individual roles.
5. Compliance Team: This team consists of the COO, the ISO, the Compliance Officer, and the IT members. This team ensures employees comply with established policies and procedures.
6. IT Team: This team is responsible for the following areas related to information security:
   
   1. Managing related processes, such as incident and change management
   2. Providing technical expertise related to information security
   3. Implementing technical controls
   4. System administration; e.g., user creation, backups
   5. Security monitoring; e.g., network intrusions
   6. Reporting actual or potential security breaches
   7. Contributing to risk assessment where required

5 Identification and Authentication

The organization has defined the expectations and principles relating to how system setup and credential privileges should be managed. User accounts and privileges shall be managed correctly to ensure authorized user access to information systems is possible, while unauthorized access is not, including but not limited to:

1. Authorization to manage user accounts and privileges. Requests are triggered by the HR Business Partner, and authorization may be given through line management, by the Manager and/or Director of the area in question.
2. Management of user accounts and privileges. Specific staff members are authorized to control login accounts and permissions for systems that the IT team does not manage. The IT team may delegate specific limited responsibilities for managing accounts and permissions to staff in other departments. See 07F18 Security Management Structure for more details.
3. The organization promotes the development and use of programs that avoid the need to run with elevated privileges and system routines to avoid the need to grant privileges to users.
4. Users’ access rights must be adjusted in a timely manner to provide only authorized role based  and necessary access. This should take place whenever there is a change in business needs, a change in an employee’s role, or when an employee leaves the organization. Managers of the user must be notified of change/termination IAW 07P08 IT Help Desk SOP.
5. Password management. Once access to a system or application is authorized, the user shall create their own password IAW 04M06 Password Policy.
6.  Deletion of user access upon exiting the organization is executed IAW 07P16 Technical Termination SOP.
7. IT staff with access to system credentials and cryptographic keys are responsible and liable for maintaining them. Keys are rotated to a minimum of once a year and are kept out of the reach of any other person and shall report any suspicious activity immediately to the ISO.
8. Cloud provider keys for AES-256 are rotated and managed by them. In all cases (cloud providers or IT personnel) are trained to provide key generation, key distribution, key storage, key rotation and key revocation. Cloud encryption keys are managed by AWS and GCP cloud providers. IT is responsible for the generation of Portal keys which are auto-generated and rotated every 2 months with a life of only 3 months via letsencrypt. Keys used to interact with services are rotated at a minimum annually or if an IT employee leaves.
9. A monthly audit is conducted of login access to ensure accuracy and remove access to those users who are no longer eligible or required. See 07P08 IT Service Desk SOP for more details.
10. The organization restricts access to privileged functions and all security-relevant information.
11. The ISO is the only authorized person to grant privileged access to IT infrastructure or source code.
12. Shared/group and generic user IDs are not used in exceptional circumstances where there is a clear business benefit. All admins have their own unique credentials.
13. The authorization involves approval to hire a software engineer or IT infrastructure engineer to authorize additional privileges and the record of the JIRA ticket IAW 07P08 IT Help Desk SOP

 6      Handling of External Party Requests and Support

All Customer requests for support must be submitted to [email protected] and vendor requests are to be submitted to [email protected]. Requests are categorized into three tiers:

• Tier 1: All customer requests are considered tier 1, with  the SLA of 1 hour. Consists of 3 support staff to manage requests for this tier.
• Tier 2: Issues or assistance requested are considered tier 2.  Our product owners are on call for these types of matters. Consists of 3 Support Staff to manage requests for this tier.
• Tier 3: DevOps are on call to provide support for requests that can be resolved internally or that might demand the needs of service provider support. GCP and AWS have 24/7 support. Consists of 3 support staff to manage requests for this tier.

All calls received after hours are routed to customer support who are on call. Otherwise during regular business hours the number of staff supporting the service. For all tier 3 requests, a ticket will need to be created with GCP or AWS.

