Information Security Policy, IS.SEC.000 s1

DEPARTMENT: Information Security POLICY DESCRIPTION: Information Security Roles and Responsibilities PAGE: 1 of 4 REPLACES POLICY DATED: 6/1/04, 1/15/10 EFFECTIVE DATE: November 1, 2012 REFERENCE NUMBER: IS.SEC.006 APPROVED BY: Ethics and Compliance Policy Committee

SCOPE: All Company-affiliated facilities.

PURPOSE: To outline information security roles and responsibilities, which establish authority and guidance for each Company-affiliated facility to have a Facility Information Security Official (FISO); for each Company Division to have a Director of Information Security Operations (DISO); and for the Company to have a Chief Information Security Officer (CISO) to meet the requirements of the Company’s and facility’s Information Security Program.

Each Company-affiliated facility is required to have an assigned individual whose role is to ensure compliance with Information Security Standards and Policies and oversee the facility’s Information Security program. This is required by the Health Insurance Portability and Accountability Act (HIPAA), Security Standards for the Protection of Electronic Protected Health Information (Security Standards), 45 CFR Parts 160, 162, and 164.

POLICY:

1. Each Company-affiliated facility must appoint a Facility Information Security Official (FISO) to implement and oversee the Company and facility Information Security Programs and work to ensure the facility’s compliance with the IT&S Information Security Policies and Standards. The FISO must be notified of all complaints regarding matters of information security that are received by the facility. This role is required by HIPAA Security Rule provisions (see above).

2. A single individual who is appointed as an FISO may serve at multiple facilities as a Zoned, or Market, FISO. A single individual may also serve multiple roles within a facility. For example, a FISO may also serve as a Facility Privacy Official (FPO).

3. Each Company Division must have a Division Information Security Official, or Director of Information Security Operations (DISO) to implement and oversee the Company and Division Information Security Programs; and to oversee and support facilities’ compliance with the IT&S Information Security Policies and Standards.

4. The Company must have a Chief Information Security Officer (CISO) to implement and oversee the Company-wide Information Security Program and serve as the Responsible Executive for Information Security. This role is required by the Payment Card Industry (PCI DSS v2; 12.5 Information Security Policy) requirement for Information Security Management.

PROCEDURE:

9/2012 DEPARTMENT: Information Security POLICY DESCRIPTION: Information Security Roles and Responsibilities PAGE: 2 of 4 REPLACES POLICY DATED: 6/1/04, 1/15/10 EFFECTIVE DATE: November 1, 2012 REFERENCE NUMBER: IS.SEC.006 APPROVED BY: Ethics and Compliance Policy Committee

Facility Information Security Official (FISO): 1. Each FISO must oversee and implement the Facility’s Information Security Program. The FISO will use Corporate Information Security policies, procedures, standards, and processes provided by Information Security, and follow the direction of the DISO, to implement the Facility Information Security Program. The Facility Information Security Program must include implementation and ongoing maintenance of all components of facility information security (e.g., system security, physical protection of computer systems and related buildings and equipment) as developed by Information Security. 2. The FISO must participate in existing committees, including, but not limited to, the Facility Ethics and Compliance Committee (FECC) and Facility Security Committee (FSC) to facilitate implementation, education and support of the Facility Information Security Program. See the Information Security – Security Committees Policy, IS.SEC.007.

3. The FISO’s responsibilities include, but are not limited to: a. Implementing and overseeing a Facility Information Security Program; b. Serving as primary facility contact for all information security concerns; c. Monitoring security compliance using existing tools as directed by Corporate Information Security; d. In conjunction with the Facility and/or Division IT&S staff, implementing Information Security policies, procedures, standards, and toolkits to ensure facility compliance; e. Ensuring the facility has an ongoing Information Security Training and Awareness Program; f. Ensuring a complete Information Security Incident Response Plan is developed and implemented. Investigate and document all facility Information Security incidents and respond according to Information Security Standards; g. In conjunction with department managers, ensuring appropriate departmental security procedures are in effect which support Information Security requirements; h. Ensuring appropriate physical security process for Information Security assets, including but not limited to, laptop and workstation security, appropriate access to controlled areas, and adequate environmental controls for equipment; i. Working with the Facility Privacy Official to ensure alignment between information security and privacy practices; j. Working with the Ethics & Compliance Officer to ensure alignment between information security and Company compliance requirements; and k. Facilitating any additional Information Security initiatives as directed by the Company.

