Mimecast’s DMARC Analyzer Services Technical & Organizational Measures

Last Updated – July 1, 2021

This document describes technical and organizational security measures and controls implemented by Mimecast to protect the data customers entrust to us as part of the Mimecast DMARC Analyzer services.

Within this document, the following definitions apply:

• “Customer” means any subscriber to the Mimecast DMARC Service. 
• “Mimecast DMARC Analyzer Service” means the Software-as-a-Service provided by Mimecast to our Customers.
• “Customer Data” means any information provided or submitted by the Customer that is processed by the Mimecast DMARC Analyzer Service.
• “Personal Data” means any information relating to an identified or identifiable natural person.
• “Personnel” means Mimecast employees and authorized individual contractors/vendors. 

 

1. Organization Of Information Security

Objective:

To outline Mimecast’s information security structure.

Measures:

1. Mimecast employs full-time dedicated trained/certified security Personnel responsible for information security.
2. The information security function reports directly to the Mimecast senior leadership team.
3. Mimecast has a comprehensive set of information security policies, approved by senior management and disseminated to all Personnel.
4. All Mimecast Personnel have signed legally reviewed confidentiality agreements.
5. All Mimecast Personnel are given training in information security.

 

2. Information Security Management System

Objective:

To demonstrate Mimecast’s commitment to manage the assessment and treatment of these risks and to continually improve its information security.

Measures:

1. Mimecast has deployed an ISMS (Information Security Management System) that serves as the foundation of our information security practices.

 

3. Physical Access

Objective:

To protect the physical assets that contain Customer Data.

Measures:

1. The Mimecast DMARC Analyzer Service is housed with the Amazon Cloud environment. Amazon’s description of their data center physical security controls can be found here: https://aws.amazon.com/compliance/data-center/controls/

 

4. System Access

Objective:

To ensure systems containing Customer Data are used only by approved, authenticated users.

Measures:

1. Access to Mimecast systems is granted only to Mimecast Personnel and/or to permitted employees of Mimecast’s subcontractors and access is strictly limited as required for those persons to fulfil their function.
2. All users access Mimecast systems with a unique identifier (UID).
3. Mimecast has established a password policy that prohibits the sharing of passwords and requires passwords to be changed on a regular basis and default passwords to be altered. All passwords must fulfil defined minimum complexity requirements and are stored in encrypted form.
4. Mimecast has a comprehensive process to deactivate users and their access when Personnel leaves the company or a function.
5. All access or attempted access to systems is logged and monitored.

 

5. Data Access

Objective:

To ensure Personnel entitled to use systems gain access only to the Customer Data that they are authorized to access.

Measures:

1. As a matter of course, Mimecast Personnel do notaccess Customer Data.
2. Mimecast restricts Personnel access to Customer Data on a "need-to-know” basis based on this justification.
3. Each such access and its subsequent operations are logged and monitored.
4. Personnel training covers access rights to and general guidelines on definition and use of Customer Data.

 

6. Data Transmission/Storage/Destruction

Objective:

To ensure Customer Data is not read, copied, altered or deleted by unauthorized parties during transfer/storage.

Measures:

1. Customer access to the Mimecast DMARC Analyzer Service portals are protected by the most current version of Transport Layer Security (TLS).  
2. The Mimecast DMARC Analyzer Service relies on Amazon Cloud controls for the destruction of media. An outline of these controls can be found at: https://aws.amazon.com/compliance/data-center/controls/

 

7. Confidentiality And Integrity

Objective:

To ensure Customer Data remains confidential throughout processing and remains intact, complete and current during processing activities.

Measures:

1. Mimecast has a formal background check process and carries out background checks on all new Personnel.
2. Mimecast trains its engineering Personnel in application security practices and secure coding practices.
3. Mimecast has a central, secured repository of product source code, which is accessible only to authorized Personnel. 
4. Mimecast has a formal application security program and employs a robust Secure Development Lifecycle (SDLC).
5. Security testing includes code review, penetration testing, and employing static code analysis tools on a periodic basis to identify flaws.
6. All changes to software on the Mimecast DMARC Analyzer Service are via a controlled, approved release mechanism within a formal change control program. 
7. Where the customer opts to have a DMARC Analyzer forensic report stored at Mimecast, the data is protected via a PGP Key where the customer retains the private key.

 

8. Availability 

Objective: 

To ensure Customer Data is protected from accidental destruction or loss, and there is timely access, restoration or availability to Customer Data in the event of a Mimecast DMARC Analyzer Service incident.

1. The Mimecast DMARC Analyzer Service is housed in Amazon’s Dublin region.
2. Mimecast maintains a robust Business Continuity/Disaster Recovery program including

• Well defined updated plans.
• Regular Testing and retrospectives.  

 

9. Data Separation

Objective:

To ensure each Customer’s Data is processed separately.

Measures:

1. Mimecast uses logical separation within its multi-tenant architecture to enforce data segregation between customers.
2. In each step of the processing, Customer Data received from different Customers is assigned a unique identifier so data is always physically or logically separated. 

 

10. Incident Management

Objective

In the event of any security breach of Customer Data, the effect of the breach is minimized and the Customer is promptly informed.

Measures:

1. Mimecast maintains an up-to-date incident response plan that includes responsibilities, how information security events are assessed and classified as incidents and response plans and procedures.
2. Mimecast regularly tests its incident response plan with “table-top” exercises and learns from tests and potential incidents to improve the plan. 
3. In the event of a security breach, Mimecast will notify Customers without undue delay after becoming aware of the security breach.

 

11. Audit

Objective

To ensure Mimecast regularly tests, assesses and evaluates the effectiveness of the technical and organizational measures outlined above.

Measures:

1. Mimecast conducts regular internal and external audits of its security practices.
2. Mimecast ensures that Personnel are aware of and comply with the technical and organizational measures set forth in this document.

---

To subscribe to notifications for changes to this and other data privacy related pages, please click here and subscribe to the “Trust Center Updates” feed.