January 4, 2007

GE Internal (Distribution to GE Third Parties, Suppliers and Customers allowed)

GE Corporate Security

General Electric Third Party Information Security Policy

Date: July 10, 2007

GE Third Party Information Security Policy 1

January 4, 2007

GE Internal (Distribution to GE Third Parties, Suppliers and Customers allowed)

Table of Contents

1 Third Party Information Security..............................................................3

1.1 1.2 1.3 1.4 1.5 1.6 2.1 2.2 2.3 2.4 2.5 2.6 2.7 2.8 2.9 2.10 2.11 3.1 3.2 3.3 3.4 3.5 3.6 3.7 3.8 3.9 3.10 4.1 4.2 4.3 4.4 4.5 4.6 4.7 Introduction.......................................................................................................................3 Scope................................................................................................................................3 Definitions and Terms.......................................................................................................3 Organization......................................................................................................................4 Establishing Security Requirements..................................................................................4 Third Party Approvals........................................................................................................5 General Audit....................................................................................................................5 Personnel..........................................................................................................................6 Inventory, Ownership, and Classification...........................................................................6 Data Storage and Handling...............................................................................................7 Data Transmission.............................................................................................................7 Laptops/Workstations........................................................................................................8 Business Continuity Planning/Disaster Recovery...............................................................8 Incident Response.............................................................................................................8 Third Party Workplace Security.........................................................................................9 Computer Room Access..................................................................................................9 Consumer and Regulatory Compliance.........................................................................10 Data and Application Audit..............................................................................................10 Data Isolation and Architecture.......................................................................................11 Change Management .....................................................................................................11 Server Operating Systems...............................................................................................11 Data Back-Up..................................................................................................................13 Activity and Fault Logs....................................................................................................13 Access Controls and Privilege Management....................................................................13 User Accounts.................................................................................................................13 Password Policy...............................................................................................................14 Application Security......................................................................................................14 Third Party Type and Audit..............................................................................................15 Third Party Network Transport Requirements.................................................................15 Basic Third Party Access Requirements...........................................................................16 Trusted Third Party Access Requirements.......................................................................18 Trusted Third Party Network Architecture.......................................................................18 Trusted Third Party Outbound Proxy Servers..................................................................19 Trusted Third Party Email Servers...................................................................................19

2 General Security Requirements................................................................5

3 Data and Application Security Requirements..........................................10

4 Network Connectivity Security Requirements.........................................15

5 Appendix..............................................................................................20
5.1 Appendix A: GE Data Classification Standard..................................................................20 5.2 Appendix B: GE Acceptable Use Guidelines.....................................................................20 5.3 Appendix C: GE Supplier Security Risk Analysis Checklist...............................................20

GE Third Party Information Security Policy 2

January 4, 2007

GE Internal (Distribution to GE Third Parties, Suppliers and Customers allowed)

1 Third Party Information Security

1.1 Introduction
GE recognizes that information protection requires close cooperation between GE and its suppliers, vendors, partners, and customers. This document outlines GEs security policies designed to safeguard GE information, as well as information belonging to these Third Parties, from unauthorized or accidental modification, damage, destruction, or disclosure.

1.2 Scope
This policy addresses technical security and compliance concerns with respect to GE on-site and VPN-connected contractors, GE data housed or hosted by external service providers, site-to-site customer-facing network connectivity, and general connections into the GE internal network from non-GE sites. Specially designed GE external customer services DMZs with no inbound access to GE internal networks are out-of-scope. The basis for the control objectives and controls is compliance with applicable law and GE general policies, primarily the GE Spirit & Letter policies. However, most of this documents procedures go beyond technology concerns and have wider applicability. For example, information protection applies to data in electronic form as well as printed or paper documents. Contractual language requirements for agreements are highlighted in gray. GE may periodically update its security policies based upon newly identified vulnerabilities and threats. In addition, GE already has an extensive network of existing Third Party Connections with additional joint risk. To minimize this residual risk, new third parties or contract renewals should be brought in line with the then current policy document. All third parties should have all gaps identified, then brought into compliance or mitigated. September 15, 2007: All new third parties or contract renewals should use the latest documented policy

1.3 Definitions and Terms

Certain terms are used throughout this policy; in order to avoid misinterpretation, several of the more commonly used terms are defined below. Basic Third Party Connection: A site-to-site connection between Third Party network and GE internal network that requires Least Access firewall rules and NAT of GE internal addresses. Used for outbound-initiated connectivity into the Third Party network, or a specific set of inbound IPs/ports/protocols acceptable to GE (not typically Sametime/NetBIOS/SMTP/DNS which require special security audits and controls normally associated with a Trusted Third Party Connection). BCP/DR: Business Continuity Planning/Disaster Recovery. GDC: Global Development Center a Trusted Third Party with additional management controls and oversight sponsored by GE Corporate to service multiple business contracts. GE Worker: GE and Third Party employees, their consultants, contractors, and vendors for any GE engagement. Will generally apply to customers with remote or on-site access to GE facilities. Hosting: Third Party providing Internet-facing servers and applications accessible by the public or GE customers; Most Hosting Third Parties will also have Housing of GE data as part of the application. Housing: Third Party that stores or processes GE data such as data processing applications, data center services and backup tape storage facilities. Housing includes GE data storage whether accessible to the Internet or not.

GE Third Party Information Security Policy 3

January 4, 2007

GE Internal (Distribution to GE Third Parties, Suppliers and Customers allowed)

Least Access: The minimum required access rules necessary to achieve function required; used to describe locked-down firewall rules. NAT: Network address translation; used to change GE internal addresses to numbers routable on the Third Partys network; required for Basic Third Party connectivity. Remote VPN: Individual Internet-based access to the GE internal network using two-factor authentication such as SSL-VPN or IPSec. Because a token is required, it is not suitable for access by automated processes. Third Party: non-GE vendor, supplier, partner, contractor, service provider, or customer with connectivity to GEs internal network or access to GE data. This includes joint ventures without majority GE ownership. Third Party Manager: The individual at the vendor responsible for the GE/Third Party relationship. Third Party Security Leader: Appointed by the Third Party Manager with notification to the GE Sponsor and GE Information Security Leader to supervise and coordinate security activities within the organizations. Assumes role as primary point of contact with GE in case of security incident response. Trusted Third Party Connection: A physically isolated segment of the Third Party network connected to GE internal network in a manner identical to a GE remote office. Commonly used for GDCs servicing multiple businesses, or Third Parties where full network/system management access is required.

