Reso 2021-3185 - Laserfiche WebLink

Home Browse Search

Continuity Plan ensures that WEX employees, and the physical and information assets entrusted to us by our clients are protected by viable response and recovery plans. The Corporate BCP takes an all hazards approach to the assessment of risk posed to critical business functions and develops comprehensive plans that provide for effective recovery from a disruption of critical business functions. The plans are tested before implementation and exercised regularly thereafter to ensure their viability and continued improvement. In instances of fraud or card skimming, WEX works in a similar manner to ensure accounts and customer information is shut off and safeguarded. See discussion of WEX's fraud detection system, SaferPayments, in our response to Question 15.4. 7.7 Contractor must provide and maintain an appropriate information security program to prevent the unauthorized disclosure, misuse, alteration, or destruction of confidential information. As part of the WEX BCP, WEX has in place an information security program that exists to safeguard both WEX and WEX customers from the unauthorized disclosure of information, especially sensitive information. This includes unauthorized disclosure, misuse, alteration or destruction of confidential information. The WEX Information Security Program outlined below covers the protection of cards, account numbers, passwords, PINS, transaction data, among many other sensitive systems and information. The WEX production data center is a secure facility, accessed by badge readers and monitored by CCTV. The facility is staffed 24x7x365. The WEX data center has a Tier III rating as specified by the uptime institute. WEX visitors and maintenance personnel are only allowed access to data center facilities with an authorized escort and approved business need. WEX has an ISO 27001/27002 based Information Security Program that includes robust access controls, security monitoring controls, governance, risk and compliance, backup and recovery capabilities, regular penetration testing and vulnerability scanning, strong physical and environmental controls, policies and procedures, and security awareness training. Policies and standards are reviewed and updated annually. Procedures are owned by the individual teams and are required to meet the standards and also be approved by their management. WEX also obtains a SSAE16 SOC1, PCI-DSS certification over our WEXOnline° platform, and is subjected to regular reviews and oversight by Internal Audit, External Audit, FDIC Examiners, and various third parties. The SSAE16 SOC1, PCI-DSS certification governs WEX security protocols for how we handle customer information like cards, account numbers, passwords, personal identification numbers and transaction data. Vendor Access WEX has a Vendor program that establishes the following review and oversight areas: Information Security service provider review, Procurement review, and Legal Department review that must be performed prior to a third party being approved. Logical access is then requested by the WEX manager that owns the relationship with the third party and provisioned by a systems access group. System Patches System patches, including service packs and security fixes are reviewed and approved following standard change management processes. Relevant patches are applied as soon as practical given MASTER AGREEMENT No. 00819 — FLEET CARD SERVICES PAGE 106 OF 138