Encryption & access control — found from sitemap — Symphony

Cited by

Facts read from this source

• Infosec policy ISO 27001 Report an error

  “An Information Security Policy based on ISO 27001 is in place addressing system requirements for all users. The policy is reviewed and updated on an annual basis and as needed by the Chief Information Security Officer (“CISO”).”

• SOC 2 subservice review Report an error

  “On an annual basis the CISO reviews SOC2 reports from subservice organizations Amazon Web Services (“AWS”) and Google Cloud Platform (“Google”) to ascertain whether complementary subservice organization controls are operating effectively.”

• Access control need to know Report an error

  “Symphony has implemented technical controls so that each Authorized User will be able to gain access only to those categories of personal data to which access is necessary to perform assigned job responsibilities.”

• SSO identity management Report an error

  “Symphony uses a single-sign-on (“SSO”) solution for identity management of applications used in Symphony’s environment. The SSO solution has been configured to read from Active Directory and is used to grant access to further applications as needed.”

• MFA production access Report an error

  “Access to the production environment is authenticated through unique user IDs and multi-factor authentication.”

• Access revocation timing Report an error

  “Access is revoked within one business day after notification from the manager.”

• Antivirus corporate workstations Report an error

  “Anti-virus software is installed on Symphony corporate workstations. The anti-virus software is configured to detect and quarantine threats, and is monitored by the Security Team on an ongoing basis. Customers are responsible for implementing anti-virus software to prevent or detect and act upon the introduction of unauthorized or malicious software.”

• Firewalls deployed Report an error

  “Symphony has deployed firewalls and rule configurations to protect Symphony servers against outsiders and threats to the system’s security, availability, and confidentiality.”

• Encryption in transit tls Report an error

  “Symphony encrypts personal data in transit, using Transport Layer Security (“TLS”) and encrypts personal data at rest using 256-bit AES encryption or stronger.”

• Encryption at rest 256bit aes Report an error

  “Symphony encrypts personal data in transit, using Transport Layer Security (“TLS”) and encrypts personal data at rest using 256-bit AES encryption or stronger.”

• Remote access vpn only Report an error

  “Symphony permits remote access to its networks only via a VPN or a similar secure means.”

• Encrypted offsite backups Report an error

  “Symphony backs up personal data on a regular schedule. Back-ups are encrypted and stored in a location apart from the primary storage. Back-ups permit prompt restoration of personal data in the event of a disaster.”

• Business continuity disaster recovery plan Report an error

  “Symphony has developed and maintains a business continuity/disaster recovery plan to ensure that it can promptly resume service and restore access to personal data in the event of a physical or technical incident occurrence”

• Physical office safeguards Report an error

  “Visitors to Symphony offices are required to sign-in at reception, and security cameras are located at entry points for Symphony offices. Physical access to IDF computer and data rooms are restricted to authorized personnel.”

• Providers Report an error

  “Symphony has outsourced hosting of Symphony servers, including the physical and environmental security of facilities housing such servers, to AWS and Google.”

• Channels Report an error

  “Customers may reach the Customer Support Team via telephone, email, or the Customer Support portal, and response times have been established reflecting the severity of the customer inquiry.”

• Incident monitoring splunk Report an error

  “Incidents are identified and monitored using Splunk.”

• Segregated development environment Report an error

  “A separate development environment is in place and the Development Teams are restricted from accessing the production environment.”

• Source code control Report an error

  “Source code is maintained in the source code control system to record changes and Confluence serves as a document repository throughout the software development lifecycle.”

• In house development Report an error

  “The company applications are developed in-house.”

• Background checks new hires Report an error

  “Additionally, background checks are performed on new hires as permitted by local laws.”

• Security training Report an error

  “Employees are provided with security and confidentiality related training upon hire and on a continuing basis.”

• Risk committee bricc Report an error

  “A Business Risk and Information Control Committee (“BRICC”) is in place co-led by the Chief Information Security Officer. The committee meets on a monthly basis together with members of Engineering leadership”

• Document last updated Report an error

  “Last Updated: June 1, 2024”

2 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Compliance Counsel Encryption & access control
• The Compliance Counsel Deployment & data custody
• The Platform Engineer Encryption & access control
• The Security Officer Encryption & access control
• The Skeptic Encryption & access control
• The Team Lead Encryption & access control
• The Team Lead Retention, discovery & co-determination
• The Works Council Advocate Encryption & access control