RSM’s information security program establishes a secure foundation for sustainable digital growth through strategic, technical and organizational measures that protect RSM’s digital assets.

Our information security mission calls for protecting the confidentiality, integrity and availability of RSM and client data. To support this mission, our leadership team has driven continuous improvement through appropriate levels of oversight, leadership participation and a risk-based approach to control protected information. Our people undergo information security and privacy awareness training upon hire and annually thereafter. This includes ongoing phishing detection training.

We also have a dedicated information security team. Led by our chief information security officer (CISO), this team includes but is not limited to the office of the CISO, security operations, cyber incident response, security architecture and engineering, and information security governance.

Our information security standards align with the internationally recognized ISO/IEC 27001: 2022 framework. They are further shaped by industry best practices, regulatory requirements, and the specific needs of our operating environment.

Information security incident management

We continuously monitor for vulnerabilities, threats, and security events using industry-standard prevention and detection tools. This includes intrusion detection/prevention systems, data loss prevention, and security information and event management (SIEM) platforms. Our incident response plan is supported by a dedicated and experienced incident response task force.

Information security in vendor relationships

At RSM, we prioritize security when sourcing digital products and services. Any vendor solution that stores or accesses confidential information undergoes a security review. Vendor agreements include provisions for confidentiality, security, privacy, data integrity and breach response, as appropriate. Contractors and nonemployees are required to comply with our acceptable use and information security policies.

Collection, use and retention of personal information

‍We collect, use and retain personal information subject to our publicly available privacy policy. As described in that policy, we process this data for several purposes, including to provide services to our clients. This data maybe retained for as long as necessary for the purposes described in our privacy policy, to achieve the goals for which the information was collected or as permitted under applicable law. We have a dedicated enterprise privacy office led by our enterprise privacy leader.

‍