Cvent Vendor Information Security Measures

In provision of Software and/or Services, the ‘Service Provider or Service Providers’ here forth, may have access to personally identifiable information, sensitive data, payment data, other business information intended to be treated as confidential, including any third party information provided to Service Provider for the purposes of providing the Services ("Customer Information"). Service Provider shall implement technical and organizational measures to protect all Customer Information against unauthorized disclosure, loss and misuse (“Information Security Measures”) as follows:
 

1.    Information Security Plan. Service Provider has a written information security plan that describes its program to protect Customer Information.  As part of the plan, Service Provider:

• a) Shall maintain an Information Security program based on generally accepted industry Information Security standards and frameworks (e.g., the then current version of ISO/IEC 27001 or NIST Cybersecurity Framework).
• b) Designates one or more employees to coordinate its information security program.
• c) Designs and implements a safeguards program, and regularly monitors and tests it.
• d) Selects service providers that can maintain appropriate safeguards, ensures that its contract requires them to maintain safeguards, and oversees their handling of Customer Information; and
• e) Evaluates and adjusts the program considering relevant circumstances, including changes in Cvent’s business or operations, or the results of security testing and monitoring.

2. Employee Management and Training. Service Provider also secures Customer Information by:

• a) Checking references or doing background checks before hiring employees who will have access to Customer Information;
• b) Asking every new employee to sign an agreement to follow Service Provider’s confidentiality and security standards for handling Customer Information;
• c) Limiting access to Customer Information to employees who have a business reason to see it;
• d) Enforcing employees to use “strong” passwords that must be changed on a regular basis; 
• e) Using password-activated screen savers to lock employee computers after a period of inactivity;
• f)  Having policies for appropriate use and protection of laptops, PDAs, cell phones, or other mobile devices;
• g) Training employees to take basic steps to maintain the security, confidentiality, and integrity of customer information, including: 
• i) Locking rooms and file cabinets where records are kept;
• ii) Not sharing or openly posting employee passwords in work areas;
• iii) Abiding by the clean desk and clear screen policy;
• iv) Encrypting sensitive customer information when it is transmitted electronically via public networks;
• v) Reporting suspicious attempts to obtain Customer Information to designated personnel.
• h) Having policies for employees who telecommute to use protections against viruses, spyware, and other unauthorized intrusions;
• i) Imposing disciplinary measures for security policy violations.
• j) Preventing terminated employees from accessing Customer Information by immediately deactivating their passwords and usernames and taking other appropriate measures.
• k) Security Awareness Training: Service provider shall maintain an Information Security Awareness Program geared to its employees, contractors and relevant third parties to provide understanding for Company’s Information Security Program, common threats and risks to Customer Data resources, as well as fulfillment of their Information Security responsibilities. Security Awareness training shall be conducted on an annual basis, topics covered may include, but are not limited to, Security Policy & Incident Recording, Acceptable Use, Information Classification and Privacy, specifically, concerning GDPR and CCPA, and other applicable global regulations.

3.  Data Protection

• a) Controls to protect Customer Data may include, but are not limited to, the following: Protecting Customer Data in transit and while at rest, by implementing strong cryptography controls using AES-256 for specifically handling PII and Customer financial data.
• b) Service Provider will not store Customer Information on its own systems or media unless required for the services provided to Cvent , if done data  shall be encrypted and all databases logically separated to ensure the confidentiality of Customer Data.
• c) Service Provider will delete any confidential information communicated by Cvent via emails, file shares or other such means immediately after use, via   securely disposing or destroying Customer Data using techniques consistent with NIST 800-88, “Guidelines for Media Sanitization” or other similar industry standards.
• d) Read relevant industry publications for news and emerging threats and available defenses;
• e) Assess third parties on regular basis against security and risk management policies and standards;
• f) Maintain up-to-date and appropriate programs and controls to prevent unauthorized access to Customer Information including by:
• i) Checking with software vendors regularly to get and install patches timely that resolve software vulnerabilities
• ii) Multi-factor authentication over a secured VPN connection to any systems hosting Production Data 
• iii) Processes to provision user access with formally approved authorization using unique authentication IDs per individual 
• iv) Managing and reviewing privileged user access rights on a quarterly basis and performing a full review on an annual basis
• v) Prompt removal of user access upon termination of employee.
• vi) User passwords and other login information used to facilitate user identification and access to Cvent information systems shall be protected from unauthorized access by secure login mechanisms. Passwords shall be required to be changed every ninety (90) days and accounts shall be disabled after a specific number of invalid login attempts.  
• vii) Role-Based Access Controls shall be in place to ensure that only authorized Employees have access to any systems that could store or transmit Customer Data.             
• viii) Using anti-virus and anti-spyware software that updates automatically.
• ix) Maintaining up-to-date firewalls
• x) Regularly ensuring that ports not used for its business are closed; and
• xi) Promptly passing along information and instructions to employees regarding any new security risks or possible breaches.

g. Uses appropriate oversight or audit procedures, including by:

• i) Keeping logs of activity on its network and monitoring them for signs of unauthorized access to Customer Information;
• ii)  Using an up-to-date intrusion detection system to alert its personnel in the event of attacks; and
• iii)  Monitoring both in- and out-bound transfers of information for indications of a compromise, such as unexpectedly large amounts of data being transmitted from its system to an unknown user.

h. Takes steps to preserve the security, confidentiality and integrity of Information in the event of a breach, such as by:

• i) Taking immediate action to secure any information that has or may have been compromised;
• ii) Preserving and reviewing files or programs that may reveal how the breach occurred; 
• iii) Notifying Cvent if any personal information is subject to a breach that poses a significant risk of identity theft or related harm;
• iv) Notifying law enforcement if the breach may involve criminal activity or there is evidence that the breach has resulted in identity theft or related harm; and
• v) Checking to see if breach notification is required under applicable state law.

