Laserfiche WebLink
Security Policies and Procedures <br />site. Access to the documentation for sensitive applications and the operating systems <br />will be on a need -to -use basis. <br />E. Change Control and Maintenance <br />All proposed changes to production systems must be registered in the companies issue <br />tracking system. Changes shall be categorized as standard, normal, or emergency. <br />Standard changes are those that are performed frequently and considered low risk. <br />Standard changes are reviewed quarterly and pre -approved for the following quarter. <br />Normal changes are those which are not performed frequently and may pose some risk <br />to the business. Each normal change must be reviewed by a minimum of two <br />super-admins, the CTO and/or VP of engineering prior to being made. Reviewers are <br />responsible for assessing the impact of the change in regards to the functionality, <br />availability, durability, and security of the system. If a consensus among reviewers is <br />reached, the proposed change is sized, sorted, and executed through the standard <br />engineering workflow. Emergency changes are those that are required to rectify some <br />form of degradation of the system. Emergency changes must be reviewed by a <br />minimum of two super-admins. If a consensus is reached, emergency changes can <br />bypass the standard engineering workflow and be made immediately. All changes to <br />production systems must be captured in the company's issue tracking system without <br />exception. <br />F. Operating Systems <br />Only approved operating systems will be loaded onto Virtru-owned assets. Before <br />major upgrades to systems, authorization by the ISO and AISO will be required. <br />Default settings must be reviewed prior to installation to identify any security <br />vulnerabilities. These settings will be communicated with all workforce members, or <br />they will surrender their devices to the ISO or AISO for configuration. <br />G. Applications <br />All applications, whether developed or purchased, must comply with Virtru's policies <br />and protection standards. The information owner is responsible for ensuring that these <br />requirements are included during the development or acquisition of software. <br />The protection requirements for applications include: <br />55 <br />Rev.2015.8.6 <br />