eSkill Trust Center

Talent Assessment Platform^TM

We recognize the importance of maintaining the confidentiality, integrity, and availability of our customers’ information and the protection of its valuable business assets and applications. This Security and Trust Assurance Packet reflects our commitment to providing a secure environment and adopting effective security standards that align with industry best practices in the areas of security and service management.

With the use of a variety of reliable security technologies as well as a unique combination of trained personnel, mature business processes, and regular third-party audits measured against several international and U.S. standards, the eSkill Talent Assessment Platform^TM delivers a high level of security and confidence that is unmatched in the industry.

This document describes each layer of this assurance approach to provide an overview of the compliance, data protection, and cybersecurity that the eSkill Talent Assessment Platform^TM provides.

While open to sharing information with clients, eSkill asks companies and entities who are not yet clients to sign a non-disclosure agreement before making detailed inquiries using eSkill Talent Assessment Platform^TM services.

Formal Information Security Program, Policies and Procedures

eSkill offers a public version of our formal information security program.

Compliance

To assure that clients’ data confidentiality, integrity, and availability are maintained, we conduct multiple internal audits and third-party audits. The written results are available upon request.

The eSkill Talent Assessment Platform^TM also undergoes periodic external scans and the results are available on request.

The following table shows the types of audits and scans, plus the frequency at which they are conducted.

Privacy

Our privacy policies and practices can be found at:

Privacy Policy

Cookie Policy

Privacy Product Features
By configuring Data Retention, clients can simplify their compliance with data privacy regulations by removing data. Removal involves anonymizing, deleting, or obfuscating the data. eSkill’s Assessment Platform has internal use Read and Change access logging on personal data fields to meet GDPR requirements.

Third-Party Providers
Before third-party providers are approved to offer parts of eSkill Talent Assessment Platform^TM services, they must go through a formal vendor risk management program review to confirm and monitor that they provide an adequate level of security and comply with relevant data protection requirements. The eSkill Talent Assessment Platform^TM collects only the minimum necessary personal data and uses it only for agreed-on purposes.

Data Protection

Privacy is important to eSkill. We have a comprehensive privacy program that is overseen by our Data Protection Office (DPO). Our DPO actively monitors our compliance with GDPR and other privacy regulations. If you have any questions about our privacy practices, please reach out to your eSkill CSM or representative.

We have established the following safeguards for personal information protection:

• Data is encrypted when transmitted over public networks.
• Personal Information may be anonymized at the request of the customer.
• Data is accessible only by vetted, authorized personnel.
• Client data is prohibited from being stored on eSkill workstations and mobile devices.

Data in motion

• Web Browser User Sessions – TLS 1.1 & 1.2 (and above if available).
• Webservice APIs – TLS 1.2 +.

Data Center

The eSkill Talent Assessment Platform^TM’s cloud platform is based on a high-availability architecture with no single point of failure. It is hosted at AWS data centers in two different geographical locations.

For compliance details on specific data center platforms, please visit

AWS: https://aws.amazon.com/compliance/

Application Security

We have implemented a secure software development lifecycle (secure SDL) and require our product teams to use security training, tools, and processes that are in alignment with the Open Web Application Security Project (OWASP) and NIST.

These guidelines include secure coding implementation in application architecture, authentication, session management, access controls and authorization, event logging, and data validation.

Required processes for product teams include threat modeling, inline and continuous security scanning and monitoring, and mandatory security reviews that enable product teams to deliver security by design.

The eSkill Talent Assessment Platform^TM integrates static, interactive, and dynamic security testing into its secure SDL.

Applications and services are designed to ensure that only authorized users can perform allowed actions within their privilege level to control access to protected resources using decisions based on role or privilege level, and to prevent privilege escalation attacks.

Role-based Access

• User roles can be defined both at the group level and at the user level.
• User roles can be used to adhere to Segregation of Duties (SoD).
• User and group access can be defined down to the assessment level.

Network Security

The eSkill Talent Assessment Platform^TM’s network architecture ensures that sensitive data is protected through best business practice security policies and procedures.

Hardened router configurations. Router configurations correctly route packets to their proper destinations and restrict traffic. Access Control Lists (ACLs) on the front-end routers stop common attacks.

Network segmentation. Our segmented network architecture prevents direct public contact or connection to the eSkill Talent Assessment Platform^TM’s private network segment.

Front-end load balancers. Access to eSkill Talent Assessment Platform^TM services is managed with redundant load balancers. These provide a variety of functions, including TLS session termination, load balancing, network address translation (NAT), and port address translation (PAT).

Distributed denial-of-service (DDoS) protection. A service protects the availability of eSkill Talent Assessment Platform^TM services, even when they are under a distributed denial-of-service (DDoS) attack.

