Information Security Policy

1. Information Security – General

Information is an asset, which like other important business assets, has value to an organization and must be suitably protected. Information security protects information from a wide range of threats in order to ensure business continuity, minimize business interruption or harm, and maximize return on investments and business opportunities.

Information can exist in many forms. It can be printed or written on paper, stored electronically, transmitted by post or by using electronic means, shown through audiovisual means or spoken in conversation. Whatever forms the information takes, or the means by which it is shared or stored, it should always be appropriately protected.

Information security is characterized here as the preservation of:

Confidentiality: ensuring that information is accessible only to those authorized to have access;
Integrity: safeguarding the accuracy and completeness of information and processing methods; and
Availability: ensuring that authorized users have access to information and associated assets when required.

Information security is achieved by implementing a suitable set of controls, which may include policies, practices, procedures, organizational structures and software functions. These controls need to be established to ensure that the specific security objectives of an organization are met.

This policy states MinMax’s commitment to information security, and lays-out our approach to managing security risk. MinMax’s information assurance and security program protects the company’s information assets, in whatever form they take. Our program identifies and addresses business and security risks facing the organization, thereby keeping customers’ data safe and enabling growth of our business.

2. Policy and Purpose

MinMax (the “Company”) is a Video as a Service enterprise. While we have some limited physical assets, data is our most valuable asset. Because we do business on the Internet, we must protect our proprietary source code, business records, customer information, and corporate communications from a wide range of threats, in order to grow our business, and keep customers safe.

This document defines the high-level Information Security Policy (together with any underlying policies and standards described or referenced herein or in Appendix A, the “Policy”) of MinMax, Inc. This Policy is reviewed and updated at least annually as needed to reflect changes to business objectives or the risk environment. This Policy has been established to ensure that all MinMax information (regardless of the form the information takes, or the means by which it is shared or stored) is appropriately protected. This Policy outlines the processes and procedures that all MinMax employees, contractors, consultants, and other third parties having a legitimate need to access the Company’s information (collectively, all “MinMax and Related Parties”) are expected to understand and adhere to at all times.

3. Scope

Unless stated otherwise, this Policy is applicable worldwide to MinMax and Related Parties, each of whom must adhere to this Policy at all times.

4. Responsibility

4.1 The Company’s Co-Founders are responsible for establishing and enforcing this Policy and its related standards, procedures and guidelines.
4.2 MinMax and Related Parties share in the responsibility for protecting the Company’s information assets. This section of the Policy defines and describes those groups that have particular responsibilities in that regard:
4.3
Company Co-Founders, Managers, and Supervisors
1. 4.3.1 Those Company employees with management responsibility are accountable for ensuring that their teams have received appropriate training and instruction regarding information security, overseeing compliance with MinMax policies and procedures, including, without limitation, this Policy, and immediately reporting breaches of this Policy or any other Company policy to the Founding team.
4.4
Employees and Contractors
1. 4.4.1 All MinMax employees and contractors are responsible for protecting any of the Company’s information resources to which they have access, even if they do not have responsibility for managing those resources. These responsibilities cover both computerized and non-computerized information and information technology devices that are in their care or possession. All MinMax employees and must adhere to and follow the terms contained in this Policy, as well as any departmental or other specific information security practices, standards and protocols that are applicable to their roles within the Company.
2. 4.4.2 All Company employees and contractors are responsible for completing appropriate training and instruction sessions regarding information security, adhering to all MinMax policies and procedures, including, without limitation, this Policy, and immediately reporting breaches of this Policy or any other Company policy to the Founding team.
4.5
Consultants and Other Third Parties
1. 4.5.1 Consultants and other third parties having a legitimate need to access MinMax information are required to comply with the applicable security requirements set forth in this Policy. MinMax and its employees and contractors will take all reasonable and appropriate steps to ensure consultant and other third-party compliance with the terms contained in this Policy.
2. 4.5.2 Any consultant’s or other third party’s breach of or non-compliance with the terms contained in this Policy shall be immediately reported to the appropriate supervisor or individual responsible for overseeing their work, or to the Founding team.

5. General Policies and Best Practices

5.1
In addition to complying with the general principles outlined in this Policy, all MinMax employees and contractors are required to adhere to the following best practices and policies in the course of their employment or contracting relationship with the Company. The responsibility for creating and distributing each of these policies and procedures are owned by the Founding team and designed to reinforce and ensure the confidentiality, integrity and proper availability of MinMax information that are the cornerstones of this Policy.
1. (a) Clean Desk Policy – All employees and contractors must maintain the confidentiality and security of sensitive Company documents in their offices or work stations. Any such Company documents must be secured before leaving their offices or work stations at the end of each work day.
2. (b) Sensitive Document Disposal Policy – All employees and contractors must shred and not otherwise retain or dispose of sensitive Company documents which are in their possession and no longer required by them to perform their essential job functions. From time to time, the Company’s Founding team may inform all staff members that certain documents must be retained for legal reasons for a period of time. Such notification shall be designated as a limited exception to the Sensitive Document Disposal Policy.
3. (c) Data Classification, Handeling, Retention, and Disposal Policy – All employees, contractors, and third parties of MinMax have a responsibility to protect MinMax data from unauthorized generation, access, modification, disclosure, transmission or destruction, and are expected to be familiar with and comply with this policy.
5.2 Any electronic media containing but not limited to PCI, HIPAA and PII information must be disposed of in a secure manner.
5.3 All media will only be stored for up to forty-eight (48) hours unless otherwise specified in the relevant Creative Service and Use Agreement.
5.4 All agreements and amendments with third party service providers must be reviewed and approved by the Founding team.

