The Top 5 Fulcrum Data and Security Questions: Answered

‍

Transcript:

‍

Hi, I'm John. I'm the CTO here at Fulcrum. Now, I'm James. I'm an engineer here and also an Adjunct professor of cybersecurity at the University of Texas in San Antonio. And today, we will be answering the top five questions we frequently get about data and security.

So the first question we have is:

Is my data secure? And more specifically, is the cloud secure? Here at Fulcrum, we do care about security. It's not a secondary concern for us, and there are a few different things that we do look at when it comes to security, primarily when it comes to your data; we're looking at is your data encrypted at rest. Basically, meaning that once we throw that data on our hard drive, is it encrypted? The other part of that is: Do we encrypt it in transport when we send that data to you and your browser? Is that encrypted? And it is. And how we achieve this is we host our services and Microsoft's Azure Cloud platform.

Yeah, and one of the reasons that we chose Microsoft Azure is because there are a lot of other large companies on Microsoft Azure that you've probably heard of: Dow Chemical, Airbus, 3M, Toyota — really just a handful of companies out of the hundreds that are of large scale systems that are on Microsoft Azure. I've worked with a few companies in the past to have been nervous about going from an on-prem system to a cloud-based system either for security concerns or even just kind of data access concerns, and one company that comes into mind was a company based out of New York City that I worked with that had an on-prem system in their data warehouse just in New York City when Hurricane Sandy hit it caused a power outage and corrupted a bunch of that data. They lost about 20 years of data in their system. That just wouldn't happen on a cloud-based system.

Right. And that's the other side of security — that not only is the confidentiality of your data important, but also the availability of that data, and with Microsoft's Cloud platform, we're able to use several different services to provide that availability to you. We leverage backups and recovery-type security controls to make sure that access to that data is given to those who are authorized as well as several redundancy and resiliency controls such as load balancing and other services to make sure that your data is available to you when you need it. So is your data secure and is Fulcrum secure? Yes.‍

Who owns our data, and who has access to our data? This is a question that we get a lot with Fulcrum. You own your data. We don't sell your data to any third parties. And, should you ever leave Fulcrum, We will provide an export for you to take with you. As for who has access to it, you primarily control that. We have many different access controls and roles within the system that you can define to assign permissions to either grant access or restrict access to whoever you invite into your system. Outside of that, Fulcrum employees may need access from time to time, primarily for training or diagnostic purposes.

How long do you store data, and are there backups? We see this with a lot of different manufacturers who are looking to have a data retention policy, whether it's something that's driven internally — such as trying to stay compliant with the ISO 9001 quality. Or, they have a hard data retention policy of something like 10 years from AS9100. And whatever that is, we are prepared to support that sort of data retention. We do take backups of databases on an hourly, daily, weekly, and even monthly cadence so that if there is an issue with data integrity — you've accidentally deleted something, which is, you know, certainly a possibility — we are prepared to recover that data for you.

Do you support manufacturers who need to be ITAR compliant? If you work with any defense contractors with the DOD or really in any defense manufacturing, you may need to follow the International Traffic in Arms Regulations or ITAR. We do support ITAR manufacturers. We will host your site in Azure's Gov Cloud, which is very similar to the public cloud, but with the added benefit of being ITAR and FedRAMP compliant. In addition to that, we make sure to silo our system to remain NIST compliant as well. So things like Google Drive integrations or Autodesk's public cloud, we cut off connections to clouds that we don't control and that are not ITAR compliant. 

What about CMMC or the Cybersecurity Maturity Model Certification? There are a lot of manufacturers starting to see this as an upcoming requirement, especially when it comes to contracts for the Department of Defense. It is a fairly new certification model that kind of mirrors ISO 27001 and NIST 800 series certifications. And when it comes to whether you're doing a Level 1 certification through a self-assessment or you're bringing in the auditor to achieve a Level 3 certification, we're there to provide you with the artifacts, the data, the logs, the representation that you've satisfied these controls so that you can either become certified or continue to show that you are still certified.

These were the five most common questions that we get around data and security. But if you have any more questions, feel free to leave them in the comments or talk to our sales team.