Bank of America 12/30/2021 - Laserfiche WebLink

BANK OFAMERICA � Y 21.4 Security Policy. Our Information Security Policy has been approved by our management and is published and communicated to our Workforce. We have procedures designed to ensure that our Extended Workforce are subject to similar policies and processes. We conduct periodic risk assessments to identify and assess reasonably foreseeable internal and external risks to the security, confidentiality and integrity of electronic, paper and other records containing CPI. We require our Extended Workforce to have a similar risk assessment process. The remainder of this Section 21 sets out the key aspects of our Information Security Policy. 21.5 Organizational Security. All information is stored in the United States for programs in the United States and Canada. Such information may be accessed by our Workforce and any Extended Workforce from locations within or outside the United States. Our Information Security Policy applies to at such access. We include,as part of our agreements with any Extended Workforce that has access to CPI, provisions that are consistent with those set out in this Section 21. 21.6 Human Resources Security. We take reasonable steps to ensure that our Workforce is aware of our obligations in the provisions of the Services and Applicable Data Protection Laws,including that any unauthorized processing or disclosure of the CPI may lead to disciplinary action under their contract of employment or other contractual arrangements. Prior to receiving access to CPI,the Workforce and any Extended Workforce receive appropriate security awareness training and recurring security awareness training at appropriate intervals, The access rights of our Workforce with access to Information Processing System(s) or media containing CPI are removed upon termination of their employment, contract or agreement, or adjusted upon change of job function in accordance with the Information Security Policy. 21.7 Physical and Environmental Security. We protect all areas that contain Information Processing System(s)or media containing CPI by the use of security controls deemed appropriate by us. 21.8 Communications and Operations Management. We use detection, prevention, and recovery controls which are consistent with Financial Services Industry Best Practices to protect against malicious software and attacks, and train our Workforce on the prevention and detection of malicious software and attacks. We dispose of any paper, electronic or other record containing CPI using all reasonable steps to destroy(based on our determination of the sensitivity of the information)the CPI. To protect the confidentiality and integrity of CPI in transit, we use encryption tools that are consistent with Financial Services Industry Best Practices,to encrypt records and files containing CPI that we: (i)transmit or send wirelessly across public networks; (ii)store on our laptops; (iii)where technically practicable, store on allowed portable devices: and (iv)store on any device that we authorize to be transported outside of our physical or logical controls. We use appropriate measures to safeguard the security and confidentiality of all encryption keys associated with encrypted CPI. 21.9 Access Control. To protect CPI from the risks inherent in mobile computing and remote access, we perform a risk assessment which, at a minimum, is designed to identify and mitigate risks to CPI from mobile computing and remote access, maintain a policy and procedures for managing mobile computing and remote access,and use security controls that are consistent with Financial Services Industry Best Practices to manage authentication of mobile and remote users. 21.10 Information Systems Acquisition, Development and Maintenance. To protect Information Processing System(s)and system files containing CPI, we restrict access to source code to authorized users whom we have determined have a need to know such CPI in the performance of their duties. To protect Information Processing System(s)and system files containing CPI,we: i. Use a change control process which is consistent with Financial Services Industry Best Practices to implement Information Processing System(s)changes;and ii. Use security controls which are consistent with Financial Services Industry Best Practices. 21.11 Information Security Event Management. We maintain an incident response plan that addresses handling of Information Security Events. In accordance with such incident response plan,we will, to the extent not prohibited by law enforcement: i. Provide you prompt, but in no event later than (2) Business Days of becoming aware thereof, notice of any Information Security Event documented and verified by us as part of our standard incident response process that involves, or which we reasonably believe involves,the unauthorized access, use or disclosure of your CPI. ii. Such notice shall, to the extent we are legally allowed, summarize in reasonable detail the Information Security Event and the corrective action taken or to be taken by us, if known at that time. We will promptly take all corrective action deemed necessary or appropriate by us. This includes responsibility and associated expenses for: (i)to the extent caused by the Bank or otherwise covered by the Bank's insurance,damages of any nature arising out of such Information Security Event, including without limitation damages to the individual Cardholders(i.e. identity theft); (ii) informing all affected individuals if applicable laws require notification to such individuals;(iii)reissuance of credit cards to all affected individuals;and(iv)credit monitoring services for one year for all affected individuals. 21.12 Business Continuity Management. In order to protect the confidentiality and availability of CPI, we maintain a business continuity management program that is consistent with Financial Services Industry Best Practices which we update and test at planned intervals and as required. 21.13 Security Assessments. We permit your representatives to perform one on-site or written assessment of the security controls used at our data processing and business facilities. Such assessments will be performed during regular business hours, at a date and time agreed to by both parties, and will not require access to Information Processing System(s). Such assessments will be subject to our security policies, procedures, and restrictions, including restrictions on access to data centers, the ability to perform hands-on testing, and copying of certain materials. 00-35-6182NSBW 02-28-2020 AK Page 13 of 16 Bank of America — Confidential ©2020 Bank of America Corporation