Trust Center

Information Security Management Program

We maintain a formally documented Information Protection Program built on a recognized industry framework. This program is actively monitored, reviewed, and updated to ensure continued alignment with BeneLynk's security objectives and threat landscape.

Roles and Responsibilities

We define and communicate user security responsibilities through policies, procedures, and standards covering scope, management expectations, and enforcement. Every position carries an assigned risk profile and screening level reviewed annually to ensure appropriate access and accountability.

Management Responsibilities

We operate a security workforce improvement program, ensuring all personnel maintain the skills required to protect our systems and sensitive data. Management provides training before access is granted, enforces ongoing security expectations, and ensures third parties receive and comply with our privacy and security standards.

Disciplinary Process

We enforce a structured sanctions process for violations of information security policies. When non-compliance occurs, appropriate leaders are notified in a timely manner, and disciplinary actions, including access restriction or termination, are applied based on severity.

Information Security Policy Document

We publish clear security objectives, principles, and control expectations that apply to all users, systems, and data in scope. Our policies align with industry standards and regulatory requirements, providing a foundation for secure business operations.

Review of the Information Security Policy

We maintain a formal process for reviewing, updating, and approving security policies at least annually. Policy owners document proposed changes, assess risk, communicate updates to the organization, and track resolution of any policy-related concerns.

Management Commitment to Information Security

We appoint senior security leadership responsible for implementing and upholding security requirements and ensuring they are appropriately resourced. Our executive team formally approves the organization's risk management and information protection programs and receives ongoing reporting on cybersecurity posture.

Independent Review of Information Security

We conduct independent assessments of our security management program at least annually or whenever material changes affect our environment. Findings are documented, corrective actions are taken, and review records are retained for compliance and audit needs.

Endpoint Protection

Controls Against Malicious Code

We install, operate, and maintain updated anti-virus and anti-spyware on all end-user devices, and systems are automatically scanned on boot and every 12 hours to identify and remove unauthorized software. Server environments that cannot host endpoint anti-malware are protected through a network-based malware detection solution that blocks, quarantines, and alerts administrators upon malicious code detection.

Centralized Anti-Malware Enforcement

We centrally manage anti-malware tools to ensure they cannot be disabled by users, guaranteeing continuous protection across BeneLynk devices and platforms. All endpoints and network entry/exit points operate with up-to-date anti-spam and anti-malware controls.

Real-Time Threat Protection & Response

We perform real-time scanning of files originating from external sources and block or quarantine malicious code in accordance with our security policy. Alerts generated from malware detection are immediately escalated to our administrators to ensure timely remediation.

Memory Protection Against Unauthorized Code Execution

We implement safeguards that protect system memory from unauthorized or malicious code execution. These protections reduce exploit risk and preserve the confidentiality, availability, and integrity of our information systems.

False Positive Handling & System Assessments

We actively address false positives during malware detection and eradication to ensure accurate threat responses. Systems considered statistically unlikely to host malicious software are periodically reassessed to evaluate evolving threat conditions.

Secure Development & Environment Separation

We define clear rules governing the migration of software from development to operational environments. Development, testing, and production systems remain physically or virtually separated to prevent unauthorized access, limit change risk, and protect operational systems.

Portable Media Security

Management of Removable Media

We register portable media devices, including laptops, prior to use and apply restrictions based on data classification to ensure responsible handling. All media containing covered or confidential information is physically and logically protected, using encryption, until it is sanitized or securely destroyed.

Protection During Transport

We protect and control portable media containing sensitive information during transportation outside of controlled environments. These protections ensure that confidential data is not exposed through loss, theft, or unauthorized access while in transit.

Identification of Restricted Media

We formally identify any digital or non-digital media that requires restricted use and clearly document the safeguards that govern that use. This ensures that only authorized individuals may handle sensitive media and that all controls are consistently enforced.

Information Handling Procedures

We label and encrypt media according to its data classification, ensuring portable devices meet the same security standards as core systems. These handling requirements prevent unauthorized disclosure and maintain the confidentiality of sensitive information.

Approval and Documentation of External Data Transfers

We require formal approval for any transfer of classified data outside controlled environments and maintain auditable records of those transfers. These records provide traceability and accountability for every movement of sensitive information.

Mobile Device Security

Encryption & Acceptable Risk

We encrypt mobile devices to protect the confidentiality of stored or transmitted data. If encryption is not technically reasonable or appropriate, we formally document the justification and accept the risk through leadership approval.

Protection of Mobile Computing Devices

We protect all mobile devices with access controls, usage restrictions, encryption, secure configurations, firewalls or equivalent protections, anti-malware tools, and physical safeguards. These protections apply at all times and ensure that devices storing or accessing BeneLynk information maintain strict confidentiality and resilience against compromise.

Approved Application Stores

We maintain a documented list of approved application stores that are allowed for company-managed and BYOD mobile devices that access or store entity or client information. Non-approved stores and applications, including permitted apps not acquired through approved stores, are strictly prohibited.

Prohibition of Security Circumvention

We prohibit jailbreaking, rooting, or any circumvention of manufacturer-built or platform-built security controls on mobile devices. These prohibitions prevent compromised devices from introducing untrusted software, unauthorized system behavior, or high-risk vulnerabilities into our environment.

Monitoring of Unauthorized Connections

We continuously monitor for unauthorized mobile device connections to ensure only approved and managed devices can access corporate systems and data. Any unapproved device attempting to connect is blocked and investigated.

Centralized Mobile Device Management

We deploy a centralized mobile device management (MDM) solution to all permitted devices, enforcing both preventative and detective controls. The MDM platform enables configuration, policy enforcement, compliance monitoring, and security actions from a centralized administrative layer.

Remote Patch & Version Validation

We ensure mobile devices connecting to corporate networks allow remote validation of operating system and software patch levels. This capability guarantees devices remain up-to-date and secure before accessing BeneLynk data or services.

Remote Wipe Capability

We require all authorized mobile devices to support remote wipe so that sensitive data can be destroyed if a device is lost, stolen, or compromised. Remote wipe protects our clients, customers, and internal systems by ensuring no residual data remains accessible.

Telework Site Protections

We implement protections at teleworking locations to prevent theft of equipment, unauthorized disclosure of information, and unauthorized remote access to BeneLynk systems. These protections ensure home-based or remote work environments maintain enterprise-level security standards.

Authorization of Teleworking

We authorize teleworking only when controls and security arrangements align with BeneLynk policies and organizational requirements. If risks or deficiencies are identified, remote work is not approved until those issues are remediated.

Wireless Security

Vendor Defaults Removed

We change all vendor-default settings on wireless access points before they are ever deployed in the organization. This prevents unauthorized parties from exploiting default credentials or preconfigured settings to gain access to our infrastructure.

Strong Encryption Applied

We configure wireless access points with strong encryption, AES WPA2 at minimum, to protect all sensitive communications. This ensures that wireless traffic is shielded from interception and unauthorized disclosure.

