Information Security Policy

1. Purpose, scope, and users

This top-level Policy document defines the purpose, direction, principles, and basic rules for information security and privacy management and contains rules, constraints, and standards for individual access and individual use of systems, data storage, and data protection with respect to Resolver’s Hosted Platforms.

There are multiple types of critical data: customer data (including PII – Personally Identifiable Information and PHI – Protected Health Information).

Resolver is committed to safeguarding the confidentiality, integrity, availability, and privacy of the company’s systems and information, including customer, employee, and service provider information. Information is an important business asset of significant value to the company and needs to be protected from threats that could potentially disrupt business continuity and or breach of data privacy.

The Information Security & Privacy Policy is in place to set an underlying framework to meet the requirements of the International Organization for the Standardization standard ISO/IEC 27001:2013 and its Privacy extension ISO 27701:2019.

A critical aspect of the Information Security and Privacy Policy is reporting potential Data Breaches and Security Incidents. This is described in more detail later in this document.  Reporting incidents or potential incidents is an aspect of every employee’s job function.

Users of this document are all Resolver’s employees: permanent, temporary, contracted staff, and its affiliates and subsidiaries.

2. Basic information security terminology

Confidentiality – characteristic of the information by which it is available only to authorized persons or systems.

Integrity – characteristic of the information by which it is changed only by authorized persons or systems in an allowed way.

Availability – characteristic of the information by which it can be accessed by authorized persons when it is needed.

Information security – preservation of confidentiality, integrity, and availability of information.

Information Security Management System (ISMS) – part of overall management processes that plan, implement, maintain, review, and improve information security.

Privacy – Data privacy refers to handling personal data in compliance with data protection laws, regulations, and general privacy best practices.

Personal Data – any information relating to an identified or identifiable natural person.

Privacy Information Management System (PIMS) – Information Security Management System which addresses the protection of privacy as potentially affected by the processing of PII.

3. Objectives

Resolver’s hosted platforms’ information is an asset protected from prohibited disclosure, revision, use, and destruction. Prudent and practical steps are taken to ensure that data integrity, the confidentiality of information, application/data availability, and data privacy are not compromised.

Security tools and processes are implemented and configured to enable adequate and proper restriction of access to programs, data, and other information resources. Physical access measures are also incorporated and implemented to ensure that only authorized individuals can access or use information resources.

General objectives for the ISMS are:

• Creating a better market image and reducing the damage caused by potential incidents and compliance with the EU GDPR.
• Ensure the goals are outlined in the: “2 Resolver Corporate ISMS Objectives” document are in line with the organization’s business objectives, strategy, and business plans.

Company CISO is responsible for reviewing these general ISMS objectives and setting new ones.

Objectives for individual security controls or groups of controls are proposed by the CTO or Director of Development, IT Manager, and Information Security Analyst and approved by CISO in the Statement of Applicability.

General objectives for the PIMS are:

• Creating a better market image and reducing the damage caused by potential data privacy breaches and compliance with applicable data protection laws, regulations, and general privacy best practices.

All the objectives must be reviewed at least once a year.

Resolver will measure the fulfillment of all the objectives. CISO is responsible for setting the methods for measuring the achievement of the objectives – the measurements will be performed at least once a year and the Information Security Analyst will analyze and evaluate the measurement results and report them to CISO as input materials for the Management review.

Information Security Analyst is responsible for recording the details about measurement methods, periodicities, and results in the Measurement Report.

4. Scope of policy

This Policy is applied to the entire ISMS as defined in the ISMS Scope Document and to any activity involving accessing, using, or modifying Resolver’s Hosted Platforms information and/or resources.

Further, this Policy is also applied to PIMS as defined in PIMS Scope Document, and any activity that involves access to, use or modification of Personal Data:

1. Hosted on Resolver Core Hosted Platform for which Resolver assumes the role of the Data Processor.
2. Acquired by Resolver’s HR, Marketing and Sales Dept. for which Resolver assumes the role of Data Controller.

Users of this document are all Resolver’s employees and relevant external parties.

The scope or impact is any access, logical or physical, that has the potential to negatively affect Resolver’s Hosted Platforms and its corporate image. Areas that are managed include, but are not limited to:

4.1 Risks addressed

The risks addressed are prohibited or unauthorized use, modification, and/or destruction of Resolver’s Corporate and Hosted Platforms’ information, data and resources.

