Reso 2021-3185 - Laserfiche WebLink

Home Browse Search

Cryptography Encryption of relevant data in transit and at rest based on data classification Physical and environmental security Physical access and environmental controls Operations security Procedures, anti -virus, backups, change management, capacity management, logging, vulnerability management Communications security Network controls, network segmentation System acquisition, development System development methodologies, secure coding training, and maintenance security engagement into the project management lifecycle Supplier relationships Review of key third party service organizations to include right to audit and review of SSAE16, PCI and related reports Information security incident Incident management, security investigations, and management eDiscovery capabilities Information security aspects of Formal business continuity and disaster recovery programs business continuity management including periodic testing and business resiliency controls Compliance; with internal PC[-DSS, SSAE16, SOX/404, NIST, Data Protection Laws, data requirements - policies, and with loss prevention controls external requirements - laws In terms of administration and governance, WEX has established a Global Chief Information Security Officer who reports to the Board of Directors Technology Committee and administratively through the Chief Technology Officer. WEX's security function includes Governance, Risk and Compliance, Identity and Access Management, Security Architecture, Security Engineering, and Business Continuity/Disaster Recovery functions. The Security framework is reviewed regularly and updated at least annually to respond to the rapidly evolving threat landscape. WEX has also contracted with a Managed Security Service provider to perform 247 real time threat intelligence, security monitoring, and incident response capabilities. 7.5 Data Breached Notification. The WEX Crisis Management Team ensures notification requirements are assessed by the legal and compliance teams and facilitates all required notifications via the appropriate channels to those who may have been impacted by any data breach. 7.6 Data Breach and Protocols to protect Agency Information. In the event of a data breach the WEX Crisis Management Team engages immediately to implement the WEX Business Continuity Plan (BCP) to triage the level a potential breach and immediately safeguard all customer, State and/or Purchasing Entity's information. WEX has a BCP for each line of business across our organization, and this plan is customized to meet the unique needs of WEX customers across our organization in a given line of business. The WEX Business MASTER AGREEMENT No. 00819 - FLEET CARD SERVICES PAGE 105 OF 138