Governance
Palmetto Solar has implemented a comprehensive information security program, with transparent policies guiding the various teams at Palmetto. The information risk council is responsible for governing the information security and risk management duties of the organization which include the development and maintenance of internal controls, development, and ratification of policies, as well as conducting annual risk assessments, internal audits, business impact assessments, and overseeing risk treatment plans.
HR Security
Human Resources best practices have been implemented to support a thorough employee screening process, security awareness training, and performance evaluations. These processes ensure employees operate in alignment with the security policies established by Palmetto.
Access Management
In order to limit employees’ access to sensitive information, Palmetto has established role-based access controls that account for job function, active employment, legitimate business need, and privacy best practices. Palmetto’s access control division reviews roles on a quarterly basis to ensure compliance.
Physical Security
Palmetto prioritizes the security of endpoints by ensuring all company assets have system hardening configurations enabled, including antivirus software. Access to Palmetto’s systems is rigorously managed through Password Complexity Standards, 2-Factor Authentication, and Single Sign-On.
Performance Monitoring
Palmetto utilizes system monitoring tools, routine reviews, and comprehensive reporting to provide the basis for the effective operation of internal controls.
Palmetto has action plans in place which facilitate timely responses to security events, and address compliance as well as confidentiality concerns. These are laid out and made available to employees in the form of written policies and procedures.
System Operations
Palmetto ensures critical information is secured through the use of encryption technology and established backup policies and processes. Any deviation from the norm is promptly addressed by Palmetto’s engineering staff.
Palmetto maintains detailed incident response and business continuity plans that delineate duties and action plans during a security incident. In the case of malicious acts, natural disasters, or continuity events, Palmetto maintains standards for identifying, documenting, reviewing, and remediating incidents faced by the organization. After an incident has been remediated, further analysis and management reviews take place in order to identify the root cause of the incident and prevent a similar occurrence in the future.
SDLC/Change Management
Palmetto’s internal applications and development environment are all supported by a thorough change management process, including maintaining a software development life cycle policy and standard operating procedures. Controls are implemented to manage access to source code, code promotion permissions, QA review, and code deployment.
System changes are formally planned, developed, documented, and reviewed before code is deployed into production. Palmetto ensures that all staging, production, and development environments are separated and managed within the Google Cloud Platform.
Support
Operational Failures: Customer responsibilities include reporting operational failures, incidents, problems, concerns, and complaints to: [email protected]
HR Complaints: Complaints about Palmetto employees for code of conduct and/or any other issues should be reported to: [email protected]
Software Services Support: [email protected]
Privacy Questions and Concerns: [email protected]