7 Incidents Report  and IT Requests

1. The IT Team has established procedures to ensure a consistent and effective approach to the management of information security incidents and IT requests, including communication on security events and weaknesses. It enables the efficient and effective management of information security incidents by providing structure for the reporting and management of such incidents.
2. Any possible information security event must be assessed, and the ISO together with the IT team shall determine if it should be classified as an information security incident.
3. Information security incidents, complaints and IT requests can be made by employees by reporting promptly.  All reported items are responded to in a quick, effective, and orderly manner in order to reduce the negative effect of incidents, repair any damage, and mitigate future risks. Tickets are to be submitted to the IT Help Desk IAW 07P08 IT Service Desk SOP.
4. Weekly reports shall be generated by the IT Service Desk system for all tickets labeled ‘security.’ Trends shall be analyzed to determine if any discernible patterns require further investigation.
5. The IT team has daily meetings where, if necessary, post-mortem and trend analysis is discussed. All knowledge acquired from information security incidents shall be used to reduce the likelihood or impact of future incidents. Any serious incidents shall be recorded in the Non-Conformance log, and a CAR may be originated (IAW 10P01 Corrective Action Request SOP), if deemed necessary.

8 Change Management

BigLS has deployed a change management process in order to prevent unintended service disruptions and to maintain the integrity of all company services. All changes identified as causing disruption are planned and approved by management, without exception.

1. Managers responsible for application systems are also responsible for the strict control (security) of the project or support environment and ensure that all proposed system changes are reviewed to check that they do not compromise the security of either the system or the operating environment. Project and support environments must be strictly controlled. All proposed system changes must be reviewed to ensure that they do not compromise the security of the system or the operating environment.
2. Changes to equipment, software, and procedures are strictly and consistently managed.
3. Fallback procedures are defined and implemented, including procedures and responsibilities for aborting and recovering from unsuccessful changes and unforeseen events.
4. The Company deploys strong segregation of duties wherever it is economically feasible, including physical access and business processes in compliance with AICPA recommendations. It is imperative for the organization to grant its VP of Technology, who works as an Information Security Officer (ISO), access to troubleshoot any problems that might occur in the production environment, including production deployments. In addition, it is necessary for the VP of Technology to be the gatekeeper for any source code change. The organization has procedures to include detective and monitoring controls to mitigate the risk of possible misuse or unintentional modification of the organization’s assets. Segregation of duties exists with a number of restrictions, such as:
   1. Source code changes are performed only by software engineers and Bitbucket logs are accessible in Bitbucket to confirm that that is the case.
   2. Email alerts exist for critical changes performed in the source code, such as pull requests. These alerts are sent to code reviewers.
   3. No code is merged into the master branch without being approved by two senior developers (per review).
   4. The VP of Technology only merges code that has been approved by the senior developers. Proof of this is also available from the Bitbucket merged pull request listing.
   5. Code won’t be released if it does not pass static security analysis. OWASP ZAP acts as a proxy for e2e tests which reveals any new vulnerabilities present in any new release.
   6. Logical access for the whole software development lifecycle (SDLC) is segregated through a JIRA Kanban System which enforces different players for each of the following concerns: specifications, prioritization, software development, QA, and deployment. Proof is available via JIRA history in each ticket.
   7. Deployment occurs after confirmation by the Product Owners and the pulling of the ticket into the deployment-in-progress stage, which is allowed only to deployers, all of which can be confirmed from JIRA. Management (as well as all users) is made aware of any new release. There is extra evidence from Google Chat, Portal header notification functionality, and emails that communicate the release notes after each deployment.
   8. Security audit logs are read only, without exception, and record all changes in the production environment. This can be confirmed by inspecting the Stackdriver logs. Stackdriver is managed by Google and logs cannot be tampered with or deleted.
   9. Logging of all privileged actions is in place and can be confirmed from Stackdriver logs.
   10. These privileged actions result in email alerts sent to the Compliance team.
   11. Developers do not have access to production systems, which can be asserted by looking at our AWS and GCP Inventories which are sent monthly and reviewed by IT as IAO. Test and production environments are segregated in their own projects, which can be asserted by looking into the Google Cloud Console.
   12. Changes to equipment,  software, and procedure are strictly managed.
   13. The company’s strategy for changes implemented accounts for a rollback strategy which is set by default. All changes are documented starting in a JIRA ticket and applied to test environments before they are pushed into the production environment. In addition the database is backed up every six (6) hours in the case a rollback for a deployment that affected data is needed. Rollback procedures are followed IAW 07P13 Software Development Lifecycle SOP for aborting and recovering from unsuccessful changes and unforeseen events.
   14. Any Systems or system components in production that  are no longer supported, the organization executes a formal migration plan approved by management to replace the system or system components.
   15. Every month, the company audits all systems, beyond the Portal production environment, for excessive privileges in its monthly IAO audit. The results of this audit are registered in JIRA.

