GSO Policies
Security Policies
Acceptable Use Policy
The RXO, Inc. (RXO) Acceptable Use Policy details the company-wide rules governing the secure operation and acceptable use of RXO Information Systems (RXOIS) and information assets. RXOIS is defined as all RXO owned, operated, or provided information technology-related hardware, software, equipment, facilities, information, and services
Access Control Policy
This policy highlights the technological and procedural areas that RXO will address to affect a comprehensive Access Control approach as a key preventative control in RXO’s Information Security Strategy. The objective is to ensure that all users have authorized access rights in accordance with the requirements of their role.
Asset Management Policy
The purpose of the RXO, Inc. (RXO) Asset Management Policy is to provide information security requirements regarding the management of assets and the handling of physical and electronic media at RXO. Inappropriate use exposes RXO to risks, including compromise of network systems and services, human resources or legal issues.
Audit & Accountability Policy
The purpose of this Policy is to establish the Audit & Accountability requirements governing the practices and processes incorporated within RXO’s Cybersecurity Program and Secure Computing Environment implemented for storing, processing, and transmitting sensitive company and customer data. This Policy is intended to outline Audit & Accountability Best Practices and the Minimum Standard for protecting RXO and customer data, and the systems which store, process, and transmit data within RXO’s system boundaries.
Change Management Policy
The purpose of this Policy is to:
- Describe what needs to happen before making a change to reduce the risk to other systems and services,
- Reduce incidents, service interruptions, and rework,
- Support notification to affected people in advance of any change, and
- Set requirements for RXO units making changes that tell them how to comply with IT Security obligations.
Communications Security Policy
The purpose of the RXO, Inc. (RXO) Communications Security Policy is to provide information security requirements for the processes related to network security management and information transfer. This document addresses network controls, security of network services and segregation in the network processes within the RXO. Additionally, the policy addresses information transfer procedures, agreements on information transfer, electronic messaging, and confidentiality or non-disclosure agreements.
Cryptography Policy
The purpose of the RXO, Inc. (RXO) Cryptography Policy is to outline requirements for the use of encryption technology to protect the confidentiality, availability, integrity, authenticity, possession, and/or utility of RXO’s information assets.
Data Retention Policy
The purpose of this policy is to establish guidelines for the retention, archiving, and disposal of data across RXO. It ensures compliance with legal, regulatory, and business obligations while promoting efficient information management.
Disaster Recovery and Business Continuity Policy
The purpose of the RXO, Inc. (RXO) Disaster Recovery and Business Continuity Policy (BC/DR) is to define the requirements regarding recovering from significant operational interruptions in a timely manner while minimizing business impacts.
Generative AI Policy
The purpose of this Policy is to establish the Generative AI requirements governing the practices and processes incorporated within RXO’s Cybersecurity Program and Secure Computing Environment implemented for storing, processing, and transmitting sensitive company and customer data. This Policy is intended to outline Generative AI Practices and the Minimum Standard for protecting RXO and customer data, and the systems which store, process, and transmit data within RXO’s system boundaries.
Human Resources IT Security Policy
The purpose of the RXO, Inc. (RXO) Human Resource Security Policy is to provide information security requirements for the IT security processes related to managing the employment life cycle with RXO employees. The aspects of Human Resources security addressed in this document include actions required before, during and after employment.
Information Security Policy
The purpose of the RXO, Inc. (RXO) Information Security Policy is to outline the responsibilities and expectations for security of information assets managed by RXO. The controls described in this policy are collectively known as RXO’s Security Program, which is designed to reflect RXO’s business objectives, prevent the unauthorized use of or access to our information systems and maintain the confidentiality, integrity, and availability of information assets.
Operations Security Policy
The purpose of the RXO, Inc. (RXO) Operations Security Policy is to provide information security requirements for the processes related to operating within RXO systems and applications.
Organization of Information Security Policy
The purpose of the RXO, Inc. (RXO) Organization of Information Security Policy is to provide a management framework to initiate and control the implementation and operation of information security within RXO in order to ensure protection of the confidentiality, integrity, availability, authenticity, utility, and possession of RXO information and assets. It also provides information security requirements for the security of teleworking and the use of mobile devices.
Physical and Environmental Security Policy
The purpose of the RXO, Inc. (RXO) Physical and Environmental Security Policy is to provide information security requirements for the processes related to protecting RXO’s secure areas and equipment. Physical security controls addressed in this document include the physical perimeter(s); physical entry controls securing offices, rooms, and facilities; protection against external and environmental threats; and requirements for working in secure delivery and areas.
Security Compliance Policy
The purpose of the RXO, Inc. (RXO) Security Compliance Policy is to provide information security requirements for the processes related to RXO’s legal, regulatory and contractual compliances and information security reviews.
Security Incident Response Policy
The purpose of the RXO, Inc. (RXO) Security Incident Response Policy is to define information security requirements to minimize the impact of unplanned events that may affect quality, reliability, availability, and overall security of organizational data, applications, and systems. The contents of this policy provide for a controlled, repeatable, efficient, and comprehensive handling approach for all incidents and outages.
Supplier Relationships Policy
The purpose of the RXO, Inc. (RXO) Supplier Relationships Policy is to define information security requirements for the processes related to contractual supplier relationships and supplier service delivery management.
