Cisco’s 7 Guiding Principles of Government Data Demands

At Cisco, we empower our customers to control their data. Protecting the privacy, integrity, and confidentiality of data in our possession is of utmost importance. In a world of advancing cyberthreats, expanding extraterritorial legislation, and growing concerns for data localization, we understand technology companies have an outsized responsibility to ensure customers have the power to make important decisions about their data.

Like all global technology companies, there are scenarios when Cisco receives demands from law enforcement, intelligence agencies, or governments requesting access to data related to an ongoing investigation. When this happens, Cisco follows a strict set of procedures to ensure that data disclosures are minimized, controlled, and that access to our solutions and services remains free from unlawful intrusion.

Our Principled Approach drives our policies and procedures in how we operate as a company when receiving government demands for data:

Principle 1: We believe governments, including law enforcement and national security agencies, should go directly to our customers to gain access to data regarding those entities, their employees, and users. We will refer government to the relevant customer before disclosing any data in Cisco’s possession. We will only consider disclosing data directly to the government in scenarios where the customer does not have the relevant corresponding data, if the customer has requested that we disclose the data to the government, or if the government has confirmed that it cannot seek the requested information from the customer.

Principle 2: Cisco will provide data in response to a demand only if the requesting government has demonstrated appropriate lawful authority to require us to provide the data. Where demands are not accompanied by valid legal process, Cisco will challenge or reject the request.

Principle 3: Cisco will carefully review every government demand to ensure legal validity, and we will narrowly interpret demands to produce the least data necessary to comply. Cisco will challenge any government demand that raises human rights concerns. Cisco’s actions will be guided by our Global Human Rights Policy.

Principle 4: Unless prohibited by applicable law, Cisco will notify the customer that its data has been requested prior to producing any data to government, so that the customer may attempt to limit or prevent disclosure.

Principle 5: Cisco will only make an exception to our customer notification commitments in emergency circumstances where disclosure to the government will prevent imminent death or serious physical harm to an individual. Where not prohibited by applicable law, we will subsequently notify the customer if such an exception has been made. Emergency demands will be included in our semiannual Transparency Report.

Principle 6: Where demands that prohibit notification to the customer are excessive in duration (over one year in length), or are overly broad in scope, Cisco will challenge the demand to protect our customer’s interests.

Principle 7: Where compliance with a valid government demand would put Cisco in potential breach of applicable data protection and/or privacy-related laws in another country that has jurisdiction over the data, we will challenge the demand and invoke mutual legal assistance mechanisms, where appropriate.

We are committed to constantly reassessing these principles to ensure they align with growing international privacy regulations and continuously exceed our customers’ expectations.

Beyond our principles, Cisco actively engages in advocacy work in topics of government surveillance reform and digital sovereignty to help encourage regulations that are consistent with Cisco’s principled approach. We are members of BSA The Software Alliance, Information Technology Industry Council (ITI), and the US ASEAN Business Council to address these issues across the globe.

Article sourced from Cisico Blog

Go to Cybersecurity Knowledge Base

Got to Cybersecurity News

Go to Homepage

Go to Cybersecurity Academy

Stay informed of the latest Cybersecurity trends, threats and developments. Sign up for RiSec Weekly Cybersecurity Newsletter Today

Remember, CyberSecurity Starts With You!

Globally, 30,000 websites are hacked daily.
64% of companies worldwide have experienced at least one form of a cyber attack.
There were 20M breached records in March 2021.
In 2020, ransomware cases grew by 150%.
Email is responsible for around 94% of all malware.
Every 39 seconds, there is a new attack somewhere on the web.
An average of around 24,000 malicious mobile apps are blocked daily on the internet.

Bookmark

Social Comments Box

About
Latest Posts

Connect

RiSec.n0tst3

Hello! I'm Steve, an independent security researcher, and analyst from Scotland, UK.

I've had an avid interest in Computers, Technology and Security since my early teens. 20 years on, and, it's a whole lot more complicated...

I've assisted Governments, Individuals and Organizations throughout the world. Including; US DOJ, NHS UK, GOV UK.

I'll often reblog infosec-related articles that I find interesting. On the RiSec website, You'll also find a variety of write-ups, tutorials and much more!

Connect