1.4 Organization
GE Sponsor: Every Third Party should have a GE Sponsor, responsible for owning the business relationship and overall performance including adherence to compliance and security requirements. The GE Sponsor should be guided by local business definitions, legal or regulatory requirements and the specifications of the GE Information Security Data Classification Standard (see Appendix) and security program. GE Information Security Leader: The GE Information Security Leader should assess Third Party risks for the GE Sponsor, and ensure the Third Party implements security controls appropriate to the classification of the data and access required. The GE Information Security Leader should work closely with the Third Party Security leader to maintain adequate incident response/audit, and provide updates to any ongoing changes to GE security practices. Third Party Manager & Third Party Security Leader: The Third Party Manager must identify a Third Party Security Leader responsible for adherence to GE security policies. The Third Party Security Leader is responsible for preparing and implementing a security program that promotes compliance and assists workers in practicing sound security principles, reviewing security plans periodically and updating them as necessary, reporting security incidents, and scheduling periodic audits as directed in this policy. The Third Party Manager is responsible for notifying the GE Sponsor of any subcontracts/outsourced work and maintaining Third Party subcontractor security levels and agreements that ensure GE information security requirements and audits are met. The Third Party Security Leader interfaces with the GE Information Security Leader.

1.5 Establishing Security Requirements

This information security policy document is organized in three sections. Based upon GE assessment of business access needs, then language addressing one, two or all three sections should be included in supplier agreements. Section 2. General: All Third Parties must comply with General security requirements Section 3. Data and Application: Additionally applies if Third Party is Hosting/Housing GE data

GE Third Party Information Security Policy 4

January 4, 2007

GE Internal (Distribution to GE Third Parties, Suppliers and Customers allowed)

Section 4. Network Connectivity: Additionally applies if the Third Party has direct access to GE networks The business need to access GE data, networks, and systems is a decision based upon assessment by the GE Sponsor and GE Information Security Leader of the Third Party status, work performed, number of GE businesses served and type of access.
Examples (Note: GE Sponsor and GE Security Leader will adjust based upon business need and data classification) On-site with No Sensitive Access Remote VPN L1 Helpdesk Basic Third Party L1 Helpdesk/Device Support Remote Hosting/Housing On-site Development/Data Processing Basic Third Party Development/Data Processing Trusted Third Party L1 Helpdesk/ Device Support/Network Management Trusted Third Party Development/ Data Processing/Hosting/Housing 2. General Security Requiremen ts Yes 3. Data and Application Security Requirements 4. Network Connectivity Security Requirements

Yes Yes Yes

Yes Yes Yes Yes

1.6 Third Party Approvals

All Third Party access should be sponsored, reviewed and approved by the sponsoring business with: GE Sponsor: Approves request as a business need and ensures the security reporting structure is in place. GE Business Legal Team: Approves contract as meeting GE and legal standards. Master Services Agreement: reviewed and approved by the appropriate GE legal department with necessary signatures from both parties. GE Information Security Leader: Approves request as meeting security requirements specified in this document and the GE Information Security program including: Controllership: Personnel, physical, software, information asset ownership, access control and identity management responsibilities. Physical Security: Access to workplace, computer rooms, systems, and media/documents System Security and GE Metrics: System and application configurations and vulnerabilities with periodic metrics reporting to the GE Security Leader BCP/DR and Crisis Management: BCP/DR preparedness and management of GE or Third Party events include information security incident response. Business Access and Network Security: Type of Third Party Connection (Basic/Trusted), network access details and termination dates

2 General Security Requirements

2.1 General Audit
2.1.1 Specific language covering periodic general or industry-specific audits should be included in agreements between GE and the Third Party. Scope for compliance must be agreed upon with GE sponsor but will vary based upon industry and regulatory (such as SAS-70 or HIPAA) requirements. 2.1.1.1 Third Party must review with GE Information Security Leader all risk items identified through infrastructure reviews and audits that Third Party does not remediate within five business days.

GE Third Party Information Security Policy 5

January 4, 2007

GE Internal (Distribution to GE Third Parties, Suppliers and Customers allowed)

2.1.1.2 Third Party must be prepared to provide necessary confirming documentation in support of GEs external audits (such as Sarbanes-Oxley) upon GE request as outlined in GE supplier agreements. 2.1.1.3 In addition to any audits provided for in GE contractual agreements, the Third Party must permit GE to request and/or perform, at the expense of GE, up to two security assessments per year, including but not limited to, review of policies, processes, and procedures, on-site assessment of physical security arrangements, network, system, and application vulnerability scanning, and penetration testing. Such assessments will be communicated at least one-quarter year in advanced and conducted at a time mutually agreed upon between the Third Party and GE, and GE will provide the results to the Third Party. 2.1.2 Based upon GE business access type and security requirements established, ensure the appropriate general security controls are audited. 2.1.2.1 The Third Party upon request must provide copies of relevant security policy, process, and procedure documents to GE for review and audit purposes. GE should review and recommend reasonable changes, and supplier must amend the policies or respond with mitigating controls and responses.

2.2 Personnel
2.2.1 2.2.2 Specific language must be included in agreements to ensure Third Party has conducted region-specific background checks for Third Party GE Workers in GE engagements. Third Party Manager must ensure employees are aware of the fact that they are not entitled to privacy protection in the use of their company computers and networks, since these resources may be monitored. Third Party Manager must define a formal process for responding to a security policy breach by Third Party GE Workers. All Third Party GE Workers, contractors, and relevant third parties with access to GE networks and data must receive training on Acceptable Use of GE Information Resources (see document in Appendix) and Third Party security policy and legal compliance developed by the Third Party as part of their security awareness program. Third Party must maintain and audit the inventory of individual yearly acceptance of the guideline. The Third Party must employ designated staff whose primary job responsibilities focus on information security and information risk management. The Third Party Manager should ensure that Third Party personnel added to the GE account (in-processing) and removed from the GE account (out-processing) are completed in a timely, consistent manner auditable by GE.

2.2.3

2.2.4 2.2.5

2.3 Inventory, Ownership, and Classification

2.3.1 2.3.2 GE reserves the right to audit Third Partys GE inventories. Data Inventory: Third Party must maintain an inventory of all GE information assets including: 2.3.2.1 Name, location, retention, and GE-assigned data classification level (as described in the GE Data Classification Standard in the Appendix) of the information asset such as a database or file system. 2.3.2.2 A knowledgeable individual owner of each information asset with the default owner of an information asset is its creator. 2.3.2.3 Computer systems that house GE data and storage encryption status. 2.3.3 Application Inventory: Third Party must maintain an inventory of Applications that provide access to GE data and transmission encryption status with correlation to computer systems. 2.3.4 Assign access controls based upon classification and individual need to know 2.3.5 GE reserves the right to examine GE data and all data stored or transmitted by GE computers or communications systems that are the property of GE. (This is may exclude data specifically owned by any government agency or other businesses where GE is the caretaker rather than owner).

