U.S. GOVERNMENT PUBLISHING OFFICE

WASHINGTON : 

For sale by the Superintendent of Documents, U.S. Government Publishing Office

Internet: bookstore.gpo.gov Phone: toll free (866) 512–1800; DC area (202) 512–1800

Fax: (202) 512–2104 Mail: Stop IDCC, Washington, DC 20402–0001

28–123 PDF 2018

S. HRG. 115–129 

AN EXAMINATION OF THE EQUIFAX 

CYBERSECURITY BREACH 

HEARING 

BEFORE THE

COMMITTEE ON 

BANKING, HOUSING, AND URBAN AFFAIRS 

UNITED STATES SENATE 

ONE HUNDRED FIFTEENTH CONGRESS 

FIRST SESSION 

ON 

EXAMINING THE EQUIFAX CYBERSECURITY BREACH AND ITS IMPACT 

ON APPROXIMATELY 143 MILLION U.S. CONSUMERS 

OCTOBER 4, 2017 

Printed for the use of the Committee on Banking, Housing, and Urban Affairs 

( 

Available at: http://www.govinfo.gov/ 

COMMITTEE ON BANKING, HOUSING, AND URBAN AFFAIRS 

MIKE CRAPO, Idaho, Chairman 

RICHARD C. SHELBY, Alabama 

BOB CORKER, Tennessee 

PATRICK J. TOOMEY, Pennsylvania 

DEAN HELLER, Nevada 

TIM SCOTT, South Carolina 

BEN SASSE, Nebraska 

TOM COTTON, Arkansas 

MIKE ROUNDS, South Dakota 

DAVID PERDUE, Georgia 

THOM TILLIS, North Carolina 

JOHN KENNEDY, Louisiana 

SHERROD BROWN, Ohio 

JACK REED, Rhode Island 

ROBERT MENENDEZ, New Jersey 

JON TESTER, Montana 

MARK R. WARNER, Virginia 

ELIZABETH WARREN, Massachusetts 

HEIDI HEITKAMP, North Dakota 

JOE DONNELLY, Indiana 

BRIAN SCHATZ, Hawaii 

CHRIS VAN HOLLEN, Maryland 

CATHERINE CORTEZ MASTO, Nevada 

GREGG RICHARD, Staff Director 

MARK POWDEN, Democratic Staff Director 

ELAD ROISMAN, Chief Counsel 

JOE CARAPIET, Senior Counsel 

BRANDON BEALL, Professional Staff Member 

ELISHA TUKU, Democratic Chief Counsel 

LAURA SWANSON, Democratic Deputy Staff Director 

COREY FRAYER, Democratic Professional Staff Member 

DAWN RATLIFF, Chief Clerk 

CAMERON RICKER, Deputy Clerk 

JAMES GUILIANO, Hearing Clerk 

SHELVIN SIMMONS, IT Director 

JIM CROWELL, Editor 

(II)

C O N T E N T S 

WEDNESDAY, OCTOBER 4, 2017 

Page 

Opening statement of Chairman Crapo ................................................................. 1 

Opening statements, comments, or prepared statements of: 

Senator Brown .................................................................................................. 2 

WITNESS 

Richard F. Smith, former Chairman and Chief Executive Officer, Equifax, 

Inc. ......................................................................................................................... 4

Prepared statement .......................................................................................... 39 

Responses to written questions of the Senate Banking Committee ............. 45 

ADDITIONAL MATERIAL SUPPLIED FOR THE RECORD

Letter Submitted by the Credit Union National Association ............................... 96 

Equifax, Inc., ‘‘Insider Trading Policy’’ .................................................................. 97 

Equifax, Inc., ‘‘Corporate Crisis Management Plan, Part I’’ ................................ 111 

Equifax, Inc., ‘‘Corporate Crisis Management Plan, Part II’’ ............................... 156 

Equifax, Inc., ‘‘Corporate Crisis Management Program, Appendix H’’ ............... 180 

Equifax, Inc., ‘‘Regional Crisis Management Plan’’ .............................................. 199 

Equifax, Inc., ‘‘Security Incident Handling Policy and Procedures’’ .................... 233 

(III)

(1) 

AN EXAMINATION OF THE EQUIFAX 

CYBERSECURITY BREACH 

WEDNESDAY, OCTOBER 4, 2017 

U.S. SENATE, 

COMMITTEE ON BANKING, HOUSING, AND URBAN AFFAIRS

Washington, DC. 

The Committee met at 10:03 a.m., in room SD–538, Dirksen Senate Office Building, Hon. Michael Crapo, Chairman of the Committee, presiding. 

OPENING STATEMENT OF CHAIRMAN MIKE CRAPO 

Chairman CRAPO. This Committee will come to order. 

This morning, we will hear testimony from Richard Smith, 

former chairman and chief executive officer of Equifax, who held 

those positions until last week. 

I understand that you are now serving as an unpaid advisor to 

the company and appreciate your willingness to testify here and 

appear and testify about the events surrounding the breach and 

Equifax’s response while you were leading the company. 

Given the severity of this data breach, Congress will continue to 

examine the facts behind it and what can be done to prevent similar situations. 

Cybersecurity is one of the most pressing issues facing companies, as well as consumers and Governments alike, and is one of 

the biggest threats to our financial system. The amount of data 

that the private industry and Government collect and store is very 

concerning. There is intrinsic vulnerability in collecting and storing 

personal financial information, and we need to have a meaningful 

discussion on how to protect and limit access to it. 

The Banking Committee takes its oversight of credit bureaus seriously, as they are financial institutions under the Gramm–Leach– 

Bliley Act. 

Credit bureaus serve a critical function in our financial system 

and have become a daily part of every American’s life. Every day, 

these institutions intersect in people’s attempts to get credit cards, 

car loans, mortgages, and other items. 

Consumers may know about their involvement in their lives, 

such as when they directly request a credit report, but sometimes 

they do not, like when a company requests a background check to 

determine their eligibility for a cell phone. 

The ability of Americans to easily access credit is one of the 

many things that make our economy and our country the envy of 

the world. It is also why this breach is so shocking and concerning. 

2 

Here is what we know based on information from Equifax. 

Equifax experienced a cybersecurity breach which potentially impacted more than 145 million U.S. consumers. The data that was 

taken included the names, Social Security numbers, birth dates, 

addresses, and in some cases driver’s license numbers. 

In addition, credit card numbers for approximately 209,000 consumers and dispute documents with personally identifiable information for approximately 182,000 consumers were accessed. 

According to Equifax, the unauthorized access took place from 

mid-May through July 2017, with Equifax discovering the situation 

on July 29 and then finally cutting off the intruders. 

Here is what we need to know. Why did it take Equifax 6 weeks 

from the time it learned of the breach to tell the public, the regulators, and the 145 million American victims about it? Why were 

Equifax executives trading during this time? How strong were and 

are Equifax’s cybersecurity practices? 

After the breach, what interactions did the company have with 

other credit bureaus and Government agencies, in order to understand what, if anything, can be improved in terms of information 

sharing and mitigating consumer harm? 

Additionally, there are valid and important questions about the 

steps Equifax has taken to remediate customers and whether more 

needs to be done to minimize the potential harm to those affected. 

In an op-ed last week, your successor admitted that answers to 

key consumer questions were often delayed, incomplete, or both. 

That same op-ed asserted that it is important to give consumers 

the power to protect and control access to their personal credit 

data. 

I look forward to having these questions answered and exploring 

different options on how companies can better safeguard consumers’ information. 

Senator Brown. 

OPENING STATEMENT OF SENATOR SHERROD BROWN 

Senator BROWN. Thank you, Chairman Crapo. 

The story of this data breach is a familiar one. A big financial 

institution screwed up. Executives walk away with millions of dollars. Tens of millions of Americans end up holding the bag. 

Unfortunately, Americans have come to expect that the Equifax 

scandal will play out the same way as the Wells Fargo scandal. A 

couple executives retire. Some of them lose some of their bonuses. 

A couple fines are issued, and only later do we find out the problems go much, much deeper. 

Most Americans never chose to have their data scooped up by 

Equifax. You have said that since 2005, Equifax has been rapidly 

transforming itself into a—your words—‘‘global analytics company’’ 

by collecting huge troves of information on people that you can sell 

to marketers and employers, but you almost never ask people if 

they want to be tracked. 

Most of the 145 million people—that number seems to climb 

every week or so—well over half of all adults in the United States, 

most of the 145 million people whose data you allowed to be stolen 

probably only had a vague idea of what Equifax was, if they had 

3 

heard of you at all. Then they read in the paper that their personal 

information has, in fact, been compromised. 

But while they might not have known the name Equifax, they 

should have been able to expect that a company that gathers the 

most private information about them would have state-of-the-art 

protections for that information. A gold mine for hackers should be 

a digital Fort Knox when it comes to security. 

But security does not generate short-term profits. Protecting consumers apparently is not important to your business model, so you 

gathered more and more information. You peddled it to more and 

more buyers. 

For example, you bought a company called TALX so you could 

get access to detailed payroll information—the hours people 

worked, how much they were paid, even where they lived—7,000 

businesses. 

You were hacked there, too, exposing the workers of one proud 

Ohio company, 400,000 workers at Kroger, and an unknown number of people’s information to criminals who used it to commit tax 

fraud. 

In May of this year, your outside law firm stated that Equifax 

had instituted additional security measures in order to prevent a 

recurrence of the TALX incident, just like you are claiming you are 

doing now. Yet at that same time, hackers had already taken advantage of another security flaw to get into Equifax’s system. 

It has been 10 weeks since you discovered this latest breach, but 

I still do not think we have a complete answer to the question what 

happened and why. 

We do know that this breach could have been avoided if you had 

taken the simple step of administering security patches, but your 

response after the fact may have been just as negligent. 

You told the House yesterday that Equifax knew at least some 

people’s data had been exposed on August 15th. Rather than giving 

victims a chance to protect themselves, you withheld this information from the public for weeks. 

You claim that you delayed telling the public about this hack so 

you could get an appropriate consumer response put together, but 

when you finally did tell people what happened, Equifax’s website 

and call centers were immediately overwhelmed. 

You even tried to take advantage of the situation by sticking victims with a forced arbitration clause buried in the credit monitoring product you were shopping to victims. Think about that. You 

tried to take advantage further, even with all this, when the public 

was so upset because you had betrayed their trust and the public 

trust. You stick the victims with a forced arbitration clause buried 

in the credit monitoring product you were shopping to victims. At 

least in this instance, you backed down under public pressure, unlike Wells Fargo, which yesterday under withering questions continued to resist. 

Chairman Crapo and I sent a letter to you on September 22nd 

requesting basic information. For example, is there a company policy on stock sales? I would guess so, but the best we got from the 

company was, quote, ‘‘Equifax will work with Committee staff to 

provide a copy of the policy,’’ unquote. We are not talking about 

trade secrets here. I just do not get the obfuscation. 

4 

Despite your promise to deliver a free CreditLock product next 

year, all of Equifax’s actions up to this point demonstrate that this 

simply is not a company that deserves to be trusted with Americans’ personal data. 

Your actions have exposed over half the country’s adults to financial harm. Equifax has forfeited its right to corporate secrets. So 

please do not make the same mistake that Wells Fargo did. Now 

is the time to give this Committee the whole story. 

Thank you, Mr. Chairman. 

Chairman CRAPO. Thank you, Senator Brown. 

And now we will proceed to the testimony. We will hear testimony from Mr. Richard Smith, former chairman and chief executive officer of Equifax, Inc. 

Mr. Smith, your written statement will be made a part of the 

record in its entirety, and you may proceed with your oral remarks. 

STATEMENT OF RICHARD F. SMITH, FORMER CHAIRMAN AND 

CHIEF EXECUTIVE OFFICER, EQUIFAX, INC. 

Mr. SMITH. Thank you, and good morning. Thank you, Chairman 

Crapo, Ranking Member Brown, and Honorable Members of the 

Committee. Thank you for the opportunity to testify before you this 

morning. 

My name again is Rick Smith, and for the last 12 years, I have 

had the honor of serving as chairman and CEO as Equifax. As 

noted, I have submitted written testimony, which addresses the details of my testimony in far more detail than I will get in my oral 

comments. 

I have talked to many consumers, and I have read their letters. 

I understand how frustrated and fearful many Americans are about 

what happened at Equifax. This criminal attack took place on my 

watch, and I take full responsibility as CEO at the time. I want 

to say to every American, I am truly and deeply sorry for what 

happened. 

Americans have the right to know how this happened, and I am 

prepared to testify today about what I learned and what I did 

about the incident and my role as CEO and chairman of the board 

and also what I know and what I have learned about the incident 

as a result of being briefed by the company’s investigation, which 

is ongoing. 

As we now know, this criminal attack was made possible because 

a combination of a human error and a technological error. The 

human error involved the failure to apply a patch to our dispute 

portal in March of 2017. The technological error involved a scanner, which failed to detect the vulnerability on this particular portal, which had not been patched. Both errors have since been addressed. 

On July 29th and July 30th, suspicious activity was detected. We 

followed our security incident response protocol at that time. The 

team immediately shut down the portal and began our internal security investigation. 

On August 2nd, we hired top security, cybersecurity, forensic, 

and legal experts, and we notified the FBI. At that time, we did 

not know the nature or the scope of the incident. 

5 

It was not until late August that we concluded that we had experienced a major data breach. 

Over the weeks leading up to September 7th, our team continued 

working around the clock to prepare to make things right. We took 

four steps to protect consumers: first, determining when and how 

to notify the public, relying on the advice of our experts that we 

needed to have a plan in place as soon as we announced; two, helping consumers by developing a website and staffing up a mass of 

call centers and offering free services to every American; three, preparing for increased cyberattacks, which we were advised are common after the notice of a breach; and finally, number four, continue 

to coordinate with the FBI and their criminal investigation of the 

hackers and notifying other Federal and State agencies. 

In the rollout of our remediation program, mistakes were made 

for which again I am deeply apologetic. I regret the frustration that 

many Americans felt when our websites and call centers were overwhelmed in the early weeks. It is no excuse, but it certainly did 

not help that two of our larger call centers were shut down for days 

by Hurricane Irma. 

Since then, however, the company has dramatically increased its 

capacity, and I can report to you today that we have handled more 

than 420 million consumer visits to our website, and the wait time 

at our call centers have been dramatically reduced. 

At my direction, the company offered a broad package of service 

offerings to all Americans, all of them free to help protect consumers. 

In addition, we developed a new service that will be available 

January 31st, 2018, that will give all consumers the power to control access to their credit data by allowing them to lock and unlock 

their credit files whenever they want for free and for life, putting 

the power to control access to data in the hands of the American 

consumer. I am looking forward to discussing this tool with you in 

detail during my testimony. 

As we have all painfully learned, data security is a national security problem. Putting consumers in control of their credit data is 

a first step toward a long-term solution to the problem of identity 

theft. 

But no single company could solve the larger problem on its own. 

I believe we need a public–private partnership to evaluate how to 

best protect American consumers’ personal data ongoing. I look forward to being a part of that dialogue. 

Chairman Crapo, Ranking Member Brown, and the Honorable 

Members of the Committee, thank you again for inviting me to 

speak before you today. 

I will close again by saying how sorry I am about this breach. 

On a personal note, I want to thank the many hardworking and 

dedicated people who have worked with me so tirelessly over the 

last 12 years. Equifax is a very good company with thousands of 

great people trying to do the right thing each and every day. I 

know that they will continue to work tirelessly, as we have over 

the past few months to right this wrong. 

Thank you. 

Chairman CRAPO. Thank you, Mr. Smith. 

6 

Mr. Smith, you recently discussed the need to give consumers 

control of their own data. Yesterday, you said, ‘‘It is time we 

change the paradigm, give the power back to the consumer to control who accesses his or her credit data. It is the right thing to do.’’ 

But we are far from that reality today with credit bureaus. First, 

what needs to be changed to give consumers this power? 

Mr. SMITH. Mr. Chairman, the start is this product we are introducing, which will come out in January of next year, which gives 

the consumer the ability to control who and when accesses the 

credit data. It will be a simple tool, Web-enabled on an application, 

and the consumer can simply dictate who gets access, who does 

not, and if he or she wants to go to a bank to get a credit card or 

a car loan, they simply can toggle on, open the access for the underwriter to look at their credit file, once complete, toggle off, and 

secure. 

Chairman CRAPO. And it seems to me if that solution works that 

that is a solution or a part of the solution with regard to other private-sector actors or illegal actors. What about the Government? 

Does the Federal Reserve or the CFPB have access to your data, 

to Equifax’s data? 

Mr. SMITH. Sir, Mr. Chairman, if a consumer locks their—at the 

consumer level, is that the question? 

Chairman CRAPO. Yes. 

Mr. SMITH. If the consumer locks their file, they lock out anyone’s access to that data. 

Chairman CRAPO. So you are not in a position of being required 

by any Federal agency to provide this personally identifiable data 

to that agency? 

Mr. SMITH. Mr. Chairman, I am not sure I understand the question. If a consumer locks their file to prevent access to their file 

from any other bank or telecommunications company, they would 

be the only ones who could unlock that file. We could not unlock 

that file on their behalf, if I understand the question correctly. 

Chairman CRAPO. Even if asked by a Government agency as opposed to an inquiring bank? 

Mr. SMITH. I would have to check that. 

Chairman CRAPO. All right. Thank you. I would appreciate that. 

Mr. SMITH. Thank you. 

Chairman CRAPO. In the hearing yesterday, you mentioned that 

we may need to think about how secure Social Security numbers 

really are and if they are really the best identifier going forward 

for consumers. Could you give us your thoughts on that? 

Mr. SMITH. Yes. Mr. Chairman, I worry about the fact that Social 

Security numbers have been out there since 1936 and used to be 

on our driver’s license and used in our employment. You talked to 

many cybersecurity experts, and they say they vast majority of all 

SSNs have already been compromised. 

I am in no way skirting the issue of the horrific breach that we 

had. It was horrific, and I once again apologize to this Committee 

and to all Americans. But I would encourage a dialogue to talk 

about what is a better way to identify individuals, something beyond the SSN. 

Chairman CRAPO. Do you have any ideas as to what that might 

be, what could we effectively transfer into? 

7 

Mr. SMITH. I do not, but I would love to be part of that dialogue, 

the combination of public and private partnership with academic, 

to think about that. There is a lot of thinking going on right now. 

I am sure with the right thought and a priority, we could crack 

that code. 

Chairman CRAPO. All right. Thank you. 

There have been some issues and confusion relating to the product you just discussed and services that Equifax has offered in light 

of the breach. Some of my constituents have said they are having 

trouble gaining access to the remediation products being offered. 

What exactly are customers being offered today, and what do they 

need to do to obtain these products and services? 

Mr. SMITH. Thank you. 

We are offering five different services for free, and to repeat, this 

is to all Americans, not just the victims of the criminal attack. 

Number one, it is a three-bureau monitoring, where you can 

monitor activity against your credit file from ourselves, 

TransUnion, and Experian. Two is the ability to lock the file. Number three is the ability to scan. We scan the dark web on behalf 

of the consumer looking for Social Security activity that might 

occur. Number four is access to our file for free, and number five 

is an insurance product that helps recoup costs up to a million dollars if a consumer has costs in trying to fight, repair their credit. 

So those are the five services we offer today to all Americans, 

and the other, Chairman, is the one we talked about that is available in 2018, January 31st of 2018, which is the next generation 

of Lock. 

Chairman CRAPO. All right. Thank you very much. 

Senator Brown. 

Senator BROWN. Thank you, Mr. Chairman. 

According to your testimony in the House yesterday, over the last 

3 years, you have spent $250 million on cybersecurity. That is 

about $85 million a year, correct? 

Mr. SMITH. Yes. That was an estimate that over the last 3 years, 

it is approaching a quarter billion dollars. 

Senator BROWN. And since 2016, you have made personally about $69 million; is that correct? 

Mr. SMITH. I have not tracked that number, to be honest. 

Senator BROWN. In hindsight, do you think Equifax should have 

spent more money protecting people’s data rather than compensating you so well? 

Mr. SMITH. I look back at the money we have spent. It is not a 

matter of the dollars spent. It was not a financial constraint, by 

any means. Obviously, when you look at the issue in hindsight, it 

is could you have spent money differently, not the total dollars 

spent. 

There is a benchmark out there that was done by IBM that 

benchmarks financial services company, and their total security 

spend is a percent of IT. And their benchmark talks about a range 

of 10 to 14 percent. Our range is in the range of 12 percent. So, 

again, we are spending money in a range that—— 

Senator BROWN. Well, I am going to interrupt you because I 

know that in the House, House hearing, there were not nearly as 

many questions because your answers were pretty long, and I unVerDate Nov 24 2008 16:00 Feb 12, 2018 Jkt 046629 PO 00000 Frm 00011 Fmt 6633 Sfmt 6633 L:\HEARINGS 2017\10-04 ZDISTILL\100417.TXT JASON
8 

derstand the complexities of this. But you are an IT company, and 

that is just not acceptable. 

Last August, this past August at a business school event at the 

University of Georgia, you bragged that Equifax gets its data basically cost-free. You were also asked how you approach data fraud, 

and you responded, quote, ‘‘Fraud is a huge opportunity for us.’’ 

Your SEC filings back that up. They state that a significant portion 

of your revenue comes from selling credit monitoring and fraud 

protection services to consumers. So do you think, Mr. Smith, it is 

fair that Equifax gets to take its consumers’ data at almost no cost, 

make millions by selling it to data-mining companies and marketers, then charge fees to those consumers for credit monitoring products after they become identity theft victims? 

Mr. SMITH. Senator, the vast majority of what we do is allowing 

consumers to get access to credit. We take their data combined 

with analytics and allow underwriters at banks, credit card lenders, automotive lenders, to make loans to consumers. We make 

very little money as a percent of our total revenue from selling 

monitoring products to consumers. 

Senator BROWN. But the point is you keep making money off people’s sensitive data either way. 

Equifax does not get its data directly from consumers, as you 

know, and as several on this Committee have pointed out, it gets 

it from their banks, their utility companies, their employers, all 

without consent of the borrowers and the employees. 

Congress long ago, as I think you know, decided that companies 

could not traffic in people’s medical records for obvious and good 

reason and that they needed to consent to a transfer. Why should 

not we do the same with financial records? You know how important that personal financial data is to people. Why not do the same 

with financial records? Do you think we need to change the consumer reporting industry in this country to give Americans ownership of the data? For example, should they be allowed to request 

that you delete the data from your systems? 

Mr. SMITH. Senator, two thoughts. One is we are a vital part to 

the global economy. We provide a great service to the consumer enabling them to get access to credit. 

We also enable the unbanked because of our data to have the opportunity to get into the credit market. So it is a vital and very important role we play and have played for many, many years. 

Yes, there are things we can do better as an industry and working with Government, and the one thing I would like to see us talk 

about as an industry is this concept of giving the consumer the 

power to control their data. One small step forward is the concept 

of this lock for life. I would like to see the entire industry move in 

that direction. 

Senator BROWN. I am trying to read between the lines. Is that 

a yes or a no to the question of should consumers be allowed to request you delete their data from your system, their data that you 

gather without their knowledge? 

Mr. SMITH. I believe a better way to get at that is through this 

lock concept. 

Senator BROWN. So that means no? 

Mr. SMITH. Correct. 

9 

Senator BROWN. Even though we do it with medical data and 

even though—I mean, fundamentally, if you do not think consumers should be allowed to control their own data, the question 

is why should a company that has had so many security failures 

be allowed to control their data. That is the fundamental question 

that this company has not—apparently has not asked or certainly 

has not answered to the public. 

Thank you. 

Chairman CRAPO. Thank you. 

And I would note to the Senators that Senator Brown and I both 

stayed within our 5 minutes. I encourage all of you to follow that 

pattern. 

Senator SASSE. It was kind of impressive. 

Senator KENNEDY. It was kind of unusual. 

[Laughter.] 

Chairman CRAPO. Senator—— 

Senator SASSE. I think it is me. Yeah. 

Chairman CRAPO. ——Sasse. 

Senator SASSE. Thank you, Chairman. 

Mr. Smith, let us take a minute to talk about why we are here. 

Big picture, it is this. There is a really small group of credit bureaus in America, and by really small, I mean three. And if you are 

an American who buys a home or a car, you typically have to be 

cleared by one of those three, and even if you do not have a relationship with one of the three, if you are a consumer who did not 

choose this, so you think about the OPM hack, people were at least 

choosing to apply for a security clearance or to work for the Federal 

Government. We have people here who did not have any relationship with you and did not choose to engage with you. 

If you get a credit card from one of the countless offers that 

Americans get every day in their mailbox from department stores 

or gas stations or airlines, it is not uncommon for one of the three 

credit bureaus to then obtain your information. So what happens 

when something goes wrong? What happens when one of you big 

three is hacked? What happens if you are one of the 145 million 

Americans who, in this case, had their information stolen? What 

happens if 5 years from now an American has their identity information stolen? What happens when there is a reasonable suspicion 

that folks at your organization may have engaged in insider trading? 

There is a lot of anxiety that Americans feel, and they are Americans who do not have the benefit of powerful attorneys and lobbyists. And for them, this hearing is one of their only shots at getting 

a full account of what went wrong, who is to blame, and what is 

going to happen about it in the future. 

So I would like to discuss this question about those who were impacted by the breach and how long you think Equifax’s exposure 

or responsibility lasts. If you are an American, if you are one of 

those 145 million, you do not have the ability to change your name, 

your mother’s maiden name, your birth date, your Social Security 

number, and your organization has committed to providing identity 

monitoring services for the next year. 

But I am curious about whether or not Equifax and your board 

have deliberated. Do you think your responsibility ends in 1 year, 

10 

in 2 years, in 5 years, in 10 years? And if you think it ends at some 

point, have you tried to think about the goodwill and balance sheet 

impact of all this? How can you explain to an American whose 

identity might be stolen later, because of this breach, why your responsibility would ever end? Does it end? 

Mr. SMITH. I understand the question, and it ends—it extends 

well beyond a year, Senator. 

The first step we took was the five services we mentioned to the 

Chairman a minute ago, which gets the consumer through 1 year. 

The ultimate control for security for a consumer is going to the lifetime lock, the ability for a consumer to lock down his or her file 

to determine who they want to have access for life. 

Senator SASSE. But is not this—I would just interrupt. Is not this 

about people who might be breached in the future? 

I am talking about the 145 million whose data has already been 

stolen. Does your responsibility end, or what do you think your 

legal obligations are to them? 

Mr. SMITH. I think the combination of the five services we are 

offering combined with a lifetime lock is a good combination of 

services. 

Senator SASSE. I actually think the innovation of some of the 

stuff you have proposed for the big three going forward is quite interesting, but why does any of that five really do much for the data 

that has already been stolen? 

Mr. SMITH. Senator, again, the combination of the five offerings 

today plus the lifetime lock, we think is the best offering for the 

consumer. 

Senator SASSE. OK. I do not think you have really answered the 

question about whether your exposure legally ends for the 145 million. 

Do you know the number? Can you do the 145 million breakdown 

by State? Not off the top of your head, but do you have the data 

that we on the Committee could have by tomorrow? Just to—have 

you got it in your 145 million records? Can you parse it by State 

so each of us understands how many constituents we have—— 

Mr. SMITH. I believe so. 

Senator SASSE. ——who have been exposed? 

Mr. SMITH. We should have that capability. I am just hesitating 

on by tomorrow, but let me take that back to—— 

[Pause to confer.] 

Mr. SMITH. We do have it. 

Senator SASSE. OK. Great. Thank you. 

It is being reported in the media this morning that you have just 

received a no-bid contract from the IRS for fraud prevention. Can 

you explain to the American people, not just as consumers who 

have been exposed and breached here, but as taxpayers, why in the 

world should you get a no-bid contract right now? 

Mr. SMITH. I am not sure it was a no-bid. My understanding— 

I do not profess to have the details there, Senator—it is with the 

IRS. It is a contract we have had in the past. I think it is being 

renewed. 

Senator SASSE. OK. We are going to follow up with the IRS as 

well, but if you could clarify back with us, my team will follow up 

with you. 

11 

I have less than a minute left, but I want to open at least the 

allegations that Equifax executives engaged in insider trading relating to knowledge of this cyberbreach. One of the clearest times 

and definitions of insider trading occurs when a business executive 

trades their company’s stock because of confidential knowledge that 

they have gained from their job. 

I am sure you can imagine why Americans are very mad about 

the possibility that this occurred here. Well, insider trading is 

going to be discussed a lot more later in this hearing. I wish you 

could just very quickly give us a timeline of the first steps. When 

did Equifax first learn of the May 2017 breach, and when did you 

inform the FBI of that breach? 

Mr. SMITH. Thank you. I will answer as quickly as I can. 

We notified the FBI cybersecurity forensic team and an outside 

global law firm on August 2nd. At that time, all we saw was suspicious activity. We had no indication, as I said in my oral testimony, of a breach at that time. 

You might recall that the three individuals sold stock on August 

1st and 2nd. We did not have an indication of a breach until mid 

to late August. 

Senator SASSE. So you are saying that those three executives— 

Mr. Chairman, I will stop. You are saying those three executives 

had no knowledge of a breach on August 1st or 2nd? 

Mr. SMITH. To the best of my knowledge, they had no knowledge, 

and they also followed our protocol to have their stock sales cleared 

through the proper channels, which is our general counsel. 

Senator SASSE. We will have follow-ups on that, please. 

Thanks. 

Chairman CRAPO. Senator Tester. 

Senator TESTER. Thank you, Mr. Chairman, and I want to thank 

you for being here today, Mr. Smith. 

I apologize for not being here during your presentation. I had a 

business meeting on another committee, so I did not hear your 

timeline. So I will give you mine, and I will start with the first notification in March of this year by U.S.–CERT that you guys had 

a vulnerability. Did you do anything with that notification? 

Mr. SMITH. Yes, Senator, we did. We were notified on March 8th 

and on March 9th, following the traditional patch protocol. Communication was sent out. 

Senator TESTER. Communication was sent out. Did you do anything to fix the potential vulnerability? 

Mr. SMITH. There were two steps that I discussed in my oral testimony—— 

Senator TESTER. Yeah. Go ahead. 

Mr. SMITH. ——which I will walk through. One was there was 

a communication breakdown in the patching organization within 

IT. The message did not get to the right person down to the utilization of patch. 

Senator TESTER. So, ultimately, nothing happened? 

Mr. SMITH. Well, two things happened. 

Senator TESTER. You did the notification, but ultimately, in the 

end, there was nothing done with that notification to fix that vulnerability? 

12 

Mr. SMITH. Senator, yes. A scan was applied looking for the vulnerability. A technology scan was applied, did not find it, so the 

patch was not applied. Correct. 

Senator TESTER. OK. So let us fast forward to the 29th of July, 

and you learned for the first time that your company has been 

hacked, do not know how big the hack is, but it has been hacked, 

and it was preceded by this notification from U.S.–CERT. 

Three days after, as Senator Sasse pointed out, you had three high-level execs sell $2 million in stock. That very same day, you 

notified the FBI of the breach. Can you tell me if your general 

counsel was held accountable for allowing this stock sale to go forward, or did he not know about the breach? 

Mr. SMITH. Senator, a clarification. On the 29th and 30th, a security person saw suspicious activity, shut the portal down on the 

30th. There was no indication of a breach at that time. 

The internal forensics began on the 30th. On the 2nd, we 

brought in outside cyberexperts—forensic auditors, law firm, and 

the FBI. The trades took place on the 1st and the 2nd. At that 

time, the general counsel, who clears the stock sales, had no indication—or did the company—of a security breach. 

Senator TESTER. Well, I am going to tell you something, and this 

is just a fact. And it may have been done with the best of intentions and no intent for insider trading, but this really stinks. I 

mean, it really smells really bad, and I guess smelling bad is not 

a crime. 

But the bottom line here is that you had a hack that you found 

out about on the 29th. You did not know how severe it was. You 

told the FBI about the breach. On that same day, high-level execs 

sell $2 million worth of stock, and then you do some investigation, 

evidently, and you find out at the end of the month that—or at 

least by the first part of September that this is a huge hack, and 

you finally notify the public. And as was pointed out already in this 

Committee, these are people that did not ask for your service. You 

gathered it, and now it is totally breached. 

And then, as Senator Sasse said, ‘‘What is the length of exposure 

here?’’ and you said, ‘‘Well, we are doing these five things.’’ That 

is proactive, and I think we can all applaud those efforts. But I 

have got to tell you, that does not do a damn thing for the people 

who have been—had their identity stolen and their credit rating 

stolen. 

So let me ask you this. So their credit rate goes up a little bit, 

and they go buy a house for 250,000 bucks on a 30-year note, and 

it cost them 25 grand. Are you liable for that? 

Mr. SMITH. Senator, I understand your anger and your frustration. We apologize for the breach. We have done everything in our 

power to make it right for the consumer, and we think these services we are offering is a right first step. 

Senator TESTER. Well, I would just tell you this, and I think 

Equifax must have—must be or been a good a company at one 

point in time, but this length of time on a breach this big in this 

day and age when we have folks that are pretty damn good at this 

stuff, especially when the Department of Homeland Security 

through U.S.–CERT says you got a problem, and was not really 

dealt with in a way like it was really a problem—I mean, you can 

13 

say you sent out the directives, but in the end, 3, 4 months later, 

you end up with a very severe breach. 

The problem we have got here—and I will just tell you this—is 

that the impact and the numbers by State is important. I think it 

is about 600,000 adults, and I think it is about two-thirds of the 

adults in Montana, which is about probably 4 to 500,000 people, 

and in a State of a million, that is a lot, OK? 

And so, consequently, those people are going to be impacted negatively for a long, long time. Why? Because this happened, and you 

can say, ‘‘Jeez, I am sorry it happened,’’ but the notification for 6 

weeks in this 21st century we live in is absolutely unacceptable. 

And I will just tell you that. It is unbelievable. 

And I appreciate you coming in front of the Committee. 

Chairman CRAPO. Senator Scott. 

Senator SCOTT. Thank you, Mr. Chairman. 

Mr. Smith, thank you for being here this morning, and certainly, 

we all are a tad confused about the knowledge that you had and 

your execs had that seem to—at least their stock sales seem to suggest more information than we are getting here. 

So I just want to walk through the numbers as well as the 

timeline to better understand and appreciate what happened. You 

say that they did not know about the breach, but there was suspicious activity that was reported. Did you know about the suspicious activity on July the 29th? 

Mr. SMITH. No, sir, I did not. So—— 

Senator SCOTT. You were not notified about the suspicious activity? 

Mr. SMITH. I was but not on the 29th. So on the 29th, a—— 

Senator SCOTT. So the 31st, you were notified? 

Mr. SMITH. Yes, correct. 

Senator SCOTT. OK. So the very next day after you were notified, your senior executives, including your CFO, sold $1.8 million, nearly $2 million of stock, for a profit of—comparatively speaking to 

your September 7th devalued stock, for about $655,000. So at the 

price that the execs sold their stock for netted them, comparatively 

speaking, to the stock price that would have been on September 

7th had they sold it on September 7th—they netted $655,000 during the same window that the average person who learned about 

the breach lost $6.4 billion or 36 percent of the stock value. Is that 

accurate? 

Mr. SMITH. I have not done the math. I trust it is. 

Senator SCOTT. OK. So Equifax tells the public about the breach 

on September the 7th, which is 6 weeks later, and just walk 

through the math with me, then. The stock dropped to $92.98 a 

share, and it dropped from $146.26 per share, or a 36 percent loss. 

The executives who sold the 1.8—1.8 trillion—$1.8 million benefited about $655,000 if you average in that 36 percent difference. 

There are roughly 120 million outstanding shares of Equifax. 

That means that folks who have Equifax stock in their retirement 

accounts, the mom-and-pop businesses that are saving for the future for a large purchase and they decided to invest in Equifax, all 

those folks bore the burden of a $6.4 billion drop in valuation at 

the same time that the general counsel who did not know, the CEO 

who did not know, so all the folks in the executive suite had no 

14 

clue, but they were the luckiest investors on August the 1st to sell 

the stock at the best price to net $655,000. This was pure luck and 

nothing else. Question. Is it? Was it? 

Mr. SMITH. No, sir. A few thoughts. 

Senator SCOTT. Thank you. 

Mr. SMITH. Go back to the 29th and 30th. We have—we experience millions of suspicious potential attacks each year. It is not like 

the suspicious attack that occurred on the 29th and the 30th was 

the first of that year, of that month. Suspicious attacks occur all 

the time. That is number one. 

Number two—— 

Senator SCOTT. Let me ask you a question right there, sir. If you 

were to look back at the executives’ stock sales on the other millions of suspicious activity, was there ever a suspicious activity 

that led to, within a 48-hour window, sale of stock? 

Mr. SMITH. The window was open post the second quarter earnings call. It is only open for a short period of time, as you might 

guess. We encourage executives to sell the first part of that window’s opening. As you get into the opening, you know more and 

more about the quarter and the financial performance of the company, so you tend to discourage sales later on in that month. So 

the behavior you saw was normal behavior. That is point number 

one. 

Point number two is they did follow the protocol. They got the 

clearance. The general counsel approved the sale. The window was 

not closed by the general counsel until mid-August. 

The last point I will make, Senator, if I may. These are three 

men I have known for a long time, two of them for 11 to 12 years. 

One has been my CFO for 3, 31⁄2 years. These are honorable men 

who follow the protocol that was outlined by the organization. 

Senator SCOTT. Well, I will just close with this, Mr. Ranking 

Member. 

I believe in the rule of law for everyone. I believe that you are 

innocent until proven guilty, but I will say that what you guys 

want us to believe as a Committee, the U.S. Senate, the Congress, 

the investors in Equifax, and the entire Nation, what you all want 

us to believe is that the three luckiest investors who sold their 

stock did so without any knowledge that that suspicious activity 

may be bigger and more powerful than any other suspicious activity perhaps in the history of the company. I find that hard to believe. 

Senator BROWN [presiding]. Senator Warner. 

Senator WARNER. Thank you, Mr. Chairman. 

Mr. Smith, appreciate you being here, but we have seen a history 

of other companies, of Yahoo! announcing today their breach was 

actually 3 billion, not the billion they initially acknowledged. 

But for a company like yours, where American citizens have no 

right to opt in, we enter into no customer-based relationship with 

you, I think it raises a whole host of policy questions we cannot get 

into today, but I think this Committee needs to look at. I think we 

have to ask honest questions. Who owns this data? How do you get 

the right to this data that is our personal information, and yet your 

company’s practices of cyberhygiene are sloppy in the extreme? 

15 

The fact that there was known vulnerability, that you did not 

have appropriate internal controls in place to easily patch this is 

inexcusable. The fact that it took so long for the senior leadership 

to get its act together is inexcusable, and what I find, what I want 

to spend my time, because I could echo what my colleagues have 

said about how long it took and everything else, but then once the 

breach was known, the complete, sloppy, haphazard approach you 

took on remediation is again inexcusable. 

The fact that the site you put up, rather than you directed customers to go to, did not use your existing domain. You created a 

whole new domain site. In that domain site, there were known software glitches. You initially offered people what I believe was a 

bait-and-switch scam to say, ‘‘We are going to give you a year of 

free protection, but, oh, by the way, you are going to give up all 

of your legal rights by agreeing to some small-print arbitration 

agreement.’’ 

The fact that the site that you directed people to was so faulty 

and so sloppily put together, that even entities like the Architect 

for the Capitol would not allow users to access the site because 

they thought it was so vulnerable, the fact that you then also required individuals after their information had been hacked into, 

abused, potentially now vulnerable for who knows how long to 

enter in your last name and your last six digits of your Social Security number, what in heaven’s name were you all thinking? 

The fact that your official Twitter account mistakenly tweeted a 

phishing link four times instead of the company’s actual breach response page, I mean, even if I want to try to give you the benefit 

of the doubt of sloppy cyberhygiene and somebody made a mistake 

and you did not find until after the fact and there were mistakes 

made, when this was all known and you said that you created a 

company that was an information-based company, you had this 

level of sloppy cyber-response? What do you say to the 143 millionplus Americans who have had their private information violated, 

that even after the fact, your response was inadequate and on 

every level would not meet basic cyber-101-hygiene standards? 

Mr. SMITH. Senator, I understand your frustration and the anger 

of the American public. I apologize not only for the—— 

Senator WARNER. But, sir, I am not asking you to apologize. I am 

asking you to say how do we tell the American people. How should 

any American say again, ‘‘I have got no option of opting in whether 

you are going to get my personal credit information’’? Why should 

any of us have any faith that you are putting anything in place 

that is appropriate when the immediate actions you took after the 

knowledge of the hack too place was so sloppy and so inadequate 

in terms of your remediation site? 

Mr. SMITH. Again, Senator, the ramp-up was overwhelming for 

a company that is largely doing business with other companies, 

and we had to go from 500 call center people to almost 3,000 in 

2 weeks. We went to the Cloud Computing Amazon site for scale. 

We had, I think I mentioned in my oral testimony, over 400 million 

consumers come to a website. 

Senator WARNER. Sir, my time is up, but I would only say telling 

me how many more people you hired and scaled up, that is not 

what my question was. My question was, Why was your site so 

16 

technically flawed? Why did you send people to a new domain site 

that was not properly registered? Why was your Twitter account 

sending people to the wrong site? Why was this site so badly put 

together that institutions like the Architect of the Capitol would 

not even allow consumers to touch it because it was so faulty? For 

a company that claims to be an information-based company, even 

giving you the benefit of the doubt on everything that happened beforehand, your remediation efforts do not pass basic cyber-101-hygiene. 

Thank you, Mr. Chairman. 

Senator ROBERTS. Senator Perdue. 

Senator PERDUE. Thank you, Ranking Member. 

Thank you, Mr. Smith, for being here today. 

Mr. Smith, just for the record, are you the current CEO of 

Equifax today? 

Mr. SMITH. No, sir. I am retired. 

Senator PERDUE. And you resigned your position; is that correct? 

Mr. SMITH. Correct. 

Senator PERDUE. Would you tell the Committee why you did 

that? 

Mr. SMITH. Senator, I thought it was the best for the company 

to have a new leader come in and resurrect this great company. I 

have agreed, Senator, to work with the company for as long as 

needed. It has been a company I have loved working for, for 12 

years. The company has done a lot of great things around the 

world. I have agreed to assist in any way I can for free for as long 

as they need. 

Senator PERDUE. So, today, there are two issues before this Committee. I only have time in the few minutes here to get at one of 

these. The two issues are what happened, how did it happen, and 

what is going to be done to rectify that with the current individuals 

that were harmed by this. 

The second issue is a bigger issue, and that is this entire cybersecurity issue. When the now Chairman Jay Clayton of the SEC 

was before this Committee, we asked this same question. Under 

the antitrust laws, there are limitations for corporations like yours 

and the other guys in this business to talk to each other when you 

are threatened by cyberattacks; is that correct? 

Mr. SMITH. There are ways for us to talk to different entities 

when needed. The agency is an example. There is a network we belong to where we talk about issues and trends in cybersecurity. We 

take advantage of that. 

Senator PERDUE. So in this situation, were you able to talk to 

your two biggest competitors when you were warned earlier in 

March and then when you discovered it in July? 

Mr. SMITH. No, Senator. 

Senator PERDUE. So why were you not able to talk to them and 

warn them of similar activity? 

Mr. SMITH. I am not sure it was that we were not able to, but 

we did not know enough at that time either to talk to them. 

Senator PERDUE. So later when you did know enough internally, 

were you limited by antitrust law or considerations, or were you 

able to fully talk to these other two competitors? 

Mr. SMITH. That, I am not aware of. 

17 

Senator PERDUE. OK. We think there is a problem in that the 

Secretary—I mean the SEC Chairman is aware of that. Actually, 

Senator Cardin and Senator Blunt are working on a data security 

act that would provide a national standard and make it clear—because if you look at the current law, it is not clear—on these 

cyberbreach notifications for people within an industry and also between the companies and different agencies in the Federal Government. 

A national standard like this, would that be helpful for your 

predecessor or your successors and other people in this industry? 

Mr. SMITH. I believe so. 

Chairman CRAPO. Let us talk about credit report freezes. It 

seems to me that in the day of the app, when my 6-year-old grandson knows how to get on and get unlimited access to apps, that a 

person who has data stored in one of these credit companies could 

go on an app that—and they are online right now, how to manage 

your credit scores and so forth. Intuit has got them. They are all 

out there. What keeps you from giving the ability to freeze an account? 

Today, as I understand it, if you want to freeze your account, you 

have to go to your firm and each of the two biggest competitors and 

possibly others, pay a fee, get a PIN, remember the PIN, and then 

freeze it for—it is your determination, but to unfreeze it, you have 

to go back and activate the entire process again. That seems most 

Americans are not going to be able to do that. 

So what keeps the industry from actually moving toward a simple app that some individual can be informed about to preclude 

this sort of exposure? 

Mr. SMITH. Senator, that is a great question. That is where we 

are heading. That is the July—or the January 31st product or service that we are offering, which is—will be an application on a 

smartphone, on a PC. It allows you to freeze or lock and unlock instantly at the time you want. 

I would encourage our two other competitors in the industry, 

Senator, to come together as an industry and offer that service to 

all consumers on one site. The things you could do if you had the 

consumers, the power at their fingertips, to lock and unlock anytime they want that for all three credit reporting agencies would 

be powerful. It would be a paradigm shift for the consumer. 

Senator PERDUE. What would you tell your successor in terms of 

the number one—in most businesses, the number one entity they 

worry about is their customer. The individuals we are talking 

about, they really were not customers of Equifax. What advice 

would you give—and we have just got a few seconds left—what advice would you give your success to rectify this situation? 

Mr. SMITH. Senator, we are a 118-year-old company. We have always prided ourselves as being a trusted steward of data. The 

number one thing we have got to do now as a company is regain 

the trust of the consumer in America. 

Senator PERDUE. How do you do that? 

Mr. SMITH. By doing what is right for the consumer. We are 

starting by doing, offering these five services, offering the lifetime 

lock. It takes time. When you have the size of criminal attack that 

we allowed to occur, it takes time to regain that trust. 

18 

Senator PERDUE. Thank you for being here. 

Mr. SMITH. Thank you. 

Senator PERDUE. Thank you, Mr. Ranking Member. 

Senator ROBERTS. Senator Warren. 

Senator WARREN. Thank you, Mr. Chairman. 

Now, Mr. Smith, Equifax has been hacked several times in the 

past few years. It is consistently rated as having some of the worst 

data security practices in the financial services industry, and this 

latest hack happened through a hole in your system that had been 

identified months before and could have been fixed pretty easily. 

The whole thing is staggering. A company like Equifax that has 

sensitive personal information on most Americans should have the 

best data security in the industry, and instead, it has the worst. 

And I want to understand why. 

So I started to look into this, and one thing jumped out at me. 

In August, just a couple of weeks before you disclosed this massive 

hack, you said—and I want to quote you here—‘‘Fraud is a huge 

opportunity for us. It is a massive growing business for us.’’ 

Now, Mr. Smith, now that information for about 145 million 

Americans has been stolen, is fraud more likely now than before 

that hack? 

Mr. SMITH. Yes, Senator, it is. 

Senator WARREN. Yeah. So the breach of your system has actually created more business opportunities for you. 

For example, millions of people have signed up for the credit 

monitoring service that you announced after the breach. Equifax is 

offering 1 year of free credit monitoring, but consumers who want 

to continue that protection after the first year will have to pay for 

it, will not they, Mr. Smith? 

Mr. SMITH. Senator, the best thing a consumer could do is get 

the lifetime lock. 

Senator WARREN. I am asking you the question. You are offering 

free credit monitoring, which you say is worth something, and you 

are offering it for only 1 year. If consumers want it for more than 

1 year, they have to pay for it; is that right? 

Mr. SMITH. Yes, Senator, but the most—the best thing a consumer can do is the lock product. That is better than monitoring. 

Senator WARREN. OK. But they are going to have to pay after 1 

year if they want your credit monitoring, and that could be a lot 

of money. So far, 7.5 million people have signed up for free credit 

monitoring through Equifax since the breach. If just 1 million of 

them buy just one more year of monitoring through Equifax at the 

standard rate of $17 a month, that is more than $200 million in 

revenue for Equifax because of this breach. 

But there is more. LifeLock, another company that sells credit 

monitoring, has now seen a tenfold increase in enrollment since 

Equifax announced the breach. According to filings with the SEC, 

LifeLock purchases credit monitoring services from Equifax, and 

that means someone buys credit monitoring through LifeLock. 

LifeLock turns around and passes some of that revenue directly 

along to Equifax. Is that right, Mr. Smith? 

Mr. SMITH. That is correct. 

Senator WARREN. That is correct. 

19 

OK. So from the second Equifax announced this massive data 

breach, Equifax has been making money off consumers who purchased their credit monitoring through LifeLock. 

Now, Equifax also sells products to businesses and Government 

agencies to help them stop fraud by potential identity thieves. Is 

that right, Mr. Smith? 

Mr. SMITH. Yes, Senator. There is one clarification. You had 

mentioned the LifeLock relationship—— 

Senator WARREN. Uh-huh. 

Mr. SMITH. ——which was accurate. At the same time, the majority of that revenue we normally generate is direct to consumer. 

We have shut that down. We are no longer selling a consumer 

product directly. 

Senator WARREN. I am sorry. My question is every time somebody buys through LifeLock—and they have seen a tenfold increase 

since the breach—you make a little more money. We actually called 

the LifeLock people to find this out. So I asked you the question, 

but I already know the answer. It is true. You are making money 

off this. 

So let me go to the third one. Equifax sells products to businesses and Government agencies to help them stop fraud by potential identity thieves, right? 

Mr. SMITH. To the Government, yes, not to the business. 

Senator WARREN. You do not sell the businesses, to small businesses? 

Mr. SMITH. We sell to business, but it is not to prevent fraud. 

That is not the primary focus or business—— 

Senator WARREN. But to stop identity theft, you do not have any 

products that you are touting for identity theft purposes? 

Mr. SMITH. Senator, all I am saying is the vast majority of what 

we do for businesses is not fraud. 

Senator WARREN. Look, you have got three different ways that 

Equifax is making money, millions of dollars, off its own screw-up, 

and meanwhile, the potential costs to Equifax are shockingly low. 

Consumers can sue, but it turns out that the average recovery for 

data breaches is less than $2 per consumer, and Equifax has insurance that could cover some big chunk of any potential payment to 

consumers. 

So I want to look at the big picture here. From 2013 until today, 

Equifax has disclosed at least four separate hacks in which it compromised sensitive personal data. In those 4 years, has Equifax’s 

profit gone up? Mr. Smith. 

Mr. SMITH. Yes, Senator. 

Senator WARREN. Yes, it has gone up, right? In fact, it has gone 

up by more than 80 percent over that time. 

You know, here is how I see this, Mr. Chairman. Equifax did a 

terrible job of protecting our data because they did not have a reason to care to protect our data. The incentives in this industry are 

completely out of whack. Because of this breach, consumers will 

spend the rest of their lives worrying about identity theft. Small 

banks and credit unions will have to pay to issue new credit cards. 

Businesses will lose money to thieves, but Equifax will be just fine. 

Heck, it could actually come out ahead. 

20 

Consumers are trapped. There is no competition, nowhere else 

for them to go. If we think Equifax does a lousy job protecting our 

data, we cannot take our data to someone else. Equifax and this 

whole industry should be completely transformed. Consumers—not 

you—consumers should decide who gets access to their own data. 

And when companies like Equifax mess up, senior executives like 

you should be held personally accountable, and the company should 

pay mandatory and severe financial penalties for every consumer 

record that is stolen. 

Mr. Chairman, we have got to change this industry before more 

people are injured. 

Thank you. 

Chairman CRAPO [presiding]. Senator Tillis. 

Senator TILLIS. Thank you, Mr. Chair. 

Mr. Smith, thank you for being here. 

I have one question that I want to get to. First, can you explain 

to me why you believe as a strategy the lock versus the delete option is in the best interest of the consumer? 

Mr. SMITH. Yes. Senator, we, I think, provide a very valuable 

service to the consumer, allowing he or she to get access to credit 

when they want access to credit. If they are not in the system, they 

hinder their ability to get credit. 

Senator TILLIS. How do you think that would—let us say that 

you had a delete option, so there was not a transactional opportunity for a consumer to have that information available to people 

who are maybe underwriting a loan. Let us say that if you took 

that to the logical conclusion and had all three of the information 

providers delete your financial record, how do you think that would 

affect somebody who is trying to apply for a mortgage or a loan or 

a credit card? 

Mr. SMITH. We know what would happen. If you are not in the 

credit ecosystem, you do not get a loan. 

Senator TILLIS. Do you think that is maybe even particularly 

more pronounced, given some of the changes that we have with financial regulations and underwriting practices and scrutiny from 

the Federal Government? 

Mr. SMITH. I do. 

Senator TILLIS. Look, the point that I am trying to make here is 

you all have a problem. I associate myself with a lot of the concerns. 

