IRESS operate an ISO 27001:2013 certified Information Security Management System (ISMS). The ISMS covers IRESS’ global Financial Markets and Wealth Management hosted service offerings provided to private and professional financial services industry participants by IRESS in Australia, Asia, Canada, New Zealand, South Africa and the United Kingdom. The ISMS includes the transmission, automated processing and storage of client data, the operation of the Production environment and the operation of client support services associated with the provision of the hosted IRESS services.
The screening of IRESS employees during the employment process includes background and law enforcement checks. Staff agree to non-disclosure, confidentiality and adherence to IRESS security policies as part of the employment contract. Security awareness training is performed annually.
IRESS host all client systems and data in a dedicated Production network. The Production network is a highly available, physically and logically separated from the corporate environment. The systems are housed in commercial ISO27001 certified data centers. The data centre provider manages physical building and environmental security. Client systems are held in racks and/or cages dedicated to IRESS.
Access to client systems and data is based on job role. Access is granted by the approval of the General Manager of Operations and is subject to annual access reviews. Access to client systems residing in the Production network is via a jump box solution.
Client data is held within a dedicated production network. IRESS networks are segregated with firewalls. The network and core server logs are monitored (using automated monitoring tools) to ensure operational continuity and are consolidated into a SIEM. Security appliances and DDOS protections that include the use of third party traffic scrubbing services protect IRESS internet links. When equipment has reached the end of its useful life it is destroyed by a specialist data destruction company.
Connections between clients and IRESS are encrypted using HTTPS. Under standard hosting arrangements client data is not encrypted at rest. IRESS does offer costed options for data at rest encryption as well as additional security controls.
Third party security consultancies perform annual security testing which involves both code reviews and white box testing. IRESS performs weekly vulnerability scanning of all Internet-facing systems.
IRESS perform annual DR testing of the common environment. Clients can arrange specific client testing with their account executives.