Orange County NC Website
Browse       Search
DocuSign Envelope ID: D1041CA6-DBD4-42BE-8B32-7C592BF2BA15 <br /> protected using the HTTPS protocol(TLS 1.0). <br /> 28. How are access rights managed by the cloud provider for their employees, contractors <br /> and other persons? <br /> TMA Response: Proper privileges at TMA are based on the "principle of least <br /> privilege". The principle limits access for users to the minimal level that allows a user <br /> normal functioning. This principle of least privilege translates into giving people the <br /> lowest level of user rights that they can have and still do their job. This limits the <br /> potential damage from a security breach, whether accidental or malicious. Addition <br /> details are available within TMA's Network Administrative Security Policy, which is <br /> available upon request. <br /> 29. What methods does the cloud provider use to destroy information, when so authorized? <br /> TMA Response: Client data is removed from our infrastructure on request at the <br /> cessation of the contract or 90 days following the cessation if not specifically requested. <br /> Media is not destroyed, as the data is stored entirely on our SAN infrastructure. Client <br /> data is never transferred to any type of removable media. <br /> 30. What is the cloud provider's patch management policy/methods? <br /> TMA Response: Patch management is managed by the database team once provided by <br /> the development team. The development team creates the patches which are tested and <br /> approved by the QA team. Once approved, the patches are packaged by the development <br /> team and provided to the database team for deployment into the SaaS infrastructure. <br /> Only the database team is authorized to make changes to the SaaS deployment. <br /> 31. How does the cloud provider defend against malware, including but not limited to <br /> viruses, bots, spyware, spam,phishing and pharming? <br /> TMA Response: Vipre is used for virus protection. The entire WebTMA solution is <br /> protected using the HTTPS protocol(TLS 1.0). Firewalls are in place to prevent <br /> disruption to the application or database from external networks. <br /> 32. What system hardening strategies are employed by the cloud provider? <br /> TMA Response: Hardening strategies include but are not limited to the following: <br /> • Management of user privileges <br /> • Removal of unused user accounts <br /> • Close unused network ports <br /> • Password complexity and policies <br /> • Remove unneeded services <br /> • Patch all known vulnerabilities <br /> • Least privileged administration model <br /> 33. How does the cloud provider perform security testing, including logging, correlation, <br /> intrusion detection, intrusion prevention, file integrity monitoring, time synchronization, <br /> security assessments,penetration testing? <br /> TMA Response: TMA utilizes a combination of independent 3rd party testing and a <br />