Orange County NC Website
Browse       Search
DocuSign Envelope ID: 1 E8BDD1 D-A826-4FDB-AB97-5EE804B7DCCB <br /> Access is provided based on the principle of least required privilege and is immediately <br /> revoked when no longer required. <br /> 29. What methods does the cloud provider use to destroy information, when so authorized? <br /> Due to security and intellectual property reasons, CERVIS policy does not allow <br /> disclosure of specific information related to infrastructure or security. However, <br /> CERVIS will use secure erasure technology to accomplish this activity. <br /> 30. What is the cloud provider's patch management policy/methods? <br /> Due to security and intellectual property reasons, CERVIS policy does not allow <br /> disclosure of specific information related to infrastructure or security. However, <br /> CERVIS will patch vulnerabilities based on criticality as assessed by our security teams. <br /> 31. How does the cloud provider defend against malware, including but not limited to <br /> viruses, bots, spyware, spam,phishing and pharming? <br /> Due to security and intellectual property reasons, CERVIS policy does not allow <br /> disclosure of specific information related to infrastructure or security. However, <br /> CERVIS is protected with commercially accepted security practices including, Anti- <br /> Virus software,Network firewalls, host-based firewalls, network intrusion prevention, <br /> host-based intrusion prevention, Database firewalls, SSL encryption of data in motion, <br /> AES encryption of data at rest, encrypted VLANs and regularly scheduled vulnerability <br /> and web application security assessments. <br /> 32. What system hardening strategies are employed by the cloud provider? <br /> Due to security and intellectual property reasons, CERVIS policy does not allow <br /> disclosure of specific information related to infrastructure or security. <br /> 33. How does the cloud provider perform security testing, including logging, correlation, <br /> intrusion detection, intrusion prevention, file integrity monitoring, time synchronization, <br /> security assessments,penetration testing? <br /> Due to security and intellectual property reasons, CERVIS policy does not allow <br /> disclosure of specific information related to infrastructure or security. <br /> 34. What technologies and methods does the cloud vendor provide for strong authentication? <br /> Due to security and intellectual property reasons, CERVIS policy does not allow <br /> disclosure of specific information related to infrastructure or security. <br /> 35. Provide any other comments and explanations: <br /> Click here to enter text. <br /> ^os <br /> J <br />