AVM CLOUD SECURITY

WHITE PAPER | 2023

DELIVER BEST-IN-CLASS SECURITY
WITH AVM CLOUD SERVICES

AVM Cloud Whitepaper

- November 2023
Table of Contents

DISCLAIMER 2
CONTRIBUTORS 3
INTRODUCTION 4
INFORMATION SECURITY GOVERNANCE 5
INFORMATION SECURITY POLICIES 5
PERSONNEL QUALIFICATIONS 5
BEST-IN-CLASS SECURITY 6
COMPLIANCE CERTIFICATIONS 6
DATA SECURITY 6
DATA PROTECTION 6
Data In-Transit 7
Data At-Rest 7
DATA HANDLING 7
DATA CONTROL REQUIREMENTS 7
DATA ACCESS RESTRICTIONS 7
DATA STORAGE 8
DATA DELETION 8
SYSTEM ACQUISITION, DEVELOPMENT, AND MAINTENANCE 9
STEADY STATE PROTOCOLS 9
REQUIREMENT ANALYSIS AND RISK ASSESSMENT 9
TESTING AND QUALITY ASSURANCE (QA) PROCEDURES 9
CONFIGURATION MANAGEMENT 10
CHANGE MANAGEMENT 10
VULNERABILITY MANAGEMENT 10
VENDOR MANAGEMENT 10
PHYSICAL SECURITY 11
COMMUNITY SECURITY 12
NETWORK AND BOUNDARY SECURITY 12
OPERATIONAL SECURITY 13
ACCESS CONTROL 13
MULTI-FACTOR AUTHENTICATIN 13
ACCESS AND AUDIT LOGGING 13
ANTIVIRUS AND ANTI-MALWARE 13
SECURITY MONITORING 14
VULNERABILITY SCANNING 14
PENETRATION TESTING 14
DISASTER RECOVERY PLAN (DRP) 15
INCIDENT RESPONSE 15
INCIDENT NOTIFICATION 15
POST-CLOSURE ANALYSIS 15

AVM Cloud Security White Paper AVM Cloud White Paper 1

Deliver Best-In-Class Security with AVM Cloud Services
DISCLAIMER
© 2023 AVM Cloud Sdn. Bhd. (“AVM Cloud”). All rights reserved. Kindly take note that this document is for
informational purposes only and by no means establishes or assumes any legal obligations by AVM Cloud
in respect to the contents herein. AVM Cloud disclaims any representation, warranty, implied or guarantee
of the completeness, accuracy, fitness for purpose or timelines of any information. The information provided
may contain details of third party, which we do not warrant, endorse, or assume liability for. You may consult
your own counsel for legal advice before utilizing the information. You may copy or use this document for
your own reference purposes only. All information stated in this document may be amended without prior
notice at the sole discretion of AVM Cloud.

AVM Cloud Security White Paper AVM Cloud White Paper 2

Deliver Best-In-Class Security with AVM Cloud Services
CONTRIBUTORS
The list of names stated below are AVM Cloud Sdn. Bhd. employees who have contributed to the completion
and release of this document which outlines the strict security standards that AVM Cloud adheres to.

Written By:
Nat Chan (Head of Pre-Sales Solutions Architect, AVM Cloud Sdn. Bhd.)

Edited By:
Hafis Murty (Product Specialist, AVM Cloud Sdn. Bhd.)

Reviewed By:
Andrew Lee Yin Chun (Cloud Operation Manager, AVM Cloud Sdn. Bhd.)
Jacky Ku Shin Haw (Senior Support Manager, AVM Cloud Sdn. Bhd.)
Lim Tee Keat (Senior System Engineer, AVM Cloud Sdn. Bhd.)
Wong Jyh Yian (Cloud Product Manager, AVM Cloud Sdn. Bhd.)

