1.1 Introduction

This page describes technical and organizational security measures and controls implemented by Netsurit to protect the data customers entrust to us as part of the Netsurit service.

Within this, the following definitions apply:

“Customer” means any subscriber to Netsurit services.

“Netsurit Service” means the Technical and Advisory Services provided by Netsurit to our Customers.

“Confidential Data” means any information provided, submitted or stored by the Customer that is processed by Netsurit as part of our service delivery and includes Personal Data.

“Personal Data” means any information relating to an identified or identifiable legal and natural person.

“Personnel” means Netsurit employees and authorized individual contractors/vendors.

“Strong Encryption” means the use of industry standard encryption measures.

This document is a high-level overview of Netsurit’s technical and organizational measures. Netsurit may change these measures from time to time to adapt to the evolving security landscape and where required will notify customers of these changes.

1.2 Organization of Information Security

Objective: 

To outline Netsurit’s information security structure.

Measures: 

1. Netsurit is committed to deploy trained/certified security Personnel responsible for information security.
2. The information security function reports directly to a Netsurit senior leadership team member, independent to operational management.
3. Netsurit has a comprehensive set of information security policies, approved by senior management and disseminated to all Personnel.
4. Netsurit security policies are reviewed at least annually and updated when needed.
5. All Netsurit Personnel have signed legally reviewed confidentiality agreements that apply during and post-engagement.
6. Failure of personnel to follow information security policies can be treated as a disciplinary matter and lead to sanctions, including dismissal.
7. All Netsurit Personnel are given training in information security, and complete two information security tests on a bi-annual basis.
8. Netsurit is committed to continual improvement of its security.

1.3 Information Security Management System

Objective: 

Netsurit has established an ISMS (information security management system) to evaluate risks to the security of Confidential Data, to manage the assessment and treatment of these risks and to continually improve its information security.

Measures: 

1. Netsurit has deployed an ISMS (Information Security Management System) that serves as the foundation of our information security practices.

1.4 Physical Access

Objective: 

To protect the physical assets that contain Confidential Data.

Measures: 

1. Netsurit operates from several industry certified third-party production data centres with a defined and protected physical perimeter, strong physical controls including access control mechanisms, controlled delivery and loading areas, surveillance, and security guards.
2. Only authorized Personnel have access to the data centre premises housing Confidential Data and access is controlled through a security registration process requiring a government issued photo ID.
3. Power and telecommunications cabling carrying Confidential Data or supporting information services at the production data centres are protected from interception, interference and damage.
4. The production data centres and their equipment are physically protected against natural disasters, unauthorized entry, malicious attacks, and accidents.
5. Equipment at the production data centre is protected from power failures and other disruptions caused by failures in supporting utilities and is appropriately maintained.
6. When Confidential Data is copied electronically by Netsurit outside the production data centre, appropriate physical security is maintained, and the data is Encrypted at all times.

1.5 System Access

Objective: 

To ensure systems containing Confidential Data are used only by approved, authenticated users.

Measures: 

1. Access to Netsurit systems is granted only to Netsurit Personnel and access is strictly limited as required for those persons to fulfil their function.
2. All users access Netsurit systems with a unique identifier (UID).
3. Netsurit has established a password policy that prohibits the sharing of passwords and requires passwords to be changed on a regular basis and default passwords to be altered.
4. A second factor of authentication is required for access to online systems containing Confidential Data.
5. Remote access to systems containing Confidential Data are only possible through a secure VPN tunnel and require a second factor of authentication.
6. Netsurit has a thorough process to deactivate users and their access when Personnel leaves the company or a function, and to review and update access rights when Personnel change roles within the company.
7. All access or attempted access to systems is logged and monitored. System and Security logs are retained for a period of at least 6 months.
8. Any WiFi networks used by Netsurit in processing of Confidential Data will have Strong Encryption enabled and require user authentication.

1.6 Data Access

Objective: 

To ensure Personnel entitled to use systems gain secure access only to the Confidential Data that they are authorized to access.

