<html xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=gb2312"> <meta name="Generator" content="Microsoft Word 15 (filtered medium)"> <style></style> </head> <body lang="ZH-CN" link="#0563C1" vlink="#954F72" style="word-wrap:break-word"> <div class="WordSection1"> Dear LibreOffice，<o:p></o:p> <o:p></o:p> Nice to talk to you! Here is IT security team from Jabil China, Chengdu.<o:p></o:p> <o:p></o:p> Perhaps we’d like to use LibreOffice, but there are some queries especially about information security which are needed to be confirmed with you, thank you so much!<o:p></o:p> <o:p></o:p> For this product:<o:p></o:p> <o:p></o:p> <![if !supportLists]>l <![endif]>Has a penetration test been performed?<o:p></o:p> <![if !supportLists]>l <![endif]>Has a Dynamic Application Assessment been performed?<o:p></o:p> <![if !supportLists]>l <![endif]>Are there reoccurring vulnerability scans?<o:p></o:p> <![if !supportLists]>l <![endif]>Has Static Code Analysis been performed on the code?<o:p></o:p> <![if !supportLists]>l <![endif]>Is there a Software Update Cycle?<o:p></o:p> <![if !supportLists]>l <![endif]>Is there a regular OS Patching Cycle?<o:p></o:p> <![if !supportLists]>l <![endif]>Has the code base gone through a static code review for OWASP top 10 and/or SANS25?<o:p></o:p> <![if !supportLists]>l <![endif]>Has the app gone through a DAST or other dynamic testing?<o:p></o:p> <![if !supportLists]>l <![endif]> Will the vendor, now or in the future, collect, store, process, transmit, dispose, or maintain Jabil data as part of its business activities?<o:p></o:p> <![if !supportLists]>l <![endif]>Does the vendor have anyone who is responsible for information security policies, processes, and/or an overall security strategy?<o:p></o:p> <![if !supportLists]>l <![endif]>Has the vendor been certified against or compliant with an industry best practice standard for information security ( e.g., ISO 27001:2013), or undergone a Service Organization Control engagement?<o:p></o:p> <![if !supportLists]>l <![endif]>Is a valid(not expired), certificate and / or report demonstrating certification or compliance available?<o:p></o:p> <![if !supportLists]>l <![endif]>Will the software store or transmit Controlled Unclassified Information (CUI), according to the definition found in NIST Special Publication 800-171? (JDAS Only)<o:p></o:p> (CUI is government created or owned information that requires safeguarding or dissemination controls consistent with applicable laws, regulations and government wide policies. CUI is not classified information. It is not corporate intellectual property unless created for or included in requirements related to a government contract.)<o:p></o:p> <o:p></o:p> Have a nice day！<o:p></o:p> <o:p></o:p> <div> <div> Best wishes,<o:p></o:p> </div> <div> <table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" width="513" style="width:384.4pt;border-collapse:collapse"> <tbody> <tr> <td style="padding:.75pt .75pt .75pt .75pt"> <table class="MsoNormalTable" border="0" cellspacing="0" cellpadding="0" style="border-collapse:collapse"> <tbody> <tr style="height:.75pt"> <td style="padding:0cm 30.0pt 0cm 2.25pt;height:.75pt"> Emily Yuan 袁丽<o:p></o:p> CTU-IT SEC Mobile: +86 181 2331 7956<o:p></o:p> </td> </tr> </tbody> </table> </td> </tr> </tbody> </table> </div> </div> <o:p></o:p> <o:p></o:p> </div> </body> </html>