At SupportPay we prioritize the security of your data and take a proactive approach to protecting sensitive information across all systems and operations. We have developed a robust security framework that integrates risk management, compliance, and best-in-class technologies to safeguard against evolving threats.

Our security measures are designed to ensure confidentiality, integrity, and availability of your data, whether it’s being transmitted, stored, or processed. By adhering to industry-leading standards and regulatory requirements, we maintain a secure environment that fosters trust and reliability.

The following sections outline the comprehensive security policies and practices we have in place to protect your information, including encryption, access control, network security, incident management, and much more. Each area of our security program has been developed with meticulous care, ensuring that every possible risk is addressed and mitigated.

At SupportPay, your security is our priority.

Asset Management Program:

We have an asset management program that has been approved by management, communicated to all relevant constituents, and assigned an owner responsible for maintenance and regular review.

Maturity: 4 – In place with exclusions.

• D.1.1 Asset Inventory List:

An asset inventory list or Configuration Management Database (CMDB) is maintained to track all assets within the organization.

Maturity: 4 – In place with exclusions.

• D.2 Acceptable Use Policy:

A formal acceptable use policy governs the use of information and associated assets. This policy is approved by management, communicated to appropriate constituents, and assigned an owner for ongoing maintenance and periodic reviews.

Maturity: 4 – In place with exclusions.

• D.3 Asset Return Process:

We have a well-defined process to verify the return of constituent assets (e.g., computers, cell phones, access cards) upon termination or role change.

Maturity: 5 – In place with no exclusions.

• D.5 Information Classification:

Information is classified according to legal and regulatory requirements, business value, and the sensitivity to unauthorized disclosure or modification.

Maturity: 3 – Partially in place with plans to enhance.

• D.5.3 Information Asset Ownership:

Each information asset is assigned an owner responsible for its oversight and maintenance.

Maturity: 4 – In place with exclusions.

• D.5.3.2 Periodic Access Review:

Asset owners are responsible for approving and periodically reviewing access to information assets to ensure proper control.

Maturity: 5 – In place with no exclusions.

• D.5.4 Information Handling Policy:

We have a policy for information handling, covering storage, processing, and communication. This policy is approved by management, communicated to all relevant constituents, and assigned an owner for maintenance.

Maturity: 4 – In place with exclusions.

• D.5.4.2 Encryption Requirements:

The information handling policy includes encryption requirements for data during storage and transmission.

Maturity: 5 – In place with no exclusions.

• D.5.4.3 Storage Requirements:

Storage requirements, including the authorized use of Public Cloud storage, are clearly defined.

Maturity: 5 – In place with no exclusions.

• D.5.4.4 Electronic Transmission Security:

The policy includes security requirements for electronic transmission, such as email, web, and file transfer services.

Maturity: 5 – In place with no exclusions.

• D.5.4.5 Removable Media Requirements:

Requirements for handling removable media (e.g., thumb drives, DVDs) are outlined in the policy.

Maturity: 4 – In place with exclusions.

• D.5.5 Data Retention and Destruction:

We have a data retention and destruction policy, covering live media, backup/archived media, and data managed by subcontractors.

Maturity: 5 – In place with no exclusions.

• D.6 Scoped Data via Physical Media:

Scoped data is occasionally sent or received via physical media as needed.

Maturity: 5 – In place with no exclusions.

• D.7 Scoped Data via Electronic Means:

Scoped data is primarily sent or received electronically.

Maturity: 5 – In place with no exclusions.

• D.7.2 Encryption of Electronic Data:

All scoped data sent or received electronically is encrypted in transit while outside the network.

Maturity: 5 – In place with no exclusions.

• D.7.6 Protection Against Malicious Code:

Data sent or received electronically is protected by virus scanning and network virus inspection at the endpoint.

Maturity: 5 – In place with no exclusions.

• D.7.7 Phishing Prevention:

Incoming and outgoing emails undergo phishing prevention scans to mitigate potential threats.

Maturity: 5 – In place with no exclusions.

