HOOTSUITE TRUST CENTER
Compliance
Risk Management Program
Hootsuite’s security risk management framework sets out the general mandate and commitment, guiding principles, and established roles and accountabilities for managing, monitoring, and improving risk management practice within the organization. This program is adaptive to reflect the internal organizational and external environment, technology advancements, and business changes. The framework includes the assessment and treatment of information security risks for all security processes, including vendor / supplier review, application / server patching, security incident management, and vulnerabilities remediation.
Hootsuite has a dedicated team whose mission is to provide objective assurance and advisory activities designed to add value and strengthen Hootsuite’s operations. The scope of its mandate is to determine whether Hootsuite’s arrangement of risk management, control, and governance processes, as designed and represented by management, is adequate and functioning as intended for all business units which includes Hootsuite’s operations. This involves:
- Ensuring that management has implemented reliable internal controls.
- Advising business units regarding risk, and helping management identify controls to mitigate risks.
- Assessing the controls and operations within business units, and reporting the results of the assessment to management.
There is a structured risk assessment process to identify and manage risks that could affect Hootsuite’s ability to provide services for its customers. The assessment is performed on an annual basis or when there has been a significant change to the environment or business process. The assessment involves the following steps: identify, analyze, evaluate, and effectively treat risks.
Information Security Policies
Hootsuite has established an information security management system (ISMS) to guide its operations. Policies and processes are in place to provide management with direction and support for information security in accordance with business requirements and relevant frameworks, laws, and regulations.
Hootsuite has a comprehensive set of information security policies that are based on the ISO/IEC 27001/27002 information security standards, Trust Service Criteria (SOC 2), NIST 800-53, and GDPR. They include policies related to:
- Acceptable Use
- Access Control
- Asset Management
- Change Management
- Configuration Management
- Cryptography
- Disaster Recovery
- Endpoint Security
- Information Classification
- Human Resource Security
- Logging and Monitoring
- Operations Backup
- Password
- Physical and Environment Security
- Security Incident Management
- Security Risk Management
- Security Vulnerability Management
- Third-Party Risk Management
- Wireless Security
The security policies are grounded in the key principles of least-privilege, need-to-know, and segregation of duties. The policies are reviewed annually or when there has been a significant change to the environment or business process.
Verification
Hootsuite performs internal testing of key security and privacy controls to validate adherence to established frameworks. This includes third party security penetration testing on an annual basis. The results are communicated to executive management; remediation efforts are monitored and controls are re-tested as required to ensure compliance.
Security and privacy controls are audited yearly by an independent 3rd party to verify that technology, processes and procedures are in place and being followed. You may request a summary of our SOC 2 Type II report through your account manager.
The UK Government’s National Cyber Security Strategy requires all suppliers to be compliant with Cyber Essential controls for bidding on government contracts that involve handling sensitive and personal information. Cyber Essentials was developed by the UK Government, in consultation with industry and provides a foundation of basic cyber hygiene measures. Hootsuite has achieved compliance with the Cyber Essentials program.