One thing I would ask you to do, you said the three individuals 

in question for a stock disposition are honorable people, that you 

have known them for several years. They have been employed by 

Equifax for several years. I think it would be very helpful to see 

what their pattern of stock dispositions have been over the years 

to see the process they have gone through, because I think that 

that would be helpful for this Committee. I think there is an appearance issue there that you all should—or that Equifax and the 

individuals should step up and address. 

Look, here is the other thing that we could be missing here. You 

all made a big mistake. You sound like you have got some remediation practices in place. I think you do have to get right on the 

long-term obligation you may have. There is a difference between 

a breach and exploitation. 

21 

At least the other day, when I asked about any evidence of exploitation of the data breach, we have not seen any yet, but it 

seems to me, you have got to create some sort of a footprint on the 

data that was exploited so that over time, you could make a reasonable decision about whose problem it is to remediate any exploitation beyond the year pathway. 

Another thing—I mentioned it yesterday with Wells Fargo—that 

I think is very important, the problem that resulted for maybe controls and processes at Equifax should be your problem, not the consumer’s problem. In other words, you need to make it very easy 

and no cost to the consumer to fix a problem that they became a 

part of, and rather than you get into the details in this Committee, 

it would be helpful for me to get some assurances that that is the 

case. 

I use an example of an inappropriate parking ticket that I got 

using a park mobile app in Charlotte. When I called the folks up 

and said, ‘‘I got a receipt right here,’’ they said, ‘‘Well, you can go 

through 2 or 3 weeks. You can appeal. You can file it, and we are 

sure that it was because maybe your license tag got mixed up.’’ I 

said, ‘‘My license tag at the time was a 3.’’ So I think they should 

have been able to figure it out, but they were trying to make their 

problem my problem. And you need to be absolutely certain—or 

Equifax and the people that are taking the helm need to be absolutely certain that they can convince us that you are addressing 

this and not making your problem the consumer’s problem. 

I do think it is very important for people to understand the potential chilling effect that you could have if you erase your financial history from the system. We expect you all to protect it, and 

we expect you all to be good stewards of it. In this case, a variety 

of factors led to that not being the case, but we have to get there. 

I had another—just a comment to make. You are an aggregator 

of data. What this Committee and every committee that is taking 

a look at for cybersecurity needs to understand, the broad exposure 

that we have in this country. You are an aggregator of data. Again, 

I would think that your systems should be more impervious to attacks than mom-and-pop shops and other people who are 

aggregators of data based on their purchasing platforms and their 

supply chains. 

Congress needs to start thinking big picture here and how we 

can get the U.S. economy to a point to where when you become difficult or more difficult to penetrate, then I just go to the sources. 

And then I can pick it off and maybe actually do it in organizations 

that are far less sophisticated than you. 

If people think that the credit reporting agencies and the big 

banks are the only ones that are vulnerable, I would suggest that 

you go get a book that I have got on my desk right now in my office. It is called ‘‘Hacking for Dummies’’. It is a very important book 

for you all to understand, for the industry to understand, and for 

Congress to understand. 

You need to be held accountable. Equifax needs to be held accountable. We need to be held accountable for actually getting beyond the shiny objects of this breach, which are really important, 

and you need to protect the consumers and recognize we have a 

role to play to protect this economy, otherwise this is not going to 

22 

end. It will be the CEO of the week and the breach of the week, 

and that is not the way that we should be leading from Capitol 

Hill. 

Thank you for being here, and we will potentially submit some 

other questions for the record. But I think it is in your best interest 

or those who are working with Equifax to give us more information 

on the stock disposition patterns for the executives in question. 

Thank you very much. 

Mr. SMITH. Thank you. I understand, Senator. 

Chairman CRAPO. Senator Heitkamp. 

Senator HEITKAMP. Thank you, Mr. Chairman. 

North Dakota is a State of about 740,000 people. Our Attorney 

General estimates that 248,000 North Dakota families have been 

affected by this, and let me tell you, I have heard from a lot of 

them. And I want to just tell you that I am deeply concerned about 

the remedial efforts and how all of that rolled out to begin with. 

First off, if you have this level of information on consumers that 

they did not give you—that is all part of this thing that Elizabeth 

was talking about—and you do not have a system in place for a fire 

drill on what you do if you are breached, after you told us that you 

get notifications all the time of potential breaches—and then you 

say, ‘‘Oh, we had to create all of this system. We had to create this 

thing out of whole cloth,’’ right? That is what you have told us— 

why the roll-out after the breach was notified, why it went so poorly, and why people were not protected, and why in many cases, it 

was like, ‘‘OK. We are going to charge you a fee if you do this. We 

are going to do this,’’ my consumers are like, ‘‘Why do I have to 

now spend money to protect myself when it is their fault?’’ 

And so I think it is not enough for you to say, ‘‘My goodness, look 

at the magnitude of this,’’ when you should have anticipated it, the 

same way you should anticipate whether you have a fire in a building. You should be ready when it happens, and it goes to what Senator Tillis just said. We all know it is going to happen again, and 

I am saying this because I want all CEOs who have access to this 

kind of information to know I am going to ask a question on what 

they are doing to prepare, to prepare for a breach. 

Now I want to get back to the FBI. You said, ‘‘Look, we get a 

lot of these breaches. You know, this happens all the time. We did 

not realize it was as serious as what it was.’’ What is the date you 

notified the FBI, and who made that notification? 

Mr. SMITH. Senator, the date was August 2nd. The head of security at that time would have notified the FBI, the cybersecurity forensic team, and King & Spalding. 

Senator HEITKAMP. And when would the head of security have 

notified your chief legal counsel or chief legal officer? 

Mr. SMITH. On and around that same time. 

Senator HEITKAMP. Yeah. And when did he approve the stock 

trades? 

Mr. SMITH. Senator, he approved the stock trades on the 1st and 

the 2nd for the three individuals. At that time, as I alluded to earlier, it was a suspicious activity. There was no indication of a 

breach at that time. 

Senator HEITKAMP. How many times do you notify the FBI? You 

do that every day, every week? 

23 

Mr. SMITH. I do not have that specific data, but it is not unusual. 

I mentioned earlier that we have millions—— 

Senator HEITKAMP. I get that. I want to know how many times 

when you are notified, you actually turned around and notified the 

FBI. 

Mr. SMITH. We can get that information. I do not have that. 

Senator HEITKAMP. Yeah. Well, that is a problem because it looks 

pretty suspicious, and your chief legal officer has some explaining 

to do because even after he knew that there was a notification to 

the FBI about this level of breach, he did not clawback or try to 

undo those transactions and reverse what clearly appears to be a 

pretty beneficial situation for three of your employees. 

I want to talk about remedial measures and go back to consumers. Obviously, we are in this very big discussion about what 

we are going to do with mandatory forced arbitration. 

You know, it is interesting because if I go out there and sign a 

contract with somebody, maybe I can protect myself. Maybe I cannot. I do not think that fine print in a contract is exactly anything 

other than illusory, but we can argue that point. But why should 

you ever make that choice and mandate forced arbitration in your 

business? 

Mr. SMITH. Senator, a point of clarification—and this is part of 

our—my apology earlier—the intent was never to have arbitration 

clause in the product that—the services offered to the consumer at 

that time. It was a part of a boilerplate. It was a part of a product 

we were offering to consumers prior to the breach. It was a mistake 

we made. 

Senator HEITKAMP. But let us just ignore for a minute the 

breach. Why should the consumer not be able to make that choice, 

especially in this situation when the consumer is not your community? 

Mr. SMITH. Again, to be clear, that was not the intent for the 

breach. Arbitration clause is a legally, viable path for us to take 

at this time. That is why it was in the consumer offering. 

Senator HEITKAMP. Yeah. Well, I think we have got some real 

challenges in taking a look at how we provide a real remedy to consumers in this situation, and this will not be the first time that we 

have a hearing like this. We had one yesterday; we are having one 

today. 

But I guess my warning, Mr. Chairman, would be I am going to 

ask every person out there who has responsibility as a CEO for 

consumer data to do the right thing, and that is right now start 

thinking about if this happens to me, how do I treat my consumers 

and the people who have lost their personal data. And maybe we 

ought to start thinking about opting in as opposed to opting out. 

And so I want my credit locked until I do not—until I unlock it. 

Why cannot I have that option? Why do I have to pay to have my 

credit locked? 

Mr. SMITH. Senator, you do not. It is free. It is part of the offering we just made. 

Senator HEITKAMP. For the breach, yeah. 

Mr. SMITH. For lifetime. 

Chairman CRAPO. Senator Schatz. 

Senator SCHATZ. Thank you, Mr. Chairman. 

24 

You are retired as of last week. You leave with your base salary, unvested options, and a pension, roughly valued at $90 million. 

Help me to understand why that is fair. 

Mr. SMITH. Those numbers do not resonate with me, Senator. 

Senator SCHATZ. Well, what is the number, then? You should 

know. 

Mr. SMITH. Clarification. I stepped down last week. I told the 

board at the time I stepped down, I will not take a bonus. There 

is on severance. I will work for as long as the company needs for 

free. I have asked for nothing. What I walk away with is a pension 

that I have earned over my career and unvested equity that was 

given to me and I earned in the past. 

Senator SCHATZ. Is it fair to say that is in the tens of millions 

of dollars? 

Mr. SMITH. It is in the proxy. The proxy discloses the value of 

the—— 

Senator SCHATZ. Right. And that is how we got to $90 million, 

but if it is $45 million or it is $23 million or it is $38 million, my 

question stands. How is that fair? 

Mr. SMITH. The pension, Senator, is something I have earned for 

my career, and the other piece is the earned equity I have already 

been given. 

Senator SCHATZ. Do you think that is fair? 

Mr. SMITH. Senator, I grew up as a young guy in Midwest. I 

never envisioned having a career like I have had for the last 36 

years. I have been fortunate. I have worked hard, and I do not set 

those compensation levels. The board does, and the board is elected 

every year. 

Senator SCHATZ. Your investor presentation from August 16th, 

2017, mentions nothing about the data breach, even though by July 

29th, you knew that your system had been compromised. By August 2nd, you had retained outside counsel and informed the FBI. 

I understand that you periodically inform the FBI. I assume you 

do not necessarily consistently retain outside counsel. I assume at 

some point around August 2nd, you knew that something more significant than usual was up; is that true? 

Mr. SMITH. No, that is not true, Senator. 

It was not until later in August that we had some indication, the 

size, the scope, and the complexity of the breach. It was not on August 2nd. 

Senator SCHATZ. So August 16th, your message to investors was, 

quote, ‘‘Enduring business fundamentals support long-term 

growth,’’ and the first time data security is mentioned is at the end 

of your materials where you tout your role as a trusted steward of 

consumers’ data. Do you think that Equifax should have disclosed 

the possibility of a major data breach to its investors? 

Mr. SMITH. Senator, we talk to investors routinely. We disclose 

in our 10-K and Q’s that one of the greatest risks we pose each and 

every day and fight every day is cybersecurity. 

Senator SCHATZ. Right. But you retained outside counsel. You informed the FBI. People are liquidating their stock, and I guess I 

am wondering whether that pattern seems to indicate that somebody knew something pretty significant was up. But somebody 

made a judgment to not disclose that, not just to 143 million AmerVerDate Nov 24 2008 16:00 Feb 12, 2018 Jkt 046629 PO 00000 Frm 00028 Fmt 6633 Sfmt 6633 L:\HEARINGS 2017\10-04 ZDISTILL\100417.TXT JASON
25 

icans but also investors. It seems to me that that is material. It 

seems to me that that is reportable, and whether or not you follow 

the letter of the law, it seems to me that investors ought to know 

if something is going to impact the company. And you had to have 

some clue that this was percolating in a negative way. 

Mr. SMITH. Senator, we are very transparent with our investors 

that security is always a risk. They are very well aware of that. 

They price that into their value of the company. 

Obviously, on the 16th, I think, is what you refer to, the investor 

relations team had a presentation, on or around the 16th. We had 

not gone public with anything. We did not know the scope or the 

size of a breach, so obviously, we could not disclose that at the investor meeting. 

Senator SCHATZ. Right. So you did not know the total scope and 

size of the breach. I get that. So you decided not to disclose it at 

all? 

Mr. SMITH. To the investors? 

Senator SCHATZ. Yes. 

Mr. SMITH. Yes. Because at that time, we were even uncertain 

if there was a breach at that time, and you could not go to an investor base and tell an investor base something before we had gone 

public with something. 

Senator SCHATZ. And why would not you inform the public about 

it? 

Mr. SMITH. Sir, the timeline, as I walk through, from the 28th, 

29th, and 30th of July through September 7th lays that out, and 

it was not until late August we actually had an indication of the 

breach. 

Senator SCHATZ. So what happened on July 29th? 

Mr. SMITH. July 29th is when a security individual saw suspicious activity, on the 30th saw it again, shut down the portal to 

stop the incident. 

Senator SCHATZ. And then it took you 6 weeks to figure it all 

out? 

Mr. SMITH. Yes. Again, we bring in the cybersecurity experts who 

do this for a living, and the complexity, the size, the movement—— 

Senator SCHATZ. You do not do it very well for a living, except 

to the extent that you make massive profits off of making mistakes. 

I understand you do this for a living, but to the extent that none 

of us have the volition to enter into a contract with you, you are 

not doing it well for a living, except that you are all making a very 

nice living at it. 

Thank you, Mr. Chairman. 

Senator BROWN [presiding]. Thank you, Senator Schatz. 

Before calling Senator Kennedy, I want to do a clarification. Senator Sasse asked about if you had State-by-State information. You 

seemed unsure. Your team informed you in real time that, in fact, 

you did have that. 

Chairman Crapo and I had sent a letter September 22nd requesting that State-level data on victims, so it appears that your 

team has this information. Why was it not provided to us in response to our September 22nd letter to the Chairman and me, the 

State-by-State data? 

[Pause to confer.] 

26 

Mr. SMITH. I was just informed by Senator Chambliss that it was 

given to each of the State AGs earlier. There are, as you saw, a 

released by the company—I believe it was Monday—of another 2.5 

million consumers impacted. That has not yet been distributed to 

the AGs. I am told the AGs, State AGs have that record. 

Senator BROWN. OK. We are not the State AGs, and the Chairman of the Banking Committee and the Ranking Member cosigned 

a letter. We do a lot of things bipartisanly in this Committee, and 

that letter was sent—it looks like 2 full weeks ago, and it was not 

provided, so I hope that you will get that to us quickly. And that 

is not the way that you should operate. 

Senator Kennedy. 

Senator KENNEDY. Thank you, Mr. Chairman. 

Thank you for being here. I am over here, Mr. Smith. 

I found out about Equifax’s contract with the Internal Revenue 

Service in an interview this morning with Stuart Varney. How big 

is that contract? 

Mr. SMITH. Senator, I saw it this morning as well. Maybe it was 

last night, and it referenced a $7.5 million contract. I am not sure 

if that is multiyear. 

Senator KENNEDY. Do you have other contracts with the Internal 

Revenue Service? 

Mr. SMITH. We may, sir, but I am not aware of it. 

Senator KENNEDY. Could you get me a list of all of Equifax’s contracts with various Governments? 

Mr. SMITH. Yes, Senator, we can do that. 

Senator KENNEDY. The contract, the 7-million-and-change contract, does that involve taxpayer information that you would have 

access to? 

Mr. SMITH. Senator, it is my understanding—I am not professed 

to be deep in this particular contract—it is to prevent fraudulent 

access to the IRS, but beyond that, I—if you want more information, we can get that for you. 

Senator KENNEDY. Well, you realize to many Americans right 

now, that looks like we are giving Lindsay Lohan the keys to the 

mini bar. 

Mr. SMITH. I understand your point. 

Senator KENNEDY. Let me ask you about a credit freeze. I went 

through that. I have frozen my credit at all four of the bureaus. I 

would like a commitment from you today that you are going to ask 

your former company, though I think you still own quite a few 

shares—I want you to make a commitment to putting a free app 

available to anybody so that you can just go to your app, toggle on 

and off, access to your credit files. 

Mr. SMITH. Senator, I agree with you. We like that idea. That is 

going to go live for every American consumer the end of January 

2018. That will be free for life. 

Senator KENNEDY. So you are committing to do it? 

Mr. SMITH. Yes. Senator, we have been working on that for 

months. 

Senator KENNEDY. OK. This whole unfortunate experience, Mr. 

Smith, has raised larger issues, and one of the issues that it has 

raised is to whom does your former company—I will call it your 

27 

current company because you are still working there. To whom 

does your company have an obligation? 

My understanding of your business model is that you collect my 

information without my permission. You get the information. You 

take it along with everyone else’s information, and you sell that information to businesses. Is that basically correct? 

Mr. SMITH. That is largely correct. 

Senator KENNEDY. And you also have a premium service to monitor the information that you collect about me. So if there is some 

bad information that you collect about me, you sell me a service to 

monitor it and correct it; is that right? 

Mr. SMITH. Senator, just a clarification. Roughly 90 percent of everything we do is helping banks and others make informed decisions about lending money to consumers. The monitoring you are 

referring to, to consumers, is a very small piece of what we do. 

Senator KENNEDY. But it just seems incongruent to me that you 

have my information. You do not pay me for it. You do not have 

my permission. You make money collecting that information, selling it to businesses, and I think you do a service there. Do not misunderstand me. 

And you also come to me—you cannot run your business without 

me. My data is the product that you sell, and you also offer me a 

premium service to make sure that the data you are collecting 

about me is accurate. I mean, I do not pay extra in a restaurant 

to prevent the waiter from spitting in my food. You understand my 

concern? 

Mr. SMITH. I understand your point, I believe, but another way 

to think about that is the monitoring part that you are referring 

to, Senator, in the future is far less required if you as a consumer 

have the ability to freeze or lock, as we call it, and unlock your file. 

And that is free for life. 

Senator KENNEDY. But it is not just the freeze part. What if you 

have bad information about me? Have you ever—has an agency 

ever had bad information about you, and you had to go through the 

process of correcting it? 

Mr. SMITH. Yes, Senator. There is a process that if—— 

Senator KENNEDY. It is a pain in the elbow, isn’t it? I mean, the 

burden is kind of on—you have my data, which you have not paid 

me for. You are earning a good living, which I do not deny you. I 

believe in free enterprise. I think this is a very clever business 

model you have come up with, but you are earning your money by 

selling my data, which you get from me and do not pay me for, to 

other people. But if the data is wrong that you have about me, I 

would think you would want to make it as easy as possible to correct it, not as hard as possible. 

Mr. SMITH. I understand your point, and it is an important point 

for the entire industry to make the process as consumer-friendly as 

possible. If there is an error on your utility bill, if there is an error 

on your bank bill, your credit card statement, to work with consumers and make that—— 

Senator KENNEDY. Well, can you commit to me today that 

Equifax is going to set up a system where a consumer who believes 

that Equifax has bad information about him can pick up the phone 

and call a live human being with a beating heart and say, ‘‘Here 

28 

is this information you have about me that you are selling to other 

people. You are ruining my credit, and it is not true. And I want 

to get it corrected. How are you going to correct it? What information do you need from me to prove that it is incorrect, and when 

are you going to get back to me? And give me your name and 

phone number so I can call you’’? 

Mr. SMITH. Senator, I understand your point. There is a process 

that exists today. I would be more than happy—— 

Senator KENNEDY. Yeah. And it is difficult, Mr. Smith. 

Mr. SMITH. I would be more than happy to get the company to 

reach out to your staff, explain what we do and what we are doing 

to improve that process. I hear you. 

Senator BROWN. OK. I thank you, Senator Kennedy. 

Senator KENNEDY. I am sorry. I went way over. I apologize. 

Senator BROWN. That is all right. 

Senator DONNELLY. Thank you, Mr. Chairman. 

Mr. Smith, on September 19th, myself, Senator Heller, Senator 

Tester, Senator Menendez sent you a letter, and the letter we sent 

expressed concerns about the impact on the roughly 1.3 million active duty U.S. military personnel, especially the nearly 200,000 currently stationed overseas who may lack the access and resources 

required to place a credit freeze on their files or take other necessary measures to adequate protect their personal information. 

We requested you immediately detail the specific actions Equifax 

will take to ensure our servicemembers are not victimized any further by thieves with access to personal information, such as Social 

Security numbers, dates of birth, and home addresses. 

In response, I received a generic letter from Equifax that never 

even mentioned servicemembers, that basically said thank you for 

your interest. 

In your written testimony today, you also make no mention of 

our servicemembers or the military. So I will again ask a question 

that should have been answered: What specific actions will Equifax 

take to ensure our servicemembers are not victimized any further? 

Mr. SMITH. Senator, let me apologize if we did not get back to 

you. That was—someone dropped the ball, and I will look into that 

quickly for you. 

The servicemembers around the world have the same ability, if 

they have access to the Internet, to freeze, lock, get access to products. If not, they have the ability to have a power of attorney in 

the U.S. to act on their behalf. 

Senator DONNELLY. Well, let me ask you about some of our 

young men and women who are at forward operating bases in Iraq 

or in Afghanistan, who may be somewhat other occupied—— 

Mr. SMITH. Yeah. 

Senator DONNELLY. ——than having the chance to get on the 

computer and get their lock going on. So let me ask again and say 

for those members who are serving in remote or high-conflict areas, 

what is it that you can do to make sure that their identities and 

financial information are safe? 

Mr. SMITH. Again, they have the ability to have a power of attorney, and that power of attorney can act on their behalf. 

29 

Senator DONNELLY. You know, that is pretty weak tea for someone who is in a location where they may be occupied keeping our 

country safe and having their hands full with others. 

Mr. SMITH. Senator, let me take that on. I will get back with the 

company and see if there is anything else we can do specifically for 

those overseas. 

Senator DONNELLY. Let me ask you another question. Due to the 

cyberattack, roughly 145 million Americans have had their information compromised, and Equifax has said you now offer free credit freeze. But there is also Experian and TransUnion, and what I 

want to know is, Will Equifax also offer free credit freezes at 

Experian and TransUnion to ensure consumers are protected from 

theft and fraud? 

Mr. SMITH. Senator, the lock that we offer for free for life is a 

product that I believe the entire industry should rally around. It 

is my understanding that TransUnion, one of the two other credit 

reporting agencies, also offers a lock product for free. It is my understanding it is not for life at this time, but they offer it for free. 

Senator DONNELLY. Well, this breach was caused by Equifax. 

What will Equifax do to ensure that there are free credit freezes 

for those 145 million Americans at Experian and TransUnion as 

well? I do not want to see folks have to rally around this or rally 

around that or try to figure out how to navigate the Internet to get 

it done for themselves. What will you do for those 145 million 

Americans, our friends and neighbors, millions in my State, that 

will provide a free credit freeze at Experian and TransUnion? 

Mr. SMITH. Again, Senator, the things we have done is the five 

services we offered for 1 year combined with a lock for life—and I 

would invite TransUnion and Experian to follow suit—— 

Senator DONNELLY. But those services you just described do not 

include a free credit freeze at Experian and TransUnion. 

Mr. SMITH. That is correct. 

Senator DONNELLY. So, in other words, Equifax will not do anything to provide that? 

Mr. SMITH. Again, we are offering our five services plus lock of 

life. 

Senator DONNELLY. Well, I guess that answers the question that 

I was asking, which then leads to my next question which is, What 

is Equifax’s obligation to consumers who fall victim to identity 

theft or financial fraud in the future due to this breach? The damage caused to their credit, the money they may lose, how does 

Equifax plan to address the financial harm that can come to our 

families? 

Mr. SMITH. Senator, the design, the thought was offer these five 

services, allow someone to lock their file for life to minimize the 

downstream harm. 

Senator DONNELLY. But what happens if someone is harmed? 

Mr. SMITH. Senator, that is the extent of our offering. 

Senator DONNELLY. So because of your failure to stop this breach 

and a family is damaged financially, there will be no compensation 

provided? 

Mr. SMITH. Again, Senator, the five services we are offering are 

for free. The lifetime lock is for free. 

30 

Senator DONNELLY. Which does not touch at all upon the question I just asked. 

Thank you, Mr. Chairman. 

Chairman CRAPO [presiding]. Senator Rounds. 

Senator ROUNDS. Thank you, Mr. Chairman. 

Mr. Smith, I would like to go back into a little bit different question for a little while. I would suspect that there are probably thousands of CEOs and board chairmen for publicly traded companies 

as well as some large private companies that when they heard 

about the theft of data that was in your care, custody, and control, 

that they looked back at their own operations and said, ‘‘Can that 

happen to us?’’ And I would suspect that there were a number of 

chief information officers out there who were being called into the 

front offices to explain and to reassure that they did not have the 

same vulnerabilities that were found within your operation. 

I also suspect that since you have got experience in working in 

multiple major organizations that you have seen how boards work 

and that you have seen how the bosses do their own type of a command and control and get feedback. 

I would imagine that you have lost a lot of sleep wondering what 

it was that you could have done differently and what message you 

would send to other individuals if given the opportunity. 

We are going to have a lot of people that get hurt on this, and 

they are people that you had data from. If you could go back a year 

and look at your operation and tell us what you would do differently to demand things be changed, if there was any inkling at 

all, what would you do? 

Mr. SMITH. Senator, as you might guess, since early August, myself and the entire team that has been focusing on addressing this 

issue has been working around the clock trying to, first and foremost, understand the forensic of what occurred and maybe why it 

occurred and then communicating to consumers and regulators and 

State AGs and the like. I have had no time to reflect on, as a leader who has apologized and takes full responsibility, what I would 

do differently. I am sure when I have time to reflect, there will be 

things I look back on and say, ‘‘If I only had done this.’’ That time 

will come, but, Senator, to be honest, I have not had that time to 

reflect. 

Senator ROUNDS. As many board members or chairmen would do, 

they rely on a CIO to provide them with assurances. Did you as 

a member or with the board doing their due diligence—do you feel 

that the due diligence that was expected of you as a board and as 

the chief operating—or the chief executive officer—do you feel like 

you did the due diligence necessary to assure yourselves and to get 

second opinions, that the CIO was actually doing the job that they 

needed to do, and that they were doing their own sense of due diligence in this process? 

Mr. SMITH. The CIO I had has been there for 8 years. He was 

a very seasoned CIO. Ultimately, the responsibility stops with me, 

not him. He is no longer with the company nor is the chief security 

officer, but ultimately, that responsibility stops with me, Senator. 

Senator ROUNDS. I read your article. I read through your statement, your written statement, and I caught time and again—and 

we sometimes—we go for the fact that you were the victim of theft 

31 

as well. There were bad people that got into your system. The obligation that you had to protect that information that was in your 

care, custody, and control is clear. And I think that sometimes organizations that have that data, they assume that somebody else 

is doing their job. They assume that there are reasonable expectations of due diligence being completed. 

I guess what I was hoping to hear is something along the lines 

of ‘‘Yeah. If I could send a message to other CEOs out there, it is 

do not just listen. Do the double-checks. Find out. Ask for the outside assistance,’’ and I guess I am not hearing that. And I know 

that this is early in your process, but nonetheless, it seems like 

that would have been one of the first things that most CEOs would 

have said is ‘‘If I could do this over again, I would have fixed this. 

I could have had an opportunity. Why did not I think of it?’’ I 

just—I am looking for that. 

And I know that you did make a point in there saying, ‘‘We are 

using Social Security numbers out there, and we have got to go to 

a different system.’’ If nothing else, you have thought about that. 

What would you do or what would you recommend in terms of a 

different system for identifying and maintaining data that belongs 

to individuals safe in a case like this? What can we do different? 

Mr. SMITH. Yeah. I do not have that answer. I have spent a lot 

of time talking to people in the cyberworld, and they are convinced—they have convinced me that there has to be a better solution than an instrument that was introduced in 1936. It was never 

intended as an identifier for an individual. 

I am convinced that if you get the public, private, and academic 

partnership, we can crack that. 

Senator ROUNDS. But no real answer yet? 

Mr. SMITH. Not yet. 

Senator ROUNDS. Thank you. 

Thank you, Mr. Chairman. 

Chairman CRAPO. Senator Van Hollen. 

Senator VAN HOLLEN. Thank you, Mr. Chairman. 

Mr. Smith, it is good to have you here. Consumers do not authorize Equifax or any credit reporting agency to collect their personal 

information, do they? 

Mr. SMITH. Not to collect it. 

Senator VAN HOLLEN. No. So you vacuum up lots of information, 

and you provide it to people who say they are interested in the 

credit of somebody who may be applying for a car loan or a home 

loan or other loan, right? 

Mr. SMITH. Yes. 

Senator VAN HOLLEN. So you have an incredible amount of 

power over people’s lives, right? You collect all their personal information, and yet their life decisions may, in many cases, depend on 

what you say to a bank or another lender. Is not that right? OK. 

Is not it a fact that when someone goes for a loan, if you tell a 

lender that someone is a bad risk, they are a lot less likely to lend? 

Mr. SMITH. Senator, I thought that is where you were going. We 

do not make that delineation for the bank. We have that data, may 

provide some analytics behind it, but ultimately, the banks—— 

Senator VAN HOLLEN. But you provide the credit scoring, right? 

32 

Mr. SMITH. There is an individual firm called FICO that provides 

the score. 

Senator VAN HOLLEN. And they do that based on the information 

you provide, right? 

Mr. SMITH. Correct. 

Senator VAN HOLLEN. OK. Now, are you aware of the fact that 

when the Consumer Financial Protection Bureau did a survey, they 

found that Equifax, Experian, and TransUnion are the three most 

complained-about companies in America? Are you familiar with 

that finding? 

Mr. SMITH. Yes. It is a little misleading. 

Senator VAN HOLLEN. Well—— 

Mr. SMITH. That is the CFPB Complaint Portal. If I may, Senator? 

Senator VAN HOLLEN. Well, no. Unfortunately, if the Chairman 

wants to give me more time, I will, but I will—I will just—you can 

submit something for the record, if you are interested, but I think 

the point I wanted to make is this was actually from September 8, 

2016. I mean, this is even before we had the incredible introductions into the data and the exposure of data. 

People pay many other companies billions of dollars in the event 

that you make a mistake that needs to be corrected. Is not that the 

case? 

Mr. SMITH. I am sorry. State that again? 

Senator VAN HOLLEN. People, consumers who have information 

incorrectly included on one of your reports, they often have to pay 

a lot of money to other firms to get it corrected. Is not that the 

case? 

Mr. SMITH. No, that is not the case. If a consumer has a—you 

referred to in the CFPB—— 

Senator VAN HOLLEN. I am talking about the credit repair services. What do they do? 

Mr. SMITH. Yeah, but the process the consumer could use, if they 

think they—— 

Senator VAN HOLLEN. No, but what about—what—the credit—I 

am asking these credit repair service companies—they are making 

money now to try to help consumers correct mistakes that are often 

put in your reports or other credit rating agencies. Is not that the 

case? 

Mr. SMITH. There is an industry that does that, Senator. A consumer can come to us directly and dispute that issue. 

Senator VAN HOLLEN. So I guess those industries are making billions of dollars, but they really do not need to exist, in your testimony. All they have to do is come to you. 

Are you aware of the fact that—I just—Mr. Chairman, I would 

like to put in the record, a Washington Post story from 2008—16, 

how the careless errors of credit reporting agencies are ruining people’s lives. 

Chairman CRAPO. Without objection. 

Senator VAN HOLLEN. I would also like to include in the record 

something from CNBC, a piece by Aaron Klein, a fellow at the 

Brookings Institute, titled ‘‘The Real Problem With Credit Reports 

Is the Astounding Number of Errors’’. 

Chairman CRAPO. Without objection. 

33 

Senator VAN HOLLEN. And I would also, Mr. Chairman, like to 

put in the report the FTC study from February 2013 that said 5 

percent of consumers had errors on their credit reports that could 

result in less favorable terms for loans. 

Chairman CRAPO. Without objection. 

Senator VAN HOLLEN. Because the whole model of this industry 

is you collect information without permission from consumers, and 

yet their lives depend, in many ways—their economic lives depend 

on decisions you make. 

So I want to go back to something Senator Heitkamp asked you 

with respect to forced arbitration because, clearly, we have a powerful company that is often up against one individual who is trying 

to get something corrected on their credit rating report or whatever 

it may be, and yet in the aftermath of this incredible breach, you 

said that you would provide credit protection but only if consumers 

gave up their right to get their day in court. You want to have 

forced arbitration. 

Now, your testimony today is that was a mistake, that you did 

not mean to apply it in this case; is that right? 

Mr. SMITH. That is correct. 

Senator VAN HOLLEN. All right. But you do apply forced arbitration in many other situations, don’t you? 

Mr. SMITH. In the consumer products. 

Senator VAN HOLLEN. And so if you are looking out for the rights 

of consumers, why do not you give them the choice of how they 

seek their remedy? 

Mr. SMITH. Senator, I understand your issue today. That arbitration clause is a legal provision, and we follow that. 

Senator VAN HOLLEN. And you have been—not just legal, but you 

have paid lobbyists on Capitol Hill—I am asking you a question, 

then. Have you paid lobbyists on Capitol Hill to fight the rule that 

was put forward by the Consumer Financial Protection Bureau? 

Mr. SMITH. If you are referring to the harmonization bill that 

was proposed, which I think you are referring to—is that the bill? 

Senator VAN HOLLEN. I am referring to the legislation—— 

Mr. SMITH. Arbitration specifically? 

Senator VAN HOLLEN. ——that would overturn the Consumer Financial Protection Bureau’s rule that prohibits forced arbitration 

clauses. 

Mr. SMITH. Senator, if we spent time on that, I am not aware of 

that. 

Senator VAN HOLLEN. So are you in favor, then? You said it is 

part of the law, and so you are just abiding by the law. But as 

somebody who has experience in this area, would you agree that 

consumers should have the right to decide how best to protect 

themselves in legal matters? 

Mr. SMITH. Senator, if that becomes law, we will follow the law. 

Senator VAN HOLLEN. No, that is not my question. 

Mr. SMITH. I understand. 

Senator VAN HOLLEN. My question is, Where do you stand on the 

issue of allowing consumers to choose how they seek recourses 

when they believe they have been wronged? 

Mr. SMITH. Senator, I understand the question, and today, arbitration is a part of the law, and we are following the law. 

34 

Senator VAN HOLLEN. Yeah. And so you are following it even 

though it may be unfairly treating consumers; is that right? 

Mr. SMITH. I understand your question. 

Senator VAN HOLLEN. But, Mr. Chairman, if I just—but you 

chose to suspend that law. You could have enforced that on these 

individuals, right? 

Mr. SMITH. It was never the intent, as it related to the 

breach—— 

Senator VAN HOLLEN. But it was the law. The law would have 

allowed you to do it, right? 

Mr. SMITH. But it was never the intent—— 

Senator VAN HOLLEN. That is not what I am asking. The law 

would have allowed you to do that, right? 

Mr. SMITH. Yes. 

Senator VAN HOLLEN. And you chose not to because you thought 

in that circumstances, consumers would be better protected by having choices, and my only question to you, if it is good in that circumstances, why is not it good for consumers all the time? 

Thank you, Mr. Chairman. 

Chairman CRAPO. Thank you. 

Now, that concludes the questioning, however, we have had a 

couple of requests for a second round, and so I will go with a brief 

3-minute second round. 

Senator. 

Senator BROWN. Thank you, Mr. Chairman. 

Following up on, I thought, Senator Van Hollen’s very good line 

of questioning about your rather curious statement that you are 

following the law, but you are not following the law on the—in the 

one case, but you are in the other, I do not entirely get that. 

But let me take it a different way. In your written testimony, you 

state that terms and conditions attached to the free solutions that 

Equifax offered included an arbitration clause. You said this provision of forced arbitration clause was never, in this case, intended 

to apply, and you were informed the clause was included. Apparently, it was sent out to your customers, and you did not know it 

was in there, the clause, as customers often do not know these 

forced arbitration clauses are in there, the fine print. And I assume 

you are more sophisticated in these financial instruments and 

transactions than most of your customers, but leave that alone. 

You were informed the clause—and clause was included because 

it was, quote, your words, ‘‘essentially ’cut and pasted’ from a different Equifax offering.’’ But this inadvertent error could have prevented, if not—if not unearthed and then protested, then pushed 

back and you dropped it, this inadvertent error could have prevented 145 million victims from pursuing their legal rights in 

court. 

So make that case again. Your company failed by allowing this 

breach of 145 million victims. You sent out a piece. You sent out 

a restitution to them with forced arbitration. You backed off the 

forced arbitration. 

So do not you think it is fundamentally unfair that the ability 

of 145 million Americans to seek justice in court could have been 

taken away simply by a cut-and-paste job? Does not that show how 

unfair forced arbitration is to customers? 

35 

Mr. SMITH. Senator, to be specific to this particular issue, it was 

an error, as you noted. We were made aware of the error, and I 

believe within 24 hours removed that clause. It was never intended 

to be a clause applied to the breach. 

Senator BROWN. But that was not really the question. 

So, first of all, you say it was an error. I guess I believe that, 

that it was an error, although your company has given us cause to 

not believe some other things. But does not that show how unfair 

forced arbitration is? You did not ask—you did not answer that 

question. If this inadvertent error, this cut-and-paste error had 

taken away forced—forced arbitration of 145 million Americans, 

does not that show how unfair forced arbitration is? 

Mr. SMITH. I have no opinion on that. 

Senator BROWN. But you used forced arbitration in other cases? 

Mr. SMITH. Correct. 

Senator BROWN. So you must not think it is—so it is unfair to 

those 145 million in that circumstance, but it is not unfair to customers in other circumstances on whom you oppose forced arbitration, both? 

Mr. SMITH. Again, I go back, Senator. It was never the intent for 

us to have that arbitration clause in the breach service itself. 

Senator BROWN. And I will close, Mr. Chairman. I appreciate 

your indulgence. 

I just cannot understand why you think—for those 145 million 

in that case that forced arbitration is unfair, but in other uses in 

your company, you seem to think it is fair. It just puzzles me. 

Senator BROWN. Senator Heitkamp. 

Senator HEITKAMP. Thank you, Mr. Chairman. 

And I just wanted to come back and offer a couple suggestions 

because we are all struggling, and obviously, your company has 

had a huge hit to its reputation. 

We found out today that the IRS has been forced to continue 

your contract by your protest. That is why that contract was continued, and we, in spite of some very interesting timelines, the belief that you have that there was no insider training—and so I am 

just going to offer a couple of suggestions for you. 

Number one, tell the IRS it is OK to migrate the contract someplace else and say, ‘‘We are fixing, getting our house in order. We 

understand that we have a ways to walk back, our reputation, and 

we are going to withdraw our protest on the loss of that contract.’’ 

And the other thing I would suggest to the three individuals, 

who may be completely innocent—but the rest of the shareholders 

who took the hit—they are more innocent than employees of that 

company, of your company—they should give the money back. They 

should give the money back. 

And so I think there is other things. I think there is an attitude 

that we come here, we do everything possible, we are trying to do 

our level best, but many, many times, it is the symbolic things. It 

is like forcing the IRS to take this contract for another year, like 

a very suspicious timeline that has led us all to believe that there 

should at least, at a minimum, be an investigation. All of that 

could be undone with a gesture of goodwill. 

And so I understand you are not the CEO of the company. You 

said you are still in an advisory role. My advice to you is do some 

36 

things that are very, very visible, and those are two things that 

you could do that would give us some certainty that this is being 

taken as seriously as it what it should be taken. 

Thank you, Mr. Chairman. 

Chairman CRAPO. Thank you. 

And I will conclude with 3 minutes of questions as well. 

Mr. Smith, I wanted to get back to my original question. A lot 

of the questions you have gotten today appropriately have been 

very specific with regard to Equifax and the Equifax breach. 

I want to focus on the broader issue as we conclude. In my initial 

questioning to you, I talked to you about whether there were— 

whether any Experian data went to other entities, and I was referring to governmental entities—the CFPB, the Federal Reserve. We 

just had discussion about the IRS, and there are contractual relationships, I understand, with the use of this data. 

Let me just talk about a the CFPB as an example. In September 

of 2014, the GAO did a report which I requested for on CFPB data 

collection. They found that CFPB at that time—that is 3 years ago 

now—had access to account-level credit card data on between 546 

to 596 million consumer accounts on a monthly basis, representing 

87 percent of the credit card market. GAO also found that at that 

time, there was not adequate protection at the CFPB of this data 

that they were collecting. 

In this report, it indicated—again, this was in 2014—all of the 

sources of data that the CFPB was collecting—and Experian shows 

up in that report—700,000 vehicles per month, information procedure from Experian, vehicle purchases, and the data on those purchases, 10.7 million consumers, cosigners, and borrowers with consumer credit information from Experian, and another 600,000 samples of consumer credit reports and consumer credit scores on those 

reports from Experian. 

Now, Experian is not the only entity that is providing data to the 

CFPB. There are, in this same report, for example, nine unidentified large financial institutions using a commercial data aggregator 

who provided 25 to 75 million total account sets of data involving 

individual consumers’ credit card account-level data with linkages 

to their credit reporting data. 

The reason, what I am getting into here, is this. Experian is not 

the only company or entity in America collecting data. There is 

massive data collection being undertaken in this country, and it is 

not just the three credit bureaus that are collecting this data. 

I believe that Congress need to address not only the issue with 

Experian, but the broader issue of the collection and use and protection of personally identifiable information that is being collected 

by the Government, by the private sector, and others with regard 

to this personally identifiable data. 

And I guess this is really more of a statement than a question, 

but I would like to know your opinion on that. Well, actually, there 

is a question first, and that is, Does Experian face requests from 

Federal regulators that are mandatory to provide data to them? 

Mr. SMITH. Senator, Mr. Chairman, I assume you mean Equifax? 

Chairman CRAPO. Yes. Excuse me. 

Mr. SMITH. Yes. 

Chairman CRAPO. Equifax. 

37 

Mr. SMITH. A general observation, a reaction to your thoughts 

there, if there was a better way to ensure that those that aggregate 

and manage significant amounts of data like we do, banks do, others in the industry, we would welcome that dialogue if there is a 

better path forward. 

But to answer your question specifically, do we aggregate and 

provide data to different Government entities, the answer is yes. 

Chairman CRAPO. All right. Thank you. 

And I apologize. In fact, I gave the Experian examples, and that 

was just a mistake. 

But your answer is that, yes, Equifax also provides data to those 

regulators, and it is not always voluntary, is it? In other words, you 

must provide it on occasion when it is required from agencies? 

Mr. SMITH. Yes. 

Chairman CRAPO. So let me ask you the general question, then. 

As Congress looks at this issue, it seems to me that it should be 

obvious that we should look much more broadly than even just one 

private-sector company and even then just the private sector, but 

to the data collection that is going on across our society, including 

the data collection that the Government itself is collecting. Would 

you agree? 

Mr. SMITH. The rate and pace of cyberattacks is increasing at a 

rate that is unbelievable. If there is a way for public–private partnership to intelligently sit around a table and debate that and find 

better ways to manage and secure data, we would welcome that 

dialogue. 

Chairman CRAPO. Thank you. 

And I note that Senator Sasse came in, so he will get the last 

word. We are doing a 3-minute round, Senator Sasse. 

Senator SASSE. Thank you, Mr. Chairman, and I would like to 

just associate myself with your comments right there about the digital revolution moment we are at, and the speed and pace of data 

aggregation and collection should push the Congress to have some 

real hard discussions about data ownership and transmission and 

implicit contracts where individuals are not contracting with one of 

the three credit bureaus and their data is still being managed and 

shipped in ways that they cannot control. I agree with you that we 

should have hearings and a lot of debate about this important topic 

in the digital revolution. 

Mr. Smith, I want to just see if I can be clear about where I 

think we stand nearly 2 hours into this hearing. Your company, 

which has only two competitors, right? Really you only have two 

competitors—has lost the data of 145 million Americans, and this 

is not a spreadsheet problem. This is a real human problem where 

2 and 3 and 4 years from now, you are going to have real Americans whose identity is going to be stolen, and their credit is going 

to be abused in the future. And they are going to have difficulty 

qualifying for a home loan or a car loan or they are going to pay 

a differential interest rate than they should be paying because of 

the rotten credit score that they are going to have. 

And in response, your company could potentially make a profit 

from selling LifeLock products. Again, I agreed with you earlier 

that a lot of the forward-looking innovation that may come from 

this could incrementally improve things, but I think we are most 

38 

interested right now in the retrospective moment for these 145 million. 

You are going to have a product that could potentially be sold to 

the very victims. It feels like a broken-windows business model 

where you did not actively chuck the bricks, but your company allowed bricks to be tossed through windows, and then you might potentially be able to sell new windows to some of the same people 

whose windows were just broken. 

And I think the way you explained your LifeLock product in your 

testimony makes some sense for what you plan to roll out in January of 2018, but it is still really hard to understand it as a fraud 

protection product when you think about the victims historically. 

So I want to go back for just a minute to this contract with the 

IRS. 

So we checked, and it appears to be a no-bid, even if it is a revolving contract that is a no-bid, but the purpose of the contract 

with the IRS looks like it is fraud prevention, right? You are trying 

to prevent fraudulent access. 

I will not ask for a show of hands in the room, but I do not know 

who would want to say we should buy fraud protection from the 

people who were just hacked and dumped 145 million American 

records. 

So just honestly as an American—and I appreciate the fact that 

you have resigned from the company, but as an American, why 

should anybody hire Equifax for fraud protection right now after 

the exposure? 

Mr. SMITH. Senator, I understand your point. We are a company 

that has been around for 118 years and for most of those 118 years 

have done good things for many stakeholders, including the Government, and one of those things we have done very proudly is prevent fraud for many entities, including the Government. 

I come back. It was a horrific breach, and I apologize on behalf 

of the company for that breach. We will make it right as best we 

can, but it does not wipe out 118 years of good work we have done. 

Senator SASSE. Thank you. 

I am going to be following up with the IRS and asking them why 

this contract should go forward, but thank you for your willingness 

to appear before the Committee today. 

Mr. SMITH. Thank you. 

Chairman CRAPO. Thank you, Senator. 

And that concludes the questioning. 

Mr. Smith, we do appreciate you coming before the Committee 

and appearing today. 

For all Senators, all follow-up questions need to be submitted by 

next Wednesday, October 11th. 

And, Mr. Smith, we ask that you please respond promptly to 

those questions. We usually like to see the responses within a 

week, if possible. 

With that, this hearing is adjourned. 

Mr. SMITH. Thank you. 

[Whereupon, at 12:01 p.m., the hearing was adjourned.] 

[Prepared statements, responses to written questions, and additional material supplied for the record follow:] 

39 

PREPARED STATEMENT OF RICHARD F. SMITH 

FORMER CHAIRMAN AND CHIEF EXECUTIVE OFFICER, EQUIFAX, INC. 

OCTOBER 4, 2017 

Preliminary Statement 

Chairman Crapo, Ranking Member Brown, and Honorable Members of the Committee, thank you for the opportunity to testify today. 

I am here today to recount for this body and the American people, as best I am 

able, what happened when Equifax was hacked by a yet unknown entity and sensitive information of over 140 million Americans was stolen from its servers, and 

to outline the remediation steps the company took. We at Equifax clearly understood that the collection of American consumer information and data carries with 

it enormous responsibility to protect that data. We did not live up to that responsibility, and I am here today to apologize to the American people myself and on behalf 

of the Board, the management team, and the company’s employees. 

Let me say clearly: As CEO I was ultimately responsible for what happened on 

my watch. Equifax was entrusted with Americans’ private data and we let them 

down. To each and every person affected by this breach, I am deeply sorry that this 

occurred. Whether your personal identifying information was compromised, or you 

have had to deal with the uncertainty of determining whether or not your personal 

data may have been compromised, I sincerely apologize. The company failed to prevent sensitive information from falling into the hands of wrongdoers. The people affected by this are not numbers in a database. They are my friends, my family, members of my church, the members of my community, my neighbors. This breach has 

impacted all of them. It has impacted all of us. 

I was honored to serve as the Chairman and Chief Executive Officer of Equifax 

for the last 12 years, until I stepped down on September 25. I will always be grateful for the opportunity to have led the company and its 10,000 employees. Equifax 

was founded 118 years ago and now serves as one of the largest sources of consumer 

and commercial information in the world. That information helps people make business and personal financial decisions in a more timely and accurate way. Behind 

the scenes, we help millions of Americans access credit, whether to buy a house or 

a car, pay for college, or start a small business. During my time at Equifax, working 

together with our employees, customers, and others, we saw the company grow from 

approximately 4,000 employees to almost 10,000. Some of my proudest accomplishments are the efforts we undertook to build credit models that allowed and continue 

to allow many unbanked Americans outside the financial mainstream to access credit in ways they previously could not have. Throughout my tenure as CEO of 

Equifax, we took data security and privacy extremely seriously, and we devoted substantial resources to it. 

We now know that criminals executed a major cyberattack on Equifax, hacked 

into our data, and were able to access information for over 140 million American 

consumers. The information accessed includes names, Social Security numbers, 

birth dates, addresses, and in some instances, driver’s license numbers; credit card 

information for approximately 209,000 consumers was also stolen, as well as certain 

dispute documents with personally identifying information for approximately 

182,000 consumers. 

Americans want to know how this happened and I am hopeful my testimony will 

help in that regard. As I will explain in greater detail below, the investigation continues, but it appears that the breach occurred because of both human error and 

technology failures. These mistakes—made in the same chain of security systems 

designed with redundancies—allowed criminals to access over 140 million Americans’ data. 

Upon learning of suspicious activity, I and many others at Equifax worked with 

outside experts to understand what had occurred and do everything possible to 

make this right. Ultimately we realized we had been the victim of a massive theft, 

and we set out to notify American consumers, protect against increased attacks, and 

remediate and protect against harm to consumers. We developed a robust package 

of remedial protections for each and every American consumer—not just those affected by the breach—to protect their credit information. The relief package includes: (1) monitoring of consumer credit files across all three bureaus, (2) access 

to Equifax credit files, (3) the ability to lock the Equifax credit file, (4) an insurance 

policy to cover out-of-pocket costs associated with identity theft; and (5) dark web 

scans for consumers’ social security numbers. All five of these services are free and 

without cost to all Americans. Equifax also recently announced an important new 

tool that has been under development for months that will allow consumers to lock 

and unlock their credit files repeatedly, for life, at no cost. This puts the control of 

40 

consumers’ credit information where it belongs—with the consumer. We have also 

taken steps to better protect consumer data moving forward. 

We were disappointed with the rollout of our website and call centers, which in 

many cases added to the frustration of American consumers. The scale of this hack 

was enormous and we struggled with the initial effort to meet the challenges that 

effective remediation posed. The company dramatically increased the number of customer service representatives at the call centers and the website has been improved 

to handle the large number of visitors. Still, the rollout of these resources should 

have been far better, and I regret that the response exacerbated rather than alleviated matters for so many. 

How It Happened 

First and foremost, I want to respond to the question that is on everyone’s mind, 

which is, ‘‘How did this happen?’’ In my testimony, I will address both what I 

learned and did at key times in my role as CEO, and what I have since learned 

was occurring during those times, based on the company’s ongoing investigation. 

Chronologically, the key events are as follows: 

On March 8, 2017, the U.S. Department of Homeland Security, Computer Emergency Readiness Team (U.S.–CERT) sent Equifax and many others a notice of the 

need to patch a particular vulnerability in certain versions of software used by other 

businesses. Equifax used that software, which is called ‘‘Apache Struts’’, in its online 

disputes portal, a website where consumers can dispute items on their credit report. 

On March 9, Equifax disseminated the U.S.–CERT notification internally by email 

requesting that applicable personnel responsible for an Apache Struts installation 

upgrade their software. Consistent with Equifax’s patching policy, the Equifax security department required that patching occur within a 48-hour time period. We now 

know that the vulnerable version of Apache Struts within Equifax was not identified 

or patched in response to the internal March 9 notification to information technology personnel. 

On March 15, Equifax’s information security department also ran scans that 

should have identified any systems that were vulnerable to the Apache Struts issue 

identified by U.S.–CERT. Unfortunately, however, the scans did not identify the 

Apache Struts vulnerability. Equifax’s efforts undertaken in March 2017 did not 

identify any versions of Apache Struts that were subject to this vulnerability, and 

the vulnerability remained in an Equifax web application much longer than it 

should have. I understand that Equifax’s investigation into these issues is ongoing. 

The company knows, however, that it was this unpatched vulnerability that allowed 

hackers to access personal identifying information. 

Based on the investigation to date, it appears that the first date the attacker(s) 

accessed sensitive information may have been on May 13, 2017. The company was 

not aware of that access at the time. Between May 13 and July 30, there is evidence 

to suggest that the attacker(s) continued to access sensitive information, exploiting 

the same Apache Struts vulnerability. During that time, Equifax’s security tools did 

not detect this illegal access. 

On July 29, however, Equifax’s security department observed suspicious network 

traffic associated with the consumer dispute website (where consumers could investigate and contest issues with their credit reports). In response, the security department investigated and immediately blocked the suspicious traffic that was identified. The department continued to monitor network traffic and observed additional 

suspicious activity on July 30, 2017. In response, they took the web application completely offline that day. The criminal hack was over, but the hard work to figure 

out the nature, scope, and impact of it was just beginning. 