Secure Physical Placement

We place wireless access points in physically secure, controlled areas to prevent tampering or unauthorized access. This ensures that only approved personnel can interact with the equipment and reduces the risk of device compromise.

Quarterly Rogue AP Scanning

We conduct quarterly scans to identify unauthorized wireless access points and take prompt remediation actions if any are detected. This proactive monitoring prevents shadow networks from exposing BeneLynk systems and sensitive data.

Firewall Controls on Wireless Traffic

We configure firewalls to deny or tightly control any traffic originating from wireless environments into covered or confidential data zones. This ensures wireless networks remain segmented, preventing lateral access and safeguarding high-risk information.

Configuration Management

Compliance with Security Policies & Standards

We conduct annual compliance reviews using manual or automated tools, and we take corrective action when any non-compliance is identified. We maintain a continuous monitoring strategy supported by independent assessors to track security control performance and ensure long-term alignment with BeneLynk standards.

Security Trend Tracking & Review Documentation

We preserve compliance metrics and review findings to identify organizational security trends and areas of concern. Recommendations from these reviews are formally documented, submitted to management, and approved for remediation.

Technical Compliance Checking

We perform annual technical configuration checks using experienced specialists and industry-standard automated tools, taking immediate action when security deviations are detected. These checks may occur more frequently based on risk and support technical interoperability across our environment.

Change Management

We strictly manage changes to systems, networks, software, and procedures, ensuring all modifications are controlled and archived. Fallback and recovery procedures are in place for unsuccessful changes, providing operational resilience and service continuity.

Control of Operational Software

Only authorized administrators may implement approved software upgrades in accordance with business requirements and documented security considerations. Operational environments contain only approved, supported code, and systems are maintained according to current baseline configurations to prevent misuse.

Vendor Support & Migration Planning

We use supported vendor software versions and maintain current web browsers to ensure optimal security. If any production system becomes unsupported, we provide evidence of a formally approved migration plan to replace it.

Baseline System Protections

We enforce operating system protections such as antivirus, file integrity monitoring, host-based firewalls or port filters, and security logging as part of our baseline standards. Unauthorized (blacklisted) software is blocked from execution, and software usage rules are maintained and reviewed annually.

Software Testing & Version Control

We test applications and operating systems for security, usability, and impact prior to production release. We maintain configuration control of all implemented software, archive prior versions, and log all operational library updates with rollback procedures in place.

Vendor Access Controls

Suppliers are only granted physical or logical access when necessary and with management approval, and all access is monitored. This ensures third-party involvement does not compromise the confidentiality or integrity of BeneLynk systems.

Change Control Procedures

Managers are responsible for ensuring that all proposed system changes are reviewed to confirm they do not compromise operational or system security. We document purpose, scope, roles, responsibilities, and cross-team coordination for configuration management, including mobile devices and critical infrastructure.

Secure Development Requirements

When development is outsourced, contracts must include change-control requirements that track security flaws and flaw resolution, with formal reporting to BeneLynk personnel. We do not permit automated updates on critical systems and rely on approved change management practices to maintain stability.

Configuration Management Planning

We develop, document, and implement a configuration management plan that defines how changes are controlled, enforced, and recorded. Installation checklists and vulnerability scans validate the configuration of servers, devices, and appliances to ensure they meet minimum security standards.

Vulnerability Management

Inventory of Assets

We maintain a complete inventory of assets and services, ensuring proper tracking across their lifecycle, including use, transfer, exchange, and disposal. Asset inventories are aligned to prevent duplication and include owners, custodianship, classification, and protection requirements.

Wireless Access Point Registration

We maintain an inventory of authorized wireless access points (WAPs) along with documented business justification. This enables rapid detection of unauthorized WAPs and swift remediation.

Contractor & Volunteer Asset Controls

We require clear procedures in contractor agreements for assigning and monitoring BeneLynk assets, ensuring accountability for company property. Volunteers receive written agreements specifying inventory expectations and asset return timelines.

Secure Media Sanitization

We document and follow a defined process to wipe data from hard drives before device transfer, exchange, surplus, or disposal. This ensures sensitive data cannot be recovered or misused.

Secure Development Standards

We periodically review and update development procedures, guidelines, and standards under the direction of senior information security leadership. BeneLynk applications are designed according to secure coding practices or undergo appropriate security testing.

Application Vulnerability Testing

We conduct automated vulnerability testing annually on applications that store, process, or transmit covered information. These tests are performed by qualified individuals to ensure continuous resilience against technical threats.

Validation of Data Inputs

We verify data accuracy, completeness, and authenticity as close to the point of origin as possible. In-house software explicitly implements and documents error-checking for all inputs—covering data size, type, acceptable ranges, and format.

Identification, Risk Evaluation & Remediation

We identify and evaluate technical vulnerabilities and correct them in a timely manner using a structured prioritization process. Hardened configuration standards exist for all system and network components to minimize risk exposure.

Patch Management & Disaster Recovery

We test patches before deployment and ensure patches installed in production are replicated in disaster recovery environments. This ensures consistency across critical systems and prevents patch mismatch during recovery events.

Centralized Vulnerability Management Program

We operate a technical vulnerability management program that continuously monitors, ranks, and remediates identified weaknesses. Independent internal and external vulnerability assessments are performed quarterly or after material changes, spanning network and application layers.

Configuration Hardening

We harden systems by enabling only necessary and secure services, ports, and protocols. This principle-of-minimum-exposure approach reduces attack surface and strengthens overall operational resilience.

Threat Intelligence & Awareness

We identify authoritative information sources to track relevant vulnerabilities for all technologies in use. These sources are routinely updated to reflect new assets, evolving risks, and emerging security resources.

Network Protection

Segregation in Networks

We enforce network segmentation using security gateways such as firewalls that filter traffic between domains, block unauthorized access, and separate internal wired, wireless, and external environments. These gateways maintain strong access control boundaries for each network zone, including DMZs and publicly accessible systems.

Logical & Physical Segmentation

We separate public-facing components from internal systems using logically isolated subnetworks based on system function, risk classification, and security requirements. Traffic passing between network segments is restricted to only what is required for business operations.

Deny-by-Default Access

We restrict internal network connections using deny-by-default and allow-by-exception controls at managed interfaces. Connectivity is only permitted when justified by business needs and access control policies.

Firewall-Based Traffic Enforcement

We control network traffic using BeneLynk access control rules enforced by firewalls and network security devices. These controls are applied to each network access point and external telecommunications interface.

Encryption of Transmitted Information

We encrypt information transmitted over open or public networks to protect confidentiality and integrity. This ensures sensitive traffic cannot be intercepted or altered in transit.

Documented Traffic Exceptions

We document network traffic exceptions, including mission need and expiration timelines, and review them annually. Once no longer required, the exceptions are removed to restore full enforcement.

