Information Security Policy

1. General Use and Ownership
2. Users should be aware that the data they create, for personal or business use, on the corporate network, remains the Company’s property.  Because of the need to protect the Company’s network, management cannot guarantee the confidentiality of information stored on or transmitted through any network device belonging to the Company.
3. Any information that you consider sensitive or vulnerable should be encrypted.
4. For security and network maintenance purposes, authorized individuals within the Company may monitor equipment, systems and network traffic at any time.
5. The Company reserves the right to audit networks and systems on a periodic basis to ensure compliance with this policy and these guidelines.
6. Consumer information offered by or through the Company must be used appropriately and for specific purposes.  Users will not obtain any credit or other consumer information on themselves or their associates, or any other person except in the exercise of their official duties.
7. Our subscribers can only use credit reports for the specific following conditions:
8. As a factor in establishing a consumer’s eligibility for a new or continued credit;
9. Collection of an account;
10. Insurance (for underwriting purposes ONLY);
11. To determine the eligibility for government license or benefit;
12. Employment purposes;
13. In connection with a legitimate business transaction involving the consumer.
14. The Company will ensure that its subscribers have a “permissible purpose” under the FCRA before ordering consumer report information.  A permissible purpose includes the following:
15. The subscriber intends to use the information as a potential investor, servicer, or current insurer in connection with a valuation of, or assessment of, the credit or prepayment risks.
16. The subscriber has a legitimate business need in connection with a business transaction that is initiated by the consumer.
17. The subscriber intends to use the information in connection with written instructions of the consumer to whom it relates.
18. The subscriber intends to use the information in connection with a collection transaction involving the consumer for the collection of an account of the consumer.
19. The subscriber intends to use the information in response to an agency administering a state plan under Section 454 of the Social Security Act (42 U.S.C. 654) for use to set an initial or modified child support awarded.
20. The subscriber intends to use the information in accordance with written instructions of the consumer through a reseller.
21. The subscriber intends to use the information in response to a request by the head of a state or local child support enforcement agency (or a state or local government official authorized by the head of such an agency) that has met all requirements of Section 604(a) (4) (A, B, C, D).
22. The subscriber intends to use the information in connection with a credit transaction involving the consumer and for the extension of credit or review or collection of an account of the consumer.
23. The subscriber intends to use the information in connection with employment purposes.
24. The subscriber intends to use the information in connection with a determination of eligibility for a license or other benefit granted by a governmental instrument required by law to consider financial responsibility or status.
25. The subscriber intends to use the information in connection with the underwriting of insurance.
26. The subscriber intends to use the information in connection with the review of existing policy holders for insurance underwriting purposes.
27. The subscriber intends to use the information in connection with a legitimate business need to review an account to determine whether the consumer continues to meet the terms of the account.
28. The subscriber intends to use the information in response to the order of a court having jurisdiction or a subpoena issued by a federal grand jury.
29. The subscriber intends to use the information in connection with a tenant screen application involving the consumer.
30. The information will be used by a governmental agency pursuant to FCRA Section 608.
31. The subscriber intends to use the information to protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability.
32. The subscriber intends to use the information for required institutional risk control or for resolving consumer disputes or inquiries.
33. The subscriber intends to use the information in connection with holding a legal or beneficial interest relating to the consumer.
34. The subscriber intends to use the information for law enforcement agencies or for an investigation on a matter related to public safety.
35. The subscriber intends to effect, administer, or enforce a transaction to underwrite insurance at the consumer’s request, for reinsurance purposes or for the following purposes related to the consumer’s insurance:  account administration, reporting, investigating, fraud prevention, premium payment processing, claim processing, benefit administration or research projects.
36. The subscriber intends to use the information in connection with persons acting in a fiduciary or representative capacity on behalf of, and with the consent of, the consumer.
37. The subscriber intends to use the information as necessary to effect, administer, or enforce a transaction requested or authorized by the consumer, including location for collection of a delinquent note.
38. The subscriber intends to use the information in conjunction with access to a commercial file on a sole proprietorship.
39. The subscriber intends to use the information in conjunction with access to a commercial file on a corporation, where specific consumer consent is given.
40. The subscriber intends to use the information in conjunction with a credit transaction involving the extension of credit to, or review or collection of an account of, the consumer, where the medical information to be furnished is relevant to process or effect the transaction, and specific consumer consent was provided for the furnishing of the consumer report that describes the use of the consumer report that describes the use of which the medical information will be furnished.
41. The subscriber intends to use the information in conjunction for employment purposes, where the medical information to be furnished is relevant to process or effect the transaction, and specific consumer consent was provided for the furnishing of the consumer report that describes the use for which the medical information will be furnished.
42. The subscriber intends to use the information in connection with the underwriting of insurance and specific consumer consent was given for the release of the medical information contained within the consumer report.
43. Security of Information
44. All devices connecting to the company’s network must comply with all appropriate policies and standards.
45. The user must take all necessary steps to prevent unauthorized access to the Company’s data, as well as to any personally identifiable or other sensitive information related to consumers or credit histories, or otherwise contained in any of the company’s products or services.
46. All passwords must be kept secure and may not be shared.  Accounts may not be shared.  Authorized users are responsible for the security of their passwords and accounts.  System level passwords and user level passwords must be changed every ninety days.
47. All PCs, laptops and workstations must be secured with a password-protected screensaver with the automatic activation feature set at 10 minutes or less, or by logging off when the device will be unattended.
48. Use of encryption must comply with the requirements of this policy and these Guidelines.
49. Every user assigned a company asset is responsible for ensuring the protection of that equipment while in their possession.  This includes the use of computer lockdown cables and other security devices.  Laptops left at the company overnight must be properly secured or placed in a locked drawer or cabinet.  All theft of the Company’s assets must be promptly reported to the company.
50. All paper files containing sensitive or personally identifiable information shall be kept secure and not left on a desk or in an open file cabinet or drawer while unattended.  All such paper files and documents left at the company overnight must be properly secured or placed in a locked drawer or cabinet.  They shall not be left on desks overnight unless the desk is located in a room that can be securely locked.  Sensitive information such as credit histories, Social Security numbers, drivers’ license numbers or similar information shall always be placed in a locked drawer or cabinet and shall never be left on desks overnight.
51. All devise used by the user that are connected to the Company’s network must use the most up-to-date anti-virus and anti-spyware software.
52. Users must use extreme caution when opening e-mail attachments received from unknown senders, which may contain viruses, e-mail bombs, or Trojan horse code.
53. Users may not load personal or unapproved software or other applications to any device connected to the Company’s network. Only software or applications approved and purchased by the company may be loaded on any device attached to the Company’s network.
54. Security of Information Systems

