LAST REVISION DATE: September 11, 2024

DOCUMENT OWNER : Janko Ulaga / Atharva Shirode

--------------------------------------------------------------------------------------------------------

TABLE OF CONTENTS

1 Introduction 5

1.1 PURPOSE 5

1.2 SCOPE 5

1.3 ACRONYMS / DEFINITIONS 5

1.4 APPLICABLE STATUTES/REGULATIONS 6

1.5 INFORMATION SECURITY OFFICER 7

1.6 CONFIDENTIALITY / SECURITY TEAM (CST) 7

2 Employee Responsibilities 8

2.1 EMPLOYEE REQUIREMENTS 8

2.2 PROHIBITED ACTIVITIES 8

2.3 ELECTRONIC COMMUNICATION, EMAIL, INTERNET USAGE 9

2.4 OFFICE INTERNET ACCESS 10

2.5 REPORTING SOFTWARE MALFUNCTIONS 10

2.6 REPORT SECURITY INCIDENTS 10

2.7 TRANSFER OF SENSITIVE/CONFIDENTIAL INFORMATION 11

2.8 TRANSFERRING SOFTWARE AND FILES BETWEEN PERSONAL AND CORPORATE DEVICES 11

2.9 INTERNET CONSIDERATIONS 11

2.10 DE-IDENTIFICATION / RE-IDENTIFICATION OF PERSONAL IDENTIFIABLE INFORMATION (PII) 12

3 Identification and Authentication 13

3.1 USER LOGON IDS 13

3.2 PASSWORDS 13

3.3 CONFIDENTIALITY AGREEMENT 14

3.4 ACCESS CONTROL 14

3.5 USER LOGIN ENTITLEMENT REVIEWS 14

3.6 TERMINATION OF USER LOGON ACCOUNT 15

4 Network Connectivity 16

4.1 REMOTE CONNECTIONS 16

4.2 PERMANENT CONNECTIONS 16

4.3 EMPHASIS ON SECURITY IN THIRD PARTY CONTRACTS 16

5 Malicious Code 18

5.1 ANTIVIRUS SOFTWARE INSTALLATION 18

5.2 NEW SOFTWARE DISTRIBUTION 18

5.3 RETENTION OF OWNERSHIP 18

6 Encryption 20

6.1 DEFINITION 20

6.2 ENCRYPTION KEY 20

6.3 SECURE SOCKET LAYER (SSL) WEB 20

7 Building Security 21

8 Telecommuting 22

8.1 GENERAL REQUIREMENTS 22

8.2 REQUIRED EQUIPMENT 22

8.3 HARDWARE SECURITY PROTECTIONS 23

8.4 DATA SECURITY PROTECTION 23

8.5 DISPOSAL OF PAPER AND/OR EXTERNAL MEDIA 24

9 Specific Protocols and Devices 25

9.1 WIRELESS USAGE STANDARDS AND POLICY 25

9.2 USE OF PORTABLE MEDIA AND CLOUD STORAGE SERVICES 25

10 Disposal of External Media / Hardware 28

10.1 DISPOSAL OF EXTERNAL MEDIA 28

10.2 REQUIREMENTS REGARDING EQUIPMENT 28

11 Change Management 29

12 Audit Controls 30

13 Information System Activity Review 31

14 Data Integrity 33

15 Contingency Plan 34

16 Security Awareness and Training 37

17 Security Management Process 39

18 Emergency Access “Break the Glass” 42

19 Sanction Policy 45

20 Incident Response & Breach Notification Procedures 50

--------------------------------------------------------------------------------------------------------

This policy defines the technical controls, and security configurations users and Information Technology (IT) administrators are required to implement in order to ensure the integrity and availability of the data environment at Flink, hereinafter, referred to as Flink. It serves as a central policy document with which all employees and contractors must be familiar and defines actions and prohibitions that all users must follow. The policy provides the IT team within Flink with policies and guidelines concerning the acceptable use of Flink technology equipment, email, Internet connections, future technology resources and information processing.

The policy requirements and restrictions defined in this document shall apply to network infrastructures, databases, external media, encryption, hardcopy reports, films, slides, models, wireless, telecommunication, conversations, and any other methods used to convey knowledge and ideas across all hardware, software, and data transmission mechanisms. This policy must be adhered to by all Flink employees or temporary workers at all locations and by contractors working with Flink as subcontractors.

This policy document defines common security requirements for all Flink personnel and systems that create, maintain, store, access, process or transmit information. This policy also applies to information resources owned by others, such as contractors of Flink, entities in the private sector, in cases where Flink has a legal, contractual or fiduciary duty to protect said resources while in Flink custody. In the event of a conflict, the more restrictive measures apply. This policy covers Flink’s network system which comprises various hardware, software, communication equipment and other devices designed to assist Flink in the creation, receipt, storage, processing, and transmission of information. This definition includes equipment connected to any Flink domain or VLAN, either hardwired or wirelessly, and includes all stand-alone equipment that is deployed by Flink at its office locations or at remote locales.

