WorkDay_-_MSA_-_ERP_453086 - Laserfiche WebLink

Home

00453086.0 -Confidential UNIVERSAL SECURITY EXHIBIT ©2019 Workday 19.5 Page 1 of 2 This Workday Universal Security Exhibit applies to the Covered Service and Covered Data. Capitalized terms used herein have the meanings given in the Agreement, including attached exhibits, that refers to this Workday Universal Security Exhibit. Workday maintains a comprehensive, written information security program that contains administrative, technical, and physical safeguards that, taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing of Covered Data as well as the associated risks, are appropriate to (a) the type of information that security program is designed to: which Workday has access; Protect against any anticipated threats or hazards to the confidentiality, integrity, and availability of Covered Data; Protect against unauthorized or unlawful access, use, disclosure, alteration, or destruction of Covered Data; Protect against accidental loss or destruction of, or damage to, Covered Data; and Safeguard information as set forth in any local, state or federal regulations by which Workday may be regulated. 1. Security Awareness and Training. Mandatory employee security awareness and training programs, which include: a) Training on how to implement and comply with its information security program; and b) Promoting a culture of security awareness. 2. Access Controls. Policies, procedures, and logical controls: a) To limit access to its information systems and the facility or facilities in which they are housed to properly authorized persons; b) To prevent those workforce members and others who should not have access from obtaining access; and c) To remove access in a timely basis in the event of a change in job responsibilities or job status. 3. Physical and Environmental Security. Controls that provide reasonable assurance that access to physical servers at the data centers housing Covered Data is limited to properly authorized individuals and that environmental controls are established to detect, prevent and control destruction due to environmental extremes. 4. Security Incident Procedures. A security incident response plan that includes procedures to be followed in the event of any security breach of any application or system directly associated with the accessing, processing, storage or transmission of Covered Data. 5. Contingency Planning. Policies and procedures for responding to an emergency or other occurrence (for example, fire, vandalism, system failure, pandemic flu, and natural disaster) that could damage Covered Data or production systems that contain Covered Data. 6. Audit Controls. Technical or procedural mechanisms put in place to promote efficient and effective operations, as well as compliance with policies. 7. Data Integrity. Policies and procedures to ensure the confidentiality, integrity, and availability of Covered Data and to protect it from disclosure, improper alteration, or destruction. 8. Storage and Transmission Security. Security measures to guard against unauthorized access to Covered Data that is being transmitted over a public electronic communications network or stored electronically. Docusign Envelope ID: B7B2CF4A-C414-47B2-BF08-2BCDA4573B8E