All requests are processed per IAW  07P08 IT Service Desk SOP. Rollback procedures are documented in case there is a need to go back to a previous status, even though change plans are  mostly related to minimal marketable features (MMF). All MMFs are tested thoroughly after a fully automated deployment in the testing environment, before authorizing the deployment into production. Layers of authorization and logging exist so that production changes are controlled and monitored. Only authorized engineers are able to perform production changes. The organization communicates to different stakeholders when the services might be adversely affected.  

The organization supports and manages changes to Workspace in the cloud including their operating system and applications and covers major, minor and patches.

The Management team meets every month to discuss any upcoming change. This meeting is  known as the Replenishment Meeting.

9 Risk Management

1. The organization performs risk assessments in a consistent way and at planned intervals, or when there are major changes to the organization’s environment, and reviews the 06F02 Risk and Opportunity Document annually.
2. Risk assessments include the evaluation of multiple factors that may impact security as well as the likelihood and impact from a loss of confidentiality, integrity and availability of information and systems.
3. The organization uses a formal methodology with defined criteria for determining risk treatments and ensuring that corrective action plans for the security program and the associated organizational information systems are prioritized and maintained; and the remedial information security actions necessary to mitigate risk to organizational operations and assets, individuals, and other organizations are documented.
4. The organization mitigates any harmful effect that is known to the organization of a use or disclosure of restricted information by the organization, vendors, or similar third-parties in violation of its policies and procedures.
5. The organization has implemented an integrated control system characterized using different control types (e.g., layered, preventative, detective, corrective, and compensating) that mitigates identified risks.
6. The risk management program includes the requirement that risk assessments be re-evaluated at least annually, or when there are significant changes in the environment.
7. The organization formally addresses the purpose, scope, roles, responsibilities, management commitment, coordination among organizational entities, and compliance with system and information integrity requirements and facilitates the implementation of system and information integrity requirements/controls.
8. Information system specifications for security control requirements state that security controls are to be incorporated in the information system, supplemented by manual controls as needed, and these considerations are also applied when evaluating software packages, developed or purchased.
9. Security requirements and controls reflect the business value of the information assets involved, and the potential business damage that might result from a failure or absence of security.
10. A formal acquisition process is followed for purchased commercial products, and supplier contracts include the identified security requirements.
11. Where the security functionality in a proposed product does not satisfy the specified requirement, the risk introduced and associated controls are reconsidered prior to purchasing the product.
12. Where additional functionality is supplied and causes a security risk, the functionality is disabled or mitigated through application of additional controls.
13. The organization requires developers of information systems, components, and developers or providers of services to identify (document) early in the system development life cycle, the functions, ports, protocols, and services intended for organizational use.

Risk assessments shall identify, quantify, and prioritize threats that may become relevant to the organization. The results shall guide and determine appropriate organization action and priorities for managing information security risks and for implementing controls needed to protect information assets.

10 Related Security Policies (Public Section)

The organization protects its devices at all times by access controls, usage restrictions, connection requirements, encryption, virus protections, firewalls and physical protections.

10.01 04M06 Password Policy

Please see 04M06 Password Policy 

Policy may be made available upon signing a non-disclosure agreement.

10.2 04M07 Data Classification and Processing Policy

10.2.1 Policy

The sensitivity of applications/systems is explicitly identified and documented. The organization’s  solution to the Translation Industry is a security-first approach to the handling of any request.  The classification of the data of our infrastructure, architecture and home grown software development is carefully selected to handle the most sensitive information available.  The following information provides guidance and sets the expectation for the processing and classification of information and customer data:

1. Information must be processed only in applications and systems where sensitive data can be protected by guaranteeing confidentiality, integrity and availability.
2. To that end all services provided by the company are rendered from Language Vault, a Portal to vendors, clients and staff members, and Workspaces in the cloud, a windows desktop solution that guarantees no leaking of information on the end user side.
3. The SDLC used for building Language Vault has several security layers IAW 07P13 Software Development Lifecycle Procedure.
4. The Workspaces in the cloud are also built on top of a number of security layers IAW 07P12 Configuration Management SOP 
5. Information must be classified according to an appropriate level of confidentiality, integrity, and availability.
6. All resources covered by the scope of this policy must handle information appropriately and IAW its classification level.
7. All data within any system must be assigned to a Data Owner.
8. The Data Owner is responsible for ensuring that all data are properly classified. 
9. Unless the risk is identified and accepted by the data owner, sensitive systems are isolated from non-sensitive systems.