5. Reference documents

• ISO/IEC 27001:2013 standard clauses 5.2 and 5.3
• ISO/IEC 27701:2019 standard clause 5
• ISMS Scope Document
• PIMS Scope Document
• Resolver Privacy Statement
• Risk Assessment and Risk Treatment Methodology
• Statement of Applicability
• List of Legal, Regulatory, and Contractual Obligations
• Data Breach Response and Notification Procedure

6. Policy statement

As a modern, forward-looking business, Resolver recognizes at senior levels the need to ensure that its business operates smoothly and without interruption to benefit its customers, shareholders, and other stakeholders.

In order to provide such a level of continuous operation, Resolver has implemented an Information Security Management System (ISMS) and Privacy Information Management System (PIMS) in line with the International Standard for Information Security, ISO/IEC 27001 and its privacy extension ISO/IEC 27701.

This standard defines the requirements for an ISMS and PIMS based on internationally recognized best practices.

The right to use Resolver’s Hosted Platforms’ information systems and computing resources is based on each user’s access privileges. Access privileges are granted based on specific business needs and on a “need to know” basis. Access controls ensure that legitimate users cannot access information unless they are authorized to do so. Resolver’s Hosted Platforms resources, systems, and applications have access controls implemented.

All confidential data/information should be encrypted at rest and in transition.

Production environments must be physically (if possible) or logically (VLAN, VPC) separated from development and QE / Test environments with available access controls (separate AWS account).

Development and QA/test staff must not be permitted access to Production systems/environments unless required by their respective job duties/descriptions, accompanied and controlled by a DevOps person.

Resolver’s employees, “temps,” contractors, consultants, and other workers, including all personnel affiliated with third parties, are responsible for and can participate in maintaining and securing access to Resolver’s Hosted Platforms resources. Resolver’s management provides guidance in creating this secure access environment by establishing access management policies, approving roles and responsibilities, and providing consistent coordination of security efforts across Resolver.

The Security Policies and Procedures listed below are approved by management and act to govern the information environment at Resolver.

6.1 Policy update/review and notification

• Resolver reserves the right to revise the conditions of this policy at any time. Adequate notification of updates will be provided to all employees. Employees are responsible for understanding or seeking clarification of any rules outlined in this document and for familiarizing themselves with the most current version of this policy.
• All policy and procedure documentation, including but not limited to:
  • Information Security Policies, Standards, and Process Documentation.
  • HR and HR process documentation.

7. Roles and responsibilities

• Chief Technology Officer and Chief Informational Security Officer (CISO, CTO, ISWG team member/leadership team): The CISO is the owner and the main person in charge of the overall development and implementation of an information security program. The CTO is responsible for developing Resolver’s technical strategy in the Engineering department (Development, Quality Engineering, and DevOps).
• Senior Corporate Counsel / Data Privacy Officer (DPO) (ISWG team member):
  • Senior Corporate Counsel is responsible for corporate governance and aligning the organization with laws and regulations.
  • Ensure that Resolver’s employees, contractors, customers, and data subjects are informed about their data protection rights, obligations, and responsibilities and raise awareness about them.
  • Give advice and recommendations to Resolver’s management about interpreting or applying the data protection rules.
  • Create a register of processing operations within Resolver and notify applicable Privacy Regulation Authorities, e.g., The European Data Protection Supervisor (EDPS), The Personal Information Protection and Electronic Documents Act (PIPEDA), California Privacy Protection Agency (CPPA) of those that present specific risks (so-called prior checks).
  • Ensure data protection compliance within Resolver and help Resolver’s management to be accountable in this respect.
  • Be a contact point and handle queries or complaints from anyone concerned with PII upon request.
  • Cooperate with any applicable Privacy Regulation Authorities, responding to their requests about investigations, complaint handling, inspections, etc.
  • Draw Resolver management’s attention to any failure to comply with the applicable data protection rules.
• Information Security and Compliance Lead (ISWG team member/leadership team): Responsible for overall monitoring and investigation of detected vulnerabilities and providing the risk assessment (In collaboration with asset owner) and mitigation steps.
• Information Security & Compliance Team (Information Security & Compliance team Lead is a member of the ISWG team):
  • Responding to Customer’s Questionnaires, assuring them of the various security measures deployed in Resolver to secure and protect their data.
  • Review legal contracts, emerging Cybersecurity standards, and frameworks, and provide feedback about Cybersecurity and Privacy compliance issues to legal and other concerned divisions of Resolver.
  • Maintain Cybersecurity and Data Privacy Policies, documentation, and guidelines.
  • Daily review of security events (in SEIM)
  • Periodic Vulnerabilities review
  • Monthly review of Software Development activities with a focus on Cybersecurity.
  • Organizing Internal ISO 27001 Audits
  • Organizing External SOC 2 Type 2 with HIPAA-HITECH Audit
  • Organizing External ISO 27001/2 Audit
  • Participating in ongoing Client’s Audits
  • Updating Resolver’s compliance information on External Security Rating companies. Monitoring reports, analyzing, remediating, and working on security posture improvements.
  • Conducting Security Awareness training
  • Organizing and participating in User access review
  • Organizing review of acknowledgments related to Annual InfoSec Policy and Code of Conduct Acknowledgement processes.
  • Conducting Internal Penetration testing
  • Organizing External Application Penetration testing
• IT Directors (ISWG team members): IT Department director, responsible for implementing remediating actions defined as a result of detected vulnerabilities for Resolver’s Corporate networks’ attached assets.
• DevOps Director (ISWG team member): The DevOps team is responsible for deploying and maintaining the cloud environments, implementing remediating actions defined as a result of detected vulnerabilities for Resolver’s Hosted production environments.
• Director of Customer Service (ISWG team member): Responsible for customer communication.
• Asset Owner: Responsible for the IT asset scanned by the vulnerability management process. This role should decide whether identified vulnerabilities are mitigated, or their associated risks are accepted.

