Cyber Security at Xerox 

The Cyber Security organisation at Xerox has the global responsibility of securing Xerox’s infrastructure and protecting Xerox’s information assets. It is led by the Xerox CISO and includes a global team of cyber professionals located across our offices in North America, Europe and Asia.

The top priorities of our Cyber Security organisation include: 

• Establishing appropriate security policies, safeguards and controls to prevent, detect and respond to cyber attacks 

• Managing cyber risks in a manner that meets regulatory and compliance requirements and aligns with customer expectations 

• Securing Xerox intellectual property, products & services and supply chain in collaboration with Xerox business, product and IT teams​​ 

The Xerox Cyber Security organisation is comprised of the following teams and capabilities: 

Cyber Defense

​​​​​​​​​​​​​​​Responsible for protecting, detecting and responding to cyber-attacks on Xerox information assets. Some of the key activities/capabilities provided by this team include: 

• Security Operations Center (SOC): delivers continuous (24/7) monitoring of Xerox’s information systems and performs appropriate action to contain and respond to cyber events 

• Vulnerability Management: performs vulnerability scanning, prioritisation, reporting and remediation tracking of security vulnerabilities with the goal of improving system hardening and minimizing attack surface 

• Offensive Security: continuously evaluates our infrastructure, applications, products and services using the same tactics, techniques and procedures of an adversary to identify and remediate security issues before being identified or exploited by an adversary 

• Cyber Security Incident Response: performs triage, analysis, containment, and recovery of Xerox information systems from cyber security events 

• Cyber Threat Intelligence and Threat Hunting: gathers cyber threat intelligence data, analyses for relevancy to Xerox information systems and performs threat hunting 

Governance, Risk and Compliance

​​​​​​​​​​​​​​​Responsible for managing Xerox Cyber Security policy and standards, risk and compliance programs. Some of the key activities/ capabilities provided by this team include: 

• Security Policy Management: manages Xerox security policy and standards and reviews their enforcement across Xerox 

• Security Awareness and Training: manages security training during employee and contractor onboarding and then on an ongoing basis to raise awareness about their security responsibilities and key cyber threats 

• Disaster Recovery: governs the enterprise disaster recovery program and periodic testing of recovery plan and resiliency capabilities 

• Third-Party Risk Management: performs due-diligence review of third-party supplier engagements at the time of initial procurement and subsequently during renewal depending on the engagement risk  

• Compliance Management: manages certification and compliance programs including PCI, SOC 1, SOC 2, ISO 27001, FedRAMP, etc. 

Security Architecture & Testing

​​​​​​​​​​Responsible for incorporating security throughout the SDLC in collaboration with Xerox business, product and IT teams. Some of the key activities/ capabilities provided by this team include: 

• Security Architecture Review: implements security-by-design into new applications and services through technical security design/ architecture reviews 

• Security Testing: performs automated application scanning and manual penetration testing prior to go-live 

Identity & Access Management

​​​​​​​​Responsible for managing the technologies and processes for managing identities and their access across Xerox systems, services and applications. Some of the key activities/ capabilities provided by this team include: 

• Identity Governance & Administration: manages technology and processes for identity provisioning, de-provisioning and life cycle management of Xerox identities and governs their access to various Xerox systems, services and applications

• Access Management: manages the suite of technologies for authentication, single sign-on, multi-factor authentication and privileged access to various Xerox systems, services and applications.

Customer Security

Responsible for managing customer trust in Xerox products and services through collaboration with various Xerox business and product teams. Some of the key activities/capabilities provided by this team include: 

• Customer Security Assessments: responds to customer inquiries and questionnaires regarding the security posture of Xerox products and services

• Customer Contract Compliance: reviews security terms and conditions in customer contracts prior to execution and ensures our security program complies with applicable laws, regulations and customer expectations

In addition to the above, we work with our internal and external partners to evaluate and continuously improve our cyber security posture through:

• External Penetration Testing: We engage external specialist cyber security consulting firms to perform penetration testing of high-risk enterprise infrastructure and customer-facing services. 

• Security Audits: We perform comprehensive audits of our Cyber Security program through reputable external consulting firms. Additionally, internal audits are performed in areas deemed to be high risk. The results of external and internal audits are reported to the Audit Committee and fed into the continuous improvement cycle to continue to mature our Cyber Security program. 

Xerox and Cisco's Identity Services Engine

Xerox Security Model

Product Security

Document Security Technologies

Xerox Information Security

SOC 2 Certified Brochure (PDF)

Xerox Comprehensive Security Solutions

State-of-the-Art Printer and Data Security