EXHIBIT C
INFORMATION PROTECTION PROGRAM
DST has a formal Information Protection Program (IPP) that was established and exists as a working roadmap for DST security. DST does Risk Assessments, Security Assessments, Security Awareness for the corporation as a whole, targeted training for specific applicable groups, and other security related activities. DST has a program and process pursuant to which DST reviews its technology and architecture and security requirements and needs.
Integral to the function of the IPP is the Global Security Council (GSC). The GSC convenes periodically during the year and is responsible for 1) identifying, measuring and rating risks, 2) approving policies, standards, and practices, and 3) assessing and reporting progress towards compliance. The IPB convenes periodically during the year and is responsible for providing executive level oversight and guidance to the Information Protection Program.
A component of the IPP is DST’s Policies, Control Standards, and Technology Baselines. DST’s Security Management Console (SMC) is an on-line system DST obtained from Archer Technologies that provides Security Policies, Control Standards, and Technical Baselines, oriented to the financial industry. The policies and standards incorporated in the SMC are designed to be consistent and evolve with ISO27001, HIPAA, Data Protection Act of 1998, IS Forum Standards, FFIEC IS Booklet, and MAS to the extent DST deems them applicable to its business.
DST has in place security log and activity monitoring, on a 24x7x365 basis. DST has an Intrusion Detection System (IDS) implemented to keep us informed on network activity. DST has an incident response process to deal with unexplainable logs and activities that are observed. This process is reviewed for validity and effectiveness for the purpose. DST also uses third party security reviews to provide the information to support DST’s security efforts.
All of the foregoing policies and procedures are subject to regular review and modification without notice, it being agreed that (i) no change to the foregoing shall diminish the over-all level of security and protections afforded to The Fund Data as maintained on the DST Subaccounting System and the DST Facilities and (ii) DST hereby undertakes that it shall at all times have in place data security policies and standards that are reasonably designed to be consistent and evolve with ISO27001, HIPAA, Data Protection Act of 1998, IS Forum Standards, FFIEC IS Booklet, and MAS to the extent DST reasonably deems them applicable to its business.
DST will continue to provide The Fund with a SSAE 16 report once every six (6) months, which details DST’s internal controls surrounding the TA2000 Mutual Fund Transfer Agent Processing system.