Division Information Security Official or Director of Information Security Operations (DISO): 1. Each DISO must oversee and implement the Division and facilities’ Information Security Programs at the Division level. The DISO will use Corporate Information Security policies, procedures, standards, and processes provided by Information Security to implement the Division security program and to oversee and assist the facilities within the Division with the facilities’ security programs.

2. The DISO should utilize existing committees, including, but not limited to, the FSCs and the Division Security Committees (DSCs), to facilitate implementation of the Division and Facilities’ Information Security Programs.

3. The DISO’s responsibilities include, but are not limited to: a. Overseeing and implementing a Division Information Security program in accordance with Corporate Information Security Policies, Standards, guidance and initiatives; b. Serving as primary Division contact for all information security concerns; c. Facilitating vendor assessments and Information Security Agreements (ISAs) as outlined in the Information Security – Vendor Information Security Agreement Policy, IS.SEC.008; d. Working with business units and business owners to identify areas of non-compliance with Information Security Standards and to develop and document mitigation plans and Risk Acceptance strategies as defined in the Information Security Risk Acceptance and Accountability Policy, IS.SEC.009; e. Leading and driving all information security activities within a Division, as a component of the enterprise-wide Information Security (IS) program; f. Identifying, developing, implementing, and monitoring Information Security initiatives; g. Serving as liaison for all FISOs on all Information Security initiatives, issues, and projects, including, but not limited to, all responsibilities listed in FISO duties; h. Overseeing and directing security work performed by FISOs; and i. Working with the Division Ethics & Compliance Officer to ensure alignment between information security and Company compliance requirements.

Chief Information Security Officer (CISO): 1. The CISO oversees and implements the company-wide Information Security Program and serves as Responsible Executive for Information Security. The CISO is responsible for all company Information Security policies, procedures, standards, processes, infrastructures, and operations necessary to protect company IT systems and ensure regulatory compliance. In addition, the CISO must oversee and assist business units and facilities with information security and related compliance program implementation.

2. The CISO’s responsibilities include, but are not limited to: a. Overseeing and implementing an enterprise Information Security program in accordance with Corporate Information Security Policies, Standards, guidance and initiatives; b. Serving as primary enterprise contact for all information security concerns; c. Facilitating vendor assessments and Information Security Agreements (ISAs) as outlined in the Information Security – Vendor Information Security Agreement Policy, IS.SEC.008;

d. Working with business units and business owners to identify areas of non-compliance with Information Security Standards and to develop and document mitigation plans and Risk Acceptance strategies as defined in the Information Security Risk Acceptance and Accountability Policy, IS.SEC.009; e. Leading and driving the enterprise-wide Information Security (IS) program; f. Identifying, developing, implementing, and monitoring Information Security initiatives; g. Serving as liaison for all DISOs on all Information Security initiatives, issues, and projects, including, but not limited to, all responsibilities listed in DISO duties; h. Overseeing and directing security work performed by DISOs; and i. Working with the Chief Ethics & Compliance Officer to ensure alignment between information security and Company compliance requirements.

REFERENCES: 1. Health Insurance Portability and Accountability Act, Security Standards for the Protection of Electronic Protected Health Information 2. Payment Card Industry – PCI DSS v2 – 12.5 Information Security Policy – Information Security Management 3. Information Security - Program Requirements Policy, IS.SEC.001 4. Information Security - Security Committees Policy, IS.SEC.007 5. Information Security – Vendor Information Security Agreement Policy, IS.SEC.008 6. Information Security Risk Acceptance and Accountability Policy, IS.SEC.009 7. IR.RISE.01 – Incident Reporting Standard 8. IR.IRM.01 – Incident Response Procedures Standard 9. WS.SWB.02 – Security Awareness & Training Standard 10. Company Code of Conduct 11. Risk Acceptance Form (RAF) 12. Submitting a RAF

9/2012