Exhibit 2 - Security Controls
RemotePC will implement the controls listed below, or equivalent controls, during the term of this DPA:
1. Access Controls. The Data Processor will implement suitable measures to prevent unauthorised persons from gaining access to data processing equipment. These measures will include:
- Access authorisation for employees and third parties
- Keycards and passes
- Restrictions on keys
- Requirements for third parties
- Identification of persons with authorised access
- Protection and restriction of entrances and exits
- Establishment of secure areas
- Building security (e.g. security alarm systems)
2. Access Control to Data. The Data Processor undertakes to ensure that people authorised to use the data processing systems access Customer Personal Data only within the scope and to the extent permitted by their respective access permissions or authorisation.
- Workstation locks
- User authorisation requirements
- Confidentiality obligations
- Controls for the destruction of data media
- Processes for the development and release of software
3. User Controls. The Data Processor will implement suitable measures to prevent unauthorised people from using its data processing systems, including to read, copy, alter or remove stored data or data media without authorisation. These measures will include:
- Access authorisation requirements
- Logging events and activities
- Dedicated workstations and/or users
- Authenticating authorised personnel
- Using encryption where the Processor considers it appropriate
- Controlling the removal of data media
- Securing areas where data media are stored
- Requiring strong passwords and periodic password changes
- Disabling inactive accounts within 60 days
- Requiring users to authenticate again to reactivate a terminal or session after more than 15 minutes of inactivity
- Authentication requirements for remote access