WorkDay_-_MSA_-_ERP_453086 - Laserfiche WebLink

Home

00453086.0 -Confidential UNIVERSAL SECURITY EXHIBIT ©2019 Workday 19.5 Page 2 of 2 9. Secure Disposal. Policies and procedures regarding the secure disposal of tangible property containing Covered Data, taking into account available technology so that such data cannot be practicably read or reconstructed. 10. Assigned Security Responsibility. Assigning responsibility for the development, implementation, and maintenance of its information security program, including: a) Designating a security official with overall responsibility; and b) Defining security roles and responsibilities for individuals with security responsibilities. 11. Testing. Regularly testing the key controls, systems and procedures of its information security program to validate that they are properly implemented and effective in addressing the threats and risks identified. 12. Monitoring. Network and systems monitoring, including error logs on servers, disks and security events for any potential problems. Such monitoring includes: a) Reviewing changes affecting systems handling authentication, authorization, and auditing; b) Reviewing privileged access to Workday production systems processing Covered Data; and c) Engaging third parties to perform network vulnerability assessments and penetration testing on a regular basis. 13. Change and Configuration Management. Maintaining policies and procedures for managing changes Workday makes to production systems, applications, and databases processing Covered Data. Such policies and procedures include: a) A process for documenting, testing and approving the patching and maintenance of the Covered Service; b) A security patching process that requires patching systems in a timely manner based on a risk analysis; and c) A process for Workday to utilize a third party to conduct web application level security assessments. These assessments generally include testing, where applicable, for: i) Cross-site request forgery ii) Services scanning iii) Improper input handling (e.g. cross-site scripting, SQL injection, XML injection, cross-site flashing) iv) XML and SOAP attacks v) Weak session management vi) Data validation flaws and data model constraint inconsistencies vii) Insufficient authentication viii)Insufficient authorization 14. Program Adjustments. Workday monitors, evaluates, and adjusts, as appropriate, the security program in light of: a) Any relevant changes in technology and any internal or external threats to Workday or the Covered Data; b) Security and data privacy regulations applicable to Workday; and c) outsourcing arrangements, and changes to information systems. Docusign Envelope ID: B7B2CF4A-C414-47B2-BF08-2BCDA4573B8E