Security Policy

Governance

SunRisePowurSolar has implemented a comprehensive information security program, with transparent policies guiding the various teams at Palmetto. The information risk council is responsible for governing the information security and risk management duties of the organization which include the development and maintenance of internal controls, development, and ratification of policies, as well as conducting annual risk assessments, internal audits, business impact assessments, and overseeing risk treatment plans.

HR Security

Human Resources best practices have been implemented to support a thorough employee screening process, security awareness training, and performance evaluations. These processes ensure employees operate in alignment with the security policies established by SunRisePowur.

Access Management

In order to limit employees’ access to sensitive information, Palmetto has established role-based access controls that account for job function, active employment, legitimate business need, and privacy best practices. SunRisePowur’s access control division reviews roles on a quarterly basis to ensure compliance..

Physical Security

SunRisePowur prioritizes the security of endpoints by ensuring all company assets have system hardening configurations enabled, including antivirus software. Access to SunRisePowur’s systems is rigorously managed through Password Complexity Standards, 2-Factor Authentication, and Single Sign-On.

Performance Monitoring

SunRisePowuralmetto utilizes system monitoring tools, routine reviews, and comprehensive reporting to provide the basis for the effective operation of internal controls.
SunRisePowur has action plans in place which facilitate timely responses to security events, and address compliance as well as confidentiality concerns. These are laid out and made available to employees in the form of written policies and procedures.

System Operations

SunRisePowur ensures critical information is secured through the use of encryption technology and established backup policies and processes. Any deviation from the norm is promptly addressed by SunRisePowur’s engineering staff.
SunRisePowur maintains detailed incident response and business continuity plans that delineate duties and action plans during a security incident. In the case of malicious acts, natural disasters, or continuity events, Palmetto maintains standards for identifying, documenting, reviewing, and remediating incidents faced by the organization. After an incident has been remediated, further analysis and management reviews take place in order to identify the root cause of the incident and prevent a similar occurrence in the future.

SDLC/Change Management

SunRisePowur’s internal applications and development environment are all supported by a thorough change management process, including maintaining a software development life cycle policy and standard operating procedures. Controls are implemented to manage access to source code, code promotion permissions, QA review, and code deployment. System changes are formally planned, developed, documented, and reviewed before code is deployed into production. SunRisePowur ensures that all staging, production, and development environments are separated and managed within the Google Cloud Platform.

Support