Q: What controls do you have in place to prevent, detect and mitigate the effect of data breaches?

A: To prevent unauthorized access or disclosure, we have put in place physical, electronic, and managerial procedures. These procedures are designed to safeguard and secure personal information and protect it from misuse, interference, loss, and unauthorized access, modification, and disclosure.

We also have a policy that prohibits IT vendors from accessing our information security assets until a contract containing security controls is agreed to and signed by the appropriate parties. All IT vendors must comply with the security policies defined and derived from our Information Security Program.

In terms of detection, we have controls in place to restrict the use of removable media to authorized personnel. Antivirus and anti-malware tools are deployed on end-point devices (e.g., workstations, laptops, and mobile devices). These tools are configured to automatically receive updates, run scans, and alert appropriate personnel of viruses or malware.

To mitigate the effects of data breaches, we maintain cybersecurity insurance to mitigate the financial impact of business disruptions.

In the event of a breach, we have defined procedures for notifying appropriate parties, including affected individuals and various regulatory bodies. The notification timeframes and procedures are outlined in our Incident Response Plan.