Best Practice #3


PRIVACY AND PROTECTION OF NON-PUBLIC PERSONAL INFORMATION

Best Practice #3: Adopt and maintain a written privacy and information security program to protect Non-public Personal Information as required by local, state and federal law.

Purpose: Federal and state laws (including the Gramm-Leach-Bliley Act) require title companies to develop a written information security program that describes the procedures they employ to protect Non-public Personal Information. The program must be appropriate to the Alliance Abstract and Title’s size and complexity, the nature and scope of Alliance Abstract and Title’s activities, and the sensitivity of the Consumer information Alliance Abstract and Title handles. Alliance Abstract and Title evaluates and adjusts its program in light of relevant circumstances, including changes in the Alliance Abstract and Title’s business or operations, or the results of security testing and monitoring.

Alliance Abstract and Title Comprehensive Policies and Procedures for Implementation and Adherence to Best Practice #3 Alliance Abstract and Title has a comprehensive security program designed to insure that all necessary information security safeguards are in place and adequately address GLBA requirements. All employees of Alliance Abstract and Title are expected to contribute to this program and report any incidents that may affect the security of the organizations information systems. The following polices are addressed within the Alliance Abstract and Title’s Information Security Policy Manual.

1. Physical security of Non-public Personal Information
Alliance Abstract and Title :
i. Restricts access to Non-public Personal Information to authorized employees who have undergone Background Checks at hiring.
ii. Prohibits or controls the use of removable media.
iii. Uses only secure delivery methods when transmitting Non-public Personal Information.

2. Network security of Non-public Personal Information
Alliance Abstract and Title :
i. Maintains and secures access to Alliance Abstract and Title information technology through physical entry controls.
ii. Remote access controls and restrictions.
iii. Developed and maintains guidelines for the appropriate use of Alliance Abstract and Title information technology.
iv. Up to date virus management software and firewall controls against malicious software, viruses and unauthorized websites.
v. Real time disaster recovery imaging of all servers with additional onsite backup.
vi. Business continuity plan for disaster preparedness.
vii. Background checks on all personnel.
viii. Training of employees to ensure compliance with program.
ix. Ensures secure collection and transmission of Non-public Personal Information.

3. Disposal of Non-public Personal Information
Alliance Abstract and Title :
i. Adheres to Federal law which requires companies that possess Non-public Personal Information for a business purpose to dispose of such information in a manner that protects against unauthorized access to or use of the information.

4. Alliance Abstract and Title has an established Disaster Recovery Plan

5. Alliance Abstract and Title exercises appropriate management and training of employees to ensure compliance with Alliance Abstract and Title’s information security program.

6. Alliance Abstract and Title has oversight of service providers to help ensure compliance with Alliance Abstract and Title’s information security program.
Alliance Abstract and Title
i. Takes reasonable steps to select and retain service providers that are capable of appropriately safeguarding Non-public Personal Information.

7. Audit and oversight procedures are in place to ensure compliance with Alliance Abstract and Title’s information security program.
Alliance Abstract and Title
i. Reviews the privacy and information security procedures to detect the potential for improper disclosure of confidential information.

8. Notification of security breaches to customer and law enforcement
Alliance Abstract and Title
i. Posts the privacy and information security program on all Alliance Abstract and Title websites and provides program information directly to customers in useable form. When a breach is detected, Alliance Abstract and Title has a program to inform customers and law enforcement as required by law.