Endorsed By:
Lim Hui Sieng (ISO Compliance Manager, AVM Cloud Sdn. Bhd.)
Lai Eong Hua (General Technical Division Manager, AVM Cloud Sdn. Bhd.)
Kenny Lim (Chief Technology Officer, AVM Cloud Sdn. Bhd.)

AVM Cloud Security White Paper AVM Cloud White Paper 3

Deliver Best-In-Class Security with AVM Cloud Services
INTRODUCTION
AVM Cloud is built on a distributed compute architecture using hardware and software services to provide
customers with a secure operating environment for their Cloud Service deployment. As this technology
evolves, AVM Cloud continually incorporates new services to deliver increased availability, security, and
performance within AVM Cloud Services. Our experts ensure that customers are leveraging the latest
version of our fully optimized architecture and its associated enhancements delivered through routine
patches and upgrades.

AVM Cloud also provides customers with the ability to operate, access, and manage applications built upon
it. Users will be able to provision their own application environment based on our cloud-optimized reference
architecture. Once provisioned, users can develop, tailor, and manage the underlying application and data
components to meet their respective needs with full functional parity of the features, capabilities, and
services available on the AVM Cloud platform.

With this operating model, AVM Cloud customers administer and control the platform, the solutions built upon it, and
the data those applications present. AVM Cloud will maintain the supporting cloud platform and cloud infrastructure on
behalf of its customers.

AVM Cloud Security White Paper AVM Cloud White Paper 4

Deliver Best-In-Class Security with AVM Cloud Services
INFORMATION SECURITY GOVERNANCE
Information security governance is the management of systems, people, tools, and processes to ensure
that optimal security is maintained across the entire ecosystem. Because cloud computing involves multiple
layers of providers and users, an effective security posture requires commitment to governance at all levels
of the organization.

AVM Cloud is committed to maintaining the highest levels of security on behalf of its customers. AVM
Cloud’s governance and security controls are structured around industry-standard security encryption
requirements, various management systems and protocols as described below.

INFORMATION SECURITY POLICIES

AVM Cloud develops, documents, and disseminates an organizational information security policy to
comprehensively govern its corporate security posture. This policy aligns with the platform’s enterprise
architecture, is structured on industry-recognized frameworks, and is defined by the industry best practice
governance standards for information security noted above. AVM Cloud management reviews and updates
these policies at least annually, or after any significant changes to the service offerings in the context of the
technology landscape.

PERSONNEL QUALIFICATIONS
AVM Cloud follows a formalized hiring practice that verifies that all potential new employees or internal
transfers are qualified for the responsibilities of their job functions. AVM Cloud’s Human Resources
department conducts and verifies background checks on all new employees and contractors. Upon
acceptance of employment, employees are required to acknowledge receipt and understanding of
compliance with the AVM Cloud code of conduct and confidentiality policies.

AVM Cloud requires that newly hired personnel, including employees, interns, and contractors, who support
the AVM Cloud Services receive and acknowledge Information Security Management System (ISMS)
awareness briefing related to organizational privacy and security requirements. This briefing and
acknowledgement are facilitated by AVM Cloud’s ISO Compliance team.

AVM Cloud Security White Paper AVM Cloud White Paper 5

Deliver Best-In-Class Security with AVM Cloud Services
BEST-IN-CLASS SECURITY
AVM Cloud operates a dedicated internal compliance team to ensure that industry best practice processes
are continuously maintained, enhanced, and verified. This compliance team has established extensive data
protection and privacy policies and procedures to ensure strict compliance with Malaysia Data Security
Regulations and Requirements.

COMPLIANCE CERTIFICATIONS
AVM Cloud and its set of partners comply with the risk management and information security frameworks
listed below. This compliance is verified and certified, where appropriate, by way of comprehensive
assessments performed at least annually by qualified third-party and internal resources.

The AVM Cloud Group of Services complies with each of the following industry-recognized certifications,
accreditations, and regulations.