GE Third Party Information Security Policy 6

January 4, 2007 2.3.6

GE Internal (Distribution to GE Third Parties, Suppliers and Customers allowed)

Physical Inventory: Third Party must maintain an inventory of physical computing assets (including VPN hard tokens) used in the performance of the GE engagement. 2.3.6.1 Physical assets and equipment must have asset tags or recorded serial numbers. 2.3.6.2 Assign a knowledgeable individual owner and usage requirements to each asset. 2.3.6.3 Include purpose or project, locations authorized, and current location. 2.3.6.4 For GE-supplied equipment, record GE authorization (GE provides a template) and return date. 2.3.7 Software Inventory: Third Party must maintain an inventory of software used in the performance of the GE engagement: those licensed and issued by GE, procured by the Third Party and reimbursed by GE, and those procured by GE. 2.3.7.1 Include license date, purpose/locations authorized, and return date. 2.3.7.2 Record the GE authorization (GE provides a template) and usage compliance.

2.4 Data Storage and Handling

2.4.1 Third Party must at a minimum follow the GE Data Classification Standard (see Appendix) directives when storing GE data. The following best practices meet these requirements. 2.4.1.1 Non-public information can be stored locked, password protected/encrypted, or under direct user control (See Third Party Workplace Security). 2.4.1.2 Follow a clear desk policy to securely store GE documents. GE Confidential and Restricted printing jobs must not be left unattended. The Third Party security team must audit and confiscate unattended documents. 2.4.1.3 Passwords and challenge response answers must not be stored in clear text, but can be stored using a one-way hashing algorithm (e.g. MD5). 2.4.1.4 GE Confidential or Restricted information can be printed if attended. 2.4.1.5 Before computer magnetic storage media is sent to a vendor for trade-in, servicing, or disposal, all GE Confidential and Restricted information must be physically destroyed, or erased using tools for hard disk overwrite provided on GE Securing Your Computing Environment SupportCentral). 2.4.1.6 All waste copies of GE Confidential and Restricted data generated in the course of copying, printing, or otherwise handling such information must be destroyed. 2.4.2 Do not make copies of GE Confidential or Restricted information without the permission of the GE information owner. 2.4.3 GE data at the Third Party in any form must not be stored or replicated outside the Third Party without special agreement; obtain approval from the GE Sponsor before transmitting GE data to a subcontractor or any non-GE entity. The Third Party Manager must maintain an inventory of the non-GE entities that are receiving the data, the purpose of the data transmission, the transmission and encryption/protection method or protocol, the data that is transmitted and the GE approver and GE Information Security Leader who has authorized the transmission with these controls. 2.4.4 Upon conclusion or termination of the work agreement, the Third Party must provide GE with copies of all GE information maintained under the work agreement, as well as all backup and archival media containing GE information. 2.4.5 Upon conclusion or termination of the work agreement, the Third Party must use mutually agreed upon data destruction processes to eliminate all GE information from the Third Party systems and applications.

2.5 Data Transmission

2.5.1 Third Party must at a minimum follow the GE Data Classification Standard (see Appendix) directives when transmitting GE data. The following GE best practices meet these requirements. 2.5.1.1 Email: Since GE Confidential and Restricted Information must be encrypted when transferred over public networks (such as the Internet), GE supports SMTP encryption using TLS on the gateway. Country-specific legal and regulatory requirements must be reviewed concerning the use of encryption technology.

GE Third Party Information Security Policy 7

January 4, 2007

GE Internal (Distribution to GE Third Parties, Suppliers and Customers allowed)

2.5.1.2 Printed Delivery: Send GE Confidential and Restricted printed information by trusted courier or registered mail with tracking approved by GE. 2.5.1.3 Fax: Information classified as GE Confidential or Restricted can be faxed to passwordprotected mailboxes or a by sent after verifying a trusted contact is standing by to receive. 2.5.1.4 Phone: GE Restricted information must not be discussed on speakerphones or during teleconferences unless all participating parties first confirm that no unauthorized persons are in close proximity such that they might overhear the conversation. 2.5.1.5 Mobile Phone: GE Confidential or Restricted information must never be discussed on cordless or cellular telephones. 2.5.1.6 Electronic Transmission: where available, use file-based PGP/GPG encryption with TLS/SSH encryption over a Basic Third Party Network connection.

2.6 Laptops/Workstations
2.6.1 Third Party is responsible for the infrastructure that supports user compliance with the Acceptable Use of GE Information Resources (see Appendix). The policy applies to laptops, desktop PCs, Unix workstations, and mainframe terminals. Third Party must maintain laptop and workstation security through demonstrated provisioning, patching, and antivirus processes. Personal firewall and anti-virus are required for all Windows systems. Laptop disks should be encrypted. Systems with direct access to the GE internal network must follow monthly reporting to the GE Information Security Leader in the form of the GE Information Security Metrics. They may be restricted or removed for compliance failure or compromise. GE data must not be stored on laptop computers or other portable computing devices. Although laptops should primarily be used for access, not storage, specific exceptions may be granted by the GE Information Security Leader for GE coreload systems running GE-licensed software, with patching, anti-virus, encryption, and personal firewall conforming to GE security requirements with justified business need.

2.6.2

2.6.3

2.6.4

2.7 Business Continuity Planning/Disaster Recovery

2.7.1 Specific language must be included in agreements to ensure Third Party has a tested and sufficient BCP/DR plan and reporting process. So that the business processes may be quickly re-established following a disaster or outage, the Third Party Security Leader must maintain an updated inventory of all critical production systems and supporting hardware, applications and software, projects, data communications links, and critical staff at both the primary and secondary sites. Third Party Security Leader must ensure preparation, maintenance, and regular test of the BCP/DR plan that allows all critical computer and communication systems to be available in the event of emergency or a disaster, and meet service level and recovery time and recovery point objectives. BCP/DR test results must be periodically reported to GE Information Security Leader. Any emergency event-related disruption of business activities must be reported to the GE Sponsor. Ensure backup site security requirements meet GE Third Party Information Security Policy.

