External Risk Mitigation: Protecting PII from Security Threats

Network Protection Policy

1. Firewall and Software Security

• Firewalls, operating system security patches, and all relevant software must be up to date on any device accessing the firm’s network, including third-party devices.

• Anti-virus, anti-malware, and internet security software must be current and installed on all systems storing or processing PII.

2. Secure User Authentication

• Implement secure protocols for user authentication, including:

• Username ID and password management.

• Two-Factor Authentication (2FA) for enhanced security.

• Strong password requirements, such as a mix of upper and lower-case letters, numbers, and special characters, with a minimum length of 8 characters.

• Mandatory password changes every 90 days or sooner if necessary.

• Exclusive use of firm-related passwords, separate from personal credentials.

3. Monitoring and Logging

• Continuous monitoring for unauthorized access to PII.

• Event logging enabled on all systems containing PII, with logs reviewed randomly within 90-day intervals by the Data Security Coordinator (DSC) or IT partner.

4. Firewall Management

• Maintain a secured firewall between the internet and the internal network, updated per vendor recommendations. Software-based firewalls must also be enabled on workstations.

5. Operating System Updates

• Continuously review and install OS patches and security updates. A thorough security review will be conducted every 30 days by the DSC.

User Access Control Policy

Ongoing

Done

N/A

Firm

Data Security Coordinator

Date

1. Two-Factor Authentication (2FA)

• All remote logins require 2FA, using tools like Google Authenticator or Duo.

2. Unique User Passwords

• No shared passwords are permitted for accessing the network, software, or other systems. Users can change their passwords without disclosing them to others.

3. Regular Password Refresh

• Passwords must be updated at least every 90 days, with accelerated updates as warranted.

4. Password Management Tools

• If password utilities like LastPass are used, the DSC ensures:

• Secure, encrypted storage of credentials.

• 2FA for new device authentication.

Electronic Exchange of PII Policy

Ongoing

Done

N/A

Firm

Data Security Coordinator

Date

1. Secure Data Transmission

• PII must not be shared via email in unprotected formats. Encryption or password protection is mandatory. Passwords should be shared through separate channels, such as SMS or phone calls.

2. Password-Protected Portals

• Secure portals may be used for PII exchange with DSC approval.

3. Device Encryption

• Tools like MS BitLocker must encrypt files on external drives, including USB devices.

Wi-Fi Access Policy

Ongoing

Done

N/A

Firm

Data Security Coordinator

Date

1. Secure Wireless Networks

• Firm Wi-Fi must use strong encryption and require a password. Guest Wi-Fi must operate on a separate network.

2. Securing Smart Devices

• Default passwords for devices like printers, smart TVs, and other IoT equipment must be changed. Devices without this capability must be disabled or replaced.

Remote Access Policy

Ongoing

Done

N/A

Firm

Data Security Coordinator

Date

• Remote access tools must encrypt both traffic and authentication credentials.

• Remote access is prohibited during unmonitored hours, such as nights and weekends.

• 2FA is mandatory for all remote access sessions.

• The DSC and IT contractor must approve all remote access tools.

Connected Devices Policy

Ongoing

Done

N/A

Firm

Data Security Coordinator

Date

1. Device Security Reviews

• Any new devices connecting to the network must undergo a security review, ensuring compliance with login and security patch standards.

2. AutoRun Features

• Disable AutoRun for USB and optical drives to prevent unauthorized installations.

3. Data Disposal

• Hard drives and memory devices must be erased or destroyed when decommissioned to ensure no residual data remains.

4. Anti-Virus Protection

• Approved, licensed anti-virus software must be updated continuously. Weekly tests will confirm the system’s protection is current.

Information Security Training Policy

Ongoing

Done

N/A

Firm

Data Security Coordinator

Date

• Employees will receive annual training on the firm’s security protocols for PII, covering both paper and electronic records.

• New employees must complete training before accessing PII.

• Refresher courses and reviews will ensure all employees adhere to security standards.

• Non-compliance with these policies may result in disciplinary action.

External Risk Mitigation

Ongoing

Done

N/A

Firm

Data Security Coordinator

Date