• WEX has a mature Global Resilience Management (GRM) Program that is maintained in alignment with industry standards and best practices. It includes planning for business recovery, ICT recovery, crisis management, and emergency response
• The WEX Business Continuity Plan (BCP) contains defined procedures for responding to disruptive events. The BCP is integrated with WEX's physical security, information security, and risk management systems.
• To ensure its effectiveness, the BCP is tested annually, and the results are reported directly to leadership.
• WEX has also implemented both an Operational Resilience (OpRes) and a Digital Operational Resilience Act (DORA) framework to meet applicable regulatory requirements.

• WEX utilizes a combination of cloud and physical infrastructure, HA architecture and multiple cloud availability zones to ensure the resilience and recoverability of production systems.
• Technology recovery plans identify the responsibilities, recovery tasks, detailed logistics and action items vital to recovering the critical applications and network infrastructure that supports our business units. These plans are tested annually.
• WEX conducts daily incremental backups and full backups at least weekly with the integrity of each verified by designated tools. Backups are securely replicated over an encrypted WAN to encrypted storage at a secure Disaster Recovery facility.

• The Crisis Management Plan (CMP) and Crisis Management Framework (CMF) provide a flexible, scalable framework that guides the company\u2019s response to events that pose significant operational, financial, reputational and/or legal risks to the company.
• Functional incident response plans integrate into the CMP via defined escalation criteria and are designed to quickly scale as required based on the incident's scope and/or complexity.
• WEX uses a mass emergency notification tool. This system enables rapid internal communication, ensuring that employees receive timely and critical information in the event of a crisis.

• WEX provides all employees with security awareness training which covers a variety of topics including data privacy, security best practices and how to recognize and report phishing attacks.
• WEX employees are also trained on specific security controls, such as password management and multi-factor authentication.
• WEX provides employees with specific regulatory training based on role type and job responsibilities.

• WEX requires a comprehensive background check before any employee starts employment at WEX.
• The process includes background checks with third-party vendors, as part of the offer process.
• Our dedicated onboarding team monitors background check progress and follows Fair Credit Reporting Act requirements for pre-adverse and adverse action notification.
• WEX has a process for offboarding employees in a secure manner.

• WEX follows a secure SDLC process that includes security requirements gathering, threat modeling, secure coding practices, security testing and security incident response.
• WEX has a dedicated security team that is involved in all stages of the SDLC.
• Application developers must address common coding vulnerabilities in software development processes, such as the Open Web Application Security Project (OWASP) Top 10.

• WEX uses dynamic and static code analysis tools to identify and fix security vulnerabilities in their code.
• Code analysis is performed at multiple stages of the software development lifecycle, including during development, testing, and deployment.
• WEX ensures peer reviews are conducted on code, which includes checking for common coding vulnerabilities.

• Penetration testing is conducted at a minimum annually.
• Penetration testing includes internal and external network-based as well as application-based.
• Segmentation testing is conducted.
• WEX prioritizes and remediates penetration test findings based on their severity and risk.

• WEX uses WAF technology, which performs layer 7 deep packet inspection and blocks threats such as cross-site scripting, SQL injections, denial-of-service and other web attacks/vulnerabilities.
• The WAF is monitored 24/7 and updated with new rules as needed.
• Web Application Firewall (WAF) is configured to block DDoS and other well-known attacks.

• WEX maintains separate environments for production and nonproduction.
• Production data is not used in nonproduction environments.

• WEX conducts developer security training annually, utilizing a third-party tool that provides developers with hands-on training focusing on security industry standards/best practices such as OWASP Top 10.
• WEX has an Application Security Community of Practice that promotes developer security awareness and best practices through multiple channels.

• Accessibility Statement

• WEX has a 24x7 Security Operations Center (SOC) that monitors alerts and suspicious activity.
• WEX utilizes an industry-recognized security information and event management (SIEM) solution.
• SIEM solution provides centralized logging, alerts on changes and alerts on events.

• The WEX SOC team responds to security incidents promptly.
• Notifications to impacted customers is conducted timely and in accordance with required laws and regulations.
• WEX conducts annual incident response tabletop testing.

• NextGen IDS/IPS is used at network boundaries
• IDS/IPS is used to detect and block malicious traffic.
• IDS/IPS systems monitor network traffic for patterns and anomalies.
• File integrity monitoring, endpoint detection and response as well as host based IDS/IPS are used

• WEX uses industry-recognized systems and application vulnerability scanners.
• Network vulnerability scans are performed at least monthly.
• WEX prioritizes and remediates vulnerabilities based on their severity and risk.

• WEX has an internal, dedicated threat and vulnerability management team.
• WEX utilizes industry-recognized threat intelligence resources.