Systems Acquisition, Development and Maintenance Policy
The purpose of the RXO, Inc. (RXO) Systems Acquisition, Development, and Maintenance Policy is to provide information security requirements for the processes related to performing system acquisition, development, and maintenance activities for RXO systems and applications.
Security Standards
Password Management Standard
The purpose of the RXO Password Management Standard is to provide information security requirements for the processes related to managing the secret authentication information of users and systems.
API Security Standard
The purpose of this document is to define the API security standards within RXO. API security standards are defined to identify potential or realized weaknesses as a result of inadvertent misconfiguration, weak authentication, insufficient error handling, sensitive information leakage, etc.
Approved Messaging Services Standard
The purpose of this standard is to:
- Define a list of approved messaging platforms for business communication.
- Establish controls for restricted messaging applications.
- Ensure secure handling of sensitive and confidential information.
- Support regulatory compliance and reduce exposure to cyber threats.
Cloud Security Standard
The purpose of the RXO Cloud Security Standard is to provide information security requirements for the provisioning and management of cloud based services.
Data Governance Standard
The purpose of this document is to define standards related to data governance to mitigate risk related to data misuse or inaccuracies, to promote practices that enhance accuracy, consistency, and reliability of data, and to ensure adherence to legal and regulatory requirements.
Document Control Standard
The purpose of the RXO GSO Document Control Standard is to ensure conformance to requirements within applicable management systems and international quality standards.
Email Communications Standard
The purpose of the RXO Email Communications Standard is to provide information security requirements and best practices for the processes and systems related to Email use.
GDPR Applicability Reference Standard
The purpose of the RXO, Inc. (RXO) GDPR Applicability Standard is to provide all RXO personnel who are required to understand the relationship between specific ISO 27002 control requirements and related GDPR privacy clauses. Typically security and privacy are addressed separately but the criticality of GDPR privacy requirements, and the necessarily close integration of security controls, make it mandatory for relevant RXO personnel to clearly understand this linkage.
Hardware and Software End of Life Standard
The purpose of this document is to define RXO’s governance, risk, and compliance (GRC) standards for managing the lifecycle of hardware and software assets, ensuring secure, efficient, and compliant operations across the enterprise.
Identity and Access Management Standard
The purpose of this standard is to establish the requirements necessary to ensure that access to and use of RXO’s information resources are managed in accordance with business requirements, security best practices, and applicable laws and regulations (e.g., GDPR, HIPAA, SOX).
Information Classification Standard
The purpose of this policy is to establish an enterprise wide approach for the consistent handling of all Company Information with respect to security, access, confidentiality and conformity with contracts, local, state, federal, and international law, and the Company’s Code of Business Ethics.
Information Logging & Monitoring Standard
The purpose of this document is to define the information logging & monitoring standards within RXO. Logging is used to feed intrusion detection systems, for forensic analysis and investigations, and to satisfy regulatory and compliance requirements. These standards will limit the attack surface of RXO’ applications available both internally and externally, protect customers’ sensitive data, and satisfy compliance with any relevant policies in place.
IT Asset Disposal Standard
The purpose of the RXO IT Asset Disposal Standard is to provide information security requirements for the disposal of technology equipment and components.
Network Segmentation Standard
The purpose of the RXO Network Segmentation Standard is to provide information security requirements for the segregation of information and systems using network segmentation. This standard defines the network zones used for segmentation, the criteria for placement of systems in these zones, and rules governing communications between the zones.
Remote Access Management Standard
The purpose of the RXO Remote Access Standard is to provide information security requirements for the processes related to remotely connecting to the RXO network and resources.
Secure Cipher Standard
The purpose of this document is:
- Establish a consistent, secure baseline for cryptographic cipher usage at RXO.
- Reduce exposure to weak, deprecated, or vulnerable encryption algorithms.
- Support regulatory, customer, and audit requirements.
- Enable secure interoperability across applications and infrastructure.
- To protect sensitive customer data.
Secure Coding Standard
The purpose of this Secure Coding Standard is to ensure that all internally developed software is designed, implemented, and maintained using secure development practices. This standard defines expected behaviors, minimum security requirements, and best-practice recommendations for all developers and system designers.
Secure Port Usage Standard
The purpose for RXO Secure Port Usage Standard is to define standards for the secure configuration and management of network ports. Its goal is to ensure encrypted communication, minimize exposure to cyber threats, and
maintain compliance with industry best practices.
Secure Server Standard
The purpose of this document is to define standards for the secure configuration and management of network ports at RXO. This includes enforcing encrypted communication, minimizing exposure to cyber threats, and maintaining compliance with industry best practices.
SSL Certificate Standard
The purpose of this document is to establish a standard for securing RXO servers through the mandatory use of SSL/TLS certificates, ensuring all data transmitted over networks is encrypted and server identities are authenticated.
Terms and Definitions Standard
The purpose of the RXO, Inc. (RXO) Terms and Definition Standard is to provide a repository that details the meaning and intent of the various topics and abbreviations used through the RXO policy and standards documents.
Vulnerability Management Standard
The purpose of the RXO, Inc. (RXO) Vulnerability Management Policy is to provide information security requirements for the processes related to management of security vulnerabilities within RXO systems and applications.