1

All employees are required to review and formally accept the corporate Code of Conduct Policy.

2

All employees are required to review and formally accept the corporate Security Policy.

3

All employees and contractors are required to sign corporate confidentiality agreements.

4

Continuous audit monitoring process is in place to detect out-of-compliance conditions.

5

All material entities are subject to an annual Risk Assessment.

6

A compliance function is established within each critical entity.

7

A Data classification standard is established and required to be used throughout the company to identify and classify all components.

8

A Systems Development Methodology is utilized by all software development areas.

9

A workflow management system is deployed for all software changes.

10

All employees are required to attend corporate ethics training as part of the new hire process.

11

Employee transfer policy requires that all employee security access to corporate systems to be removed and establish security access using the new hire process.

12

An annual security access entitlement review is performed which includes all known security resource components.

13

Access requests to all security resource components are required to be processed through a formal security request handling process.

14

Data owners are defined for all sensitive resources within the company.

15

Job Descriptions are established for all corporate-wide job functions.

16

All external parties which host corporate data are required to have an annual independent assessment to ensure the effectiveness of their controls.

17

An Internal Audit function is established which review corporate adherence to corporate standards.

18

All employees and contractors are required to attend annual security awareness training.

19

An independent third party vendor performs quarterly vulnerability assessments of all external facing and internal network components.

20

An organization wide analysis is performed on an annual basis to ensure that a proper level of separation of duties exists for all key business and IT processes.

21

All buildings which contain corporate data centers are manned by 24 hour security with video surveillance cameras monitoring all data center access points.