2.7.2

2.7.3 2.7.4 2.7.5

2.8 Incident Response

2.8.1 Third Party Manager or Third Party Security Leader must maintain an up-to-date information security incident response plan including mobilization contact/call trees, bridge numbers, severity assessment, log recording steps, evidence collection and process diagrams. 2.8.1.1 Third Party Security Leader must review test results of periodic drills with GE Information Security Leader. Violation of GE Information Security policies, virus/worm attacks, spam, data compromise, and physical asset loss must be covered.

GE Third Party Information Security Policy 8

January 4, 2007

GE Internal (Distribution to GE Third Parties, Suppliers and Customers allowed)

2.8.1.2 The Third Party, at the request of GE, must provide copies of any log files maintained by the Third Party (including firewall, intrusion detection, system, and application log files) to support any investigation or legal action that may be initiated by GE. 2.8.2 Specific language must be included in agreements to ensure Third Party has a tested and sufficient incident response and GE reporting process. Third Party Manager must notify and update the GE Sponsor and/or GE Information Security Leader without unreasonable delay of any actual or threatened unauthorized access or release of GE Confidential or Restricted data or to the systems holding or providing access to such data. Final notification must include detailed incident log and root cause analysis within five days of closure that describes actions taken and plans for future actions to prevent a similar event from occurring in the future. The Third Party Information Security Leader must negotiate process with GE Security Leader, but expectation is within two hours of discovery and mutually agreed upon updates for agreed upon high-impact incidents. 2.8.2.1 Third Party must report all occurrences of viruses and malicious code, not handled by deployed detection and protection measures, on any workstation or server used to provide services under the work agreement, to GE without unreasonable delay. GE expectation is within four hours as negotiated with the GE Information Security Leader. 2.8.3 Specific language must be included in agreements to ensure Third Party has a tested and sufficient GE disclosure approval process. Third Party must take action immediately to identify and mitigate an incident, and to carry out any recovery or remedies. Third Party must first secure GE approval of the content of any filings, communications, notices, press releases, or reports related to any security breach prior to any publication or communication thereof to any third party. The Third Party Security Leader must maintain a well-understood reporting procedure for security incidents and train Third Party GE Workers on GE contracts.

2.9 Third Party Workplace Security

2.9.1 2.9.2 Entry to the Third Party area with GE data access must be restricted to personnel authorized for access including an access termination procedure and periodic audit. Visitor logbooks must be maintained which includes clear description of the visitor, arrival and leaving time, and GE-relevant business purpose. A Third Party employee must always escort visitors within the Third Party area. A security guard or electronic access control must protect entry to Third Party area. Entry and exit logging are preferable. Software-based access control systems must be secured, have proper backups and be highly available. Entry logs must be maintained for at least six months. Ensure windows or any other auxiliary entry points are secured. If not staffed 24x7, alarms and entry point security cameras must be installed for off-hours access monitoring with recordings retained for at least one month.

2.9.3

2.9.4

2.10 Computer Room Access

2.10.1 All computer room doors must be secured to prevent access into the room unless otherwise authorized by the Third Party Security Leader. 2.10.2 Each computer room door must have signs on both sides indicating it is to be closed and locked with a contact to notify if it is found unsecured. 2.10.3 An identification badge reader must control all entrances into the computer room. Any other doors must be exit-only. The entrance and exit doors must be alarmed such that if left unsecured longer than one minute, the Security Office will be automatically notified. The Security Office must investigate the cause of the alarm, arrange to have it corrected, and notify the Third Party Security Leader of incidents. 2.10.4 Identification Badge Systems must generate a log of each entry. All door openings must generate a log entry, and every time the identification badge reader is used, it must log date, time, room location, and badge number.

GE Third Party Information Security Policy 9

January 4, 2007

GE Internal (Distribution to GE Third Parties, Suppliers and Customers allowed)

2.10.5 Anyone needing badge access to any computer room must follow a defined procedure approved by the Third Party Security Leader including the badge holders name, badge number, computer room location, reason access is needed, and termination date for fixed duration Third Party GE Workers. The Third Party Security Office must not configure any badge for computer room access without being authorized by the Third Party Security Leader or designated team members. 2.10.6 Employment termination must result in badge access termination within a number of hours agreed upon by the GE Information Security Leader. The Third Party Security Leader must confirm that the badge access list is validated every quarter to verify those on this list still require access. Any discrepancies found must be corrected. 2.10.7 Badge access must only be given to individuals who require long-term access (those who are responsible for continuous administration or maintenance of the equipment located in the room). Visitors having business need confirmed by the Third Party Security Leader are allowed escorted access. If system access is required, the escort must have the technical security background to monitor any commands typed, or equipment added or removed. The Third Party Security Leader may allow badge access for short-term access under special circumstances if determined appropriate. 2.10.8 Anyone having badge access to a computer room must not give or loan their badge to another to gain access to a computer room. 2.10.9 If it is necessary to leave a computer room door open for a specific time period for individuals who do not have access: 2.10.9.1 The Third Party Security Leader or designated team members must authorize the unsecured door request for a specific time period and document in the access logs. 2.10.9.2 A badged contact must be assigned to monitor the unsecured area and ensure the door is secured at the end of the specified time. Posted signs are recommended.

2.11 Consumer and Regulatory Compliance

2.11.1 Specific language must be included in agreements to ensure Third Party protects GE worker privacy. Third Party must not disclose, market or otherwise contact GE customers or employees/contractors outside of their work on behalf of GE, either electronically or through other media, using information gathered from Third Party web sites or GE data. 2.11.2 Specific language must be included in agreements to ensure Third Party complies with industry and regulatory policies applicable to GE data and security controls such as HIPAA, Sarbanes-Oxley, GLBA). If one of the above stated policies is in conflict with a governmental regulation, the issue must be presented to the GE Information Security Leader for investigation and resolution.

3 Data and Application Security Requirements

3.1 Data and Application Audit
3.1.1 3.1.2 A Third Party Housing or Hosting GE Confidential or GE Restricted data must have infrastructure reviews performed by a third party at least annually. Third Party must periodically conduct external security audits of their Internet-facing applications that make available GE Confidential or GE Restricted information, and the infrastructure that holds or transmits GE data. A sanitized version of these results must be provided to GE. Perform a source code review of all non-static application logic changes before they are moved into production or perform an application penetration test at least twice yearly. Third Party must conduct regular periodic and change-related internal audits of networks and systems.