Note: ISO/IEC 27017:2015 which focuses on Cloud Security has been achieved as an extension of ISO/IEC 27001:2013

DATA SECURITY
AVM Cloud recognizes the importance of data privacy for our customers and their end users. To maintain
the utmost levels of data privacy, protection, and handling, its compliance and legal teams have developed
comprehensive privacy controls to restrict the level of personal information visible and accessible to
employees who manage AVM Cloud Services environments on our customers’ behalf.

DATA PROTECTION
AVM Cloud values data security and ensures that data in-transit and at-rest are protected by encrypting
data across all virtual instances and backup environments leveraging on state-of-the-art encryption tools
and key management systems provided by our Technology Partners.

AVM Cloud Security White Paper AVM Cloud White Paper 6

Deliver Best-In-Class Security with AVM Cloud Services
Data In-Transit
AVM Cloud implements industry-best-practice cryptography techniques to protect any management data
transmitted to and from AVM Cloud. A robust combination of internet protocol security (IPSEC) and/ or
secure socket layer (SSL) virtual private network (VPN) gateways is applied to all management data that is
transported. These measures adhere to industry-standard encryption algorithms to meet or exceed
minimum bit strengths.

Customers (Tenants) have the responsibility of handling encryption of their in-transit data outside of the
AVM Cloud environment and within their own internal environment. This can be carried out using an end-
to-end encrypted tunnel during data transmission which could be subscribed via AVM Cloud’s security
services.

For customers who require encrypted communication for remote access to applications hosted within AVM
Cloud, they can leverage on AVM Cloud’s SSL VPN Service. Our SSL VPN service allows up to 100 unique
VPN users to connect to the services hosted within AVM Cloud through an encrypted tunnel from anywhere
via an SSL VPN Client.

Alternatively, when a site-to-site tunnel is required, this can also be carried out via an establishment of a
secured IPSEC tunnel between customers’ on-premises firewall and AVM Cloud’s Firewall services.

Data At-Rest
AVM Cloud utilizes industry standard cryptography (AES-256) to protect and secure data at rest anywhere
within AVM Cloud Services boundaries for all management plane workloads. For customers who have
compliance and security requirements in encrypting data at rest within their subscribed storage services,
AVM Cloud can enable storage-based encryption for customers’ VDC on a per request basis.

DATA HANDLING
Significant measures are taken to ensure that customers retain complete ownership of their data when using
AVM Cloud Services. AVM Cloud, having obtained Sovereign Cloud status, allows Customers (Tenants) to
use the full benefits of Cloud Services while complying with data residency and sovereignty regulations. In
other words, these Sovereign Cloud solutions are built specifically to deliver security and data access that
meet the strict requirements of regulated industries and local jurisdiction laws on data privacy, access, and
control.

DATA CONTROL REQUIREMENTS

AVM Cloud customers and AVM Cloud Solution, Services and Support team share the responsibility of
determining the appropriate controls, policies, and technologies to manage, protect, and govern data
throughout its lifecycle within AVM Cloud. These requirements are captured and discussed during the
solutioning phase and implemented during the AVM Cloud onboarding process.

DATA ACCESS RESTRICTIONS

AVM Cloud customers retain full ownership of their data. Data identification and classification are fully
managed by Customers (Tenants) as AVM Cloud Support team does not have visibility into customers’ data.
AVM Cloud support team does not access customer data without formal customer authorization through a
cloud support case. In order to maintain data access restrictions, AVM Cloud support team members utilize
only a restricted role within AVM Cloud, enforced by access control lists (ACLs) which provide restricted

AVM Cloud Security White Paper AVM Cloud White Paper 7

Deliver Best-In-Class Security with AVM Cloud Services
ability within the deployed environment. This would only provide AVM Cloud support team with privileges
sufficient to manage the service deployment while prohibiting access to any customer data.

