BW Events - Event Technology Consulting
Solutions For Hybrid, Digital & In-Person Events
1. Purpose
BW Events LLC must restrict access to confidential and sensitive data to protect the organization data from being lost or compromised in order to avoid negatively impacting our clients and partners, incurring penalties for non-compliance and suffering damage to our reputation (and the reputation of our trusted partners). At the same time, we must ensure users can access data as required for them to work effectively.
It is not anticipated that this policy can eliminate all malicious data theft. Rather, its primary objective is to increase user awareness and avoid accidental loss scenarios, so it outlines the requirements for data breach prevention.
This policy also outlines remediation plans in the event of a breach in process.
It is not anticipated that this policy can eliminate all malicious data theft. Rather, its primary objective is to increase user awareness and avoid accidental loss scenarios, so it outlines the requirements for data breach prevention.
This policy also outlines remediation plans in the event of a breach in process.
2. Scope
2.1 In Scope
This data security policy applies all customer data, personal data and other company data defined as sensitive by the company’s data classification policy. Therefore, it applies to every server, database and IT system that handles such data, including any device that is regularly used for email, web access or other work-related tasks. Every user who interacts with company IT services is also subject to this policy.
2.2 Out Of Scope
Information that is classified as Public is not subject to this policy. Other data can be excluded from the policy by company management based on specific business needs, such as that protecting the data is too costly or too complex.
3. Policy
3.1 Principles
BW Events LLC shall provide all employees and contracted third parties with access to the information they need to carry out their responsibilities as effectively and efficiently as possible. Part of this access includes these principles and trainings outlined in this policy.
3.2 General
a. Each user shall be identified by a unique user ID so that individuals can be held accountable for their actions.
b. The use of shared identities is permitted only where they are suitable, such as training accounts or service accounts.
c. Each user shall read this data security policy and the login and logoff guidelines, and sign a statement that they understand the conditions of access.
d. Records of user access may be used to provide evidence for security incident investigations.
e. Access shall be granted based on the principle of least privilege, which means that each program and user will be granted the fewest privileges necessary to complete their tasks.
b. The use of shared identities is permitted only where they are suitable, such as training accounts or service accounts.
c. Each user shall read this data security policy and the login and logoff guidelines, and sign a statement that they understand the conditions of access.
d. Records of user access may be used to provide evidence for security incident investigations.
e. Access shall be granted based on the principle of least privilege, which means that each program and user will be granted the fewest privileges necessary to complete their tasks.
3.3 Access Control Authorization
Access to company IT resources and services will be given through the provision of a unique user account and complex password. Accounts are provided by the IT department based on records in the HR department.
Passwords are managed by the IT Service Desk. Requirements for password length, complexity and expiration are stated in the company password policy.
Role-based access control (RBAC) will be used to secure access to all file-based resources in Active Directory domains.
Passwords are managed by the IT Service Desk. Requirements for password length, complexity and expiration are stated in the company password policy.
Role-based access control (RBAC) will be used to secure access to all file-based resources in Active Directory domains.
3.4 Network Access
a. All employees and contractors shall be given network access in accordance with business access control procedures and the least-privilege principle.
b. All staff and contractors who have remote access to company networks shall be authenticated using the VPN authentication mechanism only.
c. Segregation of networks shall be implemented as recommended by the company’s network security re- search. Network administrators shall group together information services, users and information systems as appropriate to achieve the required segregation.
d. Network routing controls shall be implemented to support the access control policy.
b. All staff and contractors who have remote access to company networks shall be authenticated using the VPN authentication mechanism only.
c. Segregation of networks shall be implemented as recommended by the company’s network security re- search. Network administrators shall group together information services, users and information systems as appropriate to achieve the required segregation.
d. Network routing controls shall be implemented to support the access control policy.
3.5 User Responsibilities
a. All users must lock their screens whenever they leave their desks to reduce the risk of unauthorized access.
b. All users must keep their workplace clear of any sensitive or confidential information when they leave.
c. All users must keep their passwords confidential and not share them.
b. All users must keep their workplace clear of any sensitive or confidential information when they leave.
c. All users must keep their passwords confidential and not share them.
