Please describe your initial selection and risk assessment process for suppliers/ vendors.
SDL's procurement process requires new suppliers to undergo security risk assessment prior to onboarding. Suppliers are assigned a risk category according to a number of criteria including: criticality of the goods/services to be provided and sensitivity of information or facilities they access.
Does SDL have a vendor management program for security?
Yes, SDL's Global Vendor Security Management policy specifies the security requirements for third party suppliers
Describe how you identify and manage the information security vulnerabilities in your IT systems, including change management processes.
SDL carries out monthly vulnerability scanning of its public facing infrastructure. Weaknesses are risk assessed and appropriate mitigation applied in accordance with the Global Security Testing Policy. A member of the information security team sits on the Global IT Change Advisory Board to assess the security impact of proposed changes.
Describe how you secure applications through the system development lifecycle including how you develop and test changes to applications.
"SDL's Global Secure Software Development Lifecycle Policy specifies how products are to be developed securely. Security is featured as part of each development step from requirements gathering, design, implementation, verification, and release. Changes are tested prior to release. "
Do you use a tool to track incidents, changes and problems?
Yes, SDL uses both Service Centre and ServiceNow to track workflows from tickets being raised to assignment and resolution. SLAs are in place depending on the criticality of the incident/change or problem
Does SDL have an Acceptable Use Policy?
Yes. SDL has an IT Security and Acceptable Use Policy
What is the retention policy for customer data?
SDL will only retain customer data as long as it is necessary for the performance of the services and in any case as agreed in the Contract.
Is there an Asset Management process?
Yes, SDL has a dedicated Software and Asset Management (SAM) Team as well as utilising an asset tool called Lansweeper and Flexera on the SDL network. Lansweeper automatically detects and records items on the SDL corporate network including details such as owner, asset type, software installed, warranty and configuration, all assets have an assigned owner.
Is there a Patch Management process?
Yes, patches are applied to end points automatically utilizing a centralized patching application. Patching of the servers with updates performed at least annually. Typically this patching will be performed during the routine monthly maintenance window, Patches of other types (such as SQL, Antivirus) performed on ad-hoc when desired but should be tested on a Development or Staging system before Production, where such systems exist.
Is there a Change Management process?
Yes, change management roles and responsibilities are governed by the CAB process in which management are included as well as the relevant stakeholders including IT and any SDL system testers, any system changes are tested before implementation and/or deployment. Emergency changes are carried out in the same way as the standard change management process, ensuring the changes are logged, recorded, tested, agreed and implemented. Implementing change is the responsibility of release management, however the process at large is the responsibility of CAB.
Has SDL implemented a formalized approval process for logical access requests based on the principles of least privilege?
Yes, SDL has a Logical Access policy which specifies the processes to be used to manage logical access.
Is there a risk assessment program that has been approved by management, communicated to relevant employees and an owner appointed to maintain the program?
Yes, SDL's risk assessment program is owned by the SDL Executive and is communicated to relevant employees
Describe the key elements of the SDL security risk management program
SDL's security risk management program is outlined in the Global Security Risk Management policy. This contains the methodology to be used for the identification and management of security risks, including: Asset Identification; Impact Analysis; Risk Assessment; Identification and Application of Controls; and Monitoring of Control Effectiveness. Risks are assessed periodically or when a significant change occurs that could have an impact on the confidentiality, integrity or availability of SDL information or assets. Oversight and governance of the risk management processes is exercised by the Global Information Security Lead and Information Security Steering Committee as appropriate.
Does SDL consider Data Privacy?
Does SDL have ISO 27001 certification?
Yes, customers may view our ISO 27001 certification at www.sdl.com/security
Does SDL have SOC 2 type II attestation
Yes, SDL software hosted by SDL Cloud Operations is within the scope of our SOC 2 type II report. An executive summary of the report is available on request.
Is an established, published, and annually approved security program in place?
Yes. SDL's information security program is owned by the Chief Transformation Officer and is managed throughout the year by the executive level Information Security Steering Committee to ensure it continues to support business goals.
Does SDL have a dedicated information security owner and/or team responsible for information security?
Yes. SDL's Chief Transformation Officer is the executive sponsor for information security. Day to day responsibility for the management of SDL's information security management system and continued compliance with security requirements is vested in a small team led by SDL's Global Information Security Lead
Is there an information security policy which has been approved by management, communicated to all personnell?