Measures: 

1. Netsurit restricts Personnel access to files and programs on a “need to know” basis, and perform regular reviews of user accounts and access rights on systems that store Confidential Data.
2. Netsurit ensures that appropriate personnel receive alerts and notifications from system software vendors and other sources of security advisories and installs system software patches regularly.
3. Netsurit uses up-to-date anti-virus software on all appropriate computers and servers.
4. Netsurit uses well-configured firewalls, including host-based firewalls, to protect access to the network, computers and servers.
5. Netsurit conducts regular vulnerability scanning to identify and resolve weaknesses in the network, servers, workstations and applications.
6. Remote access and its subsequent operations on Customer networks are logged and monitored.
7. Customer network credentials are saved in an encrypted repository and only authorised Personnel are provided access to the credentials.
8. Personnel training covers access rights to and general guidelines on definition and use of Confidential Data.
9. Secure baseline configurations are developed for systems that access and/or process Confidential Data, including software versions, security patch levels, managed anti-virus detection, encryption level, TPM module requirements and security settings for audit.
10. An automated audit process that documents system security events will be implemented for systems that process Confidential Data.
11. Netsurit implements appropriate controls to safeguard against data leakage, enable remote wipe of mobile devices and to ensure that mobile devices comply with the security baseline configuration.
12. Where Netsurit uses contractors to assist with processing of Confidential Data, an appropriate Operator/Processor agreement will be signed with the third party that clearly indicates the responsibilities of the third party to safeguard Confidential Data, including the Technical and Organization Measures that the third party has to comply with.

1.7 Data Transmission/Storage/Destruction

Objective: 

To ensure Confidential Data is not read, copied, altered or deleted by unauthorized parties during transfer/storage.

Measures: 

1. Access to the Netsurit Service portals are protected by the most current version of Transport Layer Security (TLS).
2. Netsurit uses Strong Encryption in the transmission of Confidential Data outside the production data centres.
3. Confidential Data stored outside the production data centre is protected by Strong Encryption, regardless of media type.
4. Upon Customer’s request, Confidential Data will be promptly deleted.
5. Netsurit equipment or disk media containing Confidential Data are not physically removed from the production data centre unless securely erased prior to such removal or being transferred securely for destruction at a third-party site.

1.8 Confidentiality and Integrity

Objective: 

To ensure Confidential Data remains confidential throughout processing and remains intact, complete and current during processing activities.

Measures: 

1. Netsurit has a formal background check process and carries out background checks on all new Personnel in critical roles with access to Confidential Data.
2. Netsurit trains its Personnel in application security practices and secure coding practices.
3. Netsurit has a central, secured repository of product source code, which is accessible only to authorized Personnel.
4. Netsurit has a formal application security program and employs a robust Secure Development Lifecycle (SDL).
5. Security testing includes code review, penetration testing, and employing static code analysis tools on a periodic basis to identify flaws.
6. All changes to software are via a controlled, approved release mechanism within a formal change control program.
7. All encryption and other cryptographic functionality used within Netsurit uses industry standard encryption and cryptographic measures.

1.9 Availability

Objective: 

To ensure Confidential Data is protected from accidental destruction or loss, and there is timely access, restoration or availability to Confidential Data in the event of an incident.

Measures: 

1. Each production data centre has multiple power supplies, generators on-site and with battery back-up to safeguard power availability to the data centre.
2. Each production data centre has multiple access points to the Internet to safeguard connectivity.
3. Each production data centre is monitored 24x7x365 for power, network, environmental and technical issues.
4. Netsurit has a business continuity plan in place that is regularly updated.
5. Netsurit tests elements of its business continuity plan regularly and learns from the results of such tests.
6. Netsurit makes a reasonable effort to create frequent, encrypted backup copies of Confidential Data, and these are stored in a geographically separate location to the data centre.
7. Netsurit has a process in place to ensure that backup failures are flagged and dealt with.
8. Netsurit performs restore tests of backups on at least a quarterly basis.
9. Netsurit keeps an up to date register of Personnel and Customers who are authorised to request access to backup media and restore of data.
10. Netsurit monitors server, service and resource availability via a network monitoring system.

1.10 Data Separation

Objective: 

To ensure each Customer’s Data is processed separately.

Measures: 

1. Netsurit uses logical separation within its multi-tenant architecture to enforce data segregation between customers.
2. Customers only have access to their own Confidential Data.

1.11 Incident Management

Objective: 

In the event of any security incident of Confidential Data, the effect of the incident is minimized, and the Customer is promptly informed.

Measures:

1. Netsurit maintains an up-to-date incident response plan that includes responsibilities, how information security events are assessed and classified as incidents and response plans and procedures.
2. Netsurit regularly tests its incident response plan with “table-top” exercises and learns from tests and potential incidents to improve the plan.
3. In the event of a security incident, Netsurit will notify Customers without undue delay after becoming aware of the security incident.

1.12 Audit

Objective: 

To ensure Netsurit regularly tests, assesses and evaluates the effectiveness of the technical and organizational measures outlined above.

Measures: 

1. Netsurit conducts regular internal audits of its security practices.
2. Netsurit ensures that Personnel are aware of and comply with the technical and organizational measures set forth in this document.
3. Netsurit maintains a register of security incidents and unscheduled outages.