Data Security Policy

Introduction

The Data Security Policy (DSP) provides a comprehensive framework for ensuring the confidentiality, integrity, and availability of data and information systems at American Choice Vanlines LLC. This policy applies to all employees, contractors, and partners who interact with data systems in the course of our operations.

American Choice Vanlines LLC is committed to protecting its clients, employees, partners, and operations from unauthorized access, alteration, disclosure, or destruction of data. It is the responsibility of all personnel to adhere to this policy and conduct their activities in accordance with it.

Purpose

The purpose of the Data Security Policy is to outline the security controls and procedures that protect the following:

• The confidentiality, integrity, and availability of data.
• The prevention of unauthorized access or misuse of American Choice Vanlines LLC’s data and information systems.
• Compliance with relevant legal, regulatory, and contractual obligations regarding data security.

This policy ensures that all personnel, partners, and third-party vendors operate in a manner that protects the company’s data and systems from exposure to risk.

Scope and Applicability

This policy applies to all data, information systems, and business operations conducted by American Choice Vanlines LLC. It covers all employees, contractors, and third-party vendors involved in the storage, processing, transmission, and disposal of data.

All personnel are expected to comply with the provisions outlined in this Data Security Policy. Contractors, third-party service providers, and business partners are required to comply with this policy when working with American Choice Vanlines LLC’s data and systems.

Violations

Any violation of the Data Security Policy may result in disciplinary action, including termination of employment or termination of business relations with American Choice Vanlines LLC. Individuals who violate applicable local, state, federal, or international laws will be reported to the appropriate authorities for civil or criminal prosecution.

1.0 Information Security Program

American Choice Vanlines LLC will maintain a robust information security program designed to protect data and systems from unauthorized access or compromise. This program includes the implementation of appropriate administrative, technical, and physical controls to safeguard data and ensure compliance with all applicable legal obligations.

The program is overseen by senior management and is regularly reviewed to ensure its effectiveness. An independent, annual risk assessment will be conducted to track risks and maintain compliance with industry standards.

1.1 Management Commitment to Information Security

American Choice Vanlines LLC management is fully committed to protecting information assets and ensuring the security of data. Management demonstrates this commitment by:

• Treating information as a critical business asset.
• Ensuring the enterprise has a comprehensive set of security policies.
• Reviewing information security risks annually.
• Conducting regular external audits to ensure best practices are met.

1.2 Organization of Information Security

The Information Security Officer (ISO) at American Choice Vanlines LLC is responsible for managing the information security program. Responsibilities include:

• Establishing and distributing security policies and procedures.
• Overseeing information security incidents.
• Evaluating risks related to business initiatives and procurement processes.
• Collaborating with internal and external auditors to review security practices.

1.3 Security Awareness and Training

All personnel are required to participate in regular security awareness training. This training helps employees understand their roles in safeguarding data and reducing the risk of security incidents. Role-based training is required for employees with access to sensitive data or systems.

1.4 Identification of Security Controls

American Choice Vanlines LLC identifies security requirements through risk assessments, penetration tests, and compliance with legal, regulatory, and contractual obligations. These assessments ensure the protection of sensitive information.

1.5 Data Classification and Handling

Data is classified according to its sensitivity to ensure appropriate handling and protection. All data is categorized as Public, Proprietary, Restricted, or Highly Restricted, and specific controls are applied to each category. Special procedures apply to sensitive customer data to ensure proper handling.

1.6 Legal, Regulatory, and Contractual Compliance

American Choice Vanlines LLC ensures compliance with relevant laws, regulations, and contractual obligations related to data security. The information security program is aligned with legal requirements to protect the company’s data and business operations.

1.7 Audits and Reviews

The company conducts regular audits of its information security controls to ensure compliance with security policies and to address potential risks. These audits are performed both internally and by independent third parties.

2.0 Access Control

Access to American Choice Vanlines LLC systems is controlled and reviewed regularly to prevent unauthorized access to data. Access is granted on a need-to-know basis and is aligned with the principle of least privilege. User access to sensitive data is audited quarterly, and access to general data is audited annually.

2.1 User Access Management

User identities are managed through a centralized system, ensuring proper authentication and authorization for system access. Access is immediately revoked upon termination of employment or contract, and inactive accounts are disabled after 90 days.

2.2 Password Management

Passwords are considered Highly Restricted information and must comply with industry standards for complexity and security. Passwords must never be shared, written down, or transmitted via insecure methods.

3.0 Operational Security

American Choice Vanlines LLC follows defined security procedures to protect systems and data. Regular patch management and change control processes ensure systems remain secure and operational without interruption.

3.1 System Hardening

All systems are hardened according to industry standards to minimize the risk of compromise. Hardening procedures include removing unnecessary functionalities, enabling encryption, and disabling default vendor accounts.

3.2 Patch Management

Critical patches are applied as soon as possible, and general patches are installed quarterly. All patches are tested in a controlled environment before being deployed to production systems.

4.0 Business Continuity and Disaster Recovery

American Choice Vanlines LLC has a comprehensive Business Continuity (BC) and Disaster Recovery (DR) plan that ensures the restoration of business operations in the event of a disruption. The BC/DR plan is tested annually to ensure the company’s ability to recover critical systems in a timely manner.

5.0 Incident Response

American Choice Vanlines LLC follows a structured incident response process to address security incidents. This process includes preparation, identification, containment, neutralization, recovery, and lessons learned. The incident response plan is regularly reviewed to ensure its effectiveness.

6.0 Acceptable Use

All personnel using American Choice Vanlines LLC’s equipment and systems must adhere to the Acceptable Use Policy. This policy outlines the proper handling of company data, systems, and communications to ensure the protection of sensitive information.

6.1 Equipment and System Usage

Users must report lost or stolen equipment, follow proper data handling procedures, and use systems for business purposes only. Personal use of company equipment is strictly prohibited.

7.0 Vendor Management

Third-party vendors and partners are required to adhere to the same data security standards as American Choice Vanlines LLC. Contracts with vendors will include provisions that ensure the protection of American Choice Vanlines LLC data.

8.0 Audits and Reviews

Regular audits are conducted to ensure compliance with this Data Security Policy. These audits are performed both internally and by third-party entities to maintain the security of American Choice Vanlines LLC’s data and systems.

By implementing and adhering to this Data Security Policy, American Choice Vanlines LLC ensures that data and information systems remain secure, compliant, and resilient against potential threats.