I was told about the suspicious activity the next day, on July 31, in a conversation 

with the Chief Information Officer. At that time, I was informed that there was evidence of suspicious activity on our dispute portal and that the portal had been taken 

offline to address the potential issues. I certainly did not know that personal identifying information (PII) had been stolen, or have any indication of the scope of this 

attack. 

On August 2, consistent with its security incident response procedures, the company: (1) retained the cybersecurity group at the law firm of King & Spalding LLP 

to guide the investigation and provide legal and regulatory advice; (2) reached out, 

though company counsel, to engage the independent cybersecurity forensic consulting firm, Mandiant, to investigate the suspicious activity; and (3) contacted the 

Federal Bureau of Investigation (FBI). 

Over the next several weeks, working literally around the clock, Mandiant and 

Equifax’s security department analyzed forensic data seeking to identify and understand unauthorized activity on the network. Their task was to figure out what happened, what parts of the Equifax network were affected, how many consumers were 

41 

affected, and what types of information was accessed or potentially acquired by the 

hackers. This effort included identifying and analyzing available forensic data to assess the attacker activity, determining the scope of the intrusion, and assessing 

whether the intrusion was ongoing (it was not; it had stopped on July 30 when the 

portal was taken offline). Mandiant also helped examine whether the data accessed 

contained personal identifying information; discover what data was exfiltrated from 

the company; and trace that data back to unique consumer information. 

By August 11, the forensic investigation had determined that, in addition to dispute documents from the online web portal, the hackers may have accessed a database table containing a large amount of consumers’ PII, and potentially other data 

tables. 

On August 15, I was informed that it appeared likely that consumer PII had been 

stolen. I requested a detailed briefing to determine how the company should proceed. 

On August 17, I held a senior leadership team meeting to receive the detailed 

briefing on the investigation. At that point, the forensic investigation had determined that there were large volumes of consumer data that had been compromised. 

Learning this information was deeply concerning to me, although the team needed 

to continue their analysis to understand the scope and specific consumers potentially affected. The company had expert forensic and legal advice, and was mindful 

of the FBI’s need to conduct its criminal investigation. 

A substantial complication was that the information stolen from Equifax had been 

stored in various data tables, so tracing the records back to individual consumers, 

given the volume of records involved, was extremely time consuming and difficult. 

To facilitate the forensic effort, I approved the use by the investigative team of additional computer resources that significantly reduced the time to analyze the data. 

On August 22, I notified Equifax’s lead member of the Board of Directors, Mark 

Feidler, of the data breach, as well as my direct reports who headed up our various 

business units. In special telephonic board meetings on August 24 and 25, the full 

Board of Directors was informed. We also began developing the remediation we 

would need to assist affected consumers, even as the investigation continued apace. 

From this point forward, I was updated on a daily—and sometimes hourly—basis 

on both the investigative progress and the notification and remediation development. 

On September 1, I convened a Board meeting where we discussed the scale of the 

breach and what we had learned so far, noting that the company was continuing 

to investigate. We also discussed our efforts to develop a notification and remediation program that would help consumers deal with the potential results of the incident. A mounting concern also was that when any notification is made, the experts 

informed us that we had to prepare our network for exponentially more attacks 

after the notification, because a notification would provoke ‘‘copycat’’ attempts and 

other criminal activity. 

By September 4, the investigative team had created a list of approximately 143 

million consumers whose personal information we believed had been stolen, and we 

continued our planning for a public announcement of a breach of that magnitude, 

which included a rollout of a comprehensive support package for consumers. The 

team continued its work on a dedicated website, www.equifaxsecurity2017.com, 

where consumers could learn whether they were impacted and find out more information, a dedicated call center to assist consumers with questions, and a free credit 

file monitoring and identity theft protection package for all U.S. consumers, regardless of whether they were impacted. 

I understand that Equifax kept the FBI informed of the progress and significant 

developments in our investigation, and felt it was important to notify the FBI before 

moving forward with any public announcement. We notified the FBI in advance of 

the impending notification. 

On September 7, 2017, Equifax publicly announced the breach through a nationwide press release. The release indicated that the breach impacted personal information relating to 143 million U.S. consumers, primarily including names, Social 

Security numbers, birth dates, addresses and, in some instances, driver’s license 

numbers. 

These are the key facts as I understand them. I also understand that the FBI’s 

investigation and Equifax’s own review and remediation are ongoing, as are, of 

course, numerous other investigations. 

Protecting U.S. Consumers Affected by the Breach 

From the third week in August, when it became clear that our worst fears had 

come true and Equifax had experienced a significant breach, my direction was to 

continue investigating but first and foremost to develop remediation to protect conVerDate Nov 24 2008 16:00 Feb 12, 2018 Jkt 046629 PO 00000 Frm 00045 Fmt 6621 Sfmt 6621 L:\HEARINGS 2017\10-04 ZDISTILL\100417.TXT JASON
42 

sumers from being harmed and comply with all applicable notification requirements, 

based on advice of outside cybersecurity counsel and Mandiant. Significantly, a 

major task was the need to deploy additional security measures across the entire 

network because we were advised that as soon as Equifax announced the hack, 

there would be a dramatic increase in attempted hacking. There were three main 

components to Equifax’s plan: (1) a website where consumers could look up if they 

were affected by the breach and then register for a suite of protective tools; (2) a 

call center to answer questions and assist with registration; (3) the package of tools 

themselves that the company was offering to everyone in the country. The task was 

massive—Equifax was preparing to explain and offer services to every American 

consumer. First, a new website was developed to provide consumers with additional information—beyond the press release—about the nature, extent, and causes of the breach. 

This was extremely challenging given that the company needed to build a new capability to interface with tens of millions of consumers, and to do so in less than 2 

weeks. That challenge proved overwhelming, and, regrettably, mistakes were made. 

For example, terms and conditions attached to the free solutions that Equifax offered included a mandatory arbitration clause. That provision—which was never intended to apply in the first place—was immediately removed as soon as it was discovered. (I was informed later that it had simply been inadvertently included in 

terms and conditions that were essentially ‘‘cut and pasted’’ from a different Equifax 

offering.) 

The initial rollout of Equifax’s call centers had frustrating shortcomings as well. 

Put simply, the call centers were confronted by an overwhelming volume of callers. 

Before the breach, Equifax had approximately 500 customer service representatives 

dedicated to consumers, so the company needed to hire and train thousands more, 

again in less than 2 weeks. To make matters worse, two of the larger call centers 

in Florida were forced to close for a period of time in the wake of Hurricane Irma. 

The closure of these call centers led to a reduction in the number of available customer service representatives and added to the already significant wait times that 

callers experienced. Many needlessly waited on hold or were otherwise unable to 

have their questions answered through the call centers, which I deeply regret. My 

understanding is that the call centers are now fully functional. The number of customer service representatives, which is now over 2,500, continues to increase, and 

I am informed that wait times have decreased substantially. 

Beyond the website and the call centers, the company also developed a comprehensive support package for all American consumers, regardless of whether they 

were directly affected by the incident or not, that includes free: (1) credit file monitoring by all three credit bureaus; (2) Equifax credit lock; (3) Equifax credit reports; 

(4) identity theft insurance; and (5) Social Security Number ‘‘dark web’’ scanning for 

one year. Importantly, enrolling in the program is free, and will not require consumers to waive any rights to take legal action for claims related to the free services 

offered in response to the cybersecurity incident or for claims related to the cybersecurity incident itself. 

Despite these challenges, it appears that Equifax’s efforts are reaching many people. As of late September, the website had received over 420 million hits. And similarly, as of late September, over 7.5 million activation emails have been sent to consumers who registered for the program. 

Equifax also recently announced a new service that I understand will be available 

by January 31, 2018, that will allow consumers to control their own credit data, by 

allowing them to lock and unlock their credit files at will, repeatedly, for free, for 

life. I was pleased to see the company move forward with this plan, which we had 

put in motion months ago, and which I directed the company to accelerate, as we 

were constructing the remedial package in response to the breach. 

The hard work of regaining the trust of the American people that was developed 

over the course of the company’s 118 year history is ongoing and must be sustained. 

I believe the company, under the leadership of Lead Director Mark Feidler, and interim CEO Paulino do Rego Barros, Jr., will continue these efforts with vigor and 

commitment. 

How To Protect Consumer Data Going Forward 

It is extremely important that notwithstanding the constant threat of 

cybercriminals, the American people and the Members of this Committee know that 

Equifax is doing everything in its power to prevent a breach like this from ever happening again. Since the potential breach was discovered, those inside and outside 

the company have worked around-the-clock to enhance the Company’s security 

measures. While I am limited in what I can say publicly about these specific measures, and going forward these questions are best directed to new management, I 

43 

want to highlight a few steps that Equifax has already taken to better protect consumer data moving forward, including the website developed to respond to the hack, 

and some changes still to come. 

In recent weeks, vulnerability scanning and patch management processes and 

procedures were enhanced. The scope of sensitive data retained in back-end databases has been reduced so as to minimize the risk of loss. Restrictions and controls 

for accessing data housed within critical databases have been strengthened. Network segmentation has been increased to restrict access from internet facing systems to back-end databases and data stores. Additional web application firewalls 

have been deployed, and tuning signatures designed to block attacks have been 

added. Deployment of file integrity monitoring technologies on application and web 

servers has been accelerated. The company is also implementing additional network, 

application, database, and system-level logging. These are just a few of the steps 

Equifax has taken in recent weeks to shore up its security protocols. 

Importantly, Equifax’s forensic consultants have recommended a series of improvements that are being installed over the next 30, 60, and 90 day periods, which 

the company was in the process of implementing at the time of my retirement. In 

addition, at my direction a well-known, independent expert consulting firm (in addition to and different from Mandiant) has been retained to perform a top-to-bottom 

assessment of the company’s information security systems. 

Beyond the recent technological enhancements, Equifax has also made several 

strategic personnel changes at the highest levels of the company. Accountability 

starts at the top and I, therefore, decided to step down as CEO and retire early to 

allow the company to move forward. Before I retired, our Chief Information Officer 

and Chief Security Officer also left the company. Equifax’s interim appointments for 

each of these positions, including Paulino do Rego Barros, Jr., the interim CEO, are 

ready, able and qualified to step into their new roles and to help consumers, and 

the company, recover from this regrettable incident. 

It is my hope and expectation that, at the conclusion of the investigation, we will 

have an even more complete account of what happened, how future attacks by criminal hackers can be deterred and suspicious activity curbed more quickly, and most 

importantly, how consumers’ concerns about the security of their personal data can 

be alleviated. 

Toward a New Paradigm in Data Security 

Where do we go from here? Although I have had little time for reflection regarding the awful events of the last few weeks, this humbling experience has crystalized 

for me two observations: First, an industry standard placing control of access to consumers’ credit data in the hands of the consumers should be adopted. Equifax’s free 

lifetime lock program will allow consumers, and consumers alone, to decide when 

their credit information may be accessed. This should become the industry standard. 

Second, we should consider the creation of a public–private partnership to begin a 

dialogue on replacing the Social Security Number as the touchstone for identity 

verification in this country. It is time to have identity verification procedures that 

match the technological age in which we live. 

The list of companies and Government agencies that have suffered major hacks 

at the hands of sophisticated cybercriminals is sadly very long, and growing. To my 

profound disappointment, Equifax now finds itself on that list. I have stepped away 

from a company I have led and loved and help build for more than a decade. But 

I am not stepping away from this problem and I am strongly committed to helping 

address the important questions this episode has raised. Part of that starts today, 

as I appear at this hearing and others voluntarily to share what I know. Going forward, however, Government and the private sector need to grapple with an environment where data breaches will occur. Giving consumers more control of their data 

is a start, but is not a full solution in a world where the threats are always evolving. 

I am hopeful there will be careful consideration of this changing landscape by both 

policymakers and the credit reporting industry. 

Conclusion 

Chairman Crapo, Ranking Member Brown, and Honorable Members of the Committee, thank you again for inviting me to speak with you today. I will close by saying again how so sorry I am that this data breach occurred. On a personal note, 

I want to thank the many hard-working and dedicated people who worked with me 

for the last 12 years, and especially over the last 8 weeks, as we struggled to understand what had gone wrong and to make it right. This has been a devastating experience for the men and women of Equifax. But I know that under the leadership 

of Paulino and Mark they will work tirelessly, as we have in the past 2 months, 

to making things right. 

44 

I realize that what I can report today will not answer all of your questions and 

concerns, but I can assure you and the American public that I will do my level best 

to assist you in getting the information you need to understand this incident and 

to protect American consumers. 

45 

RESPONSES TO WRITTEN QUESTIONS OF 

THE SENATE BANKING COMMITTEE FROM RICHARD F. SMITH 


10417001.eps
46 


10417002.eps

The Honorable Mike Crapo 

December 22, 2017 

Page2 

confidential, lrade secre~ and proprielary information, and a reasonable opportunily to object 

Please direct any such notice to me atlhe above address. 

Should you have any questions concerning lhe information provided herein, please 

contact me directly at202-626-2901. 

oc: Senator Sherrod Brown, Ranking Member 

Senator Jack Reed 

Senator Robert Menendez 

Senator Jon Tester 

Senator Mark Warner 

Senator Elizabeth Warren 

Senator Heidi Heitkamp 

Senator Joe Donnelly 

Senator Brian Schatz 

Senator Chris Van Hollen 

Senator Calherine Cortez Masto 

Senator Ben Sasre 

Senator Richard Shelby 

Enclosure 

Sineerelv. 

1f;; 

Theodore M. Hester 
47 


10417003.eps

EQUIFAX'S SUBMISSION IN RESPONSE TO 

COMMITTEE REQUESTS DATED OCTOBER 12,2017 

Please note that the question numbers are not the Conunittee's question numbm, but are 

being provided for ease of reference. 

Equifax is providing the Committee with a copy of the Special Conunittee Repnn 

referenced throughout the responses provided below (attached to this letter) and is producing 

documents Bates numbered EFXCONG-SBCOOOOOOOOI to EFXCONG-SBC000000185 to the 

Committee as part oftoday's production. Due to email file size limitations, Equifax is producing 

the Bates numbered documents to the Committee on a CD, which has been encrypted to ensure 

the privacy and integrity of the data. The password to gain access to the materials will be sent by 

separate correspondence. 

Questions for Mr. Richard F. Smith. Former Chairman and Chief Executive Officer of 

Eouifax. Inc. on behalf of Ranking Member Brown, Senator Jack Reed. Senator Robert 

Menendez, Senator Jon Tester. Senator Mark Warner. Senator Elizabeth Warren. Se.nator 

Heidi Heitkamp. Senator Joe Donnellv. Senator Brian Schatz, Senator Chris Van Hollen, 

and Senator Catherine Cortez Masto: 

Question 112 (p. 2): We know the decision was not yours, but given the singular importance 

of protecting private data to Equifax's business model, do you think it is appropriate that 

you 11·ere awarded this compensation? 

A: As a threshold matter, Mr. Smith does not believe the various repnrts rtgarding his 

compensation between 2016 and 2017 are accurate. In addition, his compensation 

structure was determined by an independent committee of the Board of DirectoB, elected 

by the Company shareholders, and was aligned with the performance of the Company. 

Question #S (p. 3): Given your testimony that Equifax's consumer-fating segment 

comprises a small portion of the company's overall business, how does your compensation 

package's focus on shareholder return ensure that the company takes adequate 

precautions against theft of consumers' personal identifying information? 

A: Equifax is a 118-year'"()ld company, that prides itself on being a trusted steward of 

data, regardless of whether it is a consumer's data or a company's data. The Company's 

business model depends on it and the reputational impact of a data breach is just as 

significant coming from a consumer breach, as it is with a corporation breach. Aligning 

the executive's compensation with building long term value for shareholdeB is good 

corporate governance and is consistent with this model. The Company's compensation 

structure reflects that. 

I 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIF AX INC. 
48 


10417004.eps

Question #6 (p. 3): Your compensation package appears to have incentivized the pursuit of 

short-term revenue growth, profits, and stock returns over protection of consumer 

information. What changes in law would ensure that consumer reporting agencies' 

primary focus is protecting consumers and ensuring credit-report accuracy? 

A: With respect to Mr. Smith's compensation, Equifax respectfully submits that a large 

majority of his oompe~tion (over 70%) was based on three-y~r share perfonnance, 

rather than short-tenn revenue growth or profits. This three year perfonnance metric 

direttly aligns his compensation with the value delivered 10 shareholders. Only a small 

portion of Mr. Smith's oompensation was based on short-tenn perfonnance. 

In establishing and reviewing Equifax's executive compensation program, the 

Compensation Committee of the Board of Direttors considered whether the program 

encourages unnecessary or excessive risk-taking and concluded that it does not. The 

Compensation Committee also considered shareholder feedback in its review of the 

compensation progwn, as well as oompensation plan and benchmarking advice from its 

independent compensation consultant. Further, the shareholders of Equifax confinned 

their support for the Company's executive offteer oompensation plan by overwbelrningly 

approving the compensation package at the last annual meeting of shareholders held on 

May4,2017. 

Equifax understands that being the bolder of consumer infonnation and data carries with 

it enonnous responsibility. Equifax bas devoted substantial resources to this area 

historically and, as described in more detail throughout the other responses, Equifax bas 

taken a number of important steps to enhance consumer data protection and will continue 

to implement additional improvements going forward. 

Equifax and consumers have an aligned interest in ensuring credit report accuracy; it is in 

Equifax's business interest to maintain a high level of accuracy in the reports that it 

provides to lenders and other authorized customers. Based on the foregoing, Equifax 

believes that a change in law is not necessary to ensure its focus on these important 

matters. 

Question 113 (p. 4): In an August Q&A at the University of Georgia, you stated that 

traditionally, Equifax has "owned (consumers'( credit data." You also mentioned the 

potential for a new regulatory model in which consumers own this data: "IT( here's going to 

be a time-and it's going to be sooner rather than later, because it's occurring in the U.K. 

right now-where through regulation, the U.K. regulators are saying, 'No, no. You no 

longer have the rights to own that data.'ff This appears to be a reference to the United 

Kingdom's planned 2018 implementation of the E.U. General Data Protection Regulation 

(GDPR). The GDPR grants consumers several rights that do not exist under current U.S. 

law, intluding the right to make companies delete their personal data. Rather than 

characterizing this new legal regime as an insurmountable obstacle for Equifax, you 

championed the tecllnologieal responses Equifax could take and framed the regulatory 

change as a potential "opportunity." This is consistent with the tone of a short article by 

2 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 
49 


10417005.eps

1nVl)J .Pt."lltt, Olef Compliance Officer at Equifax (entitled "The Future of Data 

l'rotectioo'?, which states that companies must be "ready" for GDPR compliance. How 

'lri.ll Equ1fax's U.K. businesses ad.apt to be "ready" for the GDPR? 

A: Equi~'s cumnt analysis indicates that its U.S. operations do not process data that is 

s~ect !0 ihe ex,merritorial application of GDPR. As such, Equifax is taking measures 

to C6!'Jllli'J with li1> contractual obtigatiol!S under data processing agreements with data 

controllers or processors that have indicated that the data they provide to Equifax for 

processing in the U.S. is subject to GDPR. 

In the U.K., Equifax has been investing and working on its GDPR compliance project 

since 2016, including following the 12-step approach as outlined and promoted by the 

U.K. data protection regulator, the Information Commissioner's Office C'ICO"). 

These actions include reviewing and updating (as appropriate) contractualammgements 

with clients, suppliers, and processors with up-to-date GDPR contractual terms and 

ensuring contractual terms include cooperation and assistance provisiol!S between the 

parties so that Data Subject Rights (including the right of erasure) can be fulfilled where 

appropriate and required. 

In addition, regarding the right of erasure, Equifax is working on a joint exercise with the 

other U.K. CRAs, the !CO and key financial services clients to implement a standard 

U.K. Credit Reference Agency Information Notice ("CRAIN") that all credit data sharers 

will utilize in their interactions with their customers post-GDPR. This standard will help 

ensure the ongoing, lawful sharing and processing of credit report infonnation. 

In Iberia, Equifax has also been working on its GDPR compliance project since 2016. In 

common with the U.K., this activity includes reviewing and updating (as appropriate) 

contractual ammgernents with clients, suppliers, and processors with up-to-date GDPR 

contractual terms. In addition to the requirements of the GDPR, a fonhcoming Spanish 

data protection regulation will affect the business. 

The review of operations includes the right of erasure in respect of both "negative" 

(missed payments) and "positive" bureau data, to which different procedures apply. 

Equifax is taking the necess&l)' steps toward achieving compliance with GDPR on or 

before the May 2018 deadline. 

Question #9 (p. 4): Do you bdieve that if the United States adopted a legal framework in 

which consumers own their data and can make companies erase it, Equifax could adapt to 

those ehanges? You may explain your answer, but please state an ultimate "yes" or "no" 

conelusion. If the answer is no, please explain why Equifax's U.K. business will survive the 

U.K. implementation of the GDPR but Equifax's U.S. business could not withstand a 

similar change in U.S. law. 

3 

CONFIDENfiAL TREA TMENf REQUESTED BY EQUIFAX INC. 
50 


10417006.eps

A: Harmonizing data protection standards could eliminate some of the friction in doing 

business across borders, and lead to synergies that could ultimately benefit consumers. 

Equifax is committed to the best interests of conswneJS, including data protection, in 

every aspect of its global operations. Equifax would gladly participate in discussions 

with the goal of bringing data protection standards in the U.S. and the EU closer together. 

In your testimony, you claimfd that Equifax is a "vital part" of "the g!ob1l e«~nomy" 1nd 

"provide(s( a great service to tbe consumer, enabling them to get access to credit" In your 

August Q&A at tbe University of Georgia, you stated that Equifax does not enter some 

markets because of an unfavorable regulatory en~ironment. 

Question #10 (p. 4): Are there countries with well-developed consumer credit 

markets where Equifax maintains no presence? 

A: Equifax operates or has investments in 24 countries in North America, Central 

and South America, Europe, and the Asia Paciftc region. These countries 

represent both developed and emerging markets with credit economies at various 

levels of maturity. There are several countries in which Equifax does not operate 

that have established credit markets, many of which are in Europe and Asia 

Question #12 (p. 4): It is a stated priority of the Consumer Data Industry Association, of 

wbicb Equifax is a member; to get consumers out of payday loans and into tbe regulated 

banking industry. Does Equifax support the CFPB's payday-loans rule? 

A: Equifax does not oppose or support the CFPB's payday-loans rule. Equifax submitted 

constructive comments to assist the Bureau in its regulatory promulgation. These 

comments focused on the proposed Registered lnfonnarion System and the ability-to· 

repay provisions. Per tbe CFPB's request, Equifax also participated in ex parte 

communications with the Bureau to provide insight and feedback on the proposed rule's 

requirements. 

Senator Cassidy and Senator Brown wrote to the Social Security Administration (SSA) to 

ask wbethe.r Social Security numbers in the SSA's E-ID Verify program, which is run by 

Equifax, were compromised. According to tbe SSA, Equifax stated that it "found no 

evidence that this incident impacted any information provided to Equifax by tbe (SSA)." 

The day before the hearing, Politico reported that Eqaifax was being granted a 

multimillion-dollar fraud-prevention contract with the IRS. This means that two federal 

agencies responsible for safeguarding Americans' most sensitive information are relying on 

Equifax to protect this information. It took E~uifax months to discover and a11ess the · 

breach that exposed 145.5 million Americans' Social Security numbers and other personal 

information to identity thieves. Additionally, security expert Brian Krebs reports that 

"Equifax's poor security contributed to an epidemic of tax refund fraud at the IRS in the 

2015 and 2016 tax years, when fraudsters took advantage of weak security questions 

provided to the IRS by Equifax to file and claim phony tax refund requests on behalf of 

hundreds of thousands of taxpayers." 

4 

CONFIDENTIAL TREATMENT REQUESTED BY EQUlFAX !NC. 
51 


10417007.eps

Question #13 (p. 4): How can we trust that contracting with Equifax does not put 

tbe IRS and SSA-and Americans' most sensitive personal information-at risk for 

future breaches? WiU Equlfax be implementing additional security procedures? 

A: Equifax remains confident in its ability to provide services to the IRS and 

SSA. Equifax has taken important steps to improve its data security 

infrastructure. It is further hardening its networks, changing its procedures to 

require "closed loop" confl!Dlation when software patches are applied, rolling out 

new vulnerability detection tools, and strengthening accountability 

mechanisms. Equifax has implemented cenain technological remediation steps as 

described in the Mandiant executive summary, which was submitted to this 

Committee on October I, 2017. Equifax has also engaged PwC to assist with its 

securicy program. including strategic remediation and transformation initiatives 

that will help Equifax identify and implement solutions to strengthen its long·term 

data protection and cyber security posture. 

Question #14 (p. 4): Please tist all Equifax consumer products for which the contract, 

terms of service, or any other agreement contains a forced·arbitration clause. 

A: Equifax has over 50 direct·to-consumer products that provide consumers with a wide 

variecy of credit monitoring features, identity theft protections, and other credit report 

services through both subscription-based and transactional, one·time offerings. This 

includes products sold under the Equifax, Trusted!D (including co-branded partner 

products), and 10 Watchdog brands. 

AU Equifax direct·to-consumer products described above currently contain an arbitration 

provision in the product Terms of Use, except for the following specific products: 

• TrustediD Premier - a complimentary identity theft protection and credit file 

monitoring product offered to all U.S. consumer.; 

• TrustediD Essentials-a Trusted!D credit monitoring product 

• Equifax CreditWatchTM Gold with 3-in-1 Monitoring - a complimentary 

identity theft protection and credit file monitoring product offered via direct mail 

for consumers without online access 

• Comerica IDMonitor- a TrustediD-supported partner credit monitoring product 

• AARP® Identity Theft Protection - a Trusted!D-supported partner credit 

monitoring product 

Enrolling in Trusted!D Premier, which is being offered to U.S. consumers since the 

cybersecurity incident, does not prohibit consumer.; from taking legal action. Moreover, 

5 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 
52 


10417008.eps

the Terms of Use on www.equifax.com do not apply to the TrustedlD Premier product 

being offered to consumers as a result of the cybersecurity inciden~ and the arbitration 

provision included in those terms does not apply to claims related to the cybersecurity 

incident. 

Question #IS (p. S): Please list all Equifax consumer products for whith the contract, 

ttrms of serviu, or any otber agreement contains a forced-arbitration clause. 

A: Please see response to Question #14. 

Question #16 (p. 5): Do Equlfax's employment agreements or other arrangements with 

nonexecutive employees contain forced-ar~itration clauses? 

A: No. 

Question #17 (p. S): Will Equifax voluntarily remove forced-arbitration clauses from all of 

its consumer products? 

A: Equifax is not currently offering any subscription services to consumers for purchase. 

Equifax will not include an arbitration clause in connection with the forthcoming credit 

lock application that will be available in January 2018. 

Question #18 (p. 5): Is there any data that is so deeply personal or of such an intimate 

nature that Equifax ~ill not collect it, even if collecting the data were legal? 

A: Equifax does not have any standing principals that would prohibit it from collecting 

specific types of data where it is legal to do so. For each potential data elemen~ Equifax 

considers a number of factors about the data, including existing regulations, the ability to 

govern the quality and consistency, the availability of sufficient depth and coverage, and 

consumer benefit. Where the confluence of these factors leads Equifax to reject a data 

elemen~ Equifax manages its response centrally to ensure consistency among each 

business unit. 

Question #19 (p. 5): Federal filings show that before the breach, Equifax lobbied on a 

House bill that would thwart consumers' ability to hold consumer reporting agencies 

accountable for FCRA violations. Please describe any lobbying activity by Equifax, its 

affiliates, or its agents between July 1, 2017 and October 11,2017 (including the approval 

of lobbying expenditures and any meetings between lobbyists and lawmakers). In each 

case, please state (1) the date of the expenditure approval or meeting, as the case may be; 

(2) the bill, rule, or matter at issue; (3) the houses of Congress and federal agencies lobbied; 

(4) the indhidual(s) wbo made the decision to lobby; (S) when the individual(s) who made 

the decision to lobby became aware (a) of the "suspicious aclhity" to which you referred in 

your testimony and (b) that this suspicious activity may have exposed consumers' personal 

information; and (6) whether and when you and the current interim CEO became aware of 

the lobbying decision or meeting, as the case may be. 

6 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 
53 


10417009.eps

A: The chan below includes the meetings that Equifax participated with congressional 

offices related to Fair C!edit Reponing Act ("FCRA'~ refonn, or H.R.2359, for the time 

period of July I, 2017 through October II, 2017. During this period, Equifax 

participated in other lobbying activities such as preparing background documents, 

exchanging emails, and participating in conference calls. Following the annoWICement of 

the cyberseeurity incident on September 7, 2017, all communicttions related to H.R1359 

were limited to responding to inquiries. 

Meetin2Date Chamber 

Julv6 2017 House 

July 10,2017 Senate 

Julv 11,2017 Senate & House 

July 14 2017 Senate 

Aui!USI3, 2017 House 

AU2Ust 22, 2017 House 

Aui!USI23 2017 House 

Ausrust 30 2017 House 

Aui!USI31 2017 House 

Seotember 1 2017 House 

Sent ember 5, 2017 House 

Seotember 6 2017 House 

The Senior Vice President for External Affairs makes the decision to lobby on an issue 

and provides updates to the Legal Department nn a regular basis. The Chief Executive 

Officer was not made aware of individual meetings, lobbying activities or legislative 

objectives. The Senior Vice President for External Affairs was made aware of suspicious 

activity on August 23, 2017. Because of the sensitive nature of the inciden~ the Senior 

Vice President for External Affairs was prohibited from communicating this material, 

non-public information to others and has not participated in lobbying activity since 

August23,2017. 

Equifax provided notice of the cybersecurity incident to the lobbyists it employed on 

September 6, 2017. Notice of the cybersecurity incident was provided to external 

consultants and lobbyists on September 7, 2017. Expenditures for these meetings were 

limited to travel costs and salary for lobbyists employed by Equifax. External consultants 

and lobbyists are generally on monthly retainer arrangements and only reimbursed 

incidental, negligible costs for individual meetings. 

Question #20 (p. 5): Federal filings show that before the breacb, Equifax and the 

Consumer Data Industry Association lobbied on a Consumer Financial Protection Bureau 

rule that would prohibit forced arbitration in consumer contracts, including credit 

monitoring products like those Equifax offered after the breach. Please describe any 

lobbying activity by Equifax, its affiliates, or its agents between July I, 2017 and October 

7 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIF AX INC. 
54 


10417010.eps

11, 2017 (including the approval of lobbying expenditures and any meetings between 

lobb)ists and lawmakers). In eac,b case, please state (I) the date of the expenditure 

approval or meeting, as the case may be; (2) the bill, rule, or matter at issue; (3) the houses 

of Congress and federal agencies lobbied; (4) the individual(s) who made the decision to 

lobby; (S) when tbe individual(s) who made the dedsioo to lobby betame aware (a) of the 

"suspicious activity" to wbicb you referred in your testimony and (b) that this suspicious 

activity may have exposed consumers' personal iDformation; and (6) whf~ber and when 

you and the current interim CEO betame aware of tbe lobbying decision or meeting, as the 

case may be. 

A: Lobbyists employed by Equifax attended two industry-wide meetings on July II, 

2017 with the Senate regarding several topics impacting the credit reporting industry, 

including the use of arbitration agreements and House Joint Resolution Ill. Equifax also 

participated in industry-wide calls in which the topic of arbitration clauses was addressed. 

The Senior Vice President for External Affairs makes the decision to lobby on an issue 

and provides updates to the Legal Departmoot on a regular basis. The Chief Executive 

Officer was not made aware of individual meetings, lobbying activities or legislative 

objectives. The Senior Vice President for External Affairs was made aware of suspicious 

activity on August 23,2017. Because of the sensitive nature of the inciden~ the Senior 

Vice President for External Affairs was prohibited from communicating this material, 

non-public information to others and has not participated in lobbying activity since 

August 23,2017. 

Equifax provided notice of the cybersecurity incident to the lobbyists it employed on 

September 6, 2017. Notice of the cybersecurity incident was provided to external 

consultants and lobbyists on September 7, 2017. Expenditures for these meetings were 

limited to travel costs and salary for lobbyists employed by Equifax. External consultants 

and lobbyists are generally on monthly retainer arrangements and only reimbursed 

incidental, negligible costs for individual meetings. 

Question #21 (p. 6): Will Equifax commit to paying for consumers' credit Jocks or freezes 

at Experian and TransUoion? 

A: Equifax is committed to working with the ootire industry, including Experian and 

TransUnioo, to develop solutions 10 cybersecurity and data protection challenges we all 

face. Equifax is offering consumers Trusted!D Premier, a free package of services that it 

believes will substantially mitigate the risk of harm to consumm. Beginning at the end 

of January, consumers will have the ability to lock and unlock their Equifax credit repolt 

for free, for life. 

Question #27 (p. 7): On what dates did specific personnel and divisions become aware of 

the incident? 

s· CONFIDENTIAL TREATMENT REQUESTED BY EQUIF AX INC. 
55 


10417011.eps

A: On July 29, 2017 Equifax's security team observed suspicious network traffic 

associated with the U.S. consumer online dispute portal web application where 

consumers can upload documents or other information in support of a credit file dispute. 

In response, the security team investigated and immediately blocked the suspicious traffic 

that was identified. The security team continued to monitor network traffic and observed 

additional suspicious activity on July 30, 2017. In response, they took the web 

appliealion completely offline that day. 

CEO Richaro Smith was told about the suspicious activity the next day, July 31, in a 

conversation with the Chief Information Officer. At that time, Mr. Smith was informed 

that there was evidence of suspicious activity on the dispute portal and that the portal had 

been taken offline to address the potential issues. 

On August 2, consistent with its security incident response procedures, the Company (I) 

retained the cybersecurity group at the law fum of King & Spalding LLP to guide the 

investigation and provide legal and regulatory advice; (2) engaged, through company 

counsel, the independent cybersecurity forensic finn, Mandian~ to investigate the 

suspicious activity; and (3) contacted the Federal Bureau of Investigation ("FBI'l 

Over the next several weeks, Mandiant and Equifax's security department analyzed 

forensic data seeking to identify and understand these early indications of unauthorized 

activity on the network. Their task was to figure out what happened, what parts of the 

Equifax network were affected, identify consumers that were impacted, and what 

information was accessed or potentially acquired by the hackers. This effort included 

identifying and analyzing available forensic data to assess the attacker activity, 

determining the scope of the intrusion, and assessing whether the intrusion was ongoing 

(it was not; it had stopped on July 30, when the portal was taken offline). Mandiant also 

helped examine whether the data accessed contained personal identifying information 

("PII''), discover what data was exfiltrated from the company, and trace that data back to 

unique consumer information. 

By August II, the forensic investigation had determined that, in addition to dispute 

documents from the online web portal, the hackers may have accessed a database table 

containing a large amount of consumers' PII, and potentially other data tables. 

On August 17, Equifax senior leadership team met to receive a detailed briefing on the 

investigation. At ·that poin~ the forensic investigation had determined that there were 

large volumes of consumer data that had been compromised. The company had expert 

forensic and legal advice, and was mindful of the FBI's need to conduct its criminal 

investigation. 

On August 22, Equifax's presiding director of the Board of Directors, Mark Feidler, was 

notified of the data breach, as well as Mr. Smith's direc-t reports who headed up various 

business units. In special telephonic boazd meetings on August 24 and 25, the full Board 

of Directors was informed. Equifax also began developing the remediation needed to 

assist affected consumers, even as the investigatioo continued. 

9 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIF AX INC. 
56 


10417012.eps

By September 4, the investigative team had created a list of approximately 143 million 

consumers whose personal identifying information was believed to have been impacted, 

and Equifax continued its planning for a public announcement of a breach of that 

magnitude, which included a rollout of a comprehensive support package for consumers. 

The team continued its work on a dedicated website, www.equifaxsecurity2017.com, 

where consumers could learn whether they were impacted and fmd out more information, 

a dedicated call center to wist eons~rs with questions, and a free credit file 

monitoring and identity theft protection package for all U.S. consumers, regardless of 

whether they were impacted. 

On September 7, 2017, Equifax provided notification of the incident by issuing a 

nationwide press release, providing the dedicated website where consumers could 

determine if their personal identifying infonnation was impacted and sign up for the 

credit file monitoring and identity theft protection produc~ and providing a dedicated call 

center for consumers. The notification indicated that the incident impacted personal 

identifying information relating to approximately 143 million U.S. consumers, primarily 

including names, Social Security numbers, birth dates, addresses and, in some instances, 

driver's license numbers. On October 2, 2017, following the completion ofthe forensic 

portion of the investigation of the inciden~ Equifax announced that approximately 2.5 

million additional U.S. consumers were potentially impacted, for a total of 145.5 million. 

Question #28 (p. 7): On wbat dates were specific personnel informed that more than 

100,000; more tban 1,000,000; more tba.n 25,000,000; more than 50,000,000 and more tban 

100,000,000 consumers were affected? 

A: Please see response to question #27, which provides information about how Equifax 

became aware of the number of consumers affected. 

Question #29 (p. 7): How was tbe incident response proem coordinated internally between 

relevant divisions? 

A: Please see response to question #27. 

Question #31 (p. 7): When you and senior management ftrst learned of tbe breach, to 

whom and how was that information communicated, and were subsequent actions taken by 

you and other senior management? 

A: Please see response to question #27. 

Question #33 (p. 7): Please provide a description of the cybersecurity oversight and 

policies and procedures that Equifax had in place prior to the detection of the breach and 

updates or other changes the company bas instituted since. 

A: Equifax has a fonnalized security program supported by administtative, technical, 

and physical safeguards focused on the protection of consumer data. Equifax has a 

10 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIF AX INC. 
57 


10417013.eps

security team in place, which is responsible for the coordination and execution of the 

Company's infonnation security program. The security team reports to Equifax's Chief 

Security OffiCe! and operates using defmed plans and procedures for responding to 

security incidents, which are revised on a regular basis. Security incidents are classified 

according to severity and escalated to management personnel as appropriate. The 

security team includes dedicated incident response managers and a Cyber Threat Center, 

which is staffed by security professionals and uses technological capabilities to monitor 

the Company's network. Equifax has physical safeguards in place to secure its data 

centers. 

Equifax bas taken important steps to improve its data security infrastructure. It is further 

hardening its networks, changing its procedures to require "closed loop" confinnation 

when software patches are applied, rolling oot new vulnerability detection tools, and 

strengthening accountability mechanisms. Equifax has implemented certain 

technological remediation steps as described in the Mandiant executive summary, which 

was submitted to !his Committee on October I, 2017. Equifax has also engaged PwC to 

assist with its security program, including strategic remediation and transfonnation 

initiatives that will help Equifax identify and implement solutions to strengthen its long· 

term data protection and cyber security posture. 

Question #34 (p. 7): Please explain specifically how Equifax systems were breached, 

including how intruders w·ere able to enter Equifax's system, what vutnenbilities were 

exploited, how intruders were able to access data, and a list of all data sources, databases, 

or tables containing personally identifiable information that were accessed. 

A: Mandian~ a leading independent cybersecurity flllll, was engaged to investigate this 

incident. Mandiant has provided Equifax with an executive summary, a supplemental 

repo~ and a final supplement. For your reference, Equifax provided copies of the 

executive summary and supplemental report to the Committee on October I, 2017 and a 

copy of the final supplement to the Committee on October 6, 2017. 

Equifax's internal investigation of !his incident is ongoing and the Company continues to 

work closely with the FBI in its investigation. 

Question #35 (p. 7): Please provide a complete list of all types of personally identifiable 

information that was compromised. Pluse describe your long term plans to address risks 

and harm to consumer including any resources set aside for future compensation and 

remediation for victims. 

A: On September 7, 2017, Equifax publicly announced that the breach impacted personal 

infonnation primarily including names, Social Security numbers, birth dates, addresses 

and, in some instances, driver's license numbers. Credit card numbers and infolll1ation 

contained on dispute documents were also impacted for some consumers. Mandian~ a 

luding independent cybersecurity flllll, was engaged to investigate !his incident. 

Mandiant has provided Equifax with an executive summary, a supplemental report, and a 

II 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 
58 


10417014.eps

final supplement For your reference, Equifax provided eopies oflhe exeeutive SUJllJll81)' 

and supplemental report to the Committee on October I, 2017 and a eopy of the final 

supplement to the Committee on October 6, 2017. 

Equifax has implemented certain teehnological remediation steps as described in the 

Mandiant executive summary and the Company is worlcing wilh federal and state 

regulators, as well as consumer stakeholders, regarding remediation steps. 

12 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 
59 


10417015.eps

Questions for Mr. Richard F. Smith. Former Chairman and Chief Executive Officer of 

Equifax.lnc. from Senator Cortez Masto: 

Question #36 (p. 8): When can I expect a substantive response to my letter dated 

September lith, 2017 regarding Equifax's position on mandatory pre-dispute arbitration 

clauses and SJ. 47, Senate legislation seeking to nullify the Consumer Finaoc:ial Protection 

Bureau's rule limiting use of such clauses? 

A: Equifax is not currently offering any subscription services to consumers for 

purchase. Equifax will not include an arbitration clause in coMection with the 

forthcoming credit lock application that will be available in January 2018. 

Question #37 (p. 8): Equifax executives sold stock in the company on August I" and 

August 2'd. Per your testimony to the Senate, this stock sale was approved by Equifax's 

Chief Legal Counsel. Equifax also contacted the Federal Bureau of Iavestigations (FBI) 

and Mandiant on August 2'd. Was the Cbief Legal Counsel who approved of the stock 

sales also aware that the firm contemporaneously contacted the FBI and Mandiant? Did 

the Chief Legal Counsel approve any contracts with Mandiant related to the July 29th 

"suspicious traffic?" 

A: The Equifax Legal Department approvals of the referenced stock sales were n01 

made "contemporaneously" with the contacts with the FBI and Mandian~ as further 

explained below. 

The Board of Directors of Equifax released a report by a Special Committee of the Board 

of Directors regarding the trading of Company securities by certain executives following 

the detection by Equifax cybersecurity persoMel of suspicious activity in the Company's 

network and prior to public disclosure of the incident. A copy of the report by the 

Special Committee and aocompanying press release was provided to the Committee on 

November 3, 2017. A copy of that report is also enclosed with this submission. The 

report concludes that two of the executives whose trades were reviewed received 

clearance from Legal Department persoMel on July 31, 2017, and two other executives 

received Legal Department clearance on August I, 2017. 

Based on tlie early indications of suspicious activity, ·on August 2, 2017, (I) the 

Company's Senior Vice Presiden~ U.S. Legal-<m behalf of Equifax-retained the 

cybersecurity group at the law fmn of King & Spalding to guide the forensic 

investigation and provide legal and regulatory advice; (2) King & Spalding en~ed the 

independent cybersecurity forensic fmn, Mandian~ to aid in investigation of the 

suspicious activity; and (3) the Company contacted the FBI. It was not until later in 

August that the forensic investigation determined the hackers may have accessed a 

database table containing a large amount of consumers' Pll, and potentially other data 

tables. The Chief Legal Officer was not aware of these engagements or the contact of the 

FBI before they were made, but became aware of them after they occurred. 

13 

CONFIDENTIAL TREATMENT REQUESTED BY EQUlFAX INC. 
60 


10417016.eps

'J'he Chief Legal Officer was not involved in reviewing or approving the agreement with 

Mandiant. The Company's Vice President legal reviewed and approved the agreement 

Question #38 (p. 8): Wbat resources is Equifax making avtilable to ensure that community 

banks and credit unions are made whole as a result of this data breach? 

A: Following the announe.ement of the cyberSteurity incident, Equifax has met with and 

continues to work with community banks and credit unions to provide them infonnation 

about the cybersecurity incident and to respond to specific questions raised. Equifax also 

made available communication materials (i.e., FAQs) to the community banks and credit 

unions that provide iofonnation about the cybersecurity incident to their customers and 

members. Equifax continues to accommodate requests from community banks and credit 

unions to funher discuss the cybersecurity incident 

Question #40 (p. 8): What dividends did Equifax pay out to shareholders following 

knowledge of the data breach? Wby did Equifax elect to pay out dividends to shareholders 

given knowledge of the company's tremendous legal exposure and the harm eaused to 

consumers? 

A: Since the Company's security team discovered the unauthorized access on July 29, it 

declared (1) a quarterly dividend on August 4, 2017 of $0.39 per share, which was paid 

on September 15, 2017, and (2) a quarterly dividend on November 9, 2017 of$0.39 per 

share, which is payable on December 15, 2017. Decisions regarding the declaration and 

payment of dividends depend on the Company's financial condition, earnings, prospects, 

current and furure funding requirements, applicable law, and other relevant factors. The 

dividends paid in 2017 reflect consideration of these factors. 

Question #41 (p. 8): Can Equifax provide data on the number of active duty 

servicemembers and seniors impacted by the data breach, broken down by state? 

A: Active duty status is not a data element that Equifax possesses. As a resul~ Equifax 

is unable to calculate the number of active duty servicemembers impacted by the breach. 

It is difficult to accurately assess the number of impacted seniors. The dates of binh 

included within the data associated with the cybersecurity incident consist of self· 

reported binh dates or not dates at all and as a resul~ the infonnation may not be reliable 

for pwposes of calculating the total number of seniors impacted by the incident For 

example, some dates in the data do not appear to reflect accurate dates of birth (e.g., 

IIlii III). 

14 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 
61 


10417017.eps

Questions for Mr. Richard F. Smith, Former Chtlrman and Chief Executive Officer of 

Eguifax, Inc. from Senator Robert Menendez: 

Question #46 (p. 10): Equifax shareholders ftled a resolution this year asking the company 

to disclose its political spending. Shareholdm were prompted by the fact that Equifax 

devotes significant corporate resources on politics without disclosing it to sharebolders.fl) 

In addition. Equifax does not disclose tbe money it gives to trade associations rueb as tbe 

Consumer Data Industry Association, which represents Equifax, Experian, and 

TransUnion, and bas lobbied against the Consumer Financial Protection Bureau's forced 

arbitration rule. In light of the significant drop to Equifax stock prices following the data 

breach, do you believe that shareholders deserve to know when Equifax is actively fighting 

consumer protections and accountability at the expense of shareholders? 

A: As described below and in Equifax's 2017 Proxy Statement, Equifax has disclosed 

appropriate infonnation regarding its political contributions and has an appropriate 

system of oversight in place, including a fonnal Political Contributions Policy and COde 

of Ethics, to ensure that its political contributions comply with applicable law and are in 

the best, long-term interests of the Company and its shareholders. 

• Equifax bas historically made an extremely limited number of political 

contributions of de minimis value. Equifax's political contributions are not 

financially material to the Company. In 2016,2015 and 2014, aggregate political 

contributions made direcdy by Equifax with corporate funds totaled 

approximately $1,500, $2,000, and $10,250, respectively. In 2016, Equifax's 

total expenses relating to political contributions were de minimis when compared 

to its total operating costs of approximately $2.3 billion. 

• Equifax is transparent and accountable regarding its political contributions. 

Equifax operates in a highly· regulated industly, and the decisions of federal, state 

and local governments can significantly impact the Company. On a limited basis, 

Equifax has pursued and will continue to pursue efforts to help infonn public 

policy decisions that have the potential to affect its industly, business, products, 

customers, employees, shareholders, and communities. 

Equifax pays annual membership dues to industry trade associations. The trade 

associations in which Equifax participates may engage in political activities, but such 

decisions are governed by those associations' respective bylaws. Thus, even when 

Equifax participates in trade associations, it does not control how they use membership 

dues. Equifax expects that these trade associations comply with applicable laws with 

respect to their political activities. Equifax believes that additional disclosure regarding 

the specific payments made to these trade associations would not benefit shareholders. 

• Significant disclosure regarding the Company's political activities and 

related policies is already publicly available. Please consider the following: 

15 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 
62 


10417018.eps

o Under federal law, all contributions by the Equifax Inc. Political Action 

Committee, the sole political action committee affiliated with the 

Company, are required to be reported, and a list of SIICh contributions is 

publicly available at the website of the United States Federal Election 

Commission. 

o As noted abov6, Equifox publicly discloses aggregat6 political 

contributions made directly by the Company with corporate funds for the 

most recendy completed fiscal year. Contributions made directly by 

Equifax are typically small in amount and most mquently made to localand state-level candidates. 

o Federal Jaw prohibits corporations from contributing corporate treasUI)' 

funds to federal candidates or federal campaign committees. Accordingly, 

Equifax makes none. 

o The Policy and the Code of Ethics are available on the "Corporate 

Governance" section ofEquifax's website. The Governance Committee's 

oversight of the Policy, the Guidelines and Equifax's political engagement 

activities is memorialized in the Committee's written charter, which is 

also available on the Company's website. 

Finally, the shareholder proposal described in the question above was presented at the last 

annual meeting of shareholders, held on May 4, 2017, and Equifax's shareholders chose 

not to approve the proposal. 

Question #47 (p. 10): Please describe tbe policies in plaee during your tenure as chief 

executive offieer pertaining to tbe permissibility of stock sales by senior management and 

leadership in near proximity to a significant announcement by the company. 

A: Equifax has in piaee an insider trading policy that sets forth procedures governing 

employees' trading in the Company's securities, including: 

(a) prohibiting all employees from trading while in possession of material, 

nonpublic infonnation; 

(b) permitting eertain individuals (including, among others, officers and directors) 

to trade only during specified trading windows that follow the public release of 

quarterly fmancial infonnation; and 

(c) with respect to certain designated individuals (including Section 16 reporting 

officers, as well as directors), pennining trades only after obtaining pre-approval 

from the office of the Company's chief legal officer or his or her designee. 

16 

CONFIDENTIAL TREATMEI\'T REQUESTED BY EQUIFAX INC. 
63 


10417019.eps

Equifax is producing a copy of this policy with this submission. The policy is Bates 

numbered EFXCONG·SBCOOOOOOOOl to EFXCONG-SBC000000014. 

Question #55 (p. 10): Please describe how active duty servicemembers were impacted by 

the data breach. 

A: Active duty starus is not a data elemm~t thAt &lui fax ~e$. A$ a resul~ Equifax 

is unable to calculate the number of active duty servicemembers thAt were impacted by 

the cybersecurity incident. However, based on the number of consumers that were 

impacted, it is highly likely that some were active duty servicemembers. Equifax's 

description of the incident and its impact on consumers would also apply to any active 

duty servicemembers that were impacted. 

Question #56 (p. II): How many active duty senietmembers were impacted by the data 

breach? 

A: Active duty status is not a data element that Equifax possesses. As a resul~ Equifax 

is unable to calculate the number of impacted active duty servicemembers. 

Question #57 (p. II): What sp«iflc actions is Equifax currently taking to identify active 

duty servicemembers and pro\ide appropriate remediation? 

A: Equifax is strongly committed to helping military service members. The company 

has been in direct communication with the Department of Defense and CFPB's Office of 

Servicemember Affairs, and is working on efforts to further educate servicemembers, 

including those impacted by the cybersecurity inciden~ regarding the incideru and the 

various options available to them, such as the free TrustediD Premier service, security 

freezes, and active duty alerts, as well as other relevant information. 

In addition, in response to the cybersecurity inciden~ Equifax developed a robust package 

of remedial protections for each and every American consumer - not just those affected 

by the breach - to protect their credit information. The relief package includes (I) 

monitoring of consumer credit files across all three bureaus, (2) access to Equifax credit 

files, (3) the ability to lock the Equifax credit file, (4) an insurance policy to cover out-of· 

pocket costs associated with identity theft, and (S} dark web scans for consumers' social 

security numbers. All five of these services are free and without cost to all Americans, 

including Veterans and servicemembers. 

Question #S& (p. II): In your opinion, to protect themselves from identity theft and fraud, 

how long do consumers impacted by the breach need a credit monitoring service? If longer 

than a year, will Equifax commit to providing such services at no cost to consumers 

impacted by tbe data breach? 

A: Equifax is offering consumers TrustedlD Premier, a free package of services that it 

believes will substantially mitigate the risk of harm to consumers. ·Beginning at the end 

17 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIF AX INC. 
64 


10417020.eps

of JanuaJy, consumers will have lhe ability to lock and unlock their Equifax credit report 

for free, for life. 

18 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 
65 


10417021.eps

Questions for Mr. Richard F. Smith, Former Chairman and Chief Executive Officer of 

Eguifax, Inc. from Senator Jack Reed: 

Question #60 (p. 12): Four days after announcing tbe cybersecurity breach, Equifax 

reversed itself by removing forced arbitration language from websites and products 

associated with the breach. If you concede that forced arbitration is bad for consumers you 

may have wronged, why doesn't Equifax stop using forud arbitration dAUSt$ln ooosumer contracts altogether? 