Common terms and acronyms that may be used throughout this document.

CEO – The Chief Executive Officer is responsible for the overall privacy and security practices of the company.

VP Engineering – Vice President Engineering

CST – Confidentiality and Security Team

Encryption – The process of transforming information, using an algorithm, to make it unreadable to anyone other than those who have a specific ‘need to know.’

External Media –i.e. flash drives, USB keys, thumb drives.

FAT – File Allocation Table - The FAT file system is relatively uncomplicated and an ideal format for floppy disks and solid-state memory cards. The most common implementations have a serious drawback in that when files are deleted and new files written to the media, their fragments tend to become scattered over the entire media, making reading and writing a slow process.

Firewall – a dedicated piece of hardware or software running on a computer which allows or denies traffic passing through it, based on a set of rules.

FTP – File Transfer Protocol

IT - Information Technology

LAN – Local Area Network – a computer network that covers a small geographic area, i.e. a group of buildings, an office.

NTFS – New Technology File Systems – NTFS has improved support for metadata and the use of advanced data structures to improve performance, reliability, and disk space utilization plus additional

extensions such as security access control lists and file system journaling. The exact specification is a trade secret of Microsoft.

SOW - Statement of Work - An agreement between two or more parties that details the working relationship between the parties and lists a body of work to be completed.

User - Any person authorized to access an information resource.

Privileged Users – system administrators and others specifically identified and authorized by Flinks’

management.

Users with edit/update capabilities – individuals who are permitted, based on job assignment, to add, delete, or change records in a database.

Users with inquiry (read only) capabilities – individuals who are prevented, based on job assignment, from adding, deleting, or changing records in a database. Their system access is limited to reading information only.

VLAN – Virtual Local Area Network – A logical network, typically created within a network device, usually used to segment network traffic for administrative, performance and/or security purposes.

VPN – Virtual Private Network – Provides a secure passage through the public Internet.

WAN – Wide Area Network – A computer network that enables communication across a broad area, i.e. regional, national.

Virus - a software program capable of reproducing itself and usually capable of causing great harm to files or other programs on the computer it attacks. A true virus cannot spread to another computer without human assistance.

The following is a list of the various agencies/organizations whose laws, mandates, and regulations were incorporated into the various policy statements included in this document.

Berlin Data Protection Authority : General Data Protection Regulation, Berlin Data Protection Act.

Each of the policies defined in this document is applicable to the task being performed – not just to specific departments or job titles.

This ISO will oversee all ongoing activities related to the development, implementation, and maintenance of Flink’s privacy policies in accordance with applicable federal and state laws. The current ISO for Flink is:

Atharva Shirode, Senior IT Security Specialist

Flink has established a Confidentiality / Security Team made up of key personnel whose responsibility it is to identify areas of concern within Flink and act as the first line of defense in enhancing the appropriate security posture.
​
The current members of the CST are:

The CST will meet quarterly to discuss security issues and to review concerns that arose during the quarter. The CST will identify areas that should be addressed during annual training and review/update security policies as necessary.

The CST will address security issues as they arise and recommend and approve immediate security actions to be undertaken. It is the responsibility of the CST to identify areas of concern within Flink and act as the first line of defense in enhancing the security posture of Flink.

The CST is responsible for maintaining a log of security concerns or confidentiality issues. This log must be maintained on a routine basis, and must include the dates of an event, the actions taken to address the event, and recommendations for personnel actions, if appropriate. This log will be reviewed during the quarterly meetings.

The ISO or other assigned personnel is responsible for maintaining a log of security enhancements and features that have been implemented to further protect all sensitive information and assets held by Flink. This log will also be reviewed during the quarterly meetings.

The first line of defense in data security is the individual employee. Flink employees are responsible for the security of all data which may come to them in whatever format. Flink is responsible for maintaining ongoing training programs to inform all users of these requirements.

Challenge Unrecognized Personnel - It is the responsibility of all Flink personnel to take positive action to provide physical security. If you see an unrecognized person in a restricted Flink location, you should challenge them as to their right to be there. All visitors to Flink offices must sign in at the front desk. All other personnel must be employees of Flink. Any challenged person who does not respond appropriately should be immediately reported to supervisory staff.

Unattended Computers - Unattended computers should be locked by the user when leaving the work area. This feature will be discussed with all employees during yearly security training.

Home Use of Flink Corporate Assets - Only computer hardware and software owned by and installed by Flink is permitted to be connected to or installed on Flink equipment. Personal computers supplied by Flink are to be used solely for business purposes. All employees and contractors must read and understand the list of prohibited activities that are outlined below. Modifications or configuration changes are not permitted on computers supplied by Flink for home use.

