Print Page

1.  Purpose and Overview

This Vendor Privacy and Security Policy (this “Policy”) is one part of our efforts to work with Vendors, such as yourself, to reduce the risks to Safe Software Inc. and its customers. In today’s interconnected world, the security of information placed on any set of networked systems is dependent upon the security of all of the participants in that network. This Policy establishes a minimum set of controls that must be followed by all Safe Software’s Vendors in order to protect Safe Software Information and, where applicable, Safe Software Systems (and Your Systems if they interface with ours).

2.  Defined Terms and Scope

2.1  Defined terms

1. Agreement:means any written document or verbal agreement that memorializes and governs the relationship between you and Safe Software.
2. Safe Software Information, orSSI:means any information received from or about Safe Software, either directly or indirectly in any form, and any data, materials, processes, or information you develop for us or receive as a result of this relationship. Whether a safeguard is “appropriate” to protect SSI depends on the nature of the information.
3. Safe Software Systems, orSSS:means computer systems owned, licensed or otherwise used by Safe Software which process, transmit, store, or maintain SSI.
4. Safe Software, us, our,orwe:means Safe Software Inc.
5. Youoryour:means the Vendor and also the Vendor’s Third Party Providers which have access to SSI or SSS.
6. Your Systems:means computer systems owned, licensed or otherwise used by you which process, transmit, store, or maintain SSI.
7. Third Party Providers:means any entity other than Safe Software which provides you products or services which relate to the subject of this Policy or the Agreement.
8. Third Party Provider Systems:means computer systems owned, licensed or otherwise used by your Third Party Providers which process, transmit, store, or maintain SSI.

2.2  Scope

All SSI is subject to this Policy. In the event of any conflict between this Policy and any Agreement, the conflict will be interpreted and construed in a manner which provides the broadest security and protection of SSI.

3.  Policy Statement

You will implement appropriate administrative, technical, and physical safeguards to ensure the security, privacy, confidentiality, integrity, and availability of SSI. Whether SSI is stored on, processed on, or transmitted by SSS, Your Systems, or Third Party Provider Systems, you (and your Third Party Providers if applicable) will use information security controls to: (1) protect any and all SSI and SSS you have access to while performing your obligations under any Agreement; and (2) protect Your Systems and your Third Party Provider Systems on which SSI is stored, processed, or transmitted.

4.  Termination of Access

Your access to any SSI and/or SSS, including but not limited to any Safe Software customer and/or employee information, is subject to your continuing compliance with this Policy. We may immediately, automatically, and unconditionally revoke your access, and all links and interfaces, to SSI and/or SSS without liability for any reason or no reason.

5.  Information Retention & Disposal

You will, at no additional charge to Safe Software, retain SSI as required by the Agreement or, if there is no agreed-upon retention requirement outside of this Policy, as directed by Safe Software in writing. At the end of our specified retention period, or upon our written request at any time, you will return or destroy, and certify in writing that you have destroyed or returned, all SSI, as we direct. If we require information destruction, you will destroy SSI in a confidential manner. This means you will shred paper copies of SSI and you will destroy electronic copies in a confidential manner so that they are no longer usable, readable, or decipherable, and the information on them is not retrievable. Nothing in this Policy will prevent you from maintaining information, still subject to confidentiality obligations, as required by law or any regulatory authority to which you are subject.

6.  Minimum Information Security Controls

You must implement and maintain the minimum information security controls set forth below. You may implement additional controls as appropriate for your business.

6.1  Application of Security Controls

These security controls shall apply to personnel, processes and/or technology involved in the work you or your Third Party Providers do with or on behalf of Safe Software.

6.2  Audit of Security Controls

1. If we request, you will provide a written description of compliance with this Policy, which includes, at a minimum, how you implement each security control set forth below. This written description will be completed at your expense and certified in writing by your authorized representative.
2. In addition, if we request, you will allow us, or our independent third party, to audit your compliance with this Policy (including without limitation performing penetration testing and vulnerability scans). You will work with us, at your own expense, to remedy any deficiencies identified in the audit.
3. Nothing in this section limits our audit or other rights we may have in any other Agreement with you or your Third Party Providers.

6.3  Security Controls Catalog

1. Security Management: Must have a comprehensive written information security program, based on best practices standards for your industry, which is designed to protect the confidentiality, integrity, and availability (“CIA”) of assets under your management

2. Risk Management: Must perform risk assessments to evaluate risk profile regarding collection, storage, and use of information. Information classification and ownership must be defined for all information assets allowing for inventorying and management, controls application, and compliance with relevant data retention policies.

3. Personnel Security: Controls must be implemented to enable employees, contractors/contingent workers, and service providers to adhere to policies and standards according to roles and access and to reduce the risk of theft, fraud, loss, and misuse of facilities or information.

4. Physical and Environmental Security: Appropriate physical controls commensurate to risk must be implemented, managed, and reviewed to prevent unauthorized physical access, damage, and interference to information assets and IT infrastructure and equipment. In addition, physical protection against external and environmental threats such as natural disasters, malicious attacks, or accidents must be implemented, managed, and reviewed.

5.运营管理:组织必须安全ly operate IT infrastructure and applications supporting information assets through the application of key operational management controls, including but not limited to the maintenance of system and network documentation, employment of consistent and secure change and incident management processes, and maintaining vendor- supported and patched infrastructure and software.

6. Security Monitoring and Response: Vendor must leverage appropriate network and endpoint-based controls to facilitate security logging and monitoring of user activities, exceptions, faults, and events in accordance with business, legal, and regulatory requirements. Collected logs and associated analysis must be appropriately archived, protected from unauthorized access, and regularly reviewed.

7. Cryptographic controls: Cryptographic controls to protect the confidentiality, integrity, and availability of information assets in transit and at rest including controls for the management and use of cryptographic keys must be developed, implemented, and reviewed on a periodic basis.

8. Access Control: Access to resources must be regulated through the use of information security access controls and robust authorization mechanisms commensurate to risk.

9.Network Security: Network specific information security controls must be leveraged to protect information assets that traverse the Vendor's network.

10. Vendor management: Vendor must manage its third parties to protect Safe Software resources and ensure the confidentiality, integrity, and availability of SSI and assets.

11. Business Continuity and Disaster Recovery: Vendor must have appropriate BC and DR capabilities to prevent or mitigate business interruption and associated impact. Vendor must test its BC and DR capability regularly.

12. Compliance: Information security and data protection controls and processes must comply with applicable law, statutory, regulatory or contractual obligations, and any Industry Standard Information Security requirements to avoid breach and/or compromise of SSI and SSS.