Non-Remote Communication Restriction

Remote devices that connect locally are not allowed to communicate with external remote resources. This prevents unapproved bridging between protected networks and external environments.

Network Routing Control

We implement routing controls using security gateways between internal and external networks. These gateways verify source and destination information, hide internal directory data, and enforce routing rules aligned with access control policies.

Authenticated Proxy Enforcement

We force outbound traffic through authenticated application-layer proxies that log sessions, decrypt traffic when necessary, and block unauthorized URLs, domains, and IP addresses. Proxy whitelisting ensures users can only access explicitly approved destinations.

Sensitive System Isolation

We identify system sensitivity and document it at the application or system owner level. Unless risk is explicitly accepted, sensitive systems are physically or logically isolated from non-sensitive systems.

Current Network Diagram

We maintain an up-to-date network diagram, including wireless environments, updated with any network change and at least every six months. This ensures all network components are traceable, documented, and reviewed.

Wireless Access Monitoring

We monitor for authorized and unauthorized wireless access and prohibit WAP installations without CIO-approved authorization. This prevents rogue access points and unauthorized wireless exposure.

Protection of Network & Services

We safeguard information in transit, enforce network service availability, and prevent unauthorized access to connected services. All equipment on the network is formally managed, including user-area devices.

Device Authentication

We uniquely identify and authenticate devices using shared identity or organizational authentication solutions appropriate to system categorization. Access control lists restrict remote access to authenticated endpoints only.

VoIP Usage Controls

We define VoIP usage restrictions, provide implementation guidance, and ensure service authorization and monitoring. This prevents misuse of voice communications as an attack vector.

Interconnection Authorization

We authorize connections between BeneLynk systems and third-party systems through interconnection security agreements. These agreements document interface characteristics, security needs, and data types transmitted.

Default-Deny Architecture

We apply deny-all, permit-by-exception to external system connections, with host-based firewalls dropping all traffic except explicitly authorized ports and services. This enforces strict perimeter protection at every endpoint.

Secure Virtual Migration

We use encrypted communication channels when migrating servers, applications, or data to virtualized infrastructures. This ensures confidentiality and integrity during the movement of assets.

Network Configuration Change Controls

We test and approve all firewall, router, and switch changes prior to implementation, documenting deviations and business justification. New traffic rules include the responsible owner and an expected duration.

Traffic Minimization

We restrict inbound and outbound traffic to only what is strictly required. Firewall configurations connecting untrusted networks are tracked in the network diagram.

Endpoint Device Identification

We authenticate devices on LAN and WAN using either shared data or organizational credentials appropriate to security classification. This prevents unauthorized hardware from joining the network.

Quarterly Network Scanning

We perform quarterly network scans to identify unauthorized components or devices. Any discovered anomalies are investigated and remediated.

Transmission Protection

We protect the confidentiality and integrity of transmitted information from preparation through receipt. This includes end-to-end safeguards and verified cryptographic controls.

Security of Network Services

We formally manage and monitor services provided by network service providers to ensure secure delivery. Every external interconnection is authorized and documented, and agreements define specific security obligations.

Interconnection Policy

We employ a deny-all, permit-by-exception model (preferred) or allow-all, deny-by-exception when connecting to external systems. Providers must disclose service protocols, functions, and ports used.

Data Protection Responsibilities

Contracts with outsourced providers explicitly require protection of covered information. We review interconnection security agreements on an ongoing basis to verify compliance.

Input Data Validation

We deploy application-layer firewalls for public-facing web applications and network firewalls for non-web public applications. Where encrypted traffic is present, firewalls decrypt or sit behind termination layers to ensure complete inspection.

Transmission Protection

Cryptographic Protection in Transit

We use FIPS-validated cryptographic mechanisms to protect information during transmission and detect any unauthorized alteration. If cryptography cannot be applied, we enforce alternative physical safeguards to maintain confidentiality and integrity.

Formal Safeguards Prior to Exchange

We assess and implement multiple safeguards before allowing the use of information systems for data exchange. These safeguards ensure that both BeneLynk and any participating external organizations protect shared information.

Terms for External System Use

We define clear terms and conditions for authorized individuals accessing BeneLynk systems from external platforms or using external systems to store, process, or transmit BeneLynk data. These conditions align with established trust relationships and clearly limit how information can be handled.

Cryptography for Remote Access

We use cryptographic controls to protect the confidentiality and integrity of all remote access sessions to internal and external systems. These protections ensure sensitive information is never exposed during remote connectivity.

Strong Protocols on Public Networks

We use strong cryptography protocols to secure confidential or covered information when transmitted over open or untrusted networks. This prevents interception, disclosure, or tampering during transmission.

Communication Governance & Audits

We incorporate exchanges of information and communication requirements into enterprise policies and audit them for compliance. This ensures that security expectations are not just defined but are continuously enforced.

Conditions for External Access

We allow remote access to BeneLynk systems and information assets only under clearly defined terms and conditions. These terms specify the responsibilities and limitations of access for assets we do not control.

Portable Media Restrictions

We restrict the use of organization-controlled portable storage media on external systems. This prevents uncontrolled data transfer and reduces the risk of information leakage.

Collaborative Device Activation

We prohibit remote activation of collaborative computing devices and require visible indicators when such devices are in use. This ensures in-room users know when remote viewing or recording is active.

Approval for Public Messaging Platforms

We require formal approval before using external public services such as instant messaging or file sharing. This guarantees that communications platforms are reviewed and aligned with security expectations.

Stronger Authentication for Public Access

We implement stronger authentication controls when accessing systems from public networks. This reduces the risk of account compromise or unauthorized access.

End-to-End Message Security

We apply cryptographic protection to electronic messages throughout their entire transport path unless an approved alternative safeguard exists. This ensures message confidentiality from origin to delivery.

No Sending of Unencrypted Sensitive Data

We never send unencrypted sensitive information via end-user messaging technologies such as email, IM, or chat. All sensitive communication must be secured using approved, enterprise encryption methods.

Data Classification Prior to Transaction

We verify whether data used in online or e-commerce transactions contains covered information before processing. This ensures controls match the sensitivity of the data involved.

End-to-End Transaction Security

We maintain security throughout the entire transaction lifecycle, from initiation to completion. All communication protocols are protected using cryptographic techniques such as SSL or equivalent.

Secure Storage of Transaction Records

We store transaction records in controlled, non-public environments such as BeneLynk intranet storage. Records are never retained on media that is publicly accessible from the internet.

Trusted Authority Integration

Where digital signatures or certificates are used, we embed security throughout the full trust authority lifecycle. This ensures protected issuance, validation, rotation, and revocation.

Protocol Upgrades

We promptly adopt updated communication protocols when vulnerabilities are discovered. This ensures BeneLynk uses continually hardened methods for secure data exchange.