3.1.3 3.1.4

GE Third Party Information Security Policy 10

January 4, 2007 3.1.5

GE Internal (Distribution to GE Third Parties, Suppliers and Customers allowed)

Third Party must review with GE all high-risk items identified through infrastructure reviews, code reviews and audits (internal or external, security and otherwise) that Third Party does not remediate within 10 business days. 3.1.6 Based upon GE business access type and security requirements established, ensure the Data and Application Security Requirements (and Appendix checklist) to assess application security controls are audited. 3.1.6.1 The Third Party upon request must provide copies of relevant security policy, process, and procedure documents to GE for review and audit purposes. GE should review and recommend reasonable changes, and supplier must amend the policies or respond with mitigating controls and responses.

3.2 Data Isolation and Architecture

3.2.1 GE data must be stored in a separate system or database instance from data belonging to or accessed by other companies. If this is not possible, adequate controls must be documented and approved by the GE Information Security Leader to ensure that a compromised database must not yield any GE data. GE data must be backed up on separate tapes/drives than data belonging to or accessed by other companies. If this is not possible, adequate controls must be documented and approved by the GE Information Security Leader to ensure that a compromised database must not yield any GE data. At no time may GE data be housed on a server shared by companies other than the contracting vendor. For example, a shared web server that is used by several companies and maintained by an Internet Service Provider must not be used to house GE data. Internet facing web servers must be dedicated to this task, and must not host internal (intranet) applications for the Third Party.

3.2.2

3.2.3

3.2.4

3.3 Change Management

3.3.1 Third Party must have a documented change management procedure for applications and networks that support GE processes or for Housing GE data. 3.3.1.1 Third Party change management process must have clear separation of duties. 3.3.1.2 Third Party must have a documented source code versioning procedure. 3.3.2 Third Party must have a demonstrable process for keeping servers and software updated with the latest patches and service packs as recommended by the OS and software vendors. 3.3.3 Third Party must have separate development, staging, and production environments. 3.3.4 Production GE data must not be used in the Third Partys development or staging environment without approval from the GE Sponsor or GE Information Security Leader. If a production extract is used, the Third Party must de-identify the GE data or use a tool to obfuscate the GE data before it is inserted into these environments.

3.4 Server Operating Systems

3.4.1 Antivirus must be installed on all Microsoft Windows systems. 3.4.1.1 Antivirus definitions must be updated at least once a day. 3.4.1.2 Do not install any freeware and shareware software before consulting Third Party Security Leader for review and approval. 3.4.1.3 Avoid installing plug-ins from Internet sites or using servers for general browsing. 3.4.2 The latest critical operating system, application, database, and network patches as defined by the GE Information Security Metrics and Third Partys risk management process must be installed. 3.4.2.1 Third Party must demonstrate a security bulletin risk assessment process to react to emerging attacks and newly discovered vulnerabilities. 3.4.2.2 Systems must have weekly change windows for emergency and maintenance patching. 3.4.2.3 Latest Critical security and operating system patches should be installed within a seven-day change window to stem targeted attack or outbreak unless otherwise agreed

GE Third Party Information Security Policy 11

January 4, 2007

GE Internal (Distribution to GE Third Parties, Suppliers and Customers allowed)

upon with the GE Information Security Leader. Other patches should be assessed and applied during periodic maintenance windows. 3.4.3 Lock down the server operating system. The following minimum requirements must be expanded upon based upon industry best practices. 3.4.3.1 Only the minimum/necessary set of applications and services should be installed. 3.4.3.2 Source code of server-side executables and scripts should not be viewable by external users. 3.4.3.3 Packet filters (such as host-based firewall and TCP wrappers) should be installed to restrict connections to necessary hosts on necessary services and log incoming requests. 3.4.3.4 Synchronize time to a trusted time service. 3.4.3.5 Services that require different access should use different accounts IDs. 3.4.3.6 No SNMP accessibility from the Internet. It is recommended to disable all SNMP. 3.4.3.7 There should be legal notice warning of unauthorized access penalties where applicable. 3.4.3.8 The password database should be encrypted. 3.4.4 Lock down the web server using industry best practices. 3.4.4.1 The servers web root should be a unique directory from all other server files (i.e. all interpreters, shells and configuration files should be located outside of web server directory). 3.4.4.2 Directory browsing (indexed directories) should be turned off at the web server as to not reveal the presence of unlinked files. 3.4.4.3 The web server should run with minimum privileges necessary (not root or Administrator). 3.4.4.4 The web server host should not be a domain controller (NIS or Windows). 3.4.4.5 The web server host should not be configured as a router or packet sniffer. 3.4.4.6 The web server identification should be removed from the returned HTTP server field. 3.4.5 Lock down administration using industry best practices. 3.4.5.1 If Third Party has the capability to remotely administer servers, the remote connection must take place over an encrypted tunnel, and must require two-factor authentication. 3.4.5.2 All administrator accounts should have IP address restrictions, two-factor authentication or be limited to console login. 3.4.5.3 All administrative traffic should be encrypted. Encryption level should be defined based on the needs of the application. 3.4.5.4 All default accounts should be renamed or removed and all default passwords changed. 3.4.5.5 Access to devices involved in the provision of services should be granted only on a need to have basis. Server administration permissions are typically granted to a limited number of individuals within an organization. 3.4.5.6 More than one person should approve the granting of new administrator account access, and the addition/removal of account access should be auditable. 3.4.5.7 Shared administrative accounts should not be used. Instead, use individual accounts with an auditable method to escalate privileges for administration (example: PowerBroker, sudo) where possible. Admin passwords can also be checked out for a period of time then reset. 3.4.5.8 System and service account passwords used by automated and batch processes should only be granted restricted access. The account should be single purpose, noninteractive login, from controlled sources such as a fixed source IP as a second login factor. If account should have more access, the GE Sponsor should be made fully aware of their account responsibilities with the account description field annotating the contact. 3.4.6 At the initial user sign-on to any system, server, device, and/or application used to provide services under the work agreement, the Third Party must display a warning banner advising users that the system they are accessing is a private computer system and is for authorized use only and activities are monitored and recorded. The warning

GE Third Party Information Security Policy 12

January 4, 2007

GE Internal (Distribution to GE Third Parties, Suppliers and Customers allowed)

message should include content that advises prospective users that unauthorized and/or malicious use of the system is prohibited and violators may be prosecuted to the fullest extent of the local and international law and that by logging on, the user has read and understood these terms.

