These Data Security Requirements amend and form part of the Terms of Service by and between Judgment, Inc. and Customer (the “Terms”).Capitalized terms used but not defined in these Data Security Requirements will have the meanings given to them in the Terms. Judgment Labs and Customer will apply at least the following types of security measures to Customer Data, as applicable:
1. Physical access control
Technical and organizational measures designed to prevent unauthorized persons from gaining access to the premises and facilities (including databases, application servers, and related hardware) where Customer Data is Processed, such as:
- Establishing security areas, restriction of access paths;
- Establishing access authorizations for employees and third parties;
- Access control system (ID reader, magnetic card, chip card);
- Key management, card-keys procedures;
- Door locking (electric door openers, etc.);
- Security staff, janitors;
- Surveillance facilities, video/CCTV monitor, alarm system; and
- Securing decentralized data processing equipment and personal computers.
2. Virtual access control
Technical and organizational measures designed to prevent systems used to Process Customer Data from being used by unauthorized persons, such as:
- User identification and authentication procedures;
- ID/password security procedures (special characters, minimum length, change of password);
- Automatic blocking (e.g., password or timeout);
- Monitoring of break-in-attempts and automatic turn-off of the user ID upon several erroneous password attempts;
- Creation of one master record per user, user-master data procedures per data processing environment; and
- Encryption of archived data media.
3. Data access control
Technical and organizational measures designed to ensure confidentiality and that persons entitled to use a data processing system gain access only to such Customer Data in accordance with their access rights, and that Customer Data cannot be read, copied, modified, or deleted without authorization, such as:
- Internal policies and procedures;
- Control authorization schemes;
- Default configuration;
- Differentiated access rights (profiles, roles, transactions, and objects);
- Monitoring and logging of access;
- Disciplinary action against employees who access Customer Data without authorization;
- Reports of access;
- Access procedure;
- Change procedure;
- Deletion procedure; and
- Encryption.
4. Disclosure control
Technical and organizational measures designed to ensure that Customer Data cannot be read, copied, modified, or deleted without authorization during electronic transmission, transport, or storage on storage media (manual or electronic), and that it can be verified to which companies or other legal entities to whom Customer Data is disclosed, such as:
- Encryption/pseudonymization/tunneling;
- Logging; and
- Transport security.
5. Entry control
Technical and organizational measures designed to monitor whether Customer Data has been entered, changed, or removed (deleted), and by whom, from data processing systems, such as:
- Logging and reporting systems; and
- Audit trails and documentation.
6. Control of instructions
Technical and organizational measures designed to ensure that Customer Data is Processed solely in accordance with the instructions of the Customer, such as:
- Unambiguous wording of the contract;
- Formal commissioning (request form); and
- Criteria for selecting a processor.
7. Availability control
Technical and organizational measures designed to ensure the integrity, availability and resilience of the Processing systems, and that Customer Data is protected against accidental destruction or loss (physical/logical) such, as:
- Backup procedures;
- Mirroring of hard disks (e.g. RAID technology);
- Uninterruptible power supply (UPS);
- Remote storage;
- Antivirus/firewall systems; and
- Disaster recovery plan, in the event of a physical or technical incident.
8. Separation control
Technical and organizational measures designed to ensure that Customer Data collected for different purposes can be Processed separately, such as:
- Separation of databases;
- “Internal client” concept / limitation of use;
- Segregation of functions (production/testing); and
- Procedures for storage, amendment, deletion, transmission of data for different purposes.
9. Testing controls
Technical and organizational measures to test, assess, and evaluate the effectiveness of the technical and organizational measures implemented designed to ensure the security of the Processing, such as:
- Periodic review and testing of disaster recovery plan;
- Testing and evaluation of software updates before they are installed;
- Authenticated (with elevated rights) vulnerability scanning; and
- Test bed for specific penetration tests and red team attacks.
10. IT governance
Technical and organizational measures to improve the overall management of IT and ensure that the activities associated with information and technology are aligned with the compliance efforts, such as:
- Certification/assurance of processes and products;
- Processes for data minimization;
- Processes for data quality;
- Processes for limited data retention;
- Processes for ensuring accountability; and
- Data subject rights policies.