3.6 Application and Information Access
a. All company staff and contractors shall be granted access to the data and applications required for their job roles.
b. All company staff and contractors shall access sensitive data and systems only if there is a business need to do so and they have approval from higher management.
c. Sensitive systems shall be physically or logically isolated in order to restrict access to authorized personnel only.
b. All company staff and contractors shall access sensitive data and systems only if there is a business need to do so and they have approval from higher management.
c. Sensitive systems shall be physically or logically isolated in order to restrict access to authorized personnel only.
3.7 Access to Confidential or Restricted information
a. Access to data classified as ‘Confidential’ or ‘Restricted’ shall be limited to authorized persons whose job responsibilities require it, as determined by the Data Security Policy or higher management.
b. The responsibility to implement access restrictions lies with the IT Security department at [email protected]
b. The responsibility to implement access restrictions lies with the IT Security department at [email protected]
4. Technical Guidelines
The technical guidelines specify all requirements for technical controls used to grant access to data. Here is an example:
Access control methods to be used shall include:
a. Auditing of attempts to log on to any device on the company network
b. Windows permissions to files and folders
c. Role-based access model
d. Server access rights
e. Firewall permissions
f. Network zone and VLAN ACLs
g. Web authentication rights
h. Database access rights and ACLs
i. Encryption at rest and in flight
j. Network segregation
Access control applies to all networks, servers, workstations, laptops, mobile devices, web applications and websites, cloud storages, and services.
Access control methods to be used shall include:
a. Auditing of attempts to log on to any device on the company network
b. Windows permissions to files and folders
c. Role-based access model
d. Server access rights
e. Firewall permissions
f. Network zone and VLAN ACLs
g. Web authentication rights
h. Database access rights and ACLs
i. Encryption at rest and in flight
j. Network segregation
Access control applies to all networks, servers, workstations, laptops, mobile devices, web applications and websites, cloud storages, and services.
5. Reporting Requirements
This section describes the requirements for reporting incidents that happen.
a. Daily incident reports shall be produced and handled by the IT Security department or the incident response team.
b. Weekly reports detailing all incidents shall be produced by the IT Security department and sent to the IT manager or director.
c. High-priority incidents discovered by the IT Security department shall be immediately escalated; the IT manager should be contacted as soon as possible.
d. The IT Security department shall also produce a monthly report showing the number of IT security incidents and the percentage that were resolved.
a. Daily incident reports shall be produced and handled by the IT Security department or the incident response team.
b. Weekly reports detailing all incidents shall be produced by the IT Security department and sent to the IT manager or director.
c. High-priority incidents discovered by the IT Security department shall be immediately escalated; the IT manager should be contacted as soon as possible.
d. The IT Security department shall also produce a monthly report showing the number of IT security incidents and the percentage that were resolved.
6. Ownership and Responsibilities Definitions
Data owners are employees who have primary responsibility for maintaining information that they own, such as an executive, department manager or team leader.
Information Security Administrator is an employee designated by the IT management who provides administrative support for the implementation, oversight and coordination of security procedures and sys- tems with respect to specific information resources.
Users include everyone who has access to information resources, such as employees, trustees, contractors, consultants, temporary employees and volunteers.
The Incident Response Team shall be chaired by an executive and include employees from depart- ments such as IT Infrastructure, IT Application Security, Legal, Financial Services and Human Resources.
Information Security Administrator is an employee designated by the IT management who provides administrative support for the implementation, oversight and coordination of security procedures and sys- tems with respect to specific information resources.
Users include everyone who has access to information resources, such as employees, trustees, contractors, consultants, temporary employees and volunteers.
The Incident Response Team shall be chaired by an executive and include employees from depart- ments such as IT Infrastructure, IT Application Security, Legal, Financial Services and Human Resources.
7. Enforcement
Any user found in violation of this policy is subject to disciplinary action, up to and including termination of em- ployment. Any third-party partner or contractor found in violation may have their network connection terminated.
8. Data Retention
Unless otherwise specified by client, and where applicable, data retention will last only 24 hours after the conclusion of the scope. No data should be permitted on BW servers at any time unless otherwise required by client.
9. Related Documents
This section lists all documents related to the policy and provides links to them. This list might include:
a. Data Classification Policy
b. Password Policy
c. Incident Response Policy
a. Data Classification Policy
b. Password Policy
c. Incident Response Policy
10. Revision History
Version Date of Revision Author Description of Changes
3.0 June 12, 2020 Brandon Wernli, BW Events LLC