A: Equifax is not currently offering any subscription services to consumers for purchase. 

Equifax wiU not include an arbitration clause in coMection with the fonhcoming credit 

lock application that will be available in January 20 I 8. 

Question #61 (p. 12): Do you personally betieve that senior executives or shareholders 

should bear tbe costs associated with potential fines and penalties levied against Eqaifax 

for tbe cybersecurity breach, and wby do you bold this view? 

A: Mr. Smith has not had the opportunity to review your proposed legislation, but he 

believes it would be inappropriate to comment on the legislation or cost-sharing 

proposals in light of ongoing civil litigation relating to the 2017 breach. 

19 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIF AX INC. 
66 


10417022.eps

Questions for Mr. Richard F. Smith. Former Chairman and Chief Executive Officer of 

Eguifax, Inc. from Senator Btn Sasse: 

Question #70 (p. 13): Has Equifu updattd the "protoco ~ that let ooe person cause a 

mistake of this catastrophic magnitude? 

A: The brMeh oectllfed b6ca~U of both hum3J\ etror and tblhnology f.lilures. These 

mistakes were made in the same chain of security systems designed with rtdundancies. 

Equifax has implementtd several updates to protocols and proctdures in response to this 

incident. Vulnerability scanning and patch management processes and proctdures have 

been enhanced. The srope of sensitive data retaintd in backend databases has been 

rtductd so as to minimize the risk of loss. Restrictions and controls for accessing data 

houstd within critical databases have been strenglhentd. Network segmentation has been 

increased to restrict access from internet facing systems to backend databases and data 

stores. Additional web application f~rewalls have been deployed, and tuning signatures 

designed to block attacks have been added. Deployment of file integrity monitoring 

technologies on application and web servers has been accelerattd. The Company is also 

implementing additional network, application, database, and system-level logging. These 

are just a few of the steps Equifax has taken since the breach was discovertd to shore up 

its security protocols. 

Importantly, Equifax's forensic consultants have reconunended a series of improvements 

that are being installtd over 30, 60, and 90 day periods. Equifax has also engaged PwC 

to assist with its security program, including strategic remediation and transformation 

initiatives that will help Equifax identify and implement solutions to strengthen its longterm data protectioo and cyber security posture. 

Beyond the technological enhancements, Equifax bas also made several strategic 

personnel changes at the highest levels of the company since September 7, 2017. The 

CEO stepped down and the Chief Information Offtcer and Chief Security Officer also 

resigntd from their positions. 

Question #71 (p. 13): Is the person who failtd to update the patch still employtd at 

Equifax? 

A: The individual who oversaw the team responsible for patching the relevant Apache 

Struts vulnerability on software supporting Equifax's online disputes pottal is no looger 

employed by Equifax. 

Question #72 (p. 13): Who was directly responsible for overseeing the employee at iS!ue 

and ensuring tbat the security scanning system was functioning? Is this person still 

employtd at Equlfax? 

20 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIF AX INC. 
67 


10417023.eps

A: At the time the breach was discovered, David Webb was Equifax's Chief Information 

Officer and Susan Mauldin was Equifax's Chief Security Officer. The individual who 

ovenaw the team responsible for patching the relevant Apache Struts vulnerability on 

software supporting Equifax's online disputes portal reported to Mr. Webb. Both Mr. 

Webb and Ms. Mauldin resigned from their positions, effective September 15, 2017. 

Question #74 (ji. 13)i If you had retired at the same lim~ but Equlfax had not allowed this 

massive breach, bow much compensation would you have received in 2016,2017, and upon 

'retirement? 

A: Mr. Smith is unable to predict his 2017 compensation under this scenario, as the 

Board of Directo~ compensation committee tied his compensation to align with company 

perfonnance and it would, therefore, be difficult to predict in light of the breach. His 

compensation from 2016 and retirement benefits are detailed in the Company's SEC 

filings. 

Question #75 (p.13): How much compensation will you be receiving instead for 2016,2017, 

and upon retirement? 

A: When Mr. Smith retired, he chooe not take a bonus. He also volunteered to serve as 

an unpaid advisor for the company, helping the Board of Directo~ and the management 

team for as long as they require, for free. Ultimately, when he retired, he asked for 

nothing beyond what he had earned up to the date of his retiremen~ which he has 

accumulated over his career. 

Question #76 (p. 13): WIU you receive any compensation that is legally eligible for 

dawback? 

A: The Company's clawback policy is outlined in the public proxy statement available 

on Equifax's website. The Board of Diretto~ is currently conducting a review, which is 

ongoing. 

Question #79 (p. 13): Will you commit to not accepting any compensation that is legally 

eligible for dawback? 

A: Mr. Smith's compensation structure was determined by an independent committee of 

the Board of Directors, elected by the Company shareholders, and was aligned with the 

perfonnance of the company. The Company's clawback policy is available in its proxy 

statement. Mr. Smith notes that there has been no restatement of the Company's 

fmancial statements nor is there any indication that such a restatement is in order. 

Question #84 (p. 14): It has been reported that there was a cyber breach at Equifax in 

March and that Equifax hired a security firm called Mandiant to investigate the matter. 

Why did Equifax fail to report this breach in any SEC filing? 

21 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIF AX INC. 
68 


10417024.eps

A: The events referred to in this question appear to reference fraud incidents experienced 

by TALX Corporation, a wholly-owned subsidiary of Equifax. TALX Corporation, 

operating under the trade name Equifax Workforce Solutions, provides human resowces, 

payroll, tax management, and compliance services. These fraud incidents were not 

related to the recent cybersecurity incident (see, in pertinent part, Mandiant's 

supplemental report). A briefbackground summary of these fraud incidents follows: 

• TALX experienced fraud incidents during Spring 2016 and Spring 2017. 

• During the Spring of 2016, fraudsters used personal information obtained from nonEquifax sources to access employee accounts that used personally identifiable 

information for the user 10 (e.g., Social Seeurity numbers) and personal information 

for the related default PIN (e.g., the last four digits of a Social Security number or a 

year of birth). In response to the 2016 unauthorized access, TALX added an 

additional layer of authentication for the 2017 tax season so that no individual could 

log into the system using a default PIN containing personally identifiable infonnation. 

The revised process included knowledge-based authentication f'KBA "). 

• During the Spring of 2017, TALX received reports of unauthorized access to 

individuals' W-2s contained within TALX's online platform. This incident did not 

involve any hacking of Equifax systems, and there was no mass ex filtration of data. 

While TALX was combatting these fraud cases in 2017, TALX made modifications 

to the KBA configuration in order to make it more difficult to pass. On a moving 

forward basis, T ALX is continuing to modify its authentication protocol. 

• As Maodiant concluded, the fraud incidents involving TALX are different from and 

unrelated to the recently announced cybersecurity incident. 

Question #86 (p.l4): When did Equifax first learn of the May2017 breach? 

A: Please see response to question #27. 

Question #87 (p.l4): When did Equifax Inform the FBI ofthe breach? 

A: Please see response to question #27. 

Question #88 (p. 14): When did Equifax inform the Board of Directors of the breath? 

A: Please see response to question #27. 

Question #89 (p.l4): When did the Equifax executives trade their Equlfax stock? 

A: The Board of Directors of Equifax released a report by a Special Committee of the 

Board of Directors regarding the trading of Company securities by certain executives 

following the detection by Equifax cybersecurity personnel of suspicious activity in the 

22 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 
69 


10417025.eps

Company's network and prior to public disclosure of the incident A copy of the report 

by the Special Committee and accompanying press release was provided to the 

Committee on November 3, 2017. A copy of that report is also enclosed with this 

submission. 

Question 1190 (p. 14): When did the executives at issue express their intent to seU Equifax 

stock? 

A: Please see response to question #89. 

Question 1191 (p. 14): What process did the executives have to follow in order to complete 

the trade? 

A: Please see response to question #89. 

Question 1m (p. 14): What evidence does Equifax have that suggests that the executives 

did not know about the breach at the time ofthe trade? 

A: Please see response to question #89. 

Question 1193 (p. 14): My understanding is that Eqllifax's Chief Legal Officer, John Kelley, 

bad to approve the trades at issue. Is that correct? 

A: Please see response to question #89. 

23 

CONFIDENTIAL TREATMENT REQUESTED BY EQU1F AX INC. 
70 


10417026.eps

Questions for Mr. Richard F. Smith, Former Chairman and Chief Executive Officer of 

Egulfax, Inc. from Senator Richard Shelby: 

Question #95 (p. IS): What were the internal controls at Equifax that allowed one person's 

mistake to leak over 140 mlllion American's data? 

A: The breach ocMred because of both human error and technology failures. These 

mis1akes were made in the same chain of security systems designed with redundancies. 

Equifax is conducting an investigation related to the incident announced on September 7, 

2017 and is dedicated to resolving any issues identified as a result of that investigation. 

Equifax has implemented certain technological remediation steps as described in the 

Mandiant executive summary, which was submitted to this Committee on October I, 

2017. 

Question #96 (p. IS): In your opinion, was the chain of command appropriately organized 

if one person's error could cause this massive breach? 

A: Since discovering the breach, Equifax has improved its patching procedures to require 

a "closed loop" confirmation that necessary patches have been applied, rolled out a new 

scanner to identify vulnerabilities, upgraded its security technology, and increased 

accountability mechanisms for Equifax Security team members. 

Question #98 (p. 15): Did Equifax have a contingency plan in place to respond to data 

theft? 

A: As of May 2017 the Company had in place, and had tested, several plans to address 

cybersecurity incidents and various types of crises, which include but are not limited to 

the following: 

• A Security Incident Handling Policy & Procedures documen~ which dates back to 

2008, and a Security and Safety Crisis Action Plan document, which dates back to 

2013. These guides and plans were in place in May 2017 and have been updated 

and refined over time, including changes to the titles of the operative documents. 

In June 2017, prior to Equifax's detection of suspicious activity related to the 

cybmecurity inciden~ the company conducted a table-top test exercise of the 

"Security Incident Handling Policy & Procedures." That test focused on the 

company's Cyber Threat Center (''CTC'1 managing a newly announced Microsoft 

vulnerability. 

• A Crisis Management Plan (''CMP"), Parts I and U that has been in place dating 

back to 2013. The CMP plan covers a variety of crises, including dala breaches. 

A table·top test exercise of this plan was perfonned in June 2016, including a 

scenario that involved data security incident components. 

24 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIF AX INC. 
71 


10417027.eps

• A Crisis Action Team ("CAT'') Plan specific to certain geographic regions within 

the Company. The CAT plan, like the CMP described above, cover.; a variety of 

crises, including data breaches. Table-top tests are also conducted for these plans, 

including scenarios involving data security incident components. The Southeast 

Crisis Action Team plan, for example, was activated in Man:h 2017 in order to 

run an actual test of the plan. 

Equifax faces numerous cyber threats every day. Its ere constantly assesses whether a 

particular threat can be resolved quickly by the Company's own internal cybersecurity 

team, or whether the threat will require additional resources to remediate. If the ere 

determines that a cyber.;ecurity threat is unusual and will require additional resources to 

contain, it is typically designated a "Security lnciden~" and Equifax's response outlined 

in the Security Incident Handling Policy & Procedures is triggered. 

As set forth in the Security Incident Handling Policy & Procedures, once a Security 

Incident has been declared, its severity is classified based on a risk assessment including: 

• number of affected systems; 

• network impact; 

• business services impact; 

• sensitivity of information threatened or compromised; and 

• the potential for hann. 

Various senior officers, including those within the Legal Department, are notified by 

security of Security Incidents and typically outside expertS are retained (e.g., a forensic 

team and outside counsel) to assist with the response. 

There is an ongoing root cause investigation into multiple issues, including compliance 

with Equifax's plans and procedure guides. 

Question #99 (p. IS): Why was Equifax not til king action to prevent this type of attack in 

March, when it was first alerted about potential vulnerabilities? 

A: On Man:h 9, 2017, Equifax disseminated the U.S. Department of Homeland Security, 

Computer Emergency Readiness Team f'U.S. CERl") notifiCation internally by email 

requesting that applicable per.;onnel responsible for an Apache Struts installation upgrade 

their software. Consistent with Equifax's patching poticy, the Equifax security 

department required that patching occur within a 48 hour time period. Equifax now 

knows that the vulnerable version of Apache Struts within Equifax was not identified or 

patcbed in response to the internal March 9 notification to iofonnation technology 

personnel. 

25 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIF AX INC. 
72 


10417028.eps

On March 15, 2017, Equifax's infonnatioo security depa111Dent ran scans that should 

have identified any systems that were vulnerable to the Apache Struts issue identified by 

U.S. CERT. Unfortunately, however, the scans did not identify the Apache Struts 

vulnerability. Equifax's efforts undertaken in March 2017 did not identify any versions 

of Apache Struts that were subject to this vulnerability. 

Equifax is conducting an investigation related to the incident announced on September 7, 

2017 and is dedicated to resolving any issues identified as a result of that investigation. 

26 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIF AX INC. 
73 


10417029.eps

Questions for Mr. Richard F. Smith, Former Chairman and Chief Executive Officer of 

Eguifax, Inc. from Senator Cbris Van Hollen: 

Question #101 (p. 16): Federal filings show that before the breach, Equifax and the 

Consumer Data Industry Association lobbied on a Consumer Financial Protection Bureau 

rule that would prohibit forced arbitration in consumer contracts, including credit 

monitoring products like those Equifax offered after the breacb. Please describe any 

lobbying activity by Equifax, its affiliates, or its agents between July I, 2017 and October 

11, 2017 (including the approval of lobbying expenditures and any meetings between 

lobbyists and lawmakers). In each case, please state (I) the date of the expenditure 

approval or meeting, as the case may be; (2) the bit~ rule, or matter at issue; (3) the houses 

of Congress and federal agencies lobbied; (4) the individual(s) who made the decision to 

lobby; (S) when the individual(s) who made the dedsion to lobby became aware (a) of the 

"suspicious activity" to whieb you referred in your testimony and (b) that this suspicious 

activity may have exposed consumers' personal information; and (6) whether and when 

you and the current interim CEO became aware of the lobb)ing decision or meeting, as the 

case maybe. 

A: Please see response to question #20. 

Question #102 (p. 16): Can you also list all other instances where Equifax, its affiliates 

lobbies against the CFPB's Mandatory arbitration rule? 

A: Please see response 10 question #20. 

27 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIF AX INC. 
74 


10417030.eps

Questions for Mr. Richard F. Smltb, Former Chairman and Cbief Executive Officer of 

Eguifax. Inc. from Senator Elizabeth Wamn: 

Question #103 (p. 17): Wbat was tbe preciseextent of !be breach? 

A: As part of the inciden~ the artackers were able to acoess records ac.ross numerous 

tables with inconsistent scbemas. The forensic investigation was able to standSIIlize 

columns containing various types of sensitive information (listed below}. These 

represent the data fields across artacker·accessed tables that were identified as potentially 

containing PII. The list of data elements is not exhaustive of all possible data elements in 

a given table, but instead represents the common PO data elements in the attacker queries. 

With the fortgoing in mind, the list of data elements is as follows: 

• SSN 

• FirstName 

• LastName 

• Middle Name 

• Suffix 

• Gender 

• Address 

• Address2 

• City 

• State 

• ZIP 

• Phone 

• Phone2 

• DL# 

• DL License State 

• DL Issued Date 

• D.O.B. 

• Canada SIN 

• Passport# 

• CCNumber 

• Exp Date 

• CV2 

• TaxiD 

• Email Address 

• FullName 

Mandian~ a leading independent cybersecwity firm, was engaged to investigate this 

incident. Mandiant has provided Equifax with an executive sununary, a supplemental 

repo~ and a final supplement. For your reference, Equifax provided copies of the 

28 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 
75 


10417031.eps

executive summary and supplemental repon to the Committee on Ottober I, 2017 and a 

copy of the flll8l supplement to the Committee on October 6, 2017. 

Question #108 (p. 17): Your prm release indicates that "certain dispute documents with 

personal identifying information" were accessed for 182,000 U.S. customers. Exactly what 

kinds of documents were accemd? 

A: The dispute documents accessed in this breach were documents that consumers 

uploaded to Equifax's online credit dispute ponal. As a national credit reponing agency, 

Equifax has a statu!Ol)' obligation to facilitate disputes between consumers and their 

creditors. The documents at issue were documents that consumers uploaded to Equifax 

in suppon of a credit file dispute. The documents and information contained in the 

documents varied by consumer, and some documents may have contained sensitive 

personal infonnation. Consumers received a list of the documents, and the date those 

documents were uploaded, with the direct mail notifications. 

Question #109 (p. 17): Were any other kinds of document or information accmed besides 

names, Social Security numbers, birth dates, addresses, driver's license numbers, credit 

card numbers, and "certain dispute documents"? If yes, what type of documents, and bow 

many U.S. consumers were affected? 

A: Please see response to Question #I 03. 

Question #110 (p. 17): What does Equifax mean when the company says that "the incident 

potentially impacts" personal information? Was information merely exposed to backers, 

or were backers able to exploit and exfiltrate any personal information? 

A: Please see response to Question #103, 108, and 109. 

Question #112 (p. 18): Has the company identified the backers? Is there reason to believe 

that they are State actors? 

A: Equifax is not aware of evidence sufficient for attribution, but has shared evidence 

with law enforcement for the investigation of the criminal conduct 

Quesiton #113 (p. 18): How, preclsely, was· the personal data that was exposed to the 

hackers stored and protected? Was this data stored on an internet-accessible outwardfacing database? 

A: Please see the Mandiant executive summary, supplemental report, and fwl 

supplement Equifax is conducting an investigation related to the incident announced on 

September 7, 2017 and is dedicated to resolving any issues identified as a result of that 

investigation. Equifax is also currently undenaking a separate assessment of its security 

program, which may result in additional improvements to or refmements of the existing 

29 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 
76 


10417032.eps

procedures. The Special Committee continues to review the cybersecurity incident, the 

Company's response to it, and all relevant policies and practices. 

Question #114 (p. 18): Was the personal information of millions of Americans encrypted in 

any way? If not, has Equifax begun to u~ encryption in light of the recent breach? 

A: Please see the Mandiant executive summazy, supplemenral report, and final 

supplement. Equifax is conducting an investigation related to the incident announced on 

September 7, 2017 and is dedicated to resolving any issues identified as a result of that 

investigation. Equifax has also engaged PwC to assist with its security program, 

including strategic remediation and transfonnation initiatives that will help Equifax 

identify and implement solutions to strengthen its long-tenn data protection and cyber 

security posture. 

Question #115 (p. 18): Did the hackers acoess the data directly via the Apache Struts 

vulnerability, or were the hackers able to jump from the initial breached system to the 

corporate network to get that information? If so, bow did this occur? 

A: Please see the Mandiant executive summary, supplemental report, and final 

supplement. Equifax is conducting an investigation related to the incident announced on 

September 7, 2017 and is dedicated to resolving any issues identified as a result of that 

investigation. Equifax is also currently undertaking a separate assessment of its security 

program, which may result in additional improvements to or refmements of the existing 

procedures. Tbe Special Committee continues to review the cybersecurity incident, the 

Company's response to it, and all relevant policies and practices. 

Question #116 (p. 19): What steps did Equifax take to patch Apache Struts beginning in 

March 2017? Please provide a detailed timeline of all work on this patch from March 2017 

to the present. 

A: On March 8, 2017, U.S. CERTsent Equifax and many others a notice of the need to 

patch a particular vulnerability in certain versions of software used by other businesses. 

Equifax used that software, which is called "Apache Struts," in its online disputes portal, 

a website wbere consumers can dispute items on tbeir credit report. 

On March 9, 2017 Equifax disseminated the U.S. CERT notification internally by email 

requesting that applicable personnel responsible for an Apache Struts installation upgrade 

their software. Consistent with Equifax's patching policy, the Equifax security 

department required that patching occur within a 48 hour time period. Equifax now 

knows that the vulnerable version of Apache Struts within Equifax was not identified or 

patched in response to the internal March 9 notification to infonnation technology 

personnel. 

On Marth 15, 2011 Equifax's infonnation security department ran scans that should have 

identified any systems that were vulnerable to the Apache Struts issue identified by U.S. 

30 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 
77 


10417033.eps

CERT. Unfortunately, the scans did not identify the Apaebe Struts vulnerability. 

Equifax's efforts undertaken in March 2017 did not identify any versions of Apache 

Struts that were subject to this vulnerability. Equifax's investigation into these issues is 

ongoing, but the Company knows that it was this unpatched vulnerabitity that allowed 

hackers to access personal identifying infonnation. 

On July 29, 2017, Equifax's security depa11ment ()bserved suspicioos network uaffic 

associated with the consumer dispute website (where consumers could investigate and 

contest issues with their credit reports). In response, the security department investigated 

and immediately blocked the suspicious uaffic that was identified. The department 

continued to monitor network uaffic and ob.lerved additional suspicious activity on July 

30, 2017. In response, they took the web application completely offline that day and 

patched the relevant vulnerability before the web application was later brought back 

online. 

Equifax is conducting an investigation related to the incident announced on September 7, 

2017 and is dedicated to resolving any issues identified as a result of that investigation. 

Equifax bas implemented certain technological remediation steps as described in the 

Mandiant executive summary, which was submitted to this Committee on October I, 

2017. 

Question #117 (p.l9): Your testimony states that Eqoifax's security department •required 

that patching occur" within 48 hours. What did Equifax do to require patching? 

A: Please see response to question # 116. 

Question #118 (p. 19): Did executives follow up with system users in the following 1neks to 

ensure that the patching had occurred? 

A: Please see response to question #116. 

Question #119 (p. 19): Did Equifax mooitor its systems to ensure that patching bad 

occurred? 

A: Please see response to question #116. 

Question #120 (p. 19): Did Equifax do anything besides contact system users as part of its 

efforts to "require" patching of the Apache Struts vulnerability? 

A: Please see response to question # 116. 

Question #121 (p. 19): What safeguards did Equifax hm in place to protect against 

vulnerabilities in tbe event that all users did not immediately patch an Identified weakness? 

What safeguards has Equifax put in place since this breach? 

31 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 
78 


10417034.eps

A: Please see response to question #33. 

Question #122 (p. 19): How have Equifax's protocols and procedures for respoading to an 

identified vulnerability changed since this breach? 

A: Since discovering the breach, Equifax has improved its patching procedures to require 

a "closed loop" confinnation that necessary patches have been applied, rolled out a new 

scanner to identify vulnerabilities, upgraded its security technology, and increased 

accountability mechanisms for Equifax Security team members. 

Equifax has also engaged PwC to assist with its security program, including strategic 

remediation and transfonnation initiatives that will help Equifax identify and implement 

solutions to strengthen its long-tenn data protection and cyber security posture. 

Question #123 (p.19): Which executive in the company was responsible for ensuring that 

this patch was successfully installed? 

A: Please see responses to questions#?! and #72. 

Question #124 (p. 19): Was the Apache Struts weakness the oaly vulnerability that was 

exploited by the backers, or bas Equifax identified any other weaknesses or vulnerabilities 

in your cybersecurity system? If so, what were these vulnerabilities ud have they been 

resolved? 

A: Mandiant, a leading independent cybersecurity fum, was engaged to investigate this 

incident Mandiant has provided Equifax with an executive Sllll1JlW)', a supplemental 

report, and a fmal supplement. For your reference, Equifax provided copies of the 

executive summary and supplemental report to the Committee on October I, 2017 and a 

copy of the final supplement to the Committee on Octtlber 6, 2017. 

Equifax's internal investigation of this incident is ongoing and the Company continues to 

work closely with the FBI in its investigation. 

Question #125 (p.19): Has Equifax investigated why and how these scans failed to identify 

the continuing vulnerability? If so, what has the investigation determined? 

A: Equifax is conducting an investigation related to the incident announced on 

September 1, 2017 and is dedicated to resolving any issues identified as a result of that 

investigation. Equifax has implemented certain technological remediation steps as 

described in the Mandiant executive summary, a supplemental report, and a final 

supplement. For your reference, Equifax provided copies of the executive summary and 

supplemental report to the Committee on October I, 2017 and a copy of the final 

supplement to the Committee on October 6, 2017. 

32 

CONFIDENTIAL TREATMENT REQUESTED BY EQUlf AX INC. 
79 


10417035.eps

Question #127 (p. 19): Has Equifax performed a full evaluation of its security department 

to determine whether this and other automated security measures are fully functioning? 

A: Equifax bas engaged PwC to assist with iiS security program, including strategic 

remediation and transfonnation initiatives that will help Equifax identify and implement 

solutions to strengthen iiS long-tenn data protection and cyber security posture. 

Question #128 (p. 20): Did Equifax have safeguards in place to prevent against 

catastrophic consequences in the event of a failed scan? If not, bas Equifax put such 

measures in place since the breach occurred? 

A: Please see responses to questions #33 and #70. 

Question #129 (p. 20): How have Equifax's protocols and procedures for running scans to 

determine if a vulnerability has been patched changed since the breach? 

A: Please see response to question #70. 

Question #130 (p. 20): Did Equifax consider notifying consumers of a potential breach of 

their personal information before September 7th? 

A: Please see response to question #21. 

Question #131 (p. 20): Why did Equifax decide not to give consumers an initial disclosure 

regarding the potential impacts of the breach that would have allowed them to take 

precautionary measures to protect themselves? 

A: Please see response to question #27. 

Question #132 (p. 20): More than two months after the breach, Equifax revised the 

estimated number of individuals impacted from 143 million to 145.5 mi!Uon. Given that 40 

days elapsed between the discovery of the breach and the initial announcement, bow did 

Equifax miscount the number of affected indMduals? 

A: As noted in the September 7, 2017 press release, the work to determine the scope of 

the intrusion was substantially complete, but remained ongoing. As part of that work, 

Mandiant, a leading independent cybersecurity finn, was engaged to investigate this 

incident Mandiant provided Equifax with an executive summary, a supplemental repon, 

and a fmal supplement For your reference, Equifax provided copies of the executive 

summary and supplemental repon to the Committee on October I, 2017 and a copy of the 

final supplement to the Committee on October6, 2017. 

In addition, Equifax issued a press release regarding the cybersecurity incident on 

October2, 2017, which included the following infonnation: 

33 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 
80 


10417036.eps

Mandiant has completed the forensic portion of its investigation of the 

cybersecurity incident disclosed on September 7 to finalize the consumers 

potentially impacted .. .. 

The completed review determined that approximately 2.5 million additional U.S. 

conswners were potentially impacted, for a total of 145.5 million. Mandiant did 

nnt identify any evidence of additional or new attacker activity or any aeee~ to 

new databases or tables. Instead, this additional population of consumers was 

confirmed during Mandiant's completion of the remaining investigative tasks and 

quality assurance procedures buill into the investigative process .. .. 

(T)be individuals identified in this update, and the unauthorized access of 

information, all relate to the cybersecurity incident disclosed on Sept. 7. 

To minimize confusion, Equifax will mail written notices to all of the additional 

potentially impacted U.S. consumers identified since the Sept. 7 announcement. 

The feature on the website that U.S. consumers may use to determine whether 

they may have been impacted will be updated to reflect the additional potentially 

impacted U.S. consumers discussed in this release by no later than October 8 .. 

Equifax's internal investigation of this incident is ongoing. 

Question #133 (p. 20): Is Equifax confident in the new number, or should consumers expect 

another re-calculation in the future? Where did the 2.5 million new accounts come from? 

A: Please see response to question #132. 

Questions #134-136 (p. 20): Prior to July 29, 2017 did Equifax have a plan in place to 

respond to a large-scale security breach? If so, please provide a copy of this plan. If so, 

was this plan followed in its entirely following the July 20I7 breach? If not, where did the 

Equifax response deviate from this plan, and why? 

A: Please see response to question #98. The plans referenced in #98 are being submitted 

to the Committee as documents Bates numbered EFXCONG.SBC000000015 to 

EFXCONG-SBCOOOOOOI85. 

Regulatory filings show that three Equifax executives - CFO John Gamble, U.S. 

Information Solutions President Joseph Loughran, and Workforce Solutions President 

Rodolfo Ploder - sold stock in the company on August 1st and 2nd, just days after the 

initial discovery of the breach. At the recent bearing, you claimed that as far as you knew, 

these men had no knowledge oftbe extent of the breach, and that these sales were done as a 

matter of due course, even being cleared through the Chief Legal Officer. While this 

breach bas put the financial security of hundreds of millions of Americans at risk, it is 

disconcerting that three executi,•es may have decided to profit off their insider information. 

34 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 
81 


10417037.eps

Question #137 (p. 21): Were any of the three executives listed above (CFO John 

Gamble, U.S. Information Solutions President Joseph Loughran, and Workforce 

Solutions President Rodolfo Ploder) aware of the suspicious activity as of August 1st 

or 2nd? 

A: Please see response to question #89. 

In your testimony, you claimed that neither you nor anyone at the company was aware of 

the severity of the breach in early August. You also noted that Equifax retained the 

cybersecurity group at the law firm of King & Spalding, hired cybersecurity firm 

Mandiant to investigate the activity, and contacted the FBI on August 2, 2017. 

Question #I44 (p. 2I): Were any of the three executives who sold Equifax stock 

aware of plans or the decision to take any of those three actions? 

A: Please see response to question #89. 

Question #146 (pp. 21·22): In response to the breach, and ostensibly to help consumers 

determine if their data bas been backed, Equifax created a new website, 

Equifaxsecurity2017.com. The New York Times reported tha~ after the website initially 

went live, consumen were unable to determine with certainty if their information was 

breached, reporting that the Equifax site for consumers indicated - in response to all 

inquiries -that personal information "may have" been compromised. As of October lOth, 

members of my staff were still unable to determine with certainty if their information was 

compromised. Why was Equifax unable to provide clarity on whether individuals' 

information was breached? 

A: Equifax is continuously worlcing to enhance and improve consumers' experience with 

the incident website. Following the initial launch of the "Am I impacted?" search tool on 

September 7, the Company resolved some technical issues with the search functionality. 

Following the completion of a forensic investigation on October 2, the Company is oow 

able to provide a more definite impact response to U.S. consumers that take advantage of 

the " Am I impacted?" search tool, which can be accessed by going to the home page of 

this site: www.equifaxsecurity2017.com. 

In addition, following completion of the forensic investigation on October 2, the 

Company has: 

• Mailed written notices to the approximately 2.5 million additional U.S. consumers 

that were potentially impacted; and 

• Updated the "Am I impacted?" search tool, on the website to include the entire 

impacted population of approximately 145.5 million U.S. consumers. 

35 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 
82 


10417038.eps

Question #147 (p. 22): Is there any way for individual ronsumers to determine 11ith 

certainty if they were part of the breach? If this cannot be done via tbe website, bow can 

they determine if this is the case? 

A: Please see response to question #l46. 

Question #ISl (p. 22): Why did Equifax's Twitter acrount tweet the link to a false domain 

not owned by Equifax several times? 

A: An independent contractor mistakenly sent out the inaccurate tweets, and the 

company removed the tweets as soon as it learned of the error. 

Question #153 (p. 22): Why did Equifax initillly include a requirement that consumers 

consent to arbitration? Did the public outcry against the provision play any role in the 

decision to remove the arbitration clause? 

A: Equifax has addressed confusion concerning the arbitration clauses initially included 

in the Terms of Use applicable to Trusted!D products. Equifax never intended for these 

clauses to apply to this cyb=urity incident. The Company clarified that those clauses 

do not apply to this cybersecurity incident or to the complimentary TrustediD Premier 

offering. The Company clarified that the clauses will not apply. to consumers who signed 

up before the language was removed. Equifax has updated the Terms of Use and the 

www .equifaxsecurity20 17.com website to reflect this point. 

Equifax initially included a requirement that consumers consent to arbitration In order to 

determine whether their data bad been breached. Equifax also originally required that 

impacted individuals give their credit card information in order to get one free year of the 

company's Trusted!D Premier credit monitoring and indicated that it would automatically 

begin billing customers if they did not cancel the subscription within a year. 

Question #154 (p. 22): Does Equifax require con.sumers to consent to arbitration 

with respect to any of its other products? If so, please provide a list. 

A: Please see response to Question #14. 

Question #157 (p. 23): Why did Equifu initially choose to use the auto-billing modd for 

customers? 

A: Equifax has never requested consumers' credit card information when they sign up 

for the free credit file monitoring and identity theft protection that the company is 

offering to all U.S. consumers. Consumers who sign up for TrustedlD Premier will not 

be automatically enrolled or charged after the conclusion of the complimentary year of 

Trusted!D Premier. Following the expiration of the one year enrollment Equifax is 

providing to all consumers, those consumers are free to sign up for an Equifax identity 

monitoring product, sign up for an identity monitoring product from a competing 

36 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIF AX INC. 
83 


10417039.eps

provider, or take no action at all. Additionally, Equifax hopes consumers will enroll in its 

new application that will be available in January2018. 

Question #159 (p. 23): Consumers initially were required to submit sensitive information 

to TrustediD in order to sign up for credit monitoring. Wbat evaluations bas Equifax done 

of its current data security environment to ensure that tbe victims of this hack do not, once 

again, have thtir information stoltn? 

A: Equifax has implemented certain technological remediation steps as described in the 

Mandiant executive summary, which was submitted to this Committee on October I, 

2017. 

Moreover, Equifax has engaged PwC to assist with its security program, including 

strategic remediation and transformation initiatives that will help Equifax identify and 

implement solutions to strengthen its long·term data protection and cyber security 

posture. 

Question #161 (p. 23): How does Equifax's "credit lock" differ from a traditional credit 

freeze? Please explain in detail how each service works. 

A: At the most basic level, a credit file lock and a security freeze do the same thing: they 

both help prevent creditors and other lenders from accessing your Equifax credit file, 

with certain exceptions. Unless a consumer gives permission or takes an action, such as 

removing, unlocking or lifting the freeze or lock, a iender or other creditor cannot access 

the consumer's Equifax credit report with a security freeze or a credit file lock in place. 

Security freezes (also known as credit freezes) were created in the early 2000's, are 

subject to regulation by each state, and use a PIN based system for identity 

authentication. Credit file locks were created more recently, are mobile-enabled, and use 

modem identity authentication techniques, such as usemame and passwords and one time 

passcodes for better user experience. 

Detailed directions for freezing or locking an Equifax credit file are set forth on the 

company's website. The directions are paraphrased below: 

Lock-To lock your Equifax credit file, enroll in TrustediD Premier. This credit 

file monitoring and identity theft protection product is free for one year to all U.S. 

consumers who enroll by January 31, 2018. Once you have fmalized your 

activation in TrustediD Premier, visit www.trustedid.com, login and simply click 

the lock button. There are some exceptions where a lock may be delayed or may 

not be possible. Once you have fmalized your activation in TrustediD Premier, 

visit www.trustedid.com, login, and simply click the lock button. 

37 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIF AX INC. 
84 


10417040.eps

To unlock an Equifax credit file, once you have fmalized your activation in 

Trusted!D Premier, visit www.trustedid.com, log in and simply click the unlock 

bunon. 

Freeze - An Equifax security freeze can be placed by mail, phone, or online. 

Equifax has waived the fee to add, lift, or pennanently remove a security freeze 

on Equifax credit files through January 31, 2018. Any free-.:e activitiei after 

January 31,2018 may be subject to the fees provided by your state of residence. 

The easiest and fastest way to freeze your Equifax credit file is by using Equifax's 

online process found at the following link: www.freeze.equifax.com. If you 

choooe, you may also request a security freeze by calling Equifax's automated 

line at 1-800.685-11 11. NY residents please call 1-800.349-9960. You may also 

submit your request in writing to: 

Equifax Security Freeze 

P.O. Box 105788 

Atlanta, Georgia 30348 

When you freeze your Equifax credit file, you will receive a 10-digit randomly 

generated PIN from Equifax that you will need to save and have available should 

you chonse to temporarily lift or permanently remove the freeze in the future. 

Question #162 (p. 23): Will E~uifax offer consumers the opportunity to delete their data 

from Equifax's systems? As of your departure, was Equifax considering this option? 

A: Equifax will not offer consumers the opportunity to delete their personally 

identifiable information or remove accurate information on a credit report, except as 

required by law under the Fair Credit Reporting Act ("FCRA'), 15 U.S.C §1681 et seq., 

or applicable state taws. 

As stated in the FCRA, "the banking system is dependent upon fair and aocurate credit 

reporting. Inaccurate credit reports directly' impair the efficiency of the banking system, 

and unfair credit reporting methods undermine the public confidence which is essential to 

the continued functioning of the banking system."1 The taw further states that the 

purpose of FCRA is ·~o require consumer reporting agencies adopt reasonable procedures 

for meeting the needs of commerce for consumer credi~ personnel, insurance, and other 

information in a manner which is fair and equitable to the oonsumer, with regard to the 

confidentiality, aocuracy, relevancy, and proper utilization of such information in 

accordance with the requirements of[the FCRA).'~ 

I Fair Credit Reporting Act, 15 U.S.C §1681, S«.602(aXIJ. 

2 Fair Credit Reporting Act, IS U.S.C §1681, Sa:. 602(b). 

38 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIF AX INC. 
85 


10417041.eps

Offering consumers the "opporrunity to delete their data from Equifax's systems" would 

directly contradict the Federal obligation placed on consumer reporting agencies 

("CRAs'1 to ensure that credit reports are accurate. Should a consumer delete accurate 

data from Equifax, or from any of the other CRAs, it would result in the creation of 

inaccurate credit reports which "directly impair the efficiency of the banking system," as 

noted above by the FCRA. It could also result in consumers potentially being considered 

"unbanked" by a lender, therefore unfairly hindering their access to credit. 

In the General Principles for Credit Reporting, The World Bank has further concluded: 

"Information quality is the basic building block of an effective credit reporting 

· envirorunent. Accuracy of data implies that such data is free of error, truthful, 

complete and up to date. Inaccurate data may lead to numerous problems, 

including unjustified loan denials or higher borrowing costs."l 

In addition, The World Bank's International Committee on Credit Reporting also recently 

stated: 

"From a poli<:y perspective, perhaps the most important role of credit reporting 

consists in addressing information asymmetries between creditors and borrowers 

in order to facilitate an efficient and cost effective credit risk assessment. Through 

this means, credit reporting can help achieve lower lending costs, which in 

competitive markets are passed on to borrowers in the form of lower cost of 

capital. Moreover, it can enhance access to credit for individuals and firms. 

Credit reporting also contributes to financial stability. For example, services 

offered by Credit Reporting Service Providers (CRSPs) help improve the quality 

of loans made by banks and other lenders through the provision of tools used to 

evaluate credit risk more effectively and consistently, as well as for the active 

management of the loan portfolio. Credit reporting also serves to discipline 

debtor behavior as regards the timely repayment of their financial and certain 

other obligations, as a good credit history facilitates access to credit and can often 

obviate the need for debtors to put up tangible collateral for loans. "1 

Accurate and complete data "facilitate{s] an effiCient and cost effective credit risk 

assessmenf and "contributes to financial stability." The opportunity for consumers to 

selectively delete accurate information from CRAs would directly prevent a critically 

important component of our financial system. 

Under the FCRA, consumers have the right to receive a free, annual copy of their credit 

report and to review the accuracy of the information included on that report. In addition, 

l Gcn<!JI Princioles for ()edit Rrnorting The World Bank, Septembet 201 t, page 2. 

I The Rot< of Credit Rrnorting in Supoonjng Fjnancjal Seetor ReguiJ!ion and SuDC!Vjsjoo lr.tenwi!!!!ll Committee 

oo Credit Reponing. The World Bank, January 2016, page S. 

39 

CONFIDENTIAL TREA 1MENT REQUESTED BY EQUIF AX INC. 
86 


10417042.eps

consumers are entitled to a free report in the event of an adverse action, such as the denial 

of an application for credit, insurance, or employment, based on information in the report. 

further, consumers are entitled to a free, annual copy of their credit report if they are 

unemployed and plan to look for a job within 60 days; if the consumer is on welfare; or if 

a report is inaccurate because of fraud, including identity theft. 

Further, under the FCRA. CRAs, and furnishers of information provided to the CRA, are 

responsible for correcting inaccurate or incomplete information on a credit report, and 

must comply with established procedures outlined in the FCRA to enable consumers to 

dispute information on their credit file. 

Equifax complies with the above obligations under the FCRA, which support the 

underlying goal of ensuring a system of "fair and accurate credit reporting'' for the 

benefit of consumers, lenders and the entire financial system. 

Question #163 (p. 23): Is Equifax considering an "opt-in" regime where consumers would 

decide whether Equifax should have access to their sensitive personal information in the 

first place? As of your departure, was Equifax considering this option? 

A: Equifax is not considering an "opt-in" regime. 

Question #167 (p. 24): Did Equifax consider and reject other cybersecurity strategies? If 

so, please describe those proposals and the reasoning behind the decision to adopt the 

current plan. 

A: Please see response to question #33. 

Question #168 (p. 24): Did Equifax have a detalled breach response plan in place prior to 

September 2017? If so, what specific steps did this plan entail? Was this plan followed 

during the re!ponse to the most recent breach? 

A: Please see response to queltions #98. 

Que!tion #170 (p. 24): Did Equifax "lock down" all individual credentials? Was this data 

stored on an internet-accelsible outward-facing database? 

A: Please see the Mandiant executive summary, supplemental report, and final 

supplement Equifax is conducting an investigation related to the incident announced on 

September 7, 2017 and is dedicated to resolving any issues identified as a result of that 

investigation. 

Moreover, Equifax has engaged PwC to assist with its security program, including 

strategic remediation and transformation irtitiatives that will help Equifax identify and 

implement solutions to strengthen its long-term data protection and cyber security 

postUre. 

40 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIF AX INC. 
87 


10417043.eps

Question #174 (p. 25): Was the root cause of the breach related in any way to the previous 

backs that resulted in the theft of W-2 tax and salary data from Equifa.x in 2016, or the 

theft ofW-2 tax data from Equifax subsidiary T ALX earlier this year? 

A: Please see response to question 1184. 

Question #186 (p. 26): As of the most recent data, bow many individuals have signed up 

for Equifax's free credit monitoring services? 

A: As of December 20, 2017, approximately 10.8 million consumers had completed 

registration for TrustedlD Premier and approximately 4.04 million conswners had 

successfully enrolled. 

On September 29th, barely three weeks after the public announcement of the recent 

breach, the Internal Revenue Service (IRS) awarded Equifax a S7.25 million sole-source 

contract "to verify taxpayer identity and to assist in ongoing identity verification and 

validations needs of the Smice." Taxpayers in Massachusetts and across the country are 

concerned that the same company that just put their data and financial security at risk will 

now be responsible for preventing taxpayer fraud. 

Question #191 (p. 27): Has Equifax updated its cybersecurity to ensure that it will 

be able to fulfill its contract with the IRS without putting taxpayen at risk? Please 

describe tbe steps taken by Equifax to boost their security and protect taxpayers. 

A: Equifax has 1aken important steps to improve its data security infrastructure. h 

is further hardening its networks, changing its procedures to require "closed loop" 

confirmation when software patches are applied, rolling out new vulnerability 

detection tools, and strengthening accountability mechanisms. Equifax has 

implemented certain teclmological remediation steps as described in the Mandiant 

executive summary, which was submitted to this Committee on October I, 2017. 

Equifax has also engaged PwC to assist with its security program, including 

strategic remediation and transformation initiatives that will help Equifax identify 

and implement solutions to strengthen its long-term data protection and cyber 

security posture. 

Question #192 (p. 27): Equifax received this sole-source contract after protesting 

the initial award to another company. After Equifax learned of the massh·e data 

breach in late July, d.id Equifax alerttbe IRS? 

A: Equifax filed the subject protest on July 7, 2017, and remained under existing 

contract to perform the identity verification and validation services for the IRS 

through September 30, 2017. Following the public announcement of the 

cybersecurity incident on September 7, 2017, Equifax spoke with the IRS on 

September 8, 2017, and has worked closely with the agency since then to answer 

41 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIF AX INC. 
88 


10417044.eps

its questions and, at its request, securely provided impacted data for analysis. 

Equifax has hosted the IRS for multiple onsite security reviews since September 

7, 2017 and continues to work diligently with the agency. 

Question #193 (p. 27): Did Equifax coasideriog withdrawing its protest and 

permUting another company to fulfiU the contract in light of the recent breach 

exposing fundamental flaws in Its cybentcurity? 

A: Equifax timely submined its bid protest in accordance with 4 C.F.R. § 

21.2(a)(2). The contracting agency, as required Wider the Competition in 

Contracting Ac~ 31 U.S.C. § 3553(d)(4)(A), withheld authorization of 

perfonnance while the bid protest was pending before GAO. Through its protest, 

Equifax asked GAO to review the Agency's evaluation and make an independent 

determination. GAO's consideration of whether the Agency conducted a fair 

evaluation and reasonably adhered to the terms of its solicitation remained 

appropriate, notwithstanding the breach. Moreover, Equifax has found no 

evidence of unauthorized activity on any of Equifax's core consumer and 

commercial credit reporting databases and remains confident in its ability to 

provide identity verification seJVices to the IRS. 

Question #194 (p. 27): How many other federal contracts for handling sensitive 

personal information are held by Equifax? What was tbe value of these contracts 

for FYiOIS, FY2016, and FY2017? What is the value of these contracts for 

FY2018? Please provide a list and a brief summary of these contracts. 

A: Equifax provides products and services to a number of federal agency 

customers, such as the IRS, Centers for Medicare & Medicaid ("CMSj, and 

Social Security Administration (''SSA "). Representative seJVices include identity 

verification and validation, as well as human resources, payroll, tax management, 

and compliance seJVices. Equifax is in the process of collecting additional 

responsive contract information and plans to submit a supplemental response to 

these requests. 

Question #195 (p. 27): Have cybersecurity breaches affected any of the data held 

under any of these additional contracts? 

A: Equifax has shared Mandiant's executive summary with the IRS, CMS, and 

SSA and has confirmed that Mandiant found no evidence of any unauthorized 

access to the data provided by these agencies. 

As Equifax has publicized, the attackers accessed certain information related to 

approximately 145.5 million consumers. The attackers accessed a number of 

tables that comained various data elements provided by consumers. For example, 

some of those tables contained records related to Equifax products and seJVices, 

consumer disputes, and verification of consumer identities for services provided 

42 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 
89 


10417045.eps

by customers, including the IRS. Equifax has found no evidence that the 

attackers manipulated or deleted any of this data. 

Equifax has alerted the IRS, CMS, and SSA, among other federal agency 

CllStomers. Equifax has securely provided impacted data to the IRS and SSA, 

pursuant to their respective requests, and continues to work diligently with these 

agencies. 

43 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIF AX INC. 
90 


10417046.eps

Rli:PORT OF THli: SPECIAL CO~UTIEE OF 

THE BOARD OF DIRECTORS OF EQUIFAX INC . 

.Elane B. Stock, Cbair 

Robert D. Daleo 

G. Thomas Hougb 

November I, 2017 

Counsel 

Wilmer Cutler Pickering Hale and Dorr LLP 
91 


10417047.eps

REPORT OF THE SPECIAL COMMITTEE 

In September 2017, the IJoanl of Directors ofEquifax Inc. formed a Special Committee 

of independent directors to address matters related to the cybersecurity incident disclosed by 

Equifax on September 7, 2017. The Special Committee was charged with conducting an 

independent review of the circumstances of trading in Equifax securities by cenain executives 

following ihe discovery by Equifax of suspicious activity on ib network and prior to the public 

disclosure of the incident. The Special Committee was advised by Wilmer Cutler Pickering Hale 

and Dorr LLP ("\VilmerHale") in conducting the review, and the Special Committee directed 

\VilmerHale during the course of the investigation. This report presents the findings of the 

Special Committee and the work ofWilmerHale resulting from the review of the trading. 

Equifax has an Insider Trading Policy applicable to all employees. Under that policy, no 

employee may trade in Equifax securities if he or she possesses material non-public information 

regarding Equifax. In addition, Equifax directors and certain senior Equifax officers may trade 

in Equifax securities only in specified "trading windows" and only if they fiiSt receive 

preclearance by the Equifax Chief Legal Officer or his designee. 

Four senior officers at Equifax who are subject to this trading preclearance requirement 

sought and received preclearance to sell shares in Equifax securities between July 28 and August 

I, 2017. Those officers are John \V. Gamble, Jr. (Chief Financial Officer), Joseph M. ("'Trey") 

Loughran, Ill (Presiden~ U.S. Information Solutions), Rodolfo 0. C'Rudy'') Ploder (President, 

Workforce Solutions), and Douglas G. Brandberg (Senior Vice Presiden~ Investor Relations). 

Equifax identified some suspicious activity on its network on the evening of Saturday, July 29, 

and Equifax personnel immediately began to assess the activity. 

The Special Committee examined whether the trades of those officers comported with 

the Company's Insider Trading Policy, whether the executives had any information about the 

security incident when they made their trades, and whether preclearance was appropriately 

obtained.1 

For the reasons set out below, the Special Committee has detennined that none of the 

four executives had knowledge of the incident when their trades were made, that preclearance for 

the four trades was appropriately obtained, that each of the four trades at issue comported with 

Company policy, and that none of the four executives engaged in insider trading. 

METHODOLOGY 

The Special Committee's review examined the circumstances under which Equifax 

identified suspicious activity on its nerwork, and the review was designed to pinpoint the date on 

Ini6ally, lhe Spo:w Committee focused ooche 11= offieers of Equif"" (Messrs. <amble, Lcughran, and Ploder) who sold sliarcs during lhe period under rtvicw and who art Scctioo 16 oflieers of the C<>mpany, I.e .• 

covered by Rule 16a-1(0 under Stobool6 of !he Securicics Exchange Aol oo 19~4. The Committee !hereafter delermincd to expand che rtview to cover all officers oflhe company - whclhcrcovertd by Stobool6 or 001- wllo 

~uirtd p<o-<lcaraDCe for uadill£ in Equifax slims under !he C<>mpany's Insider Trading Policy and who sold sllarcs during lhe relevant period. This chang< led co the iDCiusion of Mr. Brlndbcrg in lht review . 

. ] . 
92 


10417048.eps

which each of the four senior officers first learned of the security investigation that uncovered 

the breach and to detennine whether any of those officers was infonned of or otherwise learned 

of the security investigation before his trades were executed. The review also entailed analysis 

of the Company's Insider Trading Policy as applied to these four trades. 

The Special Committee conducted an extensive review of documents and 

communications during the period surrounding the four officers' trading in Equifu securities. 

The Special Committee also conducted dozens of interviews with individuals involved in or 

knowledgeable about the security investigation and/or the trade preclearance process in the 

relevant period. fmally, the Special Committee conducted lengthy in-perwn interviews with 

each of the four senior offiCers who executed trades. In conducting its review, the Special 

Committee received full cooperation from all Equifu employees including from the four senior 

officers, who supplied all requested infonnation. 

Document Review. The Special Committee reviewed over 55,000 documents, 

comprising emails, text messages, phone logs, and other records: 

• As to each of the four senior officers, the Committee reviewed all of their Equifax 

emails, texts, calendars, voicemails, phone logs, and electronic documents, along 

with all Equifax emails and texts of each of their administrative assistants, for the 

period July29 through August 2, 2017.2 For the period of August 3 through 

September 7 (when the incident was announced publicly), the Committee 

conducted a targeted review of their Equifax communications, using search tenns 

designed to identify documents concerning the incident or trading. The 

Committee also reviewed relevant materials from their perwnal ernails, texts, 

phone logs, and other documents. Finally, the Committee reviewed documents 

related to the officers' Equifax holdings and trading history. 

• As to employees in the Equifax Legal Department most involved in the security 

investigation and/or the preclearance of the trades at issue, and for Equifax's then· 

Chief Security Officer, the Committee reviewed all Equifax emails, texts, 

voicemails, calendars, and other electronic documents for the period of July 29 

through August 2. The Committee also conducted a targeted review of their 

ernails from August 3 through September 7, using search tenns to identify 

documents concerning trading. 

• As to all Equifax employees identified as having knowledge of the security 

investigation on or prior to the dates of the trades at issue, the Committee 

conducted a targeted review ofEquifax emails in the period July 29 through 

August 2, using search tenns to identify documents concerning the four officers 

This period spans the Company's decec1ion or SU$picious ac1ivi1y on the .,.wort lhroogl! lhe dale on which 

1be last of the senior officer's securities transaclions were executed. 

·2· 
93 


10417049.eps

and, where feasible, a full review ofEquifax text messages from !be period July 

29through September 7.l 

Interviews. The Special Committee conducted 62 interviews, including lenglby in-

~ interviews wilb each of !be four senior officers. During !hose interviews, !be Committee 

addressed !be officers' trading history, documents and recollections surrounding !be August 2017 

trade$, and knowledge of ihe security investigation ihat uncovered the breach. The Committee 

also interviewed, in person or telephonically, each current or former Equifax employee identified 

as potentially possessing knowledge of the security investigation on or before the date on which 

!be senior officers conducted their trades. During those interviews, the Committee sought to 

determine whether !be employee had contact wilb any of !be four officers during !bat period, and 

if so, whelber !bat contact included any discussion of the security investigation then underway. 