3.5 Data Back-Up

3.5.1 3.5.2 Third Party must have well-documented procedures for information backup. GE Confidential or GE Restricted data and Third Party systems critical to GE operational processes must be backed up and stored in physically secured area with periodic notification to the GE Information Security Leader of location and status. 3.5.2.1 Third Party must maintain all backup and archival media containing GE information in secure, environmentally controlled storage areas owned, operated, or contracted for by The Third Party and approved by GE Information Security Leader. 3.5.2.2 Third Party must limit access to backup and archival media storage areas and contents to authorized Third Party staff members with job-related needs. 3.5.3 Validity of backedup data must be checked on a periodic interval not more than quarterly to ensure data is available when required. 3.5.4 GE data must not be stored on removable media other than physically secured retention media expressly used for the purpose of backup or data retention for BCP/DR purposes. 3.5.5 Third Party must maintain adequate access and encryption controls on electronic backups as outlined in the GE Data Classification Standard. 3.5.6 If the Third Party uses off-site tape storage then Third Party or their subcontractor must use an auditable tape check-in/check-out process and locked storage for transportation.

3.6 Activity and Fault Logs

3.6.1 3.6.2 3.6.3 3.6.4 3.6.5 Success and failure for all user account logins, system logins, and administrative requests must be logged. General server event logs, utilization logs, and application events and errors must be periodically verified as functioning in case of a forensics investigation. The Third Party must maintain record for all hardware problems and operating system crashes. Authentication failures and successes must be reviewed (at least weekly) for security violations. Unless required otherwise by law, the Third Party must, at a minimum maintain logs for a period of no less than 180 days from origination.

3.7 Access Controls and Privilege Management

3.7.1 All GE Data must be protected via access controls. The information must be protected from improper access, disclosure, modification and deletion. See GE Data Classification Standard. GE data must not be disclosed to unauthorized personnel. Access to GE data must be approved on a business need basis. Access to servers must be restricted to authorized staff based on function (e.g., employees working in development must not have access to production servers). The users must be given access privileges with the minimum requirements as per their job requirements. Non-administrative users must not have access to administrative system software or utilities. Privileged or administrative accounts must only be given to the persons responsible for managing systems, databases and applications. Ensure procedures are in place to add, remove, and modify user access, including details on control of user administration rights.

3.7.2

3.7.3

3.7.4

3.8 User Accounts

3.8.1 General user account requirements

GE Third Party Information Security Policy 13

January 4, 2007

GE Internal (Distribution to GE Third Parties, Suppliers and Customers allowed)

3.8.1.1 Every user must have a unique user ID. No shared accounts must be used beyond built-in and system accounts where individual usage can be tracked. 3.8.1.2 The account owner is responsible for protecting data and resources that are proprietary to GE, respecting privacy considerations where appropriate, operating ethically, and following security and legal procedures. 3.8.1.3 Account settings should be configured such that files owned by that account are not world-accessible or other-accessible (for reading, write, or executing) by default. The account owner can modify accessibility as needed. 3.8.1.4 Upon employment termination, all accounts belonging to exiting GE Workers must be disabled or deleted on their departure date. 3.8.1.5 When an account is removed, files associated with the account must be transferred as instructed by the request. If specific instructions were not received, the files must be archived on tape or other approved backup media and then deleted from the system. 3.8.1.6 On a quarterly basis all user accounts must be reconciled. Any account that is not owned must be removed. Any account that is not sponsored, is not valid, or has not been accessed during the prior 90 calendar days or longer must be disabled. 3.8.2 GE Sponsored user accounts including SSO 3.8.2.1 A GE employee should sponsor all accounts on GE-managed systems assigned to Third Party GE Workers 3.8.2.2 The full name of the GE employee sponsoring the account should be included in the account profile in readable form such that the account can be easily identified as the responsibility of that employee. 3.8.2.3 The GE account sponsor is jointly responsible with the owner for protecting GE data and resources. 3.8.2.4 When a Third Party GE Worker leaves or is no longer actively engaged on a GE project, it is the responsibility of Third Party to inform the GE Sponsor to initiate account termination activities. 3.8.2.5 Disabled accounts must not be re-enabled until sponsored by a GE employee.

3.9 Password Policy

3.9.1 For GE systems, http://security.ge.com/ explains the password policy. Third Party account access must match or exceed GE or industry standard password management, and include audits for: 3.9.1.1 Minimum password length and complexity (example: 8 character length, Windows complexity). 3.9.1.2 Account login failure lockout (example: 9 failures). 3.9.1.3 No shared or group passwords. 3.9.1.4 Required encryption during network transmission. 3.9.1.5 One-way hash if stored (example: SHA-1). 3.9.1.6 Two-factor authentication is preferred and may be required for some applications such as remote access (example: RSA SecurID token). 3.9.2 When an administrator assigns a temporary password to an account, the user should be forced to change the password at the first sign-on.

3.10 Application Security

3.10.1 Third Party must incorporate information security testing checkpoints into the software development lifecycle. 3.10.2 Third Party must train developers in application information security and provide quantitative feedback on common vulnerabilities found along with prevention and remediation measures. 3.10.2.1 Follow the GE Application Security Guidelines (see GE Application COE SupportCentral and Appendix checklist) and stay informed of common vulnerability types at OWASP (owasp.org). 3.10.3 Third Party must follow standard application account security procedures.

GE Third Party Information Security Policy 14

January 4, 2007

GE Internal (Distribution to GE Third Parties, Suppliers and Customers allowed)

3.10.3.1 A secure process should be in place for distributing first-time passwords. First time password should be unique, randomly generated, not publicly available, and may only function one time. 3.10.3.2 The system should force a password change upon a users first login. The permanently selected password may not be the same as the first time password. 3.10.3.3 An account lockout should be in place whereby the users account is locked after a certain number of unsuccessful attempts. 3.10.3.4 A user may reset or reactivate their password by answering a challenge/response or requiring that a new one-time use password be sent to the users e-mail address. The username should not be present in this e-mail. 3.10.3.5 Auditing and logging procedures should be in place for all account access. 3.10.3.6 A process should be in place for account disablement. Third Party should have a process to immediately disable an account in an emergency situation (within 10 minutes) as well as a process for normal account retirement. 3.10.3.7 Password aging should be in place for all accounts, with password changes forced at least yearly. Any system that houses HIPAA regulated data should meet HIPAA standards for password aging. 3.10.3.8 After the third set of failed login attempts, the account should be permanently disabled and the user should contact the customer service/help desk to reestablish the account. 3.10.3.9 Administrative accounts should be automatically disabled when an administrator no longer requires access to systems or applications or terminate employment with the Third Party. 3.10.3.10 Third Party should perform administrative account audits at least quarterly. Audits should identify and disable accounts that are not actively administering the system or accounts that no longer require access to the systems or networks. 3.10.3.11 At GEs request, Third Party should provide an inventory, for each application or system that accesses GE Data, of all application roles, a description of each role and how many active users are assigned to each role.

