Organization of the Security
Is there an IT Security Manager / Chief Information Security Officer (CISO) ?
Yes, Matthieu Borrel.
Access controls of the Users of the Service
See 9.1.1 for general rules regarding accesses to the Service by the Users
How are Users given access to the Service ?
See 9.2.1 for measures related to registration and de-registration of the Users and their login.
See 9.2.2 for measures related to the management of the access rights of the Users of the Service.
See 9.2.3 for measures related to the management of the access rights of the Administrators of the Service.
See 9.2.4 for measures related to the distribution of passwords to the Users of the Service.
How are authenticated the Users of the Service secured ?
See 9.3.1 for the management of the their password by the Users of the Service.
See 9.4.2 for security measures to secure the log-on and the security of the authentication information of the Users to the Service, including SSO, and Multi-Factor Authentication.
See 9.4.3 for how the passwords of the Users of the Service are managed and protected.
How are access rights of the Users managed ?
See 9.2.3 for the management of the privileged accesses (administrators).
See 9.2.5 for measures related to export and review of the access rights of the users
See 9.4.1 for measures to restrict and manage access to information to users based on their profile.
Security of the data
See 8.2.3 for general rules regarding handling of assets by 365Talents.
See 13.2.4 for Confidentiality or non-disclosure agreements topics.
How are Service's data in transit secured ?
See 8.3.1 for removable media handling and printed documents.
See 9.1.2 for measures related to access to networks of the Service.
See 9.4.2 for measures related to Secure log-on to the Service.
See 10.1.1 "Data in transit" for measures related to encryption of data in transit.
See 10.1.2 for the management of the Keys used for encryption of data in transit.
See 13.1.1 and 13.2.1 and 13.2.2 for the security of the communications between the Clients and the Service.
See 13.2.3 for the security measures related to the e-mails sent by the Service.
See 14.1.2 and 14.1.3 for protection of the data transmitted over the Internet and protection against threats coming from the Internet.
How are Service's data at rest secured ?
See 8.3.1 for removable media handling and printed documents.
See 10.1.1 "Data at rest" for measures related to encryption of data at rest, including backups.
See 10.1.2 for the management of the Keys used for encryption of data at rest, including backups.
See 14.3 for test data.
How are the backup of the Service performed ?
See 12.3 for the measures related to the backup of the Service.
How are managed personal data ?
See 8.2.1 for data classification.
See 14.3 for test data.
See pages dedicated to Data treatment, Treatment registry, the procedure for "Exercise of rights" and Privacy Impact Assessment (PIA)
Security of the infrastructure of the Service
How is the infrastructure protected ?
See 9.2.3 for the security measures related to management of privileged access rights on the infrastructure
See 9.4.2 for the security measures related to the log-on on the infrastructure by technical team of 365Talents.
See 13.1.1 and 13.1.2 for security measures related to networks.
See 12.4.1 for the log of the events on the Infrastructure
See 12.2 for security measures related to malware
See 12.6 for security measures related to vulnerability management
See 13.1.3 for network segregation between development, pre-production and production environment
What are the security guarantees of the hosting provider ?
See 9.1.1 for access controls related to the hosting provider.
See 13.1.2 for security guarantees provided by the hosting provider
See 15 -Supplier relationships for the security guarantees provided by the hosting provider.
See 17.2 for information related to redundancies.
See 18.1.4 for compliance to GDPR and localization of data.
See 18.2.2 for security compliance of the hosting provider.
Security of the operations on the Service
How is the Service securely operated ?
See 9.1.1 for access control policy applied to the technical team of 365Talents
See 9.2.1 for registration and de-registration of the member of the technical team of 365Talents
See 9.2.3 for the management of the access rights of the technical team of 365Talents
See 9.4.2 for security measures related to secure log-on to the infrastructure components either by technical teams of 365Talents or by the application.
See 9.4.3 for the security measures applied to passwords of the technical team of 365Talents
See 12.1.1 for the operating procedures
See 12.1.2 for measures related to the change management of the Service and 14.2.2 & 14.2.3 for the change & configuration control procedures.
See 12.1.3 for measures related to the supervision of the Service.
See 12.1.4 for measures of segregation between development, pre-production and production environments.
See 13.1.1 and 13.1.2 for networks controls when accessing the infrastructure of the Service (e.g. VPN)
See 13.1.3 for network segregation between development, pre-production and production environment
How are the developments secured ?
See 9.4.5 for protection of the source code.
See 14.2.1 for Secure development policy.
See 14.2.5 for Secure system engineering principles
See 14.2.6 and 14.2.7 for Secure development environment.
See 14.2.8 and 14.2.9 for (security) testing.
See 14.13 for test data.
How are managed vulnerabilities ?
See 12.6.1 for the management of security vulnerabilities
How the availability of the Service is guaranteed ?
See 17.2 for the redundancy mechanisms.
See this page for Business Continuity, Disaster Revery and SLAs
Logs of the actions of the Users on the Service
How are the actions of the Users logged ?
See 12.4.1 for the informations that are logged
See 12.4.2 for the protection of the logs
See 12.4.3 for the logs of the administrators of the Service
See 12.4.4 for the time-stamping of the logs
Security of third-parties
How are secured data exchange with third-parties ?
Please refer to section How are Service's data in transit secured
See 9.1.1 for access controls applied to third-parties
See 9.4.2 for security measures to secure the log-on of the third-parties.
See 10.1 for cryptographic measures used when exchanging data with third-parties.
See 13.1.1 and 13.2.1 and 13.2.2 for the security of the communications between 365Talents and third-parties.
See 13.2.4 for Confidentiality or non-disclosure agreements with third-parties
See 14.1.2 and 14.1.3 for protection of the data transmitted over the Internet and protection against threats coming from the Internet.
See 15.1 and 15.2 for management of the security with third-parties.
Security incident management
How are managed security events and incidents ?
See 16.1.1 for responsibilities and procedures defined to manage security incidents
How are reported security events and incidents ?
See 16.1.2 and 16.1.3 for reporting about security events and incidents
How are assessed security events and incidents ?
See 16.1.4 for security events and incidents assessment
How a re security incidents handled ?
See 16.1.5 for response to information security incidents
Compliance and Audit
Is the Service compliant with applicable laws and regulations, in particular GDPR ?
See 18.1.1, 18.1.4 and 18.1.5 for application of laws and regulations
Is the Service audited and reviewed ?
See 18.2.1 and 18.2.3 for service audits and reviews performed
Can the Service be audited ?
See 12.7.1, 18.2.1, 18.2.2 and 18.2.3 for conditions under which the Service can be audited.
Can the hosting provider be audited ?
See section dedicated to hosting provider
Other
Does the usage of the Service require specificities on the workstations of the Users ?
See 9.4.4 for list of what is (not) needed to deploy on the workstations of the users and administrators of the Service.