EXHIBIT C-1 - SECURE WORK SPACE REQUIREMENTS

• Site conducted

  Select

• Conducted on

  Date

• Prepared by

• Location
  Address

• Yes

  No

  N/A

Physical Security and Access

• Electronic access will include anti-tailgating and anti-passback controls (swipe in, swipe out)

  Yes

  No

  N/A

• Where possible, physical controls such as turnstiles are preferred

  Yes

  No

  N/A

• Entry into the SWS will be limited to only those persons requiring access for the purposes of performing under this Agreement. The Verizon Project Manager must approve all visitors to the

  Yes

  No

  N/A

• MACCS: Master Agreement for Contact Center Services – GDPR – Feb 2019

  Yes

  No

  N/A

• Verizon Proprietary and Confidential

  Yes

  No

  N/A

• Asurion_Internal_Use_Only maintenance, either electronically or via written logs. Logs must be available for review for at least

  Yes

  No

  N/A

• 180 days or for the maximum retention period permitted under local law

  Yes

  No

  N/A

• Workspace should be provided for storing personal items. All devices such as mobile phones, USB storage drives, CDs/DVD’s, and other electronic media, recording devices, iPods, MP3 players, and

  Yes

  No

  N/A

• CD players are prohibited. Any exceptions must be reviewed and approved by Verizon

  Yes

  No

  N/A

• 2.10. Use of paper, pens, pencils, and printed material in any form is not allowed inside the SWS, except pursuant to procedures specified by Verizon or as permitted by the Verizon Project Manager

  Yes

  No

  N/A

• 2.11. All personal items are restricted from entering the SWS. Secured lockers outside the Secured

  Yes

  No

  N/A

• 2.12. All personnel entering and exiting the restricted space will be screened by the guard via a metal preferred

  Yes

  No

  N/A

• 2.13. Security guards will monitor and document all activities in the SWS including housekeeping and

  Yes

  No

  N/A

• 2.14. Where servers and network devices associated with the SWS have distinct administrative staff, the

  Yes

  No

  N/A

• 2.15. Access to network cabling, electrical circuits and panels, or other infrastructure will be limited to

  Yes

  No

  N/A

• 2.16. Training rooms must meet the same criteria and standards as SWS. If the training room(s) is

  Yes

  No

  N/A

• 2.17. All personal computer CPUs must be secured with a cable lock. All CPU chassis must also be

  Yes

  No

  N/A

• 2.18. All offices and conference rooms within the SWS must have lockable doors and remain locked

  Yes

  No

  N/A

• 2.19. All rooms, doors and computer hardware secured by a physical key must be done so using an

  Yes

  No

  N/A

• All SWS systems must require unique user authentication and all access to such systems must be permitted under local law

  Yes

  No

  N/A

• Logical Security when unoccupied

  Yes

  No

  N/A

• Segregation of network and use of segregated VLAN for each project is required

  Yes

  No

  N/A

• MACCS: Master Agreement for Contact Center Services – GDPR – Feb 2019

  Yes

  No

  N/A

• Verizon Proprietary and Confidential

  Yes

  No

  N/A

• Asurion_Internal_Use_Only rule violations. Logs must be monitored and available for review for at least 180

  Yes

  No

  N/A

• Network segmentation must be done through a dedicated SWS firewall. Firewalls will log

  Yes

  No

  N/A

• Access to the Internet is not allowed from the SWS

  Yes

  No

  N/A

• 3.8. must be approved by Verizon in writing

  Yes

  No

  N/A

• 3.10. Personnel requiring both SWS and non-secure workspace access will be assigned separate access the SWS.)

  Yes

  No

  N/A

• 3.11. Personnel are not permitted to circumvent logical controls from within the SWS and Supplier shall

  Yes

  No

  N/A

• 3.12. Moving information outside of the Verizon virtual environment is prohibited and controls to prevent local copying and pasting must be implemented

  Yes

  No

  N/A

• 3.13. Remote access to SWS systems is prohibited

  Yes

  No

  N/A

• 3.14. Access to email within the SWS is prohibited

  Yes

  No

  N/A

• 3.15. Modems, Bluetooth or other wireless type connections to SWS systems are prohibited. This

  Yes

  No

  N/A

• 3.16. System administration of SWS systems will be performed from SWS locations

  Yes

  No

  N/A

• MACCS: Master Agreement for Contact Center Services – GDPR – Feb 2019

  Yes

  No

  N/A

• Verizon Proprietary and Confidential

  Yes

  No

  N/A

• Asurion_Internal_Use_Only printers

  Yes

  No

  N/A

Compliance and Monitoring

• Electronic logging must be performed for all network attached systems and devices to record the information specified in the individual controls. Logs must be monitored for suspicious activity

  Yes

  No

  N/A

• All security and access records must be available for review by Verizon upon request