Encryption Policy

We use encryption to protect confidential or covered information across communication channels and on mobile/removable media based on predetermined criteria. This ensures sensitive data remains unreadable to unauthorized parties.

Key Management

We enforce a structured key management program with clearly assigned roles and responsibilities. Key lifecycle operations comply with relevant national and international restrictions and regulations.

Password Management

Passwords Not Displayed

We ensure passwords are never displayed when entered into systems or applications. This prevents shoulder-surfing, accidental exposure, and unauthorized viewing during authentication.

Cryptographically Protected Passwords

We transmit passwords only through cryptographically secured channels and store them using approved hashing algorithms. This guarantees that credentials remain unreadable and resilient to compromise even if intercepted.

No Unprotected Distribution

We do not use third parties, email, or other unprotected methods to disseminate passwords. This eliminates exposure risk and ensures all credential delivery follows controlled, audited, and secure channels.

Acknowledgement of Credentials

Users must formally acknowledge receipt of their passwords. This provides traceability and reinforces user accountability for credential confidentiality.

Mobile Device Password Enforcement

Password requirements for mobile devices are documented and enforced through technical controls on company devices and approved BYOD devices. These controls restrict users from lowering password length, complexity, and other authentication standards.

Identity Verification Before Reset

We verify user identity before performing any password resets. This ensures that only the legitimate account owner can obtain password recovery support.

Default & Temporary Password Change

We change default passwords whenever compromise is suspected, at first login after issuance, and immediately following account recovery. This ensures no account continues operating under shared, weak, or known credentials.

Weak & Compromised Password List

We maintain a list of commonly used or compromised passwords and update it at least every 180 days or after any suspected breach. Users are allowed to choose long passwords or passphrases, and automated tools verify new passwords are not on the prohibited lists.

Automated Logon Restrictions

We do not allow passwords to be stored as part of automated log-on mechanisms. This prevents unauthorized local access and credential theft from saved authentication caches.

Encryption in Transit and Storage

Passwords are encrypted at all times, both in transit and at rest across all system components. This ensures credentials cannot be intercepted or extracted through direct storage access.

User Confidentiality Agreement

Users sign a confidentiality statement acknowledging responsibility for protecting their passwords. This reinforces behavioral expectations and provides a documented basis for accountability.

Temporary Passwords

We generate temporary passwords that are unique and non-guessable. These credentials are designed solely for short-term access and must be replaced immediately.

Access Control

User Registration

We maintain a current listing of all workforce members, including employees, contractors, vendors, and partners, who have access to sensitive information. User identities are verified before creating accounts, and default or unnecessary accounts are removed or secured.

Account Lifecycle Management

Account managers are notified when user access rights change and modify accounts accordingly. Registration and deregistration formally govern activation, modification, review, disabling, and removal of accounts.

Least Access Before Grant

We validate authorization and minimum access levels prior to granting access and ensure access is appropriate to business need and does not violate segregation of duties. Inactive accounts are automatically disabled, and critical access is removed when roles change.

User Access Documentation

Users receive written statements outlining their access rights and must sign acknowledging the conditions of that access. Guest, anonymous, shared, emergency, and temporary accounts are specifically authorized and continuously monitored.

Account Type Classification

We classify account types, including individual, group, system, application, and temporary, and establish rules for group membership. Shared credentials, if allowed at all, are modified when members leave, and generic accounts are only used in exceptional and approved circumstances.

Privilege Management

Privileges are formally authorized, controlled, and allocated on a need-to-use and event-by-event basis per job function. Role-based access control maps each user to roles and roles to system functions.

Default Deny

All systems storing, processing, or transmitting covered information are configured with a default deny-all access setting. Elevated privileges use separate accounts and are minimized to only what is required.

Privilege Restriction

We promote solutions that eliminate the need for elevated privileges and restrict access to privileged functions and security-relevant information. Information sharing is facilitated only for authorized users with appropriate protections.

Review of User Access Rights

We maintain a documented list of all authorized users and review privileged accounts every 60 days and all other accounts every 90 days. Access rights are reassessed after any role change and reallocated as needed.

Clear Desk & Clear Screen

Covered or critical business information may not be left unattended on desks, printers, fax machines, or displays. These protections extend to internal and external mail services to prevent unauthorized access.

External Connection Authentication

We require strong authentication for all external access to BeneLynk systems, disable unused vendor access, and authenticate both users and devices for wireless access to sensitive systems. Remote access across public networks is only permitted after successful identification and authentication.

Encrypted Remote Access

We enforce encryption such as VPN or private lines and log all remote access to BeneLynk networks. Vendor user IDs are reviewed at least annually and checked for unauthorized dial-up capabilities.

Remote Diagnostic / Configuration Ports

Physical diagnostic and configuration ports are controlled through key locks and supporting procedures. Non-required ports, services, and applications on systems are disabled or removed to prevent misuse.

User Identification & Authentication

Every user, organizational or external, is uniquely identified and authenticated. Privileged functions require separate accounts, and shared or generic IDs are only used in tightly controlled, pre-approved scenarios.

Replay-Resistant Controls

We employ replay protected authentication mechanisms, such as OTP, nonces, or timestamps, and implement multifactor authentication. PKI authentication validates certificates, enforces private key control, and maps identities to accounts.

Session Timeout

Sessions pause after 15 minutes of inactivity and close after 30 minutes, requiring re-authentication. BYOD and company devices use enforced auto-lock controls.

Information Access Restriction

Access to applications and functionality is restricted consistent with the access control policy, and inter-application permissions are controlled. Covered information outputs are limited to the minimum necessary and only delivered to approved terminals.

Remote Data Protections

Sensitive data cannot be copied, moved, printed, or stored remotely without a defined business need. Covered information is encrypted at rest in non-secure environments or otherwise documented with justification.

Removal of Access Rights

When employment status changes, physical and logical access—passwords, keycards, badges—are removed or modified within 24 hours, and old accounts are closed within 90 days of issuing new ones. Rights are reduced or removed prior to termination when risk factors warrant.

Immediate Revocation for Risk

For high-risk cases, we immediately remove access and escort terminated individuals if necessary. Automated alerts notify assigned personnel when access removal events occur.

Prevention of Misuse of Information Assets

All employees sign acceptable use agreements before being granted access to information assets. Login banners display terms and conditions of access and must be accepted to proceed.

Audit Logging & Monitoring

Monitoring System Use

Centralized Monitoring and Validation

We aggregate log and monitoring data from multiple sources and regularly test our monitoring and detection processes to validate effectiveness. We remediate deficiencies, improve methods, and meet all legal requirements associated with both authorized and unauthorized access monitoring.

Documented Review Practices and Automated Detection

We document how frequently logs are reviewed, how evidence is recorded, and the qualifications of the personnel performing reviews. Automated systems monitor anomalous events and security indicators across BeneLynk's environment and are reviewed on a consistent schedule.