Retention of Ownership - All software programs and documentation generated or provided by employees, consultants, or contractors for the benefit of Flink are the property of Flink unless covered by a contractual agreement. Nothing contained herein applies to software purchased by Flink employees at their own expense.
​
​

Personnel are prohibited from the following activities. The list is not inclusive. Other prohibited activities are referenced elsewhere in this document.

malicious code into an information system.

Exception: Authorized information system support personnel, or others authorized by Flink’ ISO, may test the resiliency of a system. Such personnel may test for susceptibility to hardware or software failure, security against hacker attacks, and system infection.

Private use of company IT equipment (Internet, computers, devices and programs), telecommunications equipment (telephones, mail, fax) and photocopiers as well as the associated software is not permitted.
​
You may only use the telephone system privately in urgent cases. The obligation to use the telephone system exclusively for business purposes applies in particular to the use of e-mail and the Internet. If you receive messages with private content on your business e-mail address, please delete them immediately and completely. This also serves to protect your privacy, especially if it is necessary, for example, during your vacation or illness, for colleagues to access the e-mails that come in or go out via your work e-mail address.

You may not install pirated or unlicensed software on any company computer or network. If you want to install software licensed by us, you need our prior consent. Installation is only possible on the hardware provided by us; external distribution or installation on private devices is not permitted. Likewise excluded is the storage or processing of official files or documents on

private hardware or through private software.
​
​

Office Internet access is provided for Flink employees and is considered a great resource for the organization. This resource is costly to operate and maintain, and must be allocated primarily to those with business, administrative or contract needs.

Many Internet sites, such as games, peer-to-peer file sharing applications, chat rooms, and on-line music sharing applications, could have already been blocked by Flink routers and firewalls. This list is constantly monitored and updated as necessary. Any employee visiting pornographic sites will be disciplined and may be terminated.
​
​

If the user, or the user's manager or supervisor, suspects a computer virus infection, Flink’ computer virus policy should be followed, and these steps should be taken immediately:

The ISO should monitor the resolution of the malfunction or incident, and report to the CST the result of the action with recommendations on action steps to avert future similar occurrences.
​
​

It is the responsibility of each Flink employee or contractor to report perceived security incidents on a continuous basis to the appropriate supervisor or security person. A User is any person authorized to access an information resource. Users are responsible for the day-to-day, hands-on security of that resource. Users are to formally report all security incidents or violations of the security policy immediately to the ISO. Users should report any perceived security incident to either their immediate supervisor, or to their department head, or to any member of Flink CST. Members of the CST are specified above in this document.

Reports of security incidents shall be escalated as quickly as possible. Each member of Flink CST must inform the other members as rapidly as possible. Each incident will be analyzed to determine if changes in the existing security structure are necessary. All reported incidents are logged and the remedial action indicated. It is the responsibility of the CST to provide training on any procedural changes that may be required as a result of the investigation of an incident.

Security breaches shall be promptly investigated. If criminal action is suspected, Flink’ ISO/DPO shall contact the appropriate law enforcement and investigative authorities immediately.
​
​

When confidential or sensitive information from one individual is received by another individual while conducting official business, the receiving individual shall maintain the confidentiality or sensitivity of the information in accordance with the conditions imposed by the providing individual. All employees must recognize the sensitive nature of data maintained by Flink and hold all data in the strictest confidence. Any purposeful release of data to which an employee may have access is a violation of Flink’ policy and will result in personnel action and may result in legal action.

Personal software shall not be used on Flink computers or networks. If a need for specific software exists, then a vendor management process is required where the Finance, Legal and IT team should approve the requests. Users shall not use Flink purchased software on non-Flink computers or equipment. Flink proprietary data, including but not limited to IT Systems information, financial information or human resource data, shall not be placed on any computer that is not the property of Flink without written consent of the respective supervisor or department head. It is crucial to Flink to protect all data and, in order to do that effectively we must control the systems in which it is contained. In the event that a supervisor or department head receives a request to transfer Flink data to a non-Flink Computer System, the supervisor or department head should notify the ISO or appropriate personnel of the intentions and the need for such a transfer of data.

All Flink-owned and managed IT and cloud assets are maintained with a wide range of security protections in place, which include features such as virus protection, email file type restrictions, firewalls, anti-hacking hardware and software, etc. Since Flink do not control non-Flink personal computers, Flink cannot be sure of the methods that may or may not be in place to protect Flink sensitive information, hence the need for this restriction.

Special precautions are required to block Internet (public) access to Flink information resources not intended for public access, and to protect confidential Flink information when it is to be transmitted over the Internet.

The following security and administration issues shall govern Internet usage.

Prior approval of Flink’ ISO or appropriate personnel authorized by Flink shall be obtained before:

All personally identifying information is removed from all data that falls within the definition of PII before it is stored or exchanged.

De-identification is defined as the removal of any information that may be used to identify an individual or of relatives, employers, or household members.

PII includes:

Re-identification of confidential information: A cross-reference code or other means of record identification is used to re-identify data as long as the code is not derived from or related to information about the individual and cannot be translated to identify the individual. In addition, the code is not disclosed for any other purpose nor is the mechanism for re-identification disclosed.

