Regular Audits Test Security
Every year, OneBridge undergoes a variety of different audits and testing in order to help us ensure we maintain the highest levels of information security. These reviews include the SAS 70 audit, the CISP/PCI audit, and penetration testing.
SAS 70
This a very common audit for service organizations because it represents that their control activities have undergone an in-depth review. This kind of review is especially important for organizations like OneBridge who are responsible for handling sensitive cardholder data. OneBridge has undergone an annual SAS 70 since we opened in 1994. We completed our most recent in February 2006 and will be evaluated again in February 2007.
Cardholder Information Security Program (CISP)
Visa requires all merchants, issuers, and service providers that store, process, or transmit cardholder data to comply with CISP. Part of achieving CISP compliance requires that we meet the Payment Card Industry (PCI) Data Security Standards, which are a set of standards agreed upon by all card brands. CISP compliance is valid for one year. OneBridge was one of the first processors to acheive CISP compliance in 2004 and has been compliant since. We passed our most recent audit in May of 2006.
Penetration Testing
Penetration testing is conducted quarterly by a third party auditor. It involves the active evaluation of our own information security measures. To do this, the auditors analyze our system and procedures for design weaknesses, technical flaws, and vulnerabilities by attempting to break into our network. The results are then delivered to OneBridge management and all necessary adjustments are made.
Because of the critical nature of the data we handle for our clients, information security is a top priority for OneBridge. We are constantly reviewing and updating our systems, policies, and procedures to keep them current with industry best practices.
If you have any questions about OneBridge's audit and security practices, please contact
us at 1.800.322.4035.
