Security at RWS

At RWS we understand that information security is important to our customers. As a global organisation, we have adopted the ISO 27001 framework to provide structure to our information security management system (ISMS). 

Using this widely accepted and industry recognised framework provides RWS with a robust baseline from which to meet customer requirements. This approach has enabled us to achieve ISO27001:2013 certification for many of our products, services and supporting people, processes and technology. Further details can be found on our current ISO27001 certificate. 

On this page we have added some of our high-level information security policies in addition to product specific security related documentation. If you have any further information security related queries, please contact us.

FAQs

RWS's procurement process requires new suppliers to undergo security risk assessment prior to onboarding. Suppliers are assigned a risk category according to a number of criteria including: criticality of the goods/services to be provided and sensitivity of information or facilities they access.

Yes, RWS's Group Supplier Security Management policy specifies the security requirements for third party suppliers

RWS carries out monthly vulnerability scanning of its public facing infrastructure. Weaknesses are risk assessed and appropriate mitigation applied in accordance with the Global Security Testing Policy. A member of the information security team sits on the Global IT Change Advisory Board to assess the security impact of proposed changes.

RWS's Group Secure Software Development Lifecycle Policy specifies how products are to be developed securely. Security is featured as part of each development step from requirements gathering, design, implementation, verification, and release. Changes are tested prior to release.

Yes, RWS uses both Service Centre and ServiceNow to track workflows from tickets being raised to assignment and resolution. SLAs are in place depending on the criticality of the incident/change or problem

Yes. RWS has an IT Security and Acceptable Use Policy

RWS will only retain customer data as long as it is necessary for the performance of the services and in any case as agreed in the Contract.

Yes, RWS has a dedicated Software and Asset Management (SAM) Team as well as utilising an asset tool called Lansweeper and Flexera on the RWS network. Lansweeper automatically detects and records items on the RWS corporate network including details such as owner, asset type, software installed, warranty and configuration, all assets have an assigned owner.

Yes, patches are applied to end points automatically utilizing a centralized patching application. Patching of the servers with updates performed at least annually. Typically this patching will be performed during the routine monthly maintenance window, Patches of other types (such as SQL, Antivirus) performed on ad-hoc when desired but should be tested on a Development or Staging system before Production, where such systems exist.

Yes, change management roles and responsibilities are governed by the CAB process in which management are included as well as the relevant stakeholders including IT and any RWS system testers, any system changes are tested before implementation and/or deployment. Emergency changes are carried out in the same way as the standard change management process, ensuring the changes are logged, recorded, tested, agreed and implemented. Implementing change is the responsibility of release management, however the process at large is the responsibility of CAB.

Yes, RWS has a Logical Access policy which specifies the processes to be used to manage logical access.

Yes, RWS's risk assessment program is owned by the RWS Executive and is communicated to relevant employees

RWS's security risk management program is outlined in the Group Security Risk Management policy. This contains the methodology to be used for the identification and management of security risks, including: Asset Identification; Impact Analysis; Risk Assessment; Identification and Application of Controls; and Monitoring of Control Effectiveness. Risks are assessed periodically or when a significant change occurs that could have an impact on the confidentiality, integrity, or availability of RWS information or assets. Oversight and governance of the risk management processes is exercised by the Security Governance, Risk and Compliance Manager and Information Security Steering Committee as appropriate.

Yes, RWS takes data privacy very seriously. Our Privacy Policy is available here: www.rws.com/about/privacy for privacy information

Yes, customers may view our ISO 27001 certification at www.rws.com/security

Yes, RWS software hosted by RWS Cloud Operations is within the scope of our SOC 2 type II report. An executive summary of the report is available on request.

Yes. RWS's information security program is owned by the Chief Information Officer and is managed throughout the year by the executive level Information Security Steering Committee to ensure it continues to support business goals.

Yes. RWS's Chief Information Officer is the executive sponsor for information security. Day to day responsibility for the management of RWS's information security management system and continued compliance with security requirements is vested in a small team led by RWS's Security Governance, Risk and Compliance Manager.

Yes, RWS's information security policy is approved and signed by the executive sponsor for information security and sets out the high level security requirements which allow RWS to maintain and continually develop its information security management system.

Our policies are reviewed at least annually. Internal documents may be viewed on site or remotely viewed by the client during an audit under NDA / MNDA. 

RWS Group ISMS Information Security Policy
RWS Group Information Security Policy
RWS Group Security Risk Management Policy (Internal)
RWS Group Security Testing Policy (Internal)
RWS Group Logical Access Policy (Internal)
RWS Group Business Continuity Policy (Internal)
RWS Group Global Classification & Handling Policy (Internal)
RWS Group Information Security Incident Management Policy (Internal)
RWS Group Physical Security Policy (Internal)
RWS Group Privacy Policy (Internal)
RWS Group IT System Policy (Internal)
RWS Group Cryptographic Controls Policy (Internal)
RWS Group Supplier Security Management Policy (Internal)
RWS Group Secure Software Development Policy (Internal)
RWS Group ISMS Acceptable Use Policy (Internal)
RWS Group ISMS Security Exceptions Policy (Internal) 

Our policies are published on the corporate Intranet and available to all RWS employees, policies are regularly communicated to RWS employees via mandatory security & privacy awareness and training.

Yes

Yes. RWS has a security exceptions policy and process.

Yes, any non-compliance to our Information Security policies will be reviewed and investigated by the global Information Security team and subsequently passed on to management and the relevant HR team for further investigation and action as necessary. Sanctions depend on the severity of the incident and could result in disciplinary action up to and including dismissal.

RWS's legal department monitors relevant legal and regulatory requirements which apply to RWS. Regulatory requirements pertaining to information security will be discussed between the head of the legal department and the global head of information security and changes to the security program made as appropriate.

Any such lawful requests would be handled by our legal team and would consider any contractual obligations and legal requirements.

Yes, RWS's Group Information Security Incident Management Policy is published and accessible to all employees on the RWS intranet and includes but is not limited to: Monitoring and Preparation; Identification; Containment; Mitigation; Recovery; and Follow-up.

Yes, RWS's Group Information Security Incident Management Policy is published and accessible to all employees on the RWS intranet and includes but is not limited to: Monitoring and Preparation; Identification; Containment; Mitigation; Recovery; and Follow-up.

Yes, RWS's network supplier monitors traffic and provides alerts in the event of anomalous activity and RWS employs IDS/IPS in key areas of the network to detect and prevent intrusions. End points have appropriate prevention/detection software.

Yes. Information security awareness training is a fundamental part of the onboarding process for RWS personnel, contractors, and freelancers. Thereafter, computer-based information security training is delivered annually to all employees in a dedicated learning module. Additionally, information security awareness training is delivered as part of the yearly Code of Conduct training and through our frequent 'Think Security' campaigns.

Yes. All new starters undergo identity and 'right to work' checks. Where required by their role in the organsiation or national obligations, further background checks can be carried out in accordance with the relevant laws.

RWS's freelancers are not subject to background checks as standard. However, we do have a vendor agreement in place with our freelancers which includes minimum security measures and confidentiality and background screening of freelancers can be requested by customers as contractually agreed, subject to local laws.

Yes, all new starters are required to complete mandatory information security awareness training and Code of Conduct training which also includes security elements. On termination employees are reminded of their post employment security responsibilities. All assets are recovered and accounts suspended pending review and deletion.

Yes, RWS's Group Classification and Handling policy covers the areas of data destruction and media sanitisation. Specific processes to implement the policy are owned and maintained by the respective technology owners.