Individual users shall have an SAP account. An access control system (Okta) shall identify each user and prevent unauthorized users from entering or using information resources. Security requirements for user identification include:

Flink’ Human Resources Department or appropriate personnel deactivate the account upon the departure of all employees and contractors, at which time accounts are revoked.

Users who desire to obtain access to Flink systems or networks must have a ticket created here. This ticket must be approved by the supervisor or department head of each user requesting access.
​
​

User Account Passwords

User IDs and passwords are required in order to gain access to all Flink networks and workstations. All passwords are restricted by a corporate-wide password policy to be of a "Strong" nature. This means that all passwords must conform to restrictions and limitations that are designed to make the password difficult to guess. Users are required to select a password in order to obtain access to any electronic information both at the server level and at the workstation level. When passwords are reset, the user will be automatically prompted to manually change that assigned password.

Password Length – Passwords are required to be a minimum of eight characters.

Content Requirements - Passwords must contain a combination of upper and lower case alphabetic characters, numeric characters, and special characters.

Change Frequency – Passwords must be changed every 180 days. Compromised passwords shall be changed immediately.

Reuse - Previous passwords cannot be reused.

Restrictions on Sharing Passwords - Passwords shall not be shared, written down on paper, or stored within a file or database on a workstation and must be kept confidential.

Restrictions on Recording Passwords - Passwords are masked or suppressed on all online screens, and are never printed or included in reports or logs. Passwords are stored in an encrypted format.
​
​

We attach great importance to protecting confidential information about our company. You therefore undertake to keep operational matters of a confidential nature secret, in particular company and business secrets, as well as contractual provisions, and to use information in this regard exclusively for operational purposes and not to pass it on to outsiders. The duty of confidentiality remains in force after termination of the employment relationship. It must also be maintained vis-à-vis other employees of our company, insofar as they do not require the respective information for their own work.

When handling information that you receive in the course of your work for us, you will comply with the applicable laws, in particular the General Data Protection Regulation and the Federal Data Protection Act. Please do not take any confidential documents into your private possession or remove them from the business premises of our company. Furthermore, it is prohibited to copy these documents without authorization, to hand them over to unauthorized persons or to forward them to the press. The same applies to self-made official records or notes. Upon termination of employment, you will leave all such documents at your place of employment.

In the event of culpable disclosure of confidential documents or information to a company competing with us, you agree to pay liquidated damages in the amount of one gross monthly salary. The assertion of further damages and further rights, in particular injunctive relief, shall remain unaffected
​
​

Information resources are protected by the use of access control systems. Access control systems include both internal (i.e. passwords, encryption, access control lists, constrained user interfaces, etc.) and external (i.e. port protection devices, firewalls, host-based authentication, etc.).

Rules for access to resources (including internal and external telecommunications and networks) have been established by the information/application owner or manager responsible for the resources. Access is granted only by creating a ticket here. This form can only be initiated by the appropriate department head and must be signed by the department head and the ISO or appropriate personnel.

This guideline satisfies the "need to know" requirement of local regulations, since the supervisor or department head is the person who most closely recognizes an employee's need to access data. Users may be added to the information system, network, cloud systems only upon the signature of the ISO or appropriate personnel who are responsible for adding the employee to the network in a manner and fashion that ensures the employee is granted access to data only as specifically requested.

Identification and Authentication Requirements

The host security management program shall maintain current user application activity authorizations. Each initial request for a connection or a session is subject to the authorization process previously addressed.
​
​

If an employee changes positions at Flink, employee’s new supervisor or department head (or SAP account title change- automation with Okta) shall promptly notify the Information Technology (“IT”) Department of the change of roles by creating a ticket here, both the roles or access that need to be added and the roles.

or access that need to be removed so that employee has access to the minimum necessary data to effectively perform their new job functions. The effective date of the position change should also be noted on the ticket so that the IT Department can ensure that the employee will have appropriate roles, access, and applications for their new job responsibilities. For a limited training period, it may be necessary for the employee who is changing positions to maintain their previous access as well as adding the roles and access necessary for their new job responsibilities.

No less than annually, the IT Lead shall facilitate entitlement reviews with department heads to ensure that all employees have the appropriate roles, access, and software necessary to perform their job functions effectively.
​
​

Upon termination of an employee, whether voluntary or involuntary, the employee's supervisor or department head shall promptly notify the IT Department by indicating “Remove Access” on the ticket here Or make the necessary changes to SAP account and it would reflect to all systems using IAM tool Okta. The employee’s department head shall be responsible for ensuring that all keys, ID badges, and other access devices as well as Flink equipment and property is returned to Flink prior to the employee leaving Flink on their final day of employment. Please check the offboarding checklist here.

