# Casa Compliance Center Casa is committed to ensuring the confidentiality, integrity, and availability of your data. Here is how we protect information and comply with industry best practices. [View Monitors](https://compliance.casa.io/#monitoring-dcbeffd6-3438-4ccc-b026-74f6a31921e6) ## Resources ### Subprocessors List Request ### Privacy Policy Visit ### Terms of Service Visit ### SOC2 Type 2 Report Request ## Monitoring Continuously monitored by Secureframe ### Change Management - Segregation of Environments - Change Management Policy - Secure Development Policy ### Availability - High Availability Configuration - Testing the Business Continuity and Disaster Recovery Plan - Automated Backup Process ### Organizational Management - Acceptable Use Policy - Disciplinary Action - Internal Control Policy ### Confidentiality - Retention of Customer Data - Access to Customer Data is Restricted - Disposal of Customer Data ### Vulnerability Management - Vulnerability and Patch Management Policy - Third-Party Penetration Test ### Incident Response - Tracking a Security Incident - Incident Response Plan Testing - Incident Response Plan ### Risk Assessment - Risk Assessment - Vendor Risk Management Policy - Risk Assessment and Treatment Policy ### Network Security - Endpoint Security - Logging and Monitoring for Threats - Automated Alerting for Security Events ### Access Security - Removal of Access - Encryption-in-Transit - User Access Reviews ### Physical Security - Physical Security Policy # Monitoring ## Change Management Segregation of Environments - Development, staging, and production environments are segregated. Change Management Policy - A Change Management Policy governs the documenting, tracking, testing, and approving of system, network, security, and infrastructure changes. Secure Development Policy - A Secure Development Policy defines the requirements for secure software and system development and maintenance. Configuration and Asset Management Policy - A Configuration and Asset Management Policy governs configurations for new sensitive systems. Baseline Configurations - Baseline configurations and codebases for production infrastructure, systems, and applications are securely managed. Production Data Use is Restricted - Production data is not used in the development and testing environments unless required for debugging customer issues. ## Availability High Availability Configuration - The system is configured for high availability to support continuous availability, when applicable. Testing the Business Continuity and Disaster Recovery Plan - The Business Continuity and Disaster Recovery Plan is periodically tested via tabletop exercises or equivalents. When necessary, Management makes changes based on the test results. Automated Backup Process - Full backups are performed and retained in accordance with the Business Continuity and Disaster Recovery Policy. ## Organizational Management Acceptable Use Policy - An Acceptable Use Policy defines standards for appropriate and secure use of company hardware and electronic systems. Disciplinary Action - Personnel who violate information security policies are subject to disciplinary action and such action is documented in one or more policies. Internal Control Policy - An Internal Control Policy identifies how a system of controls should be maintained to safeguard assets. Information Security Policy - An Information Security Policy establishes security requirements. Information Security Program Review - Management is responsible for the design, implementation, and management of the security policies and procedures. Organizational Chart - Management maintains a formal organizational chart to clearly identify positions of authority. Performance Reviews - Internal personnel are evaluated via formal performance reviews at least annually. Background Checks - Background checks or their equivalent are performed before or promptly after a new hire's start date. New Hire Screening - Hiring managers screen new hires or internal transfers to assess their qualifications. Advisor Meetings on Security - Senior management meets at least annually to review business goals and risk management activities. Cybersecurity Insurance - Cybersecurity insurance has been procured to help minimize the financial impact of loss events. Independent Advisor - The board includes senior management and external advisors who are independent from the company's operations. Roles and Responsibilities - Information security roles and responsibilities are outlined for personnel responsible for security, availability, and confidentiality. Performance Review Policy - A Performance Review Policy provides context and transparency into performance processes. Personnel Acknowledge Security Policies - Internal personnel review and accept applicable information security policies annually. Code of Conduct - A Code of Conduct outlines ethical expectations and ramifications of noncompliance. ## Confidentiality Retention of Customer Data - Procedures are in place to retain customer data based on requirements or policies. Access to Customer Data is Restricted - Access to, erasure of, or destruction of customer data is restricted to personnel that need access. Disposal of Customer Data - Upon customer request, Company requires that data no longer needed is removed in accordance with requirements. Data Retention and Disposal Policy - A Data Retention and Disposal Policy specifies how customer data is to be retained and disposed of based on compliance requirements. Data Classification Policy - A Data Classification Policy details the security and handling protocols for sensitive data. ## Vulnerability Management Vulnerability and Patch Management Policy - A Vulnerability Management Policy outlines processes to efficiently respond to identified vulnerabilities. Third-Party Penetration Test - A 3rd party is engaged to conduct a penetration test of the production environment at least annually. ## Incident Response Tracking a Security Incident - Identified incidents are documented, tracked, and analyzed. Incident Response Plan Testing - The Incident Response Plan is periodically tested via tabletop exercises. Incident Response Plan - An Incident Response Plan outlines the process of identifying and tracking confirmed incidents. Lessons Learned - After any incident has been resolved, management provides a "Lessons Learned" document to the team. ## Risk Assessment Risk Assessment - Formal risk assessments are performed, identifying threats related to security, availability, and confidentiality. Vendor Risk Management Policy - A Vendor Risk Management Policy defines a framework for vendor relationship management. Risk Assessment and Treatment Policy - A Risk Assessment and Treatment Policy governs the process for conducting risk assessments. Risk Register - A risk register is maintained to record the risk mitigation strategies for identified risks. ## Network Security Endpoint Security - Company endpoints are managed with a strong password policy, anti-virus, and hard drive encryption. Logging and Monitoring for Threats - Logging and monitoring software is used to collect data from infrastructure to detect security threats. Automated Alerting for Security Events - Alerting software is used to notify teams of potential security events. Restricted Port Configurations - Configurations ensure networking ports, protocols, services, and environments are restricted as necessary. Network Security Policy - A Network Security Policy identifies requirements for protecting information and systems. Network Traffic Monitoring - Security tools are implemented for monitoring network traffic to the production environment. ## Access Security Removal of Access - Upon termination or when personnel no longer require access, system access is removed. Encryption-in-Transit - Service data transmitted over the internet is encrypted-in-transit. User Access Reviews - System owners conduct scheduled user access reviews of production servers and applications. Administrative Access is Restricted - Administrative access is restricted based on the principle of least privilege. Encryption and Key Management Policy - An Encryption and Key Management Policy supports secure encryption of app secrets. Access Control and Termination Policy - An Access Control and Termination Policy governs access to applicable systems. Access to Product is Restricted - Non-console access is restricted to users with a unique SSH key. Asset Inventory - A list of system assets and respective owners is maintained and reviewed at least annually. Encryption-at-Rest - Service data is encrypted-at-rest. Unique Access IDs - Personnel are assigned unique IDs to access sensitive systems. Least Privilege in Use - Users are provisioned access to systems based on the principle of least privilege. Complex Passwords - Personnel are required to use strong, complex passwords and a second form of authentication. ## Physical Security Physical Security Policy - A Physical Security Policy that details physical security requirements for the company facilities is in place. ## Communications Terms of Service - Terms of Service are published to external users. Privacy Policy - A Privacy Policy details the company's privacy commitments. Communication of Security Commitments - Security commitments are communicated to both internal personnel and external users. Communication of Critical Information - Critical information is communicated to external parties, as applicable. Description of Services - Descriptions of the company's services and systems are available to both internal personnel and external users. Confidential Reporting Channel - A confidential reporting channel is made available for reporting security concerns.