• Asset Inventory. DataQuel will maintain an asset inventory of its infrastructure, network, applications and cloud environments. DataQuel will also maintain an inventory of its media on which Client Data is stored. Access to the inventories of such media will be restricted to personnel authorized in writing to have such access.
• Data Handling. DataQuel will
  • Classify Client Data to help identify such data and to allow for access to it to be appropriately restricted.
  • Limit printing of Client Data from its systems to what is minimally necessary to perform services and have procedures for disposing of printed materials that contain Client Data.
  • Require its personnel to obtain appropriate authorization prior to storing Client Data outside of contractually approved locations and systems, remotely accessing Client Data, or processing Client Data outside the Parties’ facilities.

• Security Training. DataQuel will
  • Inform its personnel about relevant security procedures and their respective roles.
  • Inform its personnel of the possible consequences of breaching the security rules and procedures.
  • Only use anonymous data in its training environments.

• Physical Access to Facilities. DataQuel will implement and maintain procedures to limit authorized access to its facilities where information systems that process Client Data are located.
• Physical Access to Components. DataQuel will maintain records of the incoming and outgoing media containing Client Data, including the kind of media, the authorized sender/recipients, date and time, the number of media, and the types of Client Data they contain.
• Component Disposal. DataQuel will use industry standard (e.g., ISO 27001, CIS Sans 20, and/or NIST Cyber-Security Framework, as applicable) processes to delete Client Data when it is no longer needed.

• Operational Policy. DataQuel will maintain security documents describing its security measures and the relevant procedures and responsibilities of its personnel who have access to Client Data.
• Mobile Device Management (MDM)/Mobile Application Management (MAM). DataQuel will maintain a policy for its mobile devices that:
  • Enforces device encryption.
  • Prohibit use of blacklisted apps.
  • Prohibits enrollment of mobile devices that have been “jail broken.”
• Data Recovery Procedures. DataQuel will
  • Have specific data recovery procedures with respect to its systems in place designed to enable the recovery of Client Data being maintained in its systems.
  • Review its data recovery procedures at least annually.
  • Log data restoration efforts with respect to its systems, including the person responsible, the description of the restored data and where applicable, the person responsible and which data (if any) had to be input manually in the data recovery process.
• Malicious Software. DataQuel will have anti-malware controls to help avoid malicious software gaining unauthorized access to Client Data, including malicious software originating from public networks.
• Data Beyond Boundaries. DataQuel will
  • Encrypt Client Data that it transmits over public networks.
  • Protect Client Data in media leaving its facilities (e.g., through encryption).
  • Implement automated tools where practicable to reduce the risks of misdirected email, letters, and / or faxes from its systems.
• Event Logging.
  • For its systems containing Client Data, DataQuel will log events consistent with its stated policies or standards.