Event-Level Tracking of Security-Relevant Behaviors

Our systems identify irregularities that may signal malfunction or compromise and ensure the environment functions in an optimal, resilient state. Monitoring includes privileged operations, failed access attempts, deactivated accounts, and system alerts or failures.

Efficient Event Reduction and Coordinated Response

We employ log-reduction and reporting capabilities to ensure data can be analyzed efficiently. We respond to physical security incidents and coordinate investigations with BeneLynk's incident response team.

Role Separation to Prevent Unauthorized Modification

We implement separation of duties to reduce unauthorized or accidental modification of information and systems. No single person may access or modify information systems without appropriate authorization and visibility.

Independence of Oversight Activities

We keep security audit activities independent and define duties and responsibilities in role descriptions. Initiation of an event is separated from its authorization to reduce fraud and collusion risks.

Defined Access Limits and Incompatible Function Separation

We identify duties that require segregation and define access authorizations that support those separations. Incompatible functions are split across multiple users to prevent misuse and minimize operational risk.

Administrator & Operator Logs

We ensure administrator and operator system activities are logged at a level that supports analysis and accountability. These logs are reviewed regularly to detect unauthorized configuration changes or misuse.

Prevention of Misuse of Information Assets

We provide clear notice that user actions may be monitored, and all employees must consent to this monitoring prior to system use. This establishes transparency, agreement, and compliance with our security standards.

Comprehensive Activity Logging

We generate secure audit records for all activities involving covered or confidential information, covering create, read, update, and delete events. Each record includes user identity, subject identity, performed function, and timestamp.

Privileged Account Log Requirements

Privileged-user activities include success/failure indicators, affected systems, associated processes, and supporting event metadata. Audit log retention periods are formally defined and enforced.

Operational System Logging & Message Metadata Tracking

We maintain logs of messages sent and received, including date, time, origin, and destination, but never message contents. Auditing remains active while systems are operational and tracks access attempts, security configuration changes, authentication mechanisms, alarms, and system-level object actions.

Retention and Justification of Logged Events

Audit records are retained for 90 days and archived for one year thereafter. We provide rationale for why audited events support forensic investigation and review that rationale annually.

Availability, Review Frequency & Enforcement

This policy is available to all employees and accessible within the BeneLynk policy repository. The document is reviewed annually or when operational needs require changes. Compliance is enforced by Leadership, Compliance, and Human Resources, and violations may lead to disciplinary action up to and including termination. Review history and policy revisions are fully documented and retained.

Education, Training, and Awareness

Mobile Computing & Communications Training

We train personnel using mobile computing devices on risks such as theft, shoulder-surfing, and unauthorized physical access. Users are taught the controls implemented to protect data and their responsibilities when using mobile devices in any environment.

Teleworking Training

We train personnel who telework on the risks, the applicable controls, and their responsibilities in remote environments. This ensures individuals working outside corporate facilities understand how to safeguard BeneLynk information and systems.

Initial and Role-Based Training Requirements

We provide documented initial security and privacy training to employees and contractors within 60 days of hire, followed by annual and ongoing role-based training. Specialized incident response and contingency training is delivered within 90 days of role assignment, upon system changes, and every 365 days thereafter.

Structured Enterprise Training Program

We maintain a formal awareness and training program that identifies who receives training, the types of training required, the frequency of delivery, and how training is performed. This program ensures personnel are continuously educated in alignment with organizational risks, control changes, and evolving best practices.

Leadership-Specific Training

We ensure senior executives receive training specific to their roles and responsibilities. Leadership-level training equips them to make informed risk decisions and effectively oversee BeneLynk's information security posture.

Security Responsibilities in Onboarding

We incorporate dedicated security and privacy awareness training into the onboarding program, tracking completion and highlighting recognition and reporting of potential insider threats. Employees formally acknowledge their security and privacy responsibilities upon completion.

Annual Program Evaluation & Targeted Skill Development

We conduct annual internal reviews to assess the effectiveness of the security and privacy education program and update it based on the organization's risk assessments. Targeted training is provided to personnel with elevated responsibilities, such as system developers and business unit security points of contact.

Training for Secure Information Handling

We train our workforce on proper storage of covered information to ensure data remains in approved locations. This reinforces confidentiality requirements and prevents inadvertent data exposure.

Prevention of Misuse of Information Assets

We inform employees and contractors in writing that violations of BeneLynk's security policies will result in sanctions or disciplinary actions. This formal notification ensures individuals understand the consequences of misuse and encourages responsible stewardship of company resources.

Acceptable Use of Assets

We define clear rules describing user responsibilities and acceptable behavior for communication technologies, including email, internet, mobile devices, social media, and facility usage. Employees, contractors, and third-party users understand the boundaries of acceptable system use and remain accountable for all activities under their assigned credentials.

Controls Against Malicious Code

We prohibit the installation of unauthorized software, including downloads from external networks, and train users on these restrictions. This helps reduce malware exposure and preserves a secure computing environment.

Information Exchange Practices

We educate personnel on leading principles for exchanging information across verbal, paper, and electronic channels. This ensures users consistently apply secure handling procedures regardless of communication medium.

Crisis Management Awareness

We provide employees with crisis management awareness and training to ensure they understand how to respond when operational disruptions occur. This preparedness strengthens BeneLynk's ability to maintain continuity during security incidents or business emergencies.

Availability, Review, & Enforcement

This policy is accessible to all users via BeneLynk's SharePoint and reviewed annually, or as needed following revision or organizational change. It is enforced by Leadership, Compliance, and Human Resources, and violations may result in disciplinary action, including access restriction, suspension, or termination.

Third Party Assurance

Restricted Access Until Due Diligence Is Completed

We do not permit external parties to access BeneLynk systems or information until due diligence is completed, appropriate controls are implemented, and a signed agreement acknowledges their security obligations. Remote access connections between BeneLynk and third parties are encrypted, and access is limited to the minimum necessary for the shortest duration required.

Formal Risk Evaluation & Ongoing Assurance

We evaluate external party risks using a defined set of review criteria, including interviews, documentation review, certifications such as HITRUST, and other formal vetting processes. We obtain annual assurances that reasonable information security is maintained across the entire information supply chain.

Defined Responsibilities and Access Conditions

We ensure customers understand their rights, obligations, and liabilities before accessing, processing, or managing BeneLynk information or assets. Access is not granted until required controls are implemented and, where feasible, a signed contract defines service terms, legal responsibilities, asset protections, access parameters, and intellectual property rights.

Security Requirements Reflected in Agreements

All security requirements resulting from work with customers or internal controls are reflected in the associated agreements. When customers access computing assets such as kiosks, websites, or terminals, we prominently provide the BeneLynk privacy policy and user responsibility requirements.

Customer Authentication for Information Access

We employ a formal identity authentication mechanism before granting customer access to covered information. This requirement ensures accountability and prevents unauthorized system access.