6. Anti-Virus Policy

6.1 All employees, contractors, and third parties must comply with the MinMax Anti-Virus Policy, which governs protection of the Company’s resources against intrusion by viruses and other malware.
6.2 System Scope – This policy applies to all servers, workstations, laptops and virtual machines commonly affected by virus or malware that are attached to the MinMax network.
6.3
MinMax will use MinMax approved anti-virus software for detection and protection. The following minimum requirements shall remain in force:
1. 6.3.1 Anti-virus software will be installed and configured on all MinMax systems defined under section 6.2.
2. 6.3.2 The anti-virus library definitions will be updated as necessary.
3. 6.3.3 Systems listed in section 6.2 will be scanned on a regular basis.
4. 6.3.4 Any networked machine that is found to be infected, will be inspected and the virus removed as soon as reasonably possible. If repair is not possible in a timely manner, the infected system will be removed from the MinMax network and not re-connected to the network until the system has been verified virus-free by MinMax personnel using approved anti-virus software tools.
5. 6.3.5 MinMax administrators will conduct periodic reviews of Anti-virus console to verify that all MinMax owned clients on the network conform to this policy.

7. Acceptable Use Policy

7.1 All employees and contractors must comply with the MinMax Acceptable Use Policy, which governs usage of Company computer equipment.
7.2 The purpose of this policy is to outline the acceptable use of Information Technology systems at MinMax. This policy is designed to protect MinMax, its employees and partners from illegal or damaging actions by individuals, either knowingly or unknowingly. Inappropriate use of computer equipment exposes MinMax to risks including virus attacks, compromise of network systems and services, and legal issues. All users are expected to familiarize themselves and comply with this policy.
7.3 Effective security is a company-wide effort involving the participation and support of every MinMax employee and affiliate who deals with information and/or information systems. It is the responsibility of every MinMax user to know this policy and to conduct his or her activities accordingly.
7.4 MinMax Information Technology systems are intended to be used for authorized business purposes serving the interests of MinMax and its customers. All data created and stored on MinMax owned Information Technology infrastructure remains the property of MinMax. Employees shall exercise due diligence to protect MinMax sensitive or confidential data. For security and network maintenance purposes, MinMax may monitor employee use of MinMax Information Technology systems at any time.
7.5
Employees should take all of the following steps to prevent unauthorized access of company information:
1. 7.5.1 Authorized users are responsible for the security of their passwords and accounts. Users must keep their passwords secure and accounts should not be shared.
2. 7.5.2 All PCs, laptops and workstations should either be secured with a password-protected screensaver with the automatic activation feature set at 15 minutes or less or logged-off (window key + L for Windows users) when the host will be unattended.
3. 7.5.3 Employees must use extreme caution when opening e-mail attachments received, especially from unknown senders, as these attachments may contain malicious code or applications.
4. 7.5.4 A list of approved devices including but not limited to network devices and servers in-scope for PCI, HIPAA, and PII compliance must be maintained and updated as devices are added to or removed from the environment.
7.6
Unacceptable Use
1. 7.6.1 The following activities are generally prohibited. Under no circumstances is an employee of MinMax authorized to engage in any activity that is illegal under local, state, federal or international law while utilizing MinMax owned resources.
2. 7.6.2
  Systems, Network, and Internet Activities
  1. (a) Accessing websites inappropriate to a workplace environment (e.g. pornography, gambling or illegal drug related sites) is prohibited.
  2. (b) The Internet must not be used to violate the intellectual property rights of any party. Intellectual property includes copyrights, trademarks, patents, trade secrets, publicity and privacy rights. Employees are prohibited from interfering with or attempting to disable anti-piracy mechanisms or other standard technical measures used by copyright owners to protect or identify their work.
  3. (c) Accessing resources on the Internet is reserved to the authorized users of the target systems and must be limited to legitimate purposes that comply with local legislation. Attacking in any way, as well as scanning, probing or penetrating, computer systems or networks on the Internet is strictly prohibited.
  4. (d) MinMax reserves the right to block access to Internet sites considered inappropriate. Deliberate attempts to access such sites may result in disciplinary action.
  5. (e) Unauthorized copying of copyrighted material including, but not limited to, digitization and distribution of photographs from magazines, books or other copyrighted sources, copyrighted media, and the installation of any copyrighted software for which MinMax or the end user does not have an active license is strictly prohibited.
  6. (f) Exporting software, technical information, encryption software or technology, in violation of international or regional export control laws, is illegal. The appropriate management should be consulted prior to export of any material that is in question.
  7. (g) Introduction of malicious programs into the network or server (e.g., viruses, worms, Trojan horses, e-mail bombs, etc.) is prohibited.
  8. (h) Employees shall not reveal MinMax account passwords to others or allow use of their accounts by others. This includes family and other household members.
  9. (i) Employees may not use a MinMax computing asset to actively engage in procuring or transmitting material that is in violation of sexual harassment or hostile workplace laws in the user’s local jurisdiction.
  10. (j) Using MinMax Information Technology systems to make fraudulent offers of products, items, or services is prohibited.
  11. (k) Employees shall not attempt to access data for which they have not been granted access or attempt to bypass access controls for any system unless previously authorized to do so by Information Technology management for the purposes of testing information security controls.
  12. (l) It is prohibited to execute any form of network monitoring which will intercept data not intended for the employee’s host unless previously authorized to do so by Information Technology management for the purposes of testing information security controls.
  13. (m) It is prohibited for any devices that could be used for recording audio, video and images to record information in any environment. This includes but is not limited to smart phones and cameras that could be used to take unauthorized copies of information from a monitor, documentation, or any other source.
3. 7.6.3
  Email and Communications Activities
  1. (a) Personal, non-business use is permissible to the extent that it does not consume significant resources and that it does not interfere with employees official work responsibilities.
  2. (b) Social security numbers, credit card PAN, and credit reports must never be transmitted via email unless encrypted by a MinMax approved encryption method. The Founding team will have responsibility for designating approved encryption methods.
  3. (c) Employees shall not send unsolicited email messages, including the sending of “junk mail” or other advertising material to individuals who did not specifically request such material (email spam).
  4. (d) It is prohibited to participate in any form of harassment via email, telephone or paging, whether through language, frequency, or size of messages.
  5. (e) Employees shall not use MinMax email or computing resources to participate in the creation or the forwarding of “chain letters”, “Ponzi”, or other “pyramid” schemes of any type.
  6. (f) It is prohibited to send passwords with corresponding usernames and other authentication attributes in the same email.