To ensure higher measures in monitoring and handling data access, Customers (Tenants) are strongly
advised to implement an end-to-end Role Based Access Control (RBAC) within the deployed environment
to ensure that highly privileged roles are assigned only to Customers’ (Tenants) VPC administrator users. In
order to further enhance security through an additional layer of user control that allows real-time session
monitoring, Customers (Tenants) can subscribe to AVM Cloud’s PAM Services. This service only allows
users with the right control and authority to access certain workloads and subsequently the data, with
additional features such as session monitoring for traceability of user actions performed during a privileged
session.

DATA STORAGE
AVM Cloud is deeply committed to maintaining customer data privacy. AVM Cloud customer data is not
stored in any on-premises environment outside of that individual AVM Cloud instance. Secure media
handling and destruction procedures are handled by AVM Cloud Support team.

DATA DELETION
AVM Cloud regularly assesses its compliance for adherence to secure data deletion policies and processes.
When a contract termination occurs, AVM Cloud issues a 7-day notice period during which customers can
validate that all data migration has been completed. An extended period for validation and data migration
is available upon request.

Upon receiving a final confirmation from the customer, all customer data and any possible copies are
completely deleted by AVM Cloud. If there is no confirmation given by the customer within the 7-day or
extended period, AVM Cloud will remove all customer’s data by default.

AVM Cloud Security White Paper AVM Cloud White Paper 8

Deliver Best-In-Class Security with AVM Cloud Services
SYSTEM ACQUISITION, DEVELOPMENT, AND MAINTENANCE
Best practice security principles are integrated into all phases of the AVM Cloud Services product lifecycle.
These security principles are implemented both through the AVM Cloud system design itself and through
specific activities required for key lifecycle milestones. Successful development, deployment, maintenance,
and optimization of the AVM Cloud Services relies on robust security principles, protocols, and procedures
integrated throughout all stages of the product lifecycle.

STEADY STATE PROTOCOLS

• Each individual is required to give acknowledgement on AVM Cloud Service’s organizational
security standards.
• Routine training to ensure personnel make security-appropriate decisions throughout the design
and architecture phases of the product life cycle.
• Dedicated use and maintenance of unique development, testing, and production environments to
ensure production data is never available to unauthorized users or utilized outside of the appropriate
environment.

REQUIREMENT ANALYSIS AND RISK ASSESSMENT

• Regimented review and approval of all proposed changes through our governed change
management process, which is administered by an internal Change Control Board (CCB) that meets
periodically.
• Regular, proactive AVM Cloud risk assessments are conducted to continually evaluate potential
and confirmed threat considerations and impacts.
• Identification of appropriate risk management solutions for any identified vulnerabilities or issues.

TESTING AND QUALITY ASSURANCE (QA) PROCEDURES

• Instance security scanning prior to automated version releases to ensure that each updated
deployment contains all security and operating system updates.
• AVM Cloud Infra team conducts Vulnerability Assessment (VA) on a quarterly basis and Penetration
Testing (PenTest) on a yearly basis to ensure that the AVM Cloud environment is secure and up-to-
date on any security related patches or updates.

AVM Cloud Security White Paper AVM Cloud White Paper 9

Deliver Best-In-Class Security with AVM Cloud Services
CONFIGURATION MANAGEMENT
The AVM Cloud Services utilizes hardened machine images that align to defined and proprietary baseline
configuration documentation to determine the necessary functions, ports, and services used by the
platform, and to disallow use of all others by default. AVM Cloud also leverages automation tools to deploy
consistent hardened instances and prevent any pre-deployment tampering or modification to these images.
Baseline configurations on AVM Cloud Services’ management plane is reviewed and reassessed at least
annually. Customers (Tenants) bear the responsibility of managing their own custom hardened images, both
within and outside of the Customers’ (Tenants) VPC environment, where and if applicable. This includes
ensuring the security and compliances of images deployed within their environment to meet applications
and infrastructure requirements.