• D.7.9 Cloud-Based Public Sharing:

We take necessary precautions when storing or transferring data via cloud-based public sharing solutions.

Maturity: 5 – In place with no exclusions.

• D.8 Confidential Scoped Data Storage:

Confidential and regulated scoped data is stored electronically following security protocols.

Maturity: 5 – In place with no exclusions.

Security Program and Management

• Physical Security Program: Our physical security program is formally approved by management. It is communicated to all relevant parties, and a designated owner is responsible for its ongoing maintenance and review.
  • Status: Fully implemented with no exclusions.

2. Physical Security Controls

• Secured Facilities: We have implemented robust physical security controls for all our secured facilities, including data centers and office buildings.

  • Status: Fully implemented with no exclusions.

• Electronic Access Controls: Our physical security controls feature an electronic access system, such as key cards, tokens, fobs, or biometric readers.

  • Status: Fully implemented with no exclusions.

• Entry and Exit Monitoring: All entry and exit doors are equipped with alarms for forced entry and propped-open scenarios, and are monitored by security personnel.

  • Status: Fully implemented with no exclusions.

• Access Restrictions and Logs: Access to our facilities is restricted to authorized personnel only, and we maintain detailed logs of all access activities.

  • Status: Fully implemented with no exclusions.

• Documentation of Procedures: Our procedures for physical access controls are thoroughly documented to ensure clarity and consistency.

  • Status: Fully implemented with no exclusions.

• Reporting of Lost or Stolen Access: We require immediate reporting of any lost or stolen access cards or keys to maintain security integrity.

  • Status: Fully implemented with no exclusions.

3. Environmental Controls

• Protective Measures: We have established environmental controls within our secured facilities to protect computers and other physical assets. This includes comprehensive fire detection and suppression systems.
  • Status: Fully implemented with no exclusions.

4. Visitor Access

• Visitor Policy: We have a clear policy regarding visitor access to our facilities to ensure security is maintained at all times.
  • Status: Fully implemented with no exclusions.

5. Data Center

• • Data Center Location: Our scoped systems and data are securely housed within a dedicated data center, ensuring optimal security and reliability.
    • Status: Fully implemented with no exclusions.

Business Resiliency

1. Business Resiliency Program

• Established Program: The organization has a Business Resiliency Program in place that has been approved by management, communicated to relevant parties, and maintained with an assigned owner responsible for its review.
  • Status: Fully implemented with no exclusions.

5. Business Continuity Procedures

• Documented Continuity Procedures: Formal business continuity procedures have been developed and documented to ensure critical operations can continue during disruptive events.
  • Status: Fully implemented with no exclusions.

6. Senior Management Responsibility

• Assigned Responsibility: Senior management has assigned responsibility for managing critical response and recovery efforts.
  • Status: Fully implemented with no exclusions.

7. Periodic Review

• Annual Review: The business resiliency procedures are reviewed at least annually to ensure they remain effective and up to date.
  • Status: Fully implemented with no exclusions.

8. Critical Third-Party Dependencies

• Third-Party Dependencies: There are dependencies on critical third-party service providers, which are taken into account in the resiliency planning.
  • Status: Fully implemented with no exclusions.

10. IT Disaster Recovery

• Documented IT Disaster Recovery Program: A formal, documented IT disaster recovery exercise and testing program is in place to ensure readiness in the event of an IT disruption.
  • Status: Fully implemented with no exclusions.

19. Backups of Scoped Systems and Data

• • Backup Process: Backups of scoped systems and data are regularly performed to ensure data integrity.

    • Status: Fully implemented with no exclusions.

  • Backup Policy: There is a formal policy or process for backing up production data.

    • Status: Fully implemented with no exclusions.

  • Backup Integrity Testing: Backup integrity and restoration procedures are tested at least annually to ensure they function as intended.

    • Status: Fully implemented with no exclusions.

  • Backup Error Review: Backup and replication errors are reviewed and resolved as required to ensure data availability and integrity.

    • Status: Fully implemented with no exclusions.