No less than quarterly, the IT Manager or their designee shall provide a list of active user accounts for both network and application access, to department heads for review. Department heads shall review the employee access lists within five (5) business days of receipt. If any of the employees on the list are no longer employed by Flink, the department head will immediately notify the IT Department of the employee’s termination status and submit the ticket here.
​
​
​

Access to Flink information resources including cloud-based services, shall be subject to authorization and authentication by an access control system. Access without prior authorization is prohibited.

Systems that allow public access to host computers, including mission-critical servers, warrants additional security at the operating system and application levels. Such systems shall have the capability to monitor activity levels to ensure that public usage does not unacceptably degrade system responsiveness.

Remote access privileges are granted only upon the request of a department head with the submission of the ticket here and the approval of the ISO or appropriate personnel.

The security of Flink systems can be jeopardized from third party locations if security practices and resources are inadequate. When there is a need to connect to a third party location, a risk analysis should be conducted. The risk analysis should consider the type of access required, the value of the information, the security measures employed by the third party, and the implications for the security of Flink systems. The ISO or appropriate personnel should be involved in the process, design and approval.

Access to Flink computer systems or corporate networks should not be granted until a review of the following concerns have been made, and appropriate restrictions or covenants included in a statement of work (“SOW”) with the party requesting access.

Antivirus software is installed on all Flink personal computers. Virus update patterns are updated daily on Flink workstations. Virus update engines and data files are monitored by appropriate administrative staff that is responsible for keeping all virus patterns up to date.

Remote Deployment Configuration - Through an automated procedure, updates and virus patches may be pushed out to the individual workstations on an as needed basis.

Monitoring/Reporting – A record of virus patterns for all workstations on Flink’ network may be maintained. Appropriate administrative staff is responsible for providing reports for auditing and emergency situations as requested by the ISO or appropriate personnel.
​
​

Only software created by Flink application staff, if applicable, or software approved by the ISO or appropriate personnel will be used on internal computers and networks. All new software will be tested by appropriate personnel in order to ensure compatibility with currently installed software and network configuration. In addition, appropriate personnel must scan all software for viruses before installation. This includes shrink-wrapped software procured directly from commercial sources as well as shareware and freeware obtained from the Internet, or on disks.

Although shareware and freeware can often be useful sources of work-related programs, the use and/or acquisition of such software must be approved by the ISO or appropriate personnel. Because the software is often provided in an open distribution environment, special precautions must be taken before it is installed on Flink computers and networks. These precautions include determining that the software does not, because of faulty design, “misbehave” and interfere with or damage Flink hardware, software, or data, and that the software does not contain viruses, either originating with the software designer or acquired in the process of distribution.

All data and program files that have been electronically transmitted to a Flink computer or network from another location must be scanned for viruses immediately after being received. Contact the appropriate Flink personnel for instructions for scanning files for viruses.

Every USB device is a potential source for a computer virus. Therefore, every USB device must be scanned for virus infection prior to copying information to a Flink computer or network.

Computers shall never be “booted” from a disk or USB device received from an outside source. Users shall always remove any USB device from the computer when not in use. This is to ensure that the USB device is not in the computer when the machine is powered on. A USB device infected with a boot virus may infect a computer in that manner, even if the USB device is not “bootable”.
​
​

All software programs and documentation generated or provided by employees, consultants, or contractors for the benefit of Flink are the property of Flink unless covered by a contractual agreement. Employees developing programs or documentation must sign a statement acknowledging Flink ownership at the time of employment. Nothing contained herein applies to software purchased by Flink employees at their own expense.

Encryption is the translation of data into a secret code. Encryption is the most effective way to achieve data security. To read an encrypted file, you must have access to a secret key or password that enables you to decrypt it. Unencrypted data is called plain text; encrypted data is referred to as cipher text.

An encryption key specifies the particular transformation of plain text into cipher text, or vice versa during decryption.

If justified by risk analysis, sensitive information and files shall be encrypted before being transmitted through networks. When encrypted data are transferred between agencies, the agencies shall devise a mutually agreeable procedure for secure key management. In the case of conflict, Flink shall establish the criteria in conjunction with the ISO or appropriate personnel. Flink employs several methods of secure data transmission.

Any hosted system, if applicable, will require access using a secure SSL connection.

It is the policy of Flink to provide building access in a secure manner. Each site, if applicable, is somewhat unique in terms of building ownership, lease contracts, entranceway access, fire escape requirements, and server room control. However, Flink strives to continuously upgrade and expand its security and to enhance protection of its assets. The following list identifies measures that are in effect at Flink. All other facilities, if applicable, have similar security appropriate for that location.

With the increased availability of broadband access and VPNs, telecommuting has become more viable for many organizations. Flink considers telecommuting to be an acceptable work arrangement in certain circumstances. This policy is applicable to all employees and contractors who work either permanently or only occasionally outside of Flink’ office environment. It applies to users who work from their home full time to employees on temporary travel, to users who work from a remote office location, and to any user who connects to Flink’ network, if applicable, from a remote location.

