DivDat has security monitoring in place that automatically sends alerts to our Network Administration staff whenever there is any suspicious activity occurring on the corporate firewalls, network infrastructure, hosted sites, endpoints and email system. Security appliances are monitored real-time for IDS, log monitoring and threat management by Alert Logic. If there is a confirmed incident, depending on the severity, the appropriate DivDat members will be notified by email and phone. Once the incident has been identified DivDat invokes our incident response plan through the completion of the remediation and post mortem process.

In the event of an outage, DivDat immediately notifies DivDat management and impacted clients which include a summary of the incident, time and date, estimated time of resolution, and description of impact. Notifications are sent to IT management and affected clients every hour until fully resolved.

DivDat has identified all mission critical applications that are required to be restored in the event of disaster recovery. To ensure that production services and data are protected in the event of a disaster, DivDat purchased and deployed an enterprise virtualization backup and replication software suite. The backup software suite allows the Infrastructure team to select from a variety of recovery options including instant virtual machine recovery, full restoration of a virtual machine from incremental or full backups, granular file level recovery and cross site replication of critical servers/services. Incremental backups are done daily and full backups are done every Saturday.

DivDat has different departments/personnel for almost every function. Network Operations, Programming, Print Operators, Mailroom, audit and supervision, etc. Everyone has the least amount of access necessary to complete their job. For instance, programmers cannot make changes to the network. Print operators cannot make changes to the program. Delivery drivers cannot print documents.

DivDat warrants and represents that personnel have been screened for the following immediately prior to placement: (1) illicit drug use as determined by a standard 5 Panel Drug Test; and (2) criminal background as determined by a standard background check that is designed to reveal any federal, state, or local felony crime of any nature, or any federal, state, or local non-traffic-related misdemeanor offense.

Vulnerability scanning (external and internal) is conducted by DivDat (through Alert Logic) on a weekly and monthly basis while DivDat’s QSA conducts vulnerability scanning (external) on a quarterly basis.

Penetration testing is conducted through DivDat’s QSA on an annual basis and is aligned with our PCI DSS assessment. Remediation of identified vulnerabilities is controlled by DivDat’s Change Management Process and is governed by DivDat’s Patch Management policy.

DivDat utilizes IBM BigFix for patch management and compliance/vulnerability assessments and reporting. Patches are grouped into baselines by type and severity. For patches that have been identified as mitigating serious security threats, these baselines will be applied as soon as possible with sensitivity to customer data processing. All others follow DivDat’s standard patching policy.

DivDat’s Access Control policy has been established to provide controlled access which will allow employees access to entrance doors, computer rooms, wiring closets, telephone rooms, finance and IT departments as their role requires.

All DivDat employees gain access to the office building, warehouse and production areas via an Access Badge (Badge) through an access control system. A proximity reader is positioned on the wall by all access controlled doors. To gain access through a door, an employee registers his or her Badge at the proximity reader. The light will turn from red to green and beep and the door will unlock. If an employee does not have authorized access to that door, it will not unlock.

Badges must be worn by all employees at all times while on the premises. When entering and leaving the facility, employees are required to register their badge with the proximity readers located by all outside doors. For safety reasons, DivDat must know which employees are in the building at all times. When an employee terminates employment with DDC, LLC, the Controller immediately disables access through the access control software. The Controller runs a user-access report at minimum on a quarterly to verify that all access is current.

Additional building security includes the use of security gates, electronic monitoring, fire suppression, temperature monitoring, humidity monitoring, CCTV camera system for both internal and external cameras, and exterior lighting.

DivDat can support a variety of encryption for transferring data to include: PGP, SFTP, IPSEC VPN tunnels and HTTPS – TLS communication. DivDat receives data files 24x7x365. The data file transfer method that we use is secure SFTP with the option of PGP encryption and SSH key exchange for enhanced security. DivDat follows best in practice industry standards as they relate to encryption and encrypted communication.

DivDat operates a Microsoft domain environment for its internal employees. Each employee has their own unique domain user account and password that is not shared with others. DivDat’s password group policy ensures that user passwords are strong by industry standards and rotate on a 90 day cycle. For web and archive services, DivDat forces the use of custom accounts based on our client’s business rules. Standard user account and password rules include the following:

• Custom access levels
• Custom password length
• Custom usernames
• MFA

DivDat’s scoped systems are protected with centrally managed anti-virus software to ensure the integrity of the systems and the data that they process. Anti-virus definitions are updated automatically as they are released by Symantec. Additionally, DivDat recommends that its clients at a minimum operate an industry standard anti-virus program for each client device that may access said utility.

DivDat’s latest online solutions utilize a common Login and Password service that adheres to the latest OWASP guidelines and includes multi-factor token challenge sent via a side channel (SMS or alt eMail address) and detailed logging. All sensitive login/password data is stored in an encrypted state.

For a minimum of 1 year DivDat will retain log data relevant to user access, user activity, account changes, account access, web service activity, server activity, firewall activity, network device activity and many other additional items. All log data is stored securely offsite with our log management provider, Alert Logic.

DivDat utilizes Microsoft’s Office 365 platform in conjunction with Fortimail for all of its corporate email communication. Leveraging features available through Office 365 and Fortimail such as Data Loss Prevention, Mobile Device Management, SPAM/malware filtering and inbound security rules, DivDat is able to protect and secure email communications both inbound and outbound.