Agmt22 Granicus - Laserfiche WebLink

Browse Search

REV: 06-24-22 RL EXHIBIT H SECURITY POLICY Technical and Organizational Measures for Granicus Cloud Services (TOMs) The following sections define Granicus current technical and organizational measures and are incorporated into Schedule 2 of the DPA. Granicus may change these at any time without notice so long as it maintains a comparable or better level of security. Individual measures may be replaced by new measures that serve the same purpose without diminishing the security level protecting Personal Data. 1. GENERAL 1.1 Granicus will: 1.1.2 maintain an information security program to protect information processing systems and media that contain sensitive information, from internal and external security threats and from unauthorized disclosure. 1.1.3 maintain an information security policy that is approved and communicated to all employees, contractors, and subcontractors. The information security policy will comply with all applicable laws, regulations, and/or mandatory industry standards. 1.1.4 maintain a process to review newly acquired tools/software and manage existing vendors. 1.1.5 maintain a risk management program to identify vulnerabilities and risks, and to remediate vulnerabilities in a timely manner. 1.1.6 perform periodic reviews of its information security program and its capabilities through independent third-party audits, internal and external penetration tests, and self- assessments. 1.1.7 maintain a software development program to ensure that code is properly reviewed and deployed, and changes go through a standard process. 1.1.8 maintain an effective process to maintain and track all physical computing and software assets in use and/or containing sensitive information. 1.1.9 ensure the network boundary will be protected using technologies such as firewalls, and monitoring tools. 1.1.10 maintain an up–to-date antivirus software at access points to the company network (for e-mail accounts), as well as on all file servers and all workstations. 1.1.12 maintain contingency plans to protect against accidental and/or unauthorized destruction or loss. All plans will be tested, at minimum, on an annual basis. 1.1.13 perform regular backup processes to provide restoration of business-critical systems as and when necessary. 1.1.14 maintain a data retention and data deletion process. 1.1.15 maintain a risk management program to identify vulnerabilities and risks, and ensure vulnerabilities are remediated in a timely manner. 1.1.16 maintain adequate system and application-level logging. 1.1.17 ensure that access to products, services and Client Personal Data by Granicus personnel is restricted on a strictly need to know basis and that all Granicus’ personnel who are granted such access have completed appropriate security training in line with the Granicus Data Privacy policy. ATTY/AGR.2022.156/Granicus (Online agenda and meeting hosting and indexing) (Page 29 of 32)