Yes, SDL's information security policy is approved and signed by the executive sponsor for information security and sets out the high level security requirements which allow SDL to maintain and continually develop its information security management system.
Please list your information security policies. Are such policies reviewed and updated regularly, and accessible to all SDL personel?
"Our policies are reviewed at least annually. Internal documents may be viewed on site or remotely viewed by the client during an audit under NDA / MNDA.
ISP100 Global Information Security Policy
ISP101 Global Risk Management Policy (Internal)
ISP102 Global Security Testing Policy (Internal)
ISP103 Global Logical Access Policy (Internal)
ISP104 Business Continuity Policy (Internal)
ISP105 Global Classification & Handling Policy (Internal)
ISP106 Global Information Security Incident Management Policy (Internal)
ISP107 Global Physical Security Policy (Internal)
ISP109 Global IT System Policy: Last reviewed & approved (Internal)
ISP110 Global Cryptographic Controls Policy (Internal)
ISP111 Global vendor Security Management Policy (Internal)
ISP112 Global Secure Software Development Lifecycle Policy (Internal)
Our policies are published on the corporate Intranet and available to all SDL employees, policies are regularly communicated to SDL employees via mandatory security & privacy awareness and training. "
Does your organization carry cybersecurity insurance?
Does SDL have a security policy exceptions process and policy?
SDL is currently developing a Global Security Exceptions Policy. Part of this draft policy is a Policy Exception process involving a formal exception request and risk assessment prior to approval. It is anticipated this new policy will receive senior management approval in Q1 2020.
Is there a formal disciplinary procedure for staff who violate information security policies and procedures?
Yes, any non-compliance to our Information Security policies will be reviewed and investigated by the global Information Security team and subsequently passed on to management and the relevant HR team for further investigation and action as necessary. Sanctions depend on the severity of the incident and could result in disciplinary action up to and including dismissal.
Does SDL have a process to monitor changes in the regulatory requirements of relevant jurisdictions and adjust your security program to ensure compliance?
SDL's legal department monitors relevant legal and regulatory requirements which apply to SDL. Regulatory requirements pertaining to information security will be discussed between the head of the legal department and the global head of information security and changes to the security program made as appropriate.
Does SDL have a documented procedure for responding to requests for tenant data from governments or third parties?
Any such lawful requests would be handled by our legal team and would consider any contractual obligations and legal requirements.
Does SDL have an Information Security Incident Response policy and procedurewhich is published and communicated?
Yes, SDL's Global Information Security Incident Management Policy is published and accessible to all employees on the SDL intranet and includes but is not limited to: Monitoring and Preparation; Identification; Containment; Mitigation; Recovery; and Follow-up.
Does SDL have a process for incident response / data breach?
Does SDL have a process for identifying incidents and their common attack vectors along with detection mechanisms to detect incidents as they occur?
Yes, SDL's network supplier monitors traffic and provides alerts in the event of anomalous activity and SDL employs IDS/IPS in key areas of the network to detect and prevent intrusions. End points have appropriate prevention/detection software.
Is Information Security Awareness training conducted on a periodic basis for all employees and consultants
Yes. Information security awareness training is a fundamental part of the onboarding process for SDL personnel, contractors and freelancers. Thereafter, computer based information security training is delivered annually to all employees in a dedicated learning module. Additionally, information security awareness training is delivered as part of the yearly Code of Conduct training and through our 'Think Security' campaign at least every two months or more often if circumstances dictate.
Does SDL background check employees?
Yes. All new starters undergo identity and 'right to work' checks. Where required by their role in the organsiation or national obligations, further background checks can be carried out in accordance with the relevant laws.
Does SDL Background check Freelancers?
SDL's freelancers are not subject to background checks as standard. However, we do have a vendor agreement in place with our freelancers which includes minimum security measures and confidentiality and background screening of freelancers can be requested by customers as contractually agreed, subject to local laws.
Does SDL consider information security in the employee onboarding and termination process?
Yes, all new starters are required to complete mandatory information security awareness training and Code of Conduct training which also includes security elements. On termination employees are reminded of their post employment security responsibilities. All assets are recovered and accounts suspended pending review and deletion.
Does SDL have a process for data destruction and media sanitisation?
Yes, SDL's Global Classification and Handling policy covers the areas of data destruction and media sanitisation. Specific processes to implement the policy are owned and maintained by the respective technology owners.