Data is not shared between the data centers. You may request an account in each region, but these will be independent of each other, and data will not synchronize between accounts.
Data Backups and Retention
KnowBe4 maintains one year of database backups and three years of audit and application logs. These backups are stored encrypted in accordance with the Data Encryption section listed above. To submit a data deletion request, please work with your sales representative or customer success manager.
Awareness and Training
All KnowBe4 employees complete mandatory security awareness and privacy training upon hire and at least once annually. We conduct simulated phishing and social engineering tests on an ongoing basis at least once a month. All KnowBe4 employees and contractors sign confidentiality and non-disclosure agreements upon hire and before access to company or customer data.
Business Continuity / Disaster Recovery
KnowBe4 engineers have designed highly scalable and resilient product architecture within AWS. Our product withstands sophisticated attacks and is highly adaptable. Our systems’ performance within the product architecture is monitored for key metrics, ensuring the load on any one system is within an acceptable range. Should any components become overloaded or experience a fault, automated processes will be executed to bring online additional temporary systems or to cycle out existing systems for new ones. Automation is built into the KnowBe4 architecture, so system monitoring, updates, and corrective actions can take place as needed with no downtime. Status and uptime monitoring can be found here.
KnowBe4’s Risk Management Program is reviewed as part of KnowBe4’s annual third-party audits (FedRAMP, ISO 27001, and SOC2). A full overview of KnowBe4's Risk Management Program can be found here.
Code Security and Code Updates
The KnowBe4 Research and Development (R&D) department leverages a Continuous Integration / Continuous Delivery (CI/CD) pipeline for managing code deployments. Code changes are peer reviewed, approved by separate QA staff, and tested in a staging environment before they are pushed into production. The staging and production environments are logically separated, and no data is shared between them.
Logging and Monitoring:
KnowBe4 collects audit and application logs from all systems. These logs are stored encrypted in a centralized logging facility separate from the system generating the logs. The log entries are in line with industry standards for audit trails. KnowBe4 maintains these logs for a period of three years for the business purpose of investigating past system activity.
Vulnerability Management
The KnowBe4 information security team performs monthly web application vulnerability scans. These scans are configured to run as authenticated scans. Any vulnerabilities found during these scans or any other vulnerability discovery activities are added to a vulnerability tracking system. There, the vulnerabilities are verified, categorized, and evaluated for actual risk. Vulnerabilities are remediated in accordance with the schedule listed below:
The following SLA will be followed for vulnerability findings based on a CVSS with a Snyk Priority Score lower than 800, Snyk does not use the CVSS score alone to determine priority. Snyk's Priority Score is a comprehensive scoring system that processes multiple factors, including the CVSS score, the availability of a fix, known exploits, how new the vulnerability is, and whether it is reachable or not.
|
Severity
|
Critical/High
|
Medium
|
Low
|
Informational
|
|
Remediation Timeline
|
< 30 Days
|
< 90 Days
|
< 180 Days
|
Discretionary
|
The following SLA will be followed for:
Vulnerability findings based on CVSS with a Snyk Priority Score of 800 or higher Non-CVSS scored vulnerabilities with a risk score determined by leveraging OWASP Risk Rating Methodology (Risk = Likelihood * Impact)
|
Severity
|
Critical/High
|
Medium
|
Low
|
Informational
|
|
Remediation Timeline
|
< 14 Days
|
< 30 Days
|
< 180 Days
|
Discretionary
|
Penetration Testing / Bug Bounty / Report Security Vulnerabilities
KnowBe4 participates in a paid, private bug bounty program where vetted third-party researchers conduct ongoing penetration testing of our products. If you feel you have discovered a security flaw in our system, you can sign up for the program, and we will invite you to participate. You can submit any vulnerabilities through the bug bounty program or by contacting the KnowBe4 security team directly at infosec@knowbe4.com. We encourage you to test, and we encourage you to share what you find. Security testing outside of this private program is not permitted. We do not permit any automated scanning as part of this program; the researchers are instructed to perform manual testing so as to not be disruptive.
Security
.png?width=300&height=383&name=A-LIGN_ISO_27701%20(1).png "A-LIGN_ISO_27701")
.png?width=300&height=383&name=A-LIGN_ISO_27001%20(1).png "A-LIGN_ISO_27001")
.png?width=300&height=383&name=A-LIGN_ISO_27018%20(1).png "A-LIGN_ISO_27018")
.png?width=300&height=383&name=A-LIGN_ISO_27017%20(1).png "A-LIGN_ISO_27017")
