Orange County NC Website
Browse       Search
• Identity and Access Management (IAM) <br />• Monitoring, Logging, and Security Information and Event Management (SIEM) <br />• DDoS Mitigation <br />• Physical Security Controls <br />• Compliance and Regular Security Audits <br /> <br />26. What security measures does the cloud provider use in data storage, transit and use? <br />• Data Storage Security <br />o Encryption at Rest <br />o Access Control and Role-Based Access <br />o Redundant Storage and Replication <br />o Audit Logging <br />o Regular Security Patching <br /> <br />27. What encryption technologies does the cloud provider use in data management? <br />• Encryption at Rest <br />o Advanced Encryption Standard (AES-256) <br />o Shield Platform Encryption <br />o Customer-Managed Keys <br />• Encryption in Transit <br />o Transport Layer Security (TLS 1.2/1.3) <br />o HTTPS and Secure APIs <br />• Encryption Key Management <br />o Hardware Security Module (HSM) <br />o Key Rotation and Revocation <br />• Encryption in Use <br />o Field-Level Encryption\ <br />o Tokenization and Masking <br />• Compliance-Oriented Encryption Standards <br />o FIPS 140-2 Compliance <br /> <br />28. How are access rights managed by the cloud provider for their employees, contractors <br />and other persons? <br />• Role-Based Access Control (RBAC) <br />• Principle of Least Privilege <br />• Multi-Factor Authentication (MFA) <br />• Single Sign-On (SSO) Integration <br />• Access Reviews and Audits <br />• Strict Access Approval and Revocation Processes <br />• Privileged Access Management (PAM) <br />• Data Masking and Restricted Access in Production Environments <br />• Activity Monitoring and Logging <br />• Training and Security Awareness <br /> <br /> <br />Docusign Envelope ID: 99306186-17FB-4EAC-9539-D90895EB6D04