While telecommuting can be an advantage for users and for the organization in general, it presents new risks in the areas of confidentiality and security of data. Workers linked to Flink’ network become an extension of the wide area network and present additional environments that must be protected against the danger of spreading Trojans, viruses, or other malware.
​
​

Telecommuting workers are required to follow all corporate, security, confidentiality, HR, or Code of Conduct policies that are applicable to other employees/contractors.

Employees approved for telecommuting must understand that Flink will not provide all equipment necessary to ensure proper protection of information to which the employee has access; however, the following lists define the equipment and environment required:

Flink Provided:

Flink supplied workstation.

If printing, a Flink supplied printer.

If approved by your supervisor/founder, a Flink supplied phone.

Employee Provided:

Broadband connection and fees,

Secure office environment isolated from visitors and family,

A lockable file cabinet or safe to secure documents when away from the home office.
​
​

Virus Protection: Home users must never stop the update process for Virus Protection. Virus Protection software is installed on all Flink personal computers and is set to update the virus pattern on a daily basis. This update is critical to the security of all data and must be allowed to complete.

VPN and Firewall Use: Established procedures must be rigidly followed when accessing Flink information of any type. Disabling a virus scanner or firewall is the reason for termination.

Lock Screens: No matter what location, always lock the screen before walking away from the workstation. The data on the screen may contain confidential information. Be sure the automatic lock feature has been set to automatically turn on after 15 minutes of inactivity.
​
​

Data Backup: Backup procedures have been established that encrypt the data. Use only that procedure – do not create one on your own. If there is not a backup procedure established, contact the appropriate Flink personnel for assistance.

Email: Do not send any PII via email unless it is encrypted. If you need assistance with this, contact the ISO or appropriate personnel to ensure an approved encryption mechanism is used for transmission through email.

Non-Flink Networks: Extreme care must be taken when connecting Flink equipment to a home or hotel network. Although Flink actively monitors its security status and maintains organization-wide protection policies to protect the data within all contracts, Flink has no ability to monitor or control the security procedures on non-Flink networks.

Protect Data in Your Possession: View or access only the information that you have a need to see to complete your work assignment. Regularly review the data you have stored to ensure that the amount of customer/client level data is kept at a minimum and that old data is eliminated as soon as possible. Store electronic data only in encrypted work spaces. If your laptop has not been set up with an encrypted work space, contact the ISO or appropriate personnel for assistance.

Hard Copy Reports or Work Papers: Never leave paper records around your work area. Lock all paper records in a file cabinet at night or when you leave your work area.

Data Entry When in a Public Location: Do not perform work tasks which require the use of sensitive corporate information when you are in a public area, i.e. airports, airplanes, hotel lobbies. Computer screens can easily be viewed from beside or behind you.

Sending Data Outside Flink: All external transfer of data must be associated with an official contract, non-disclosure agreement, or appropriate Business Associate Agreement. Do not give or transfer any customer/client level information to anyone outside Flink without the written approval of your supervisor.
​
​

Disposal of Electronic Media: All external media must be sanitized or destroyed.

Due to an emergence of wireless access points in hotels, airports, and in homes, it has become imperative that a Wireless Usage policy be developed and adopted to ensure the security and functionality of such connections for Flink employees. This policy outlines the processes and procedures for acquiring wireless access privileges, utilizing wireless access, and ensuring the security of Flink laptops and mobile devices.

All usage of public WiFi networks must happen while being connected to a Flink-issued VPN (if provided).

Software Requirements - The following is a list of minimum software requirements for any Flink laptop that is granted the privilege to use wireless access:

If your laptop does not have all of these software components, please notify your supervisor or department head so these components can be installed.
​
​

Portable media and cloud storage services included within the scope of this policy includes but is not limited to portable storage devices or storage on the cloud.

The purpose of this policy is to guide employees/contractors of Flink in the proper use of portable media or cloud storage services when a legitimate business requirement exists to transfer data to and from Flink.

Every workstation or server that has been used by either Flink employees or contractors is presumed to have sensitive information stored on its hard drive. Therefore procedures must be carefully followed when copying data to or from portable media or cloud storage services to protect sensitive information.

Since portable media, by their very design, are easily lost, care and protection of these devices must be addressed. Since it is very likely that portable media will be provided to a Flink employee by an external source for the exchange of information, it is necessary that all employees have guidance in the appropriate use of media from other companies.

The use of portable media and cloud storage service is common practice within Flink. All users must be aware that sensitive information could potentially be lost or compromised when moved outside of Flink. Transportable media received from an external source could potentially pose a threat to Flink networks.

Sensitive information includes all human resource data, financial data and Flink proprietary information.

Rules governing the use of portable media include:

Example: Do not copy a work spreadsheet to your USB key and take it home to work on your home PC or do not place it in non-corporate cloud services.

Examples of necessary data exchange include: Data provided to auditors via USB key during the course of the audit.