  • Offsite Backup Storage: Scoped data is backed up and stored offsite to mitigate the risk of data loss in case of a disaster.

    • Status: Fully implemented with no exclusions.

  • Backup Security: Backups containing scoped data are stored in an environment with security controls equivalent to those of the production environment, ensuring the data is protected.

    • Status: Fully implemented with no exclusions.

Compliance

1. Policies and Procedures for Compliance

• Compliance Policies: The organization has policies and procedures in place to ensure compliance with applicable legislative, regulatory, and contractual requirements.
  • Status: Fully implemented with no exclusions.

1.1. Regulatory Change Process

• Process for Regulatory Changes: A documented process exists to identify and assess regulatory changes that could significantly impact product and service delivery.
  • Status: Fully implemented with no exclusions.

3. Internal Audit/Risk Management

• Internal Oversight Unit: The organization has an internal audit, risk management, or compliance department responsible for assessing, identifying, and tracking the resolution of outstanding regulatory issues.

  • Status: Fully implemented with no exclusions.

• 3.1. Audit Independence: The audit function operates independently from the lines of business.

  • Status: Fully implemented with no exclusions.

• 3.3. Compliance Audits: Audits are regularly performed to ensure compliance with statutory, regulatory, contractual, or industry requirements.

  • Status: Fully implemented with no exclusions.

4. Records Management and Reporting

• Records and Reporting: A set of policies and procedures exists for managing required records and ensuring compliance with reporting obligations.

  • Status: Fully implemented with no exclusions.

• 4.2. Reporting Compliance: Internal management and external reporting to government agencies are maintained in accordance with applicable law.

  • Status: Fully implemented with no exclusions.

11.3. Employee Training

• Annual Compliance Training: Employees undergo annual training on non-disclosure of insider information, code of conduct, conflicts of interest, and compliance and ethics responsibilities.
  • Status: Fully implemented with no exclusions.

14. Call Center Services

• Call Center Involvement: The engagement will include call center-related services.
  • Status: Fully implemented with no exclusions.

16. Marketing Activities

• Marketing to Client’s Customers: Marketing or selling activities are conducted directly to the client’s customers.
  • Status: Fully implemented with no exclusions.

17. Collections Activities

• Collections Services: Collections activities are conducted directly with the client’s customers.
  • Status: Fully implemented with no exclusions.

18.2. Terms of Sale Online

• Online Sale Procedures: Procedures for the terms of sale, dispute resolution, and returns are available online.
  • Status: Fully implemented with no exclusions.

19. Client Interactions

• Direct Client Interactions: There are direct interactions with the client’s customers.
  • Status: Fully implemented with no exclusions.

20. Cybersecurity Obligations

• Cybersecurity Policies: Documented policies and procedures enforce applicable legal, regulatory, and contractual cybersecurity obligations.
  • Status: Fully implemented with no exclusions.

23. Client Audits and Assessments

• Client Audits: Client audits and/or risk assessments are permitted.

  • Status: Fully implemented with no exclusions.

• 23.4. Evidence of Internal Controls: Internal controls are available during client assessments.

  • Status: Fully implemented with no exclusions.

• 23.5. Control Validation: Controls are validated by independent, third-party auditors or information security professionals.

  • Status: Fully implemented with no exclusions.

25. Fraud Detection and Prevention

• Fraud Compliance Program: A compliance program with policies and procedures exists to address internal and external fraud detection and prevention.
  • Status: Fully implemented with no exclusions.

32. Account Activity and Transactions

• Account Maintenance: Accounts are opened, financial transactions are initiated, and account maintenance activities are conducted through electronic, telephonic, written, or in-person requests.

  • Status: Fully implemented with no exclusions.

• 32.1. Payment Compliance: Policies and procedures are in place to address payments compliance in delivering products or services as required by regulation.

  • Status: Fully implemented with no exclusions.

• 32.3. E-Commerce Systems: Electronic commerce websites or applications are used to transmit, process, or store scoped systems and data.

  • Status: Fully implemented with no exclusions.

