Embed Size (px)
Citation preview
Trusted Partner Network 101
!1
2
Studio Content Protection — Key Pillars of Focus
Content Protection CommunitiesCommunities of key stakeholders and subject matter
experts that ensure our programs are designed, funded and executed with the appropriate level of oversight,
management support and geographic reach.
Training, Awareness & ComplianceShare existing and emerging policies, best practices, and
trainings with internal and third party staff to ensure correct content handling processes.
Policy ManagementDocument and publish detailed standards, procedures,
and guidelines for protecting Disney intellectual property.
Content Workflow AssessmentsDocument and maintain visual representations of all
workflows involving the creation, storage and/or transfer of pre-release content.
Application & Cloud SecurityArchitecture analysis code review, and penetration testing for systems utilized to store and/or transfer
pre-release theatrical content.
Site SecurityRisk assessment and approval service for internal and third party post production
and distribution facilities.
3
Objectives
• What is TPN? • Joint Venture • Mission
• TPN Assessment Requests • Transitioning from Disney’s Vendor Roster • TPN Assessment Requests • Vendor Actions to Start the Process • Vendor Actions to Complete the Process • Recap — Actions and Roles in the Timeline • Annual Reassessments
4
TPN — Industry-wide Initiative
• The Trusted Partner Network (TPN) is the new, global, industry-wide film and television content protection initiative
• The TPN program seeks to raise security awareness, preparedness, and capabilities within our industry
5
Joint Venture with MPAA and CDSA
• The TPN is a joint venture between two major entertainment industry associations, the Motion Picture Association of America (MPAA) and the Content Delivery & Security Association (CDSA), the worldwide leaders in third-party entertainment industry assessments • Both associations will cease their individual security
assessment programs and focus exclusively on managing and developing the TPN initiative
• The MPAA will continue to maintain and update their content security best practices
• Both associations will continue to independently conduct all non-security assessment related association activities separate from this new joint venture
A Joint Venture of
6
Mission to Establish Global Directory
• The TPN establishes a single benchmark of minimum security preparedness for all vendors and their teams, wherever they work, and whatever their specialty
• By creating a single, global directory of “trusted partner” vendors, the goal is to have a centralized database
• The TPN is expected to greatly reduce the number of content owner-initiated and funded assessments
• Content owner assessments will continue on an “as-needed” basis
7
Transitioning from Disney’s Vendor Roster
• Only high-level information was transferred between Vendor Roster and the new database at TPN • If the vendor has already been approved by
Disney, then the business unit gets an email six months before the Vendor’s approval expires
• The business unit should then submit an Assessment Request in Disney’s Vendor Roster
• The Business Unit • Keeps track of vendors in continuous use,
especially when they are already assessed • Watch for those reminder emails about
expirations pending • Submit the Assessment Request through
Vendor Roster • Disney sends the request to TPN
8
TPN Assessment Requests
• The Vendors work with their business units • Even if the business unit isn’t sure they plan to work with the vendor, the
Vendor can make an Assessment Request directly with TPN • Disney makes TPN Assessment Requests when a business unit asks to
work with a specific vendor (and places the submission in Vendor Roster) • Why would a vendor want a TPN assessment?
• The assessment is not just for Disney work • There are many Content Creators who recognize a TPN Site
Assessment to consider a vendor approved to work on a project • The vendor then has only one annual assessment, rather than many, to
work with Content Creators throughout the industry
9
Vendor Actions to Start the Process
1. A Request for Assessment is sent to TPN • TPN Accepts a Request for Assessment
2. TPN sends the Initial Questionnaire to the Vendor to complete
• Vendor completes and submits the finished initial questionnaire
3. TPN sends the Extended Questionnaire to the Vendor to complete
• Vendor completes and submits the finished extended questionnaire
4. Assessment Request is now in a Scheduling Queue • Vendor now has control of the scheduling timeline
1 2
34
10
Vendor Actions to Complete the Process
5. The Vendor selects an Assessor and negotiates payment (negotiations are directly with the Assessor)
• Business unit can communicate with Vendor or the Content & Information Security team about scheduling status
• If Urgent, the Content & Information Security team can assist on case-by-case
6. After the Vendor pays TPN, then the Remote or Onsite Assessment is scheduled
7. The Assessor completes the Assessment and submits the report to TPN
8. TPN reviews the report and publishes the Assessment 9. The Vendor then addresses any Remediation issues until everything
is accounted for and TPN issues a Status of Completion 9
65
78
11
Recap — Actions and Roles in the Timeline
• A New Assessment Request is submitted…or Studio Content Protection team issues the reminder email to Business Unit to renew an Assessment
• Business Unit communicates with Vendor • Business Unit submits Site Assessment
Request in Vendor Roster • Studio Content Protection team takes the
Vendor Roster assessment and submits it as a TPN Site Assessment Request • Studio Content Protection and Vendor
receive notification that the Assessment Request was transferred to TPN
• TPN contacts the Vendor directly, sending Initial and Extended Questionnaires • Vendors have access to their Vendor Portal in TPN
(looks nearly identical to the Disney Vendor Portal) • Vendors can use the Archives in their Disney Portal
to assist them for answering the TPN Questionnaires
• Vendor completes Questionnaires in TPN Vendor Portal
• Request moves into TPN Scheduling Queue • Vendor selects Assessor, arranges and completes
payment, establishes appointment with Assessor for Site Assessment
12
Annual Reassessments
Annual re-assessment begins at vendor’s expiration date (back to Step 1)
• Involves a site visit • Typically requested for
facilities handling pre-theatrical content or sensitive assets which are handled early in the distribution cycle
On-site Remote• Performed via telephone
interview • This ‘lighter’ version of
assessment may be suitable if assets handled are not sensitive in nature or are later in the release cycle (e.g. post theatrical or television content)
Questions?
