Lorem ipsum dolor sit amet

Authentication through passwords and VPNs is used to protect access to all systems applications and data. Authenticators are strongly constructed to prevent unauthorised access.

Access control is assigned to each PwC and client data asset based upon classification scheme and assigned staff and vendor roles and responsibilities.

All application releases are subject to vulnerability testing, code reviews and security scans. Internet facing apps are subject to penetration testing.

Access to systems and data are monitored to identify unusual or unauthorised system activity and to prevent data leaks and other malicious activity.

Cloud hosted PwC applications and data are secured through configuration and infrastructure management policies and solutions in addition to the layered protections listed above.

PwC staff are required to purge client engagement data at the end of the engagement. If retention is necessary for a regulatory period, files are stored in our system of record "Aura".

Files uploaded and downloaded from applications are scanned for malware and viruses to prevent data exploitation.

Sensitive data is identified based on classification and confidentiality requirements and protected with encryption at rest and during transmission when appropriate.