SOC 3 for Security and Availability Independent Practioner s Trust Services Report For the Period October 1, 2013 through September 30, 2014 Independent SOC 3 Report for the Security and Availability Trust Principles for Everbridge, Inc.
EVERBRIDGE, INC. INDEPENDENT PRACTIONER S TRUST SERVICES REPORT SOC 3 Table of Contents SECTION ONE: INDEPENDENT PRACTIONER S TRUST SERVICES REPORT... 1 SECTION TWO: EVERBRIDGE, INC. S ASSERTION REGARDING ITS MASS NOTIFICATION SYSTEM... 2 SECTION THREE: DESCRIPTION OF EVERBRIDGE, INC. S MASS NOTIFICATION SYSTEM... 3 1 OVERVIEW OF THE EVERBRIDGE OPERATIONS... 3 2 OVERVIEW OF THE SYSTEM AND APPLICATIONS... 3
SECTION ONE: INDEPENDENT PRACTIONER S TRUST SERVICES REPORT To the Management of Everbridge, Inc.: Scope We have examined management s assertion that during the period October 1, 2013 through September 30, 2014, Everbridge, Inc. (the Company ) maintained effective controls over its Mass Notification system, based on the American Institute of Public Accountants ( AICPA ) and Canadian Institute of Charted Accountants ( CICA ) trust services security and availability criteria to provide reasonable assurance that: the system was protected against unauthorized access (both physical and logical); and the system was available for operation and use, as committed or agreed; The Company is responsible for this assertion. Our responsibility is to express an opinion based on our examination. The Company s management description of the aspects of the Mass Notification system covered by their respective assertion is outlined within the report. Our examination was conducted in accordance with attestation standards established by the AICPA and, accordingly, included (1) obtaining an understanding of the Company s relevant controls over security and availability of the Mass Notification system; (2) testing and evaluating the operating effectiveness of the controls; and (3) performing such other procedures as we considered necessary during our examination. We believe that our examination provides a reasonable basis for our opinion. Because of the nature and inherent limitations of controls, the Company s ability to meet the aforementioned criteria may be affected. For example, controls may not prevent, or detect and correct errors or fraud, unauthorized access to systems and information, or failure to comply with internal and external policies or requirements. Also, the projection of any conclusions based on our findings to future periods is subject to the risk that changes may alter the validity of such conclusions. In our opinion, the Company s assertion referred to above are fairly stated, in all material respects, based on the AICPA and CICA trust services security and availability criteria. Everbridge s use of the SysTrust for Service Organizations Seal constitutes a symbolic representation of the contents of this report and is not intended, nor should it be construed, to update this report or provide any additional assurance. SSAE 16 Professionals, LLP December 15, 2014 Orange, California 1
SECTION TWO: EVERBRIDGE, INC. S ASSERTION REGARDING ITS MASS NOTIFICATION SYSTEM December 15, 2014 During the period October 1, 2013 through September 30, 2014, the Company, in all material respects maintained effective controls over the Mass Notification system, as defined by the System Description attached within the report, to provide reasonable assurance that: the system was protected against unauthorized access (both physical and logical); and the system was available for operation and use, as committed or agreed; Further, the Company confirms that to the best of our knowledge and belief, that the controls related to the trust services criteria were suitably designed and operating effectively during the period October 1, 2013 through September 30, 2014, to achieve those control objectives. The criteria we used in making this assertion were that: The risks that threaten the achievement of the controls related to the trust services criteria have been identified by the Company; and The controls related to the trust services criteria would, if operating as described, provide reasonable assurance that those risks would not prevent the control objectives stated in the trust services criteria from being achieved. Everbridge, Inc. 2