For more detailed information about the roles and responsibilities and organizational structure at Resolver, please refer to  https://resolverco.bamboohr.com/employees/orgchart.php?pin

8. Confidential information plan

Please refer to the “A.8.2 Resolver Corporate Data Handling Policy” document for more detailed information.

Resolver ensures that the information security and data privacy principles as described below are applied consistently across the management of access to information assets, information systems, business processes, and premises for any activity that involves access to, use or modification of Personal Data:

1. Hosted on Resolver Core Hosted Platform, (for which Resolver assumes the role of a Data Processor).
2. Acquired by Resolver’s HR, Marketing and Sales Dept., (for which Resolver assumes a role of Data Controller).

Consent & Choice: PII Principals shall have the choice whether to allow PII processing or not

Purpose, legitimacy and specification: The purpose of processing shall comply with the law and be communicated to PII principals.

Collection limitation: Data collected shall be limited to what is strictly necessary for the purpose.

Data minimization: PII processing and third parties access to PII shall be minimized.

Use, retention and disclosure limitation: PII shall be used only for specified purpose and, retained only as needed for purpose.

Accuracy and quality: PII shall be maintained as accurate, as complete, as up-to-date, as adequate and relevant for the purpose, as provided by the PII principals.

Openness, transparency and notice: PII principals shall receive sufficient, clear and easy to access information

Individual participation and access: PII principals should be able to access and review PII, as permitted by the law

Accountability: Resolver takes the responsibility for the PII processing.

Information security: Security Controls shall be implemented to protect the confidentiality, integrity and availability of data.

Privacy compliance: Controls shall be implemented, audits, and verifications shall be performed to ensure PII processing meets the compliance requirements.

8.1 Handling and distribution of data

For greater detailed information, please refer to the “A.8.2 Resolver Corporate Data Handling Policy” document

8.2 Data Encryption Policy

Data encryption should follow the requirements defined in the “A.10 Resolver Corporate Cryptography Policy and Standards” document.

8.3 Resolver’s Hosted Platforms Data Breach Notification Policy

8.3.1 Reporting of Data Breach

In the event a data breach has occurred or is suspected, employees are required to notify their supervisor immediately.

Supervisors are required to report the event to the CISO or CTO immediately.

Evaluation regarding whether there has been a data breach will follow after a breach notification.  Senior management will make the determination about subsequent notification to customers and authorities.

Please refer to the “A.16 Resolver Data Breach Response and Notification Procedure GDPR and HIPAA” document for more detailed information.

9. Security and Privacy policies and procedures

9.1 Employee position change

Issuance or electronic notification is required when an employee changes positions within the organization at Resolver. All employee position change notifications should include the following to allow application and systems owners to update logical and physical access accordingly, if appropriate:

• Title change
• Department Transfer
• Physical Location Change
• Access Establishment Requirements
• Access Termination Requirements

Human Resources will only initiate employee change notifications.

9.1.1 Terminating access

When an employee is terminated voluntarily or involuntarily and exits Resolver, a notification will be sent to all applicable parties. Human Resources issue the termination notification immediately upon termination.

