Products and Tools

Pendulum employs a full-time System Administrator located in Albuquerque, New Mexico, who oversees system user training and ongoing user support. All clients receive ongoing support services throughout their relationship with Pendulum. Our staff provides updates with group structures and customizes and develops new reports as needed. Consistent system user support also includes software maintenance and upgrades to the program.

The system support provided for clients includes but is not limited to:

For New Clients:

• Prior events data transfer (additional costs based on volume/type of transfer)
• Client organization/group structure configuration
• Customization of client Event Types
• Security/user access
• User training
• Customized reports

For All Clients:

• System user support
• Updates in system configuration
• Customization and development of reports
• Software system maintenance
• Added Value Software: Risk Viewer™, a Graphical Reporting Tool

Data Management Information

An application service provider (ASP) function highlight is the WAN/LAN and Sonicwall firewall that is constantly monitored and tested for outside attacks. The Citrix/ICA Client is configured to use 128-bit encryption. Pendulum has a dedicated Oracle Database and system application.

Servers and other sensitive devices are secured by iVOS in a server room with electronic key access restricted to authorized personnel. Operating system login access (including administrative level) is tracked (date/time and source machine) and restricted to the Valley Oak IT manager, network administrator, and database administrator.

Secure Sockets Layer (SSL)

The information passing between Internet Explorer and the application server may be encrypted using Secure Sockets Layer (SSL). In addition to the application server, database and network security, iVOS also supports 128-bit SSL encryption along with its System Administrator Security Module. Pendulum's clients are free to configure the level of encryption on the application server as they choose.

Role-Based Security

iVOS uses role-based security to completely configure the user interface for the various workgroups that access the system. Security is configured by first setting up a user profile record for each user in the system. Workgroups are then established, after which users are assigned to these workgroups. The next step in establishing security is setting up the roles assigned to each workgroup and defining the functionality each role can access.

Each role can be defined by hiding tabs and fields, setting fields as read-only, re-labeling field names, hiding columns of data, restricting access to data in tables, hiding items in drop down menus, etc. A unique differentiator of iVOS is that the Security Module actually uses the user interface to define the roles that will be applied to the workgroups. iVOS' powerful, but easy-to-use Security Module provides the tools we need to have complete control over defining the permissions of each workgroup.

Passwords

iVOS also utilizes the Security Administration tool for adding new users, changing existing user profiles, resetting passwords, etc. Each user must enter a User ID and password to access the system.

Session Time Outs

Work session time outs are in place to address periods of system inactivity.

HIPAA Compliance

The Event Management System is a secured website with password-protected entry. The iVOS software is compliant with HIPAA regulations, and iVOS is continually upgrading security efforts to meet or exceed industry standards.

SAS Compliance

The Event Management System is SAS 70 compliant.

Data Backup/Data Recovery

The database server is hosted by iVOS ASP Hosting Service. Database archive logs are continuously saved to a separate disk subsystem at the primary site. These would be used if there was a complete loss of the production database, but not the database server infrastructure. Full-system backups are conducted each night. The backup database is monitored daily to determine that the logs have been successfully applied to the backup database and that the system is ready for production use. Nightly incremental and full weekly tape back-ups are sent off-site. Monthly testing of tape back-ups is also conducted.