When no longer in productive use, all Flink laptops, workstation, or servers must be wiped of data. All portable media must be wiped according to the same standards. Thus all portable media must be returned to IT or appropriate personnel for data erasure when no longer in use.

Rules governing the use of cloud storage services include:

It must be assumed that any external media in the possession of an employee is likely to contain sensitive information. Accordingly, external media (disks) should be disposed of in a method that ensures that there will be no loss of data and that the confidentiality and security of that data will not be compromised.

The following steps must be adhered to:

All equipment to be disposed of will be wiped of all data, and all settings and configurations will be reset to factory defaults. No other settings, configurations, software installation or options will be made. Asset tags and any other identifying logos or markings will be removed.

Statement of Policy

To ensure that Flink is tracking changes to networks, systems, and workstations including software releases and software vulnerability patching in information systems that contain sensitive information. Change tracking allows the Information Technology (“IT”) Department to efficiently troubleshoot issues that arise due to an update, new implementation, reconfiguration, or other change to the system. Check this process for a detailed explanation- Change Management Process.

Procedure

Statement of Policy

To ensure that Flink implements hardware, software, and/or procedural mechanisms that record and examine activity in information systems that contain sensitive information. Audit Controls are technical mechanisms that track and record computer activities. An audit trail determines if a security violation occurred by providing a chronological series of logged computer events that relate to an operating system, an application, or user activities.

Flink is committed to routinely auditing users’ activities in order to continually assess potential risks and vulnerabilities to sensitive information in its possession. As such, Flink will continually assess potential risks and vulnerabilities to sensitive information in its possession and develop, implement, and maintain appropriate administrative, physical, and technical security measures.

Procedure

Statement of Policy

To establish the process for conducting, on a periodic basis, an operational review of system activity including, but not limited to, user accounts, system access, file access, security incidents, audit logs, and access reports. Flink shall conduct on a regular basis an internal review of records of system activity to minimize security violations.

Procedure

All significant findings shall be recorded.

1. The Information Technology Services shall forward all completed reports, as well as recommended actions to be taken in response to findings, to the ISO for review. The ISO shall be responsible for maintaining such reports. The ISO shall consider such reports and recommendations in determining whether to make changes to Flink’ administrative, physical, and technical safeguards. In the event a security incident is detected through such auditing, such matter shall be addressed pursuant to the policy entitled Employee Responsibilities (Report Security Incidents).

Statement of Policy

Flink shall implement and maintain appropriate electronic mechanisms to corroborate that sensitive information has not been altered or destroyed in an unauthorized manner.

The purpose of this policy is to protect Flink sensitive information from improper alteration or destruction.

Procedure

To the fullest extent possible, Flink shall utilize applications with built-in intelligence that automatically checks for human errors.

Flink shall acquire appropriate network-based and host-based intrusion detection systems. The ISO shall be responsible for installing, maintaining, and updating such systems.

To prevent transmission errors as data passes from one computer to another, Flink will use encryption, as determined to be appropriate, to preserve the integrity of data.

Flink will check for possible duplication of data in its computer systems to prevent poor data integration between different computer systems.

To prevent programming or software bugs, Flink will test its information systems for accuracy and functionality before it starts to use them. Flink will update its systems when IT vendors release fixes to address known bugs or problems.

Statement of Policy

To establish and implement policies and procedures for responding to an emergency or other occurrence (e.g., fire, vandalism, system failure, natural disaster) that damages systems that contain sensitive information.

Flink is committed to maintaining formal practices for responding to an emergency or other occurrence that damages systems containing sensitive information. Flink shall continually assess potential risks and vulnerabilities to protect sensitive information in its possession, and develop, implement, and maintain appropriate administrative, physical, and technical security measures.

SLAs:

Flink aims to achieve 99.9% availability for all services available to customers. Flink utilizes cloud infrastructure to deliver its product and service.
For IT / Availability issues & GSuite SLAs provide high availability at or above 99.9% availability.
Google cloud platform SLA’s : https://cloud.google.com/terms/sla
Google workspace SLA’s: https://workspace.google.com/terms/sla.html

Flink internal processes and procedures apply to the servers we control inside these cloud environments.

Procedure

Statement of Policy

Aim to establish a security awareness and training program for all members of Flink’ workforce, including management. Check the security awareness training here.

All workforce members shall receive appropriate training concerning Flink security policies and procedures. Such training shall be repeated annually for all employees.

Procedure

Statement of Policy

To ensure Flink conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of sensitive information held by Flink.

Flink shall conduct an accurate and thorough risk analysis to serve as the basis for Flink compliance efforts. Flink shall re-assess the security risks to its sensitive information and evaluate the effectiveness of its security measures and safeguards as necessary in light of changes to business practices and technological advancements.

Procedure

Policy Summary

Flink has formal, documented emergency access procedures enabling authorized workforce members to obtain required information during an emergency. Flink has a formal, documented emergency access procedure enabling Flink workforce members to access the minimum information necessary to effectively and efficiently resume business operations in the event of a major emergency. Read this policy for more information.

