Report of Independent Accountants. To the Management of Verizon Communications Inc. Verizon Business IP Application Hosting:

Transcription

1 Report of Independent Accountants Ernst & Young, LLP Two Commerce Square Suite Market Street Philadelphia, Pennsylvania Tel: Fax: To the Management of Verizon Communications Inc. Verizon Business IP Application Hosting: We have examined management s assertion included in the accompanying "Report by Management on the Effectiveness of Its Controls over the Verizon Communications Inc. Verizon Business IP Application Hosting Customer Production Environment Located in the Beltsville, Maryland; Frankfurt, Germany; London, United Kingdom; San Jose, California; and Tokyo, Japan data centers, Collectively Referred to as Verizon Business IPAH, based on the AICPA/CICA Trust Services Principles and Criteria" (Management's Report) that Verizon Communications Inc. Verizon Business IP Application Hosting, during the period November 1, 2008 through October 31, 2009 maintained effective controls over the Verizon Communications Inc. Verizon Business IPAH Customer Production Environment to provide reasonable assurance that the Verizon Communications Inc. Verizon Business IPAH Customer Production Environment was: protected against unauthorized access (both physical and logical) and available for operation and use, as committed and agreed based on the AICPA/CICA Trust Services Security and Availability Principles and Criteria. This assertion is the responsibility of Verizon Communications Inc. Verizon Business IPAH management. Our responsibility is to express an opinion based on our examination. Our examination was conducted in accordance with attestation standards established by the American Institute of Certified Public Accountants and, accordingly, included (1) obtaining an understanding of Verizon Communications Inc. Verizon Business IPAH s relevant security and availability controls over the Verizon Communications Inc. Verizon Business IPAH Customer Production Environment; (2) testing and evaluating the operating effectiveness of the controls over the Verizon Communications Inc. Verizon Business IPAH Customer Production Environment; and (3) performing such other procedures as we considered necessary in the circumstances. We believe that our examination provides a reasonable basis for our opinion. Because of inherent limitations in controls, error or fraud may occur and not be detected. Furthermore, the projection of any conclusions, based on our findings, to future periods is subject to the risk that the validity of such conclusions may be altered because of changes made to the system or controls, the failure to make needed changes to the system or controls, or deterioration in the degree of effectiveness of the controls. In our opinion, Verizon Communications Inc. Verizon Business IPAH management s assertion referred to above is fairly stated, in all material respects, based on the AICPA/CICA Trust Services Security and Availability Principles and Criteria. The SysTrust Seal on Verizon Communications Inc. Verizon Business IPAH web site constitutes a symbolic representation of the contents of this report and it is not intended, nor should it be construed, to update this report or provide any additional assurance. December 30, 2009 A member firm of Ernst & Young Global Limited

2 Report by Management on the Effectiveness of Its Controls over the Verizon Business IP Application Hosting Customer Production Environment Located in the Beltsville, Maryland; Frankfurt, Germany; London, United Kingdom; San Jose, California; and Tokyo, Japan Data Centers, Collectively Referred to as Verizon Business IPAH, Based on the AICPA/CICA Trust Services Principles and Criteria Verizon Communications Inc. Verizon Business IP Application Hosting has established and is responsible for maintaining effective controls over the security and availability of the Verizon Communications Inc. Verizon Business IP Application Hosting Customer Production Environment located in the Beltsville, Maryland; Frankfurt, Germany; London, United Kingdom; San Jose, California; and Tokyo, Japan data centers, all collectively referred to as Verizon Business IPAH to provide reasonable assurance that the Verizon Business IPAH Customer Production Environment was: protected against unauthorized access (both physical and logical), and available for operation and use, as committed and agreed, during the period November 1, 2008 to October 31, 2009, based on the Trust Services Principles and Criteria established by the American Institute of Certified Public Accountants (AICPA) and the Canadian Institute of Chartered Accountants (CICA). The AICPA/CICA Trust Services Principles and Criteria contain the following definitions of the security and availability of the system: Security: the system was protected against unauthorized access (both physical and logical). Availability: the system was available for operation and use, as committed and agreed. The AICPA/CICA Trust Services Principles and Criteria may be obtained from the AICPA s website at Our attached Description of Verizon Communications Inc. Verizon Business IPAH Customer Production Environment identifies the aspects of the customer production environment covered by our assertions. John Tomljanovic Director - Product Management IT Solutions Verizon Business December 30, 2009

