Offeror must describe its notification process in the event of a security incident, including relating to timing, incident levels. Offeror should take into consideration that Purchasing Entities may have different notification requirements based on applicable laws and the categorization type of the data being processed or stored. A security incident can originate from various sources; the client, Pondera, or Quest Technology Management. Xxxxxxx designates a project/client advocate manager that acts as a Point of Contact (POC) for each engagement. Any security (or suspected security) incidents discovered by our clients are immediately reported to the POC which internally escalates it the Pondera Information Security Officer (ISO). When Pondera or Quest Technology Management detect actual or suspected security incidents, they are immediately reported to Pondera’s ISO. The Pondera ISO investigates and validates whether the reported incident is a security incident. If the scope of the incident includes Quest Technology Management, Pondera has established a strict urgency based Service Level Agreement (SLA) with Quest Technology Management. For severity 1 issue like a security breach, work begins within minutes from the time the incident is identified and/or reported and response could, but not limited to, taking the FDaaS servers offline to ensure data is no longer accessible through the network. The Pondera ISO and the clients designated authorized incident response individuals work closely and establish an action plan which would follow the incident to its resolution. Post security incident, Xxxxxxx employs a lessons learned process that is aimed to address any vulnerabilities discovered during the incident resolution process.
Offeror must describe whether it can restrict visibility of cloud hosted data and documents to specific users or groups. Pondera Solutions, Inc. employs a role based access control (RBAC) policy which bases access control decisions on the functions a user is allowed to perform within a particular role or group. Thus the RBAC policy allows for the restriction of data, functions and /or documents to specific users or groups. It should be noted that users cannot pass access permissions on to other users at their discretion.
Offeror must describe its notification process in the event of a security incident, including relating to timing, incident levels. Offeror should take into consideration that Purchasing Entities may have different notification requirements based on applicable laws and the categorization type of the data being processed or stored. RETARUS RESPONSE: No specific Customer contact has yet been identified as the escalation point for security incidents. Usually, this is part of the implementation process. Retarus will contact the designated individual(s) (and/or escalation list) directly via phone to report the nature of the incident. No security related information will be passed via email in the event of any incident report. Retarus maintains contacts at regulatory bodies and government agencies that may also be required to be notified in the event of a breach. Again, no information regarding such an incident would be passed via email.
Offeror must describe and identify whether or not it has any security controls, both physical and virtual Zones of Control Architectures (ZOCA), used to isolate hosted servers. RETARUS RESPONSE: This is covered by Retarus’ ISAE 3402 disciplines: • Physical Security • Network and Security • User & Access Management • Customer Service Setup • Service Desk • Request Fulfillment • Change Management • Incident Management These processes are supported by and cross-linked with other vital and central processes like Information Security Management, Business Continuity, Disaster Recovery, Financial Controls, Governance, Risk Management, Asset Management and Training / Awareness covering altogether the central disciplines of ISO 2700x, but better adapted to Services as provided by Retarus.
Offeror must describe its scale-up and scale-down, and whether it is available 24x365.