FINDINGS 

The Special Committee found the following con<:erning the trading by each of the four 

senior officers: 

John Gamble. As is standard under the Company's Insider Trading Policy, Mr. Gamble 

received notification by email on Tuesday, July 25 !bat the trading window for Equifax share 

lransactions by executives would open on Friday, July 28 and remain open through Monday, 

August 31. The email instructed Mr. Gamble and the other recipients of the notification to seek 

preclearance from the Legal Department for any contemplated securities lraDsactions during the 

window, and !bat preclearance, if given, would be valid for two days. 

Mr. Gamble traveled to Utah with his wife on July 28 on non-Equifax business. On July 

31, while in Utah, Mr. Gamble sent an email to the Legal Department requesting preclearance to 

sell 6,500 sharesofEquifax stock (approximately 13.4% of his holdings at the time). Mr. 

Gamble's Equifax share grants had recently started to vest, and he had previously discussed with 

his financial adviser his goals to diversify his assets and to pay for an ongoing home renovation. 

Mr. Gamble's request to trade was approved via email on July 31, and the trade was executed on 

August!. 

Nine days after Mr. Gamble's trade, on August 10, during a management offsite meeting, 

Mr. Gamble first learned of the existence of a security incident at Equifax that was under 

investigation. Mr. Gamble received a more detailed briefing the following week, on August 17, 

and received additional details of the incident on August 22, during a Senior Leadership T earn 

meeting. 

' Oo August I 5, 2017,the Equilix l<gal Departm<nl imposed atoong blackOill on all eoo~~y pcrsonncl identified as aware of the breach asoftbal date. The Special Committee used the recipient list for the August IS 

bladcout notice to isolate the initial ~lation ofEquifax employees~ documents and oommunicatioos sboold be reviewed. To the extent additio.W 10dividuals ~~~reidentified as polentwly knowledgeable about tile breach 

investigllion during die Committee's review,lhcir •mails and telrt! were subj«tthe sam< process, and lhosc 

petS<liiS were ntcrv~. 

- 3-
94 


10417050.eps

The Special Committee concluded !hat Mr. Gamble did not have any knowledge of the 

security incident when he sought precleai1Uice to trade on July 3 I or when he executed his 

cleared trades on August I. The Special Committee further concluded !hat Mr. Gamble fully 

complied with Company policy and did not engage in insider trading. · 

Trey Loughran: As is standard under the Company's Insider Trading Policy, Mr. 

loughi1UI received notification by email on Tuesday, July 25 ihai iht lrading window for 

Equifax share transactions by executives would open on Friday, July 28 and remain open 

through Monday, August31. The email instructed Mr.loughi1UI and the other recipients of the 

notification to seek preclearance from the legal Department for any contemplated securities 

transactions during the window, and that preclea11U1Ce, if given, would be valid for two days. 

Mr.loughi1UI sent an email to the legal Depanment requesting precleai1U1Ce to sell 

Equifax securities on July 28, 2017, one day before suspicious activity on the network was 

identified. On July 3 I, in response to a request from the legal Department for greater specificity 

regarding the number and type of shares he wanted to sell, Mr. Loughran clarified that his 

request was to sell4,000 shares (approximately 9.4% of his holdings at the time). Mr. 

Loughran's request for precleai1Uice was approved on July 3 I, and the sale occurred on August 

I. Mr. Loughran's sale of Equifax securities was consistent with previous sales he had made and 

was part of an effort to diversify his holdings. 

Mr. Loughran first learned, at a general level, that a security issue was being investigated 

in a series of texts, emails, and phone calls he exchanged with members of the Equifax legal 

Department on August 13 and 15. Mr.loughi1Ui learned details of the breach on August 22, 

when he attended the Senior Leadership T earn meeting referenced above. 

The Special Committee concluded that Mr. Loughi1UI did not have any knowledge of the 

security incident when he sought preclea11U1Ce to trade on July 28 or when he executed his 

cleared trades on August I . The Special Committee further concluded !hat Mr.loughi1UI fully 

complied with Company policy and did not engage in insider trading. 

Rudy Ploder: As is standard under the Company's Insider Trading Policy, Mr. Ploder 

received notification by email on Tuesday, July 25 that the trading window for Equifax share 

transactions by executives would open on Friday, July 28 and remain open through Monday, 

August 3 I. The email instructed Mr. Ploder and the other recipients of the notification to seek 

preclearance from the legal Department for any contemplated securities transactions during the 

window, and that prec]eai1Uice, if given, would be valid for two days. 

Mr. Ploder sent an email to the Legal Department requesting precleai1U1Ce to sell Equifax 

securities on August I. Precleai1Uice was gi1Uited !hat same day, and his trade executed on 

August 2. Mr. Ploder sold 1,719 shares (approximately3.8% of his holdings at the time). Mr. 

Ploder's trade was motivated by, among other things, a need to meet COstS associated with a 

business-related move to SLlouis and was consistent with his previous sales of Equifax shares. 

Mr. Ploder learned of the security incident on August 22,2017, when he participated in 

the Senior Leadership Team meeting referenced above. 

·4· 
95 


10417051.eps

The Special Committee conduded that Mr. Ploder did not have any knowledge of the 

security incident when he sought preclearance to trade on August I or when he executed his 

cleared trades on August 2. The Special Committee further concluded that Mr. Ploder fully 

complied with Company policy and did not engage in insider trading. 

Douglas Brandberg; As is standard under the Company's Insider Trading Policy, Mr. 

Brandberg received notification by email on Tuesday, July 25 that the trading window for 

Equifax share transactions by executives would open on Friday, July 28 and remain open 

through Monday, August 31. The eniail instructed Mr. Brand berg and the other recipients of the 

notification to seek preclearance from the Legal Department for any contemplated securities 

transactions during the window, and that preclearance, if given, would be valid for two days. 

Mr. Brandberg sent an email to the Legal Department requesting preclearance to sell 

Equifax securities on August I, 2017. Preclearance was granted on August I, and his trade was 

executed on August 2. Mr. Brandberg sold 1,724 shares. Mr. Brandberg's sale ofEquifax 

securities was consistent with his previous practice of selling shares as they vested; his sale was 

driven by family expenses. 

Mr. Brandberg first learned that a security issue was being investigated on approximately 

August 14, and learned details of the security incident on August 22, when he attended the 

Senior Leadmhip Team meeting referenced above. 

The Special Committee concluded that Mr. Brandberg did not have any knowledge of the 

security incident when he sought preclearance to trade on August I or when he executed his 

cleared trades on August 2. The Special Committee further concluded that Mr. Brandberg fully 

complied with Company policy and did not engage in insider trading. 

Tbe Application of tbe Insider Trading Policy. Mesm. Gamble, Loughran, Ploder, 

and Brandberg each sought and received clearance from the appropriate Legal Department 

personnel prior to trading. Based on its review, the Committee has concluded that neither 

Equifax's Chief Legal Officer nor his designated preclearance officer had reason to believe that 

Messrs. Gamble, Loughran, Ploder, or Brandberg had knowledge of the security incident's 

existence as of the date of their preclearance requests or the date of their trades. Accordingly, 

the Special Committee has concluded that the preclearance authorization obtained by Messrs. 

Gamble, Loughran, Ploder, and Brandberg was within the authority permitted under the policy. 

The Special Committee continues to review the cybersecurity ciden~ the Company's 

response to ~ and all relevant policies and practices. 

-5-
96 

ADDITIONAL MATERIAL SUPPLIED FOR THE RECORD

LETTER SUBMITTED BY THE CREDIT UNION NATIONAL ASSOCIATION 


10417052.eps
97 

EQUIFAX, INC., ‘‘INSIDER TRADING POLICY’’ 


10417053.eps

~lFAX' EOOFAX COf,FIOENTI.II. 

CORPORATE POLICIES DOCUMENT 

INSIDER TRADING POLICY 

POUCY NUMBER: EQ.Lega\.002 

POUCY MANAGER: Lisa Slockard, Assistant Secretary 

SLT MEMBER: J. Keley, COfJ)OOIIe Vkle Prasiden~ Cll~f Legal Olbfand COfJ)OOIIe Seaetary 

LASTMOOIAED: July201 7 

DATE OF LAST SLT MEMBER REVIEW: July 2017 

BOARD APf>ROVAL REQUIRED: N~ 

POUCY OVERVIEW 

T1lis Poky concerns the handlir9 o1 matellal, non-pllbie lnformalion relalilg 1~ Equitax InC. rEqulfax. • 

lhe 'Company; or 'We1 or other ~les will which we deal and wllll the bu)tlg and seftlg ot stock 

ond olher ooouritic$ ol Equ~ax ond other compe.WC.. Thi> Policy is doo;jnod lo iiM<t enhonco 0<1r 

~compliance progtam 10 prevent ilal!'.erteot ilsider l/al!ing or alegations ol ilsider 1/ai!ilg. and 

to protect our ~potalion for inlegrity and eth~ conduct. This Policy SUpplements the ~rictions sel 

blh in the E(!lrifax Code ol Elhics and Bu$1\e$$ Conduct e 'COOe Of Elhicsi . 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG-SBC000000001 
98 


10417054.eps

TABLE OF CONTENTS 

EMPlOYEE GROUPS; SUMMARY OF RESTRICTIONS .............................................................. 3 

II. INSIDER TRADING PROHIBITED ............................................................................................ 3 

Ill. UNAUTHORIZED OISCLOSURE OF MATERIAL, NONPIJBLIC INFORMATION 

PROHIBITED ............................................................................................................................... 7 

IV. TRAOING'MNDOWS ............................................................................................................... 8 

V. PRE·CLEARANCE OF TRANSACTIONS .................................................................... " ................ 9 

VI. PERMmED TRANSACTIONS ................................................................................................. 9 

VII. SANCTIONS FOR VIOLATIONS OF THIS POLICY .................................................................... 11 

VIII. ADMINISTRATION OF THIS POUCY .................................. - ..................................................... 12 

IX. ROLESANDRESPONSIBILITIES ............................................................................................. 12 

X. REFERENCES ............................................................................................................................. 14 

XI. REVISION HISTORY .................................................... ............................. .............................. 14 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000002 
99 


10417055.eps

EMPLOYEE GROUPS; SUMMARY OF RESlRICTlONS 

For purposes of this Policy, each Equifax efl1)1oyee, oficer and dirednf will be categorized into ooe of 

three groups as described bebw. Different restrictions described In this Poley apply lo each group. The 

Ofice ol Cofl)Orate Secrelary, under lhe diredion of the Chief Legal Olf10er ('CLO'), wilworl< will lhe 

Company's management leam lo detenmine 1he appropriale groop for each employee, and each 

employee win be norl\ed by the Oflioe of Corporate Secretary ff he or she has been plaoed into or 

removed from Group Two or Group Three. 

You should read this enlke Policy. H~ver. for your coovenienoe, the following is a summ31Y of the 

restridlons that apply to eacn group under this Policy: 

• Grow One· The majority of our employees are t1 Group One. Members ol Group One are 

requred lo comply will the prohibitions on (~ ~ad ng in securities wflle in possession of material 

nonpulllic information \insidertr.lding'), as described in section II of lhis POlicy and in the Code 

of Ethics, and (i~ disdosing material noopubic information lo others ('"lippng'), as desaibed in 

secoon Ill of this Policy and In the Code of Ethics. 

• Group Two ·Certain of our offiCefS and 01her employees with regular acoess 10 material, nonpubic ink>rmation are In Group Two. In addiion lo file general prohiblions against insider lrading 

and lipping, membels of Group Two may only purchase or sel Equifax searities during the 

ltading windows described in 5ection IV of this Poley. 

• Grow Three· Members of our boatd or diedors and certain senior of!lcers are In Group Three. 

Merrbers of Group Three are subjed to file same reslrictions as apply to Group Two. In addition, 

me!Tbers of Group Three are required to pre-clear roost ~nsa llons with the CLO (or his or her 

designee), as described in Sedion V of lhis POicy and wl1 be notified separalely of certain other 

lrading restrictions and repol1ilg requirements i111>0sed on them by the federal securities laws 

and tile rules and regulations of lhe Unlled States sew~ and Exdlange ~nvnission ('SEC/. 

A list oflhe members of Groups Two and Three will be maidained by the Of!lce ol Cofl)Orate Secrelary 

and dislnbuted inlemaly and eXIemally as awropliate. 

In addiUon, regardless or group alrliaUon, any employee, of!lcer ordiedor of Equifax may be lell1>0faliy 

prohibiled from buying or sening Equ~ax securiies during spedal blacl<oul periods. These spedal 

bladlout periods are desated in Section IV of this Policy. 

II. INSIDER TRADING PROHIBITED 

General Rule. No Equifax employee, of!lcer or direcw may purthase or sell Equlax secorlies whie he 

or She is ill possession of material, nonpublic ink>rmation relating to Eq ~ax. This resuiction does not 

apply to certain "Pelrited Transfers; which are disoussed in Section VI of !his Policy. 

EmplOyees, OtriCt!$, 0/ltetOfS and Relattd Pi11Jes. This Policy apples to all employees, ollioers and 

directors ol Equlfax and l s subsidialies. EaCh provision or lhis PoUcy that aJllllies to an employee, ob 

and dlreclor also applies lo: 

• Such Individual's familY members and other persons with whOm he/she shares a household: 

• Jamiy members or other persons whO principally rely oo111e employee, officer or di"ec:tor for lheir 

lnancial suppon. regarotess ol where lhOse persons reside: and 

• any entily (a) over which file employee, olli<:er or died or has oonlrol or inlklence will resped to 

a ~ction in securities (e.g .. a IIUSieeor a 1/Ust or an execuror of an estate} or (b) in which 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000003 
100 


10417056.eps

he/she has a material financial interest (for example, a trust of which an employee is a 

beneficiary). 

Likewise, when we refer lo )'ou" in this Policy, we also mean each of the persons and entities listed 

abol'e wih respect 1o you. Be<:ause the persons and enti ies lisled above are cowred by this Policy, you 

wU! be responsible for their transactions in Equifax seculties and,ln order to maintain your compliance 

Willi this Polley, you should ensure !hat they do not purtllase or sell Equifax securties without your 

Clearance. 

other Persons. tt may be 3Pilf0pl1ale, il some clrwmstances, for persons who are not employed by 

Equnax (ln addition to !hose !isled abow) to be subject to the same restrfctions as the Company's 

employees and Other "insiders.• If you are aware of a siuation in which a consultant. ad'iisor or other 

person not em!*Jyed by Equlfax wil have access 1o materiaL nonpubllc information about !he Company, 

you shou!d llfilg this siuation to the attention ol !he Ob of Corporate Seaetal)', which will make 

appropriate arrangements to protect the Company. 

Material, Nonpubllc /ntomratlon. 

Malerial. Information is considered ·material' if: 

• a reasonable investorwou!d consider Klmportant il making a dec:tslon of whetherto buy, sell or 

hold !he securiy; 

• a reasonable investor would ,.;ew the i®nnatlon as slgnr;:antly alering the total mix o1 

information In the ma!te!place about !he company thai Issued !he security; or 

• the information oou!d reasonably be expected to have a substantial effect on the price of the 

security. 

fl<oopulllk. ln!QrTnalion is n911pubic until- has ~~ten 'PIJb/ic!y disdo~,' meaning !h;d k: 

• is published il such a way as to proWie broad, noHxtlusiooary distribution of the intorma!ion to 

the public; and 

• has been in the public domain for a suflident period or time to be absorbed by the matte! and 

rellected In the !)lice of !he related securties. 

Examples of public disclosure ilc!ude the issuance of a press release or the ling ol an appropriate report 

with the SEC. Information is gene!ally considered to be 'nonpubic' unti the expiration ol a period of one 

full trading day after the information is released to the general public. However, this period varies 

depending on the type of information released, the marllet's expectations relating 1o the subject matter of 

the release. and the mattet's reaction after the information is released. 

~es of matefial, nonpublic lnfonnatlon night ioclude information about: 

• the Company's inancia! or operating resutts, whether for completed periods or relating 1o 

expectations for future periods (mcluding changes in prelliousty.released earnings estimates or 

guldence and variances from analysts' consensus estimates); 

• a materia Impairment or change in the value of the Company's assetsi 

• substantiw dlsrussions regarding a slgniicant merger. acqulsi!ion, joint ven«ure or disposition of 

slgnificart assets; 

• changes In top managernenl; 

• gain or loss of a significant customer, 

• introduction of a signiicant new product or seM:e; 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000004 
101 


10417057.eps

• significai'A advelse accounting developments; 

• Changes in dMdend poncies or declaration of a Slod<. split; 

• the Compaily's enuy ilto or tennin8tion of any $iQnificarA contract: 

• the filing of significant ~lion Of significant clains againSt tile Cofll)3ny, develOpments 

Oncluding seulements) in $i0nificai'A pending tiligation, Of othef significant contllgent liabillies 

a"ectlnO the Cofll)3ny; 

• a potential enforcement action inVOlVing mate11al penalties or a material regulatOfY developmeft 

• a material security breath or other material diSIUI)tiOn of the CCiflll)aoys lofOI'mation teChnolOgy 

intniSiructure; 

• the Cofll)3ny's plans relating to its capital stllldure or outstanding securities, intlldilg issuances 

Of repurchases ol common stod<. or debl securitles, and infOI'malion about possible Changes in 

the Company's cred~ ratings; and 

• any other events thai may require the liing of a CU~rei'A Report on Foon 8-K witt the SEC. 

lnfonnation may be material whether ills t.Mlrab!e or unfawrable to the Company. The Bst of exa•s 

provided abow is mefely llustrative, and there are many othertwes ol informatioo and ewnts that may 

be matertat at any particular lime, depending on the circumstances. Wlere there is any possibily that an 

l em may be considered "material,' you should treat las such and you shout! confer with the Ofllce of 

CotpOrate Secret31Y U you wo!Ad like to reYlew any specific s~uation. 

other Companies. Wille this Polley prohlllils tradirQ In EquUax seoorities while you are In possession of 

materia~ nonpulllic information about Equfax, h also prohlllils trading In securiies of any other cofll)3ny 

about which you learn material. non pubic infOI'malion in the course of performng your duties for EQuWax. 

For example. you may be involved in a transaction in which Equlax elq)ects to enter into (or terminate) a 

substantial business relalionship wlh another company (suCh as a publicly-traded customer or vendo~. 

or acquie another company, buy a substantial amount of~ stod<. or enter into a joint venture with the 

cofll)3ny. Even though the size or the transaction may be inmateriaf to Equifax. l may be material to the 

other company. This Policy prohillils you from trading in the securiies of that company while aware of 

this material, nonpublic information or from tiWing others rega!dilg the information. In addhio!l, please 

remember that Code ol Elllics prohibH you from engaging in outsi:le interests that represent a conftict ol 

illerest with your obligations to EquWax. 

SecurltJes; All Transactiom. This Policy prohibits ce11aln tra~ns In the •sea/lilies' of Equifax. 

Although -is usually the case that the lnfOI'matiOn you gain will be material wlh respecl to EquMax 

common stod<., any seculties that Equ"ax issues, such as debl securities or preferred stod<., are also 

subject to this Poli:y. This Policy alSo applies to stock options and olherdetiwtives related 10 Equlfax 

secur11ies. as discussed below, as wei as Equifax Inc. ~100 Plan transactions inVOlVing Equifax 

common stod<.. Pwchases and sales of Equ~ax securities are subject to the lnsi:liertradif'G laws and the 

provisions of this Policy, whtther they are executed in the public martets or in private transactions, and 

whelhet you execute the transaction diecdy or lndlredly through another person or entity. 

Shorl-lerm Investments. We elq)8ct our employees. oflicefs and diectors to refrain from speculative 

transactions that are designed to resuft in profi based on sholl·lenn fluctuations in the plice of our 

securities. ff you do puldlase Eq ~axsecurities, we strongly encotrage you to do so wah the 

expectation of owning those securities tor an extended period or time -at a minimum, for six months. We rerognize, of course, thai your personal arcumSiances may change due 1o unforeseen events, In 

which case you may be forced to more quicldy liqui:late Equ ax seruriies that you originally purchased 

whh the intent ofhotling as a long-tenn ilvestmenl In addhion, members of Group Three are subject to 

imhations on purChases and sales whhin a six-month period pursuant to Sedion 16(b) of the Exchange 

Ad. 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000005 
102 


10417058.eps

Shott Sales. A 'short sale" is (i) a ttansacllon inwMng securities that the seller does not own at the lime 

of sale or (1~ a ttansaction invoMng securities thai are owned by the seller althe time of sale, but where 

the seclllilies wil not be deivered against such sale within 20 days thereafter or deposited in the mails or 

other usual channels of ttansportati)n wahin five days thereafter. SeWng securities 'short" Is coosislent 

with an expedun !hat the price of the securities will decline in !he near Mure and is often sperulalive in 

nature. Short selling may arouse suspicion in !he eyes of the SEC !hal the person was trading on the 

basis of Inside information, particutarty when !he trading ocoutll before a major COfTilany annouooement 

or evenl Aooolll~, our employees, offK:elll and diredotll are prohibited !rom engaging in "Short sales" 

of Equifaxsecurilies or in any other transaction involving Equifax securiies thai is entered into~ the 

expectation of. or that wl l benefit from, a decline In !he prk:e of Equlfax's securities. 

Dtrlvative Sewlitles; Hedging. De!iw!Ne securiies are securiies contracts or arrangements whOse 

wkle wries in relation to the priCe of Equifax securities. For example, derivatiVe securiies woutl inClude 

exchange.ltllded 1)1.( or caU options, as wei as in<ividualy armnged derivative ttansactions. Many forms 

of derivatiws a.re sperutatNe in nature (meaning that their value luctuates based on sllort4erm chaoges 

in the priCe of Equifax securities), and the purcllase or sale of such derivatives by Equifax employees, 

oflicetll or dlredors could motivate them to take actions that are ln conOid will the long·tenn interests of 

other sllareholdelll and could also cause the appea/llnce of misuse of inside information. Certain forms 

of hedging or monetization ttansactions, such as zero-cost co831lland forwafll sale contracts, allOw an 

in<il1dual kllocll in much of the value of his or her stock holdings. often in exchange for all or part ol the 

potential tor upsi:le appreciation In the sloolt Such hedging and monetization ttansactions allow the 

inlividualto continue to own the coYered securities, but witho.- the full risks and rewaflls of owneooip. 

'Mlen that occ.rs, the individual may no longer have the s001e objectives as !he Company's other 

security holdetll. Aooollflngly, our employees, olficellland directors are prohibited !rom purcllasllg or 

seling derivative securiies, or entering Into derivatives contracts or hedging and monetization 

ttansadions relating to Equifax securities. The prohibition on transactions in derivatives does not apply to 

stock options and other interesiS Issued under Equifax em!*'yee benef4 plans. If you have any questi)n 

as to whether a particular type or arrangement or derivatiVe ttansadion is pemitted under this Policy, you 

should contact the Oft'~ee of Corporate Secretary. 

Pledged Securltiu; /lllrg/n Loans. Under typical pledge or margin arrangements, a lender or brol(er Is 

entiled to sel securities which you haW! deposled as COllateral for loans if !he value 01 yotX sewrities 

falls below a specified level or in cet1ain other cilcumstanoes. EYen tho~ you did not initiate the sale or 

control its timing. because lis S1JI a sale for your benefit. you may be subject to llabit~y under lnslder 

trading taws~ such a sale is made at a line when the 'Window" is dosed (as described below) or you are 

in possession of material non·public information at the time of sUCh a sale. If such a sale involves a 

member of ~P lllree, n can lxing unwanted negative pubiQiy to the Colf4lany and you. In add~ion. 

pledging may be used as a part of hedging strategy thai would ref!IO'Ie the lui risk and rewaros of stock 

ownership, and sever your ~nment will that Of Equilax's other seCUiily hotletll. 

GrouoThree 

Mentels of Group Tlvee are prohibied from pledging Equifax S8Qlriies or using Equifax 

securities to secure a margin loan, Tllis Policy does not prohibit membetll of Gtoup Three from 

holding Equffax securties in brokerage accounts, so long as any Eqlifax securities held in such 

account are explicily excluded from any margin or pledge afl3ngements. Sales of Equffax 

securities which are held In a ma~gln account are not exef11ll from insider ttadlng taws or this 

Po riC'/. Aooofllilgly, Mn though utilizing accourts !hat exclude EQilifax setllities would not be 

subject to restrictions under this Policy, you should be extremely carerul when utililing a margin 

loan In a brokerage account that contains your Equifaxsecuritles. 

Groups One and Two 

Wile petllons in Groups One and Two ate not ~¥Qhlbited !rom pJe(Jging Equifax securities, sales 

of Equifax securilie$that you haW! pledged as securty for a loan or which are held in a margin 

account are not exempl from Insider ltllding taws or !his Policy. Aooordingly, eYen though 

6 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000006 
103 


10417059.eps

ente~ Into sudl arra ~~gements would not be considered a sale, and would no1 be SIJ~ 1o 

restrictions under Ibis Policy, members of Groups One and Two shook! be eldremefy careful 

when pledgilg Equilax securilies, utiizilg a ma111in loan In a brokerage aoc:ount or otherwise 

usilg Equilax secJrities as CCIIIateral fo<' a loan. 

Any sale must be made in COI11)1fance wih lhe reslticlions underlhls Policy that ~Y to you, SUCh as trading wildows and pre.dearance requkemenls. As a resull, ~you pledge your Equifax securties or 

use Equifax securties to secJre a margin loan, yoo may be forced to lake actions (lor instance, 

depos~ additional money or selng other secJities) in order 1o avoid 1'011' lender or b<oker selling your 

Equnax securities at a time that would result in a \1ola6on of Insider trading laws 011~ Poley. Simla! 

calrtlons a~ to any Olherarrangemenls under which you have used Equnaxsecuritles as colateral. 

Menters of Group Two must receive pre.dearanoa pr10I to eote~ into any pledge 01 margin 

arrangement ini'Oiving Equnax secJritles to avoid an lnadvenent viola6on oflhis Policy. 

Safest Time fOt TraiiSaC!ions. All employees, oficers and d'reclors, whether or not subject to the 

trading wmows or pre.dearance procedures descr'bed illhls Policy, are reminded that the safest time 

for transactions il Equnax seC&Jtities wil generally be just rollowi~~g lhe ltadi~~g wildow opens after lhe 

release by the ~ny of financial informaCion relating to a COfl\?leled fiscal quarter, as deserted in 

Sedlon IV below. The appeatanoe or Improper trading may 1n«ease as lhe Company approaches lhe 

end or lhe next fiscal quarter. 

Ill. UNAUlMORIZED DISCLOSURE OF MATERIAL, NONPUBUC INFORMATION PROHIBITED 

Gflteral Rule. No employee, otrK:er or diredOI may disclose materia~ nonpubic lnlonna6on about 

Equ~ax Of any COfl\?3ny will which Equffax deals to anyone oulside of Equilax. uress authorized to do 

so. 

Tipping. Under the fede~ seQJities laws. you can be held responsible not only lot' your C1ft1l ilsl'les 

trading, but also lor secJriies transactions by anyone to whOfn you discklse material, nonpublic 

inlonna6on. Even llhose to whom you disclose suell information do notltade whie aware of the 

information, you can be responsible for the ltades ol persons who received material, nonp!blic 

infonnation indiredly tOJn you. 

Discussing 01 RecOtlllnending Eqvilax Secut/ti$$. We teQ)Qllize lhale111)1oyee enthusiasm lor 

Equ~ax and lis busiless prospeciS Is a vital element of our success. You should, howewr, use extreme 

caution when discussing Equnax Of Equifax securties with anyone outsKie of Equ~ax. In the course of 

diSCIJsstiQ Equffax or Equffax secJrlties, accidental d~c:losure or material, nonpubic inlonna6on can 

occur and can be >Aewed as 'lipping." Likewise, reconrnendations or Equlfax securities can also nesulln 

embanassing sluations lor you or the COJnpany ~you make a recommenda6on ai a time when there Is a 

pendllg announoament or materia~ nonpubic lnfonnation by the Company, ewn ffyou are unaware of 

lhallnl01ma6on. 

Internet and Sociallrledia. Consumer engagement though lhe Internet and social me<5a is an important 

part of our business. The provisions cJescr'bed In lhis Policy about lhe unaulhorb:ed disel?SIIre or materia~ nonput6: llforma6on and 'lipping" apply equally to any statements that are made on the 

Internet and lhrough social media outlets. lnclud'flQ on our websie, any 1o1m ol'chal." including 

disCIJssion forums and blogs, and on Face~ Twiller,lnstagram, Snapchal, Pinteresl, You Tube and 

other outlets, by our el11)kr;ees, ofticers and d'reclors. Yoo should also refer 1o the Equnax Social Media 

Policy. 

Authorization fo Disclose Material, Honpublic Information. We authorize only certain employees, 

ofticers and dmors to make pubic disdlsures or material nonpubic lnlonnation or to conferw~h 

persons outside lhe Col11)8ny regarding SUCh information (for exa~e. our aooitors, outside counsel and 

olher ad'Asors). Unless you are authorized to do so purwant to the Equ~ax Inc. Corporate Disclosure 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000007 
104 


10417060.eps

Policy, you should not discuss material, nonpublic information wih anyone not In the Company. Even in 

discussilns w~h other Equifax employees, you should consider the consequences of disclosing material, 

noopub&c infonmation to them. For exaqlle, by doing so, you would precbfe those pefSOils ll'om Jrad~ 

in Equifax's seooriies untl the infonnation is publicly disclosed. Accord~ly. you shol.ld restrict the 

ronvnunicalion of matelial, nonpublic infonnation to those employees, officers and dkectots having a 

need to know in order to sem Equifax's interes1S. 

Regulation FD (Fair Disclosure). There are SEC rules and regulations ballning selecli;oe disclosure of 

information relating to pubi'IC oompanies. Generally, these regulations provide that when a pubic 

Cllmpany (sum as Equ~ d1Sclo6es material. noopub&c infonnation, a must pf'OI4de broad, nonexelusionruy pdJic access fo the fnfonnation (for example, through press releases, Cllnference calls or 

webcasiS). VIOlations of these regula lions can res'* In SEC enforcement actions against you and the 

Company, re&Jiting in injunctions and severe monelaly penaties. Regulation F1) apples largely to a 

inied group of senior oficers and the Investor relations pefSOilnel who regularly Cllnmmicate witll 

securi1ies mart<et professionals and shareholders. Remember that no other Equifax employees, ofticers 

or directots are authorized to convnunicate fnfonnatioo reganling the Company with securities mart<el 

prolessionals, shareholders or members or the media. You should refer to the Equ'rtax Inc. Corporate 

Disclosure Policy for further information about these regulations and requiements. 

Non-Disclosure .Agreements. Employees, officers and directors invol\led In transactions or other 

negotialions that reqtire cfiSCios~e of material. non public infonnalion wlh parties outside Equifax should 

generally have those to whom sum Information is being disclosed sign a non-disdosure agreement in a 

fonn approved by the Equifax legal departmenl The non-d~ agreement will reqtire that the 

recipient of fnfonnalion not disclose the Information to others and require the recipient not to trade in 

Equ~ax securw while in possession of such Information. You should oonfer witll Equifax legal 

department whenever a non-<lisdosure agreement may be needed. 

rl. TRADING WINDOWS 

Standilrd Trading Window$ for Groups Two and Three. If you are a member of Group Two or Three, 

you may only purchase or stl Equifax securiles: 

• during the designated trading windows desaibed belOW, and 

• when you are nolln possession of materia~ nonpublic infonnation. 

OIASide olthe trading windows, members of Groups Two and Three may not pun:hase or sell Equifax 

SeQirilles, ewn ~they are not personally aware of any material, nonpublic infonnatioo. However, 

membeiS of Groups Two and Three may engage in Permitted Transactions (desaibed in Section VI 

below) outside of the Jta(lng windows. 

The Office of Corporate Secretary will communicate to each member of Groups Two and Three when 

each trading window will open and close. His expeaed that the trad~ window generally wiD open on the 

seoond tracfng day (assuming the first trading day Is a tulltlllding day) after our qua~etly release of 

earnings and will close at the end of trading on the last trading day of the second month of the folowing 

quarter. However, you should not expect that the window will open on eny paltioolar dele or remain open 

for any minimum period of tine. Significant corporate developments may require changes to the 

schedule, including clos~ the window at the Company's option at any lime. 

Do not confuse the applicability or the trading windows with the broader prohib~ion on trading 

when you are in possession of material, nonpublic infonnation descriled in Section II. 

Regardless of whether the trading window is open (l( closed, you may not trade in Equilax 

secur~ies ~you are in actual possession or material, nonpublic infonnation about Equifax. 

SpeciiiBJac•ours. We reseM the rigllt to impose a trading blackout from time to time on al or any 

group of our employees, officers or directors when, in the judgment of our CLO and other senior officers, 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBCOOOOOOOOS 
105 


10417061.eps

a blackout is warranted. !luring a special blaclout, you wil not be permilted to purchase or sel Equifax 

securities and you may or may not be aDowed to execute Perrnited Transactions (as defined below). A 

special blackoul may also prohi>il you rrorn tradilg in the secutties of other oompanies. II the CLO 

impo$e$ a blackout to which you are subjed, we wil notify you when the blaclout begins and when i 

ends and the secumies and transadions to wtlicil l appies. Airy pelSOR made aware ollhe eldslence of 

a special blackout should not d'ISdOse the exis1ence or the restridion to any OCher pe~. The llliklre of 

the Company to de~nate a ~ as being subjed to a special blaclout will not relieve lhat pelSOR of 

the obliJation to retrain from trading wtlie aware of material, ROfllUblic informalion. 

Standing Ordm; Umlt OrderS. Purchases or sales resullng rrorn standing omers or linl orders may 

resu.tt illhe execution of orders wllllout your oontrol over the transalilon or your awareness of lhe liming 

of lhe transaction. Even Jhough you placed lhe order at a line when you were permitted to enter Into 

transactions, you must be certain lhallhls 1)1)e ol order win not be exeQJ!ed when you are in possession 

of materia~ noopubic infonnation about lhe Company or during a blackout period. Accordingly, any 

standing orders should be used only for a very brief period and wilh delalled instrudlons to the broker 

who wil execute lhe transadlon. Standing orders under an approved Rule 10b5-1 Trading Plan, 

described below, wll not be subjed to these linitations. 

V. PRE.(;I.fARANCE Of TRANSACTIONS 

General. Before ptrehasJno or se~ Equ'dax securilies, members ol Group Three must obtain 

clearance or lhe transadloo from the ClO (or his or her designee). This clearance must be obtailed 

!1!!2!! you place lhe order for. or otherwise inliale, any transadion in Equ~ax securiies. Two business 

days· ad'lllllCe wri1en notice is requested fllf a proposed transaction. Any pre-clearance thai you obtain 

wUI be valid fllf a transaction exeeuled within two business days, unless eiher the pre-clearance is 

granted for a shorter or longer period or you learn of material. noopublic infonnation during Ill at lime. 

Wlether or not your request lor pre-clearance is granted, you must not inforTR anyone else of lhe results 

of your request. 

Do not confuse pre.<learance of transactions with the btoader prohibition on trading when you 

are in possession of materia~ nonpubic infonnation described in Section II. Regardless of 

whether you have received prulearance for a transaction or wl1ether a trading window is open or 

closed, you may not trade in Equ~ax securities l you are in actual possession of materia~ 

nonpublic information about EquWax and your tompliance willl insider trading laws remains 

solely your responsibil~y. 

Permitted Transactions. Members of Group Three are not required to receive pre-clearance prior to 

entering Into any Pe«nitted Transaction, except they are required to do so before exertistog any stock 

options or making any gifts or Equlax securities. 

VI. PERMITTED TRANSACTIONS 

The followi'og are "Pennltled Transactions': 

• acceptance or receipt of a stock option, shares of restrided stock or similar grallls of securilies 

under one of Equifax's equly-based benefit plans (IICiuding eteaions to ac:qure stock opei)ns or 

securities In ieu of OCher ~nsetion) or lhe cancellation or folfellle of ~ns. restricted 

shares or securities pursuant to Equlax's benefd plans: 

• eteaion lo partq,ate in, cease participation in or purchase securiies under an EquWax ~yee 

stock purchase plan or d'l'lidend rein'le51ment plan, ~SUCh a plan is in effed (see "Employee 

Benefit Plan Transactions" below); 

• eami'og or vesting of stock options or shares of resllicted stock and any related stock withholding; 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000009 
106 


10417062.eps

• elre!Cise of stock options issued under Equifax plans in a cash eJrertise, a stodc-1«-stock 

exercise or a nel share exercise, payment oflhe exercise Pfi:e in shares of already-owned slock 

and any related stock wilhholding lransactions, !!!!.!!2! (~ the sale of any stock a(Quired in lhe 

~n el<2rdse, (i) a •cashll!$$ exercise' in which shares are sold in the matte~ or Qii) lhe use of 

proceeds from the sale of any such shares to exercise addilional o~s (see 'EnlJioyee Benefit 

Plan Transactions• bek>w); 

o tlansl~ sec:urities to an enliy !hal does not involve a cllange in lhe beneficial ownership of 

lhe securllies, for example, to an inler \i.os trust of which you are the sole beneficiary duling your 

lifetime (see "Transactions in 'Mlich There Is No Change in Beneficial Ownership' bek>w); 

o making payroll conlribulions to and receiving matching Company conlribWons in the Equifax Inc. 

401(k) Plan, defefred compensation plan or any similar plan, btll not (i) intra plan tlansfers 

Involving any Equifax securilies nor Q~ a cllarige in ,nveslmenl d"rection' under sutll plan to 

increase or decrease your pe«:errlage inveslment conlribulioo alllcated to Equifax sea.wities; 

• bona fide gifts of securities, !!!!1M! where you are delivering lhe Equlax sec:urities in payment of 

a previous CIO!'niOOnenl ~ make a cash gift or where the Equlax sec:urilies are being delivered In 

payment of any other obigations (see "Gils of Equifax Sectriles' bek>w); 

o execution of alransaclion pursuant to a contract, instructioo or plan deserted in Secuilies 

Excllange Ad Rule 10b5-1 (called a "Trading Planj, as discussed below (see 'Trading Plans' 

below); or 

• any olher transaction designated by lhe Boaro of Direaors or any Board commitee or senior 

management, wilh reference to this Poicy, as a Permilred Transadioo. 

Pr&-0/sc/osuiY! of Und/sc/ostd Maltrial, Nonpublk Jnfomvtjon. You may nof enter lnlo any 

Permitted Transaction unless you have disclosed any material, nonpublic information of which you are 

aware lo the ClO (or his or her designee); provided, lhal members of Group Three must disclose any 

such inl«mation directly to lhe CLO belore any transaction isted qualif.es as a Penrilted Transadioo. 

This eRS4Jres lhal Equifax is fl.i~ aware of any material information affedlng any securly before you enter 

inlo a transaction inwlving Equifax seculiies. 

Employee Btnetll Plan Transactions. Most of lhe ongoing transactions you mlglrt enter nto undef 

Equijax's equly-based bene II plans a.re included in the defmillorl of Permitted Transactions. For 

eX311llle, alhough your ongoing J)311ic4lation In a plan may nwllle lhe regular pulthase of Equifax's 

oommon stock, elher directly pursuant to an Investment election or bdiectly through an employer 

matching oonlribulion, lhose pulthases aiY! Permitted Transactions. Nib, hcwev.r, that the movement of balilnCfS in ltlose p/aJIS into or out of Equifax securities or changes in your investment 

direction undtr ttrose p~«ns are~ Pennltted Transactions. This means !hat you may not make 

transfers or elections of Equifax securties while you a.re In possession of malenal, nonpubllc Information 

and 1ha1 sucll transfers or ele<:llons must be made in oomplianoe w~h 8ft'/ other restrictions undef this 

Policy lhalapj)ly to you (for instance, r you are in Group Three, such transfers or elections oould only be 

made during an open trading window and with pre-clearance). 

Transadions In employee stock oplioos are also considered Pemitted Transadioos ff there is no related 

sale on the matte! or to a person other than EquiD. Note, however, that a sale of stock fo/Jowfng or 

fn conMd/on with an option tnreise Is !!2! a transac6on with Equifax and Is, ~m. !!2! a 

Permitted T111maction. Thus, you may engage in a cash exercise of an~ as long as you retain the 

stock you buy In the exercise. You can also engage in stock·for-slock exercises or elect stock 

wilhhOiding ~ violating lhe Policy. However, lwould not be a PerrriUed Transaccion ilr you to 

exercise a stock o~, sell the resulllng sha.res and then use lhe proceeds from that sale to pay f()( lhe 

exercise of addliooal stock options In a same day sale. Alhough exercises of Equifax stock options are 

Permitted Transaclions, men-betS of Group Ttvee rrust pre-dear all stock option exertises. 

Transactioo$/n Which There is No Change In Btntf'IC/11 ownership. tel1ain transactions lnvoN8 

meiY!I\' a cllange In the form In wNc:h v<~u own sec:ulities. For example, you may transfer shares of stock 

10 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000010 
107 


10417063.eps

to a trust if you are the only beneliciafY of the trust during your lifetime. Ukewise, charging the fonn of 

ownership to incble a member of your household as a pint owner 0< as a sole owner is a Permtted 

Transadion silce membels of your household are considered the same as you for pu!p05eS of this Policy 

(and the sha~ wil remain subject to the tenns of this Policy). 

Gills of Equifax Securilies. Bona fide gifts of Eqtilax securities, wllether to charita~ ins$Uiions 0< to 

liends and family meJTilers Oncbllng into any trust), are generllly considered to be Pennilted 

Transadions. ~r. ij you are mamg the gil to satisfy a previous commitment to make a cash gift or 

;, payment of another obliJalioo, then the gift woukl not be a Permiled Transadion and the normal 

restrfdlons wotjj be applicable. This Polley Is designed 10 preve1lt employ~ trum malitog gills of stocl\ 

when the gift wll satisfy a preW!us pledge of cash or not be considered a 'bona fide' gift. Although bona 

fi:le gillS of stocl\ are Pem'illed Trans1ers, members of Grol.l) Three 10051 pre-dear all gifts of shares. 

Trading Plans. The SEC has enacted a rule (Rule 10b5-1 undenhe Securities Exchange Ad of 1934) 

thai provides an allinnaliw defense against >Aolations of the insider boding laws if you enter into a conlrad, provide instructions, or adopt aw1ilten plan for a 1/ansadion il seculties wllen you are not il 

possession of material, nonpublic information, even W ltums ott that you had Stich information when the 

lransadioo is actually cofl'Cl(elad. The contract, instrudioos, or plan must: 

• speQ!y the amoun~ price and dale of the transaction, 

• speatyanOiljedive method fO<detennininglheamount, price aroddateoflhe transadioo,or 

• place the disaetion for detem'iniiQ amount, price, and date of the transaction in another pe~S<~n 

who is not, at the lime of the transadion, il possession of material. nonpublic information. 

You may not exettise discretion Q( influence oW!r the amounl price, and date of the tmnsaction after 

entering Into the arrangement. In this Poticy, we refer to these arrangements as "Trading Plans." The 

rules regarding Trading Plans are extremely complex and must be complied wlh completely to be 

effectiye, You should oonsider consultation w~h your own le\)al ad>isor before proceeding with entering 

into any Tmding Plan. 

Any reslrictlons under lhls Policy thai apply to you when purdlasilg Q( seling Equnax securiies also 

apply to you when eslabishing a Trading Plan. Therefore, you may not eslabish a Trading Plan when 

you are in possession of material, nonpublic inloanatlon about Equifax and, to the extent trading windows 

and special blackout periods apply to you, those restllctions must be complied will in connection wkh 

establishing a Tradii'IQ Plan. The Company may trum tine to tine adopt additional rules tor the 

estabflshmenl and operation of Trading Plans, and you wDJ need to comply wlh these rules In Q(der to 

utiile a Trading Plan. In addron, members of Groups Two and Three are required to receive preclearance before entering into any Trading Plan. Once a Trading Plan for a member Of Group Two or 

Three has been pre-deared by the ClO, uansactlons executed pursuant to lllat Trading Plan do n01 

require approval. Members of Group One are not required to pre-clear Trading Plans, btllthey are 

required to provide copies of lfleHfllding Plans to the CLO prior to any tJadilg is begun thereunder. 

In establishing any Trading Plan, you shouli cere fully consider the liming of your transactions under the 

Trading Plan. E.en though b'ansadioos executed in aoooldance wilfl a Trading Plan are e>rempl tom the 

insider trading rules, the trades may nonetheless ooour al times shortly before Eq<ifax announces 

material news, and the media may not unde~Stand the nuances of·lrading pursuant to a Trading Plan. 

Vll SANCTIONS FOR VIOlATIONS OF THIS POUCY 

The SEC. the stock exchanges and plaintiffs' lawyers focus on uncovering insider lrad'IIQ, and use 

sophisticated technologies 10 in~ale St!Spicious aelivily. 

A breach of the insiler trading laws could expose the insider to cri!rinal files of up to SS,OOO,OOO and 

imprisonment of up to 20 years, in addiioo to civil penalies (up to three limes the profits eamed), and 

11 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000011 
108 


10417064.eps

iljmctive actions. In addilion,pCJnilive damages may be imposed under appicable stale laws. Securities 

laws also subject controling persons to cMI penahies fo< ilegal insider lrading by employees. Controlilg 

peiSOilS include drecto<s. officers and supel'iisors. These persons may be subject to 1iles of up lo lhe 

grealer of $1,000,000 or lllree times lbe ptOfrt rea filed or loss avoided by I he insider. Acc:onlingly, all 

Equ~ax employees llllSI COf1lliY wilh this Policy and applicable securities laws and to ensure thallhose 

errj)loyees who lhey supel\'ise also <:Oflllly. 

Inside information does not belong to any of Equifax's individual employees, officer.; or diector.;. This 

infoanalion is an asset of the <:Ofll)&ny. For any person to use suc!l information for per.;ooal bene&t or to 

disel05e ~to OCher.; outside or the Corrc>any violates the COde of Ethics,Ulis Policy and fedelal securftles 

laws. More pattlculat1y, insider lradlng is a flaud against member.; of the lnvesllog pCJblc and against the 

Corrc>any. Wlethet or not there Is any actual tradif'G ol our securities, any Yiolatioo of this Policy wl be 

grounds for d~ne. up to termnation of emplOyment fo< cause. 

VII. ADMINISTRAnON OF THIS POUCY 

Admln/S1ntlon and Review. The day-to-day admiliSIJatioo of this Poticy,lncluding appropriate trailing, 

wUI be carried oot by Ule Office of Corporate Secretary, undet the direction of the CLO. ff )'OU have any 

queStions concerning the Interpretation of this Policy, you should dlred your questions to the Oftice or 

Corporate Secretary (CorporateSecretary@equifax.corro. 

Repo11ing Violations. Hyou beoomeaware ofany\iolation of this Policy, you should repM n 

Immediately to the Office ol Corporate Secretary. 

Exetnpliorl$. An individual subject to !he tradilg wlldows or spectal blacko~ periods described il 

Section rv may request Ulat the CLO grant him orhef a hardship exemption 1rom those resllictions ~he 

or she is not otheiWise prohibited from trading undef Section II. However, we anticipate that exemptions 

wil be given very rarely and ooly in extreme cirwmstances. 

Amendment of the Po/'l(y. This Policy may be amended from time to time in the discretioo of the ClO. 

In SUCh event, we win COtMIUnicate to you lhrough normal comn'Ulicatioi\S Channels the subStance of 

any such changes. 

The u~ mate responsibility for complying with this Policy and app6cablo laws and regulations 

rests w~ you. You should use your best judgment and consubhh the ClO (or his or her 

designee), the Office of Corporate Secreta!)' and your personal legal and financial adv1sors, as 

needed. 

IX. ROlES AND RESPONSIBIUTIES 

Party Role I Responsibility I! 

Senior Leadership Team . Promole and implement a strong cukure of compliance; and 

ll 

('SLJ1 . SuppM el!ofts to iml)lement lhe Policy and sponsor aJ)pt'OIIIiate action 

to align with the Policy. 

Chief Legal Officer . Provide pre-clearance of transactions by mell'ber.; of Group Three and 

('CLO") Trading Plans for all employees, as may be required under the Policy; 

. Detennlne wher1 a spectal blacl<out period Is warranted; 

. Approve exceptions lo the Policy; and 

12 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000012 
109 


10417065.eps

Party I ROle I Responsibility 11 il . Approve amendments to the Policy . 

Policy Manager . Monitor Poley Implementation; 

. Periodically review the Policy and propose re'lisions to the ClO as 

appropriate; and 

. Coordilate review and aP!XOval of tile Policy and the iltemal 

ooflmJlllcation of Policy changes. 

Office ol Corporate . Oversee day·t!Hlay admilistration of the Policy; 

Secretary . Provide legallnlerpretalions insiler rad~ laws and regulations; 

. Review proposed revisions to the Poley; 

. Wlltt wih Company's management team to determine the appropriale 

restlictions under the Policy tor eadl employee and notify emplOyees of 

placement in or removal from Groups Two or Th~; 

. Maintail fist of designated insiders and oonmmlcale updates to 

internal and external personnel, as necessary; 

. OiStlibl!te periodiC reminders to designated insiders (members ol 

Groups Two and Three) will Information rega!lflng trading windows 

and pre-clearance requirements; 

. No!lfy em[lloyees In oonnedlon w•n any special blacltout period; 

. Provide legal guidance In the event that non-em[lloyees may have 

access to materiat nonpublic lnfomlatlon about the Company; 

. Assist in the development and maintenance ol applicable llaining; and 

. Provide legal guidance with respect to investigations and permissible 

disciplinary adlons. 

Employees . Read and oompy with the Policy; 

. Report PoHcy \'iotations and concerns to the Office of Corporate 

Secretary or the Policy Manager, and 

. Seek clarification from the Offte of Corporate Sectetary concerning 

any questions or ooncams with respect to oomplianca ~h lhe Poley. 

Non-Employee Dlrvctors . Comply wilh the Policy; and 

. Report PoHcy \'iolations and concerns to the CLO or other Sl T 

member. 

13 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000013 
110 


10417066.eps

X. REFERENCES 

• Equifax COOe of Ethics and Business Cooduct 

• Equifax tnc. Corporate Oisdoswe Policy 

• Equllax Social Media Poley 

XI. REVISION HISTORY 

VeBionf Revision Dale Revision C0111ments 

1.0 July 2017 Initial document creation; replaced existing policy on insider 

trading. 

14 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000014 
111 

EQUIFAX, INC., ‘‘CORPORATE CRISIS MANAGEMENT PLAN, PART I’’ 


10417067.eps

Et{UIFAX 

Corporate Crisis Management Plan 

Part I: Program Description 

May 2017 

Version 5.0 

This document is not intended to be used during a crisis. 

Refer to Part 0 -Crisis Mmtagemelll Team Response Plan 

for crisis response guidance. 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000015 
112 


10417068.eps

Equifax Crisis Management Plan Coofldernial- For htcmal Use Only 

This Document is not an Emergency Response Plan. 

In Case of Fires, Injuries, Tiueatening Situations, or Other Emergencies: 

Get to a Safe Place and Call 911 

(Outside US: Contact Local Emergency Services) 

Serious incidents should be reported as a potential Equifax crisis: 

• Fatalities, serious injuries, or dtreatening situations. 

• Fires, explosions or Olher events causing damage to a facility. 

• The risk or actual occurrence of confidential data oorruption, loss, dteft, or compromise. 

• Any incident causing dte evacuation or sheller in place of pemnnel. 

• Facility closure due to severe ll'eather or odter regional emergencies. 

• The risk or actual occurrence of significant operational disruption from any cause. 

Incidents that might be an Equifax crisis should be reported by calling 

the Equifax Security Hotline: 

+I 770.740.5555 

Suspected information security incidents will be reported to the Cyber 

Threat Center (CTC) by phoning: 

+1 678-795-7106 or 1-888-257-8799 or emailing: ttiYPERLINK 

"mailto SCQJritv ioc ~CGlifax.coiD' \b I 

0 2017 Equila.x. loc. AD Riglls Rcsavcd 

v.5.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG·SBC000000016 
113 


10417069.eps

Equifax Crisis Management Plan Coofldernial- For htcmal Use Only 

Equifax's first priority is to protect the health and safety of people. 