• 32.3.2. Transaction Data Protection: All transaction details, including payment card info and parties involved in transactions, are prohibited from being stored in the Internet-facing DMZ.

  • Status: Fully implemented with no exclusions.

34. Sanctioned Country Restrictions

• • Restricted Activities: Policies and procedures are in place to restrict activities or transactions involving sanctioned countries (e.g., country blocking).

    • Status: Fully implemented with no exclusions.

  • 34.10. Sanctions Compliance Checks: Compliance and sanctions checks (e.g., Office of Foreign Assets Control – OFAC) are performed on customers, suppliers, and third parties.

    • Status: Fully implemented with no exclusions.

  • 34.11. Sanctions Compliance Program: A sanctions compliance program with policies and procedures exists to meet obligations related to Office of Foreign Assets Control (OFAC) requirements.

    • Status: Fully implemented with no exclusions.

END USER DEVICE SECURITY

End User Devices (Desktops, Laptops, Tablets, Smartphones) Usage

Scoped Data on End User Devices:
Are end-user devices used to transmit, process, or store scoped data?
Status: Yes if employees use these devices for work that involves sensitive data.

1.1. Security Configuration Standards

Security Configuration Documentation:
Are there documented security configuration standards for end-user devices?
Status: Yes if there are policies in place, such as encryption, password complexity, etc.

1.16. Activity Alerts for Infections and Suspicious Activity

Review of Alerts:
Are alerts reviewed and actioned at least weekly for uncleaned infections and suspicious activity?
Status: Yes if regular monitoring or antivirus solutions are implemented.

1.17. Anti-virus System Checks

Anti-virus Procedures:
Are there defined procedures to identify and correct systems without antivirus?
Status: Yes if the organization uses tools to regularly verify antivirus installations.

1.22. Mobile Device Usage

Mobile Device Use:
Are employees allowed to use mobile devices in your environment?
Status: Yes if employees can access company networks or apps on mobile.

1.22.5. Access to Corporate Email on Mobile Devices

Corporate Email Access:
Can employees access corporate email on mobile devices?
Status: Yes if email is accessible via smartphones or tablets.

1.23. Mobile Device Management Program

Mobile Device Management:
Is there a formal mobile device management program in place?
Status: Yes if the company uses tools like MDM (Mobile Device Management) software.

Personal Computers (PCs) Usage

PCs and Scoped Data:
Are personal computers (PCs) used to handle scoped data?
Status: Yes if PCs are used for tasks involving sensitive data.

2.3. Non-Company Managed PCs

External PCs Accessing Company Network:
Are non-company PCs allowed to connect to the company network?
Status: No if this is prohibited for security reasons.

NETWORK SECURITY 

1.1. Approval Process for Network Devices

• Network Device Approval:
  Is there an approval process prior to installing a network device?
  Status: Yes if devices are approved before being added to the network.

2. Security and Hardening Standards

   • Network Device Standards:
     Are there security and hardening standards for network devices, including Firewalls, Switches, Routers, and Wireless Access Points (baseline configuration, patching, passwords, Access control)?
     Status: Yes if standards are defined and followed.

2.1. Administrative Interfaces

• Interface Configuration:
  Are all network device administrative interfaces configured to require authentication and encryption?
  Status: Yes if these interfaces are secured with authentication and encryption.

2.2. Default Passwords

• Default Password Handling:
  Are default passwords changed or disabled prior to placing network devices into production?
  Status: Yes if default passwords are managed properly.

3. Network Device Logs

   • Log Detail:
     Is there sufficient detail contained in network device logs to support incident investigation?
     Status: Yes if logs contain adequate information for investigations.

4. Security Patches

   • Patch Application:
     Are all available high-risk security patches applied and verified on network devices?
     Status: Yes if high-risk patches are consistently applied.

5. Network Segmentation

   • Network Segmentation:
     Are network technologies used to isolate critical and sensitive systems into network segments separate from those with less sensitive systems?
     Status: Yes if segmentation is in place.

5.11. External Network Connections

• Firewall Termination:
  Is every connection to an external network terminated at a firewall (e.g., the Internet, partner networks)?
  Status: Yes if all external connections are secured by firewalls.