CHANGE MANAGEMENT
AVM Cloud documents any proposed changes to its cloud offering within a secure, internal ticketing system.
Change request tickets must outline detailed descriptions, implementation steps, impact assessments,
backout procedures, and requisite approvals for each proposed change.

Every proposed change must be reviewed and approved prior to implementation by the AVM Cloud internal
team, comprised of senior technical leaders spanning the Information Security, IT Operations, Cloud, and
Support teams.

Upon approval, AVM Cloud engineering team implements the required changes either during standard
maintenance windows or during time periods pre-approved by the customer. A post-deployment QA
validation is performed for each change to ensure system functionality and integrity are maintained once
implemented.

VULNERABILITY MANAGEMENT
AVM Cloud develops, documents, and disseminates a set of procedures for implementing vendor-provided
security patches, quick-fix engineering, and updates for Microsoft Windows- and Unix-based system
components that is used to build AVM Cloud Services. AVM Cloud support team implements these
procedures at least once a month within a scheduled maintenance window. If critical or zero-day
vulnerabilities are identified, AVM Cloud works with individual customers to establish a scheduled
maintenance window in which to update or patch the critical vulnerability in AVM Cloud environment within
one month of detection.

VENDOR MANAGEMENT
AVM Cloud performs extensive vetting activities with all vendors before permitting system access or
engaging in its offered services. Due diligence activities include risk assessments, attestations of
compliance reviews, and regular reassessments to ensure that the individual personnel at each vendor
adhere to and continually comply with the same regulations, requirements, and standards that AVM Cloud
is required to maintain on behalf of its customers. Additionally, AVM Cloud requires all vendors to read and
acknowledge their understanding of all applicable access control policies and procedures required to
perform applicable duties. Besides that, all vendors are required to attend an Information Security
Management Briefing (ISMS) conducted by AVM Cloud’s ISO team.

AVM Cloud Security White Paper AVM Cloud White Paper 10

Deliver Best-In-Class Security with AVM Cloud Services
PHYSICAL SECURITY
As a Sovereign Cloud Service Provider, AVM Cloud is responsible for establishing and maintaining physical
access control systems (PACS) to restrict data centre access to properly authorized individuals within any
locations that house the backup data, recovery infrastructure, and all media for hosted systems.

In general, access to our critical assets used to support AVM Cloud Services are governed by AVM Cloud’s
operation and user control access and strict Operating Procedures practiced by our trusted and certified
Data Centre partner.

Our Data Centre partner practices a 8 layer security mechanism in ensuring physical access security.

Data Centre Multilayer Security

AVM Cloud Security White Paper AVM Cloud White Paper 11

Deliver Best-In-Class Security with AVM Cloud Services
COMMUNITY SECURITY
AVM Cloud strictly governs and controls all communications across its cloud system components to secure
each AVM Cloud deployment against unwanted intrusion and enable rapid detection and response should
any attempts occur. However, it should be noted that this practice only applies to the AVM Cloud Services’
management plane only. Customers (Tenants) have the responsibility of handling any communication
outside of the AVM Cloud Services environment.

Customers (Tenants) can setup a first line of defence before accessing the VPC. AVM Cloud provides
different network firewall options that can serve as a perimeter firewall to protect the customers’ VPC.
Customers (Tenants) may also choose NSX Edge Gateway and Firewall Services which provides NAT,
routing and networking services that connect networks within the VPC to networks outside of the VPC.
Alternatively, Customers (Tenants) can also opt for FortiGate Firewall which is an industry leader within the
security scene.

In ensuring virtual machine security protection, Customers (Tenants) may also choose to leverage on TREND
MICRO DEEP SECURITY SERVICE where Customers (Tenants) will also be eligible for additional features
such as Intrusion Prevention (IPS), Firewall, Web Reputation, Integrity Monitoring (IM) and Log Inspection.

