CGA appendices: security measures

Encryption and pseudonymization measures

Encryption	The provider will encrypt the client’s information in transit over the Internet and within the provider’s network, as well as at rest at the disk, database, or application level. The provider may not process any client information that is not encrypted, unless approved by the client. Standard data protection controls, such as encryption, must be used in accordance with industry best practices (for example, TLS 1.2, AES, P12 Cert guidelines) to secure CGA information. Encryption keys for personal data processed or transferred from Europe will be stored in Europe.
Pseudonymization (as defined in the GDPR) with respect to Personal Data	The provider will process pseudonymized personal data on behalf of the client only where appropriate for the purposes of providing the services, thereby ensuring that such data cannot be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to appropriate technical and organizational measures. To the extent the client provides the Provider with pseudonymized personal data for processing, the Provider will not attempt to re-identify such data or re-associate it with an individual, unless explicitly instructed otherwise by the client.

Encryption

The provider will encrypt the client’s information in transit over the Internet and within the provider’s network, as well as at rest at the disk, database, or application level. The provider may not process any client information that is not encrypted, unless approved by the client. Standard data protection controls, such as encryption, must be used in accordance with industry best practices (for example, TLS 1.2, AES, P12 Cert guidelines) to secure CGA information. Encryption keys for personal data processed or transferred from Europe will be stored in Europe.

Pseudonymization (as defined in the GDPR) with respect to Personal Data

The provider will process pseudonymized personal data on behalf of the client only where appropriate for the purposes of providing the services, thereby ensuring that such data cannot be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to appropriate technical and organizational measures. To the extent the client provides the Provider with pseudonymized personal data for processing, the Provider will not attempt to re-identify such data or re-associate it with an individual, unless explicitly instructed otherwise by the client.

Measures to ensure the confidentiality, integrity, and availability of systems and services

Confidentiality or non-disclosure agreements	Requirements for confidentiality or non-disclosure agreements reflecting the organization’s needs for the protection of information are identified, regularly reviewed, and documented.

Measures to ensure the ability to restore the availability of and access to information in a timely manner in the event of a physical or technical incident

Backups	The provider must perform, or have performed, daily backups of the client’s information on the provider’s systems and store these backups in an industry-standard encrypted format in a secure location. Upon reasonable request, the provider must provide the client with a copy of its backed-up information in a machine-readable format.

User identification and authorization measures

Access control policy	An access control policy is established, documented, and reviewed based on business and information security requirements.

Measures to protect data during storage

Firewall	The provider uses a firewall to protect its systems and network against external attacks and to help prevent data breaches.

Measures to ensure event logging

Logging	Event logs recording user access, activities, exceptions, faults, data access, deletion or restoration, and information security events must be produced, retained, stored securely, and regularly reviewed. The client will have access to the relevant access logs upon request. Logs of transmissions of the client’s information must be retained, including, without limitation, the identity of the data transmitted, the recipient, and the date of disclosure. Administrator activity logs must be retained and provided to the client upon request.

Logging

Event logs recording user access, activities, exceptions, faults, data access, deletion or restoration, and information security events must be produced, retained, stored securely, and regularly reviewed. The client will have access to the relevant access logs upon request. Logs of transmissions of the client’s information must be retained, including, without limitation, the identity of the data transmitted, the recipient, and the date of disclosure. Administrator activity logs must be retained and provided to the client upon request.

Measures for internal IT and IT security governance and management

Installation of software on operational systems	Procedures are implemented to control and prohibit the installation of unauthorized software on operational systems.
Controls against malware	Detection, prevention, and recovery controls to protect against malware are implemented, combined with appropriate user training and awareness.
Information security continuity	The business continuity plan must include measures to maintain the same level of information security controls at backup sites as at the primary sites.

Process and product certification/assurance measures

Information security policy	The provider has an approved and published information security policy that provides direction and support for information security (in accordance with business needs and applicable laws and regulations) and that is regularly reviewed, approved, and published to all relevant personnel.

Measures to ensure limited data retention

Limited data retention	Technical and organizational measures are in place to ensure that personal data is not retained for longer than necessary, including controls and processes in place to support the client’s instructions and requirements regarding data retention.

Measures to ensure accountability

Accountability	Technical and organizational measures are in place to demonstrate that the provider/data importer has taken appropriate steps to ensure that the data protection principles have been implemented.

Processor oversight arrangements

Processor oversight	Not applicable, no subcontracting