Single Sign-On (SSO) Policy

1.0 OVERVIEW

This policy details the Single Sign-On (SSO) service utilized with OAuth 2.0

2.0 PURPOSE & BACKGROUND

Single sign-on (SSO) is a session and user authentication service that permits a user to use one set of login credentials (e.g., name and password) to access multiple applications.

At NEO, we use OAuth 2.0 as our Single Sign On service.

In addition, we use a Bitwarden Authenticator or a compatible OTP solution like Bitwarden:

Bitwarden Authenticator is a software token that implements two-step verification services using the Time-based One-time Password Algorithm and HMAC-based One-time Password algorithm, for authenticating users of mobile applications.

3.0 ELIGIBILITY

This policy applies to all users of information systems within the organization. This typically includes employees and contractors, as well as any external parties that come into contact with systems and information controlled by the organization (hereinafter referred to as “users”). This policy must be made readily available to all users.

4.0 POLICY

SSO will be enabled for all users and is required for security purposes. The usage of SSO enhances the user experience by linking trust services and limiting the number of login credentials that must be remembered by each user.

5.0 ROLES & RESPONSIBILITIES

This policy applies to the use of information, electronic and computing devices, and network resources to conduct NEO business or interact with internal networks and business systems, whether owned or leased by NEO, the employee, or a third party. All employees, contractors, consultants, temporary, and other workers at NEO and its subsidiaries are responsible for exercising good judgment regarding appropriate use of information, electronic devices, and network resources in accordance with Worksuite policies and standards, and local laws and regulation.

6.0 COMPLIANCE

NEO reserves the right to audit networks and systems on a periodic basis to ensure compliance with this policy.