8. User Authentication Policy

8.1 All employees and contractors must comply with the MinMax User Authentication Policy, which provides a secure framework for access to the Company’s computer network and other technical resources.
8.2 This policy applies to all accounts within MinMax, Inc.
8.3
Account Management
1. (a) Account access for terminated users will be revoked as soon as reasonably possible.
2. (b) Employee transfers must follow the Termination and User provisioning process. Transferred user accounts must have all access removed and be rebuilt per the employee’s new manager’s specifications.
3. (c) Regular reviews will be conducted of inactive user accounts.
4. (d) Accounts created for contractors will be active and monitored only during the time period needed to complete work.
5. (e) Domain accounts will be locked for 10 minutes after more than six incorrect login attempts.
6. (f) Regular reviews will be conducted of new accounts created and checked against list of new hires.
7. (g) Access rights for privileged user IDs are restricted to least privileges necessary to perform job responsibilities.
8. (h) Access controls must be implemented via an automated access control system.
8.4
Screen Locking
1. (a) If a session has been idle for more than 15 minutes, require the user to re-enter the password to reactivate the terminal
2. (b) When a user leaves their desk or workstation, they must lock their workstation
8.5
User Responsibility
1. 8.5.1 Any account used on a personal workstation, must follow this policy. It is the user/employee’s responsibility to follow proper password and account management procedures.
8.6
Enforcement
1. 8.6.1 Enforcement of this policy is accomplished through audits and security awareness training. Any desktop/laptop/VM found to be out of compliance may be disconnected from the MinMax network without notice.

9. Exceptions

The Company’s Founding team may grant exceptions to this Policy under certain limited circumstances. Any exceptions to this Policy will be clearly documented and approved.

10. Compliance

Compliance with the terms and provisions contained in this Policy is mandatory and shall be monitored regularly. Company employees and contractors who do not comply with this Policy will be subject to disciplinary action, up to and including termination of employment or contract term. The Company will likewise maintain a strict compliance policy with its consultants, and other third parties that are subject to this Policy. If such parties do not comply with the terms outlined herein, the Company will take appropriate steps towards remediation, up to and including terminating the relationship.

11. Information Security Contacts

11.1 All employees and contractors, regardless of title, level or status, are required to immediately report any information security breach of which they become aware, including, without limitation, any breach of the terms and provisions contained in this Policy. All such reports must be made to the Founding team.
11.2 Security breaches may include, by way of example only, lost or stolen computer or other Company equipment breaches of employee or contractor information, breaches of customer information, including, without limitation, credit card information, or phishing or other similar suspected information security scams.
11.3 If you have any questions or need clarification on this Policy or any of the terms described herein, please contact the Founding team: anthony@minmax.co.