Activity log aggregation. Log activities from network devices and systems are aggregated through an activity log collection system. Logs are fed to a SIEM, where alarms are generated for those events that warrant immediate attention.

Proactive monitoring. Security and Risk Management continuously monitor industry communities for news of security alerts, as well as vendor and partner security changes that may affect Information Services and eSkill Talent Assessment Platform^TM’s product line. Information Services has 24/7 automated monitoring with backup personnel.

Active vulnerability assessment. Security scans of applications and infrastructure are routinely performed by approved third-party assessment vendors, security engineers, and through the use of internal scanning appliances (see table of audits and scans above). These scans check for vulnerabilities in both our external (public facing) web applications and our internal (private) networks. Discovered vulnerabilities are managed through eSkill’s vulnerability and patch management program and the risk is treated per eSkill’s risk management program. vulnerability and patch management program and the risk is treated per eSkill’s risk management program.

VPN. eSkill personnel use a best-in-class VPN when connecting and processing from outside the trusted network. The VPN secure tunnel offers Internal Operations personnel highly secure remote connectivity to perform after-hours maintenance or trouble-shooting. Multifactor authentication is required for all employees who have direct access to the eSkill Talent Assessment Platform^TM’s production systems.

Digital certificates and TLS. We use web server digital certificates to verify the authenticity of all client sites and digital certificates to encrypt all web traffic between clients and servers.

Host Based Security

Information Services employs a hardened, approved, and standardized build for every type of server used within the infrastructure. This procedure disables unnecessary default user IDs, closes unnecessary or potentially dangerous services and ports, and removes processes that are not required.

Servers are built, scanned for vulnerabilities, and remediated before being put out into the wild. This process is repeated every 30 days, with servers being rebuilt from scratch.

All patches are tested using a standard process to ensure proper functioning within the operating environment before they are applied to the servers.

The same process is used for the eSkill Talent Assessment Platform^TM data centers. We control the server builds and dedicated engineers continually update, optimize, and secure the standard build procedures, while adhering to industry best practices and regulatory requirements.

Database storage-area-network (SAN) cluster. eSkill databases are stored on a fully redundant SAN. Drives are configured with RAID for all tiers of storage, and each segment of data has, at a minimum, two standby drives that are used automatically in the event of a drive failure. Database servers use N+1 clustering to prevent downtime in the event of a server failure.

Centralized logging. Events from all systems are collected and aggregated, and alerts are sent, via a centralized log collection engine (SIEM) that is monitored by the eSkill’s Security Operations Center.

Standard change control process. Any changes to the eSkill Talent Assessment Platform^TM’s infrastructure must pass a strict Change Control Process to ensure best practices and minimal service interruption for our clients.

Security information and event management. eSkill receives real-time alerts for a variety of activities that may indicate malicious activity.

Vulnerability Management

We regularly test application code and scan the network and systems for security vulnerabilities. Third-party assessments are also conducted regularly (see table of audits and scans above), including:

• Application vulnerability threat assessments
• Network vulnerability threat assessments
• Selected penetration testing and code review
• Continuous integrated application security testing of each release
• 24×7 advanced scanning of all services
• Security control framework review and testing

Be assured that eSkill is not impacted by the Log4j vulnerability. We will continue to provide important updates as our evaluation of the vulnerability’s impact on our products and services develops. If you have any additional questions or concerns, please contact us.

eSkill Employees

Background checks are performed on all employees before hiring, including education, past employment, criminal record, and other checks according to local laws and requirements.

Employees are provided with regular training on security policies and procedures, including company policies and procedures, corporate ethics and business standards, and secure development training based on OWASP. Completion of security training is tied to system access.

Regular updates are released and periodic performance appraisals are performed to ensure employees’ knowledge of company security policies and procedures is current.

Disaster Recovery

Disaster Recovery, Business Continuity and Incident Response

eSkill maintains a comprehensive continuity of operations strategy complete with tactical playbooks for Disaster Recovery, Business Continuity and Incident Response.

The eSkill Talent Assessment Platform^TM uses a high-availability architecture to ensure that service performance continues to meet client expectations in the event of a failure.

Services are hosted at Tier 3+/Tier 4 co-location facilities that were built using a “fortress” approach. So core services, telecom, and power are diversely supplied to the building and physical access is managed through state-of-the-art technology. These facilities are audited annually by a third-party.

The eSkill Talent Assessment Platform^TM also maintains SOC 2 Type II, which requires the production, maintenance, and testing of a Disaster Recovery Plan (DRP). The current DRP is a formal recovery procedure for recovering the entire application in the alternate data center. The DRP is tabletop tested annually and eSkill also performs disaster simulations to test failover to the secondary data center.

In addition, real-time data replication is performed between the production data center and the disaster recovery center.

Recovery Point Objective             24 hours in the event of a total disaster otherwise 10 minutes

Recovery Time Objective              2 Hours