• Access Policy. DataQuel will maintain a record of the security privileges of individuals having access to Client Data via its systems.
• Access Authorization. DataQuel will
  • Maintain and update a record of personnel authorized to access Client Data via its systems.
  • When responsible for access provisioning, promptly provision authentication credentials.
  • Deactivate authentication credentials where such credentials have not been used for a period of time (such period of non-use not to exceed 90 days).
  • Deactivate authentication credentials upon notification that access is no longer needed (e.g., employee termination, project reassignment, etc.) within two business days.
  • Identify those personnel who may grant, alter or cancel authorized access to data and resources.
  • Ensure that where more than one individual has access to its systems containing Client Data, the individuals have unique identifiers/log-ins (i.e., no shared ids).
• Least Privilege. DataQuel will
  • Only permit its technical support personnel to have access to Client Data when needed
  • Maintain controls that enable emergency access to productions systems via firefighter ids, temporary ids or ids managed by a Privileged Access Management (PAM) solution.
  • Restrict access to Client Data in its systems to only those individuals who require such access to perform their job function.
  • Limit access to Client Data in its systems to only that data minimally necessary to perform the services.
  • Support segregation of duties between its environments so that no individual person has access to perform tasks that create a security conflict of interest (e.g., developer/reviewer, developer/tester).
• Integrity and Confidentiality. DataQuel will instruct its personnel to disable administrative sessions when leaving premises or when computers are otherwise left unattended.
• Authentication. DataQuel will
  • Use industry standard (e.g., ISO 27001, CIS Sans 20, and/or NIST Cyber-Security Framework, as applicable) practices to identify and authenticate users who attempt to access its information systems.
  • Where authentication mechanisms are based on passwords, require that the passwords are renewed regularly.
  • Where authentication mechanisms are based on passwords, require the password to contain at least eight characters and three of the following four types of characters: numeric (0-9), lowercase (a-z), uppercase (A-Z), special (e.g., !, *, &, etc.).
  • Ensure that de-activated or expired identifiers are not granted to other individuals.
  • Monitor repeated attempts to gain access to its information systems using an invalid password.
  • Maintain industry standard (e.g., ISO 27001, CIS Sans 20, and/or NIST Cyber-Security Framework, as applicable) procedures to deactivate passwords that have been corrupted or inadvertently disclosed.
  • Use industry standard (e.g., ISO 27001, CIS Sans 20, and/or NIST Cyber-Security Framework, as applicable) password protection practices, including practices designed to maintain the confidentiality and integrity of passwords when they are assigned and distributed, as well as during storage.
• Multi-Factor Authentication. DataQuel will implement Multi-Factor Authentication for internal access and remote access over virtual private network (VPN) to its systems.

• At least annually, DataQuel will perform penetration and vulnerability assessments on DataQuel's IT environments in accordance with DataQuel's internal security policies and standard practices.
• DataQuel agrees to share with Client summary level information related to such tests as conducted by DataQuel to the extent applicable to the Services.
• For clarity, as it relates to such penetration and vulnerability testing, Client will not be entitled to (i) data or information of other customers or clients of DataQuel; (ii) test third party IT environments except to the extent DataQuel has the right to allow such testing; (iii) any access to or testing of shared service infrastructure or environments, or (iv) any other Confidential Information of DataQuel that is not directly relevant to such tests and the Services.
• For any DataQuel IT systems that are physically dedicated to Client, the Parties may agree to separate, written testing plans and such testing will not to exceed two tests per year.

DataQuel will

• Have controls to avoid individuals gaining unauthorized access to Client Data in its systems.
• Use email-based data loss prevention to monitor or restrict movement of sensitive data.
• Use network-based web filtering to prevent access to unauthorized sites.
• Use firefighter IDs or temporary user IDs for production access.
• Use network intrusion detection and / or prevention in its systems.
• Use secure coding standards.
• Scan for and remediate OWASP vulnerabilities in its systems.
• To the extent technically possible, expect that the Parties will work together to limit the ability of DataQuel personnel to access non-Client and non-DataQuel environments from the Client systems.
• Maintain up to date server, network, infrastructure, application and cloud security configuration standards.
• Scan its environments to ensure identified configuration vulnerabilities have been remediated.

• DataQuel will have a patch management procedure that deploys security patches for its systems used to process Client Data that includes:
  • Defined time allowed to implement patches (not to exceed 90 days for high or medium patches as defined by DataQuel’s standard); and
  • Established process to handle emergency or critical patches as soon as practicable.

• DataQuel will implement controls for workstations it provides that are used in connection with service delivery/receipt incorporating the following:
  • Software agent that manages overall compliance of workstation and reports at a minimum on a weekly basis to a central server
  • Encrypted hard drive
  • Patching process so that workstations are patched within the documented patching schedule
  • Ability to prevent blacklisted software from being installed
  • Antivirus with a minimum weekly scan
  • Firewalls installed

• Security Breach Response Process. DataQuel will maintain a record of its own security breaches in its systems with a description of the breach, the time period, the consequences of the breach, the name of the reporter, and to whom the breach was reported, and the process for recovering data.
• Service Monitoring. DataQuel’s security personnel will review their own logs as part of their security breach response process to propose remediation efforts if necessary.

• DataQuel will have processes and programs that are aligned to ISO 22301 to enable recovery from events that impact its ability to perform in accordance with the Agreement.