# The Weather Company _Customers trust us with critical weather data that drives real decisions. We're committed to protecting the confidentiality, integrity, and availability of our systems through industry best practices, continuous monitoring, and strict security controls._ ## Controls ### Access Management | Control | | --- | | Access Provisioning
Access to internal assets is granted with the least privilege to accomplish assigned tasks and functions according to business requirements. | | Multi-factor Authentication (MFA) / Single-Sign On (SSO)
Access management is governed by SSO through an Identity Access Management (IAM) tool for Team Members (all employees, administrators, contractors, and any other users). MFA is required for both local and network access to privileged accounts. | | Access Revocation
Access for terminated employees is revoked within one business day of their termination. | | Physical Access
Physical security perimeters have been implemented to manage access to buildings, including restricted access to secure areas. | | Privileged Access
MFA is enabled for all accounts with privileged access in TWCo. Sensitive systems have access limited to managed workforce endpoints. | | Credential Management
TWCo Team Members must treat log in credentials as confidential information. New users are issued a temporary password for initial login and required to create a permanent password immediately upon signing in. MFA is enabled for all accounts with privileged access in TWCo. | ### Organizational Security | Control | | --- | | Information Security Program
TWCo establishes and maintains its Information Security Management System through a comprehensive set of foundational policies that address both security and system availability. A governance structure for information security within TWCo has been established and maintained to facilitate the communication of identified threats and risks to management. | | Information Security Policies
TWCo has implemented a formal written Acceptable Use Policy, Information Security Policy, Asset Management Policy, Incident Response Policy, Device Management Policy, People & Culture and Personnel Security Policy, Network and Cloud Security Policy, and Crisis Management Plan which collectively address the security and availability of the system and cover the escalation process for security breaches and other incidents. | | Information Security Team
An Information Security Team, made up of Governance, Risk, and Compliance (GRC) and Cybersecurity, has dedicated personnel responsible for monitoring and maintaining the security of the TWC environment. | | Security Awareness Program
New contractors and employees are required to complete the security awareness program within 30 days of their start date and requires completion annually. Additionally, TWCo pushes security initiatives through ongoing phishing simulations. | | Background Checks
New contractors and employees are subject to background checks prior to their start date. | ### Data Security | Control | | --- | | Encryption at Rest
TWCo employs encryption security controls to systems based on the sensitivity, as defined in the Data Classification and Handling Policy, of the information processed. Where encryption is required, systems utilize industry-standard, secure encryption protocols to protect data integrity and confidentiality. | | Encryption in Transit
TWCo enforces industry-standard cryptographic protocols to encrypt data in transit across public networks moving to and from production databases, commensurate with the sensitivity level defined in the Data Classification and Handling Policy. | | Back-ups
TWCo executes incremental backups of production data and environments at defined intervals dependent on criticality to minimize data loss, as governed by the Backup and Data Restoration Policy. | | Data Retention
TWCo has formal data retention standards to provide guidelines for retention of data for required periods of time. | | Cryptographic Keys
Cryptographic keys are used and maintained. | | Data Classification and Handling
TWCo classifies Data and Assets in accordance with legal requirements, sensitivity, and business criticality to ensure information receives the appropriate level of protection. Assets must be classified according to the highest classification of Data they store or process. | ### Network Security | Control | | --- | | Firewall & Edge Protection
TWCo's network devices (e.g. routers, switches, and firewalls) are deployed on all external access points to detect and prevent threats to our environment. | | Intrusion Detection/Prevention (IDS/IPS)
TWCo uses continuous monitoring tools to our network for early identification of potential security breaches, security threats, trends, and unusual system activity. | | Network Segmentation
A clear separation is maintained between production and non-production environments to ensure development or testing activities do not impact live systems. | | VPN & Secure Remote Access
Remote access to production environments are restricted through the use of VPNs. | ### Vulnerability Management | Control | | --- | | Vulnerability Scanning
Automated scans of domain servers, end-user devices, and supporting infrastructures occur on a set schedule to identify new and unknown vulnerabilities. Ad hoc scans will follow the discovery of new vulnerabilities which may affect the systems and applications that comprise the TWCo environment. | | Vulnerability Remediation
