Item 26 - Agreement with Allied Network Solutions, Inc. for Adobe Software and Subscription

Home Browse Search

Security and Hosting Overview June 2015 • Compliance As an element of our ISO 27001 compliance, SAP Fieldglass conducts an enterprise -wide risk assessment. Key individuals from every department are interviewed so that risks can be identified. Risks are then evaluated and entered into a risk treatment plan. This plan is managed by the Security team with oversight by the Security Steering Committee. The Security Steering Committee meets on a quarterly basis. 1.2.3 Assessments SAP Fieldglass periodically assesses the security controls to review the effectiveness of each control in addressing risk. If SAP Fieldglass' assessment suggests a need for changes, the baseline standard may be changed to include additional controls. Internal Audit SAP Fieldglass conducts quarterly internal audits for critical controls. Evidence is reviewed by our Sr. Compliance Analyst and a formal assessment report is prepared. Failed controls are made visible by this process so they can be remediated. Executive sign off on the internal audit reports is required. External Audit SAP Fieldglass also contracts with third parties on an annual basis to perform formal security audits on the following: • ISO 27001 surveillance audit • SSAE 16/ISAE 3402 Type 2 SOC1 audit • SSAE 16 Type 2 SOC2 audits in the Trust Services Principles for: • Security • Availability • Processing Integrity • Confidentiality • SSAE 16 Type 1 SOC2 audit in the Trust Services Principle for Privacy (Type 2 audit scheduled for Q3 2015) • Network penetration test • Application penetration test These assessments allow SAP Fieldglass to maintain an appropriate security posture in order to protect the company and its systems, as well as its customers' data. We are currently working with ourthird party audit partner in bringing our EU datacenters into scope for our 2015 ISO 27001 audit and SSAE 16/ISAE 3402 Type 2 SOC1 and SOC2 examinations. SAP Fieldglass , 7 1 21