Standardized Agreements with Embedded Security Controls

We maintain standardized third-party agreements that embed required security controls aligned with BeneLynk policies. These agreements explicitly assign responsibility for data protection and require suppliers to mitigate risks associated with information and communication technologies, including cloud services and supply chains.

Personnel Security Requirements and Screening Mandates

Agreements include indemnification terms to prevent misunderstanding between BeneLynk and the third party and clearly define personnel security requirements. We require a complete screening process for contractors and third-party users and mandate notification procedures for incomplete screening, screening concerns, and personnel changes.

Access Limitations and Contract Lifecycle Controls

We document limitations of access, compliance auditing procedures, penalties, and mandatory notification of third-party personnel transfers or terminations. These measures ensure continuous control over third-party access across the contract lifecycle.

Contractual Security Requirements

We manage service delivery through contracts or service-level agreements that define security controls, legal liabilities, services provided, protection of assets, and operational expectations. BeneLynk may restrict the physical location of facilities that process or store covered information to ensure compliance with regulatory and contractual obligations.

Maintained Provider Inventory and Annual Review

We maintain a current list of service providers and review it annually, documenting the services each provider performs. We ensure continuity, transition stability, and security considerations are addressed whenever services or systems are acquired or replaced.

Data Protection Obligations

Service providers must protect company data with reasonable controls designed to detect, prevent, and mitigate risks. These security requirements are enforced throughout the duration of the engagement.

Monitoring and Review of Third-Party Services

We monitor third-party performance against their contracts or SLAs at least annually. Progress meetings are held as needed to review operational reports, audit logs, security incidents, disruptions, and identified issues. We audit network services to verify that providers implement required security features and meet current regulatory and organizational standards. We maintain an active service management process to monitor compliance and detect abnormalities or violations.

Outsourced Software Development

We require formal contracts for outsourced development that clearly define application ownership and security responsibilities. The development lifecycle is monitored and includes independent security review and code analysis to prevent vulnerabilities from entering production.

Availability, Review, and Enforcement

This policy is accessible to all users via BeneLynk SharePoint and is reviewed annually, or on an as-needed basis following program or regulatory changes. It is enforced by Leadership, Compliance, and Human Resources, and violations may result in disciplinary action including access restriction, suspension, or termination.

Incident Management

Documented and Fair Sanctioning Process

We apply sanctions fairly following verified security policy violations and document every step of the investigation process, including involved personnel, timelines, notifications, rationale, and final outcomes. We maintain a record of employees involved in incidents and the corresponding resolution.

HR-Led Oversight and Leadership Notification

A designated HR contact manages employee security incidents and notifies the CISO or their delegate when formal sanctions are applied. This ensures consistent oversight, transparency, and traceability in disciplinary actions.

Prevention of Misuse of Information Assets

We require management approval for use of information assets and take immediate action when unauthorized activity occurs. This ensures misuse is detected, addressed, and prevented from recurring.

Defined Reporting and Escalation Requirements

We maintain a formal incident response program that defines how breaches and anomalies are reported, escalated, and treated across the organization. Reporting standards specify notification timelines, required information, and escalation procedures to external parties, law enforcement, and regulatory bodies when required.

Centralized Points of Contact & Insider Threat Coordination

We provide a highly visible point of contact for reporting security incidents and maintain third-party contact information for rapid communications. An insider threat program is maintained with a cross-discipline incident handling team.

Cooperation & Anonymous Reporting

Employees cooperate with state and federal investigations, and disciplinary action is taken against those who refuse. Anonymous reporting channels are provided to promote transparency and reduce fear of retaliation.

Defined Roles, Reporting Paths, and Forensic Support

We formally define incidents, roles, responsibilities, reporting paths, third-party breach handling, and forensic support requirements. Job titles and duties are assigned to specific individuals responsible for incident handling and decision-making.

Training and Automated Alert Integration

All employees, contractors, and third-party users receive incident response training so they know how to report security events immediately and to whom. Alerts from IDS/IPS systems are used as detection sources and feed incident reporting workflows.

Formal Incident Response Ownership

We design and maintain our incident response program to prepare for a broad range of cybersecurity incidents. A designated coordinator manages all phases of incident response with authority to direct required actions.

Annual Review and Capability Validation

We regularly test and exercise incident response capabilities and review the incident management plan annually. The plan formally defines scope, roles, management commitment, interdepartment coordination, and compliance requirements.

Regulatory Reporting and Communication Requirements

We track unauthorized disclosures of covered information and submit annual logs to appropriate regulatory bodies. Incident response plans are communicated to relevant personnel and supported through coordinated simulations.

Coordinated Exercises and Managed Execution

Exercises are executed and documented at least annually and include incident handling team members to reinforce readiness. Incident response is formally managed and includes all required elements for containment, communication, and remediation.

Learning From Information Security Incidents

Post-Incident Analysis and Process Refinement

We analyze outcomes from security incidents to identify repeat patterns and update our response and recovery strategies. This ensures our program continuously evolves to reduce recurrence and strengthen protections.

Structured Improvement to Incident Handling Capability

Our incident handling capability covers policies, defined roles, technical and business procedures, reporting, retention, and integration with vulnerability management. We coordinate incident response with contingency planning to maintain operational continuity.

Lessons Integrated Into Training and Procedures

We incorporate lessons learned from incidents and industry developments into training, exercises, and procedural updates. This continuous improvement approach ensures BeneLynk maintains a modern and resilient incident response posture.

Incident Types

We prepare for a wide range of cybersecurity incident types, including data theft, unauthorized access, insider threats, malware outbreaks, and ransomware. Additional categories include vendor or network DDoS, remote compromise, website defacement, targeted phishing, and corporate espionage.

Availability, Review & Enforcement

This policy is accessible to all users via BeneLynk SharePoint and is reviewed annually, or earlier when required by program changes. It is enforced by Leadership, Compliance, and Human Resources, and violations may result in disciplinary action up to and including termination.

Business Continuity & Disaster Recovery

Defined Backup Levels and Restoration Testing

We maintain regular backups of information and software and test both media and restoration procedures at appropriate intervals. Each system has a defined backup level specifying restoration methods, scope, frequency, and retention that aligns with contractual, legal, regulatory, and business requirements.

Secure Off-Site Storage and Inventory Tracking

Backup copies are stored in secure remote locations with physical and environmental controls sufficient to isolate them from primary-site damage. Comprehensive inventory records track the content and physical location of every backup asset.

Vendor-Managed Backup Controls and Availability

When backups are provided by third parties, service agreements include documented protections to ensure confidentiality, integrity, and availability. All backups are tracked using automated tools, and potential access issues, especially during regional disasters, are identified and mitigated.

Encrypted Retention of Sensitive Data

Covered or confidential information is always backed up in encrypted format to safeguard confidentiality. This ensures breach-resistant retention even in the event of system compromise or physical exposure.