Data Classification

NOTE: Any information not explicitly classified as Confidential or Restricted shall be considered as Confidential and treated as outlined in this document.

Please see 04M07 Data Classification Policy for additional information. Policy may be made available upon signing a non-disclosure agreement.

10.3 04M08 Information Access Control Policy

• Policy

The following information sets the rules and expectations for the security and accessing of information:

Resources (employee, external provider, and consultant) shall understand the sensitivity of their data and treat them accordingly per IAW 04M07 Data Classification Policy. Even if technical security mechanisms fail or are absent, every user should still attempt to maintain data security commensurate with its sensitivity.

• System Access Controls

The organization shall provide resources with access to the information they need to carry out their responsibilities in as effective and efficient a manner as possible. 

1. Restricted information can only be accessed from restricted environments. Circumventing this (e.g., by taking screenshots) is considered a violation of the established Security Policies.
2. Access to systems and data information shall be given through the provision of unique credentials per IAW 07P08 IT Service Desk SOP and a complex password per IAW 04M06 Password Policy.
3. Authentication is performed with user, password and 2FA over secure channels (PCoIP for workspaces and TLS 1.2 for servers). Language Vaults also require 2MFA. 
4. Shared credentials  (individual, shared/group, system, application, guest/anonymous, emergency and temporary) are not authorized on systems. If exceptions exist, the ISO must approve the usage of them.
5. An employee is held accountable for any activity performed under their login ID.
6. Requests to modify or revoke access to the organizations’ internal systems shall be provided only after the written request is received and validated by the IAO IAW 07P08 IT Service Desk SOP. 
7. The information system employs replay-resistant authentication mechanisms such as nonce, one-time passwords, or time stamps to secure network access for privileged accounts. The company deploys “replay-resistant” authentication mechanisms on the workspaces with the help of Kerberos authentication and in Portal with the help of CSRF tokens and HTTP headers .
8. Access to Restricted information shall be limited to authorized resources whose responsibilities require it, as determined by law, contractual agreement, or the Information Security Policy.  
9. The organization does not facilitate information sharing by enabling authorized users to determine a business partner’s.  If exceptions exist, the President must authorize the use of them after being advised by the ISO IAW 07P18 Access Control SOP.
10. Access rights to applications and application functions are limited to the minimum necessary using menus. Language Vault uses the concept of business hub which has been subject of study by its main architect for years. In simple terms absolutely all functionality from the system can be accessed via APIs using the same RBAC that applies to regular users that access the app via the UI.
11. Access rights from an application to other applications are controlled.
12. The translation process takes place within the Language Vault, where all user interactions are logged. These logs are accessible from the Audit Module where the date, the action, the request payload, the IP, the user agent of the user and the response code are all logged IAW 07P19 07P19 Access Audit Logging and Monitoring SOP.

• Removable Media

The organization places reasonable restrictions on removal media. The use of removable media is prohibited on all equipment owned by the organization. Exceptions are managed  IAW 07P10 Antivirus and Malware SOP and the 07P08 IT Service Desk SOP and must be approved by the ISO.  Restricted Workspaces are prohibited to use removable media, no exceptions.

Please see 04M08 Information Access Control Policy for additional information. Policy may be made available upon signing a non-disclosure agreement.

10.4 04M10 Remote Access Control Policy

1 Policy

1. Storage of restricted information and customer data on any personal device is prohibited.
2. All remote access users are to comply with all security policies, may not perform illegal activities and may not use the access for outside business interests. 
3. It is the responsibility of employees, external vendors, and consultants with remote access privileges to the managed resources to ensure their remote access connection is used only for the organization’s related business purposes.

