Information Security Policy
Global has developed and maintains policies and procedures to insure information security over five broad areas within our environment:
A. Confidentiality
B. Physical Security
C. Electronic Security
D. Communication Security
E. Portable Electronic Storage Devices
The following is an overview of our information security principles and areas of emphasis. Each of the following broad areas has multiple, detailed procedures for insuring the information security.
Information Policy Fundamentals:
A. Confidentiality
Access to confidential consumer information is limited to those who have a legitimate need to know the information. Those with a legitimate need to have consumer information are Vendors, Clients, Employees and Consumers.
Vendors, Clients and Employees are vetted, only provided/granted access/information necessary to their legitimate needs and then contractually bound to keep all information confidential. Consumers are vetted before information is disclosed.
Employees are prohibited from “browsing” files or databases without a business justification and Employees’ contracts set forth such a prohibition so that they are bound contractually to the same.
We maintain records on each request for information and identify each user who requests information on a consumer.
Destruction of consumer information follows the Federal Trade Commission’s requirement that the information be unreadable upon disposal.
B. Physical Security
Access to our computer terminals, file cabinets, fax machines, trash bins, desktops, etc. are secure from unauthorized access. Our offices are securely locked and monitored by an alarm system. Authorized visitors to our facility are checked in and monitored.
C. Electronic Security
We maintain a secure network to safeguard consumer information from internal and external threats. Our backup data is maintained in an encrypted form. Access by users over the internet requires a confidential user name and a strong password.
D. Communication Security
All Consumer Information transmitted using our computer network, including email, is secured using a minimum of 128-bit SSL encryption. No Consumer Information is sent over the internet that is not encrypted or secured with a minimum of 128-bit SSL encryption. This includes the body of emails or attachments. Access by users over the internet requires a confidential user name and strong password.
Other means of communication i.e., fax and mail have specialized procedures to insure communication security.
E. Portable Electronic Storage Devices
With the exception of secure transport of backup materials to an approved, vetted storage facility, employees are contractually prohibited from storing any consumer information outside the premises on any portable electronic storage device or media.