Identification of Critical Business Processes

We identify critical business processes requiring continuity and assess events that can disrupt operations, including equipment failure, human error, theft, natural disasters, terrorism, and service outages. A risk assessment is performed to determine probability, impact, and recovery parameters, followed by a continuity strategy endorsed by management.

Integration of Security Requirements Into Operations

We integrate information security continuity requirements into all aspects of operational continuity, including staffing, facilities, materials, and logistical dependencies. Business impact analyses evaluate consequences of disasters, security failures, service loss, and overall availability impacts.

Annual Assessment With Business Owner Participation

Annual continuity risk assessments are performed with full participation from business process owners and cover all business processes, not only information systems. These assessments quantify and prioritize risks against business objectives, allowable outage windows, critical resources, and recovery priorities.

Timely Recovery Under Secure Conditions

We recover and restore business operations within the timeframes required by business objectives while maintaining security protections. Transaction-based systems implement transaction recovery capabilities to maintain data integrity during restoration.

Defined Responsibilities and Plan Distribution

The contingency program defines required capacity, identifies critical missions, establishes recovery priorities, and assigns roles and responsibilities. Copies of business continuity plans are distributed to key contingency personnel to ensure readiness and rapid response.

Alternate Site Planning and Resilience Controls

We identify potential accessibility issues with alternate storage sites during area-wide disruption and maintain documented mitigation actions. Permanent or temporary alternative processing sites are located at sufficient physical distance and configured with equivalent security, SLAs, recovery time objectives (RTOs), and continuity provisions.

Backup Infrastructure and Secure Plan Storage

Emergency power and backup telecommunications are available at the primary site to maintain resilient operations. Business continuity planning defines acceptable data loss, roles, responsibilities, and processes, and all continuity plans are stored in a secure remote location.

Plan Ownership and Defined Responsibilities

We maintain at least one business continuity plan, each with a defined owner, defined continuity approach, and clear escalation conditions. Plans specify responsible individuals for each component and nominate alternates as necessary.

Updated Emergency and Fallback Procedures

Emergency procedures and fallback arrangements are updated when new business or operational requirements emerge. Manual fallback, emergency operations, and resumption plans are owned by business resource owners, and alternative technical service arrangements are maintained by service providers.

Plan Per Business Unit

Every business unit creates and maintains at least one business continuity plan, and continuity requirements are incorporated into all system changes and program modifications. Plans address minimum security requirements, temporary operating procedures during recovery, and role-based execution responsibilities.

Availability, Review, & Enforcement

This policy is accessible to all users via BeneLynk SharePoint and reviewed annually or as needed for policy revisions. Enforcement is performed by Leadership, Compliance, and HR, and violations may result in disciplinary action, including suspension, restricted access, or termination.

Risk Management

Formal Assessment Frequency

We perform formal risk assessments at consistent intervals and whenever major changes to the environment occur, and we review the results annually. Comprehensive risk assessments are updated every two years, with subsets of security controls evaluated every 365 days during continuous monitoring.

Risk Review Before Authorization

We update risk assessments before issuing new authorizations to operate or within three years, whichever comes first, to ensure decisions are based on current risk conditions. The organization updates its privacy, security, and risk management program to reflect changes to the threat landscape.

Formal Risk Treatment Methodology

We apply a formal risk treatment methodology with defined criteria for corrective actions across the security program and organizational systems. All remedial information security actions are documented, prioritized, and tracked to ensure meaningful mitigation.

Layered Controls Against Identified Risks

We mitigate any harmful effect identified from improper use or disclosure of sensitive information by BeneLynk, its partners, vendors, or contractors. We implement integrated layered controls, including preventative, detective, corrective, and compensating measures, to address identified risks.

Risk Treatment Plan Maintenance

We maintain a risk treatment plan that identifies risks, nonconformities, resources, responsibilities, and priorities. This plan is reviewed and updated regularly to ensure evolving risk scenarios are appropriately addressed.

Annual and Event-Driven Risk Reassessment

We re-evaluate risk assessments at least annually or when significant environmental changes occur. This ensures real-time alignment of security posture with operational realities.

Risk Assessment Integrated Into Change Control

We integrate risk management with the change management process so that assessments guide approvals and decisions related to system modifications. Risk assessments are performed whenever changes may significantly impact security conditions and are incorporated into the change workflow.

Risk Review Prior to Authorization

Before any system is granted authorization to operate, we update the risk assessment to reflect current conditions. This includes authorization reevaluation within three years or whenever events materially affect authorization status.

Defined Security Foundation

We formally define purpose, scope, roles, responsibilities, management commitment, and compliance expectations when implementing system integrity requirements. Security controls are incorporated into systems and supplemented with manual controls when appropriate.

Requirements Embedded Into Contracts

Security requirements reflect the business value of the information and potential business damage from control failures. Supplier and acquisition contracts include identified security requirements to ensure protective measures are upheld through the supply chain.

Requirements Govern Purchasing & Architecture

If a proposed product cannot meet required controls, we reconsider risks before acquisition and disable or mitigate additional functionality when it introduces risk. Developers identify ports, protocols, functions, and services early in the lifecycle to support secure architecture decisions.

Lifecycle Security Principles Applied

We protect secure development environments across the entire lifecycle and apply proven information security engineering principles in design, development, implementation, and modification phases. Security and privacy are addressed in all stages of the project management methodology.

Verification, Testing, and Independent Review

We perform thorough software testing and verification during system development and conduct independent acceptance testing proportional to system importance. Commercial software used to store or process covered information undergoes assessment or certification by qualified assessors prior to implementation.

Availability and Resilient Architectures

We incorporate availability requirements and evaluate redundant architectures when acceptable uptime cannot be guaranteed. Automated controls are preferred and supplemented by manual controls where needed.

Integrated Risk Management in SDLC

We integrate security risk management into the SDLC and define roles and responsibilities for every development phase. Requirement definition includes information security requirements, classification, risk assignment, and management approval.

Availability, Review & Enforcement

This policy is accessible to all users via BeneLynk SharePoint and reviewed annually, with additional revisions performed as needed. Enforcement is carried out by Leadership, Compliance, and Human Resources, and violations may result in sanctions up to and including termination.

Physical & Environmental Security

Remote Diagnostic and Configuration Port Protection

We physically protect access to network and diagnostic ports to ensure only authorized individuals can interact with system hardware. This prevents tampering, unauthorized reconfiguration, and unapproved access to sensitive networking equipment.

Facility Access Authorization

We maintain an approved list of individuals authorized to access facilities housing information systems, issue access credentials, and review access lists at least quarterly. Access rights are removed immediately when no longer required, ensuring access never remains active without business justification.

Visitor & Third-Party Controls

We supervise and record all visitor and third-party access unless pre-approved, ensuring that temporary access is continuously monitored. Areas that store or process sensitive information are strictly restricted to authorized personnel.