2 Requirements

1. Remote access passwords and dual authentication tokens shall only be used by the individual to whom access was granted.
2. All users are expected to report any loss of dual authentication devices immediately to the IT department, as well as any suspicious activity reported in their account.
3. The session time-out mechanism is set at fifteen minutes of inactivity in the WS, and closes network activity at 15 mins of inactivity. Once the user resumes activity, the user will be required to reestablish authenticated access once the session has been paused or closed.
4. Language Vault session times out after fifteen minutes of inactivity. 

Please see 04M10 Remote Access Control Policy for additional information. Policy may be made available upon signing a non-disclosure agreement.

10.5 04M12 Acceptance  Use Policy

1 Policy

1. The organization formally addresses multiple safeguards before allowing the use of information systems for information exchange.
2. Employees, external vendors, and consultants are responsible for exercising good judgment regarding appropriate use of resources per IAW 05M03 Information Security Policy and Policies.
3. Employees, vendors are aware of the limits existing for their use of the organization’s information and assets associated with information processing facilities and resources; and they are responsible for their use of any information resource and of any use carried out under their responsibility.
4. Automated controls are in place to authorize and restrict the use of mobile code. Internet/Extranet-related systems, including but not limited to computer equipment, software, operating systems, storage media, network accounts, electronic mail, WWW browsing, and additional services like SFTP and cloud services like GSuite, are the property of the organization. These systems are to be used for business purposes in serving the interests of the organization and its customers in the course of normal operations.  The company does not allow the usage of browser versions that support Java, ActiveX, shockwave or flash animations as these components pose a number of threats and have been deprecated meaning there are no patches available for the engines responsible to processing this kind of media.
5. Proprietary information stored on electronic and computing devices, whether owned or leased by the organization, the employee, or external providers, remains the sole property of the organization. 
6. Employees and external vendors may access, use, or share the organization proprietary information only under NDA and to the extent it is authorized and necessary to fulfill their assigned job duties.
7. Physical and logical access is only given to vendors for support purposes when necessary, with management approval, and such access is monitored. The access to vendors must be given under the premise of the need to know and monitor monthly as part of the IAO audit IAW 07P08 IT Help Desk SOP  
8. Employees, external vendors, and consultants have a responsibility to promptly report any access error, theft, loss or unauthorized disclosure of proprietary information per IAW 07P08 IT Service Desk SOP.
9. Employees and external vendors and consultants should not circumvent any restrictions imposed by IT on the usage of resources. 
10. All mobile and computing devices used to connect to the organization’s owned resources shall be done per IAW 04M08 Information Access Control Policy.
11. System level and user level passwords must comply with the 04M06 Password Policy. Providing access to another individual, either deliberately or through failure to secure its access, is prohibited.
12. All computing devices, including workspaces in the cloud and those devices used to connect to them, must be secured with a password-protected screensaver per IAW 07P03 Work Environment SOP. 
13. Employees, external vendors, and consultants must use extreme caution when opening email attachments or clicking on email links. The email address of the sender (not the sender name) of each email should be known to the addressee and verified by calling the sender in case such communication was not expected.
14. The organization will store emails for seven years. All email communications, even after being deleted by the organization’s  email holder,  are archived and can be used for said time period.  
15. Under no circumstances is an employee, external vendor, or consultant authorized to engage in any activity that is illegal under local, state, federal or international law while utilizing the organization’s resources. This includes, but it is not limited to:
    1. Using a computing asset to actively engage in procuring or transmitting material that is in violation of sexual harassment or hostile workplace laws in the user’s local jurisdiction. 
16. Effecting security breaches or disruptions of network communication. Security breaches include, but are not limited to, accessing data of which the employee or external vendor is not an intended recipient or logging into a server or account that the employee is not expressly authorized to access, unless these duties are within the scope of regular duties. For purposes of this section, “disruption” includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes. 
    1. Port scanning or security scanning is expressly prohibited unless a request is made to IT per IAW 07P08 IT Service Desk SOP and approved by the ISO.
    2. Executing any form of network monitoring which will intercept data not intended for the employee’s host, unless this activity is a part of the employee’s or vendor’s  normal job/duty. 
    3. Circumventing user authentication or security of any host, network, or account. 
    4. Introducing honeypots, honeynets, or similar technology on the network. 
    5. Interfering with or denying service to any user other than the user’s host (for example, denial of service attack). 
    6. Using any program/script/command, or sending messages of any kind, with the intent to interfere with, or disable, a user’s terminal session, by any means, locally or via the Internet/Intranet/Extranet. 
    7. Providing information about, or lists of, Company employees/external vendors/consultants  to parties outside BigLS.
17. The organization reserves the right to audit networks and systems on a periodic basis to   ensure compliance with this policy. 
18. Social media accounts must not be used to share any information about the company that has not been previously authorized by management and they must exercise caution when participating in chats, forums, surveys or any other means of interactions. All Employees must conduct themselves in accordance with 07F03 Employee handbook.