Besides that, AVM Cloud also offers Managed Services for Firewall and Cyber Security where Customers
(Tenants) are able to offload IT personnel from the operational task of managing and monitoring Firewalls in
the Customers’ (Tenants) AVM VPC subscription. Customers (Tenants) will also receive monthly reports and
incident alerts that the SOC (Security Operation Centre) discovers.

NETWORK AND BOUNDARY SECURITY

AVM Cloud implements distributed denial of service (DDoS) protection and mitigation services on AVM
Cloud‘s connectivity network to alert, prevent, and mitigate attacks against the AVM Cloud platform.
However, it should be noted that these services only apply to the AVM Cloud Services’ management plane.
Customers (Tenants) have the responsibility of handling any network security outside of the AVM Cloud
Services environment.

Alternatively, Customers (Tenants) may opt to subscribe to Anti-DDoS services on top of the subscribed
dedicated bandwidth offered by AVM Cloud. This allows for Customers’ (Tenants) applications to have
connectivity to the public internet while having in-line DDOS protection. Traffic targeted towards Customers’
(Tenants) VPC will be screened through and scrubbed if any unusual spike in traffic is observed.

Customers (Tenants) who are hosting websites or web applications on AVM Cloud can safeguard their
websites and web applications against various cyber threats targeted towards the application layer through
the implementation of a web application firewall (WAF). AVM Cloud provides different WAF services targeted
for different use cases, where Customers (Tenants) can opt for a shared WAF (AVM WAF Services) or
dedicated WAF (FORTIWEB) to be deployed within each Customers’ (Tenants) individual account to provide
additional application layer protection. Both WAF offerings filter, monitor, and block malicious HTTP traffic
to and from a web service which in turn protects the Customers’ (Tenants) business-critical web applications
from attacks that target known and unknown vulnerabilities.

Besides that, AVM Cloud also offers Managed Services for WAF where Customers (Tenants) are able to
offload IT personnel from the operational task of managing and monitoring Web Application Firewall (WAF)
in the Customers’ (Tenants) AVM VPC subscription.

AVM Cloud Security White Paper AVM Cloud White Paper 12

Deliver Best-In-Class Security with AVM Cloud Services
OPERATIONAL SECURITY
The AVM Cloud team that administers and maintains each AVM Cloud deployment and/ or instance
conducts all operational activities according to strict protocols to ensure the highest levels of security are
always maintained.

ACCESS CONTROL
The AVM Cloud Support team leverages centralized directory services and automated technical
solutions to provision, monitor, modify, or revoke privileged user accounts established for each unique
deployment. These components provide Role-based Access Control (RBAC), which is the ability to
strictly control access to each environment.

MULTI-FACTOR AUTHENTICATION
AVM Cloud requires that all remote and privileged access to its management stack are protected by multi-
factor authentication (MFA), reducing the possibility of identity theft and unauthorized access. Within the
application layer, customers may also choose to integrate with their own MFA solutions for their end users
or leverage AVM Marketplace’s MFA solution provided by our trusted partner.

ACCESS AND AUDIT LOGGING

AVM Cloud centralizes auditing and logging for all system monitoring and user activity using a third-party
SIEM tool that aggregates, stores, and secures all log information. The service associated with this tool
provides 24x7 monitoring and alerting services and immediately notifies AVM Cloud team of any suspicious
activity.

For Customers’ (Tenants) workloads, Customers (Tenants) may also subscribe to AVM Cloud’s
KIWISYSLOG SERVER to monitor servers, switches, firewalls, and routers. AVM Cloud’s self-service syslog
allows Customers (Tenants) to easily setup and capture syslog messages and store them in a centralized
location, providing a unified view of system events across Customers' (Tenants) network, whether it is within
AVM’s VPC or Customers' (Tenants) on-premise servers.

