We use a range of tools and practices throughout our secure software development lifecycle where security is embedded into each phase to secure our products. Depending on the product risk profile, these may include threat modeling, security testing and vulnerability scanning. Our developers are trained to follow secure coding guidelines.

Source code reviews and security testing are conducted to identify potential system flaws, with the goal of mitigating risk, protecting data and maintaining intended systems functionality. Requirements of security testing may include confidentiality, integrity, authentication, availability, authorization and nonrepudiation. Actual requirements tested depend on the context of the security implemented by the system.

We use security design patterns based on Honeywell standards and industry best practices. Components included in our infrastructure, platform and applications are reviewed against these design patterns to identify problematic coding activities that could lead to vulnerabilities in our code.

Our policies require developers to use secure coding practices and conduct security testing, which are aligned with OWASP guidelines.

We use industry-leading cloud service providers who follow comprehensive physical security controls to limit access to authorized personnel. Our data center providers are audited by independent third-party auditors who report their findings via SOC 2 Type 2 reports.

Honeywell has a defined procedure for provisioning user access. All users have individual logins. We use role-based access to ensure staff only have access appropriate to their roles. We control access to our corporate applications through a single sign-on platform.

Honeywell uses commercially standard cryptography and security protocols to protect the confidentiality and integrity of customer data. 

Cryptographic keys are managed according to defined policies and procedures. Duties are segregated to ensure an appropriate level of security controls.

We use commercially reasonable efforts to promptly apply security patches (including open source software) after potential vulnerabilities become known to us.

Logs associated with security events are aggregated and stored centrally and are monitored through Honeywell’s security operations center (SOC).

Incident response procedures exist for security and data protection incidents, which includes incident analysis, containment, response, remediation, reporting and the return to normal operations. We have an incident response capability which includes a Computer Incident Response Team (CIRT) with a formal process to respond to cyber attacks. Intrusions are logged, monitored and investigated. Incident response plans are maintained, updated and tested on an annual basis.

Yes, we adhere to our incident response procedures to ensure timely reporting of security breaches in compliance with applicable regulatory and contractual requirements.

Yes, we follow industry-leading security practices to enable logging and monitoring of security events through our security operations center (SOC) that helps detect data privacy-related incidents.

Yes, our development and operations teams follow a defined change management process while making configuration changes on applications and their underlying infrastructure platform to ensure all changes are approved and that there is minimal business impact. Changes are logged, assessed and authorized prior to implementation and reviewed against planned outcomes following implementation.

Vulnerability scans are conducted periodically with static code scans on every checked-in code change. Open source and container scans are performed on every build. Infrastructure resources are continuously scanned for vulnerabilities.

Honeywell follows a global resilience framework that includes conducting business impact analysis and maintaining business continuity plans. Honeywell periodically tests its business continuity and disaster recovery plans as per Honeywell’s Global Resilience framework.

Please refer to our Honeywell Forge Compliance Section.

Honeywell validates and approves usage of open source as part of the security requirements' definition and scans the source code using security tools to help identify and remediate known vulnerabilities.

Honeywell performs background checks as part of the recruitment process for employees and contractors, where allowed by local law and as reasonable for job roles.

Prior to engaging a third-party supplier, Honeywell reviews any proposed engagements and requires suppliers to provide evidence of their security practices. We require suppliers to comply with minimum security requirements, and these standards are incorporated into the supplier’s contract.