• Logging is active on all server and network systems.
• Access to the logging systems and data is restricted to authorized IT personnel.
• Logging configurations adhere to applicable compliance and legal requirements.
• Audit logs are retained for a minimum of 13 months.

• WEX externally facing systems are hosted in a DMZ and separate from our internal systems.
• Production systems are segregated from non-production systems.
• All network and infrastructure resources are hardened to meet or exceed industry standards.
• WEX has defined trust zones and system isolations via network segmentation.

• WEX uses a variety of email security measures, including spam filtering, content filtering, malware scanning, and Data Loss Prevention (DLP).
• WEX has implemented DMARC on email systems.

• WEX uses a variety of security measures to protect its wireless networks, including encryption, strong passwords, and access control lists.
• WEX office locations have segregated guest wireless networks available.

• WEX uses DNS filtering to block users from accessing malicious websites and content not consistent with WEX values.

• WEX uses traffic filtering to block certain types of traffic, such as peer-to-peer traffic and malicious websites.
• WEX uses traffic filtering to protect the network from performance degradation and security threats.

• WEX employs a role-based, need-to-know, least-privilege data access model.
• WEX conducts regular user access reviews.

• WEX uses role and privilege-based access controls.
• Multilayer approvals are required for privileged access.

• WEX follows regulatory guidelines for password management.
• WEX requires employees to use strong passwords and to change their passwords regularly.
• WEX stores passwords utilizing strong encryption.

• VPN (Virtual Private Network) with MFA is required for remote access to corporate networks.
• MFA using adaptive authentication is required for the administrator portal.

• WEX physical security program is approved by management, communicated to constituents and has an owner assigned to maintain and review it.
• Physical access controls are in place for employees, contractors, vendors and other visitors at all WEX locations.
• Protocols are in place to ensure that only authorized individuals have access to WEX facilities.

• Technologies and staff are deployed, as appropriate, to detect issues and support security controls.
• Plans are in place to ensure appropriate responses and escalations.
• WEX Global Support Center is available 24/7.

• WEX relies on infrastructure providers, AWS and Microsoft Azure for physical security.
• AWS Physical Protection
• Azure Physical Protection

• WEX has a dedicated Information Security organization.
• WEX Information Security maintains a policy set that is updated no less than annually.
• WEX CISO reports to the WEX Board of Directors regularly.
• WEX's information security program is based on industry-standard frameworks.

• WEX continually monitors Security Scorecard ratings.
• View our current WEX Security Scorecard.

• WEX maintains a publicly accessible privacy email address where individuals can make requests regarding their personal data access or deletion as well as lodge a complaint.
• Individual requests are processed promptly and documented in accordance with applicable laws.

• WEX has internal privacy policies and procedures established to regulate personal data usage in accordance with applicable laws and best practices.
• Privacy policies and procedures are regularly reviewed and updated to ensure consistency with legal as well as operational requirements.

• WEX routinely assesses and documents its usage of personal data in order to identify and remediate any potential privacy risks to individuals and our business partners.
• Risk assessments are conducted at various points and stages of our business operations and in accordance with applicable laws.

• WEX uses cookies on its websites to collect information about how visitors use the site, to improve the user experience and provide relevant advertising.
• Cookie consents and user preferences are managed in accordance with applicable laws.

• WEX maintains publicly accessible privacy notices describing how we collect, store, and use personal data.

• WEX has a robust Third-Party Risk Management program that defines the requirements, standards, and structure for identifying, assessing, controlling, monitoring, and reporting risks related to WEX's use of third-party vendors. The cadence for these reviews is determined by the criticality and risk rating of the engagement.
• The TPRM program evaluates and assesses subcontractor's risk and control environment. Criticality is assigned to each subcontractor based on the defined support and services they provide.
• All third parties must meet or exceed WEX\u2019s controls and standards, which are outlined within the contracted terms and conditions.

• WEX conducts periodic risk and diligence reviews for all vendors ensuring comprehensive oversight.
• WEX performs continuous performance monitoring.

• WEX leverages full disk encryption on all endpoints and systems.
• WEX uses industry-standard encryption to encrypt all data in transit and at rest.

• WEX maintains an inventory of all corporate assets, including hardware, software, and data.
• WEX has a process for securely disposing of corporate hardware assets.

• Data destruction will be performed in accordance with WEX policy that is based on industry standards.
• Data will be sanitized or physically destroyed per NIST 800-88 standards.

"}}, "translations": null, "profileSwitcherSelectedProfiles": null}}, "assuranceProfileRedesignEnabled": true, "capDataRoomBotEnabled": true, "dataRoomConsistentNdaEnabled": true, "profileDomain": "assurance.wexinc.com"}