4. Information Security Standards, Audits and Safeguards: 

a. Cvent Security Audits

• i) During the Term of the Agreement, Cvent will audit Service Provider’s performance of its obligations under the Agreement including without limitation information security obligations. Cvent will give Service Provider at least thirty (30) days prior written notice of any intended audit, and Service Provider shall use commercially reasonable efforts to provide or procure for Cvent access to information, facilities and materials it shall reasonably require to undertake the audit, subject to Cvent requiring the auditor to enter into a reasonable confidentiality agreement with Service Provider restricting disclosure of any of its own or its other customer’s confidential information.
• ii) Service Provider will address to remediate any critical findings identified by Cvent in such audits within mutually agreed upon timeframes  

b. Incident Notification and Response

• i) Service Provider will promptly notify Cvent within forty-eight (48) hours after being aware of any confirmed information security incidents involving the unauthorized disclosure, access or loss of any Customer Information (a “Security Incident”). The notice shall include the approximate date and time of the Breach and a summary of relevant, then-known facts, including a description of measures being taken to further investigate and address the Breach.
• ii) The parties agree with respect to any confirmed Security Incident that (i) Service Provider shall promptly investigate the cause of such Incident and shall at its sole expense take all reasonable steps to (a) mitigate any harm caused, (b) prevent any future reoccurrence, and (c) comply with applicable data breach notification laws including the provision of credit monitoring and other fraud prevention measures.
• iii) Service Provider will continuously scan the information systems connecting to Cvent network with an industry acceptable anti-virus and anti-malware which kept updated. Any systems suspected to be infected shall not be used to connect to Cvent network and will be immediately disconnected by the Service Provider
• iv) Service Provider will allow Cvent to run anti-virus scans on the information systems of the Service Provider used to connect to Cvent network. Any identified issues will be escalated to Cvent and immediate action will be taken to resolve the issue.
• v) Service Provider will be responsible for any damages incurred on Cvent’s data and/or systems arising from the Service Provider’s information systems, employees or network.

c. Security Risk Assessments

• i) Prior to or upon onboarding the Service Provider shall complete Cvent’s online Security Assessment Questionnaire (SAQ) and shall address or provide a plan to address any open risks or vulnerabilities that are discovered during the Security Assessment (SA). The SA and any remediation plan that need to be provided to Cvent shall be completed within 30 calendar days.  
• ii) In addition, the Service Provider shall provide its most recent pen test report and SOC 2 or PCI-DSS Reports and / or ISO 27001 certificate to Cvent prior to onboarding. If there are any open vulnerabilities in the pen test or SOC report, a plan will be provided to Cvent within 30 calendar days to address these. 
• iii) For all new Service Providers, or Service Providers where there is a renewal or an amendment to an existing contract, Cvent will perform a third-party risk assessment (TPRA) by requesting completion of the Security Assessment Questionnaire (SAQ), to ensure that the Service Provider at least meets expected industry security best practices for the services provided to Cvent. This assessment is launched and completed before any contract or MSA is executed or renewed between the two entities.
• iv) For existing Service Providers that provides services to Cvent, the Service Provider understands that Cvent may periodically perform TPRAs to ensure Service Provider continues to maintain industry accepted security best practices.
• v) Service Provider understands that the TPRA will be completed via an online electronic form where answers to assessment questions and evidence artifacts may be uploaded. Cvent will assess the responses and evidence provided and will work with Service Provider to complete the assessment. 
• vi) Service Provider understands that as part of the assessment, Cvent may request external third-party penetration tests that Service Provider may have undergone within the last 12 months. Supplier will conduct penetration tests on its infrastructure and on its web facing application if being provided to Cvent as part of the service, at least once every year and remediate all Critical, High findings in 30 days and Medium findings in 60 days.
• vii) Service Provider understand that as part of the assessment, Cvent may request any letters of certification or attestation letters that Service Provider may have obtained from external audits. Examples of such certifications or letters may include and are not limited to SOC 1, SOC 1, PCI-DSS, ISO 27001, CSA, etc.
• viii) Service Provider shall cooperate with Cvent to complete the assessment in a timely manner
• ix) In the event that Cvent finds issues or risks as a result of the assessment, it will provide Service Provider with a risk report which may require risk mitigation actions or plans by the Service Provider. Service Provider shall cooperate with Cvent to address the risk items and respond to the risk report in a timely manner. 

Information Security Requirements: