Data Handling Standard Operating Procedure

1.0 Purpose

This Standard Operating Procedure establishes the requirements for the handling, classification, storage, sharing, and disposal of data at Veridian Corp. It ensures all employees and contractors manage data consistently, securely, and in compliance with applicable regulations including HIPAA, GDPR, and SOC 2.

2.0 Scope

This SOP applies to all Veridian Corp employees, contractors, consultants, and third-party agents who access, process, store, or transmit Veridian Corp data in any format (digital or physical).

3.0 Definitions

4.0 Responsibilities

5.0 Data Classification

6.0 Procedures

1. Upon receiving any new dataset, the Data Steward must classify it within 1 business day using the classification levels defined in Section 5.0.
2. All Confidential data must be stored in approved, encrypted systems only; a list of approved systems is maintained by IT Security.
3. Access to Confidential data must be granted on a need-to-know basis with explicit approval from the Data Owner.
4. All access grants to Confidential data must be logged in the Access Management System within 24 hours.
5. Data must not be copied to personal devices, personal email accounts, or personal cloud storage under any circumstances.
6. Before sharing data with any third party, the Data Steward must verify a current DPA is in place and the recipient is on the approved vendor list.
7. Data shared externally must be transmitted via encrypted channels only; email attachments containing Confidential data must be password-protected.
8. Employees must complete data handling training before being granted access to Confidential data.
9. When data is no longer required for its original purpose, the Data Steward must initiate the disposal process within 30 days.
10. Physical documents containing Confidential data must be stored in locked cabinets and shredded when no longer needed.
11. All data handling incidents (actual or suspected) must be reported to the Data Protection Officer within 1 hour of discovery.
12. The Data Steward must conduct a quarterly review of all access permissions and remove access for any individuals whose role has changed.
13. Backup copies of Confidential data must be encrypted with the same standard as the primary copy and tested for restorability quarterly.
14. Any new software or system that will process Confidential data must undergo a Privacy Impact Assessment before deployment.
15. Annual data audits must be completed by the Data Owner to verify data accuracy, relevance, and compliance with retention schedules.

7.0 Controls

• Multi-factor authentication (MFA) is mandatory for access to all systems containing Confidential data.
• Privileged access accounts must be reviewed and revalidated every 90 days.
• All access to Confidential data must generate an audit log entry including user ID, timestamp, data accessed, and action performed.
• Audit logs must be retained for a minimum of 2 years and reviewed monthly for anomalies.
• Data loss prevention (DLP) tools must be deployed on all endpoints with access to Confidential data.
• Encryption keys must be rotated annually and stored separately from the data they protect.
• All systems processing Confidential data must be covered by the vulnerability management program and patched within defined SLAs.
• Production data must never be used in development or test environments without anonymization or pseudonymization.
• Remote access to systems containing Confidential data requires VPN and MFA without exception.
• All contractors with access to Confidential data must sign a confidentiality agreement before access is provisioned.

8.0 Non-Compliance

Violations of this SOP may result in disciplinary action up to and including termination of employment or contract, as well as potential legal liability. All suspected violations must be reported to the Data Protection Officer immediately.

9.0 Revision History