  Yes

  No

  N/A

• MACCS: Master Agreement for Contact Center Services – GDPR – Feb 2019

  Yes

  No

  N/A

• Verizon Proprietary and Confidential

  Yes

  No

  N/A

• Asurion_Internal_Use_Only

  Yes

  No

  N/A

EXHIBIT C-2 - SECURE WORK SPACE FOR VENDOR SHARED ENVIRONMENTS

• REV 1/26/2016

  Yes

  No

  N/A

• This Exhibit C-2 provides requirements for Projects required to implement a secure work space (SWS) the existing SOW and/or Agreement, this Exhibit C-2 will control

  Yes

  No

  N/A

Definitions

Physical Security and Access

• Video Cameras must monitor the entrances and exits (both inside and out), as well as the general secured areas. Real-time active video monitoring by security personnel will cover 24x7x365

  Yes

  No

  N/A

• Electronic access will include anti-tailgating and anti-passback controls (swipe in, swipe out)

  Yes

  No

  N/A

• Where possible, physical controls such as turnstiles are preferred

  Yes

  No

  N/A

• MACCS: Master Agreement for Contact Center Services – GDPR – Feb 2019

  Yes

  No

  N/A

• Verizon Proprietary and Confidential

  Yes

  No

  N/A

• Asurion_Internal_Use_Only

  Yes

  No

  N/A

• 2.13. Security guards will monitor and document all activities in the SWS including housekeeping and least 180 days or for the maximum retention period permitted under local law

  Yes

  No

  N/A

• 2.14. Where servers and network devices associated with the SWS have distinct administrative staff, (e.g., cabinet locks)

  Yes

  No

  N/A

• 2.15. Access to network cabling, electrical circuits and panels, or other infrastructure will be limited to authorized individuals

  Yes

  No

  N/A

• 2.16. Training rooms must meet the same criteria and standards as SWS. If the training room(s) is training rooms require electronic access cards with anti-passback controls

  Yes

  No

  N/A

• 2.17. All Personal Computer CPUs must be secured with a cable lock. All CPU chassis must also be secured to prevent unauthorized chassis removal/dismantling

  Yes

  No

  N/A

• 2.18. All offices and conference rooms within the SWS must have lockable doors and remain locked when unoccupied

  Yes

  No

  N/A

• 2.19. All rooms, doors and computer hardware secured by a physical key must be done so using an auditable key control system

  Yes

  No

  N/A

• Logical Security

  Yes

  No

  N/A

• MACCS: Master Agreement for Contact Center Services – GDPR – Feb 2019

  Yes

  No

  N/A

• Verizon Proprietary and Confidential

  Yes

  No

  N/A

• Asurion_Internal_Use_Only

  Yes

  No

  N/A

• Login credentials must meet industry best practices for complexity and expiration periods

  Yes

  No

  N/A

• Network segmentation must be done through a Firewall. Firewalls will log attempted rule violations. Logs must be monitored and available for review for at least 180 days as requested by

  Yes

  No

  N/A

• 3.10. Remote access to SWS systems is prohibited

  Yes

  No

  N/A

• 3.11. Access to email within the SWS is prohibited

  Yes

  No

  N/A

• 3.12. Modems, Bluetooth or other wireless type connections to SWS systems are not allowed. This includes connections to external systems via wireless data connection (broadband, LTE, 3G, 4G, WiFi, etc)

  Yes

  No

  N/A

• 3.13. System administration of SWS systems will be performed from SWS locations

  Yes

  No

  N/A

• In the event the vendor permits printing by users in the SWS, printing must be to printers located in the SWS environment and not to printers located outside the SWS. Printers inside the Secure

  Yes

  No

  N/A

• Workspace must not be accessible from outside the SWS environment. Printers must not be

  Yes

  No

  N/A

• MACCS: Master Agreement for Contact Center Services – GDPR – Feb 2019

  Yes

  No

  N/A

• Verizon Proprietary and Confidential

  Yes

  No

  N/A

• Asurion_Internal_Use_Only near printers

  Yes

  No

  N/A

3.15. Compliance and Monitoring

• 3.17. Logs and other documentation related to physical access control will be reviewed on a periodic under local law

  Yes

  No

  N/A

• 3.18. Project team may designate one person responsible for user access provisioning and this is not feasible, one person may perform both functions

  Yes

  No

  N/A

• 3.19. Electronic logging will be performed for all network attached systems and devices to record the information specified in the individual controls. Logs will be monitored for suspicious activity

  Yes

  No

  N/A

• 3.20. Systems such as intrusion prevention/detection systems and content filters will be implemented to improve the security of the SWS. Security logging will be performed by all security systems

  Yes

  No

  N/A

• 3.21. Pertinent security and access records will be available for review by Verizon upon request

  Yes

  No

  N/A

• 3.22. When requested by Verizon, periodic access to Verizon-specific monitoring logs will be arranged

  Yes

  No

  N/A

• MACCS: Master Agreement for Contact Center Services – GDPR – Feb 2019

  Yes

  No

  N/A

• Verizon Proprietary and Confidential

  Yes

  No

  N/A

• Asurion_Internal_Use_Only

  Yes

  No

  N/A