6.1. Access Control

• Default Access Denial:
  Do network devices deny all access by default?
  Status: Yes if default access is restricted.

6.2. Firewall Rules

• Firewall Rules:
  Do the firewalls have any rules that permit ‘any’ network, subnetwork, host, protocol, or port on any of the firewalls (internal or external)?
  Status: No if firewall rules are restrictive and specific.

7. Remote Access Policy

   • Remote Access Policy:
     Is there a policy that defines the requirement for remote access from external networks to networks containing scoped systems and data that has been approved by management and communicated to constituents?
     Status: Yes if a policy for remote access exists and is communicated.

7.3. Encrypted Communications for Remote Access

• Encryption Requirement:
  Are encrypted communications required for all remote network connections from external networks containing scoped systems and data?
  Status: Yes if encryption is mandated for remote connections.

9. Remote Administration

   • Remote Administration Security:
     Is remote administration of organizational assets approved, logged, and performed in a manner that prevents unauthorized access?
     Status: Yes if remote administration is controlled and logged.

9.2. Encryption for Remote System Access

• Encryption Requirement:
  Are encrypted communications required for all remote system access?
  Status: Yes if encryption is required.

10. Baseboard Management Controllers (BMCs)

• BMC Usage:
  Are Baseboard Management Controllers (BMCs) enabled on any servers or other devices?
  Status: No if BMCs are not enabled.

11. Network Intrusion Detection

• Intrusion Detection Capabilities:
  Are Network Intrusion Detection capabilities employed?
  Status: Yes if intrusion detection systems are in use.

12. DMZ Environment

• DMZ Environment:
  Is there a DMZ environment within the network that transmits, processes, or stores scoped systems and data?
  Status: Yes if a DMZ is in place for handling scoped data.

13. Wireless Networking Devices

Network Security Policy

• Network Security Policy:
  Is there a policy that defines network security requirements that is approved by management, communicated to constituents, and has an owner to maintain and review?
  Status: Yes if such a policy exists and is properly managed.

• • Wireless Devices in Network:
    Are wireless networking devices connected to networks containing scoped systems and data?
    Status: No if wireless devices are not connected to sensitive networks

Software, Firmware, and BIOS Updates

• • • Automatic Updates Delivery:
      Do you deliver software, firmware, and/or BIOS updates to clients through automatic downloads (e.g., Windows Update, LiveUpdate)?
      Status: Yes if updates are delivered through automatic mechanisms.

      THREAT MANAGEMENT (P)

      1. Windows Servers Usage

         • Scoped Services:
           Are Windows servers used as part of the Scoped Services?
           Status: Yes if Windows servers are part of the scoped services.

      2. Vulnerability Management Policy

         • Vulnerability Management Policy:
           Is there a Vulnerability Management Policy or Program that has been approved by management, communicated to appropriate constituents, and has an owner assigned to maintain and review the policy?
           Status: Yes if a formal policy or program is in place.

      2.4. Internal Network Vulnerability Scans

      • Internal Scans:
        Are network vulnerability scans performed against internal networks and systems?
        Status: Yes if regular scans are conducted for internal networks.

      2.5. Internet-Facing Network Vulnerability Scans

      • Internet-Facing Scans:
        Are network vulnerability scans performed against internet-facing networks and systems?
        Status: Yes if scans are conducted for internet-facing networks.

      2.5.1. Frequency of Vulnerability Scans

      • Scan Frequency:
        Do network vulnerability scans occur at least monthly?
        Status: Yes if scans are performed on a monthly basis.

SERVER SECURITY

1. Servers Handling Scoped Data

   • Scoped Data Usage:
     Are servers used for transmitting, processing, or storing scoped data?
     Status: Yes if servers are involved with handling scoped data.

1.1. Server Security Configuration Standards

• Documentation and Guidance:
  Are server security configuration standards documented and based on external industry or vendor guidance?
  Status: Yes if standards are documented and follow industry or vendor guidelines.