4 Network Connectivity Security Requirements

4.1 Third Party Type and Audit
4.1.1 Based upon GE business access type and security requirements established, ensure the Network Connectivity Security Requirements (and Appendix checklist) to assess access security controls are audited. 4.1.1.1 The Third Party upon request must provide copies of relevant security policy, process, and procedure documents to GE for review and audit purposes. GE should review and recommend reasonable changes, and supplier must amend the policies or respond with mitigating controls and responses. 4.1.2 Each Third Party Connection should have a termination date that is not more than 18 months from the start of the connection. The GE Sponsor is responsible for reviewing and either renewing or terminating the connection prior to the termination date. If the connection needs to continue after the termination date, a review of the connection should take place to ensure the correct security measures are in place to meet any new or updated business needs and to utilize new technology. This review should take place prior to the termination date to ensure continued service.

4.2 Third Party Network Transport Requirements

4.2.1 Dedicated circuit/frame/ATM connection or site-to-site VPN from the Third Party parent network to the GE internal network leveraging existing ISP Internet connectivity is acceptable. Other options such as MPLS and e-WAN require special review and approval by the GE Information Security Leader. The following are the site-to-site requirements. 4.2.1.1 Use a screening device that allows only VPN IPSec protocols (IP 50/UDP 500/ping) to the Third Party-side termination point. This may be a firewall or router ACLs.

GE Third Party Information Security Policy 15

January 4, 2007

GE Internal (Distribution to GE Third Parties, Suppliers and Customers allowed)

4.2.1.2 The VPN termination point that allows IPSec main-mode connections from a fixed list of GE VPN hubs. IPSec aggressive mode is not allowed. The VPN may optionally terminate on either the screening or firewall device. 4.2.1.3 GE manages the network device endpoints. This is required for both security and operational reasons. GE Global Infrastructure Services (GIS) requires out-of-band connectivity to the remote endpoint for debugging purposes. 4.2.1.4 Periodic audit should include external scans of the Internet-reachable devices used to build the VPN tunnel 4.2.1.5 No unencrypted sensitive GE traffic transits the Internet. If unencrypted but sensitive email attachments are required over the Internet, GE supports SMTP TLS transport encryption.

4.3 Basic Third Party Access Requirements

4.3.1 A site-to-site connection between the Third Party network and GE internal network should have a firewall. 4.3.1.1 The GE firewall should be on the GE network in a GE-controlled facility. Since it is a GE internal firewall, it must not be visible to the Internet. 4.3.1.2 The interface between the Third Party and GE should be monitored for inappropriate activity using intrusion detection or preferably prevention systems (NIDS/NIPS) or monitored firewall IDS/IPS. 4.3.1.3 It is recommended that the Third Party protect its internal network from GE by implementing a Third Party-managed firewall with Least Access rules. 4.3.2 Access to and from GE to the Third Party network should be reviewed and approved by the GE Information Security Leader 4.3.2.1 Rules should specify IP-to-IP access with specific ports and protocols. 4.3.2.2 Third Party and GE should not use NetBIOS protocols (for example 135/137/138/139/445). 4.3.2.3 SMTP is more securely transmitted using TLS encryption through the Internet. 4.3.2.4 GE should not allow Basic Third Party access to corporate shared resources such as internal instant messaging, email, DNS, and shared web portals. 4.3.2.5 For inbound access to GE, if a large network range (DHCP), or the protocol used does not support authentication, or it allows general next hop access (telnet/SSH), then the approval should require authentication of the Third Party prior to GE network access. Methods include two-factor logged/control Citrix access, Nortel IPSec, SSL-VPN, or GE network proxy with restricted access. Logs for audit for forensics should cover 15 days. 4.3.3 A site-to-site connection between Third Party network and GE internal network requires NAT of GE internal addresses. 4.3.3.1 GE internal address space (such as 3.0.0.0/8) may not be routed into the Third Party network. NAT GE addresses to either RFC1918 or GE-assigned 205.173.88.0/24. 4.3.3.2 Third Parties address space should not be translated. It should be registered address space that is not accessible from the Internet. This enables simpler identification of network traffic.

GE Third Party Information Security Policy 16

January 4, 2007

GE Internal (Distribution to GE Third Parties, Suppliers and Customers allowed)

All access from Basic Third Party Segment to other networks not managed by GE

Basic Third Party Network

Non GE Network GE Network

Required Firewall with NAT

Required Network IPS (preferred) IDS or Firewall Monitoring

User

Server

GE Network

All access from Trusted Third Party Segment to other networks managed by GE

Trusted Third Party Network

GE Network Extension GE Network

Optional Firewall with NAT

Optional Network IPS (preferred) IDS or Firewall Monitoring

User

Server

GE Network

GE Third Party Information Security Policy 17

January 4, 2007

GE Internal (Distribution to GE Third Parties, Suppliers and Customers allowed)

4.4 Trusted Third Party Access Requirements

4.4.1 4.4.2 Outbound Gateways (Internet access) and Inbound Gateways (Hosting)subscribe to an existing GE shared service for gateway access. VPN Gateways and Remote User Gatewaysincluding two-factor authentication for dialup, VPN, and mobile gateway should be managed by GE onlyno Third Party-managed gateways Wireless LANuse hardwired connections only or work with GE Information Security Leader for exceptions using PEAP-GTC mutual authentication following the GE Wireless LAN guidelines Connections and LANseparate Layer-2 switch infrastructure for IP, but can use shared ISP connectivity for site-to-site VPN transport. Vulnerability detection and preventionanti-virus with updates no more than a day old for all Windows systems, personal firewall for all desktop/laptop, patching for all systems. GE Security Metricsreport monthly through the GE Information Security Leader of security defects and opportunities (contact GE Information Security Leader for details and process). Physical Securityaccess restricted to Third Party GE Workers assigned to GE contracts and briefed on GE acceptable use policies.

