Page 50 - OctDefComp

9. A business resiliency program which • Network security controls and perimeter infrastructure
effectively addresses business continuity, risk assessments, including the use of multi-tiered
disaster recovery and incident response firewalls, intrusion prevention systems and web
application firewalls designed to protect the network
Empower takes a multi-tiered approach to resiliency
that includes an Incident Response Plan (IRP). The IRP from outside attack
provides guidelines for specific scenarios, including cyber- • Distributed denial of service (DDoS) defense and
attacks, facility or technology disruptions, and many other mitigation, endpoint security and data loss prevention
scenarios. The IRP also provides a framework to assess (DLP) solutions
and facilitate rapid remediation related to unknown • Malicious code protection, including anti-virus
disruptions and defines roles, responsibilities and disaster technology, Endpoint Detection and Response (EDR)
declaration processes. A dedicated Enterprise Resiliency and other systems and controls designed to protect
team oversees updates to and validations of the IRP, against malware
Business Continuity, and Disaster Recovery plans. An
annual Business Impact Assessment (BIA) is conducted. • Threat-management procedures, including security
A multi-channel emergency communication system is operation centers operate 24/7/365, are designed
utilized allow rapid response and communication during to detect and manage advanced computer security
disruptions. Additional information is found here on our incidents and persistent threats, and follow a formalized
website: Business Continuity Plan. process for acting on identified threats
• Regularly scheduled internal and external network and
10. Encryption of sensitive data stored and application development vulnerability scans performed
in transit by independent security assessment firms and Empower
security administration teams
Empower encrypts all sensitive data at rest (stored) and
in transit. All data at rest within the Empower network, • An enterprise-wide computer security incident
including mobile devices, removable media and backup response team (CSIRT) linked with the enterprise crisis
media, is encrypted. All Empower laptops and desktops response team
are fully encrypted. Empower does not allow copying of • Empower consumes numerous threat intelligence
data to USBs, CDs, DVDs. Empower’s cloud data both in sources to stay informed of the latest risks, including
transit and at rest, is encrypted. solutions such as membership in threat intelligence

sharing groups, monitoring of vendor announcements
11. Strong technical controls implementing and consuming intelligence feeds from security vendors
best security practices
• Encryption of sensitive information at rest
We employ industry-leading technology and security and when transferred electronically on public
measures designed to defend against cybersecurity communication networks
threats and safeguard client-sensitive information.
Protection methods and resources include, but are not
limited to:

9
FOR FINANCIAL PROFESSIONAL AND PLAN SPONSOR USE ONLY.