Once actions are underway to protect people, the action lists found in the 

Corporate Crisis Management Plan- Part TT- Crisis Management 

Team Response Plan should be used to guide the overall Equifax 

response. Corporate Crisis Management Plan· Executive Summary 

This COI]lCmC Crisis Management Plan is a strategic dOCilmcnt created for Equifax's senior 

leadership. It provides detailed strategic response guidance for Equifax's exe(l)tives to use wben 

managing a significant incident The plan establishes a structure and a process for integrating 

executive, managerial and operational resources. Finally, it provides a framcWO!k to facilitate 

efficient and timely collaboration between: 

• E.xe(l)tive leaders 

• Depanment heads and their teams 

• Functional leaders and their organizations 

• Subject matterexpens 

The plan defines and integrates all Equifa.x resources and supporting plans needed for effective 

crisis response, including: 

• Emergency response 

• People suppon 

• Business continuity 

• Crisis communications 

• IT disaster recovery 

• Card B1111d notification 

• All other Equifa.x-specific response plans 

The plan mandales a crisis management "CMT Coordinator," who oversees crisis management 

planning, verities the response processes defined in the plans, and audits the eA'ectiveoess of the 

entire response organization. 

The plan is specifically intended, during a declared crisis, to: 

• Take all steps needed to prcxect the safecylwcll..beiog ofEquifax personnel and others in 

all Equifax facilities. 

• Provide a framework for full or partial activation of broader response organizations. 

• Procect tbe reputation, assets, mission and survivability ofEquifax. 

0 2017 Equila.x.la:. AD Riglls Reserved v.5.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG·SBC000000017 
114 


10417070.eps

Equifax Crisis Management Plan Coofldernial-For htcmal Use Only 

• Manage the effective recovery of infrastructure (systems, buildings). 

• Verify cootinued regulatOI)' and legal compliance. 

0 2017 Equila.x.la:. AD Riglls Reserved v.5.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG·SBC000000018 
115 


10417071.eps

Equifax Crisis Management Plan Coofldernial- For htcmal Use Only 

The plan defines an organization with the supporting tools, equipment and processes to 

ell'ectively respond to any type of serious or catastrophic incident, for example: 

• Operational issues such as offioelda1a center emergencies. 

• Any situation that attrac1s 1he attention of the media and the public and could damage the 

reputation ofEquifax. 

• Kidnapping, 1errorism or other serious crimes. 

• Nalllral disasters such as hurricanes. earthquakes, or flooding. 

• Public health disasters, epidemics or pandemics. 

• Financial crises, such as maricel-related situations, a major decline in Equifax's stock 

price, earnings, or l1aurl. 

• Informational crises, such as a loss of proprietary and oonfidential information, tampering 

1~i th computer records, security incident or loss of IT infrastructure. 

• Legal issues, such as the indictment or arrest of a senior executive. 

• PoliticaVCivil unrest impacting business operations or personnel. 

• loss of the use of m~or offices /data centers for any other reason. 

• Untimely death or reponed illness of a member of the executive team. 

• Data breach of PC! associated data. 

This plan is divided into three pans. 

• The first section, Part I: Equifax Crisis Managcmtnt Plan· Program Description. 

consists of Sections A through E, and is designed to: 

• Document how Equifax has agrood to prepare for, monitor and n:spond to a 

significant incident. 

• Provide a document to improve CMT members' awareness and capabilities. 

• Provide a benchmark v.ith which 10 evaluale performance during an exercise or aetual 

crisis. 

• The second section, Part U: Equifu Crisis Management Plan: Crisis Managemtnt 

Team Response Plan oonsiSIS of a lis1 of slr.ltegic considerations and p«ential actioos 

for Equifax's leadership, ocganized by fimction. 

• The third sec1ion, Part ffi: Equifu Crisis Managemenl Plan· Appendices, consis1s of 

supporting plans for each fimction and business uni~ along wilh activation and 

notification procedures. 

Finally, the plan includes policy, principles, scope, purpose and definition Stalements to help 

align crisis response 1vith Equif~tx culture and provides guidance for principlc-basod decision 

making, It establishes authority levels and defines roles and espon~ib li ties for executives and 

their 01g<111izarions. Operational guidance, facilities, equipmen~ training and maintenance 

requirements are described at a higb level. A supponing organization i~ clearly definod, and 

command and control pro1ocols are established so thai Equifax's leadership can quickly activa1e 

a reliable, trained and integra1ed response 01g<111izatioo during the stressful and confusing events 

that aC£001pany any catastrophic incident 

0 2017 Equila."<.la:. AD Riglls Reserved v.5.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG-SBC000000019 
116 


10417072.eps

Equifax Crisis Management Plan Coofldernial- For htcmal Use Only 

Equifax Crisis Management Plan 

.Part 1: Program Description 

TableofCont~nts 

I. Cri~is l\Wiagcment Policit.s & J>rocrdurcs.-........... - ............... --.. ······-····· .. ·--·····-1 

A. Crisis Management Poticy .............................. _.,, ........... - ........................ - ........ 1 

B. Crisis l\Wiagerurnt Principles .......... - ........................... - ......................... --.... 1 

C. Crisis Mon.agemrnt Plan Scope .............................................. - ........................ --.... ..2 

1>. Crisis MJulJigtment Plan Purpo~ .......................... - .... - ........... ____ ... _ ..... ..2 

E. Audience ...... - .... - ........................................ - .......... _____ .. _, ...... - ...... ..2 

F. Corpornte Crisis. Delinitioo ..... _ ............................... - ............ _ ..................... 3 

11. Organiution and RespOnsibilities .............. - ................................................................. 4 

A. CE0 ..................................................................... - ................................................... 4 

B. CMT Leadtrship ........................... _ ........................................................... _.. ... 4 

C. Crisis Management Tram Prrsonnel . .............................................. - ...................... .4 

D. Ovenlll Crisis Muagemt.nt Struciurr .................... _ .. _ ....... _ ........... _ .... 4 

E. Ovet'llll Crisis Managrmmt StructtJre (Grapblr)-........................................ - ....... 5 

.F. Crisis Action Teams ........ - ......... - ........................... - ........... -............................ 6 

G. Operational Teams..... ......... - ............. - ................... - ............ _ ....... - ........ 6 

H. CMT Coordinator ...................... - ....................................... - ................................... 6 

l. CMT Membrl'$. CAT Leaders and Roles .............................. - ................................ 7 

UJ. C~lT Gtntnl Responsibilitits ............................................................................................ 8 

A. CIIIT Planning Responsibitilirs .................................................................................. 8 

B. OIT ResponsibiUties during a Oeclarrd Crisis ................... - ....... - ........................ 8 

C. CM1' Responsibilities after n Crisis .............................................................................. 9 

0. OIT Authority .................................................................................... - ..................... 9 

IV. CJIIT Member Responsibilities .......... _ ................................ - ... - ................................. 10 

0 2017 Equila.x.la:. AD Riglls Reserved v.5.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG·SBC000000020 
117 


10417073.eps

Equifax Crisis Management Plan Coofldernial- For htcmal Use Only 

V. Silt Emergwcy RtSpotue Lrader/Commaod and Co•nruurtkalions Unificalion .... - . .30 

A. [qoifn tmergen~y Response-···········-···········--··········--······-·--·············-···30 

B. Exlernal Emergent)' Rtsponse Command Unification ........................................ 32 

C External Comnruniutions Unification -········-·······-····-·····-······-······32 

VI. Operational Guidance ·-····-·······-·····-·······-······-·-·····-·····--·-····-······33 

A. Incident RtSOiution or Escalation ....... - ....................... - ................................ 33 

B. lnddenl Notirrutioo, Thrtat Asmsmtnt and Off activation ····-·-······--·-..33 

C lnridenl Anessmrnt Team· Activation Otcisions ........... - ............................... 34 

D. Plan Acliv2tion L.evels .............. - ..... _ ............................ - .......................... -.... 35 

E. DHscalatioo from Respond Ltvd Activation .. -·· .. -------..... - ...... - ...... 35 

F. Off Adioo Lists ........................ - ................... -................................................. 35 

G. Commnniution wirb the Board of Direcloll .................. _ ........................... - ... 35 

VII. Faciliries and Equiprutnt ........... _,_ .. _ ..................... - ....................... - ... 36 

A. Equif:u Ste11riry llorline ................................................... - ............................... 36 

B. £quifax's Crisis !bnagemtnt Bridge Lint ...................... _,_ ............ -.................. 36 

C Eijuifu Crisis Command Cmter ...... - ................................................... - ...... 36 

D. Crisis Commuoication Ce.nttr ........................................ -.......... _ ................ .36 

£ Media Briefing Ceotrr .................................. _ ........... - ........................... - .. 36 

F. Olher [quipmtnl.-................................................................................................. .37 

VUl Maintenance a.nd Traioing ............... _ ...................................................................... 37 

LX. Appendices List ........ _ .................................................................................. 38 

NOTE: References to material cutside this plan arc in bold ilulic. 

0 2017 Equila.x.lrx:. AD Riglls Rcsavcd 

v.5.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG·SBC000000021 
118 


10417074.eps

Equifax Crisis Management Plan Confidential- For htcmal llse Only 

I. Crisis Management Policy & Principles 

A. Crisis ~fa ge eu t Polity 

Pate(PAGE( 

The Equifax Company headquArtered in Atlanta GA, is a global leader in consumer, commercial and 

workforce infonnation solutions, providing businesses of all sizes and consumers with infonnalion 

they can trust Equifax organizes and assimilates data on more than 500 million consumers and 81 

million businesses worldwide, and uses advanced analytics &Jtd propriewy technology to create and 

deliver customized insights that enrich both the perfonnance of businesses and the lives of 

consumers. Equifax operates or has investments in 17 countries and is a member of S&P 500 Index. 

It isE.quifa.x's policy to operate its businesses safely, and to be prepared to effectively respond to a 

crisis. The aisis management program is managed via the business continuity organization, with a 

mission to maximize Equifax's resiliency in the event of a disaster or significant business 

inten'Uption. The overall program seeks to: 

• Protect the well-being of personnel, clients and 1-isitors. 

• Protect Equifa., infonnation and facilities. 

• Ensure timeliness, availability, and usability of data at time of business disruptioo. 

• Protect against potential threats (man-made or natural). 

With this mission in mind, senior Equifax management is responsible for the devclopmen~ 

maintenance, and implementatioo of effective aisis management plans, processes and organizations. 

In furtheranoe of this mission, Equifax has adopted this program to train its people in aisis 

management Equifax maintains a Crisis Management Team (CMl), as defined in this plan, to 

manage incidents that are declared a crisis. 

The CMT will act based firs! on the oonoem for the ... elfare of all people including personnel, 

clients, visitors, emergency responders and community members. The secooda!y concern is for the 

protectioo of our assets. preservation of our ability to operate and serve our clients, maintenanoe of a 

strong Equifax reputation and ultimately !be preservation of shareholder value. 

/J. Crisis Management Principles 

If an &juifax crisis ocrurs, &juifax will respond using the following principles: 

• Place the highesl priority on Life Safely-the welfare of all people including personne~ 

clients, visitors, emergency responders and community members. 

• Pro1ect our assets and preserve our ability to operate and supply our customers. 

• Maintain a strong Equifa.x reputation through ethically and socially aware beha,iors that 

ultimately preserve shareholder value. 

• Coolply with all laws, mles and regulations applicablclo itsopcratioos and the incidcllt. 

• Make public disclosum dw an: full, fair. aoeU131e, timely and underslalldable regarding the 

effects of the crisis oo Equifa.x facilities. personnel, clients and operations. 

• Make decisions. and take actioos that are consistent 11ith Equifax's core \'lllucs. 

• Coosider all stakeholders in its ac1ions- and as appropriare, communicate 10 d!cm 10 a timely 

.. ay and using normal channels io the exlclll possible. 

• During a crisis, make aisis response a priority ovcr other needs, specifically the deploymellt of 

resources, e.g .. personnel and equipmmt 

0 2017 Equi&:<, In:. AD Rig~ Reserved 

v.5h 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May20t7 

EFXCONG-SBC000000022 
119 


10417075.eps

Equifax Crisis Management Plan Confidential- For htcmalllse Only 

C Crisis Management Ptan Stope 

Patel PAGEl 

Equifax mainlains a Crisis Management Plan (CMP) for its CMT to use to respond to crises 

involving its asseu, businesses, and reputation. This plan is global in scope. The CMT is 

prepartd to assemble personntl and begin implementing actions promptly, even as the 

severity of an incident is being confU'IIIed. 

The CMP is organized in three pans: 

• Pan 1- Program Description (this document) 

• Part II-CMT Response Plan 

• Part m - Regional Crisis Action Team Plans 

This sll\lcture is intended to facilitate a clear and efficient crisis response by separating the 

referell(C materials needed during a response to a crisis event from administrative elements of 

tbe program. Collectively, these two pans provide a framework. organization and operating 

concepts for crisis response, applicable to the entire global organization, by providing response 

command and control, resource support, and strategic direction from Equifax leadership. 

The CMP is designed to eomolement not supplant existing emergency resoonse disaster 

recovery. business continuity and crisis communications plans. It is designed to coordinate the 

responses of corporate and operational organizations to ensure issues and concerns of internal 

and external stakeholders are adequately assessed and addressed. 

f), Crisis 1\Unagemenl Plan Purpost 

The ultimate purpose of !he CMP is to create a process that minimizes the negative effects of a 

crisis lhrough active and efficient management of !he event. The bullets below describe how this 

lvill happen. 

• Equifax plans in advance for various types of crises that may occur. 

• A crisis management 01ganization and responsibilities are defined, maintaining the inttglity 

ofEquifax's line organizations. 

• The consequences of crises on both internal and external stakeholders are adequately 

assessed, 111\d appropriate Equifax resources are coordinated and directed to a crisis. 

• Early in a crisis, rapid, factual, coordi.nated communications are esmblished and mainlained 

lvith Equifax's internal and external audiences, with special emphasis on personoel. 

• Actions are taken to ensure Equifax meets applicable regulations. guidelines and public 

expectations. 

£ Audience 

This docurnem is Ill be used by the CMT and those departments and teams that may support 

them as defined in S«tion 11 

0 2017 Equi&:<, In:. AD Rig~ RCSCJVed 

v.5h 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2017 

EFXCONG·SBC000000023 
120 


10417076.eps

Equifax Crisis Management Plan Confidential- For htcmal llse Only 

F. Dtfmilions 

Corporate Crisis 

Pate(PAGE( 

A corporate crisis is an unplanned event related to Equifax's business !hat has the potential to: 

• Present a significantlhreatto human health, safety or !he environmenL 

• Cause a significant advmeeffecl on Equifax'sreputation. 

• Cause a significant disruption to Equifax's business. 

Notwiths!Anding the definition above, a Corporate Crisis is any event identified as such by 

the OfT Leader or designate. 

Examples of potential Equifa.x crises include: 

• Operational issues such as ofticer'data center emergencies. 

• Any situation !hat attracts !he anention of the media and the public and could damage the 

reputation ofEquifax. 

• Kidnapping, terrorism or other serious crimes. 

• Natural disasters such as hurricanes, eanhquakes, Oooding 

• Public health disasters, epidemics or pandemics. 

• Financial crises, such as market-related situations, a major decline in Equifax's stock price or 

earnings, or fraud. 

• lnfonnational crises, such as a loss of proprietary and confidential infonnation, tampering 

wilh computer records, security incident or loss of IT infrastruCIIlre. 

• Legal issues, such as the indictment or arrest of a senior executive. 

• Politicai/Ci il unrest impacting business operations or personnel. 

• Loss of the use of major offices /data centers for any odler reason. 

Corporate lntident 

A corporate incident is an unplanned country-b&s«<lregional event !hat has the potential to cause 

or has caused: 

• An unplanned business disruption across multiple BU/COEs 

• Prolonged responser'resolution requirements 

• High probability of impacuo multiple oustorners 

• Media i!M(uiries 

• Life Safety issues affecting multiple WO!kers 

0 20t7 Equi&:<, In:. AD Riglts Reserved 

v.5h 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2017 

EFXCONG·SBC000000024 
121 


10417077.eps

Equifax Crisis Management Plan Confidential- For htcmalllse Only Pate(PAGE( 

Notw~hstAnding the dtfmitioo above, a corporate incident is any event identified as sutb 

by tbe CCI' Leader or designate. 

Examples of potential &juifax corporate incidents include: 

• Extended power outage 

• Extended network/leleeommunieations outage 

• Security wlnerability 

• Employee Safety (inclement weather) 

• Local political/civil unrest impacting business operations or persoonel. 

• Local demoostrations/transportation strikes 

The CMT or CCT are activated when the CMT Leader and/or Crisis Coordinator (or designate) 

decides an event meets or has the potential to meet the definitions above. Further information on 

activation procedures is provided in Section VL 

0 2017 Equi&.'<, In:. AD Rig~ Reserved 

v.5h 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May20t7 

EFXCONG·SBC000000025 
122 


10417078.eps

Equifax Crisis Management Plan Confidential- For htcmalllse Only 

TL Or:anlulion and Responsibilities 

A. CEO Responsibilitifs 

Patel PAGEl 

The CEO is a~mtable for Equifax's response to a crisis situation and manages a crisis throogh 

the CMf. The CEO is not the hands-on leader of the CMT in most cases. Rather, the C£0 may act 

as the oorporate spokespersoo or address other key stakeholders as needed \lith support from 

Communications and other CMT Members. The CEO retains ultimate responsibility foc the 

effectivtness of crisis response when managed by the CMT. The CEO may delegate leadership of 

the CMT as defined below. 

1!. CMT wdmhip 

I. The Chief Legal Counsel is lhe Crisis Manager that bas decision authority over the CMT. 

2. If the Chief Legal Counsel is nol available 10 direcl CMT activities, 1he Chief Financial 

Officer will act as Crisis Manager. 

3. If none of these leaders are available, another senior executive, appoinled by the CEO or 

active CMT members will serve as Crisis Manager. 

C: Crisi~ !'tlanagement Tram Ptrsonnel 

Members of the Equifax CMT are senior leaders 'viih responsibility for one or more functions or 

departmeniS. These m ponsibilities aredefmed in Table A in S«tion IV. Together, theCMTbas 

line organization oontrol over the entire Equifax organization worldwide. Each CMT member will 

manage lhe response to an incidenl through a functioo·specific support team caiJed a Crisis 

Command Team (CCT), defined in Sectioo F below. 

C~ff Members representing each role on the CMT, e.~. HR, IT, Finance, Communications will be 

approved by the CEO and may be from various levels of seniority. Both executive level and 

SVPNP level staffwiU be identified for each role. SlaffingoftheCMT may be from eilherlevel, 

depending on the nature and po1enrial effects of the specific incide01. If the CMT is staffed by !be 

executives, 1ypically !be SVPNP level personnel will lead the CATs. 

Eacll CM'f mernbt.r will have at least one alternate member identified. The alternate shoold be 

equally familiar with ibeCMT member's roles and responsibilities. Typically, lhe CMT primary 

member and ahernate member will be activaled at the beginning of a crisis, and both will remain 

acliveuntil the need for two shifts is detennine. In the case of a one shift response, the alternate 

member can become part oftheCAT1eam. In the case of a two shift response, the primary and 

alternate members will take turns as CMT represemative as defined later in this plan. 

1). Overall Crisis Management Structure 

The chart on the foiiO\~ing page depicts the crisis managernen1 structure. II shows the 

relationship berween !he Slllllegic Crisis Management Team shown in red. and the Crisis 

Action Teams shown in blue, along with Operllional Teams shown in green that may be 

deployed during a crisis to support lhe Crisis Action Teams. 

0 2017 Equi&:<, In:. AD Rig~ Reserved 

v.5h 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2017 

EFXCONG·SBC000000026 
123 


10417079.eps

&joifax Cri~s ~iaoogement Plan ~-F~Jitlal!i(!IO!i) 

Crisi!Att®lrl'll 

$11'11Vllll9'~1* lliCO£ ~ 

~·~ UIW<I!Ho ldiloTsJ:. .... 

0\ftnlilcllh!~ llrtl 

II! I 

fdj/lllorol 

( 

~,.,:n 

Ulr.i<""'!OO 

Ull1 fqifat IE. AJ~I\!senlll 

v.iG 

~~ 

li<;lt5> 

,... 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

l?~l!tttlt!lals: 

A 

~ .... ••fll (tlli$(;~ ~ 

~ ... 

I'I#IPA(£1 

\ I 

"'"" 1llll!l 

rit.lo'! .. 

fliP! 11M 

EFXCONG·S8croroxl27 
124 


10417080.eps

Equifax Crisis Management Plan Cooflderniat- For htcmal Use Only Patel PAGEl 

F. lncide.nt Response Tunts 

Each CMT member will require additional suppoll to execute their CMT responsibilities. To 

accomplish this, the CMT is supported by Regional 'Crisis Action Teams' ("CATs"), composed 

of SVPNP decision maker and subject matter experts within each department. CAT members 

represent lhe specific areas of expertise, 11ithin their departments, needed to respond to a 

COI]Xlfllte incident or lower level incidents. These are the kManaguial" trams (blue) shov.n in 

the graphic in Sec:tion £ 

During a corporate crisis, CMT members will activate their corresponding support Crisis Action 

Teams (CATs) to help set crisis response strategies and manage crisis response activities. Each 

CAT is comprised of the CA Tleader and an alternate leader from each supporting BU/COE, 

contact inf01mation is Sled in Appe~t~fLt A. Regional CAT membership is defined in each plan, 

respectively. 

Each CMT member is responsible for ensuring viable and timely communication between 

themselves and their CAT suoport oersonnel. A briefing p~ implemented by the CMT 

Coordinator will be used to ensure etTeetive communication is maintained. 

The CATs purpose is to receive infonnation from internal and external sources, pass appropriate 

information to the CMT, recommend strategies and tactics to the CMT, and implement those 

strategies and tactics on bebalf and under the direction of the CMT. 

Each CAT plan lists lhe team members' primary responsibilities and provides a detailed 

checklist of specific actions to be considered during a crisis. 

Adminislrative Suppo!l is also provided to CMT. The primary administrative duties are 

dooumenting the current starus of the e~·ent for the CMT, room preparation (telephones, 

computers, office supplies), and arranging food/drink for e.xtended responses. 

a. Operation ill Teams 

When the CMT is active, a CAT member will manage all active "Opeutional" teams (green) 

shown in Sec:tion E above. The Operational teams include Business Continuity, IT Recovery, 

Emergency Response, People Support, Crisis Communication, etc. Each CCT provides 

command and control protocols to ensure Operational Plans are executed according to the 

overall strategy as defined by the CMT. 

NOTE: Operational Plans may be executed WITHOUT theCMT or CATs being activated; Ibis 

is typically in less severe incidents that do not require full activation ofEquifax resources. 

However, if an Operational Plans is activated, the CMT leader or CMT Coordinator should be 

infOIDled. 

1l Crisis Coordinators 

The Crisis Coordinators are the Equifax crisis management subject matter expens. They are 

responsible for ensuring that the CMT plans are maintained and thatlhe CMT receives training 

and exercising according to the schedule in Section vm. The Crisis Coordinatoc also has audit 

responsibility for all preparedness plans shown in Sections E and F above. Finally, during an 

exercise or aclual response, the Crisis Coordinator provides process ad\ice and guidance to the 

CMT using the various concepts of operations in the Crisis Coordinator's toolkit 

020t7 tqlu!alc, to:. AD Ri$11$ Rcsen'Cd 

v,S.O 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2017 

EFXCONG·SBC000000028 
125 


10417081.eps

Equifax Crisis Management Plan Coofldernial- For htcmal Use Only 

f. C~IT Mtmbtrs and Roles 

Patel PAGEl 

CMT roles, CMT membe~ CMT allemates, CAT Leaders and CAT leader alternates as of April 

2017' are: 

Rolt ~x...,tft't CIIITMto~htl 

~~enlircCMTor 

~MnRCMTIIItmher Alt VPICIIITM .... r 

CrisisMaaagcr J.Kclley JobaGald>le 

CrisisCooldinaw Su!aoMauldil Dodd Williams M~flooBlas 

~alli:reSo4JPO!t Mal)•l!ris Palr\da.N!JIIII)IaSOJI& Pam:laSallde!s 

HR CoA:tliaR~ RonWan:.r Sllllil.oli 

IT Da>idWebb .MaryHanoan Micl>d L;g.ui 

0orpo181C~OIIS 1J1t1Gul7.rnet Marisa Saltines Mmd8hGri!Wlli 

[ega! J.Kdlc:t hlii Floostqo lcllifetBUIIIS 

Firona: JobaGamblc Ken Malsball NllllaKi08 

Glob:il()pemOO~ ADd) Bodta Toll)' Weeks Sooa YogJ il 

Safety IOd Securi~· Su!aoMauldla Gregllaktr S~tnCosb)l II 

~caiFs:ll~ T(9Rristoe Jim~~lt) Ka"'nDick ,, MaJtctiiiS&Ana~~ Tlt)' Louglnn Apam~Shab Aml'l3dhan 

GCS Tm'Or'llunls D:!nnMlils AliSOd la2arls 

Wod<:fetteSobotiom Rudy Plodct Mite~br EIJenS4anlto 

COrponucllC\-clopmcq SrC\'tnSiriJlC Dil<rinRc0o Kdly HC(IIl< 

!Ncmatiollal lollllll:f\~ Reb E®n Mart~-.-

USlS PantinoBanos ShJMflo\i;r,clnTo lsioNebM 

'"'-~~ lell'Dod3' 11 

• The official list of current CMT Members is oonlained in Appen<lit A with their contact 

information 

This roster is not meant to indicate team members will work as bolh alternates and primary team 

members during an aroond·lhe-clock response. Positions will be filled with available team 

members as the incident warrants. 

0 2017 tqlu!alc, lo:. AD Ri$11$ Rcsen'td 

v.s.o 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2017 

EFXCONG·SBC000000029 
126 


10417082.eps

Equifax Crisis Management Plan Coofldernial-For htcmal Use Only 

Ill. CMT Gtntral Respoosibait)' 

A. CMT Pltnning Responsibilities 

The CMT planning responsibilities include: 

Patel PAGEl 

• Sponsor and facilitate the developmen~ maintenance and implementatioo of the CMP, 

assuring a high level or COI(lOitte preparedness to effectively respond to any incident that 

threatens the viability of Equifax. 

• Participate in training and exercises to become familiar with !!quifa.x's crisis management 

program. 

• Review and approve policies, strategies and processes to assure crisis preparedness and 

effective crisis response by Equifax's corporate and business teams. 

• Support the CMT Ceordinaior, who is responsible for coordinating CMP dcvelopmen~ 

maintenance and exercising, assuring resource readiness, and coordinating CMT exercises. 

B. CMT Responsibililil'$ during a Dtclmd Crili1 

The CMT manages the overall crisis response as defined in the CMP. Specific roles and 

responsibilities for each CMT member are defined in Section IV below. The general roles of the 

CMT during a crisis include: 

• E$!@1i!ll tlleoveriDJ str~qg forf!Wl~ng!he~~t 

• Ensure the magnil1Jde scope and potential effects of the incident arc eomdly assessed. 

• Ensure crisis response actions are coordinated and coosistent with the incident severity. 

• Consider long-tenneffects of the crisis by assessing potential and worst-case scenarios. 

• Control and supply resources to !he business unil and COI(lOitle line organization. 

• Monitor and adjust Poople Support, IT Disaster Recovery, Business Continuity and Crisis 

Communication actions as necessary. 

• Identify and ensure appropriate communication is maintained with key Slakeholders 

including tilt Board of Directors, clients and regulators. 

• Address issues and concerns of all eonstinrencies, 

• Maintain Equifa.x in a responsible corporate position by guiding its actions. 

• Declare a crisis over, or de-escalate the statlls to stand-by or notify only response level. 

0 2017 tqlu!alc, lo:. AD Ri$11$ Rcsen'Cd 

v.s.o 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May20t7 

EFXCONG·SBC000000030 
127 


10417083.eps

Equifax Crisis Management Plan Cooflderniat- For htcmal Use Only 

C C~IT Responsibilities after a Crisis 

Follo\\ing the event the CMT may: 

Pate(PAGE( 

• As appropriate, charter an incident investigation team to determine causal factors and ensure 

COO'ective actions are taken. 

• Conduct a post-incident critique to assess the effectiveness of the crisis management effort 

D. CMT Aulhori1y 

The response intensity directed by the CMT depends on the scope of the incident and its 

potential <1r acrual effect on Equifax. The CMT is authorized to mobilize all Eguifax resoorces 

1vorldwide that it deems are required to manage a crisis and protect the health and safety of its 

personnel, the public and its business viability. 

In addition, the CMT is authorized to acquire external resources that it deems are required to 

supplement its CCTs <1r Operational Teams, assist in protecting and resioring facilities, minimize 

the effects of a crisis on business operations or to fulfill any other need related to the incident. 

External resources typically come from third-pany providers, e.g., law finns, engineering 

consultants, public relations companies, third-pany logistics, employee assistance provide~, etc. 

To the e.xtent possible, specific contacts within each external organization should be aware of the 

Equifax CMP and its needs, and understand- at a minimum-the basic CMT framework and 

their role in suppol1ing &(uifax during a crisis. It is each CAT leader's responsibility to keep a 

current list of potential outside suppliers and associated contact infonnation. In those situations 

where there is a high likelihood third parties would be engaged CATs should consider including 

key third party providers in their exercises. 

0 20t7 tqlu!alc, lo:. AD Ri$11$ Rcsen'Cd 

v.s.o 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May20t7 

EFXCONG·SBC000000031 
128 


10417084.eps

Equifax Crisis Management Plan 

Coofldernial- For htcmal Use Only Patel PAGEl 

IV. C~IT Member Responsibilities 

The primary responsibilities of CMJ members are summarized in Table A. 

I')'ABLE A-C~tT MEMB.ERS' RESPOl'ISllllLITIES ~TR()LE Respoasibiliries 

Crisis ~lanagtr Preparedness 

• Develops a thoroogb undcrstrulding of all plans md systems. 

• Rtlicii'S crisis pcparedncss and approves crisis managcmo:nt policiC~, 

plans and org;mizatioos. 

• May lead the CMT in exercises. 

• Provides guidance and direroon io the arr Coonlinaior. 

Respon!t 

• Declares ao incident a crisis, directs reSOUJteS to acliva!e the CMT and 

sel up the Crisis Coounand Centct (as defined in Stetion VI). 

• AssisiS in g:Uhering the CMT for crisis meetings. 

• Manages aod directs the CMT in significant iocidents. 

• Pro1ides prim31J1 communication to Equdax leadership. 

• Communicates "ith stakeholder.; of su:llegie interest. 

• PI'O\·idcscouuscl md ultimate decision oo policy d>anges or exoeptions 

and position guidanoe. 

• Cooducts initial meeting upon aai1'illion illld ~bedules s~bsequcnt 

meetings. 

• Keeps the ream up to date oo objectives aod focused oo ~riare 

~-

• Roeonunends Slt3tegies aod priorities aod recei\'eS input to guide 

slnlttglc response. 

• Approl'es communication to all st.1keholder.; in conjunction wilh the 

Communications C~ff member. 

• Determines the implemcnt3tion timing for criticalaod csscncial business 

continuity activities. 

• Ensures all nx:owry iSSUC$ are rt>Vun:td and managed appropriately. 

• OcclaJtSthccrisisovcr, orsctslhcarr althe stand·byornotificatioo 

ool l' response lc•el. 

0 2017 tqlu!alc, lo:. AD Ri$11$ Resen'Cd 

v.s.o 

CAT 

Plu 

None 

May2017 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG-SBC000000032 
129 


10417085.eps

Equifax Crisis Management Plan 

Coofldernial- For htcmal Use Only Pate(PAGE( 

'!'ABbE A-GMT MEMBERS' RESPONSWILfl'lES 

CMTR01E RespooS.'bilities 

Crisis Coordi~~ator Preparedness 

• Maintains Equifax Crisis Management Plan and Appendices and 

• 

cootioUOIJSl)' 

Has audit rcspoosibility 

assesses oorpor.ue 

for all ccher 

~ 

response plans (emergency 

IC$JlOilSC, disaster COOOI'Ct)', crisis corrununiealions, business 

cootiouity, eiC.), i.e, works with plan owners to make sure plans we 

maintained and tested. 

• Manages crisis training/ocher resoon:es for the C~IT. 

• Schedules and ovusees exen:ises and !imu13lioos- ensures !hat 

outcomes are 3ddresscd in relmcd plans. 

• Defines the infonnati¢t> dlanoels for infonnation flow for the crisis 

managemen1 OJE2Dization. 

Responst 

• Assists the CMT Leader in assessing the crisis. 

• Collecls initial inf01111atioo and recommends activation lcl'ello the 

c~rr leader. 

• Sets meeting particulars- including schedule, agendas, partieip31liS, 

usc of the crisis rnngtffil,'nt methodology, aoa1)1ical frameworks, 

etc. 

• Looks ahead, identifies issues, eoosider.~ worlt~ scenarios and 

supports cle,.clopmcon of cootingCilCy plans 10 ensure continuity of 

IC$JlOilSe 10 minim negative effectS. 

• Provides crisis management counscllguidMce 10 the team. 

• Resouroes llle C~fT: obscrvtS O>etall acti>ity l~r$0$ plan. 

• Works close~· 11ith the CMT 10 coordinate production of incident 

briefing dOCIII1lealation, silllalion ltpOIIS, actioo plw. etc. 

0 2017 tqlu!alc, lo:. AD Ri$11! RCSCII'Cd 

v.s.o 

CAT 

Ptu 

None 

May2017 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000033 
130 


10417086.eps

Equifax Crisis Management Plan 

Coofldernial- For htcmal Use Only Pate(PAGE( 

'!'ABbE A-GMT MEMBERS' RESPONSWILfl'lES 

CMTROL£ ~osibilities 

All CMT Preparedness 

Members • Ovetsee policy development and interpreiatioo. and !e$OUJl:e CMT 

planning for their fWlCtion. 

• Participates in regular planning meetings led by the CMT Coordinator 

and ensures adequate planning wilhin their respeclil~ OJEanizations. 

• Is filmiliar 1l11h the plans, procedures and te3mS th:u dCI~lop and 

etteille crisis management aooons Jtlattd to specific depwtments and 

the overall Fquifax. 

• Wod<s wilh the CMT Coordinator to make cbangcs as upp~ 10 

maximize lhc ability of the crisis m:magement organization to address 

the needs of the function or business they represent 

• Participates in worbbops ood exercises to increase w01king 

knowledge and confidence in lhe CMT and supporting teams. 

• Develops a penonal preparedness plan to address the needs of his or 

her filmi.ly in a protracted crisis. 

• Maintains contnctlisls and initial guidance to engage in lbc process 

when an event OC(UIS. 

• Ensures coverage is alwa)1 available 10 slaffthe CMT for their 

function (primarily lhrougb coordination of business and personal 

travel schedules and work assignments). 

Rtsponsc 

• Participates in lbc iniliai3Ciivation conference call to assist in 

determining 'be><! sreps' in tbe incident 

• Rcpo!IS to the Crisis Command Ce01er (as defined ill Section VI I) 

localion (ph)~i~ or 1irtual) if requested. 

• Engases ill the aai11tiesofthc team, addressing the Fquifux crisis 

from the strategic perspeetil~ and providing counsel and support. 

• Ensures departmental resources aJt mobilized to integrale wilh the 

CMT and sup)XIIting teams. 

• Ensures clear cffi:c:rivc communiC<IIion between tbe CMT and all 

members of their function or business. especi<llly those responding. 

• Acts on the resJXlOSI'bilities defoned in the foliol1ing depamnent· 

specific guidance on the follo11ing pages. 

0 2017 tqlu!alc, lo:. AD Ri$11$ Resen~ 

v.s.o 

CAT 

Ptu 

None 

May2017 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000034 
131 


10417087.eps

Equifax Crisis Management Plan Coofldernial- For htcmal Use Only Pate(PAGE( 

'I'ABbt:A-0.\l'f MEMBERS' RESPONSWILfl'IES 

CMTROL£ ~osibilities 

Human Rtsoartts • Sen~s A$ employee rdatioos counsel to che CAIT. 

• Ensures an 3CCWliiC a.:cooming for people, inciOOing identifiC3tioo of 

injured or missing pctSilllnel. 

• Atr.Ulgcs forliaison and assistmee for alfucted pet$QMCI :100 affcaed 

family members of ptiSOnncl. 

• Advises on COWlselinsJEAP, or corpor.ue employee n:lalions suppoll 

to persoos involl'ed in the «isis. 

• E.1<pedites pnmsion of IDCllical beoc61S or *r support n:lcv.mt to :m 

emplo)'I!C 's health. 

• O>~rrees on-going plo)~C communicalions in conjunction uilh 

Communicatioos CMT member, including creilting messages and 

updaong all en1ployce oommunicatioo 1-ehicles. 

• l:l3s access to &juifu.x's payroll process and bcoc6t plans: disability 

plan, he31th beoc61S, FMLA, and other bcoc61S. 

• Guiclcslmanages sensiti1oe rmployee relations issues. 

• Decides 11h:ll pcr100ncl need during a disasttr in oonjunctioo with 

CMTI.mr. 

• Acth'ates ood 01'i:nees the Ptnple SuJlllllrl P!Jzn. 

• Activates ood ov=s the department's Business Continuity Plans. 

0 2017 tqlu!alc, lo:. AD Ri$11$ Resen~ 

v,S.O 

CAT 

Ptu 

Ap(l<nd'lXB 

May2017 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000035 
132 


10417088.eps

Equifax Crisis Management Plan 

Coofldernial- For htcmal Use Only Pate(PAGE( 

'!'ABbE A-GMT MEMBERS' RESPONSWILfl'lES 

Ott ROLE !Wponsibilities 

Information . Serves as prineipallnfo=tioo Technology c:oonscl to CMT. 

Tedlnology . Ensures CMT and CAT personnel ba1'C all needed technology solution 

a12ilable, and supports them as needed. 

. M~ and dircdS aU inform.uion system resoun:es. including inform.uion 

rill< management, IT strategy and architoeture, etc. 

. M~ telconmmunicalions, computer systems, data cerners and other 

services during a crisis. . Keep CMT and CAT members informed of IT systems and operational 

status. . Ensures "'"'""'!)'of infrastructure and application S)~tems. Ensures the 

re<:ovet)' is prioritized based on eumnt b~ needs. 

. Provides support as requested by the CMT . 

. Make IT n:lated decisions (ex: ban! ware & soft11211: purebascs, domestic and 

/orgl<lbaJ !t$0UfCC$,CtC.). . Coordinates infonnation security operation acti1itics with the Security and 

Safety CMT member. . Coordioates "ith the Communications OIT member to del'clop ~es 

for customers. 

. Pro1idcs resources and suppon for the IT DisiiSW RW~ttry Plm • 

. Activarcs and o.-ersces the dcparttocnt's 8usi11m Continuily P11111s. 

02017 tqlu!alc,lo:. AD Ri$11$ Rcsen'Cd 

v.s.o 

CAT 

Ptu 

ApptntflXC 

May2017 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000036 
133 


10417089.eps

Equifax Crisis Management Plan Coofldernial- For htcmal Use Only Pate(PAGE( 

'!'ABbE A-GMT MEMBERS' RESPONSWILfl'lES 

CMTROLE ~bilities 

Corporttt • Sen~s as principal oommunicatioos counsel to C~rr. 

Communiations • Respoosible for all media relations, inremal Equimx oommurucations. 

and managing oommunic3lions infonnation related Ill an inci<knt 

• ishcs the media relations briefing center. 

• Partnc~ with HR CMr member Ill assure alignment of employee 

communications. 

• Appro•~ communications through legal ootmsel. 

• Monitors local media COI'Cfli8C for crisis related infollll3tion and ensures 

correct infonnation is being tqlOitCd 

• Recommends and suppons lhe 3lllboru:ed corporare media spokesperson 

at Equifa., bcadquarlcrs and all adler locations. 

• Controls the final co~n~ timins. and method of issuing of any 

stat..'ltlcniS. 

• Coordinates activities \\itb lhe DI~ or RclaliOilS l..c:lder for ant 

~131dlolder communicati<lns. 

• Coordinates activities "ith the rr CMT manber for any customer 

rommunications. 

• Provides an) t-.:ccssasy liaison with media «gaoilaJioos or poblic 

r~lalions represcntati\~'S of any other in•olltd agencies or companies. 

• <hroecs impl-ntiog and activation of tile Crisis C.ommunicatiom 

Plan. 

• Acli>-a!CS and 0\'CrstcS the depa.rtment' s/lusints.t CMtinuily Plan.t. 

0 2017 tqlu!alc, lo:. AD Ri$11$ Rcsen'Cd 

v.s.o 

CAT 

Ptu 

ApptntfuD 

May2017 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000037 
134 


10417090.eps

Equifax Crisis Management Plan 

Coofldernial- For htcmal Use Only Pate(PAGE( 

'!'ABbE A-GMT MEMBERS' RESPONSWILfl'lES 

CMTROLE Rtspoosibaities 

l..tpl • Se"'CS as ke!'advisor to !he CMT for all legal ad,;c;e 3ild iruonnation, 

during and subseqU<:Ilt to an incidcnl 

• Takes 311 needed 3Cii011S immediately ro m:rt privilege and ensure 

legally responsible communications within the CMT and Olher r~ 

!Wns. 

• lmmedialely acts to preome the official record ohctioos tal:cn during 

the response. \\itb the goal of reducing litigalioo issues. 

• Oversees all leg31 da:isions and actions iocluding ci'•il, cootracrual, 

criminal. regui~IOI) , labor, and invesligalivc. 

• Pro>idcs legal ad.;ce 3ild counsel to ensure full and rimdy disclosure is 

lll3dl: to rcgulatoJy an&'or legislalive authorities. 

• Pro>idcs legal ad.;a: 3ild counsel for all response activities to reduce 

liabilities. 

• Activates 311d 0\'CISCCS tbe department'sBruints!t C.mlinuil)• Plan1 

0 2017 &)lu!a1c, lo:. AD Ri$11$ Resen'ed 

v.s.o 

CAT 

Ptu 

Apptntfu£ 

May2017 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000038 
135 


10417091.eps

Equifax Crisis Management Plan Coofldernial- For htcmal Use Only Pate(PAGE( 

'!'ABbE A-GMT MEMBERS' RESPONSWILfl'lES 

CMTROLE Rtspoosibaities 

Financt • Serv"CS as prin(ipallinancial adviser 10 !he CMT. 

• Coordinates wilh !he <Mnnumications C~ff member lllld lhe ln•'Cslor 

Relations l.cader 10 provide message eontenl for employees, cUSIQmers, 

rendoc:s, shareholdcrslllld !he 6ooncial communi!)'. 

• listlblishcs financial impacl of !he crisis. 

• Estimates cash flow projections and ~'3.1~ poreotial needs 10 cllaw 

oo credit re•'OIIer. 

• Tr.ds all fin3llCial impacts. 

• £nsurcs mkmal eontrols are m place. 

• Sees financial policy lllld 3JlP!O''CS financial straiegics. 

• Worb wilh Legal CMT mtmberto assure full Mel 1imcly disclosure to 

financial regulatory agcocics. 

• Verifies financial opelalions (Cash Collectioos, AR, AP, Payroll) 

eootinue as pr.~Ciical. 

• Oi.reciS illlUranee activilies and eoordinalCs "i!h inswanee earners and 

clain)sadjustors. 

• Advi~ arr on insurance policy 00\t ragC, dcductiblcs and~ 10 

belp guide response 10 lhe crisis. 

• Provides finance-relaled ad•· ice, infonnatioo, and suppoll during and 

subsequent to a crisis. This includes: 

0 Arnmgemems f01 Iimely. di$CI\1CI cash availabilily. 

0 Atllising teams regarding concerns Bhout sunOIJ!Idlng ta.' lialnlities 

ror eorpor.ie audlor subsidiary locatioos in\'Oived in ao incident. 

0 Detennining !he procedures 10 be used in a::counting for funds 

needed, while 111 tbe some lime prolecl!ng information reganling 

!heir inlcndcd usc. 

0 In lbe~ nl ofextOI'Iion orakidMppinge,'C>II,Ihe C~ffTeam 

l.cadcr "ill activate !he Suious Crime 1'11111 and make the 

appropiale notilicatioos. 

• Serves as primal)• ~ff oolllact fur insumnoo claims managcmcn~ 

• Acti\'3tes and 0\~&"CS lhe depattmcnfsBusinCSI C011JinuiJy Plans. 

0 2017 tqlu!alc, lo:. AD Ri$11$ Rcsen'Cd 

v.s.o 

CAT 

Ptu 

ApptntflX F 

May2017 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG-SBC000000039 
136 


10417092.eps

Equifax Crisis Management Plan 

Coofldernial- For htcmal Use Only Pate(PAGE( 

'!'ABbE A-GMT MEMBERS' RESPONSWILfl'lES 

CMTROLE RtsponsibHities 

Global • Serves :lS principle busincsscperations adl1sor (0 the c~rr. 

Operations • Ensures all oper.uioos personool are 3CCOUI!u:d for and informs CMT 

membetsoflimctioning Sl3ffing level. 

• Takes all ll\'XXS!ary steps 10 cnswu:nicc rtqt!0$1$11IC being 

process.'((, IIIld ad1ises C~ff membeB of any critical inteuuptions 10 

opcraltonal proocsscs. 

• Cootinuously monitoB all trolSaCiions to prevent fraud. espeeially 

under abnormal opcl3llng siluarions 

• Monirors disruptions to ser.ice lc\~1 agrecmeniS, identifies financial 

operating risk associated in eonjunction 11ith the Off, IIIld 

reco11une11ds strategies to minimize risk a!ld restore effcc1i1~ senioc 

levels. 

• In pannenhip 11ith Sales, ooonlinall:s activities 11ith Corporate 

Ccmmunicalionson :111y cusromc.r, panner, and/or 1~ndor 

communications. 

• MoniroB the efltcts of !he incident on the ability 10 ~c back 

office opo:rations, and lakes aaionsro minimize disrujXioo IIIld 

fiooncial operating risks associated ~>ilh disruptions. 

• MonitoB the effects of all other criticallr.lll.S:lction4xlsed operations. 

ad1iscslhe CMT about these effccls and rt<Ommcnds stmtcgies 10 

minimize disruptions and Itduce fmaoci31 Oj1:lllling risl 

• Venfies thai the client sen ice operations are opcratioonl or man~s 

plans to return those operations 10 service as SOOD as possible 3lld 

3jll)f0pri3JC. 

• Ensures all client sen ice operation ha1'C the comet messages for 

dicnts related to the crisis, crafted by and in conjunction 11 ith the 

CMT Communications member. 

• Activares and OI'CBCCS the department's Businm Colllinulty PIIJJJ$. 

0 2017 tqlu!alc, lo:. AD Ri$11s Rcscn'Cd 

v.s.o 

CAT 

Plan 

ApptndixG 

May2017 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000040 
137 


10417093.eps

Equifax Crisis Management Plan 

Coofldernial- For htcmal Use Only Pate(PAGE( 

'!'ABbE A -GMT MEMBERS' RESOONSlBILfiiES 

CMTR01E RespooS.'bilities 

Stturity . Sen~s as priocipol Sewrily & Life Safely advisor 1o lhe C~iT. 

. M:wges and direCIS Security & Life &ifCI)• resoon:es . 

. Appro~es lhe safety and security of any location where lite CMT 

and CATs may 3$Stl!\blc PRIOR to assembling lite tCMIS. 

. Assures lite asstmblv localions remain safe and secure for lite 

dur:l!ion of the respOme. 

. Assess tbreals to executi>~ members' personal resideoccs and 

takes needed aetioo to p101oot them. 

. lnSines all needed lnformalion Security actioos are taken lo 

protccl confidt'lltial dala and io prmnl unaulhoriztd ac«ss or 

use ofEquifax S)~tem or dala 

. Acts as a resource to loc:aiii:SpOOders regarding all Security & 

&lfcty aspects, including deployment of site Emergency 

Response plans. 

. OI'CiseeS implementing and actil'lllion of the Elfuifax Stcurily 

lnddent RtspOIISt !'fan. 

. Oversees repo~ of pb}~ical, medical, and cyber relaled 

incidclliS to so•~mrncntal anlborities, in conjunction \\ith 

affi:C1edsites. 

. Works "ilh CMT to comply" ith regul:nOI)' investigations and 

llXXIrlUllCIIdations. . Sen~s as primary CMT Jaw enfon:emcntliaison . 

. M:wges and directs security resources for corpora!c offices • 

. M:wges executive s.Jeurity and site securil)• globally . 

. Assures safety of executives in route to and 31 incidc'Jlt scene . 

. Pro•idcs funetiooal c.xpertise, as needed, in a kidnapping or 

bosiag.:situation. 

. Armnges for 2417 personal security for any cxccuti•-es . 

Pm•idins liaison and coordin:nion "ith appropri:ne law 

enfon:ement agencies and specialized security coosultmts, as 

dircc~cd by the c~rr. 

. Ensures all official docwnents are prop:riy controlled and 

handled as potential evidence (as direcled by Legal), "nich may 

he required lo assist in investigarioos. 

. Ad\ises arr about ac:ocss oootrol practi<:es for Equifa.x 

property for affecu:d IQallions. 

. Coordin:ncs inf~on security activities with the lnfomwion 

Technology CMT member. 

. Ol<ersees the affected site's Emttttncy RtspOnse Pian • 

. Aeti•ates and o•~rsees the department's /Wsints< ContiRui/1 

Plans. 

. DiJCCis the Stturity locident Respoost Team 

0 2017 Eqlu!alc, lo:. AD Ri$11$ Resen~ 

v.s.o 

CAT 

Ptu 

Apptntfu Jf 

May2017 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000041 
138 


10417094.eps

Equifax Crisis Management Plan Coofldernial- For htcmal Use Only Pate(PAGE( 

TABLE A- CMT ME~tBlRS' RtSPONSffiiL.mES 

CMTROLE R~nsibilitits 

Rtal Est1tt fiiCJltties Asoocts 

I. Serves as principal facilities li:lison to the CMT. 

• Manages facility SCr'lictsto suppon the CMT, including set 'lip ofd1e 

varioos oommand centers and other CAT meeting locations. 

• Scxun:s aocommodarions. tra1·el and food for ~se teams. 

• Directs site~ through site management. 

• Assi!ls in relocation planning if needed. 

• Manages disruptions in mail room eperalions, tnsuring documeots are 

proccctcd and third-party \'endors arc infollllCd about any 

deli•~•yfpick up disruptions. 

• 0\'USCCS the Cri.<il Command C01tu Plan, including seiling up and 

supponiog all facilities used for the c~rr. supporting teams, and 

od!er staff in•·oh·cd in responding to the crisi~ 

~ 

• Req•= tta1tl records 3S needed 

• Aces as pri11131y C~IT travel achisor 

• Ensures Travel Depattmenl coordina1es with the HR CAT to: 

0 Help account for people by identifying personnel on tmd 

0 Identify the location of travelers wben a disaster strikes that 

effects the abitity to travel 

0 Plovide assistance to tra1tlcrs affected by a disaster 

• Mannges c."Jl"diled uavel arrangcrntnt for the CMT, CAT members 

or the Oo·scene team as required. 

Procumnent Asoo;ts 

• ASS<:SSCs the cffi:cls of the mcident on inbound and outbound 

shipmcnls. 

• Manages contacts with suppliers to alter purobasc or dclh-ety 

locations to acoonunodatc for the incident. 

• Ensures that key procurement personnel are readily available to 

support !be CM'fs responses, regardless of location. This includes 

maintaining up~o-date telephone contacllists of vendors and 

ensuring personnel ba1 t access to a safi: working eovironmen~ 

communication fac liti~ compulcr cquipmenl and dala noccssruy for 

real time. uniosenupred actions in suppon of continuing operalions. 

• Worl:s with finance and ITeaSu.y to ensure that coorraccual obi~ 

continue to be met 

• Assesses the financial impact of conrracrual obligations on Equifax as 

a zesull of the crisis. 

• Worl:s with legal and other CMT members to deleonine tf force 

majeure other declarations mu~ be made under cootracls 

• Adi>1lleS and Ol't~SeCS the department· s Business C<inlinuily Plans. 

02017 tqlu!alc, lo:. AD Ri$11$ Rcscn'Cd 

v.s.o 

CAT 

Plu 

ApptnJ'tx I 

May2017 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000042 
139 


10417095.eps

Equifax Crisis Management Plan Coofldernial- For htcmal Use Only Pate(PAGE( 

'!'ABbE A-GMT MEMBERS' RESPONSWILfl'lES 

CMTROL£ ~osibi ities 

Marketing, • Sem:s as primary IIWketing, anal) ties and data sen;ces oovisor lo !be 

Analytit5 & Data O.IT. 

Se.rviea • Provides str.llegie guidance and laelical execution on all aspects 

associaltd 11ilh !be four "Ps • of marlceting, including IIWkering 

coounWJicarions, product del-elopment and m~menl pricing. 

11Wke1 and customer insights, suatcgy and channel management 

• Provides str.llegic guidance and tactical execution on all aspects 

associated 11ilh anal)ties and data services, including de>-elopmeJl! and 

management of scores and models, acquisition and loading of data, and 

data quality mooagemeJl!. 

• Moniton Lhe effects oflhe incident in product and mcxlel peoformance 

and d:na acquisition and looding p~. 

