Technical Organizational Measures

1. Scope

1. These measures apply to all customer data processed by Vallem Security Groep in delivering the services in 1.2.
2. These are the services delivered by Vallem Security Groep. Vallem acts as a processor for the listed data types of each service.
   1. Security Awareness: Participant names and business emails, course and simulation telemetry.
   2. MDR/ITDR: Endpoint, identity, and network telemetry collected by the platform.
   3. Pentesting: Vulnerability findings, access credentials, environment data, and customer source code.
   4. Incident Response: Incident findings; breadth of scope varies per incident.
3. Vallem controls customer relationship management, service coordination and escalation.
4. Where this document conflicts with the SLA, the SLA takes precedence.

2. Governance

1. Privacy contact: Bjorn Overbeek, [email protected]
2. Personnel sign a non-disclosure agreement before access to customer data.
3. Personnel receive continuous phishing simulation through the same platform as Vallem’s security awareness service.

3. Access Control

1. Google Workspace is the sole identity provider.
2. SSO is used where supported for all platforms.
3. MFA is enforced on all accounts with SMS and telephone verification disabled.
4. External access is granted only to designated accounts and is removed at the ending of an engagement.
5. MDR console access is controlled within iTeam’s tenant and is subject to the access controls of iTeam.
6. Access is reviewed every six months.

4. Encryption

1. Full disk encryption is required on all desktop operating systems.
2. Native disk encryption with a passcode is required on all smartphones.
3. Data in transit is encrypted with TLS 1.2 or higher.
4. Email uses TLS whenever the other server supports it.
5. SaaS platforms encrypt data at rest.

5. Endpoints

1. SentinelOne Complete runs on all desktop operating systems.
2. The office WLAN uses WPA3 only with client isolation.
3. The office space is locked, alarmed, and monitored when unoccupied.
4. Data storage devices are sanitized as per NIST SP 800-88 before reuse or disposal.

6. Logging

1. SentinelOne Agent telemetry is retained for 14 days.
2. SentinelOne Identity events are retained for six months.
3. MDR console activity is logged within iTeam’s tenant.

7. Data

1. Only data required to deliver a service is processed.
2. Credentials for testing are exchanged through Google Drive and deleted at engagement closure.
3. Customer source code or access to source code is removed within 30 days after completion of the retest.
4. MDR telemetry is retained for 14 days.
5. ITDR telemetry is retained for 30 days.
6. All other customer data is retained for the duration of the customer relationship.
7. At the end of the relationship, customer data is destroyed or returned at the choice of the customer.

8. Subprocessors

1. Subprocessors are listed in the subprocessor register in the Vallem Trust Center.
2. Each subprocessor is bound by a DPA.

9. Incident Response

1. Vallem notifies the customer without undue delay and within 24 hours of becoming aware of an incident affecting their data.
2. Vallem systems are monitored by the same MDR service delivered to customers excluding customer-facing reporting.

10. Continuity

1. Customer data is stored on platforms with redundancy managed by providers.
2. The security awareness platform and main Vallem website run on two redundant servers and are backed up by their hosting provider.