Resolver Helpdesk, Operations, Physical Facilities, Accounting, and Human Resources will all receive the notification. Upon receipt of a termination notification, all domain and application/systems access is immediately disabled.

The terminated employee will return all Resolver equipment and property, including laptop, PDA, phone, access cards, etc., to their supervisor or a Senior Human Resources representative.

9.1.2 Network access

Resolver’s Hosted Platforms reside in Tier 1 Colocations and/or the Cloud. Network access is restricted to approved Resolver employees.

9.1.3 Resolver’s Hosted Platforms applications access

All access requests require a written or electronic form with appropriate management approval.  Access requires a profile, including a valid username and password. Group permissions are reflective of job requirements and are audited quarterly.

9.2 Physical access

Resolver’s Hosted Platforms reside in Tier 1 Colocations and/or the Cloud. Colocation data center access is restricted to approved Resolver employees.

9.3 Authenticating a user

9.3.1 Unique application and systems users

All usernames assigned to users in order to access Resolver’s Hosted Platforms information systems and/or computer resources will be unique to that information system or computer resource and unique to each user.

9.3.2 Restricted Access Devices

All of Resolver’s Hosted Platforms systems utilize complex usernames and passwords.

9.3.3 Password Policy Settings

All employees accessing Resolver’s Hosted Platforms infrastructure must change their application and/or systems passwords according to the Resolver Corporate Password Policy document.

9.4 Access Methods

9.4.1 LAN (Local Area Network)

Resolver’s Hosted Platforms reside in Tier 1 Colocations and/or the Cloud. Colocation network access is restricted to approve Resolver employees.

9.4.2 Remote access

Resolver’s Hosted Platforms’ resources remote access should follow the requirements defined in Resolver’s Hosted Platform Remote Access Policy document.

9.5 Protection of data

9.5.1 Backups

Backups of all essential electronically stored business data are routinely created.

Please refer to the “A.12.3 Resolver Corporate BackUp and Restore Policy” document for more detailed information.

9.5.2 Antivirus policy

All computers attached to any Resolver networks must run supported by company IT department anti-virus software.

This software must be active and configured as follows:

• Real-time protection must be turned on.
• Scheduled scans must be configured to perform virus checks at least once a day.
• A full antivirus scan must run at least once a month.
• Virus definition files must be kept up to date and configured for an automatic update once a day.

If an employee receives what he/she believes to be a virus or suspects that a computer is infected, it must be reported to the IT department immediately at it@resolver.com or the Information Security Department at infosec@resolver.com.

The report should include as much detail as possible: virus name, the extent of the infection, the source of the virus, and potential recipients of infected material.

Any virus-infected computer will be removed from the network until it is verified as virus-free.

9.6 Disposal of data

Please refer to the “A.11.2 Resolver Disposal and Destruction Policy” document for more detailed information.

9.7 System/Application Logging Requirements

Please refer to the “A.12.4 Logging and monitoring policy” document for more detailed information.

9.8 Personal device usage for business purposes

Personnel is prohibited from using personal devices not managed by Resolver’s corporate IT department for performing business tasks except:

• E-mail services usage: send/receive/read/write through the web interface: https://login.microsoftonline.com or using a mobile email app.
• Slack or other approved by Resolver IT Instant messaging (IM) application.

If you are utilizing a Microsoft Outlook client and storing offline e-mail correspondence in your local drive in OST or PST format, you must encrypt your local drive utilizing Bitlocker in Microsoft Windows platforms and FileVault 2 in Apple macOS X platform.

10. ISMS and PIMS Communications

There are a number of established ISMS and PIMS communication methods in place within Resolver and these will be used where possible. A breakdown of the ways in which the necessary information will be communicated to the relevant interested parties is shown in the following table.

11. Exceptions

Any exceptions to this policy can only be granted in accordance with the company CISO or Resolver’s Information Security Department’s written approval.

12. Validity and document management

This document is valid as of August 2023.

The owner of this document is an Information Security Analyst who must check and, if necessary, update the document at least once a year.

When evaluating the effectiveness and adequacy of this document, the following criteria need to be considered:

• A number of incidents arose from the unclear definition of the ISMS scope.
• A number of corrective actions were taken due to an inadequately defined ISMS scope.
• Time put in by employees implementing the ISMS to resolve dilemmas concerning the unclear scope.

EFFECTIVE ON: August 2023

REVIEW CYCLE: Annual at least and as needed