IT Security Policy

• An information security policy framework, consisting of policies, standards and procedures is in place to assure the secure provision of applications and services to the
• customer. This includes the overarching global information security policy and the global acceptable use policy.
• All policies and standards are reviewed, version- controlled and authorized on a regular basis in relation to the applications and services that Wolters Kluwer provides, and as relevant to the risk and compliance requirements that may arise in the external and internal environments.

• There is a formal risk assessment process in Wolters Kluwer and regular and periodic risk assessments of all identified Assets are conducted.
• The frequency of risk assessments is based on changes in the business or environment that may lead to a compromise to the confidentiality, integrity, availability, and/or privacy of the information and data processed, stored or transmitted by the organization and the impact this may have on the organization or individuals, along with any material changes to the business structure.

• All Wolters Kluwer employees undergo background checks to ensure their eligibility and competence to access Wolters Kluwer information.
• Background checks are conducted according to local legislation and as appropriate to the role being recruited for, to include:
  • Identity verification
  • Employment references
  • Eligibility to work in the relevant geography
  • Validation of education and certifications

• Wolters Kluwer operates four levels of data classification to ensure that information assets are appropriately handled, processed and stored.
• Information assets are assigned a classification level based on the appropriate audience for that information. If the information has been previously classified by regulatory, legal, contractual, or company directive, then that classification will take precedence. The classification level then guides the selection of protective measures to secure the information.

• All employees are required to adhere to our Information Security, Privacy and other policies which highlight our commitment to comply with our legal obligations including to keeping customer data secure.
• Team members involved in the development and support of the TAA UK applications undergo additional security training that is targeted to their job roles. For example, architects may receive training in secure design principles while developers focus on secure coding practices and principles. Developing skills and careers is an important focus for us and critical to employee engagement. To support formal learning, all employees have access to over 3,000 on-demand learning opportunities through our global Learning Management System (LMS).
• We also deploy assigned training to demonstrate our commitment to training requirements and our values. Our employees also demonstrate their commitment to learning through high completion rates on important topics such as our values, business principles, and other rules of conduct in our daily work through the annual compliance training, GDPR, and performance management training.

• Wolters Kluwer access controls are pragmatic, thorough and reviewed regularly. Our guiding principles for access are:
  • Business Need: Access to Wolters Kluwer information is only granted where there is real necessity
  • Least Privilege: Never compromising productivity or efficiency, Wolters Kluwer employees are limited to the minimum access permissions they need in order to carry out their work
  • Separation of Duties: To manage conflicts of interest, fraud and reduce error, we ensure that there is enough oversight of access.
  • A formal registration and de-registration procedure to grant and remove access.

• Cryptography assures data is protected against threat or alteration and helps to establish user authorization.
• Wolters Kluwer use industry-standard HTTPS to protect the confidentiality and integrity of the data passing between user’s browsers, our Cloud platforms and any relevant Third-Party services such as HMRC.
• For our cloud platforms, encryption is enabled to protect data at rest, and to all data in transit that is submitted to such platforms.

• Our offices are physically protected from disclosure, modification or theft of information by unauthorized persons, and controls are in place toreduce the risk of loss or damage. Offices are protected by appropriate access entry controls and 24x7 security presence.

• Wolters Kluwer operates a robust patch management process supported by regular, scheduled vulnerability assessments across the infrastructure hosting our applications.
• Infrastructure is patched weekly and application patching is aligned with our published maintenance schedule. Any significant security issues that we identify are dealt with under our emergency fix process and follow our standard out-of-schedule notification process.

• By implementing malware protection solutions, we can detect, remove and protect against known types of malicious software attack. Our solutions use behavioral detection and can recognize anomalies so that we can detect brand new attacks. We deploy our malware protection at appropriate points across the Wolters Kluwer technology infrastructure. As we know that new malware is in constant development, we regularly test and update our protection to reduce the risk of systems being exposed.

• Wolters Kluwer Security does not stop when the business day ends. Wolters Kluwer has a 24x7x365 security monitoring service via our Global Security Operations Centre (SOC).
• This service is the front line for Wolters Kluwer in reactive response to security incidents that happen anytime of the day or night. Through detection and monitoring of threats and vulnerabilities, managing security incidents, and evolving our preventive infrastructure, an experienced team aims to keep ahead of the threat.

• Wolters Kluwer information security teams adhere to a vulnerability management process which is focused on the collection, analysis, summarization, reporting, and tracking of identifiable vulnerabilities in applications, infrastructure, and endpoint systems and networks.
• This robust process is vital for providing a more accurate visibility of risk across the organization. The process is performed by the Global Information Security team and includes a defense in depth approach to the numerous levels of scanning performed by enterprise-level on-premise and cloud- based tools and at an application security level. These levels of scanning that are applied within the vulnerability management process are designed to provide assurance that any security-related risks that may arise can be identified and treated on a timely basis.

• Independent third-party technical security assessments (‘pen-testing’) are performed on all internet facing applications on an annual basis to ensure that security risks continue to be reviewed in line with industry.
• Any risks that are identified are managed and tracked according to the global vulnerability and remediation security standard.

• For our cloud platforms*, data protection processes and procedures are followed for internal service recovery purposes only, this includes a back-up facility that meets the following requirements: (i) Full backups are taken weekly, differential backups are taken every day, log backups are taken every 30 minutes; (ii) Backups are retained for 35 days; and (iii) Backups are encrypted.

(* Please note that the CCH OneClick subscription terms specifically exclude back-ups from the services we provide)

• In terms of the wider Wolters Kluwer organizational Business Continuity Plan, this comprises the following requirements: Emergency Response
• Procedure (detection, notification and evacuation procedure), Crisis Management Plan (team, incident management, notification and escalations, review and assess operations, emergency recovery and maintain phase) and Operational Recovery Plan etc.

• Applications are put through a rigorous testing process which includes static and dynamic application security testing (SAST,
• DAST) using industry leading toolsets.
• The execution of these testing programs is subject to an internal governance process that is managed by the global software security assurance team and which is designed to ensure that are all code repositories are scanned according to a pre- defined schedule and that the results of all such scans, are reviewed, validated and closed out in accordance with Global Application Security and Vulnerability standards

Software development in Wolters Kluwer follows an Information System Life Cycle Management process which is designed to ensure that prior to the acquisition or development of new information assets, or enhancement of existing information assets that affect implemented security controls, the requirements for security controls should be documented, verified to

ensure that they comply with the appropriate policies and standards, and reviewed and approved by the Division, Business Unit Management and/or the Global IT Security Team.