Laatst bijgewerkt - 14 november 2019
Dit document beschrijft de toepasselijke technische en organisatorische beveiligings- en beheermaatregelen die Mimecast heeft geïmplementeerd om de gegevens te beschermen die klanten ons toevertrouwen als onderdeel van de Mimecast DMARC-services.
Within this document, the following definitions apply:
- 'Klant' verwijst naar elke abonnee van de Mimecast AT-service.
- 'Mimecast DMARC-service' verwijst naar de Software-as-a-Service die door Mimecast aan onze klanten wordt geleverd.
- 'Klantgegevens' verwijst naar alle informatie die door de klant wordt aangeleverd of verzonden en door de Mimecast DMARC-service wordt verwerkt;
- “Personal Data” means any information relating to an identified or identifiable natural person.
- “Personnel” means Mimecast employees and authorized individual contractors/vendors.
1. Organization of Information Security
Objective:
To outline Mimecast’s information security structure.
Measures:
- Mimecast employs full-time dedicated trained/certified security Personnel responsible for information security.
- The information security function reports directly to the Mimecast senior leadership team.
- Mimecast has a comprehensive set of information security policies, approved by senior management and disseminated to all Personnel.
- All Mimecast Personnel have signed legally reviewed confidentiality agreements.
- Alle werknemers van Mimecast worden getraind in informatiebeveiliging.
2. Beheersysteem informatiebeveiliging
Objective:
To demonstrate Mimecast’s commitment to manage the assessment and treatment of these risks and to continually improve its information security.
Measures:
- Mimecast has deployed an ISMS (Information Security Management System) that serves as the foundation of our information security practices.
3. Physical Access
Objective:
To protect the physical assets that contain Customer Data.
Measures:
- De Mimecast DMARC-dienst bevindt zich in de cloudomgeving van Amazon. De beschrijving van de fysieke beveiligingsmaatregelen van Amazon voor het datacentrum zijn te vinden op: https://aws.amazon.com/compliance/data-center/controls/
4. Systeemtoegang
Objective:
To ensure systems containing Customer Data are used only by approved, authenticated users.
Measures:
- Access to Mimecast systems is granted only to Mimecast Personnel and/or to permitted employees of Mimecast’s subcontractors and access is strictly limited as required for those persons to fulfil their function.
- All users access Mimecast systems with a unique identifier (UID).
- Mimecast has established a password policy that prohibits the sharing of passwords and requires passwords to be changed on a regular basis and default passwords to be altered. All passwords must fulfil defined minimum complexity requirements and are stored in encrypted form.
- Mimecast has a comprehensive process to deactivate users and their access when Personnel leaves the company or a function.
- All access or attempted access to systems is logged and monitored.
5. Data Access
Objective:
To ensure Personnel entitled to use systems gain access only to the Customer Data that they are authorized to access.
Measures:
- Mimecast heeft vanzelfsprekend geen toegang tot gegevens van klanten;
- Mimecast restricts Personnel access to Customer Data on a "need-to-know” basis based on this justification.
- Each such access and its subsequent operations are logged and monitored.
- Personnel training covers access rights to and general guidelines on definition and use of Customer Data.
6. Transmissie/opslag/vernietiging van gegevens
Objective:
To ensure Customer Data is not read, copied, altered or deleted by unauthorized parties during transfer/storage.
Measures:
- De toegang van klanten tot de portals van de Mimecast DMARC-dienst zijn beschermd door middel van de meest actuele versie van Transport Layer Security (TLS);
- De Mimecast DMARC-dienst is gebaseerd op de mechanismen voor het vernietigen van media in Amazon Cloud. Een overzicht van deze mechanismen is te vinden op: https://aws.amazon.com/compliance/data-center/controls/
7. Confidentiality and Integrity
Objective:
To ensure Customer Data remains confidential throughout processing and remains intact, complete and current during processing activities.
Measures:
- Mimecast has a formal background check process and carries out background checks on all new Personnel.
- Mimecast trains its engineering Personnel in application security practices and secure coding practices.
- Mimecast has a central, secured repository of product source code, which is accessible only to authorized Personnel.
- Mimecast beschikt over een formeel programma voor applicatiebeveiliging en maakt gebruik van een robuuste Secure Development Lifecycle (SDLC).
- Security testing includes code review, penetration testing, and employing static code analysis tools on a periodic basis to identify flaws.
- Alle wijzigingen in de software van de Mimecast DMARC-dienst vinden plaats via een gecontroleerd en goedgekeurd mechanisme en binnen een officieel programma voor wijzigingsbeheer.
- Wanneer de klant een DMARC forensisch rapport opslaat in Mimecast, worden de gegevens beschermd via een PGP-sleutel waarvan de klant over de privésleutel beschikt.
8. Availability
Objective:
Om ervoor te zorgen dat klantgegevens worden beschermd tegen onbedoelde vernietiging of onbedoeld verlies en dat klantgegevens tijdig toegankelijk zijn, worden hersteld of beschikbaar zijn als er sprake is van een incident met de Mimecast DMARC-service.
- De Mimecast DMARC-service is gehuisvest in de regio Dublin van Amazon.
- Mimecast maintains a robust Business Continuity/Disaster Recovery program including
- Well defined updated plans.
- Regular Testing and retrospectives.
9. Data Separation
Objective:
To ensure each Customer’s Data is processed separately.
Measures:
- Mimecast gebruikt logische scheiding binnen de multitenant-architectuur om scheiding van gegevens tussen klanten af te dwingen.
- In each step of the processing, Customer Data received from different Customers is assigned a unique identifier so data is always physically or logically separated.
10. Incident Management
Objective
In the event of any security breach of Customer Data, the effect of the breach is minimized and the Customer is promptly informed.
Measures:
- Mimecast maintains an up-to-date incident response plan that includes responsibilities, how information security events are assessed and classified as incidents and response plans and procedures.
- Mimecast regularly tests its incident response plan with “table-top” exercises and learns from tests and potential incidents to improve the plan.
- In the event of a security breach, Mimecast will notify Customers without undue delay after becoming aware of the security breach.
11. Audit
Objective
To ensure Mimecast regularly tests, assesses and evaluates the effectiveness of the technical and organizational measures outlined above.
Maatregelen omvatten:
- Mimecast voert regelmatig interne en externe audits uit voor de beveiligingsmethoden.
- Mimecast ensures that Personnel are aware of and comply with the technical and organizational measures set forth in this document.
U kunt zich abonneren op meldingen voor wijzigingen op deze en andere, aan de AVG gerelateerde pagina's door hier te klikken en u te abonneren op de feed 'Trust Center Updates'.
