Snapshot 100505
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Operative Security Policy At Operative, we take the security and privacy of your data very seriously. Accordingly, Operative implements a robust security program that includes, among other components, secure system architecture and providing security and privacy training to employees. Compliance and Standards Operative complies with several international standards and regularly participates in relevant audits. ISO 27001:2013 – Operative is compliant and certified to the ISO 27001:2013 global standard for information security management. SOC 1 Type 2 – Operative has several products that are audited and comply with the AICPA standards for Controls at a Service Organization, audited annually. SOC 2 Type 2 – Operative has several products that are audited and comply with the AICPA standards for Controls at a Service Organization, audited annually. Data Center Security Operative cloud-based services and platforms are hosted on Amazon Web Services (AWS). AWS datacenters meet security regulations and standards with industry-leading physical and environmental controls. AWS is compliant with a wide range of standards, laws and regulations including CSA, various ISO standards, PCI, SOC reports and FedRAMP. Additional information can be found in the link. Network Security Operative is committed to maintaining and improving the security of our environments. As such, we regularly review the services and information accessible on our servers and related security requirements. Security controls are implemented within networks using a strict access control policy. Access points into the network are blocked from those deemed essential or business critical. Encrypted Data In Transit All transmission of data over the internet is communicated via HTTPS. Our services support Transport Layer Security encryption, providing the necessary levels of confidentiality, integrity and non-repudiation. Endpoint and Server Security Malware protection suites are installed and managed from a centralized location including monitoring and logging of events. Vulnerability Management Operative performs various security tests and audits for our infrastructure and applications. These tests include: Software Composition Analysis Static code analysis Dynamic code analysis Network vulnerability assessment Network penetration testing Application vulnerability assessment Penetration testing of multiple environments and solutions Data Access Access to data is controlled and provided to teams and members with specific business needs. Regular permission review is performed to prevent permission overlap, permission creep and conflict of interests. Security and Privacy Awareness Operative performs various activities to improve the awareness around security and privacy. Some of these include annual awareness training sessions for both security and privacy. Cyber-attack Simulation In order to improve and ready both employees and leadership for cyber incidents, Operative performs various testing and internal simulations. The results are analyzed and studied to continuously improve the security program. Business Continuity and Disaster Recovery Operative maintains disaster recovery capabilities to minimize the impact of disruptions to our operations. Incident Response Operative implements a robust alert and monitoring solution to continuously identify potential cyber security incidents. Dedicated Incident Response personnel are on call 24/7 to ensure that security incidents are managed end-to-end. Privacy Operative is committed to implementing and maintaining systems and policies to protect your privacy. Our full privacy policy, including how we handle and collect Personal Information can be found here: https://www.operative.com/privacypolicy/