4.4.3

4.4.4 4.4.5 4.4.6

4.4.7

4.5 Trusted Third Party Network Architecture

4.5.1 All current and new interconnections between the Trusted Third Party network and any other network, including the Internet and other companies, should be managed by GE and should meet GE standards and requirements for these types of connections. 4.5.2 The Trusted Third Party Network by default is a standalone group of subnets with no physical or logical connectivity to any network other than the GE network. The business network of the Third Party should not share layer-2 switches. GE has approved outbound connections to a GE-dedicated parent email server, and parent network web pages for timecard reporting on a case-by-case basis using a GE-managed Basic Third Party firewall separating the Third Party GE network from the Third Party parent network. This is an exception; no standard network architecture is detailed in this document. 4.5.3 Firewall filtering rules are recommended between the Trusted Third Party Network and the GE network to limit the access from the Trusted Third Party Network to only the systems needed to implement the business function. These filters should also ensure that all traffic destined for the GE network originated on the Trusted Third Party Network. Note: If total access to the GE network is required then filters are not needed, but have proven useful during incident response. The use of filters should support the business need while providing only necessary access. 4.5.4 The address given to the Trusted Third Party Network is dependent on the work being done by the Trusted Third Party for GE and the access needed. 4.5.4.1 If the work is being performed for a specific business or for network/compute management, then use addresses that are registered to the Third Party but not publicly routed. It is acceptable to translate from non-3.x IP address similar to a Basic Third Party. 4.5.4.2 Although discouraged, a 3.x address can be provided. A joint venture managed and treated as a part of a GE business is an example. Note that this should cause the Trusted Third Party Network to be treated as an internal GE network within all GE businesses. 4.5.5 It is recommended that the interface between GE and the 3rd party be monitored for inappropriate activity using intrusion prevention/detection technology. 4.5.6 Physical access to the network devices (routers, hubs, switches, etc.) should be protected to allow access only by GE approved network administrators and GE-approved Third Party staff.

GE Third Party Information Security Policy 18

January 4, 2007 4.5.7

GE Internal (Distribution to GE Third Parties, Suppliers and Customers allowed)

The Trusted Third Party should scan their network and systems at least weekly using the supplied GE Security Metrics ISS scanner policies or an equivalent tool and updated process agreed upon with the GE Information Security leader. All machines with vulnerabilities should at a minimum be updated with patches assessed by GE as trackable within 7/30-day patch cycle. Security metrics for systems on the network should be reported monthly to the GE Information Security Leader. 4.5.8 Network ownership for reporting and incident response should be assigned to the sponsoring GE business in the GE Subnet Inventory. The GE Suspect List should be regularly monitored by the Trusted Third Party and suspects investigated and closed within a 48-hour timeframe. 4.5.9 Remote access is only allowed through the GE VPN hub infrastructure with two-factor authentication. The Third Party Network site-to-site hub should not be configured to support client access. 4.5.10 Modem access (dial-up or ISDN) to the Trusted Third Party Network is prohibited except for GE out-of-band management access of critical systems, in conformance with GE guidelines. 4.5.10.1 Modem should be set to silent answer, callback, or authenticating in addition to remote device authentication with failure delay settings and placed in a physically locked area.

4.6 Trusted Third Party Outbound Proxy Servers

4.6.1 4.6.2 The Trusted Third Party should use a GIS-managed external proxy. The proxy should be configured with the GE standard filter list. The following filter settings typically enable business use of the Internet. The categories should be reviewed yearly. 4.6.2.1 GE recommends blocking Anonymizers/Translators, Sex, Drugs, Hate Speech, Criminal Skills, Gambling, Games, Extreme/Obscene/Violence, Chat, Webmail, Dating, and Cults/Occult. 4.6.3 Logs of proxy should periodically be reviewed for potential violations.

4.7 Trusted Third Party Email Servers

4.7.1 Block the following attachment types in email, with periodic updates by the GE Information Security Leader. Restrictions have been placed on the types of email file attachments that should be permitted when using company email. The restrictions apply to incoming and outgoing messages, both internal to GE and to/from external addresses. Attachments of most of the common file types are permitted. These include: Word (.doc), Excel (.xls), PowerPoint (.ppt), Images (e.g., .jpg) and PKZIP (.zip). HTTP links embedded in the email pointing to internal or external web addresses are also permitted. 4.7.1.1 Third Party should block ade;adp;app;asf;asx;bas;bat;bz2;chm;cmd;cnt;com;cpl; crt;dll;eml;exe;fxp;hlp;hta;inf;ins;isp;js;jse;lnk;mdb;mde;mht;msc;msi;msp;mst;pcd; pif;prg;rar;reg;scr;sct;shb;shs;url;vb;vbe;vbs;wmd;wsf;wsc;wsh. 4.7.2 GE shared service email servers are preferred for GE Confidential/Restricted business processes. These accounts have ge.com email addresses. 4.7.3 For administrative email, GE can provide GE GAL entries labeled as non-ge pointing to a shared email server on the Trusted Third Party Network for non-sensitive communications and business processes. The GE Information Security Leader should approve use. 4.7.4 The GE Sponsor or GE Information Security Leader should set up a process for email account creation/deletion for GE mailboxes.

GE Third Party Information Security Policy 19

January 4, 2007

GE Internal (Distribution to GE Third Parties, Suppliers and Customers allowed)

5 Appendix
5.1 Appendix A: GE Data Classification Standard

"GE Data Classification 20060615.doc"

5.2 Appendix B: GE Acceptable Use Guidelines

"The Acceptable Use of GE Information Resources v1.pdf"

5.3 Appendix C: GE Supplier Security Risk Analysis Checklist

"GE Supplier Security Risk Analysis Checklist 20060925.xls"

Document Change Control

Revision Date 2006/06/23 Types of Changes DRAFT: Major merge with Third Party Guidelines, Acceptable Use Guidelines and ASP Guidelines Author Scott Denton Scott Greaux Brad Freeman Shaveta Wadhera Bryan Fansler Scott Denton Carolyn Bardani Scott Denton Jennifer Ayers Neeta Maniar Juan Castillo Scott Denton Scott Greaux Stephen Scorziello Shaveta Wadhera Scott Denton Scott Greaux

2006/07/19 2006/11/15

CIS/GIS Corporate Approved Third Party Guideline not yet ratified by GE Security Council GE Commercial Finance changes with GE Security Council Approval; Merged GE Supplier Security Checklist with Trusted Third Party; Scope timeline and GE TSG updates. Updates from Corporate Sourcing and GDC reviews Finalized effective date to September 15th, 2007 Updated embedded AUG document to new Acceptable use of GE Information Resources document and updated references to use the new document name.

2006/12/18

2007/01/04 2007/07/10

GE Third Party Information Security Policy 20