Trust Center - XOi

XOi Technologies

Controls

Updated 24 minutes ago

Infrastructure security

Control	Status
Unique account authentication enforced The company requires authentication to systems and applications to use unique username and password or authorized Secure Socket Shell (SSH) keys.
Unique network system authentication enforced The company requires authentication to the "production network" to use unique usernames and passwords or authorized Secure Socket Shell (SSH) keys.
Remote access MFA enforced The company's production systems can only be remotely accessed by authorized employees possessing a valid multi-factor authentication (MFA) method.
Remote access encrypted enforced The company's production systems can only be remotely accessed by authorized employees via an approved encrypted connection.
Intrusion detection system utilized The company uses an intrusion detection system to provide continuous monitoring of the company's network and early detection of potential security breaches.
Network firewalls utilized The company uses firewalls and configures them to prevent unauthorized access.

Organizational security

Control	Status
Employee background checks performed The company performs background checks on new employees.
Confidentiality Agreement acknowledged by contractors The company requires contractors to sign a confidentiality agreement at the time of engagement.
Confidentiality Agreement acknowledged by employees The company requires employees to sign a confidentiality agreement during onboarding.
Performance evaluations conducted The company managers are required to complete performance evaluations for direct reports at least annually.

Product security

Control	Status
Data encryption utilized The company's datastores housing sensitive customer data are encrypted at rest.
Control self-assessments conducted The company performs control self-assessments at least annually to gain assurance that controls are in place and operating effectively. Corrective actions are taken based on relevant findings. If the company has committed to an SLA for a finding, the corrective action is completed within that SLA.
Penetration testing performed The company's penetration testing is performed at least annually. A remediation plan is developed and changes are implemented to remediate vulnerabilities in accordance with SLAs.
Vulnerability and system monitoring procedures established The company's formal policies outline the requirements for the following functions related to IT / Engineering: - vulnerability management; - system monitoring.

Internal security procedures

Control	Status
Whistleblower policy established The company has established a formalized whistleblower policy, and an anonymous communication channel is in place for users to report potential issues or fraud concerns.
Organization structure documented The company maintains an organizational chart that describes the organizational structure and reporting lines.
Roles and responsibilities specified Roles and responsibilities for the design, development, implementation, operation, maintenance, and monitoring of information security controls are formally assigned in job descriptions and/or the Roles and Responsibilities policy.
Access requests required The company ensures that user access to in-scope system components is based on job role and function or requires a documented access request form and manager approval prior to access being provisioned.