Attachment_B_-_Keefe_group_Security_Program_Overview_2022.pdf

Keefe Group Security Program Overview

KEEFE GROUP’S SECURITY PROGRAM

AND SECURITY OVERVIEW

JANUARY 2022

Table of Contents Section 1: Overview

1.1 Overview

Section 2: Information Security Program Management

Section 3: Business Continuity

3.1 Business Resilience

3.2 Disaster Recovery

Section 4: Network and Data Center

4.1 Infrastructure

4.2 Systems and Database Security

4.3 Data Center

4.4 Physical and Environmental Protection

Section 5: Personnel Security

5.1 Personnel Security

5.2 Security Awareness Training

Section 6: Security Assessment

6.1 Security Assessments

6.2 PCI Assessment

6.3 SOC 2 Audit

6.4 Money Transmitter License

6.5 IT General Controls

6.6 Risk Assessments

6.7 Vulnerability Scans

Section 7: Security Monitoring and Response

7.1 Security Monitoring

7.2 Incident Response

Section 1: Overview

1.1 Overview

TKC Holdings and Keefe are committed to protecting its employees, customers and corporate data from damaging acts that are intentional or unintentional. This document describes the fundamental security controls that are in place to help protect our data from being used in an unauthorized manner.

This document is broken down into 6 additional sections that describe the process or controls in place to reduce the risk of unauthorized use. The following is a list by section of what is covered:

• Section 2 – Information Security Program Management

• Section 3 – Business Continuity

• Section 4 – Network and Data Center

• Section 5 – Personal Security

• Section 6 – Security Assessment

• Section 7 – Security Monitoring and Response

Section 2: Information Security Program Management

Overview

Keefe information security program is based on the NIST 800-53 standard. In our implementation of NIST 800-53, Keefe maintains a robust set of policy and procedures covering change management, access management, network security and back-up & recovery.

Keefe’s Information Security Program employs a layered security approach, forming a defense in depth strategy to mitigate known or potential security risks. Major components of the program include Risk Assessment, Security

Assessment, Security Awareness, Security Policies and Standards, Risk Mitigation and Reporting. A dedicated

Information Security Team led by the Chief Information Security Officer are responsible for the management of the program. To ensure the prevention of unauthorized access to the environment supporting the services provided to our customers, we implement commercially accepted technologies and apply appropriate methods of security to ensure that the integrity and privacy of our customer’s data is protected. Our security program is reviewed annually and adheres to industry standards and best practices that address the critical requirements of safeguarding information using a NIST based Information Security Management System.

Keefe is committed to protecting its employees, customers and company data from damaging acts that are intentional or unintentional. Effective information security is a team effort involving the participation and support of every Keefe employee or contractor who interacts with our data on our systems.

Protecting employee, customer and company data and the systems that collect, process, and maintain this information is a critical importance. Consequently, the security of systems includes controls and safeguards to offset possible threats, as well as controls to ensure accountability, availability, integrity and confidentiality of data:

▪ Confidentiality – Confidentiality addresses preserving restrictions on information access and disclosure so that access is restricted to only authorized users and services.

▪ Integrity – Integrity addresses the concern that sensitive data has not been modified or deleted in an unauthorized and undetected manner.

▪ Availability – Availability addresses ensuring timely and reliable access to and use of information.

Scope

The scope of the Information Security Program and Requirement at Keefe encompasses Information Security

Administration, Security Policy Management and Security Technology Infrastructure. Consistent monitoring to detect changes in the threat landscape allow us to be more proactive with changes to our environment and gives us the ability to act in a reasonable manner to address potential exposure to known or reported risks targeting our information systems.

• Information Security Administration includes:

o Education and Awareness o Security Incident Response o Audit and reporting

• Information Security Policies includes:

o Information Security Program o Data Retention Guidelines o Network Security Standards o Patch Management Policy o Risk Management Plan o Facilities Access Policy o Security Incident Response Plan o Change Management

• Information Security Technology Infrastructure includes:

o Access Controls o Encryption o Data Security o Host Security o Data Retention

5 | P a g e TKC Holdings

Section 3: Business Continuity

3.1 Business Resilience

Keefe cloud software platform maintains Highly Available (HA) and redundant systems across all the applications. Data is also replicated to our fully tested, secondary data center located in Omaha, Nebraska.

Redundant systems/facilities include the following:

• TKC Holdings maintains a disaster recovery plan and protocol managed by our Information Security Office.

• Geographically dispersed Tier 3 Data Centers with the primary site in St. Louis, MO and the secondary site in Omaha, NE.

• Multiple call centers in St. Louis, MO; St. Charles, MO; Denison, TX and San Antonio, TX with redundant telecom infrastructure.