ANTIVIRUS AND ANTI-MALWARE

Antivirus and anti-malware software are used to detect, identify, and prevent the introduction of malicious
software to AVM Cloud and its associated systems. AVM Cloud utilizes a centrally hosted and managed
solution that provides continuous monitoring and endpoint detection and response (EDR) capabilities.
However, it should be noted that these services only apply to the AVM Cloud Services’ management plane.
Customers (Tenants) have the responsibility of handling any antivirus and anti-malware for their own
applications and operating systems respectively.

Alternatively, Customers (Tenants) may also subscribe to these services from AVM Cloud. AVM Cloud offers
TREND MICRO DEEP SECURITY SERVICE which can cater to Customers (Tenants) requirement for Anti-
Malware protection. This Agent-based Anti-Malware solution is a proven and widely used software for data
protection.

AVM Cloud Security White Paper AVM Cloud White Paper 13

Deliver Best-In-Class Security with AVM Cloud Services
SECURITY MONITORING
AVM Cloud uses an array of third-party security monitoring tools and alerts to provide comprehensive
monitoring of the AVM Cloud environment.

VULNERABILITY SCANNING
AVM Cloud employs extensive vulnerability scanning and analysis across all levels of its technology stack.
AVM Cloud assigns fully qualified internal resources and leverages automated technical solutions to
conduct vulnerability scans quarterly in accordance with industry-accepted guidelines. When and if
applicable, qualified external resources perform remediation scans until all requirements are met.

PENETRATION TESTING
AVM Cloud also enlists the services of a qualified third-party provider to perform penetration testing services
for AVM Cloud, complete security reviews of the platform application and network boundary, tests ingress
and egress controls, and test isolation and segregation controls. When applicable, this third-party provider
performs remediation scans within 60 days until all requirements are met.

AVM Cloud Security White Paper AVM Cloud White Paper 14

Deliver Best-In-Class Security with AVM Cloud Services
DISASTER RECOVERY PLAN (DRP)
AVM Cloud operates a comprehensive disaster recovery plan (DRP) program to minimize event-based
impact on the people, processes, systems, and technology governed by its information security
management protocols, and to ensure rapid and efficient post-event recovery. In conjunction with the other
organizational initiatives described in this document, this integrated program constitutes a critical aspect of
the comprehensive value AVM Cloud offers to customers by enabling the AVM Cloud team to ensure the
highest levels of business continuity on their behalf where applicable.

Customers’ (Tenants) DRP is dependent on the requirements and needs and will require additional
solutioning based on the Recovery Point Objective (RPO) and Recovery Time Objective (RTO) needs. AVM
Cloud has multiple services that could contribute to a DR solution and additional services will be required
to complete a DRP.

INCIDENT RESPONSE
AVM Cloud implements a coordinated incident response process to effectively identify and resolve any
security incidents involving AVM Cloud information systems and associated data for these environments.
AVM Cloud implements detective measures to identify potential security incidents and determine severity
and impacts in a coordinated manner, and to ensure all incidents are properly investigated and tracked to
resolution by trained AVM Cloud personnel.

INCIDENT NOTIFICATION
If a confirmed security incident impacts an AVM Cloud customer, AVM Cloud Support team will promptly
notify the affected customer based on respective contractual obligations and in accordance with
established incident response plan policies and procedures, unless otherwise delayed by direction from law
enforcement. It should also be noted that incident notifications are only given to customers who have
subscribed to AVM Cloud’s Security Operations Centre (SOC) and Firewall services only.

POST-CLOSURE ANALYSIS
Closed incidents are routinely reassessed to identify systemic weaknesses, threats, vulnerabilities, and any
trends that can help the AVM Cloud Support team perform preventive measures that may proactively
decrease the occurrence of specific incidents.

AVM Cloud Security White Paper AVM Cloud White Paper 15

Deliver Best-In-Class Security with AVM Cloud Services
AVM Cloud Security White Paper AVM Cloud White Paper 16
Deliver Best-In-Class Security with AVM Cloud Services