Effective date: Tuesday, 10 November, 2026
Access Control - Policies and processes to manage who has access to what data and systems. | |
All HERE users are assigned an individual and unique account. | Shared accounts are not allowed. All access at HERE is designed and granted based on the principle of least privilege (i.e., an employee/contractor/ external temporary laborer is given only those privileges needed for them to complete their task) Use of SSO and MFA where applicable Access is reviewed for appropriateness and recertification on at least an annual basis. |
User access rights and account management principles | Creation of user accounts User access reviews Deletion of user accounts Deactivation of user accounts Secure authentication |
User account types | Privileged/administrative access Internal/external user accounts Service accounts Device administration |
User rights control | Access principles Access groups and group management |
2. Cryptography - Information about how data is encrypted, both at rest and in transit. | |
HERE maintains a Cryptography Standard that outlines the means and methods of encryption, scope, and cryptography best practices. For any customer data storage we employ industry standard AES-256 encryption at rest. Any data transmitted over public network is encrypted using TLS 1.2 or greater. Cryptographic controls are in place to ensure that if malicious actors were to gain access to HERE systems, they would not have any access to the information and data included. | |
3. Firewalls and Intrusion Detection Systems - Details about the systems in place to prevent unauthorized access and detect potential breaches. | |
Firewalls are implemented to control the flow of data throughout HERE networks and technology environments. Access to change firewall configurations is restricted to appropriate Global Network Services personnel. On an annual basis, border router and firewall device security settings are reviewed by Global Network Services to ensure appropriateness. | |
4. Anti-malware Measures - Details about the software and practices in place to protect against viruses, ransomware, and other forms of malware. | |
Antivirus and malware protection on all Mac and Windows systems connecting to the network. Endpoint agents configured to check a central (cloud based) Endpoint Protection console every 2 minutes for policy and version updates. Antivirus status report generated on a daily basis and reviewed by HERE Trust Security Engineers to ensure all endpoints are configured for optimal protection. Incidents documented by Security Operations Center (SOC) and investigated by Computer Security Incident Response Team (CSIRT), and tracked from detection to resolution. Threat Intelligence gathering information about new, emerging threats, and providing mitigations in advance. | |
5. Logging - Details about systems logging and data handling | |
HERE requires logging regarding certain systems and processes to track access, privileged access activities, report on errors, and retain data in a centralized and standardized method. Log monitoring is carried out to analyze and identify potential security risks and incidents. All HERE server systems performing security logging must forward security-related logs to centralized HERE logging systems. | |
All HERE server systems that handle confidential or secret information or personal/health data, accept network connections, or make access control (authentication and authorization) decisions are required to record and retain audit-logging information sufficient to answer the following questions: | What type of activity (network connection, access control, etc.) was performed Who or what performed the activity, including where or on what system the activity was performed from (subject) What activity was performed on (object) When was the activity performed What tool(s) was the activity performed with What was the status (such as success vs. failure), outcome, or result of the activity. |
6. Network Security - Procedures and technologies in place to protect the network infrastructure, including segmentation, secure configuration, and wireless security. | |
Implementing a Zero Trust network architecture ensures that every user request is rigorously verified, never assuming trust, and granting access on a strictly need-to-know basis to secure our systems and data. Network access is monitored and controlled by network security devices, which provide firewalling, Unified Access Control (UAC) and Network Access Control (NAC) services. Access control information is distributed among data centers via IF-MAP Federation service, which simplifies user access across all locations, without compromising security. This suite of Network Security services is an integral component in the overarching protection of resources from malicious, and non-malicious, activity that may otherwise compromise systems, data or the ability to access such resources. This objective is accomplished through the authentication, authorization and/or validation of network traffic flows, incoming and outgoing. | |
7. Software and System Patch Management - Information about how software updates and patches are managed to keep systems secure and up to date. | |
HERE maintains and continues to build upon its vulnerability management practice to ensure that all vulnerabilities to its information security (and beyond) assets are identified and appropriate action is employed to remediate, or triage known vulnerabilities. The goal is to identify, classify, remediate, and mitigate vulnerabilities before these vulnerabilities can be exploited by threat actors. Vulnerability management activities at HERE include, but are not limited to, Dynamic application security testing (DAST), vulnerability scanning, dependency scanning, internal penetration testing, external penetration testing, and Static application security testing (SAST). As necessary, alerts are monitored and triaged and, if applicable, all incidents follow the incident management process. | |
8. Security Incident Management - Procedures for identifying, responding to, and recovering from security incidents. | |
Standard Incident and Security Incident Process established A proper security incident response process is implemented to ensure proper documentation artefacts creation as well as clearly defined roles and responsibilities between those participating in security incident response. | |
9. Data Backup and Disaster Recovery - Information about how data is backed up, how often, and procedure for data recovery in the event of data loss. | |
Backups are configured based on documented requirements and recovery objectives and are limited to data that is critical for the normal operation of a service. | Backups are performed in accordance with Backup and Recovery Standard and abide by applicable retention requirements. BC/DR plans implemented and tested on at least an annual basis. |
10. Employee Training and Awareness - Details about how employees are trained on security awareness, including topics like phishing, password security, and reporting potential security issues. | |
HERE has formal training requirements for new employees. Annual security and privacy trainings. Training platform with evidence of passed trainings per user. | |
11. Third-Party and Supply Chain Security - Procedures for ensuring third parties (vendors, service providers) comply with your organization’s security standards. | |
New vendors are reviewed by following Supplier and Third-Party Assurance Process Supplier Due Diligence framework implemented | |
12. Secure Software Development Lifecycle (SSDLC) - Information about how security is incorporated into the software development lifecycle, including secure coding practices, security testing, and code reviews. | |
HERE follows a secure software development lifecycle process as part of the standard development of HERE systems and services. | For the SSDLC process to be successfully implemented and continuously followed, development and service implementation teams must adhere to high-level security and privacy requirements. Software requirements collection and the design of the system is the responsibility of HERE R&D. However, the HERE Trust Security teams develop and deploy security requirements in accordance with the SSDLC process and industry best practices. |
13. Data Retention and Disposal - Information on how long data is kept and how it is securely disposed of when no longer needed. | |
HERE Document Retention Policy defined and followed to support data retention cycle. | |
14. Compliance - Information about how an organization complies with relevant security standards, regulations, and laws (e.g., ISO27001, GDPR, CCPA, HIPAA, etc.). | |
https://www.here.com/en-gb/privacy/here-data-subject-request |