• Ensures an accurale aecoooting of maskering, anal)ries and data 

senices persomel 

• Manages risk assessment and makes policy decisions specific to 1he 

siruation. 

• Ac!n'3!¢S and Mlr!CCS Lhe dcpar1mcZ1tS llu.WtJ! Continuity PI"":< 

N~<- Corporal< CollmnnitalicUIS is up hired in sep>ralt S«tioa. 

0 2017 tqlu!alc, lo:. AD Ri$115 Rtsen'Cd 

v.s.o 

CAT 

Ptu 

ApptntflXJ 

May2017 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000043 
140 


10417096.eps

Equifax Crisis Management Plan 

Coofldernial- For htcmal Use Only Pate(PAGE( 

'!'ABbE A-GMT MEMBERS' RESPONSWILfl'lES 

CMTROL£ ~osibilities 

Global Coosumer • Setl'I'S as prilll3JY Global Consumer Solutioos achisor lo the C~rr. 

Solutions • Provides sllaiCgic guidance on ali3SpC(I.S associaJed 11ith 1he deli1try 

of crtdit scores Mdlor ccedit monitoring se"ices 111rough the Equifa' 

website. 

• Manages risk assessment and makes policy decisions specific to the 

siluation. 

• Mitig;m: andloral'oid any service interruptions for Equifa.• custonx:cs, 

clieots or panners. 

• Coonlin:tes activities 11itb Corpo131e Communieatioos disseminating 

infonnatioo to cuslomers, Sllpplicrs and p3J'Iners. 

• Actil'aJCS and o•·ersccs the dcpanmcnt · s Busintss Continuity PfQ/Is. 

0 2017 tqlu!al, lo:. AD Ri$11$ Rcsen'Cd 

v.s.o 

CAT 

Ptu 

ApptntflX L 

May2017 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000044 
141 


10417097.eps

Equifax Crisis Management Plan Coofldernial- For htcmal Use Onlv Pate(PAGE( 

TABLE A· CMT .Mt~mERS' RESPONSIBJL.ITTES 

CMTROLE Re$)1onsibilities 

Worl<forte • Sen'CS as primary WoMortc Solutions advisor ro dJe ~ff. 

Solutions • Provides str.Uegic guidance oo allaspccu associaled wilh Ihe eli,~ry 

of emplo)lrtent and income I'Crilicalioos services, uoemployrocnl 

claim senices, compliance services, and the employment dalabGse. 

• Manages risk assessment and makes policy decisions spocific to dJe 

situation. 

• Mitiplc and/or al'oid any service iottll\ljltions for Equifa., Qlstomers, 

clienlsorJXU1ners. 

• Coordi~ activities "itb Corporate Communications disseminating 

information to customers, suppliers. panners and go,~nUliCntal bodies. 

• Activates and O\'=s Ihe dej)lllmenl's Busintst Continuit}· Plans. 

• Direas the Mid-West Rttional Crisis Action Team 

0 2017 tqlu!alc, lo:. AD Ri$11$ Resen'Cd 

v.s.o 

CAT 

Pill 

Appt.ndixM 

May2017 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000045 
142 


10417098.eps

Equifax Crisis Management Plan Coofldernial- For htcmal Use Onlv Pate(PAGE( 

TABLE A· CMT .MnmERS' RESPONSIBJL.ITTES 

CMTROLE Re$)1onsibilities 

International • Sen'CS as primary international Busincss Unit ad"isor to the CMT. 

• Provides smuegic guidance on allaspccu associaled with the 

intcmaliooal deli•~l)' of crtdil and other data services. 

• Man:~ges risk assessment and makes policy decisions specific to the 

situation. 

• Miti&atc and/or a"oid any service imerruptions for £quifa, cuStomcJS. 

clients or pa!lnell. 

• Coordiues activities with Corpome Conununicatioos disseminating 

information to customcD, SllpplicD and p3TIDCD. 

• Mairuains a liaison \\ttb eaclt regjooalleader regarding any country 

specific incident and/or crisis. 

• Attivau:s ood oversees ihe depru1l1li:nt's Busintn Continuity Pluns 

0 2017 tqlu!alc,lo:. AD Ri$11$ Rcsen'Cd 

v.s.o 

CAT 

Pill 

Appt.ndix N 

May2017 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000046 
143 


10417099.eps

Equifax Crisis Management Plan 

Coofldernial- For htcmal Use Only Pate(PAGE( 

'!'ABbE A-GMT MEMBERS' RESPONSWILfl'lES 

CMTROL£ ~osibilities 

Corporate • Serl'tS as primary emerging maJhts advisor lo the CMT. 

Development • Sen'Cs as prinwy oorporate de1-elopmen~ emerging m3Jkets and 

M&A adlisor to the C~ff 

• Provides strattgic guidance on 311aspc<IS 3SSOCWcd with the 

dcvcloprncol and dtlivCI}' of credit and odlcr da!a sc"icc prodlldS in 

emerging international m3Jkets. 

• Manages risk assessment and makes policy decisions spocific to 1bl: 

situatioo. 

• iti~e and/or a1·oid any service il11erruprioos for fquifa.~ customers. 

clicntsorpa!lllCrs. 

• Coonlin:tes activities 11ith Corporate Communications disseminating 

information to cuSiomcrs, Sllppliers and partners. 

• Activates aod OYCISCCS the dcpartmmt · s Businas Continuit}• Plan~ 

02017 tqlu!alc, lo:. AD Ri$11$ Resen'Cd 

v.s.o 

CAT 

Ptu 

ApptntflXO 

May2017 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000047 
144 


10417100.eps

Equifax Crisis Management Plan 

Coofldernial- For htcmal Use Only Pate(PAGE( 

'!'ABbE A-GMT MEMBERS' RESPONSWILfl'lES 

CMTROL£ ~osibilities 

US IS • Setl'I'S as prilll3JY oonswner information solutioos advisor to lhe CMT 

• Provides sttaiCgic guidance on aii3SpC(I.S associated 11ith !he deli1try 

of decision making prodtKtS and services. 

• Man~es risk assessment and makes policy dceisions specific to the 

situation. 

• Mitigate and/or al'oid any service interruptions for llquifa' customers, 

clients or partners. 

• Coordin¥es activities 11ilh Corporate Communications disseminatiog 

infonnaJion to customers, suppliers and partners. 

• Actil'ales llld 01=-s the dt1xrrilncnt s Business CINitlnuit)· Plun1 

Oirecu !he US Information Solutions CAT. 

0 2017 tqlu!alc, lo:. AD Ri$11$ Resen'Cd 

v.s.o 

CAT 

Ptu 

ApptntflXQ 

May2017 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000048 
145 


10417101.eps

Equifax Crisis Management Plan 

Coofldernial- For htcmal Use Only Pate(PAGE( 

TABI,EA- (.)IT Ml:M8ERS' RI!SPONSIBILITIES 

eMTROLE Responsibilities 

Regional L~dersbip • Acts as primarycoonselto the C\IT on all aspects of the operntion 

(Lo<al inlernlliooal in his or it(( area of responsibilil)• including: 

response) 0 Local gol'emmenlal n:quiremenls Md law~. 

0 Collura! expeetations and norms. 

0 Local oonditioos such as community reaclioos, media coverage, 

phy~ical oondltions, de. 

0 Tm llogistics 

0 Security conditions. 

• Provides on-site prtseneeto assisl in managins tho even~ as din:ctoo 

bytheCMT. 

• Acts as Equifax spo!:tsperson, as directed by the CMT. 

• Oversees the entire local response for regions under his or her 

conuol. • Actil'l!IC$ and 01t~CC$ the region's Businm Continuity Pl•ns. 

• Q,~rsecs the appropriale Regional CAT. 

NOTE: The regionalle:derlhip has both regional S3les responsibility, 

and some amouot of an operntional role, including HR, IT, 

Communications, Finanoe, Secwity, etc. F~r each of these roles, the 

approprillte RSpoosibilities a~e the same as li~ed in the 1'!1ious sections 

abo1-e. Ill essence, the rogiooalleade~ip, during a crisis, needs to 

manage all aspects of the·l.ocal response, and therefort should have a 

delllilcd plan 10 do this throogh their Regional CAT. 

0 2017 tqlu!alc, lo:. AD Ri$11$ Rcsen'Cd 

v,S.O 

CAT 

Plu 

ApptntfaR 

May2017 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000049 
146 


10417102.eps

Equifax Crisis Management Plan Coofldernial-For htcmal Use Only Patel PAGEl 

V. Site Emergency Response Team Leader/Command and Communieatioos Uniliralioo 

;L Equifax Emergency Response 

The number of trained emergency response slaff at each Equifax locations varies by location 

depending of the number of personnel at the location and other faclors. All sites have 

established Emergency Action Plans. Locations wiih sole occupancy have an eslablisbed 

Enrergtney Response Ttllnr and trained emergency responders. Locarions withrul sole 

occupancy have assigned personnel, typically an office manager or mosl senior leader in the 

office, Io be responsible for emergencies. At lhese smaller locations emergency response 

procedures are defined in the Equifax Life Safety Guidelines 

A list oflocalions with !he level of emergency response capabilities is maintained by the CMT 

member responsible for Security & Safety. During a site emergency, !he emergency response 

aspectsoftheincident will be managed according to the type of plan in place. 

If a mm is declared in response to a site emergency, the sile emergency response 

representative will: 

• Implement the emergency response plan or general emergency guidelines for the site. 

• Manage and direct all Equifax emergency response resources at the incident scene or 

related to the incident scene, including the CMT on«ene team. 

• Designale an on-scene person to communicate with the CMT. 

• Designate Ibe on-scene Equifax spokesperson as appropriate (spokespersons to be 

approved in advance by Communicatioos). 

• Oelermine if external emergency responders should be called. 

B. C~1T On·Sftne Team 

The On-scene Team is dispatched to an incident by the CMT. They provide support to the 

Site Incident COmmander, assess additional company needs for crisis response, and keep the 

CMT informed of events at the scene. The On-Scene T earn leader or Communications 

Member may act as a local company spokesperson in lieu of site management. Any CAT 

member may be designated to participate as an On-Scene Team member. The On-Scene 

Team may also include ~te personnel dedicated to corporate response activities at the time 

of the incidenL 

The On-scene Team makeup will vary with the type of crisis but usually includes 

representatives from the affected business, Operations, Communications, HR, and Legal. 

Typical members and primary responsibilities are lisled in Table B. 

0 2017 tqlu!alc, lo:. AD Ri$11$ Rcsen'Cd 

v.s.o 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May20t7 

EFXCONG-SBC000000050 
147 


10417103.eps

Equifax Crisis Management Plan Coofldernial- For htcmal Use Onlv Pate(PAGE( 

Table B 

CMT On-Scene Members Responsibilities* 

On-Scene Member Rtsoonsibilities 

Affected Departmeoll • Ten Leader for lhe On-Scene Team 

Oper:llions . Provides guidance to Site Incident Commander, and 

site line manllgCf!lent 

• Assesses effects of incident and keeps affi:cted 

Department ll13nagelllCill and C~1T infonned 

).(gal • Evalll31esc.<tenl and natnreofincident 

• Coordinates legal support persomel on scene 

• Supenises implementation of legal slrategies and 

tactics on sc:eoc 

• Direcdy manages claims process 

• Aooomp3Dies regulatory :1ge11eics on incident 

in,·estigations 

. Keeps CMI' informed 

Commwlications . Provides oo scene crisis C0l111JllUlkatioo advice 

• Assesses local employee and poblic reaction, 

reromme..ts str.ltegics and tactics for improved 

communicarion, and provides site public tdations 

and media support 

• Sen~s as the primary liaison betl'"te" site 

spokcspcoon and Public Information Officer 

• Attends and assesses all local press briefi~ 

. Keeps Communications CAT informed of crisis 

incident status 

Human Resources . Provide :ISSistance in coon!in:uing HR response 

• Assess .....00 for oollllSCling for impacted employees 

·and commwlity member.; 

. Evaluates on scene securit)' requirtments neodcd for 

protecting fueiliry and pcrsoooel 

• Cooldinates and assists in providing security 

resoortes and eootrols and keeps CCMT Security 

member informed on sccuritl' issues 

Other Functions . Provides support in all aspects of on sc:ene incidem 

response and communications asditteted by CCMT 

02017 tqlu!alc, lo:. AD Ri$11$ Rcsen'Cd 

v.s.o 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

Member Selection 

Representalive(s) is 

designated by affected 

Ocpa11mtnt leader bastd 

on responsibnity, aulhority, 

and !<now ledge of site, 

product. process, or 

looerationinvoll'ed 

Senior level attOOlt\' as 

designated by GC Genetal 

Coonsel 

Commuruca!ions CAT 

member or Outside 

Resowte 

Human Resou~m CAT 

members 

Detl:rmined wben crisis 

occurs by CCMT 

May2017 

EFXCONG·SBC000000051 
148 


10417104.eps

Equifax Crisis Management Plan Cooflderniat- For htcmal Use Only 

C External Emergency Rtsjl(lnst Command Uoffication 

Patel PAGEl 

If the emergency requires an e.xteroal respoose, e.g., if9-l·l (or similar external emergency 

dispatchers in international locations) is called or a fire alarm is activated, then leadership of 

the emergency response is taken over by local (non-Equifax) emergency responders.ln this 

case, the local officials v.ill usually establish an Emecgency Operations Center ("EOC") and 

designate a local Incident Commander. The local Incident Commander is typically the Fire 

Chief or Police Chief. In extreme situations, state or federal emergency responders may take 

over the local Incident Commander's role. 

If an external response is active, the site emergency response representative will also: 

• Unify command with the local Incident Commander, by using the Incident Command 

System• protocol followed by most federal, state and municipal agencies. 

• Coordinate resources and response tactics with the local Incident Commander 

• Most city, eoonty and Slate response or~tions in the US, use the Incident ColllJilalld Srstem 

("ICS"), a st3Ddatdiztd on-scene cme~gcncy management S)1tem. 1\l!ieb includes an intcgrared 

organi2llliorl31 structure d¢signed to reflect the oomplexit)' and demands of single or multiple 

incidents "ithout being hindered by jurisdictional boundaries. (lntcmntional locations may or may 

not ha>~ a similar S)~em ) The ICS model uses a combination offacilities, equipment, personnel, 

proo:dan:s, and communications protoools operating 11ithin a oommon organi2lllional struaure. It is 

intended to aid in managing resouroes during emergencies and is applicable to both small and large 

incidents. The ICS plan provides a prooess for private sector rcprescntati"es to assume variat1s 

positions in the on«tnc incident oommand po$1 and lhc Emergency Operations I Jointlnfonnation 

Cento:r for !be lead responding agency. 

D. Extrmal Communications U11irtetlioo 

External Communieations: The external (communi!)' and media) communications aspectS 

of most emergencies are coordinated by a local (non-EIJuifax) Public Information Officer 

("PIO'') who usually aa:ornpanies and reports to the locallncidem Commander. The 

EIJuifax communications lead at the site \\111 work closely ~> th the PIO to manage media 

and community communicalions activities. 

0 20t7 tqlu!alc,lo:. AD Ri$11$ Rcsen'Cd 

v.s.o 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2017 

EFXCONG·SBC000000052 
149 


10417105.eps

Equifax Crisis Management Plan Coofldernial- For htcmal Use Only 

Vl Opmtional Guidanct 

;L fnddenl Resolution or Escalation 

MO<St iAcidenlS will be resolved wilhoul activation of the O IT. 

Patel PAGEl 

One Shifl Response: CMT activation and staffing is at Ihe discretion of the C~IT Leader or 

designate. In most responses, the primary and allernate C~ff members will activate toge1her and 

will manage lhe incidentro a satisfac1ory conclusion. In this case, the CATs may be led by either 

the assigned CMT leader or by the CMT alternate as determined by lhe CMT members and 

availability. If both members for a specific role activate, one of the members can report 10 the 

CAT learn once a one-shift response is declared. 

Two Shift Rtsponsrs: If the incident could require an extended continuoos response, the C~IT 

should identify two reams to work in shifts. In addition, two teams may be required for each 

CAT. Managing team schedules and hourly optn ting guidure is the responsibility of the 

C1\IT Coordinator. 

The specific number and level ofCMT members and CAT teams activared will be determined by 

the CMT Ltader. However, whenever any type of activation occurs, all primary and 

alternate CMT members will be, at a minimum, alerted about the incidenL 

B. lncident Notifkation, Tbrenl Assrssmwt and C~IT Activation 

It is critical that all locations quickly report any and all potential crisis situations to their 

department management or seruriry_ This must be done as soon as possible, regardless of the 

time of day or nigh~ preferably "ithin 30 minutes of the incidenL 

If a senior department leader cannot be reached immediately, any employee with information 

about a potential cri~s should call the Equifax Security Hotline to rep<lll the incident 

Notification of incidents that are, or have the potential to become, an Equifax 

c.risis should be directed to the Equifax 24-hour Security Hotline by calling: 

+1 770.740.5555 

The Security Hotline Line is available 24n/365 to receive and forward crisis information to C~IT 

representatives on the Incident Assessment Team. The specifics for handling any incident reported to 

the Security Hotline are found in Appmdit A -incident Notification and O fT Acti••ation 

Procedures. 

0 2017 tqlu!alc. to:. AD Ri$11$ Rcsen'Cd 

v.s.o 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2017 

EFXCONG·SBC000000053 
150 


10417106.eps

Equifax Crisis Management Plan Cooflderniat- For htcmal Use Only 

C locide.nt Asst~sruent Coordinator· Activation Oefisions 

Patel PAGEl 

Appendix A contains !he procedure used by the Securiiy Hotline staff if an incident is reponed. In 

general, !hey .,;u activate the Incident Asst~sment Team using the Mass Notification System. 

The Incident Asst!smem T earn will assess the threa~ seek SlJidance from other leadership if needed 

(e.g., IT Operations, Facilities, Client Ad~iOOI)' Services, etc.). and !hen determine the level ofCMT 

activation required. The Incident Asst~sment Team includes: 

I. MikeDooglas 

2. Dodd Williams 

3. Susan Mauldin 

Before activating !he CMT, the Incident Assessment Coordinator will decide on an appropriate 

initial activation level based on !he specific circumstances of the incident The activation level 

can escalate as necessacy to acquire appropriate 001p013te resources for crisis response. (See 

Stction 0 for activation levels.) All serious incidents must be reponed to !he CMT leader or 

designate immediately. If there is any doubt about !he correct activation level, the CMT should 

be, at a minimum, activated at the Notify Only Ltvel as described in Seetion 0.1. 

D. 'Plan Aeti~ation Lmls 

There are three CMT activation levels. The Notify Only Level, Stand -By Ltvel and Respond 

Ltvd are used to establish awareness of a potential crisis or to activate the CMT in response to 

an actual crisis. Each level is described below: 

I. Notify On!)' l.evtl 

The CMT is notified when an incident is not an obvious Equifax crisis initially, but which 

warrants monitoring or would be ofinterestto members of !he CMT. At this level, CMT 

Membm DO NOT respond or assemble. Members are Iypically informed of the event during 

normal hours, Iypically via e-mail, and the CMT Coordinator becomes responsible for tracking 

incident sta1Us. Examples include: 

• A minor fire or explosion at a facilily whereon-site resources are deemed sufficient to handle 

the event and !here are no serious injuries, or 

• A.ny el'cnt that has a reasonable potential to escalate in scope and d!creby harm Equifax's 

reputation, assets or personnel, including an event in a neighboring facility. 

Z. Stand•by Le\·rl 

The CMT may be put on ''Stand-by'' when an incident has the potential to become a Equifa.• 

crisis but CMT assembly is not yet appropriate. During this suge, CMT members will be 

notified of !he incident and placed on notice that the team may be activated in the future. CMT 

members should d!en be making the appropriate amngements 10 ensure the CAT is staffed for 

their function. CMT Members DO NOT assemble at the Stand-by level. 

0 20t7 tqlu!alc,to:. AD Ri$11$ Rcsen'Cd 

v.s.o 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2017 

EFXCONG·SBC000000054 
151 


10417107.eps

Equifax Crisis Management Plan Cooflderniat- For htcmal Use Only 

J. Respond Ltvel 

Patel PAGEl 

The CMT will be activated wben !here is a high potential for a Equifax crisis to cccur. The 

activation can occur immediately upon initial notification or as an event escalates from a lower 

activation level. All CMT members will be notified of the incident and be asked to attend an 

initial briefing. Declaring a "Respond-level" activation immediately invokes !he Equifax Crisis 

Management Plan and initiates an initial CMT briefing. 

I. Partial Activation 

The CMT is staffed by bolh executive-level and VP/Direct()(-level staff. In minor to severe 

incidents, or in situations that clearly do not wmant a Iiiii team esp<M~se, the CMT may 

assemble as a partial team, based on the direction of !he CMT leader()( designee. 

£. De-esrJ.Iation from Respond Level Activation 

The CMT, onc.e activated, is a self-managed team. The level of activity, frequency of meetings and 

number of at1ive members should match the CU!l'efll needs to erft(:tively manage !he incident, and 

maintain command and control over responders. At some poin~ most incidents will become business 

recovery focused, versus crisis management focused. When appropriate, typically upon consensus of 

the CMT, !he CMT Leader can declare the crisis to be over and disband !he CMT. If !he CMT is deescalated to the Notify Only Level, the CMT should follow !he guidance above until it is fully 

deactivated. 

F. CMT Action Lilts 

CMT Action lists contained in Part 0: CMT Response Plan, are used to implement basic 

crisis ~ponse activities. Although each crisis is unique, the lists provide a framework fQI 

typical crisis response activities, and are provided to each CMT member as they arrive at lhe 

Crisis Command Center. 

G. Communiralion with lht &ard of Diretton 

If the Board of Oireclors needs to be engaged or informed of the incident, !he responsibility of 

their notification is owned by !he following person(s): 

• Rick Smith (Prim81)') 

• John Gamble (Secondary) 

• J. Kelley (Alternate) 

0 20t7 tqlu!alc,lo:. AD Ri$11$ Rcsen'Cd 

v,S.O 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2017 

EFXCONG-SBC000000055 
152 


10417108.eps

Equifax Crisis Management Plan Coofldernial- For htcmal Use Only 

Jill Facilities and Equipment 

;L Equifax'sStcuriiyRolline-+1770.740.5555 

Patel PAGEl 

The Security Hotline is available 24!365 to receive calls reporting all incidents related to Equifax 

operations, systems or products. See AppendLt A for detail on bow the Crisis Line operates. 

Please NOTE this number is a Voice 0>"eiiP ("VOIP") number and may nOI operate correctly in 

certain situations. 

B. Equifax's Crisis Management Bridge Line 

In most situations, the initial CMT assembly procedure will be to meet on a bridge line. This 

accomplished two things: 1.) It allows for faster response during oon-wodring hours, and 2.) It 

allows Seeurity resources to assess the security and safely of any physical meeting locations 

bef(ll'c assembling the CMT. The CMT Bridge Line is: 

Dial in: / Redacted I 

Access Code: Redacted I Leader Code: I Re<lacted I 

C Equifax Crisis Command Center 

Equifax's Crisis Command Center (CCC) is the facility that will house and suppolt the CMT and 

the CATs. It is also the central point for incoming and outgoing communications with key 

constituencies. The facility can handle a high volume of calls resulting from i.nquiries to Equifax 

during a crisis. 

The prinwry CCC is located at 1550 Peachtree Street if a full C~1T/CAT activation is required. 

Meeting rooms have been establi$hed fortheCMT and for each CAT, along with a place to brief 

the media. Equipment and other resoorcts required to tlfectively rtSpond to an incident will be 

provided by the Facilities and IT organizationus pan of their CAT plan. The C~IT will 

typically meet in the Centennial Conference Room on the 6• Floor of 1550 Peachtree Street. 

The a/tunal~ CCC is at the Mount Vernon Conference Room on the J.s Floor of 500 Northparlc 

office. See Appendix F- Office Facilities Crisis Action Team Plan. 

A.n additional backup CCC can be the Executive Briefing Center on the ~ floor of Building I 

of theN White campus. 

Additional facilities can ser;e as an alternate CCC, and are identified and acquired under the 

direction of the CMT Leader and Facilities CAT at the time of an incident 

D. Crisis Communications Cenltt 

As conditions warran~ a Crisis Communication Cenler may be established. This facili1y is 

ideally located in a separate area away from any of the CMT (II' CAT rooms. This location may 

be used to monitor me media and develop media messaging. A full description of the facility is 

in Appendit 8- Communiclllion Crisis Action Team Plan. 

E. Media Briefing Center 

The C(II'Omuoicatioos CAT will take the lead on media briefings, wodring with the public sector 

incident oommand as necessary. A media briefing center can be established quickly with me 

help of the facilities CAT 

0 2017 tqlu!alc, lo:. AD Ri$11$ Rcsen'Cd 

v,S.O 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2017 

EFXCONG-SBC000000056 
153 


10417109.eps

Equifax Crisis Management Plan Coofldernial-For htcmal Use Only 

F. Olhrr Equipment 

Patel PAGEl 

Equifax mainlains additional equipment and other resoorces 10 use in a crisis, including 

teleoommunicalions equipmen~ computer equipmen~ maps, building draY.ings, copies of plans, client 

contact lists, e1c. Specific details abOU1 these facilities and equipment are in Appe~ttfix F -FDcilities 

Crisis Action T eom PfDn. 

Jllll. Mainttna.nct and Training 

The CMT will review the CMP oo an annual basis and revise as needed. The Crisis Coordinator 

will facilitate this review. Each CMT member has3 copies of ibis plan: one for the office, oot 

for the car and one for !he home. When the plans are revised, !he Crisis Coordinator is 

responsible for retrieving obsolete plans and distributing new plans. 

CMT and CAT will be mainlained through a combination of training and exercises. The 

frequency of these activities 1vil! be as follows: 

• Walk-thrufl'abletop exercise- CMT .................................. Annually to every 2 years 

Training of new CMT memb~ will be conducted oo an as needed basis. 

02017 tqlu!alc, lo:. AD Ri$11$ Rcsen'Cd 

v,S.O 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2017 

EFXCONG-SBC000000057 
154 


10417110.eps

Equifax Crisis Management Plan Coofldernial- For htcmal Use Only 

IX. Re•·isioo lli!!ory 

Date Name Version 

212013 MikeDouldas 1.0 

5i2013 Mike Doualas 1.1 

912013 Mike Douglas 1.2 

11/2013 Mike Douglas 1.3 

1012014 Mike Dou.l!las 2.0 

4/2015 MikeDoo~ as 3.0 

9/2015 MikeDoo~ as 3.1 

612016 MikeDou~ as 4.0 

5i2017 MikeDoua as 5.0 

0 2017 tqlu!alc, lo:. AD Ri$11$ Rcsen'Cd 

v.s.o 

Description of Cbantes 

Initial 1~00 of document 

Edit members 

Member revisioo 

Member revisioos 

Annual Review/Update 

Annual Review/Update 

Member revisioos 

Annual review/revisioos 

Annual review/revisions 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

Pate(PAGE( 

May2017 

EFXCONG·SBC000000058 
155 


10417111.eps

Equifax Crisis Management Plan 

Coofldernial- For htcmal Use Only 

X C~IT Support Plans 

Equifu.x CMP l'llrt II- Crisis Management Team Response Plan 

App A • EFX Notifocatioo and Activatioa Plan 

Regionll Crisis Action T cam Plus (CATs): 

A~eotina Crisis Action Te:un 

Canada Crisis Action Team 

Cenlr.ll America Crisis Acrioo Teoo~ 

Chile Crisis Acrioo T cam 

Ecuador/Peru Regiorul CAT Plan 

Iberia Crisis Action Team 

lndi3 Crisis Action Team 

Mid\1"tS! Regional CAT Plan 

No~ Regional CAT Plan 

Paraguay Regional CAT Plan 

Russia Crisis Action Team 

Soutlteasl Regional CAT Plan 

Southwell Regional CAT Plan 

UK Regional Crisis Aerioo Team 

Uruguay Crisis Actioo TC301 

We& Coast Regional CAT Plan 

0 2017 tqlu!alc, lo:. AD Ri$11$ Resen'Cd 

v.s.o 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

Pate(PAGE( 

May2017 

EFXCONG-SBC000000059 
156 

EQUIFAX, INC., ‘‘CORPORATE CRISIS MANAGEMENT PLAN, PART II’’ 


10417112.eps

El{UIFAX 

Corporate Crisis Management Plan 

Part II: Crisis Management Team 

Response Plan 

June20l6 

Version 4.0 

This document contains guidance ror each Crisis Management 

Team member to use during a declared crisis. 

Primary CMT Assembly Point Centennial Ccnference Room 

6' Floor or 1550 Peacbtree 

Street 

Secondary CMT Assembly Point Lanier Conference Roan 

t• FlooroflV White Building2 

Conference Bridge Line Redacted I Access~~ Redacted J Leader Code: 

CONFIDENTIAL TREATMENT REQUESTED BY EOUIFAX INC. EFXCONG·SBCOOOOOOOOO 
157 


10417113.eps

Equifax Crisis Management Team Response Plan Coofldeltial-for btcmal Use Only 

Corporate Crisi5 Management Plan Part ll 

Crisis Management Team Response Plan 

Table of Contents 

Pagel 

l. OveraURespoose Framework ........................................................................... 3 

U. Crisis Managtrurnt Team-Initial Actions I CMT Leader List ....................... 5 

Ill. Crisi~ Management Team-Action Lists ............................................................ 9 

A. Cl\fT Leader/Coordinator ............................................................................. 9 

B. Human Rrsourres ............................................................................................ IO 

C. Information Tetbnology ............................................................................... 12 

D. Corporate Commuujcations ........................................................................... 13 

E. Legal .................................................................................................................. l4 

F. Finance .............................................................................................................. l6 

G. Global Operations ............................................................................................ I? 

B. Safety and Sec.urity .......................................................................................... J 9 

T. Real .Estate ........................................................................................................ 20 

J. Marketing, Analytics, Data Services .............................................................. 21 

K. Businm Units ................................................................................................... 22 

rv. Retision History ................................................................................................. 24 

0 2016 Fqllila\ lie. AD Righ~ R""~'Cd 

v.to 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

IWJC2016 

EFXCONG·SBC000000061 
158 


10417114.eps

Equifax Crisis Management Team Response Plan Coofldeltiat- for btcmal Use Only Page l 

TlUS SECTION OF THE PLAN IS USED DURING A CRISIS 

The CMT Action Lists, beginning on page 4, are used during crisis response. They list and 

briefly describe basic crisis management activities. These activities have been reviewed and 

approved by the CMT and are to be considered and implemented, if appropriate, in response to 

an incident de.:lared to be a oorporate crisis. Pages 2 and 3 describe the O\=ll response process. 

1. Basic Response Framework Overview 

Pbtse 1: Assm theSituttion & Asse10ble tbe Team 

A. Event reported to Incident Mantger for actn>ation l!Sessment. 

The Incident Manager assess the threa~ seek guidance from other leadership if needed (CEO, BU 

Heads). and then detennine the level ofCMT activation required. The Incident Manager is notified 

via the Security Desk and/or a member of the Equifax Management Team and includes: 

Mike Douglas Dcdd Williams Susan Mauldin 

Before activating the CMT, the Incident Manager wiU decide on an appropriate activation level 

based on the specific circumstances of the incident. The level can escalate as necesS81)' to 

acquire resources for crisis response. All serious incidents must be reponed to the CMT Leader 

or designee immediately. If there is any doubt about the activation level, the CMT should be, at a 

minimum, activated at the Notify Only Level. 

B. Activation Le1•tl Decision: No Action, Notify Only, Sund·by, Respond. 

1. Notify Only Level 

The CMT is notified when an incident is not an obvious Equifax crisis initially, but which 

warrants monitoring or would be of interest to members of the CMT. At this level, CMT 

Membtn DO l'iOT respond or assemble. Members arc typically informed of the event 

during nonnal hoors, typically via e-mail, and tbe CMT Coordinator becomes responsible 

for tracking incident !latus. 

2. Stand·by Level 

The CMT may be put on "Stand-by" when an incident has the potential to become a 

Equifax crisis but CMT assembly is oOI yet appropriate. During this stage, CMT 

members will be notified of the incident and placed on notice that the team may be 

activated in the future. CMT members shoold then be making the appropriate 

amngements to ensure the CAT is staffed fortheirfunction. CMT Members DO NOT 

assemble at the Stand-by le-•el . 

3. Respond Level 

TheCMT will be activated when there is a high polential fora Equifax crisis tooocur. 

The activation can oocur immediately upon initial notification or as an event escalates 

from a lower activation level. All CMT members will be notified of the incident and be 

asked to allend an initial briefing. Declaring a "Respond-level" activation immediately 

invokes the Equifax Crisis Management Plan. CMT activation \\ill typically use the Mass 

Notification System. 

0 2016 fqllila\ lie. AD Righ~ ""~'Cd 

v.t o IWJC 2016 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG-SBC000000062 
159 


10417115.eps

Equifax Crisis Management Team Response Plan Coofldeltial- for btcmal Use Only 

C. Communktte to CMT if needed. 

Page4 

In all siluations when the Incident Manager has determined the incident warrants CMT activatioo 

at any level, CMT members will be notified as described above.lflheCMT is assembled, the 

Mass Notificaiion Sys1em will be activa1ed and simultaneous cooununicalion to all CMT 

members and alternate members will occur. All documented contact points will be involved 

(Office Phone, Cell Phone, Home Phone, E-mail, etc.). In most cases, a conference line will be 

provided as part of the aclivaiion process. 

D. Only procttd to Pbase 2 if a RESPOND levd activation is dedared. 

ha~ 2: Prepare lo conducttbe Initial Briefing 

• Colle(! informalion. 

• Prepare agenda (next page). 

Phase3: Conducttbe lnitw Brief'mg (For all CMT members and <cmates-nsually a call) 

• Briefteam. 

• Disouss actions that are required immediately. 

• Specify next meeting timellocalion. 

• Disouss CAT activation. 

• Activate CATs and review situation. Get CAT input 

Pha.~ 4 Conduct serond mrtting (OIT a.nemhl~) 

• Use pre-determined agenda (next page). 

• Status repon from affl:(ted site/business. 

• Status repons from each function (Include information from CAT briefmgs). 

Pbaw 5 Continue Responsr Aclivitirs 

• Conduct routine meetings using Brief, Discuss, Action model. 

• Continue management of crisis. 

Phase 6 Contlude the em is response (Rccovery) 

• Stand down CMT- move into recovery stage. 

• Assign responsibility for oo·going management efforts. 

• Chaner incident investigation team as necessasy. 

• Conduct After Action Review. 

0 2016 fqllila\ lie. AD Righ~ R""~'Cd 

v.t o 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

IWJC 2016 

EFXCONG·SBC000000063 
160 


10417116.eps

Equifax Crisis Management Team Response Plan Coofldeltial-for btcmal Use Only 

II. Initial Actions-CMT Leader/Coordinator Guidance 

e>i~ Guiding Printiple$ and Priorities: 

I. Place the highest priority on l ife Safety-the welfare of all people including personnel, 

clients, vis.irors, emergency responders and oommunity members. 

2. Protect our assets and preserve our ability to operate and supply our clients. 

PageS 

3. Maintain a strong llquifax reputation through ethically and socially aware behavioo that 

ultimately prestrve shareholder value. 

A ITER Declaring a Crisis 

Initial Notiliution (Note: Apptntfix A describe$ CMT attivation process in detail.) 

• Receive briefing from Incident Assessment COO!dinator. 

• Confinn decision to activate CMT. 

• Confinn plan for initial CMT briefing. 

o lime, location, eall-in numbers, etc. 

• Cons.ider the need to infonn the Equifax Corporation or Board of Directors. 

• Consider the need to infom Equifax's regulatory &)!eocies (OSHA, EPA, DOT, etc.) 

Prrotre for initial OIT briefing 

• Review the Initial CMT Briefing Agenda (below) to confirm responsibilities. 

• If poss.ible, obtain an updated status of the incident 

• Cons.ider the timing for the first full CMT meeting 

Agenda Totiic Desired OUtcomes 

Purpose of the call Brief the Team. Direct Admin Support member to document all 

facts and decisions. 

ldcmifv all eallers Document all eallers and ensll!ll all CMT roles are reorescntod. 

Situation DescriPtion Provide the current details of the situation to the CMT. 

Suppon Identify support requested by the site or business. Discuss the 

I ootential additional suPPOrt the CMT mav be ll(luired to provide. 

Team Selection Identify the team members (name and role) that will continue to 

SUPPOrt this eveot 

Communications Detennine whal communicalions have been made and what 

communications are still required. Ass.i~ respons.ibitities. 

Logistics Announce next meeting time and loc.ation (meeting room and 

telephone numbers). 

Adjourn mee1ing Final concerns issues. Direct CMT members to assemble, brief 

and provide direction to his or her CAT. 

0 2016 fqllila\ lie. AD Righ~ R""~-cd 

v.t o IWJC 2016 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG-SBC000000064 
161 


10417117.eps

Equifax Crisis Management Team Response Plan Coofldeltial- for btcmal Use Only 

Conduct the Initial Briefing 

• Call-in early and lead lnilial Briefing. 

o Sianclard call~n information: 

Virlual Command Cenler 

Brid:e l:flietiaciedl p~ RidiClldj 

lottnatioaatl Redacted I 

PIISICOdc:LRI@L] 

tudor todt:! Redacted] 

• Follow the Initial CMT Briefing Agenda. 

• Remind participaniS of the guiding principles and priorities 

Page6 

• The Administrative Support member will capture names ofCMT members thai will continue 

to participate in the response. 

• The time and location of Ihe next CMT meeting will be announced. 

o Pre-dcsignaled room is the Centennial Conference Room on 6

6 Floor aJ 1550 Peachtree. 

o Any other facility can be designated as the meeting location if needed. Choioes include: 

L Mount Vernon Conference Room, 500 Northpark. 

2. Executive Briefing Cenler, Building I, N White Campus 

3. Any other locations determined by CMT leader 

Note: II is importam for the CMT leader to project a calm, confident and positive attilUde 10 the 

team. Acknowledge that not everything will be perf«;tty executed as designed. Decisions will 

nocd to be made 1\ilh inoomplctc information. Enoo\IJ'tlgc pooplc to ask questions if they are 

unoertain of informatioo or decisions. Reinforce this is a 1eam effort. 

0 2016 fqllila\ lie. AD Righ~ R""~'Cd 

v.to 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

IWJC2016 

EFXCONG-SBC000000065 
162 


10417118.eps

Equifax Crisis Management Team Response Plan Coofldeltiat- for btcmal Use Only 

CMT Leader Guideline for FirstJOngoing CMT Meeting 

• Ensure phone lines are open. 

• Roll Call - Identify participants! enSUJe all roles are represented. 

Page 7 

• Establish I enforce lheBrieting/Discussion/Action CMT meeting process. (See next page.) 

Briefing l'hase 

I. Pro~ide Event Status Update, 

2. Depanmental Status Updates (CMT Leader/Each CMT Member). 

Discussion Phase 

I. Review key decision making priorities \\>itlube team. 

a) Place the highest priority on Life Safety- the welfare of all people including 

personnel, clients, visitors, emergency responders and ccmmunity members. 

b) Protect oor assets and presetVe our ability to operate and supply our clients. 

c) Maintain a sirong Equifax reputation through ethically and socially aware behaviors 

that ultimately preserve shareholder value. 

2. Reminder of Key Roles. 

• The affected site/business has the primary responsibility for managing a physical 

event The CMT' s role is to support the site/business, no! to assume direct 

management of the local response. 

3. Identify key objectives for the CMT to aCC()Illplish. 

4. Communications. 

• Agree on process and timing for oommunicaring to key stakeholders. 

• Agree on content of messages (or holding statements). 

• Assign and confirm responsibility for communicating to Board of Directors. 

• Assign and confirm responsibility for communicating to regulatory agencies. 

S. If appropriate, assign a CMT member to lead a Stakeholder Analysis. 

• Resources Evaluation-Does the CMT need any additional resoorces? 

ActiGn Phase 

I. Announce time for next CMT meeting and disband group (CMT Leader). 

2. Review Slatus of response so far, and determine agenda for next meeting. 

0 20t6 fqllila\ lie. AD Righ~ R""~'Cd 

v.to IWJC20t6 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000066 
163 


10417119.eps

Equifax Crisis Management Team Response Plan Coofldeltial- for btcmal Use Only 

CMT Meeting Process 

PageS 

Briefing State: 

All CMT members present 

One person presents at a time 

No phones or computers in use 

Only present new and critical infonnation 

Others only tllk to seek clarification 

Everyone gets a tum I you can pass 

Action State: 

CMT leader sets return time/disbands 

CMT members meet with CAT 

Provide new tasks and timing 

requirements 

Collect new information 

/recommendations 

Identify completed tasb and results 

Return to CMT on time 

0 2016 fqllila\ lie. AD igh~ ""~'Cd 

v.to 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

Discussion State: 

All CMT members present 

CMT leader selects issues to discuss 

Establish clarity on Issue 

Purposeful discussion to gain agreement 

Determine task, responsibility and timing 

Go to next issue 

IWJC2016 

EFXCONG·SBC000000067 
164 


10417120.eps

Equifax Crisis Management Team Response Plan Coofldeltial- for btcmal Use Only 

Ill. Crisis Management Team- Actions Lists 

Page9 

Note: These action lists are not all·indusive. Not all actions should be impleme.nltd in every 

si.tuation. Theaction lists do not replace use of good judgment. Every situation will require 

additional actions bastd on the strategic and tactical requirements of the event 

A. Crisis Leader/Coordinator 

D Enforce the Briefing/Disrussionl Action CMT meeting process. 

D Prepare for and conducting meetings. 

0 Request CMT members to assemble CATs and assign tasks if appropriate. 

D Ensure Administrative Sup)lOO records the facts of the incident so all can see lhem. This 

documentation mil also become the official record of the response. Consider the need for 

legal personnel to assist in this process. 

0 Coordinate an initial briefing ~ith CMT members on the eurreotsituation. 

D Coordinate situation repon from the site emergency response team, Safety and Security, IT, 

or business leadership, based on which person has the best infonnation. FJtsure 

Communications How 

0 Panicipate in the preparation of an action plan. 

D Consider need to contact and assemble Board of Directors. 

0 For extended responses, establish v.'Ork-rest sehedule for the CMT. 

D For long-term responses, oversee planning and execution for shift changes for CMT and 

CATs. 

0 Ensure planning and communications meetings are conducted as necessruy. 

D Move into the managed crisis mode, continuing to perform any above CMT Leader tasks on 

an ongoing basis until the crisis is stabilized. Cootinue to diagnose the effects ofincidenr, 

including data loss and continuity risk. 

0 Docide when to begin "Retlllll to Noonal" planning. making sure to consider opcratiooal 

status, emotional conditioo of Equifax employees, regulatory status, and perceptions of 

media and society. 

D Begin to create "Return to Normal" or demobilization Plan to return the business to the 

restored or new location. 

D Notify the CAT leaders to instruct their teams on what to do in "Return to t{onnal" situation. 

0 Conduct the post incident review. 

0 2016 fqllila\ lie. AD Righ~ R""~'Cd 

v.to 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

IWJC2016 

EFXCONG·SBC000000068 
165 


10417121.eps

Equifax Crisis Management Team Response Plan Coofldeltial- for btcmal Use Only Page 10 

Note: These action Usts art not aU-inclusive. Not all actions should bt implemented in every 

situation. Tbr action lists do not replace use of good judgment. Every situation will require 

additional actions based on the strategic and tartirnl requirements of the evmt. 

B. Human Resourct.s 

People Support Aspects 

0 Review with CMT leader the appropriate HR response level. 

0 Provides sllatcgic HR and employecJiabor rclatiOCIS leadership to the CMT. 

0 Communicate the accounting-for-pecple process to CMT members. 

0 Coordinate 1\ith CommunicatiOCIS CMT member on all messaging and distribution of 

information aboot the incident to personnel &tuifax-wide. 

0 Recommend to CMT leader if an all-employee meeting is required. 

0 Assemble Human Resoorces CAT, brief them, solicit recommendations and concerns, assign 

tasks to them and establish a periodic review cycle to maimain collaboration between the 

CMT and Human Resoutces. 

0 Oversee implementation of the &Juifax Pwple Suppon Pfan. 

0 Oversee implementation of the department's Business ConlinMity Pfan. 

0 Oversee HR CAT rcspon~bi lities: 

o Accoont for ALL personnel, \1sitors, and other people that were at the site when the 

in.cident oocurred. (See HR C4 T Pfan and People SMpporr Pfan.) 

• Ensure the people who arc being tlllllSportcd to medical facilities are tJackcd and 

accoontcd for by the site team and HR. 

• Maintain Equifax's official list of victims and their status. 

o Support victims and their families 

• Contact families of personnel that have been injured and provide them with all 

possible assistance, including assigning a liaison to the family of each seriously 

affected employee. 

• Determine need and scope of humanitarian support for affected personneL 

• Provide financial support, emotional/psychological support and logistical support. 

• Engage Employee Assistance PrQgranl counselors as needed. 

• Coordinate (with Finance CAT member) any benefits or compensation dispensation 

related to personnel or their families. 

• Recommend to the CMT leader if a separate family gathering site needs to be 

established: coordinate with Facilities to get it set up. 

o Expedite HR services 

• Review requests for critical staffing resourees. 

• Coordinate medical clearance for all personnel expected to tJavel internationally. 

• Provide special assistance as needed with payroll processing, btalth and disability 

ben.efits, and all other benefits administJation. 

0 2016 fqllila\ lie. AD Righ~ R""~-cd 

v.to 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

IWJC2016 

EFXCONG-SBC000000069 
166 


10417122.eps

Equifax Crisis Management Team Response Plan Coofldeltiat- for btcmal Use Only 

o Communica!e status of pe001nel as appropriate: 

Page II 

• Coordinate and l!ack any C(llllmunicatioo with or notification of injured victims' 

families. DO NOT contact families of de«a.Sed perwnoel -law enforcement 

officials should perform next-of -kin notification. 

• If there are de«a.Sed perwnnel, coordinate v.ith Security and/or local law 

enforcement to have an Equifax representative and a mental health professional 

present when next-of-kin notification occurs. 

• Monitor the medical condition of victims and to provide periodic updates to 

perwnnel (if available). 

• Ovmee aocess to and confidentiality of information about staff or other perwnnel, 

as potentially required by authorities or Equifax response perwnnel. 

• If an international inciden~ establish dial-in telephone and electronic aocess to 

information for individuals outside the U.S. 

• Maintain primary point of oontact 111ith authorities (Including hospitals, Red Cross, 

and others) regarding victims, their status and personal belongings. 

• Activate the employee information hotline (using both toll-free telephone numbers 

for in-bound calls from personnel or family members and Equifax's web site). 

• Ensure a plan is in place to keep this information up-io-date. 

• Worlt with Communications CMT member to determine appropriate setipts 

for those staffing the line. 

0 20t6 Fqllila\ lie. AD Righ~ R""~'Cd 

v.to 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

IWJC20t6 

EFXCONG·SBC000000070 
167 


10417123.eps

Equifax Crisis Management Team Response Plan Coofldeltial- for btcmal Use Only Page 12 

Note: These action Usts art not aU-inclusive. Not all actions should bt implemented in every 

situation. Tbr action lists do not replace use of good judgment. Every situation will require 

additional actions based on the strategic and tartirnl requirements of the evmt. 

C. Information Technology 

D Panicipate in initial damage assessment when/if requested by the CMT or Facilities CAT. 

D Review ll>ith CMT leader the appropriate IT CAJ response level. 

0 Provides strategic IT leadership to the CMT. 

D Review 1\>ith CMT leader the appropriate IT CAT members to activate. 

D Assemble IT CAT members, brief them, solicit recommendations and concerns, and establish 

a petiodic review cycle to maintain collaboration betwoon the CMT and d1e IT CAT. 

D Reccmmend to CMT leader the actions needed to continue critical Equifax operation 

processes, agree on !aSks and priorities. 

D Contact the IT CAT to request the availability status ofthetechnology infrastl\lctureand the 

damage assessment. Provide summary infonnalion to the CMT. Maintain periodic updates 

based on established IT Operations procedures. 

D Review the current situation starus and recommend initial incident objectives to the CMT 

leader. Approve emergency IT expenditures. 

D Assign priority tasks to IT CAT and establish process to monitor progress. 

D Oversee implementation of the IT Disaster RWJvery Pla11. 

D Oversee implementation of the department's Business Continuity Pla11. 

0 Oversee IT CAT responsibilities: 

o Oversee support of systems and telecommunications needs for CMT and all CATs. 

o Work with Corp Communications to ensure Corporate Communications have the correct 

information involving IT incidents. 

o Work \vith Incident Response Team/Communications to ensure all internal and external 

''Help Desk" personnel are familiar ll>ith the incident and how to respond to personnel 

questions. 

o Manage all telephony issues. Reroute inooming calls to affected locations. 

o Ensure IT CAT provides the tools that the CM'T and all CATs need for communications 

such as active network access or ability to VPN from outside location. 

o Work with HR to identify personnel needs for IT Disaster Recovery activities. Establish 

which personnel 11011 be involved in DR activities and detennine if they are available and 

prepared to engage when the DR activities begin. 

o Approve and provide access to systems in the event authorized users are not available 

1\>ith the CMT or in any CAT. 

o Perform system health checks and reponlrevolve any issues. 

o Assess and ooordinate repairs/replacement of oomJlllier hardware and software. 

o Coordinate responses to cyber security issues 1\>ith the Safety and Secu.rity CAT 

0 2016 fqllila\ lie. AD Righ~ R""~-cd 

v.t o IWJC 2016 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG-SBC000000071 
168 


10417124.eps

Equifax Crisis Management Team Response Plan Coofldeltial- for btcmal Use Only 

Note: These action Usts art not aU-inclusive. Not all actions should bt implemented in every 

situation. Tbr action lists do not replace use of good judgment. Every situation will require 

additional actions based on the strategic and tartirnl requirements of the evmt. 

D. Corporate Communications 

D Review with CMT Leader the appropriate Communications CAT response level. 

D Provides strategic communications leadership to the CMT. 

D Activate the appropriate Communications CAT members. 

D Detennine need for in\'lllvement of outside PR resoorces; activate as needed. 

D Assemble Communications CAT members, brief them, solicit recommendations and 

concerns, and esublish a periodic review cycle 10 maintain oollaboration between the CMT 

and the Communications CAT. 

D Oversees media relations, coordination of messaging related to investor relations, internal 

Equifax communications. 

D Monitor on-going news coverage of the event and communicate news infonnation to the 

CMTieader. 

D Assist CMT Leader in designating spokespersons; support spokesperson directly or through 

the Communications CAT. 

D Evaluate and counsel the CMT leader on need for CMT leader or oilier senior management to 

go to the incident scene. 

D Assign priority tasks to Communications CAT and establish prooess to monitor progress. 

0 ~tt implementation of lilt EquifAX Cri.1is ComiHUNieitlion Plait 

D Oversee implementation of the department's Business Continuily Pian. 

D Oversee Communications CAT respon~bilities: 

o Activate and staff the Crisis Communications Center rHar Room) if not already active. 

o Prepare draft 'core press statement' and follow-up ' press briefing statements' for review 

and approval by the CMT Leader and legal counsel. 

o Respond to press inquiries. Establish a media briefing schedule. Publish media alei1s. 

o Consider need to secure services of a translation ser.ice. 

o Prepare internal communications in conjunction with HR& Legal CATs. 

o Assist FIR in preparing and communicating event infonnatioo to personnel globally. 

o Obtain copies (video, audio, print, online) or all coverage and keep it indexed. 

o Periodically update the communication sitategy as necessary based on media reports. 

o In conjunction with the IT CAT and other business CATs, contact all Equifax call center; 

to redirect crisis calls to the identified crisis response 800 number. 

o If required, coordinate press briefings, including facility set-up in conjunction with the 

Office Facilities CAT 

o Ensure that a communications coordinator is in place at the scene if necessary. 

o Brief and coordinate with designated spokespeople at remote locatiQils, if necessary. 

0 2016 fqllila\ lie. AD Righ~ R""~'Cd 

v.t o 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

IWJC 2016 

EFXCONG-SBC000000072 
169 


10417125.eps

Equifax Crisis Management Team Response Plan Coofldeltiat- for btcmal Use Only 

Note: These action Usts art not aU-inclusive. Not all actions should bt implemented in every 

situation. The action lists do not replace use of good judgment. Every situation will require 

additional actions based on the strategic and tactical requirements of the evmt. 

E. Legal 

D Take steps to make cenain CMT and CAT meetings privileged, as deemed appropriate; 

including announcing to the CMT in the initial briefing that the Legal CMT Member is 

acting in a legal capacity providing legal advice to die team and all discussions are to be 

considered privileged. Attempt to do the same for critical CATs by providing a lawyer at 

each CAT meeting - Most critical are Communications and HR CATs. 

0 Review wid! CMT Leadertbe appropriate Legal Department CAT response leveL 

D Activate appropriate Legal Department CAT membm, including outside oounsel if required. 