SECTION THREE: DESCRIPTION OF EVERBRIDGE, INC. S MASS NOTIFICATION SYSTEM 1 Overview of the Everbridge Operations Everbridge Inc., founded in 2002 and based in Glendale, CA, is the world's recognized leader in unified critical communications, merges technology with industry expertise to help millions of people communicate in a crisis, manage operational incidents and connect on a daily basis. The company's notification platform and incident lifecycle communications model makes communicating to many as simple and effective as communicating to one. 2 Overview of the System and Applications System Overview The System is comprised of the following components: Infrastructure: The physical and virtual components of a Hybrid Cloud (facilities, server, storage, and networks); Software: The programs and operating software of a system (systems, applications, and utilities); People: The personnel involved in the operation and use of a system (developers, operators, users, and managers); Procedures: The automated and manual procedures involved in the operation of a system; and Data: The information used and supported by a system (transaction streams, files, databases, and tables). Infrastructure Everbridge employs multiple data centers for all its test and production systems in an active-active configuration. Data is continuously replicated between the various sites, and each site can provide the full range of Everbridge services. If service is disrupted at any site, all traffic is dynamically rerouted to another site so that Everbridge's systems remain constantly available. Every system in the infrastructure is individually fault-tolerant with redundant power, network, and disc wherever possible. The Everbridge application suites and all its components are stored in highly secured CenturyLink (formerly Qwest) CyberCenters, located in Burbank, CA and Denver, CO. Also, Everbridge utilizes cloud infrastructure providers like Amazon Web Services (AWS), Elastic Hosts, and Interoute. Software Everbridge s application suites are Java J2EE solution built on application server and database platforms utilizing a hybrid cloud infrastructure for global deployment. Core components are built on virtual server farm with SSD storage. Everbridge s application suites features robust analytics, GIS 3
capabilities, and flexible contact management. In addition, customers with global contacts can leverage a single access point to notify contacts and manage contact data across multiple distributed data stores a unique globally local approach. The RESTful Web services design of Everbridge s application incorporates a simple, scalable, efficient, secure, reliable, and extensible architecture. Everbridge s SaaS-based application suites are built on a multi-component, multi-tier architecture, which means that multiple like components reside on each tier, facilitating load balancing and the modification or replacement of components at any tier without affecting the other tiers or service availability. Everbridge's secure infrastructure is built from Cisco Systems hardware, software-defined networking (SDN) with F5 traffic managers for local and global load balancing. People Everbridge employs over 200 employees and is organized into the following areas: The SaaS Operations team includes system administrators, database administrators, application and technical analysts, release management, governance and security and the service desk which collectively are responsible for maintaining the availability, confidentiality, and integrity of all information systems. The Client Services department interfaces directly with clients during the on boarding and training process and addresses any and all issues quickly and with confidence to provide the outstanding customer service. System Development creates quality solutions that meet the business needs, maintain existing software components, support IT operations, and commit to continuous improvements. Quality Assurance utilizes several methodologies of testing to ensure the highest quality product is being delivered. The Product team is responsible for determining the strategy for the Product Portfolio based on the Everbridge organization s business goals as well as collecting and prioritizing system enhancements and discovered defects and defining requirements for approved projects Procedures There are several procedures that add to the strength and reliability of the Everbridge system. The procedures include: 24/7 service desk that actively monitors the system and a system administration team that is also available 24 hours a day for escalation of any issues that may arise. Robust Incident, Problem, Change and Release Management. Risk management process which includes annual independent audits and penetration tests as mandated by the Federal Information Security Management Act of 2002 (FISMA). Annual employee security training and awareness programs. Documented and tested contingency plans. Systems development lifecycle (SDLC). Cloud Security Alliance (CSA) Security, Trust and Assurance Registry (STAR). 4
Data The Everbridge system stores and processes data that is classified as Personally Identifiable Information (PII). This information may include: name, address, phone numbers (home, work, cell, etc.), email address, instant messaging handle or address, fax and pager. Data can be input manually or by utilizing a bulk secure upload feature that expedites the data population process. Both of these functions can be done by the clients to add, delete, or modify existing information. Various reports such as usage and current member lists can also be processed through the application interface. 5