2020-887-E Economic Dev - Submittable Holdings Inc grant management software

Browse Search

DocuSign Envelope ID:90A54439-23B9-40AF-8246-BFCAAEAA529D APPENDIX B Security Measures REQUIRED TECHNICAL AND ORGANIZATIONAL DATA SECURITY MEASURES: • ORGANIZATIONAL MEASURES • Submittable has appointed one or more security officers responsible for coordinating and monitoring the security rules and procedures. • Submittable personnel with access to Personal Information are subject to confidentiality obligations. • Submittable has performed a risk assessment before processing Personal Information. • Submittable has implemented and maintained an information security program that establishes roles and responsibilities for information security, and supports the confidentiality, integrity, and availability of information systems operated by Submittable and its subcontractors. • Submittable has implemented and maintained information security policies that define requirements for acceptable use, access control, application, and system development, passwords, remote access, information classification, operational security, workstation security, network security, media handling and disposal, mobile computing, and physical security. • Submittable has implemented and maintained a governance framework with supporting risk management policies that will enable risk identification, analysis, and mitigation. • Submittable conducts data security training annually for all employees. • PHYSICAL ACCESS CONTROLS • Entry for secure areas are controlled by security personnel, identification badges, and/or electronic key cards. • All physical access is logged. • Physical access logs are reviewed monthly for unusual activity. • SYSTEM ACCESS CONTROLS • System access is based on the principle of least privilege, i.e., Submittable restricts access to personal information to only those individuals who require such access to perform their job function. • System access is revoked immediately upon termination. • Management conducts quarterly review of accounts, system access, and permission levels • DATA ACCESS CONTROLS • Data access is based on the principle of least privilege, i.e., Submittable restricts access to personal information to only those individuals who require such access to perform their job function. • Data access is revoked immediately upon termination. • Management reviews access to personal information, on a monthly basis. • Submittable uses industry standard practices to identify and authenticate users who attempt to access information systems. Submittable Customer Terms of Service v1.1—Exhibit B,Appendix B Page 1 of 2