TWCo remediates identified vulnerabilities in accordance with our formal Vulnerability Management Policy. Remediation timelines are prioritized and executed based on the criticality and risk rating of each vulnerability. | | Endpoint Protection/Anti-Malware
TWCo protects corporate and production environments by deploying antivirus and Endpoint Detection and Response (EDR) solutions that utilize automated definition updates to proactively identify and mitigate malicious software threats. | | Penetration Testing
Annual penetration testing is conducted by an independent third party on critical systems and applications to identify and remediate vulnerabilities. | ### Change Management | Control | | --- | | Change Management Procedures
Approved change management procedures and processes are performed for all system changes. | | Emergency Changes
Emergency changes are identified, documented, and deployed according to established emergency procedures. | | Impact Assessment
The potential impacts of all proposed changes are assessed before approval and implementation. | | Approval and Authorization
All changes to production systems are formally approved and authorized by management prior to deployment. | | Testing
Changes are thoroughly tested in a non-production environment before being promoted to production. | | Change Implementation
Change implementation includes a back-out plan and communication to relevant stakeholders. | | Logical Separation
TWCo's development, testing, and production environments are logically separated to prevent unauthorized access and changes. This separation ensures that development activities do not impact the security, stability, or availability of production systems. | ### Incident Management | Control | | --- | | Incident Response Plan
TWCo maintains a formal Incident Response Plan that outlines procedures for detecting, responding to, and recovering from security incidents. | | Disaster Recovery Plans
Disaster Recovery Plans (DRPs) are maintained and tested annually for all critical products to ensure timely restoration of services in the event of a disruption. | | Post-Incident Review
Following a significant security incident, a post-incident review is conducted to identify root causes, evaluate the response, and implement lessons learned. | ### Asset Management | Control | | --- | | Asset Inventory
TWCo maintains and annually reviews a master list of network and system components with assigned asset owners. | | Asset Acceptable Use
TWCo requires that all Formal Acceptable Use and Asset Management Policies are acknowledged by personnel annually. | ### Log Management | Control | | --- | | Log Collection
TWCo utilizes a centralized logging solution to collect system/application logs monitored by our Managed Service Provider (MSP) to ensure rapid threat detection. | | Log Protection
In order to maintain strict data integrity, logs are protected from alteration with access restricted based on job function. | ### Third-Party/Vendor Risk Management | Control | | --- | | Vendor Security Assessments
At TWCo, all third party vendors are evaluated and monitored based on tier classification and criticality to ensure that they meet our strict security standards. | | Vendor Monitoring
TWCo evaluates and assesses continuous monitoring controls applied to third parties based on their risk ratings. | ### Secure Development Lifecycle | Control | | --- | | Baseline Configurations
Security baselines, golden images, and standard AMIs are used for TWCo's infrastructure builds to ensure a consistently secure environment. | | Configuration Monitoring
Before deployment, new server builds are tested by QA or Central Facilities to verify baseline application. | | Secure Software Development
All source code changes require peer reviews and comprehensive vulnerability checks prior to being merged into our codebase. | | Application Vulnerability Testing
All automated source code scannings and vulnerability assessments are strictly enforced to be performed prior to production releases. | ### Risk Assessment & Management | Control | | --- | | Annual Risk Assessment
TWCo conducts annual risk assessments to identify and evaluate potential threats, compliance requirements, and fraud risks. | | Risk Mitigation
Identified threats are formally evaluated and addressed with mitigation strategies documented and revised as needed. | ### Artificial Intelligence (AI) | Control | | --- | | AI Governance
An AI governance framework is established to oversee the development, deployment, and usage of AI systems, ensuring alignment with organizational values and address regulatory requirements. | | AI Acceptable Use
Clear guidelines and acceptable use policies are defined for employees and contractors utilizing AI tools, explicitly prohibiting the input of sensitive, confidential, or proprietary company data into public AI models. | | AI Data Privacy
AI systems are designed and operated in line with data privacy principles. Personal data is minimized and protected during model training and inference. | | Third-Party AI Risk
Third-party AI vendors and tools undergo security and privacy assessments to evaluate their data handling practices, model security, and compliance posture.