Access, Intervention, Transfer and Separation Control a. Supplier will maintain documented security architecture of networks that it manages in its operation of the Contracted Services. Supplier will employ measures to prevent unauthorized network connections to systems, applications, and network devices, ensuring compliance with secure segmentation, isolation, and defense in-depth standards. Supplier may use wireless networking technology in its delivery of the Contracted Services, but Supplier must encrypt and require secure authentication for any such wireless networks.
b. Supplier will maintain measures that are designed to logically separate and prevent any Cellulant Data from being exposed to or accessed by unauthorized persons. Further, Supplier will maintain appropriate isolation of its production, non-production, and any other environments, and, if any Cellulant Data are transferred to a non-production environment (for example to reproduce an error), then Supplier will ensure that all security and privacy protections in the non-production environment are equal to those in the production environment.
c. Supplier will encrypt all Cellulant Data in transit and at rest (unless Supplier demonstrates to Cellulant’s reasonable satisfaction that encryption for Cellulant Data at rest is technically infeasible). Supplier will also encrypt all physical media, if any, such as media containing backup files. Supplier will maintain documented procedures for secure key generation, issuance, distribution, storage, rotation, revocation, recovery, backup, destruction, access, and use associated with data encryption.
d. If Supplier requires access to any Cellulant Data, Supplier will restrict and limit such access to the least level required to provide and support the Contracted Services. Supplier shall require that such access, including administrative access to any underlying components (i.e., privileged access), will be individual, role based, and subject to approval and regular validation by authorized Supplier employees following segregation of duty principles. Supplier will maintain measures to identify and remove redundant and dormant accounts with privileged access and will promptly revoke such access upon the account owner’s separation or at the request of authorized Supplier employees, such as the account owner’s manager.
e. Consistent with industry standard practices, Supplier will maintain technical measures enforcing timeout of inactive sessions, lockout of accounts after multiple sequential failed login at...
Access, Intervention, Transfer and Separation Control a. IBM will maintain documented security architecture of networks managed by IBM in its operation of the Cloud Service. IBM will separately review such network architecture, including measures designed to prevent unauthorized network connections to systems, applications and network devices, for compliance with its secure segmentation, isolation, and defense-in-depth standards prior to implementation. IBM may use wireless networking technology in its maintenance and support of the Cloud Service and associated components. Such wireless networks, if any, will be encrypted and require secure authentication and will not provide direct access to Cloud Service networks. Cloud Service networks do not use wireless networking technology.
b. IBM will maintain measures for a Cloud Service that are designed to logically separate and prevent Content from being exposed to or accessed by unauthorized persons. IBM will maintain appropriate isolation of its production and non-production environments, and, if Content is transferred to a non-production environment, for example in order to reproduce an error at Client's request, security and privacy protections in the non-production environment will be equivalent to those in production.
c. To the extent described in the relevant TD, IBM will encrypt Content not intended for public or unauthenticated viewing when transferring Content over public networks and enable use of a cryptographic protocol, such as HTTPS, SFTP, and FTPS, for Client's secure transfer of Content to and from the Cloud Service over public networks.
d. IBM will encrypt Content at rest when specified in a TD. If the Cloud Service includes management of cryptographic keys, IBM will maintain documented procedures for secure key generation, issuance, distribution, storage, rotation, revocation, recovery, backup, destruction, access, and use.
e. If IBM requires access to Content, it will restrict such access to the minimum level required. Such access, including administrative access to any underlying components (privileged access), will be individual, role-based, and subject to approval and regular validation by authorized IBM personnel following the principles of segregation of duties. IBM will maintain measures to identify and remove redundant and dormant accounts with privileged access and will promptly revoke such access upon the account owner's separation or the request of authorized IBM personnel, such as the account owner's manager.
f. Consistent with indus...
Access, Intervention, Transfer and Separation Control a. Cellulant will maintain documented security architecture of networks that it manages in its operation of the Contracted Services. Cellulant will employ measures to prevent unauthorized network connections to systems, applications, and network devices, ensuring compliance with secure segmentation, isolation, and defense in-depth standards. Cellulant may use wireless networking technology in its delivery of the Contracted Services, but Cellulant must encrypt and require secure authentication for any such wireless networks.
b. Cellulant will maintain measures that are designed to logically separate and prevent any Customer Data from being exposed to or accessed by unauthorized persons. Further, Cellulant will maintain appropriate isolation of its production, non-production, and any other environments, and, if any Customer Data are transferred to a non-production environment (for example to reproduce an error), then Cellulant will ensure that all security and privacy protections in the non-production environment are equal to those in the production environment.
