Password Security

The SciCord solution implements User identity & password maintenance by enforcing several security rules:

• Enforces non-trivial passwords (password strength criteria are set via a configurable system-wide setting).
• Enforces periodic change of passwords (password-expiry period is set via a configurable system-wide setting).
• Account lock and screen lock after a certain amount of invalid authentication attempts (parameter is set via a configurable system-wide setting).

Screen Lock

The application provides a “screen-lock”-like functionality that requires User password challenge after a configured amount of time of no activity on screen (mouse or keyboard movement)

Roles and Permissions

The SciCord Solution implements a matrix of roles and permissions to restrict access to system functionality based on role.  SciCord provides 10 default roles including Scientist, Supervisor, and Reviewer. Customer-specific “Custom” roles may also be defined.  Each role is then assigned a set of permissions to enable activities to be performed such as document review.

Data Security

Data is stored securely on the Microsoft Azure platform. All data transmitted by or stored in the SciCord Solution is encrypted (in transit and at rest).

Data backups occur at:

• Two physical locations
• Incremental Daily – retained for 30 days
• Full Weekly – retained for 4 weeks
• Full Monthly – retained for 12 months

SciCord also conducts routine Penetration and Vulnerability testing, contracting expert third-party organizations to execute penetration tests and vulnerability scanning to manage security risks.