Key Company Policy #1
Global Information Security Policy Summary

The Company is committed to ensuring the confidentiality, integrity and availability of the information assets developed by or entrusted to it. Information assets may include electronic and written information that is stored, transmitted or maintained in any form. The Company has established an InformationSecurity policy and program to ensure the protection of the Company’s information assets.

Key Company Policy #2
Acceptable Use Summary

Employees should never use company supplied technologies such as Internet access, email or telephone access in a way that would be construed as inappropriate, unlawful or unprofessional. Users of company-supplied technologies should have no expectations of privacy. Users are responsible for the security of their user IDs, passwords and other security measures and/or devices and all actions taken under their user IDs. Detailed Acceptable Use Policy should be reviewed.

Key Company Policy #3
Access Management Overview

Protecting the confidentiality, integrity and availability of information about employees, guests and clients is critical to the Company’s mission. Access privilege to information is limited to the minimum information that employees need to know in order to perform their specific job functions.

Key Company Policy #4
Data Classification Overview

There are four classification levels for data (listed in least sensitive to most sensitive order): Public (Level 1) - Company Private (Level 2) – Company Restricted (Level 3) - Vital Trust (Level 4) Vital Trust data (Level 4) is the most sensitive information. This information includes: Credit card Security numbers Passport numbers Driver’s license numbers Bank Account numbers Vital Trust data must never be transmitted electronically via email or stored in a computer system without being encrypted. Vital Trust data must be securely stored under lock and key and shredded when in paper form.

Key Company Policy #5
Software Licensing and Duplication Restrictions Policy Overview

All software installed or used on Company Information Systems, including all desktop and laptop computers, must be lawfully acquired through license, internal or contractor development, or other lawful means.

Key Company Policy #6
‍Technical Information Security Overview

The Company has a technical security program which ensures the confidentiality, integrity, and availability of the Company’s data on information systems and other technologies. The Company has established and continues to maintain an incident response process. This process includes the timely reporting of security incidents and weaknesses, vulnerabilities, and procedures to maintain the Company’s ability to promptly respond to threats to technologies that store, transmit, or protect Company information assets.

Key Company Policy #7
Physical IT Environment Security Overview

The Company strives to maintain a security environment that appropriately safeguards Company information assets and technology systems from unauthorized access and use. This security environment includes physical and operational controls over information technology assets at all Company offices and where applicable on hosted services.

Key Company Policy #1Global Information Security Policy Summary

Key Company Policy #2 Acceptable Use Summary

Key Company Policy #3Access Management Overview

Key Company Policy #4Data Classification Overview

Key Company Policy #5Software Licensing and Duplication Restrictions Policy Overview

Key Company Policy #6‍Technical Information Security Overview

Key Company Policy #7Physical IT Environment Security Overview