c. Cellulant will encrypt all Customer Data in transit and at rest (unless Cellulant demonstrates to Customer’s reasonable satisfaction that encryption for Customer Data at rest is technically infeasible). Cellulant will also encrypt all physical media, if any, such as media containing backup files. Cellulant will maintain documented procedures for secure key generation, issuance, distribution, storage, rotation, revocation, recovery, backup, destruction, access, and use associated with data encryption.
d. If Cellulant requires access to any Customer Data, Cellulant will restrict and limit such access to the least level required to provide and support the Contracted Services. Cellulant shall require that such access, including administrative access to any underlying components (i.e., privileged access), will be individual, role based, and subject to approval and regular validation by authorized Cellulant employees following segregation of duty principles. Cellulant will maintain measures to identify and remove redundant and dormant accounts with privileged access and will promptly revoke such access upon the account owner’s separation or at the request of authorized Cellulant employees, such as the account owner’s manager.
e. Consistent with industry standard practices, Cellulant will maintain technical measures enforcing timeout of inactive sessions, lockout of accounts after multiple sequential fai...
Access, Intervention, Transfer and Separation Control. (a) Pindrop will maintain measures for Pindrop-Controlled Systems that are designed to logically separate and prevent Company’s Confidential Information stored within Pindrop-Controlled Systems from being exposed to or accessed by unauthorized persons. Pindrop will maintain isolation of its production and non-production environments, and, if Company’s Confidential Information is transferred to a non- production environment, for example to reproduce an error at Company’s request, security and privacy protections in the non-production environment will be equivalent to those in production.
(b) Pindrop will encrypt Company’s Confidential Information that is subject to long-term storage within Pindrop-Controlled Systems and when Company’s Confidential Information is transmitted by Pindrop over public networks. Pindrop will maintain documented procedures for encryption key generation, issuance, distribution, storage, rotation, revocation, recovery, backup, destruction, access, and use. To the extent that encryption is impractical, Pindrop will use compensating controls designed to protect Company’s Confidential Information.
(c) If Pindrop requires access to Company’s Confidential Information that is stored within Pindrop-Controlled Systems, and if such access is managed by Pindrop, Pindrop will deploy measures designed to restrict access to the minimum level required. Such access, including, without limitation, administrative access, will be individual, role- based, and subject to approval and regular validation by authorized Pindrop personnel following the principles of segregation of duties. Pindrop will maintain measures to identify and remove redundant and dormant accounts with privileged access and will promptly revoke such access upon the account owner’s separation or upon the request of authorized Pindrop personnel, such as the account owner’s manager.
(d) For Pindrop-Controlled Systems, Pindrop will:
(i) monitor and periodically test the Pindrop-Controlled Systems to assess the effectiveness of the Security Policy;
(ii) maintain technical measures enforcing timeout of inactive sessions, lockout of accounts after multiple sequential failed login attempts, strong password or passphrase authentication, and password change frequency;
(iii) monitor use of privileged access and maintain security information and event management measures designed to: (1) identify unauthorized access, use or tampering; (2) facilitate a timely and appropriate response, and (3) en...
Access, Intervention, Transfer and Separation Control a. The Supplier will maintain a documented security architecture for Components. The Supplier will separately review such security architecture, including measures designed to prevent unauthorized network connections to systems, applications and network devices, for compliance with its secure segmentation, isolation, and defense-in-depth standards prior to implementation.
b. The Supplier may use wireless networking technology in its maintenance and support of the Supplier Services and associated Components. Such wireless networks, if any, will be encrypted and require secure authentication and will not provide direct access to the Supplier Cloud Services networks. The Supplier Cloud Services networks do not use wireless networking technology.
c. The Supplier will maintain measures for the Supplier Service that are designed to logically separate and prevent Content from being exposed to or accessed by unauthorized persons. The Supplier will maintain appropriate isolation of its production and non-production environments, and, if Content is transferred to a non -production environment, for example to reproduce an error at the Buyer's request, security and privacy protections in the non -production environment will be equivalent to those in production.
d. The Supplier will encrypt Content not intended for public or unauthenticated viewing when transferring Content over public networks and enable use of a cryptographic protocol, such as HTTPS, SFTP, or FTPS, for the Buyer’s secure transfer of Content to and from the Supplier Services over public networks.
e. The Supplier will encrypt Content at rest if and as specified in the Supplier Services Document. If the Supplier Service includes management of cryptographic keys, the Supplier will maintain documented procedures for secure key generation, issuance, distribution, storage, rotation, revocation, recovery, backup, destruction, access, and use.
f. If the Supplier requires access to Content to provide the Supplier Services, and if such access is managed by the Supplier, the Supplier will restrict access to the minimum level required. Such access, including administrative access to any underlying Components (privileged access), will be individual, role-based, and subject to approval and regular validation by authorized the Supplier personnel following the principles of segregation of duties. The Supplier will maintain measures to identify and remove redundant and dormant accounts with privileged access and will ...