2 Software Use

1. The organization has purchased fully licensed copies of computer software from a variety of publishers and vendors. 
2. Operational systems only hold approved programs or executable codes.
3. Licensed and registered copies of software programs are placed on remote workspaces in accordance with the licensing agreements and company policies. No other copies of this software or its documentation can be made without the express written consent of the software publisher and of  the organization. 
4. The organization prohibits users from installing unauthorized software, including data and software from external networks.
5. The organization prevents program execution in accordance with a list of authorized (whitelisted) software programs and components and strict rules about the addition of any new component which demands the authorization of the VP of Technology. 
6. Only authorized administrators are allowed to implement approved upgrades to software, applications, and program libraries, based on business requirements and the security implications of the release.

3 Software from Other Sources

1. The organization shall provide copies of legally acquired software to meet all legitimate needs in a timely fashion and in sufficient quantities for all remote desktops. The use of software obtained from any other source could present security and legal threats to the company, and such use is strictly prohibited. 
2. Any software, including commercial, OEM, retail, open source, shareware, and freeware software may present a security risk. Any software can only be used if the ISO has approved it. Requests shall be submitted via ticket per IAW 07P08 IT Service Desk SOP.
3. Messaging and/or any type of communication is disabled on the restricted WS

Please see 04M12 Acceptable Use Policy for additional information. Policy may be made available upon signing a non-disclosure agreement.

10.6 04M16 Intellectual Property Policy

1. Policy

1. The organization’s intellectual property, such as information, processes, and technology are available to its employees, external vendors, and consultants to carry out their daily responsibilities. 
2. Employees, external vendors, and consultants are prohibited from any unauthorized use of the Company’s intellectual property, such as, but not limited to,  audio and video tapes, print materials and source codes.
3. It is the responsibility of every employee, external vendor, and consultant to help protect intellectual property. It is the responsibility of VPs, Directors and Managers to foster and maintain awareness of the importance of protecting intellectual property.
4. While processing customer data, employees, external vendors and consultants are to use legal and ethical resources to prevent any type of data loss.

Please see 04M16 Intellectual Property Policy for additional information. Policy may be made available upon signing a non-disclosure agreement.

• 10.7 07P09 Equipment Destruction Disposal SOP; Confidential

• 10.8 07F18 Security Management Structure; Confidential 

• 10.9 04M09 Data Encryption Policy; Confidential

• 10.10 04M11 Firewall Policy; Confidential

• 10.11 04M13 Disaster Recovery Policy; Confidential

• 10.12 04M14 Software Development Lifecycle Policy; Confidential

• 10.13    04M18 Mobile Device Policy; Confidential
• 10. 14   04M11 Firewall Policy; Confidential
• 10.15    04M14 Software Development Lifecycle Policy; Confidential
• 10.16    07P10 Antivirus and Malware  SOP; Confidential
• 10.17 07P11 Penetration and Vulnerability SOP; Confidential
• 10.18 07P13  Software Development Lifecycle SOP; Confidential
• 10.19 07P14 Firewall SOP; Confidential
• 10.20 07P15 Encryption SOP; Confidential
• 10.21 07P17 Password SOP; Confidential
• 10.22 07P20 Third Party Service Provider SOP; Confidential
• 10.23 07P22 Business Continuity and Disaster Recovery Procedure; Confidential
• 10.24 07P23 Business Contingency Plan (BIA, BCP, DRP); Confidential

details of our selected controls and how they have been implemented and measured are considered confidential information and restricted to the organization. the following sections have been removed to make this document available to the public: security policy, organization of information security, asset management, human resources security, physical and environmental security, communications and operations management, access control, information systems acquisition, development and maintenance, information security incident management, business continuity management, and compliance