Laserfiche WebLink
Security Policies and Procedures <br />installation of systems and tools, and during the contracts process with vendors and <br />service providers. Standards do not, however, give detailed command -line instructions <br />on how to meet the Virtru's policies. Those are given in the guidelines. <br />Guidelines: Built for each application and platform; to be followed when implementing <br />that particular tool. A Guideline may vary a bit from one implementation to another, as <br />long as the Security Standards are met and justification is given and properly <br />documented. <br />Combined, these three levels of documents provide a method for Virtru to audit itself <br />and ensure proper controls are in place, without excess cost or risk. They also provide a <br />means for Virtru to explain to regulators, examiners, external auditors or investors <br />how our Company is safe, trustworthy and efficient. <br />IV. Using These Standards <br />A. Audience - Who will use this document <br />This document applies to Virtru's employees, business units and any Business Associate <br />Subcontractor supporting Virtru: <br />1. Technology and business process providers should comply with these Standards as a <br />matter of contractual obligation <br />2. Employees and Business units within Virtru should comply, unless a Risk Assessment <br />has been done and a deviation is approved by the ISO <br />B. How the document is used <br />This Standards document is a reference point to ensure a consistent framework of <br />protections is in place. Implementing these standards involves: <br />1. Review of existing controls, procedures and tools against the Standards <br />2. Documenting compliance or deviations <br />3. Gap Analysis to determine where improvements are needed <br />4. A Risk Assessment to validate that the improvements are justified against <br />the costs of the controls and the value of the information involved <br />S. Creation of a plan to close the gaps OR signoff of a deviation <br />6. Documentation of the new controls, procedures and tools <br />No signoff or approvals are needed if a level of protection higher than what is given in <br />this Standard is determined to be needed for a given information asset. <br />Rev.2015.8.6 <br />14 <br />