1.1.2. Security Configuration Reviews

• Regular Reviews:
  Are server security configuration reviews performed regularly to validate compliance with documented standards?
  Status: Yes if reviews are conducted on a regular basis.

1.2. Server Build Process

• Configuration During Build:
  Are all servers configured according to security standards as part of the build process?
  Status: Yes if servers are set up following security standards during the build phase.

1.2.1. Unnecessary Services

• Service Management:
  Are all unnecessary/unused services uninstalled or disabled on all servers?
  Status: Yes if unused services are managed appropriately.

1.2.5. Vendor Default Passwords

• Default Passwords:
  Are vendor default passwords removed, disabled, or changed prior to placing any device or system into production?
  Status: Yes if default passwords are handled before production use.

1.3. Logging for Incident Investigation

• Log Detail:
  Is sufficient detail contained in operating system and application logs to support security incident investigations (at minimum, successful and failed login attempts, and changes to sensitive configuration settings and files)?
  Status: Yes if logs contain necessary details for investigations.

1.5. Regular Patching

• System and Application Patching:
  Are all systems and applications patched regularly?
  Status: Yes if regular patching is performed.

1.5.8. Outdated Operating System Versions

• No Longer Supported OS:
  Are there any Operating System versions in use within the Scoped Services that no longer have patches released? If yes, please describe in the Additional Information section.
  Status: No if all OS versions in use are still supported with patches.

1.6. Unix or Linux Usage

• Unix/Linux Use:
  Is Unix or Linux used as part of the scoped services?
  Status: Yes if Unix or Linux systems are part of the services.

1.6.1. Root Access

• Root Access Requirements:
  Are users required to ‘su’ or ‘sudo’ into root?
  Status: Yes if root access requires these commands.

1.7. AS/400 Usage

• AS/400 Systems:
  Are AS/400s used as part of the scoped services?
  Status: No if AS/400 systems are not used.

1.8. Mainframes Usage

• Mainframes:
  Are Mainframes used as part of the scoped services?
  Status: No if Mainframes are not used.

1.9. Hypervisors Usage

• Hypervisors:
  Are Hypervisors used to manage systems used to transmit, process, or store scoped data?
  Status: Yes if Hypervisors are utilized for managing these systems.

1.10. Containers Usage

• • Containers:
    Are Containers used to process or store scoped data (e.g., Docker, Kubernetes, OpenShift)?
    Status: Yes if Containers are employed for handling scoped data.

CLOUD HOSTING

1. Cloud Hosting Services

   • IaaS Provision:
     Are Cloud Hosting services (IaaS) provided?
     Status: Yes if Infrastructure as a Service (IaaS) is part of the offerings.

2. Subcontracting of Cloud Services

   • Subcontracting:
     Are Cloud Hosting services subcontracted?
     Status: No if these services are not subcontracted.

3. Backup Image Snapshots

   • Authorization for Snapshots:
     Is there a management-approved process to ensure that backup image snapshots containing scoped data are authorized by the outsourcer prior to being snapped?
     Status: Yes if there is a formal process in place for authorization.

3.1. Backup Storage Security

• Security Controls for Backup:
  Are backup image snapshots containing scoped data stored in an environment where the security controls protecting them are commensurate with the production environment?
  Status: Yes if backups are stored with equivalent security controls as production.

5. Hardened Virtual Images

   • Base Virtual Images:
     Are default hardened base virtual images applied to virtualized operating systems?
     Status: Yes if hardened images are used to ensure security.

6. Independent Audit Reports

   • Audit Reports:
     Does the Cloud Hosting Provider provide independent audit reports for their cloud hosting services (e.g., Service Operational Control – SOC)?
     Status: Yes if SOC or similar audit reports are provided.

6.2. Certification by Third Parties

• • Compliance Certification:
    Is the Cloud Service Provider certified by an independent third party for compliance with domestic or international control standards (e.g., National Institute of Standards and Technology – NIST, International Organization for Standardization – ISO)?
    Status: Yes if the provider has relevant certifications.