Laserfiche WebLink
Security Policies and Procedures <br />Organizational Chart/Electronic Asset Management Log. A current copy of this <br />inventory will be kept at a separate location as described in our Disaster Recovery Plan. <br />C. Rules for access to information assets <br />If any given security incident involves a breach of Personally Identifiable Information <br />(PII), the ISO will follow our security policies and Incident and Breach Policy for <br />handling such a breach. <br />If a security incident includes the potential that personal information may have been <br />obtained by unauthorized individuals, the ISO will work with the client to notify <br />affected persons of this event, in compliance with relevant federal and/or state law. <br />See also Breaches or Impermissible Uses/Disclosures within these Security Policies and <br />Procedures. <br />VIII. Access Control Policy <br />A. Overview <br />This policy defines how Virtru manages access to electronic information and systems. <br />Virtru provides access to electronic data relative to the workforce member's job <br />requirement. We limit access to categories of data and systems that each person needs <br />to do his/her job. We require that each workforce member restrict his/her access to <br />only those specific records and functions needed to carry out his/her job. For the <br />purposes of this policy workforce members are anyone in Virtru who has access to <br />Personally Identifiable Information (PII). <br />B. Access levels <br />The ISO will qualify the workforce member to have one of these forms of access based <br />on the job role (in order of increasing access permissiveness): <br />1. Low Access to Corporate Email and Salesforce Data <br />2. General Access to product metrics <br />3. Admin Access to all front end products as well as product metrics <br />4. Super Admin Access to all front and backend products as well as product metrics <br />The access will match the person's job responsibilities The ISO will keep a record of the <br />type of access provided to each workforce member. The record will include a date and <br />justification and will be kept in our Employee Access Request Log in the Security <br />Documentation Library. <br />Rev.2015.8.6 <br />19 <br />