Infrastructure Modification Documentation

We document and retain records of repairs or modifications to facility security structures, including hardware, locks, walls, and access systems, to ensure accountability. These records support auditability and risk tracking under our retention policy.

Entry/Exit Enforcement & Audit Trails

We enforce physical access authorization at facility entry/exit points, maintain physical access audit logs, and implement additional safeguards in publicly designated areas. Restricted areas and security rooms containing confidential information remain locked and controlled at all times.

Visitor Logs & ID Controls

We maintain a visitor log and review it monthly, with records retained for at least two years. Employees, contractors, visitors, and third parties are required to wear visible identification and provide appropriate documentation upon entry.

Credential Revocation

We revoke or update badges and identification when access requirements change, expire, or are terminated. Keys, access cards, and combinations are returned, disabled, or changed immediately to eliminate unauthorized facility access.

Fire Safety & Suppression

We install fire extinguishers and detectors in accordance with applicable laws and regulations, ensuring life-safety systems meet compliance standards. Our fire prevention and suppression program includes staff training to maintain readiness and reduce the impact of fire events.

Environmental Security Governance

We formally define the scope, responsibilities, management commitment, coordination requirements, and compliance expectations for our physical and environmental protection program. This includes consistent oversight across sites and alignment to enterprise risk management.

Threat Awareness

We proactively identify environmental and structural risks caused by neighboring premises or surrounding areas. This ensures early mitigation of external threats that may compromise BeneLynk's safety or integrity.

Maintenance Governance

We clearly define scope, responsibilities, and compliance expectations for our equipment maintenance program. Maintenance is performed by authorized personnel following supplier guidance, insurance policies, and BeneLynk standards.

Vendor & Supervised Access

We maintain a list of approved maintenance organizations and ensure non-escorted personnel receive appropriate authorization. Qualified BeneLynk staff supervise third parties lacking required access credentials.

Remote Maintenance Controls

We monitor and control non-local maintenance and prohibit remote diagnostic activity unless explicitly authorized in writing by the CIO or a designated representative. This prevents unauthorized remote intervention and ensures high-risk operations remain auditable.

Recovery Planning & Spare Components

We obtain maintenance support and replacement parts for critical system components within their defined Recovery Time Objectives. This supports continuity and ensures timely restoration of critical services.

Secure Pre-Maintenance Procedures

Covered or confidential information is cleared from equipment prior to servicing unless explicitly authorized. Maintenance records are retained, and security controls are validated following every service action.

Secure Disposal or Re-Use of Equipment

We securely sanitize physical and electronic media containing covered or confidential information before reuse or destroy the device if sanitization is not feasible. Surplus equipment is stored securely and sanitized or disposed of when no longer required.

Secure Disposal Practices

We securely dispose of media containing sensitive data and apply disposal methods appropriate to the classification level. When external vendors manage disposal, we verify they use adequate security controls and industry-standard destruction practices.

Minimizing Aggregation Risk

We actively minimize aggregation risk, preventing large volumes of otherwise non-sensitive data from becoming sensitive through accumulation. This ensures disposal volumes never inadvertently increase confidentiality exposure.

Availability, Review & Enforcement

This policy is available to all employees via BeneLynk SharePoint and reviewed annually or as required following revisions. Enforcement is carried out by Leadership, Compliance, and Human Resources, and violations may result in suspension, restricted access, or termination.

Data Protection & Privacy

Security When Dealing With Customers

We provide the public access to information regarding BeneLynk's security and privacy activities and maintain open communication channels with our senior security and senior privacy officials. This transparency ensures customers understand how their information is protected and who is accountable for its safeguarding.

Governed Security Categorization

Designated senior management reviews and approves the organization's data categorizations and associated protection guidelines. This ensures information is classified appropriately and security controls are correctly aligned with record sensitivity.

Six-Year Documentation Retention

We retain copies of issued privacy notices and written acknowledgements for six years, along with documentation of good-faith efforts to obtain those acknowledgements. This requirement ensures regulatory compliance and traceability.

Documented Restrictions

We document and maintain written restrictions for a minimum of six years, whether stored physically or electronically. This guarantees that all access limitations remain enforceable and auditable.

Access Request Records

We maintain designated record sets subject to individual access, along with the titles of responsible personnel, for at least six years. This maintains accountability for how personal data is managed and accessed.

Accounting of Disclosures

We maintain disclosure accountings for six years, including all information required for disclosure and the responsible processing personnel. This ensures every release of protected data remains traceable and compliant.

Protection of High-Value Records

We protect critical organizational records, contracts, personnel files, financial data, and client/customer information against falsification, loss, or destruction. These records are safeguarded using access controls, encryption, backup storage, electronic signatures, and secure facilities.

Record Ownership Guidelines

We issue and enforce guidelines covering the ownership, classification, retention, storage, handling, and destruction of all records and information. These guidelines create consistent expectations and eliminate ambiguity in how data is managed.

Formal Retention Program

We maintain a formal record retention program to preserve the integrity and compliance of organizational documentation. Specific storage, access, retention, and destruction controls are implemented to ensure appropriate handling.

Long-Term Retention of Individually Identifiable Information

Where required by law, individually identifiable information is preserved for 50 years following the individual's date of death. This ensures adherence to federal and HIPAA retention obligations.

Encryption at Rest

We protect the confidentiality and integrity of covered or confidential information at rest with encryption appropriate to its storage medium. If encryption is not used, documented rationale and compensating controls are reviewed annually by the CISO.

Qualified Data Protection Officer

We assign a qualified data protection officer who reports to senior management and is fully responsible for protecting covered and confidential data. This ensures accountability at the highest level of compliance.

Protected Transfers

We ensure records containing sensitive personal information are protected during transfer to authorized organizations. These protections prevent unauthorized disclosure or interception.

Minimum Storage Practice

We minimize storage of covered and confidential information to reduce exposure, privacy risk, and regulatory burden. Data is retained only when necessary and in approved locations.

Authorized Storage Locations

We specify where covered and confidential information may be stored, and approved technologies enforce this. Technical controls prevent data from being stored outside organization-approved repositories.

Consent for Disclosure

When required, we obtain explicit consent prior to emailing, faxing, verbally communicating, or otherwise disclosing PII to external parties. This ensures individuals understand how their information is used and shared.

Retention Limits

We retain covered information only as long as required by business need, contractual obligations, or regulation. This reduces unnecessary storage and limits long-term exposure.

Technical Storage Enforcement

We implement technical controls that ensure covered data is stored only in organization-approved environments. These controls block unauthorized storage paths and trigger alerts for improper data placement.

Availability, Review, & Enforcement

This policy is available to all users via BeneLynk SharePoint and updated following any revisions. It is reviewed annually and on an as-needed basis to ensure it remains aligned with evolving privacy and regulatory obligations. Compliance is enforced by Leadership, Compliance, and Human Resources, and violations may result in disciplinary action including suspension, restricted access, or termination of employment.

‍