The following activities are, in general, prohibited.  Users may be exempted from these restrictions during the course of their legitimate job responsibilities (e.g., systems administrative staff may have needed to disable the network access of a device if that device is disrupting production services).

Under no circumstances is a user of the Company authorized to engage in any activity which is illegal under local, state, federal or international law while utilizing company-owned resources.

The lists below are by no means exhaustive, but attempt to provide a framework for activities which fall into the category of unacceptable use.

The following activities are strictly prohibited:

1. Violations of the rights of any person or company protected by copyright, trade secret, patent or other intellectual property, or similar laws or regulations, including, but not limited to, the installation or distribution of “pirated” or other software products that are not appropriately licensed or owned by the company.
2. Unauthorized duplication of copyrighted material.
3. Intentional introduction of malicious programs into the network or server (e.g., viruses, worms, Trojan horses, e-mail bombs, etc.)
4. Revealing your account password to others or allowing the use of your account by others.  This includes family and other household members when work is being conducted at home.
5. Effecting security breaches or disruptions of network communications.  Security breaches include, but are not limited to, accessing data of which the user is not an intended recipient or logging into a server or account that the user is not expressly authorized to access, unless these duties are within the scope of regular duties approved by the company.  For purposes of this section, “disruption” includes, but is not limited to, network sniffing, pinged floods, packet spoofing, denial of service, and forged routing information for malicious purposes.
6. Port scanning or security scanning is expressly prohibited unless prior notification is given to the Company.
7. Executing any form of network monitoring which will intercept data not intended for the user’s device, unless this activity is a part of the user’s normal job/duty.
8. Circumventing user authentication or security of any device, network or account.
9. Escalating privileges or in any way circumventing the authorization restrictions imposed by a system.
10. Escalating privileges or in any way circumventing access restrictions that you have been given by the Company by an authorized individual.
11. Interfering with or denying service to any user other than the user’s device (for example, denial of service attack).
12. Using any program/script/command, or sending messages of any kind, with the intent to interfere with, or disable, a user’s terminal session, via any means, locally or via the Internet / Intranet / Extranet.
13. Providing information about, or lists of, the Company’s customers or subscribers to any parties outside the Company unless approved by the Company.
14. Providing consumer data, credit history information or other sensitive data to anyone outside the Company unless that party is an authorized customer or subscriber of the Company.
15. Interfering with, attempting to bypass, or disabling network and device security systems.
16. Accessing consumer data, credit histories or other sensitive information for personal purposes of any kind. This prohibition includes accessing your own personal consumer data or information or that related to an individual such as a friend, family member or acquaintance, or any other individual, for other than specifically permitted purposes authorized by the Company.
17. Continuing to use passwords or Company equipment or other devices connected to the Company network for any purpose after your access has been revoked or your employment with the Company has been terminated.