General Physical Security
 Secure cabinets for data storage
Data kept with only designated individuals
Data is processed only in a physically secure area
Machines/ files are password protected
For data held electronically, data is password protected
Training every 3 months on information security
NDA signed three way – Customer, Company,
Employee
Manual data is shredded when deemed not required
Restricted Swipe Card access to production areas
Writeable media banned from production areas.
|
Data Access and Transmission
Data accessed through
Virtual Private Network (VPN) with adequate firewalls Secured FTP access with 128-bit encryption
Personal information data not accessed at all. Clients requested to either:
Send only the primary key (customer id in some cases) and the associated information, and keep the rest of the information from moving out of their premises or Mask the personal information of members (by using encryption technology)
To prevent unauthorized access to Data from outside (Hackers, etc.) Firewall – access to only specific IPs
Access only via login id and passwords
Inactive sessions expire in 10 minutes
|
