KnowledgeXpert identifies vulnerabilities on the KnowledgeXpert platform through the execution of regular vulnerability scans.

KnowledgeXpert tracks all vulnerabilities and remediates them as per the policy and procedure defined to manage vulnerabilities.

KnowledgeXpert ensures logical access that is no longer required in the event of termination is made inaccessible in a timely manner.

KnowledgeXpert has set up cryptographic mechanisms to encrypt all production databases that store customer data at rest.

KnowledgeXpert backs up relevant user and system data regularly to meet recovery time and recovery point objectives and verifies the integrity of these backups.

KnowledgeXpert tests backup information periodically to verify media reliability and information integrity.

KnowledgeXpert ensures that the production databases access and Secure Shell access to infrastructure entities are protected from public internet access.

Every production host is protected by a firewall with a deny-by-default rule. Deny by default rule set is a default on KnowledgeXpert’s cloud provider.

KnowledgeXpert has set up processes to utilize standard encryption methods, including HTTPS with the TLS algorithm, to keep transmitted data confidential.

KnowledgeXpert has set up methods to continuously monitor critical assets to generate capacity alerts to ensure optimal performance, meet future capacity requirements, and protect against denial-of-service attacks.

KnowledgeXpert’s infrastructure is configured to generate audit events for actions of interest related to security for all critical systems.

KnowledgeXpert displays the most current information about its services on its website, which is accessible to its customers.

Where applicable, KnowledgeXpert ensures that endpoints with access to critical servers or data must be protected by malware-protection software.

KnowledgeXpert has set up measures to perform security and privacy compliance checks on the software versions and patches of remote devices prior to the establishment of the internal connection.

KnowledgeXpert has a documented policy to define behavioral standards and acceptable business conduct.

KnowledgeXpert has established procedures to perform security risk screening of individuals before authorizing access.

KnowledgeXpert has established procedures for new staff to acknowledge applicable company policies as a part of their onboarding.

KnowledgeXpert provides information security and privacy training to staff that is relevant to their job function.

KnowledgeXpert requires that all employees in client serving, IT, Engineering, and Information Security roles are periodically evaluated regarding their job responsibilities.

KnowledgeXpert has established procedures for staff to acknowledge applicable company policies periodically.

KnowledgeXpert has provided information to employees, via various Information Security Policies and procedures, on how to report failures, incidents, concerns, or other complaints related to the services or systems provided by KnowledgeXpert in the event there are problems.

KnowledgeXpert has provided information to customers on how to report failures, incidents, concerns, or other complaints related to the services or systems provided by KnowledgeXpert in the event there are problems.

KnowledgeXpert performs a formal risk assessment exercise annually, as per documented guidelines and procedures, to identify threats that could impair systems’ security commitments and requirements.

Each risk is assessed and given a risk score in relation to the likelihood of it occurring and the potential impact on the security, availability, and confidentiality of the KnowledgeXpert platform. Risks are mapped to mitigating factors that address some or all of the risk.

KnowledgeXpert considers the potential for fraud when assessing risks. This is an entry in the risk matrix.

KnowledgeXpert performs a formal vendor risk assessment exercise annually to identify vendors that are critical to the systems’ security commitments and requirements.

KnowledgeXpert’s Senior Management assigns the role of Information Security Officer who is delegated to centrally manage, coordinate, develop, implement, and maintain an enterprise-wide cybersecurity and privacy program.

KnowledgeXpert uses Sprinto, a continuous monitoring system, to track and report the health of the information security program to the Information Security Officer and other stakeholders.

KnowledgeXpert’s Senior Management reviews and approves the state of the Information Security program including policies, standards, and procedures, at planned intervals or if significant changes occur to ensure their continuing suitability, adequacy, and effectiveness.

KnowledgeXpert’s Senior Management reviews and approves the Organizational Chart for all employees annually.

KnowledgeXpert’s Senior Management reviews and approves the “Risk Assessment Report” annually.

KnowledgeXpert’s Senior Management reviews and approves the “Vendor Risk Assessment Report” annually.

KnowledgeXpert reviews and evaluates all subservice organizations periodically, to ensure commitments to KnowledgeXpert’s customers can be met.

KnowledgeXpert ensures that appropriate remediation measures are in place when personal data is shared with vendors as a part of its processing activities.

KnowledgeXpert conducts Data Protection Impact Assessments periodically in order to assess the regulatory risks associated with the processing of personal data.

KnowledgeXpert appoints an EU Representative to serve as a point of contact between EU authorities, data subjects and the organization.

KnowledgeXpert has procedures to conduct regular tests and exercises that determine the effectiveness and the readiness to execute the contingency plan.

KnowledgeXpert appoints a Privacy Officer to assess and facilitate KnowledgeXpert’s compliance with relevant regulatory requirements.

KnowledgeXpert includes Privacy Act statements on forms that collect information that will be maintained in a Privacy Act system of records, or provides Privacy Act statements on separate forms that can be retained by individuals.

KnowledgeXpert has set up mechanisms to assign and manage asset ownership responsibilities and establish a common understanding of asset protection requirements.

KnowledgeXpert maintains a list of legal, statutory, and regulatory requirements relevant to information security.