3 Description of the Verizon Communications Inc. Verizon Business IP Application Hosting Customer Production Environment Verizon Communications Inc. Verizon Business IP Application Hosting services include implementation and maintenance of secure, scalable, high-performance IP Application Hosting solutions in the Beltsville, Maryland; Frankfurt, Germany; London, United Kingdom; San Jose, California; and Tokyo, Japan data centers, collectively referred to as Verizon Business IPAH. Verizon Business IPAH functions and managed services encompass managed systems, sites, firewalls, and monitoring of those system components 24 hours per day 7 days per week. Verizon Business IPAH services include providing system hardware, software, network technology, security services logical and physical, and systems management necessary to offer customers comprehensive outsourced IP application hosting solutions. Verizon Business IPAH provides the computer hardware, software, network technology, 24x7x365 certified technical staff, and systems management necessary to provide customers comprehensive, managed IP application hosting solutions. Verizon Business IPAH also offers related value-added services such as 24x7x365 installation, configuration and firewall management, security auditing and intrusion detection, stress testing, and consulting services including capacity, migration planning, and database optimization. Each Verizon Business IPAH managed solution is launched on a hardened operating system, which is scaled to provide secure transactions, operations, services, and processes. Verizon Business IPAH reevaluates the standard build quarterly to provide managed clients with the most recent updates, upgrades, patches, and security hardened platforms, providing customers systems and sites with the latest technological advances and techniques. Customer servers are logically separated and utilize a common networking infrastructure. Verizon Business Smart Centers are geographically separated in five locations including Beltsville, Maryland; Frankfurt, Germany; London, United Kingdom; San Jose, California; and Tokyo, Japan. Each Smart Center is comprised of several server farms housing customer servers and Verizon Business infrastructure. The primary server and network monitoring facility is located in Maryland. The following sections define the boundaries of each of the five components that comprise Verizon Business IPAH system: Infrastructure Hardware, Infrastructure Software, Data, People, and Policies and Procedures. Infrastructure Hardware and Software Verizon Business IPAH core business function is to provide a platform on which customer solutions are hosted. While Verizon Business IPAH does not control customer-specific content or data, it does provide the necessary system components and services as a base for customer applications and/or content. Verizon Business IPAH supports several hardware and platform combinations: HP/Microsoft Windows, HP/Red Hat Linux, HP/UX, HP/IBM AIX and Sun/Sun Solaris. Verizon Business IPAH provides a catalogue of services and applications, which are supported to provide customers with a diversified topology. Verizon Business IPAH firewall solutions are implemented and operate on Nokia platforms using Checkpoint software. Verizon Business IPAH ability to provide redundancy, high availability, and VPN, helps to ensure that Verizon Business IPAH customers are afforded expedited, secured transactions.

4 Data Customer data is stored within the customer s database server and is the responsibility of the customer. Verizon Business IPAH performs both full and incremental backups of client data on the servers and data drives. Full backups are run once per week capturing every file on the local drives that are not open and in use at the time the backup process is running. Incremental backups run every night to capture files changed or created since the last backup. Backup tapes are shipped to an off site vendor for storage and recovery. Access to client s data and database servers is limited to technicians within Verizon Business IPAH who have been appropriately authorized. Customer access to data is controlled by the customers. The Network Operations Center (NOC) monitors network and server availability. The NOC is staffed 24x7 and is responsible for identifying network and server related problems and ensuring that those problems are resolved. When alerts are received, staff members resolve the issues according to documented procedures and escalate the issues as necessary in order to provide a quick resolution. Subject matter experts are included in these notifications, as well as, senior management and customers. Physical access to server farms housing customer data is restricted based on job function. Access to these areas is monitored by security guards and logged in an automated system. People The organizational structure at Verizon Business IPAH provides the overall framework for planning, directing, and controlling operations. This structure provides defined responsibilities and lines of authority for reporting and communication. Verizon Business IPAH has assembled some of the industry s leading technical experts. Several groups share responsibility for the day-to-day operation of the data centers and customer servers. These include Client Services and Technical Operations. Each of these groups is further broken into units based upon areas of specialization. Some of their general responsibilities include: Client Services Technical Operations Responsible for customer support, reporting, and coordination of growth planning for customer sites. Services are provided according to the level of service that the customer contracts for. Client Services also serves as a primary point of contact for customers and customer help desk support. Responsible for problem resolution, upgrades, patch installations, server modifications, customer configurations, and customer server maintenance. Separate groups exist for Windows and UNIX-based systems and Network Equipment.

5 Policies & Procedures Verizon Business IPAH has documented polices and procedures supporting critical controls for their customer production environment, including: Physical Security Logical Security System Implementation and Maintenance Server and Network Monitoring and Problem Resolution Server Backup and Recovery and Environmental Controls These policies and procedures are available to employees for reference on the Verizon Business Intranet.