• PCI compliant credit card processing available in both datacenters.

• Redundant internet and network service providers.

• Component redundancy for all servers, storage, network infrastructure and load balancers in use inside of each datacenter.

3.2 Disaster Recovery

TKC Holdings maintains a comprehensive Disaster Recovery program to provide Information Technology staff with a documented and detail plan to enable a successful recovery of the IT Systems in the event of a cataclysmic event.

The plan provides detailed procedures for handling a system outage to minimize the adverse impact to TKC

Holdings and their operating business units. The primary data center is located in St. Louis, Missouri and a secondary data center in Omaha, Nebraska.

6 | P a g e

Section 4: Network and Data Center

4.1 Infrastructure

The Keefe Cloud Software platform server environment is housed in a managed colocation data center that provides environmental, network and physical controls. The server environment is managed by internal technical staff and utilizes blade servers, standalone servers, storage area networks, and virtualization technologies. The environment is in a segmented network with multilayered security controls. The perimeter is protected by a next generation firewall with intrusion detection / preventions systems. The public facing websites are also protected by a web application firewall along with file integrity monitoring.

4.2 Systems and Database Security

The systems used by the Keefe’s cloud software platform are configured to restrict access to only those who have a business need. The system roles allow users to have access to only the data that is relevant and is needed to perform their job function. Sensitive customer data is encrypted at rest to protect from unauthorized disclosure.

4.3 Data Center

The systems are in the primary Tier 3 data center located in St. Louis Missouri that utilizes Cisco carrier-class infrastructure and are protected with intelligent power and generator backups, biometrics and card access, redundant cooling and raised floors. The facilities have been designed to support high power consumption devices and utilize a network of multiple fiber runs from multiple carriers to allow for maximum capacity and redundancy.

Our data center has restricted access based on management approval and access is restricted 24/7 by security guards that require that the personal is on the approved list and they must show their government photo ID card before gaining access.

4.4 Physical and Environmental Protection

The physical environment and the related networks are protected with environmental suppression systems and are monitored via physical inspections and software monitoring tools. Physical security encompasses access to buildings, badge setup and approval processes, power management, monitoring of cameras and facility wide equipment.

7 | P a g e

Section 5: Personnel Security

5.1 Personnel Security

All new employees are required to have background checks and drug testing before they are hired. All new employees are required to review and acknowledge their receipt of employee and security policies.

5.2 Security Awareness Training

The TKC Holding Information Security Office conducts annual security awareness training that all staff with access to our computer systems must complete.

8 | P a g e

Section 6: Security Assessment

6.1 Security Assessments

TKC Holdings undergoes various third party and internal assessment each year and uses those assessments to continue to mature its overall security posture.

6.2 PCI Assessment

TKC Holdings, parent company of the Keefe Group, is classified as a Level 1 Merchant and Service

Provider. TKC Holdings undergoes a Level 1 PCI assessment annually by an independent third-party qualified security assessor (QSA). The annual Attestation of Compliance (AOC) is available upon request.

6.3 SOC 2 Audit

Keefe’s Secure Deposits undergoes an annual third party SOC 2 assessment by an independent third party. The annual SOC 2 report is available upon request. Keefe’s other cloud software, inmate Commissary and inmate

Banking are scheduled to complete a SOC 2 Type 1 audit the end of 2021 followed by a SOC 2 Type 2 the following year.

6.4 Money Transmitter License

Access Corrections is a licensed or exempt Money Transmitter in all 50 states plus the District of Columbia and

Puerto Rico. Also Access Corrections undergoes multiple audits from state agencies.

6.5 IT General Controls

Keefe group undergoes a periodic IT General Controls audit conducted by an independent assessor. The scope of the audit covers IT Governance, Logical access, Change management, Physical security to the data center, Backup and recovery, network operations and IT operations.

6.6 Risk Assessments

TKC Holdings’ Information Security Office conducts several risk assessments each year and uses the results to maintain and update the overall Information Security Program.

6.7 Vulnerability Scans

TKC Holdings conducts weekly vulnerability scans to detect any possible vulnerabilities on their systems. Any discovered vulnerability will be identified and be remediated based on risk level.

9 | P a g e

Section 7: Security Monitoring and Response

7.1 Security Monitoring

TKC Holdings utilizes a third-party Managed Security Service Provider (MSSP) to monitor critical systems and data

24x7x365. The MSSP monitors the environment for any anomalies or vulnerabilities that may come up. Alerts are escalated to appropriate personnel if any possible threats are identified.

7.2 Incident Response

TKC Holdings maintains a Security Incident Response Plan that outlines the process for handling any security event that is detected.