ActiveDisclosure Security Overview
![Stadium](jpg/security_hero_bg_hd.jpg)
![Stadium](jpg/security_hero_bg_0.jpg)
Our systems, processes and experts leverage numerous tools to secure our clients data
SOC 2 Type II audits
AES 256-bit encryption used to protect data at rest
Data is encrypted end to end and while in transit using industry-leading encryption technology
Multifactor Authentication and Single Sign-On (SSO) integration
Secure Software Development support via static and dynamic application testing (SAST/DAST), code reviews, and software release analysis
24/7 365 security monitoring and alerting
Industry leading perimeter controls and next gen firewalls
2Advanced email and threat prevention technologies
Comprehensive, ongoing vulnerability scans are conducted across all applications to quickly identify and mitigate cyber vulnerabilities
Use of next-gen antivirus and antimalware technologies
Commitment to GDPR and other data protection regulations
Annual third-party penetration testing with each finding’s remediation effort independently validated
Extensive employee security awareness and training
Rigorous governance and compliance controls
IT Governance,Risk and Compliance
SOC 2 Type II
- Annual SOC 2 Type II ActiveDisclosure Audit and Report
- Annual SOC 2 Type ii Global Investment Companies (GIC) Audit and Report
- Annual SOC 2 Type II Venue + HiTrust Audit and Report
- Annual SOC 2 Type II Global Capital Markets (GCM) audit and report
ISO 27001 certificate for the Enterprise
AICPA Trust Service Principles
Rigorous Governance Program in Place Leveraging the AICPA Trust Service Principles of Security, Availability, and Confidentiality
NIST CSF
- Comprehensive IT Risk Management Processes
- Dedicate Supply Chain Security and Third-Party Risk Management
- IT Governance over Policy, Procedures and Standards
- IT GRC Reports Directly to the Chief Information Security Officer
Penetration Testing
Annual third-party Penetration Testing for independent verification of ActiveDisclosure’s security posture
- Findings are reviewed and resolved according to DFIN policy
- The third party is brought back to validate that the remediation was effective
- Executive Summary reports are available for client review
Infrastructure
Comprehensive Network
Infrastructure Security controls are in place (firewalls, IDS & IPS, logging, and security monitoring)
Oversight
- Regular network and server vulnerability scans
- Regular OS patching (Microsoft security patches are applied each month)
- Regular backup schedule
- Hosted in Microsoft Azure
- On Premise Data Hosting
![](jpg/dannie_combs.jpg)
DFIN Security Team
Led by Dannie Combs
SVP, Chief Information Security Officer
Enterprise Security team supporting Security Incident and Response, Application Security, Network Security and Security Governance, Risk and Compliance, further supporting:
- The use of security tools and utilities to scan and monitor DFIN assets
- Security Response Team and process in place to address any potential vulnerabilities or events
- Security monitoring and logging
- Policy management - comprehensive policies including Information Security Policy and Security Awareness annual employee training
- Cybersecurity incident response
- Frequent, ongoing employee training programs and best practices
We can provide additional information, including our SOC 2 type II report, once a Non-Disclosure Agreement is signed.
call +1 800 823 5304