Purpose

This policy reflects Flink’s commitment to have emergency access procedures enabling authorized workforce members to obtain required information during an emergency. Examples: Access to GSuite, Bitbucket, GCP resources.

Definitions

Electronic media means:

Information system means an interconnected set of information resources under the same direct management control that shares common functionality. A system normally includes hardware, software, information, data, applications, communications, and people.

Workforce member means employees, volunteers, and other persons whose conduct, in the performance of work for a covered entity, is under the direct control of such entity, whether or not they are paid by the covered entity. This includes full and part time employees, affiliates, associates, volunteers, and staff from third party entities who provide service to the covered entity.

Policy

Scope/Applicability

This policy is applicable to all divisions and workforce members that use or disclose electronic protected information for any purposes. This policy’s scope includes all electronic protected information, as described in definitions below.
​
​

Scenario

“Break the Glass” refers to Flink enabling a licensed practitioner to view a sensitive data record, or a portion thereof, under emergency circumstances, when that practitioner does not have the necessary system access privileges.

​Policy Authority/Enforcement

Flink’ ISO is responsible for monitoring and enforcing this policy.

Procedures

Mechanism to Provide Emergency Access to IT systems

Note:

When using a specific user account that provides full access to all IT systems (an administrator account) consider the following:

Enforcement

Please refer to Sanction Policy for details regarding disciplinary action against employees, contractors, or any individuals who violate this policy.

Policy

It is the policy of Flink that all workforce members must protect the confidentiality, integrity, and availability of sensitive information at all times. Flink will impose sanctions, as described below, on any individual who accesses, uses, or discloses sensitive information without proper authorization.

Flink will take appropriate disciplinary action against employees, contractors, or any individuals who violate Flink’ information security and privacy policies.

Purpose

To ensure that there are appropriate sanctions that will be applied to workforce members who violate the requirements of Flink’ security policies.

Definitions

Workforce member means employees, volunteers, and other persons whose conduct, in the performance of work for a covered entity, is under the direct control of such entity, whether or not they are paid by the covered entity. This includes full and part time employees, affiliates, associates, volunteers, and staff from third party entities who provide service to the covered entity.

Sensitive information, includes, but not limited to, the following:

Availability refers to data or information that is accessible and usable upon demand by an authorized person.

Confidentiality refers to data or information that is not made available or disclosed to unauthorized persons or processes.

Integrity refers to data or information that has not been altered or destroyed in an unauthorized manner.
​
​

Violations

Listed below are the types of violations that require sanctions to be applied. They are stated at levels 1, 2, and 3 depending on the seriousness of the violation.

​Recommended Disciplinary Actions

In the event that a workforce member violates Flink’ privacy and security policies or related state laws governing the protection of sensitive and personal identifiable information, the following recommended disciplinary actions will apply.

Important Note: The recommended disciplinary actions are identified in order to provide guidance in policy enforcement and are not meant to be all-inclusive. If formal discipline is deemed necessary, Flink shall consult with Human Resources prior to taking action. When appropriate, progressive disciplinary action steps shall be followed allowing the employee to correct the behavior which caused the disciplinary action.

Purpose

To outline the process for notifying affected individuals of a breach of sensitive information.

Scope

This applies to all employees, volunteers, and other individuals working under contractual agreements with Flink.

Definitions

State Breach – Unauthorized acquisition or reasonable belief of unauthorized acquisition of Personal Information that compromises the security, confidentiality, or integrity of the Personal Information.

Personal Information – Personal Information has many definitions including definitions by statute which may vary from state to state. Most generally, Personal Information is a combination of data elements which could uniquely identify an individual. Please review applicable state data breach statutes to determine what definition of Personal Information is applicable for purposes of the document.

Personal Data Breach – Unauthorized acquisition, access, use, or disclosure of unsecured PII.

Personally Identifiable Information (PII) – Information in any form that consists of a combination of an individual’s name and one or more of the following: email address, Social Security Number, driver’s license or state ID, account numbers, credit card numbers, debit card numbers, personal code, security code, password, personal ID number, photograph, fingerprint, or other information which could be used to identify an individual.

GDPR Breach – Unauthorized acquisition or reasonable belief of unauthorized acquisition of personal information protected by GDPR. This information includes, but is not limited to, government issued ID numbers, financial account numbers or other information posing a risk of identity theft.

Private Information – Information protected by GDPR, Personally Identifiable Information, Personal Information and Protected Information collectively.

Procedure

Reporting a Possible Breach

Containing the Breach

Investigating and Evaluating the Risks Associated with the Breach

Notification

​Business associates must notify Flink if they incur or discover a breach of unsecured PII

Prevention

Compliance and Enforcement

All managers and supervisors are responsible for enforcing these procedures. Employees who violate these procedures are subject to discipline up to and including termination in accordance with Flink' Sanction Policy.

Related Policies

Sanction Policy