Security measures related to asset management
8.1 - Responsibility for assets
Objective: To identify 365Talents' assets and define appropriate protection responsibilities
8.1.1 - Inventory of assets
365Talents maintains an inventory of assets, whether hardware resources (laptops) or software (application mapping, Azure resources, deployed software). These inventories are either manual (laptops, application mapping, deployed software) or automated (Azure resources, software deployed within Azure). All public and private APIs are inventoried.
8.1.2 - Ownership of assets
365Talents has defined ownership of assets.
Customers remain the sole owners and processors of all data, both data entrusted to 365Talents by the Customer and data collected by 365Talents on the Customer's instruction. 365Talents is the owner of all other Service data.
8.1.3 - Acceptable use of assets
365Talents has defined rules regarding acceptable use of assets.
8.1.4 - Return of assets
365Talents has defined rules regarding return of assets.
8.2 - Information classification
Objective: To ensure that information receives an appropriate level of protection in accordance with its importance to the 365Talents
8.2.1 - Classification of information
To help 365Talents and its employees easily understand requirements associated with different kinds of information, the company has created three classes of data.
Confidential
Sensitive data requiring the highest levels of protection; access is restricted to specific employees or departments, and these records can only be passed to others with approval from the data owner, or a company executive. Example include:
Customer Data, in particular Personally identifiable information (PII)
365Talents' Employees Personally identifiable information (PII)
Company financial and banking data
Strategic plans, product roadmaps or specifications
Authentication credentials
Secrets and private keys
Source code
Salary, compensation and payroll information
Customer/prospects Data (CRM)
Configuration and Monitoring data
Customer support information
Projects data
Incident reports
Risk assessment reports
Technical vulnerability reports
Litigation data
Restricted
365Talents proprietary information requiring thorough protection; access is restricted to employees with a "need-to-know" based on business requirements. Communication outside the company of these data should be done only to people with a "need-to-know" and after thoughtful consideration of their sensitivity. This is default for all company information unless stated otherwise. Examples include:
Internal policies
Legal documents
Accounting data, expenses accounts
Meeting minutes and internal presentations
Contracts
Internal reports
Slack messages
Email
Public
Documents intended for public consumption which can be freely distributed outside 365Talents. Examples include:
Marketing materials
Product descriptions
Release notes
External facing policies
The Service doesn't collect the following type of personal information : age, personal situation, family situation, income, holidays, place of residence, financial indicators.
The Service doesn't collect any sensitive personal information as racial or ethnic origins, religious or political opinion or health data that would require a higher level of classification.
8.2.2 - Labeling of information
Confidential data should be labeled "confidential" whenever paper copies are produced for
distribution.
Confidential electronic documents should be explicitly labeled "confidential" in every page and in the name of the file.
Restricted electronic documents should be labeled "restricted" or "internal" at least on the first page of the document.
8.2.3 - Handling of assets
365Talents use mutualized hosting for the Service and use dedicated data bases and logical isolation to enforce isolation of the data produced or stored for the Service. 365Talents does not host or duplicate data of the Service and/or related to its Clients out-of-site.
Data are encrypted at rest as described in 10 - Cryptography.
Data are encrypted in transit as described in 10 - Cryptography
The export of the Clients' data, including personal ones, in the context of the provided service is possible to the authorized users of the Service in Excel format.
More information regarding collect and treatment of personal data by the Service
General data handling
These rules apply no matter the confidentiality of the data :
Usage of removable media such as, but not limited too, USB stick, external hard drive, SD card, … is prohibited. Any exception should be validated by IT Security manager and/or CTO.
Laptops' hard drives shall be encrypted in all cases
By default, 365Talents IS users are asked not to store customer data on their workstations. However, in certain specific cases (correction of data supplied by the Customer for integration into the service, reporting, etc.), users may need to process this type of data directly on their workstations, on a temporary basis. To avoid this, all workstations are encrypted.
Confidential Data Handling
Confidential data are subject to the following protection and handling requirements:
Access for non-preapproved roles requires documented approval from the data owner
Access is restricted to specific employees, roles and/or departments
Confidential systems shall not allow unauthenticated or anonymous access
Confidential Customer Data shall not be used or stored in non-production systems/environments
Confidential data shall be encrypted at rest and in transit over public networks in accordance with the Cryptography Policy
Mobile devices storing or accessing confidential data shall be protected by a log-on password (or equivalent, such as biometric) or passcode and shall be configured to lock the screen after ten (10) minutes of non-use
Backups containing confidential data shall be encrypted
Confidential data shall not be stored on personal phones or devices.
Paper records shall be labeled "confidential" and securely stored and disposed of in a secure, approved manner in accordance with data handling and destruction policies and procedures
Hardcopy paper records shall only be created based on a business need and shall be avoided whenever possible
Hard drives and mobile devices used to store confidential information must be securely wiped prior to disposal or physically destroyed
Transfer of confidential data to people or entities outside the company shall only be done in accordance with a legal contract or arrangement, and the explicit permission of management or the data owner
Restricted Data Handling
Restricted data is subject to the following protection and handling requirements:
Access is restricted to users with a need-to-know based on business requirements
Restricted systems shall not allow unauthenticated or anonymous access whenever possible.
Access through generic/shared accounts should be documented, limited as much as possible and usage limited to authorized people.
Transfer of restricted data to people or entities outside the company or authorized users shall require management approval and shall only be done in accordance with a legal contract or arrangement, or the permission of the data owner
Paper records shall be securely stored and disposed of in a secure, approved manner in accordance with data handling and destruction policies and procedures
Hard drives and mobile devices used to store restricted information must be securely wiped prior to disposal or physically destroyed
Public Data Handling
No special protection or handling controls are required for public data. Public data may be freely distributed.
8.3 - Media handling
Objective: To prevent unauthorized disclosure, modification, removal or destruction of information stored on media
8.3.1 - Management of removable media
365Talents forbid usage of any removable media.
365Talents doesn't print any document containing its Clients' data from the Service.
8.3.2 - Disposal of media
Data classified as restricted or confidential shall be securely deleted when no longer needed.
365Talents shall assess the data and disposal practices of third-party vendors in accordance with the Third-Party Management Policy.
Only third-parties who meet 365Talents requirements for secure data disposal shall be used for storage and processing of restricted or confidential data. Data erasure on the physical media used by the service infrastructure is carried out by 365Talents' hosting subcontractor (Microsoft Azure), which follows NIST guidelines 800-88 on media purging.
365Talents shall ensure that all restricted and confidential data is securely deleted from company devices prior to, or at the time of, disposal.
Confidential hardcopy materials shall be shredded or otherwise disposed of using a secure method.
Personally identifiable information (PII) shall be collected, used and retained only for as long as the company has a legitimate business purpose.
PII shall be securely deleted and disposed of following contract termination in accordance with company policy, contractual commitments and all relevant laws and regulations.
PII shall also be deleted in response to a verified request from a consumer or data subject, where the company does not have a legitimate business interest or other legal obligation to retain the data.
8.3.3 - Physical media transfer
365Talents doesn't transfer any physical media.