D Assemble Legal Depanment CAT members, brief them, solicit recommendations nnd 

concerns, and establish a periodic review cycle to maintain collaboration betWeen the CMT 

and the Legal Department CAT. 

D Assist the CMT Leader in evaluating the effects on the public. 

D Reccmmend to CMT Leader the actions needed to continue critical Equifax legal operation 

processes, agree on tasks and priorities. 

D Assess the need for Form &-K and oversee preparation with Finance if necessary. 

0 Assess the need for NYSE, CFPB, State Attorney Generals (AGs), and/or Capitol Nill; 

contact and coordinate with Finance and Investor Relations personnel. 

D Consider need to contact Board of Directoo. 

D Evaluate legal effects of incident on Equifax, nnd apprise CMT Leader on legal issues. 

D Assign priority tasks to Legal CAT and establish process to monitor progress. 

D mplementation ofthedepanment's Rusint.u Continuity Pla11. 

D Oversee Legal CAT responsibilities: 

o Brief all personnel involved in the response about the correct way to capture and record 

information about the inciden~ with the issue of eventual discovery as the basis. Ensure 

!his discussion occurs early in the response with the Administrative Support team keeping 

the official response log for theCMT, and consider providing full-time legal guidance to 

the documentation activities in the CMT. 

o Maintain the official written record ofEquifax's response and oversee records retention. 

o Monitor lhe docwnentation of the incident and ensure information is being recorded in a 

way that will minimize liability, and being stored in a way !hat will facilitate discovery. 

o Ensure all legally required notifications, fillings, and disclosures are made in a timely 

fashion. 

o Ovenee regulatory investigations. 

o ~-ersee criminal investigations in conjunction \\1th Securil)l CAT. 

o Manage forensic eff011s to ensure evidence is being protected. 

o Assess potential civil and criminal liability aspects of incident pertaining to Equifax and 

personnel - recommend legal representation when appropriate. 

0 20t6 fqllila\ lie. AD Righ~ R""~'Cd 

v.t o 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

IWJC 2016 

EFXCONG-SBC000000073 
170 


10417126.eps

Equifax Crisis Management Team Response Plan Coofldeltial-for btcmal Use Only 

o Direct resolution of claims and assessmecl of liability against Equifax. 

o Consider liability issues that may affect Equifax and/or its personnel. 

Page IS 

o Review all potecrial actions being considered by &juifax and/or its agents, to ensure they 

adhere to U.S. and local laws and regulations. 

o Remain aware of, and consider responses to any liability that may oocur, due to injury or 

prosecution of any persons responsible for implemecting corporate policy during a crisis. 

o Prepare, at the end of a crisis, for the allegations being brought against Equifax by a 

person claiming to be affected by the even~ shareholdm, or a member of the public. 

o Ensure all evect documentary records are managed effectively. This includes determining 

who is permitled access to crisis-related &juifax information, how it is stored, and the 

proper form of ultimate disposal. 

o Provide guidance to the affected sitt'ibusiness regarding preservation of evidence. 

o Oversee and/or participate directly in incident investigations for significant events. 

o Review and approve all final investigation reports. 

o Assess other incidents in Equifax's history and within the indusny, including compliance 

issues, and determine the likelihood of those issues being publicly connected to the 

current inciden~ communicate and provide legal advice and counsel to Communications 

as appropriate. 

0 2016 fqllila\ lie. AD Righ~ R""~'Cd 

v.to 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

IWJC2016 

EFXCONG·SBC000000074 
171 


10417127.eps

Equifax Crisis Management Team Response Plan Coofldeltial- for btcmal Use Only Page 16 

Note: These action Usts art not aU-inclusive. Not all actions should bt implemented in every 

situation. The action lists do not replace use of good judgment. Every situation will require 

additional actions based on the strategic and tartirnl requirements of the evmt. 

F. Finance 

D Review with CMT Leader the appropriate Finance CAT response level. 

D Activate the appropriate finance CAT members. 

D Assemble Finance CAT members, brief them, solicit recommendatioos and concerns, and 

establish a review cycle to mainlain collaboration between the CMT and the Finance CAT. 

D Recommend to CMT Leader the actions needed to continue critical Equifax operation 

processes, agree on taSks and priorities. 

D Provide guidance to CMT and CATs regarding spending policies and procedures during the 

crisis. 

D Review with CMT members specifics about insurance policies that may apply to the crisis. 

D Oversee implementation of the department's Business Continuity Pfan. 

D Oversee Finance CAT responsibilities: 

o Assign priority tasks to Finance CAT and establish pre<:ess to monitor progress. 

o Review insurance coverage that may apply to the crisis and contaCI providers. File any 

required notices of claims or other de<:oments. 

o Work \vith insurance provider's claims representatives to help establish timely responses 

to all affected stakeholders, especially those who may tend to take ~ actioo against 

Equifax, e.g,, businesses that lo~t business or injured cooununity members. 

o Establish a meiliod to isolate and collect c051s related to the incident Fe<:us on preparing 

substantiatioo for insurance claims. 

o Insure adequate business controls are in place during the crisis. 

o Establish SEC or other financial regulatory notification if required. 

o Ensure access to cash and/or credit lines as needed. 

o Assess potential to effect credit ratings - access to credit 

o Establish a proactive program to communicate to analysts and investors. 

o Determine disbursanent capabilities and needs. 

o Coordinate (~>ith Human Resources) any benefits or compensatioo dispensatioo related to 

personnel or their families. 

o Mainlain records of travel oosts associated with the incident 

0 20t6 fqllila\ lie. AD Righ~ R""~'Cd 

v.to 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

IWJC2016 

EFXCONG-SBC000000075 
172 


10417128.eps

Equifax Crisis Management Team Response Plan Coofldeltiat- for btcmal Use Only Page t7 

Note: These action Usts art not aU-inclusive. Not all actions should bt implemented in every 

situation. Tbr action lists do not replace use of good judgment. Every situation will require 

additional actions based on the strategic and tartirnl requirements of the evmt. 

G. Global Operations 

0 Review with CMT wder the appropriate Global Operations CAT response level. 

D Activate the appropriate Global Operations CAT membtrs. 

D Assemble Global Operations CAT members, brief them, solicit rewnmendations and 

coocems, begin deployment of Business Continuity Plans as needed and establish a periodic 

review cycle to maintain collaboration bttwccn the CMT and the Business Operations CAT. 

D Recommend to CMT Leader the actions needed to continue critical Equifax operation 

processes, agree on tasks and priorities. 

D Assess the client service operations and provide recommendatioos to the CMT if operations 

have been affected. Oversee the timely recovery of client service operations. 

0 Evaluate the po1ential 6nancial effects of tbe disruption and provide an assessment to the 

CMT. lfneeded, determine the requirements for prioritizing services. 

0 Oversee implementation of the department's Business Continuity Plan. 

D Oversee Global Operations CAT responsibilities: 

o Review/inform the known extent of the crisis as it impacts operations to include: 

• Personnel 

• Facility 

• Customer 

• VendOI/Partner 

• Processing Capability 

o Assign priority tasks to Global Operations CAT and establish process to monitor 

progress. 

o Establish contact with the key sales and operations leader(s) at the affected site(s) and 

obtain initial conditions and support needs. Assist in contacting other client support 

centers to redirect crisis calls per direction from the CMT. 

o Evaluate the situation to determine if the disruption will compromise the ability to 

conduct and support business, for what period and which areas of operations would be 

impacted by the disruption. 

o Assess potential b the incident to affect ocher operations. Those operations potentially 

affected have been given situational guidance, e.g., shut down, close the branch or 

increase preparedness. If required, ensure regulatory notification of closing occurs. 

o Commun.icate with eltternal ser.ice providers to ensure safe, orderly services exist as the 

locations can handle them. 

o Work with the Corporate Communications CAT to develop iJltemal and eltternal 

communications. 

o Work with third party suppliers to ensure cooperation if the crisis involves their 

personnel or locations. 

0 2016 fqllila\ lie. AD Righ~ R""~'Cd 

v.t o IWJC 2016 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG-SBC000000076 
173 


10417129.eps

Equifax Crisis Management Team Response Plan Coofldeltial- for btcmal Use Only Page 18 

o Ensure client setVice representatives have aCC~~rate information about the incident and 

have a scripted response to client questions created in conjunction with !he 

Communicarions CAT. 

o Coordinate on labor management and vendor management to address any high inbound 

call volwnes. 

0 20t6 fqllila\ lie. AD Righ~ R""~'Cd 

v.to 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

IWJC20t6 

EFXCONG·SBC000000077 
174 


10417130.eps

Equifax Crisis Management Team Response Plan Coofldeltiat- for btcmal Use Only Page t9 

Note: These action Usts art not aU-inclusive. Not all actions should bt implemented in every 

situation. Tbr action lists do not replace use of good judgment. Every situation will require 

additional actions based on the strategic and tartirnl requirements of the tvml. 

H. Safety and Security 

0 Review with CMT wder the appropriate Safety and SetUrity CAT response level. 

D Activate the appropriate Safety and Seo.~rity CAT members. 

D Assemble Safezy and Security CAT members, brief them. solicit re(()lllmendations and 

concems, and establish a periodic review C}'cle to maintain oollaboration between the CMT 

and the Safety and Security CAT. 

D Re(()lllmend to CMT Leader the actions needed to continue critical Equifax operation 

processes, agree on tasks and priorities. 

D Overste implementation of the department's Business Colllinuity Pian. 

D Oversee implementation of Equifax &curity lncitlent HunJ/ing Policy & ProctJttres 

0 Overste Safely and SetU!ity CAT responsibilities: 

o Assign priority tasks to Safely and Security CAT and establish process to monitor 

progress. 

o Establish contact with the Safety and Security manager or alternate at the affected site to 

determine initial conditions and suppon needs. 

o Assess the life safety effects of the crisis. An initial evaluation oflhelifesafetyand 

security risks both on and otT site should be performed and a periodic review schedule 

should be established to ensure effective monitoring of the situation. 

o Ensure that site emergency responders managing the safety of personnel and general 

public and arc operating in conjunction with local emergency officials. 

o Assess the need for external providers, e.g., guard services, and if needed, hire them and 

have them operate under the direction of the Safety and Security CAT. 

o Ensure that law enforcement agencies are identified, a dialog with each agency is 

eStablished. 

o Ensure Security personnel are assisting HR to account for all personnel and locating 

those that cannor be aecounted for. 

o Deploy security measures for the CEO and CMT Members as appropriate. 

o Assess and establish additional setUrity controls for the Command Center if necessary. 

o Provide SeoJrity for senior management that may bt traveling to the site. 

o Coordinate responses to cyber seaJrity issues with the Information Technology CAT and 

external providers. 

o Coordinate with Corpoolte Communications to pro1ide Safety and Security incident 

information. 

o Maintain Card Brand Notification procedures. 

0 20t6 fqllila\ lie. AD Righ~ R""~'Cd 

v.t o 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

IWJC 2016 

EFXCONG-SBC000000078 
175 


10417131.eps

Equifax Crisis Management Team Response Plan Coofldeltiat- for btcmal Use Only 

Note: These action Usts art not aU-inclusive. Not all actions should bt implemented in every 

situation. Tbr action lists do not replace use of good judgment. Every situation will require 

additional actions based on the strategic and tartirnl requirements of the evmt. 

I. Real Estate 

D In conjunction with Safely and Securil)' CAT, apprO\'e all assanbly points for CMT and 

CATs to make sure they are safe. 

D Review with CMT Leader the appropriate Facilities CAT response levd. 

D Review the appropriate response levd for any other affected office facilities. 

D Activate the appropriate CAT members. 

D Assemble Office Facilities CAT membels, brief them, solicit recommendations and 

concerns, and establish a periodic review cycle to maintain oollaboration between the CMT 

and the Office facilities CAT. 

D Recommend to CMT Leader the actions needed to continue critical Equifax operation 

processes, agree on wks and priorities. 

0 Receive information from the affected office emergency response team and use it to provide 

recommendations to the CMT. 

D Ove~ implementation of the department's Business Continuity Pian. 

D Oversee Facilities/Travel/Procurement CAT responsibilities: 

o Assign priority tasks to Office Facilities CAT and establish process to monitor progress. 

o Set up the Crisis Command Ceoter to suppolt the CMT and CAT facilities and logistics. 

o Link up any available news broadcasts from the area or location of crisis by pro\iding 

television viewing capabilities where the CMT is meeting. 

o Assess facility resoorces and office equipment needs in coordination 1\ith IT. 

o Assist in recovery planning as appropriate. 

o If needed, ensure transportation for those who have special needs to get them to off-site 

locations is provided. 

o If appropriate, designate an Office Facilities liaison to the police or fire department onsite command post and review security tapes with Safe!)' and Securil)' CAT. 

o Expedite procurement of any goods or services needed by the CMT or CATs. 

o Evaluate contractual relationships between Equifax and supplier; with legal to determine 

if force majeure may have to be declared. 

o Work with HR CAT to help account for people by providing mel itineraries for 

personnel who are traveling during the event 

o Work 1vith HR CAT to help account for any people at an effected location by providing 

floor plans/seating locations as appropriate. 

o Work 1vith carrier; to compare personnd mel itineraries with carrier manifests to 

confinn personnel are aaually tra1•ding. and provide infunnation to the HR CAT. 

o Provide priority travel services to CMT and CAT members that need to travel in response 

to the crisis, including charter air and ground transportation. 

o Maintain records of travel costs associated with the incidet~l. 

0 20t6 fqllila\ lie. AD Righ~ R""~'Cd 

v.t o 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

IWJC 2016 

EFXCONG-SBC000000079 
176 


10417132.eps

Equifax Crisis Management Team Response Plan Coofldeltiat- for btcmal Use Only Page 2t 

Note: These action Usts art not aU-inclusive. Not all actions should bt implemented in every 

situation. Tbr action lists do not replace use of good judgment. Every situation will require 

additional actions baJtd on the strategic and tartirnl requirements of the tvml. 

J. Marketing/Analytics!Data Services 

0 Review with CMT wder the appropriate Marketing, Analytics & Data SeJVi~ CAT 

response level. 

D Activate the appropriate Marketing CAT members. 

D Assemble Marketing CAT members, brief them, solicit recommendations and concerns, and 

establish a periodic review cycle to maintain collalxllation between the CMT and the 

Marketing, Analytics & Data Servi~ CAT. 

D Recommend to CMT Leader the actions needed to continue critical Equifax operation 

p~ses, agree oo tasks and priorities. 

D Evaluate the financial effects of the crisis and communicate to CMT. 

0 Oversee implementation of the department's Business ConJinuity Pfan. 

0 Oversee Marketing. Analytics & Data SeiVi~ CAT responsibilities: 

o Assign priority tasks to Marketing CAT and establish process to monitor progress. 

o Identify key products and p3Jillcrs (channel, and third party) that may be affected, and 

provide list to Business Units. 

o Establish a daily product & servi~ availability review schedule together with Business 

Operations. 

o Work with CO!pOrate Communications, Global Operations, Legal and Finance CATs to 

establish priorities under reflection of contractual obligations and obtain a plan fur 

product availability. 

o Es1ablish a recovery schedule that is regularly updated and reviewed as a basis for 

ongoing communications 1vith clients. 

o Worbvith Legal CAT to deiennine impaC1 of Service Level Agreements (SLAs) 

0 2016 fqllila\ lie. AD Righ~ R""~'Cd 

v.t o 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

IWJC 2016 

EFXCONG-SBCOOOOOOOSO 
177 


10417133.eps

Equifax Crisis Management Team Response Plan Coofldeltiat- for btcmal Use Only Page 22 

Note: These action Usts art not aU-inclusive. Not all actions should bt implemented in every 

situation. Tbr action lists do not replace use of good judgment. Every situation will require 

additional actions based on the strategic and tartirnl requirements of the evmt. 

K. Business Units 

(lnteroatioual, Corporate Development, GCS, USJS, Workfortt Solutions) 

(J Review with CMT Leaderthe appropriate BU CAT response level. 

(J Activate the appropriate BU CAT members. 

(J Assemble BU CAT membm, brief them, solicit reoommendations and concerns, and 

establish a periodic review cycle to maintain collaboorion between !he CMT and !he BU 

CAT. 

(J Recommend to CMT Leader the actions needed to continue critical Bjuifax operation 

processes, agree on tasks and priorities 

(J Evaluate personnel and the financial effects of !he crisis and communicate to CMT. 

(J Oversee implementation of the department's Business ContinMity Plan. 

(J Oversee BU CAT respon~bilities: 

o Assign priority tasks to BU CAT and establish proocss to monitor progress. 

o Identify employees, key products and clients that may he affected, and prepare lisl. of 

contacts. 

o Evaluate effects of the event on direct and indirect clients. 

o Coordinate a proactive communications program to infonn clients of the Slatus of their 

accounts and other important infonnation. Make sure to respect contractual obligations, 

consult with legal as needed. 

o In conjunction with the Legal CAT, undersl.and all contractual obligations. Assess risk of 

Service Level Agreement (SLA) contraCI violations. 

o E>1ablish a daily product & services availability review schedule together with Business 

Operations 

o Communicate to clients when information is available and as directed by CMT and CMT 

CAT. In no case spectJiate or promise solutions to clients. 

o Evaluate contractual relationships ~~<ilh clients (with legal, operations and financial input) 

and determine if force majeure should be initiated and prepare plans and communications 

relative to those processes. Submit plan to CMT for appi'Oio·al. 

o Work with Global Operations, Legal and Finance CATs to establish priorities under 

reflection of contractual ®ligations and obtain a plan for produot availability. 

o Establish a recovery schedule that is regularly updated and reviewed as a b~s for 

ongoing communications with clients. 

o Communicate to employees, panners, and customers when back to nonnal operations. 

0 2016 fqllila\ lie. AD Righ~ R""~'Cd 

v.t o 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

IWJC 20t6 

EFXCONG-SBC000000081 
178 


10417134.eps

Equifax Crisis Management Team Response Plan Coofldeltial-for btcmal Use Only 

Additional Actions 

Corporate Development • If there is a crisis during advanced stages of an acquisition, 

notify the CM team if there are risks of losing the transaction. 

• If there is no current M&A activity, determine if this will be 

suspended until the crisis has eoncluded or has been stabiliud 

to a satisfacitl!y level. 

• Work with Security CAT to determine if international security 

measures need to be increased. 

International • Con~t OMs for local events and engage with regional CAT . 

• Work with regional CAT to determine business impact 

GCS . Coonlinate with Global Opernrions to determine if any impact 

to call centers. 

US IS . Determine if US IS personnel can beredeplO}oed to other 

critical S\lpport duties. 

. Determine if the Small Business Financial E.xchange (SBFE) 

needs to be eontacted. 

WoMorce Solutions • No additional activities/actions noted . 

0 2016 fqllila\ lie. AD Righ~ R""~'Cd 

v.t o IWJC 2016 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000082 
179 


10417135.eps

Equifax Crisis Management Team Response Plan Coofldeltial- for btcmal Use Only 

IV. Revision History 

Date Name Venioa 

5/2013 MikeDouwas 1.0 

9/2013 Mike Douglas 1.1 

1012014 Mike Douglas 2.0 

4/2015 Mike Douglas 3.0 

612016 Mike Douglas 4.0 

0 2016 fqllila\ lie. AD Righ~ R""~'Cd 

v.t o 

Description of Chao2es 

Initial versioo of document 

Revisions 

Annual Update and Revisioos 

Annual Update and Revisioos 

Annual Update and Revisions 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

IWJC 2016 

EFXCONG·SBC000000083 
180 

EQUIFAX, INC., ‘‘CORPORATE CRISIS MANAGEMENT PROGRAM, 

APPENDIX H’’ 


10417136.eps

EO..UIFAK 

Corporate Crisis Management Program 

AppendixH 

Security and Safety 

Crisis Action Team Plan 

August2016 

Version 4.0 

Tilt Security CAT ran be activated through the Equifu No!ifiration 

System or viJI uU !ret. Artivation should be iaitiJted ly CAT Leader or 

Alttn .att. 

Primary Security CAT Fusion Center 

Assembly Point Conference Room 

Secondary Security CAT Bond Conference Room 

Assembly Point 

Conference Bridge Line Number: I-U6-39S-28SS 

Partidpaat Code:! Redacied J 

Host Code:[ Redacted _l 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. E.FXCONG·SBC000000084 
181 


10417137.eps

Table of Contents 

Purpose ............................................................................................................................................ 3 

Crisis Management Principles ........................................................................................................ 3 

Crisis· Definition............. .. ........ 4 

Activation Fnuneworlc Overview...... .. ........ 5 

Initial Actions - Respond Level Activation..... . ........... 7 

T cam Mcmber$hip and Responsibilities............................................. . ......................................... 8 

Incident Definition and Declaration ........................................................................................... 10 

Seauity Incident Classification....................... ... ............. ........... . ....... II 

E~dence Handling Procedures ..................................................................................................... 12 

Sea~rity CAT - Action List .............................................................. .., ......................................... 13 

Sea~rity for People Guidance ....................................................................................................... 17 

R~sion History ........................................................................................................................... 18 

CAT Team Contactlist ................................................................................................................ 19 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBCOOOOOOOSS 
182 


10417138.eps

Equifax Crisis Management Plan -Appendix H 

Confidllltial - For Internal Use Only 

Security C~is Action Team Plan 

Security CAT Plan 

Page3 

Dunng a Response. use the ''Action L1st" begmmng on page 13 

Purpose 

The Security Incident Response and Crisis Action Team C'CA T") Plan defines principles, 

roles and responsibilities for team members who support the physical, cyber security and life 

safety aspects ofEquifax's incident response program. This team is known as the Security 

CAT. 

This plan is not intended to stand alone; it is used to support theEquifax Crisis 

Managemellt Plan \CMPj , the Equifa.x Crisis Management Team ("CMT") and the 

Security Incident Response Procedures Guide. All Securitv CAT members must be 

familiar with the details of the CMP. 

This plan provides 1 "Potentill Considerations List" for Security CAT mrmbers and 

is desigJted to ensure a consisten~ collaborative response during an event by all active 

CATs. 

The Security CAT is acti~ted by the CMI leader or the Security CMT member. It will be 

implemented in context of the CMP. The responsibilities of the Security C~fT member are 

listed in Table A of the CMP. 

Crisis Management Principles 

~·The Security CAT scope is typically limited to the Security Dep3l!ment's response 

to an incident that has been declared a COI')lOiate incident or a corporate crisis by the C~fT. 

However, the Security CAT may also be activated by the Security organization for its own 

pwposes, if appropriate. 

Focus• The primary focus of the Security CAT is on the physical and executive security, 

information security and personnel safety elements of an incident and on issues that cut 

across departmental lines. The Security CAT will also support or consult with the affected 

dep31!ments and offer specialized resources available at the corporate level 

External Resources: The Security CAT may require additional resoorces beyond those 

within the company. In all cases of external resources, the resources will be considered 

part of the Security CAT and will operate under the direction of the CMT memberSecurity. 

Operational Guidance: The Security CAT will use the Potential Considerations List in 

Section D to man~~ge the Security Dep31!ment respoose. Please note that all actioos on the 

list mav not be aPJllllP!iate in everv incidenL nor are these the onlv actions required for a 

successful response. In all cases. judgment should be used to determine the correct actions. 

C2016 Equifax. All Rights Reserved 

v.4.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

July2016 

EFXCONG·SBC000000086 
183 


10417139.eps

Equifax Crisis Management Plan -Appendix H 

Confidllltial - For Internal Use Only 

Security CAT Plan 

Page4 

Crisis-Definition 

A crisis is an unplanned event related to Equifax 's business that has the potential to: 

• Present a significant threat to human health, safety or the en'irorunlllt. 

• Cause a significant adverse effect on Equit1x's reputation. 

• Cause a significant disruption to Equifax's business. 

Notwitbstaodiog the definition aboYt, a crisis is any mot identified as such by the CAT 

Ltider or designate. 

Examples of potential Equifax crises include: 

• Operational issues such as office/data center emergencies. 

• Any situation that attracts the anention of the media and the public and could damage the 

reputation ofEquifax. 

• Nat1lllll disasters such as hurricanes, earthquakes, flooding 

• Public health disasters, epidemics or pandemics. 

• Financial crises, such as significant market-related situations, a major decline in earnings, 

or fraud. 

• lnfoonational criscs, such as a loss of proprietary and confidential intronation. tampering 

with computer records. security incid!llt or loss of IT infrastructure. 

• Legal issues, such as the indictment or arrest of a senior executive. 

• Political/Civil unrest impacting business operations or personnel. 

• Loss of the use of major offices/data croters for any other reason. 

The Sa:urity CAT is activated when the CAT Leader (or designate) decides an event meets or 

has the potential to meet the definition above. Funher information on activation procedures is 

provided in Activation Framework Overview. 

C2016 Equifax. All Rights Reserved 

v.4.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

July2016 

EFXCONG-SBC000000087 
184 


10417140.eps

Equifax Crisis Management Plan -Appendix H 

Confidllltial - For Internal Use Only 

Activation Framework Overview 

Security CAT Plan 

PageS 

Phase t: Assess the Situation & Assemble the TeamEnnt rennrted to Incident Asstllsment 

Coordinator for activation usessment. 

The Incident Assessme11t Coordinator will assess the threa~ seek guidance from other leadership 

if needed (Regional GM, BU lfeads), and then detennine the level of CAT acth'lltion required. 

The Incident Assesm~ellt Coordinator is notified via the Setority Desk and/or a metnber of the 

Equifax Management Team and includes: 

DoddWiltiams Michael Douglas Susan Mauldin 

Before activating the Regional CAT, the lncide11t Assessmellt Coordinator will decide on an 

appropriate aCiivation level based on the specific cirtlllllstanees of the incident The level can 

escalate as neeessary to acquire resources for crisis response. All serious incidents must be 

repcrted to the CAT Leader or designee immediately. If there is any doubt about the activation 

level, the Regional CAT should be, at a minimum, activated at the Notify Only Le\·el. 

Activation Level Decision: No Action, Notify Only, Stand-by, Respond. 

Notify Only Level 

The CAT is notified when an incident is not an obvious Equifax crisis initially, but which 

warrants monitoring or would be of interest to membersoftheCAT. At this level, CAT 

Membtrs DO NOT mpond or assemblt. Membm are typically informed of the event during 

normal hoots, typically via e-mail, and the Incident Assessment Coordinator becomes 

responsible for tracking incident status. 

Stand-by Level 

The Regional CAT may be put on "Stand-by" when an incident bas the potential to become a 

Equifax crisis but CAT assembly is not yet appropriate. During this stage, CAT members will be 

notified of the incident and placed oo ootiee that the team may be activated in the future. CAT 

members should then he making the appropriate anangements to ensure the CAT is staffed for 

their function. CAT Members DO NOT assemble at the Stand-by level. 

Respond Lt\d 

The Regional CAT ~>ill he activated when there is a high potential for a Equifax crisis to occur. 

The activation can oo:ur immediately upon initial notification or as an event escalates from a 

lower activation level. All CAT members will be notified of the incident and be asked to attend 

an initial briefing, Declaring "Respond-level" activation immediately invokes the Regional 

Crisis Action Plan. Regional CAT activation will typically use the Mass Notification System. 

C2016 Equifax. All Rights Reserved 

v.4.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

July2016 

EFXCONG-SBC000000088 
185 


10417141.eps

Equifax Crisis Management Plan -Appendix H 

Confidllltial - For Internal Use Only 

Communiute to the Security CA 1' if needed. 

Security CAT Plan 

Page6 

In all situations when the Incident Assessment Coordinator has detennined the incident warrants 

CAT activation at any level, CAT members will be notified as described above. If the CAT is 

assembled, the Mass Notification System will be activated and simultaneous communication to 

all CAT members and alternate members will occur. All documented contact points will be 

involved (Office Phone, Cell Phone, Home Phone, E·mail, etc.). In most cases, a conference line 

will be provided as pan of the activation process. 

Only proceed to Phase 2 if a RESPOND le>·d activation is declared. 

Phase 2: Prepare to tondutt lbe Initial Briefing 

• Collect information. 

• P~pare agenda (next page). 

Phase 3: Conduct the Initial Britl'mg (For all OfT members and alternata-usually a call} 

• Bricftcam. 

• Discuss actions that are required immediately. 

• Specify next meeting timeJ!ocation. 

• DiscussCATactivation, 

• Activate CATs and review situation. Get CAT input. 

Phase 4 Conduct second meeting (CAT assembles} 

• Use pre-determined agenda (next page}. 

• StatliS report from affected site/business. 

• StatliS reports from each function (include information from CAT briefings). 

Phase 5 Continue Rtsponse Actilities 

• Conduct routine meetings using Brief, Discuss, Action model. 

• Continue management of crisis. 

Phase 6 Conclude the crisis response {Reco>•trvl 

• Stand down CAT-move into recovery stage. 

• Assign responsibility for OO·going management efforts. 

• Chaner incident investigation team as necessary. 

• Conduct After Action Review. 

C2016 Equifax. All Rights Reserved 

v.4.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

July2016 

EFXCONG·SBC000000089 
186 


10417142.eps

Equifax Crisis Management Plan -Appendix H 

Confidllltial - For Internal Use Only 

Security CAT Plan 

Page7 

Initial Actions- Respond Level Activation 

Review Guiding Ptintiptes and Prioriiies: 

I. Place the highest priority on Life Safety - the welfare of all people including personne~ 

clients, visitors, emergency responders and community members. 

2. Protect our assets and preserve our ability to operate and supply our clients. 

3. Maintain a Strong Equifax reputation through ethically and socially aw11re behaviors that 

ultimately preserve shareholder value. 

Initial Notification 

• Receive briefing from Incident Assessment Coordinator. 

• Confirm decision to activate CAT. 

• Confirm plan for initial CAT briefing. 

o Time, location, eaJI.in numbeJS, etc. 

• Consider the need to inform the International Crisis Action T earn or Co!poote Cri.sis 

Management T earn. 

• Consider the need to inform any UK regulatOI)' agencies. 

Prepare ror initial CAT brirfmg 

• Re-.iew the Initial CAT Briefing Agenda (bdow) to confirm responsibilities. 

• If possible, obtain an updated status of the incident 

• Consider the timing for the fim full CAT meedng. 

AJtC11da Topic DclirCd Outcomes 

Purpose of the call Brief the T earn. Direct Admin Support member to document all 

focts and decisions. 

Identify all callers Document all callers and ensure all CAT roles are represented. 

Situation Description Provide the current details of the situation to the CAT. 

Suppon Identify support requested by the site or business. Discuss the 

I ootential additional su_ppon the CAT maybereguired to provide. 

T earn Selection Identify the team members (name and role) that will cominue to 

support this event. 

Communications Determ.ine what communications have been made and whal 

communications are stiUrequired. Assign responsibilities. 

Logistics Announoe next meeting time and location (meeting room and 

telephone numbers). 

Adjourn meeting Final concerns issues. Direct CAT membe~ to assemble. brief and 

i provide direction to his or her support team. 

C2016 Equifax. All RigbtsReserved 

v.4.0 July2016 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000090 
187 


10417143.eps

Equifax Crisis Management Plan -Appendix H 

Confidllltial - For Internal Use Only 

Team Membership and Responsibilities 

Security CAT Plan 

PageS 

The Security CAT identifies primary members and alternate members to provide the ability 

to respond to an incident around-the-clock. Tbe relationship between the CMT and 

Security CAT is shown on the chart in the following section. Security CAT membership 

comprises the following disciplines: 

R'ilt ' l'rilllrJ Alterufe 

CMTMember Susan Mauldin Doug Steelman 

CAT!Mdcr Dodd Williams Man Modica 

Incident Manager Michael Dou!9as Dodd Williams 

Life Safety/Physical Security Man Hyman Sheree Franklin 

Cyber Tbreal Ceoter Doug Steelman Francis Finley 

lnveMigations Greg Baker Mark ''Tony" Alig 

Security Engineering Diab !:Iiiii Andrew Gingher 

Corporate Communications Dianne Bernez TBD 

Legal Troy Kubes Julia Hooston 

The team members are available to assemble in the Fusion Center Conference as a 

primary location or participate via teleconference as needed in response to a crisis. 

The primary roles and responsibilities of the Security CAT are listed below: 

• Serves as principal Security & LAfe Safety advisor to the CMT. 

• Manages and directs Security & Life Safety resources. 

• Approves the safety and security of any location wlleretheCMT and CATs may 

assemble PRIOR to assembling the teams. 

• Assures the assembly locations remain safe and secure for the duration of the response. 

• Assess threats to executive members' personal residences and takes needed action to 

protect them. 

• Insures all needed Information Security actions are taken to protect confidential data 

and to prevent unauthoriud aocess or use of Equifax system or data. 

o Stop unauthorized access or disclosure of confidential data. 

c J..imit immediate incident impact within the Equifax IT eovironmeot. 

o Participate in Root Cause Analysis 

o Enwrc existing policies and standards arc followed and updated in order to prevent 

ful1ber cyber related attacks. 

C2016 Equifax. All Rights Reserved 

v.4.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

July2016 

EFXCONG·SBC000000091 
188 


10417144.eps

Equifax Crisis Management Plan -Appendix H 

Confidootial - For Internal Use Only 

Security CAT Plan 

Page9 

• Acts as a resooree to loeal responders regarding all Security & Safety aspects, including 

deployment of site Emergency Response plans. 

• Ove~ reponing of physical, medical, and cyber related incidents to governmental 

authorities, in conjunction with affected sites. 

• Works with CMT to comply with regulatory investigations and recommendations. 

• Ser;es as primary CMT law enforcement liaison. 

• Preserve physicaUforensic evidence 

• Manages and directs security resources for 001p0rate oftic.es. 

• Manages executive security and site security globally. 

• Assures safety of executives in route to and at incident scene. 

• Jlroo.ides functional expertise, as needed, in a kidnapping or hostage situation. 

• Arranges for 24n personal security for any executives. Providing liaison and 

coordinatioo with appropriate law enforcement agencies and specialized security 

consultants, as directed by the CMT. 

• Ensures all official documents are properly controlled and handled as potential 

e-.·idence (as directed by I.e~). which may be required to assist in investigations. 

• Am·ises CMT about access control practices for P.quifax prope~~y for affected 

locations. 

• Coordinates infonnation security activities with the Information Technology CMT 

member. 

• Oversees the affected site's Emergency Respo~ Pfa11. 

• Oversees the Security Incident Response Procerlures Guide 

• Activates and oversees the department's llu.!iness Continuity Plan.~ 

The Security CAT should provide expertise in the following areas; 

• Operation of the various security centers and equipment 

• Relationships 1\ith law enforcement organizations. 

• Relationships with third-pany providm and consultants. 

• Executive security. 

• Sitcsecurity. 

• Criminal investigations (Personal/Property crime). 

• Knowledge of staffing and facility configuration planning. 

• Life safety and industrial and occupational safety and health. 

• Network Security and Security Engineering 

• Information security Incident Handling, Cyber-threat Analysis, and Forensics 

C2016 Equifa.x. All Rights Reserved 

v.4.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

July2016 

EFXCONG·SBC000000092 
189 


10417145.eps

Equifax Crisis Management Plan -Appendix H 

Confidllltial - For Internal Use Only 

Incident Definition and Declaration 

Security CAT Plan 

Page 10 

An incident is the act of violating an explicit or implied security paicy. The types of adivity that 

are 11idely recognized as being security incidents are violations categorized as, but are nor 

limited to, anempts (either failed or successful) to gain unauthorized access to a sys1em or EFX 

data, unwanted disruption or denial of service, the unauthorized use of a system for the 

processing or storase of data, or changes to system hardware, firmware or software 

characteristics without the owner's knowledge, instructions, and approval. 

The level of consequence of an incideot refers to the relative impact it has on an organization. 

The types of impact include: loss of daia; the loss or theft of information, IT resources, revenue 

or confidence in an EFX company or mission area by the general public or rustornm; or a high 

level of damage that must be corrected prior to system restoration. 

Within lhe Cyber Threat Center, socurity incidents shall be declared for the foll01ving reasons: 

• Analysis of monitoring system reports that show signs of system c001promises in lhe 

logs; 

• Notification by an external entity of an EFX IP or e-mail addresses being the cause or 

victim of malicioos or questionable activity; 

• Alert, notification, or warning from other business panners, cu!lorners or depanmeots that 

an EFX IP address(s) is the target or originator of malicious activity; 

• Complaints by an Internet Service Provider (ISP) that detail specific, prohibited activities 

by an EFX host, IP address or e-mail address; 

• Floods of viruses, worms and Trojan Horses for which anti-malicious code/anti-virus 

software is nOI available. In attacks where the attack vector and exploit code is 

similarfrdenrical. one EFX incident number will be assigned for the entire process; 

• Complaints from the public, or other employees that include specific examples or 

references of inappropriate or illegal use by EFX employees, cooperators, partners or 

contractors utilizing EFX IT; and 

• A self-discovery by an EFX organization that meets the definition of an incident (i.e., 

virus discoveries, policy violations, criminal actions, etc.) 

C2016 Equifax. All Rights Reserved 

v.4.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

July2016 

EFXCONG-SBC000000093 
190 


10417146.eps

Equifax Crisis Management Plan -Appendix H 

Confidential - For Internal Use Only 

Security CAT Plan 

Page 11 

Security lntident Classilkation 

Security incidents are declared when they are serious and considered m~or in nature. 

Declar.~tions and classification will be based on an initial risk assessment of the situatioo 

including; number of affected systems; network impact; business se!Vices impact; sensitivity of 

information threatened or compromised, and the potential for barm to EFX {eg. financial, 

se!Vice, sates, customer trust, or Equifax image impads). Outlined below are criteria for 

security incidents: 

Note AU Cyber specific incidents only Medium (SEVERE) and above 11111 generate 

noliJication to the Security CAT. 

High {CRITICAL) incidems are events that involve compromise of Equifax systems or da~a, 

often involving multiple systems or data records or pose an immediate threat to facilities or 

em~oyees. These incidents will be handled immediately and oper.~te on a strict need-to-know 

distribution. E'<alll~es of CRITICAL incidents include: 

• Recurring SEVERE incident; 

• Threats posing eminent threat to facility or employees; 

• Employre/contractor attempting to send Equifax Confidential data to an external 

~oat email ac=nt!online storage or other external entity; 

• Phishing attack against Equifax; 

• Malicious data access and/or alteration by employee or contractor, 

• Unauthorized access to data or systems, accidental or malicious; 

• Hijacking of Equifax domains; 

• Confinned computer, netwo!X or application compromise; 

• Disclosure, loss or corruption of critical data; 

• Malicious files found on critical system; 

• EFX website defacements or compromises; 

• Sua:cssful DDoS attacks by EFX systems a against EFX systems; 

• Unauthorized use of a production system for processing or storing non-EFX or 

prohibited data or infonnation; and 

• Any violation of any local, sate, federal or inttmationallaw. 

Medium (SEVERE) level Security Incidents are potentially serious events involved a critical 

asset with moderate damage and should be handled v.ithin eight (8) hours after the event occurs 

or notification of the event is made to theEFX Global CyberTbreat Center. This would include 

inappropriate access to oonfidential data by an Equifax rustomer, vendor or other known third 

party. 

• Recurring WARNING incident; 

• Changes to system hardware, finnware or software withOUI the system owner's 

auth<lrization; 

• Connection of unauthorized wi.reless access device to company netWork(s); 

• A conuactor or employee errandy or maliciously attempts to transfer Confidential data 

outside of the Equifax network in an unapproved manner; 

C2016 Equifax. All Rights Reserved 

v.4.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

July2016 

EFXCONG·SBC000000094 
191 


10417147.eps

Equifax Crisis Management Plan -Appendix H 

Confidllltial - For Internal Use Only 

• Abuse r:i resources impacting aitical systems or sel\'ices; 

• Attempts to circumvent Equifax Security Controls; 

Security CAT Plan 

Page 12 

• Misuse of company property, facilities a- services including accepting payment or 

services to provide access to or use of EFX IT resources in excess of one's authority, 

such as fOIWarding spam, engaging in unofficial/unauthorized chat, non-EFX e-mail and 

instant messaging services; and 

• Disoovery r:i risk that could become CRJTICAL. 

Lo11· (W ARKING) level Security Incidents involved non-critical assets and linle damage. They 

should be handled within 24 hoursaftertheevent occurs or notificalion of the event is made to 

the EFX Global Cyber Threat Center. 

• Recurring INFORMATIONAL incident; 

• Employee/contractor who violates Equifax Data Classification policy through DLP 

violations inclusive rilow volumes of data destined for a business; 

• IPS reports that define activity as medium or unsuccessful system intrusion attempt; 

• Unauthorized use r:i a system for processing or storing EFX data; 

• Installation, use or sharing of unauthorized software: 

• Unconfinned COOlputer viru!lwomts (depending on impact to department and if the 

infection is the result r:i a security policy violation); 

• Undocumented or unapproved ~ulnerabi ity scans; 

• Isolated virus outbreaks; and 

• Disoovery of risk that could become SEVERE 

Other types of incidents are categorized as adverse security events and sballnot be declared 

security incidents unless there is a confinned compromise r:i sensitive information, a threat to 

EFX data or subsequent escalation to a security Incident 

Evidence Handling Procedures 

All evidence should be processod according to the evident handling prooedures oudined in the 

Security Incident Response Prooedures Guide. EFX follow11 current industry best practices for 

handling and securing digital evidence, and the procerure guide is periodically updated reflect 

these practices. These prooedures and guidelines, while covering the most common areas of 

~idence handling, are neither all-inclusive nor a mandate, as each investigation may require a 

unique approach as agreed upon by all pal1ies. 

C2016 Equifax. All Rights Reserved 

v.4.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

July2016 

EFXCONG-SBC000000095 
192 


10417148.eps

Equifax Crisis Management Plan -Appendix H 

Confidllltial - For Internal Use Only 

Security CAT- Action List 

Security CAT Plan Page 13 

Please note that all actions in the list may not be appropriate in every incidtn4 nor 

are these the only actions nquired for a successful respoi!St. In all cases, judgment 

should be used to delermine the correct actions. 

Initial Actions and Assigning Resources I CAT leader) 

0 I. Advise senior management of incident and reaffirm responsibilities. Review roles of 

Security management and staff 

0 2. Activate the Security CAT and confirm meeting location. 

[] 3. Review the need for outside suppliers. If needed, employ outside suppliers and have 

them opoo~ e under the direction of the Security CAT. 

0 4. Assign a resource to account for aU Security Department employees, contractors and 

guests and report any missing, injured or unaccounted people to the assigned HR 

resource (See item # 6 and see additional guidance in Section E.) 

0 S. Assign a resource to maintain information flow among the CMT, all other CATs. 

affected departmems, and outside suppliers. 

0 6. Establish and communicate to Security CAT a method to capture action log and retain 

notes for post incident review. 

0 7. Activate additional Security stllff as needed and assign tasks. 

CAT Considerations 

Physical Seeuri1y Aspects 

O 8. 13riefSite security petSonnel and reception if appr<lpriate. 

O 9. Obtain report from Security and Emergency Management and report to CMT regarding 

response details: 

• Number and status of victims 

• Victim transport- which hospitals? 

• Law enforcement im·olvement 

• Evacuation status (tf applicable) 

• Access to building and property 

• Immediately identified damage 

C2016 Equifax. All Rights Reserved 

v.4.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

July2016 

EFXCONG·SBC000000096 
193 


10417149.eps

Equifax Crisis Management Plan -Appendix H 

Confidllltial - For Internal Use Only 

Security CAT Plan 

Page 14 

O tO. AssistHR to moontfor all people including staff, oonlraaors and visiton. Each 

department will be responsible for their own staff and rep<llt findings to HR. HR will 

need information from Security and Facilities to aid in the search. Scme data that they 

may need includes: 

• Security badge data 

• Visitors lists from front desk 

• Hospital transport infonnation as known 

0 11. Prepare and submit a security plan for the CMT Command Center and other critical 

facilities to the CMT leader. 

0 12. Initiate enhanced security procedures at all sites. Access control and securil)• procedures 

elevated throughout the corporation as necessary. 

0 13. Receive and distribute to security personnel official oompany statement(s) from 

Communications CAT. 

0 14. DetennineifCMTandCATsrelocationisneeded. 

O 15. Provide Security liaison to Municipal Authorities and liaisons to Firc!Police Incident 

Command Post as needed at the Emergency Operations Center. Work with Police for 

site and crintinal issues (In conjunction with Legal). Be prepared to supply video, Door 

plans and other building infonnation as appropriate. 

0 16. Contact outside service prmiders (Guard service, private investigators, law enforcement 

specialists, ere.) to alert them to the emergency and the potential need ror as~ stance. 

Evaluate tbe provider(s) ability to quickly mobilize adequate resources upon request. 

0 17. Review and approve requests for additional security resources for locations thnoughout 

Equifax. This would include alerting security resources (Guard service, private 

investigaton, Law enforcement specialists, etc.) of the emergency and potential need for 

assistance. Evaluate the provider(s) ability to quickly mobilize adequate resources upon 

request. 

0 18. Recommend that all other CATs provide a list of the authorizedlreSiriaed employees 

and oontraaors for the alternate worksite. Provide copy of list to Security CAT team for 

relocation efforts. 

0 19. Provide security advice and consultation for personnel traveling to theaffeaed site. 

11 20. Provide executive protection for all potential threats to personnel. 

0 21. Continuously evaluate and mitigate threats, including threats to affected site and other 

oompany facilities. 

0 22. Provide frequent status updates to the CMT members and other CAT teams. 

0 23. Oversee the Securily BC Pion. 

C2016 Equifax. All Rights Reserved 

v.4.0 July2016 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000097 
194 


10417150.eps

Equifax Crisis Management Plan -Appendix H 

Confidential - For Internal Use Only 

Security CAT Plan 

Page 15 

Cybu l'breat Center 

0 24. Monitor network se<:urity to prevent unauthorized a«ess by former employees, media, 

etc. 

0 25. Contact security engineering for any additional resonrces and/or assistanoe. 

0 26. Monitoring of unauthorized access attempCs, inappropriate usage, denial of ser.ice and 

other suspicious and/or malicious adivity. 

n 27. Distribution of se<:Urily advisories. 

0 28. Centralized reponingofforensicrepons. 

0 29. Performing vulnerability assessments. 

0 30. Provide user awareness and training. 

0 31. Coordination of disparate threats within a single monitoring group providing intelligent 

response se~Vioes for the global &tuifax enterprise. 

0 32. Determine if system breach has impacted PCI-related data and review incident response 

notification prooedures oudined in the Equifax Crisis Managemenl Plan, Appendix A, 

"Notificotion and Jlctil'tllion Prneetlure". 

Deactivation and Post Incident Actions 

Coodueting a lessons learned post mOIIem meeting addressing the following questioos, and any 

others that arise is a critical part of the Incident Response process. Such meetings allow 

Incident Response Team members to address that drive 'improvements in all previous Incident 

Response Phases. 

0 33. Coordinate and disseminate "Return to Normal" message to employees. vendors, 

cootracto~ and other stakeholders. 

0 34. Compile all documented adivities in incident status repon. Collect and retain all n01es 

and logs created during the event for later post-incident re-.iew. 

0 35. Deactivate IT CAT and all response vendors as appropriate. 

0 36. Participate in debriefing sessions as directed by the IRT and/or CMT. 

• How wdl did staff and management perform in dealing with the incident? Were the 

documented procedures foUGWed? Were they adequate? 

• What informatioo was needed sooner? 

• Were any steps or actions taken that might have inhibited the recovery? 

• What would the stalf and management do differently the next rime a similar incident 

ocrurs? 

C2016 Equifax. All ights Rese~Ved 

v.4.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

July2016 

EFXCONG-SBC000000098 
195 


10417151.eps

Equifax Crisis Management Plan -Appendix H 

Confidllltial - For Internal Use Only 

• What ~ve aelions can preveot similar incidents in the future? 

Security CAT Plan 

Page 16 

• What additional tools or resources are needed to detect, analyze, and mitigate future 

incidents? 

• Additionally, a follow-up report sboold be created for the management and extended 

team(s} as described below: 

o Prepare a report for Equifax E.xecutive Management to include: 

o Estimate of damage/impact; 

o Action taken during the incident (not tecllnie81 detail); 

o FolloiV on efforts needed to eliminate or mitigate the vulnerability; 

o Policies or procedures that require updating; and 

o Efforts taken to minimize liabilities or negative exposure. 

o Provide the chronologiC8llog and any system audit logs requested by the E.xtended 

Team. 

o Doc:ument lessons learned and modify the Incident Response Plan aocordingly. 

Legal and Finance worlc mlh the local authorities as appropriate in the case that the incident; 

and HR and Corp. Security WOik 1\ith Equifax management to determine disciplinary action in 

the case that lhe incident was from an internal source 

C2016 Equifax. All Rights Reserved 

v.4.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

July2016 

EFXCONG·SBC000000099 
196 


10417152.eps

Equifax Crisis Management Plan -Appendix H 

Confideatial - For Internal Use Only 

Security for People Guidance 

Security CAT Plan 

Page 17 

The llR CAT is responsible for compiling all data about the status of people during a crisis; 

however, each Departmental CAT is responsible for reaching oot to their depanment's line 

organization or other resources to help account for their staff. 

1. Once safely out of the area of dange.r, assign a resource to lnlc.k dtpartmeut staff status 

information. Ideally, this person should not be member of your CAT, but another person 

who does not have another emergency management or crisis management role. 

2. If assembled physically, write down the names of people you know to be safe and the 

ones you cannot account for (11ithin icinity~ If you have evacuated, this may be chaotic, 

but write down as many names as possible. Ask employees if they know anyooe to have 

been injured as well as any staff membm that they know were not in the area of the incident 

(such as oo vacation, traveling, etc.) 

3, Through chain of command within departmeut, ask man~gers caD out to check on 

employees and stod results to assigned resource Ask managers to track their infonnatioo 

and provide a summary to yoo at a regular interval (daily, every 3 boors, etc.) 

4. For identified injured employees, notify the DR CAT immediately! Try to get additional 

information as possible about the locatioo of the victim. Always document the source of 

information. What hospital? Has the family been notified? 

S. As possible, attount for any contractors and guests and send ro the DR CAT. 

6. Do nor contact families or conduct Next-of-kin notifKalions. The HR CAT will 

coordinate all family notifications. Rememberthat some of the information collected in the 

immediate aftermath of an incident may be incorrect. If you have home numbers and are 

attempting to rca(b ootto employees, be prepared to talk to family members. Calmly infonn 

them that an incident has occurred. Instruct them to call back or have their family member 

call back when they see them. Do not speculate. Do not provide incident details, but be 

polite and compassionate. 

7. Accounting for people lakes lime. Keep HR regularly updated on your efforts. 

Send all of your information to the DR CAT. Within the r.rst hours of the response, the 

HR CAT will ruth out your CAT to provide a method to reuive your information. If you 

do not bear from tile BR CAT, smd your information to EFXpeoplcwatcb@e9uifax.com 

Keep the DR CAT updated regularly on your efforts. Accounting for people takes time! 

C2016 Equifax. All Rights Reserved 

v.4.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

July2016 

EFXCONG-SBC0000001 00 
197 


10417153.eps

Equifax Crisis Management Plan -Appendix H 

Confidential - For Internal Use Only 

Revision History 

Date Name Version Dtscription of Ch.an~es 

4/2013 Mike Douglas 1.0 Initial version of document 

6120 13 Mike Douglas 1.1 Plan revisions 

10.12013 Mike Dou~las 11 Plan revisions 

1/2014 MikeDouldas 2.0 Annual update 

Security CAT Plan 

Page 18 

3.12014 Adam Fletcher 2.1 Revised membership and updated contact information 

8i2014 Greg Baker 2.2 

10120 14 Mike Douglas 2.3 

5/2015 Mike Douglas 3.0 

Adam MeGill 

8i2016 Mike Douglas 4.0 

C2016 Equifax. All Rights Reserved 

v.4.0 

Revised membership and updated contact information 

Revised contact information 

Annual review/update 

Annual review/update 

July2016 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000101 
198 


10417154.eps

Equifax Crisis Management Plan -Appendix H 

Confidllltial - For Internal Use Only 

CAT Team Contact List 

I .II*. .l'rimarJ .. CMTMember Susan Mauldin 

StJSan mauldi~uifax com 

678· 795· 7372 - wolk 

Redacted ~obile home 

CAT Leader -~-.. 

~-~ltSa 

71Q.701).46U-...t 

~=: 

Incident Manager Mlllono.p. 

lllicl>oot ..... ~ 

Life Safety/Ph~~ical Security 

=..n 

Matt Hyman = 

matthew h)1)J an@~uifax com 

4Q4-8$5-8442 - oftice 

Redacted ~ell home 

Cyber Threat Center Dllug Strdman 

Investigations Greg Baker 

8!]g.l.balt~~uifax oom 

678-795-7103 -office 

Redacted cell 

home 

Security Engineering Ditb Hirti 

COf]lOfllte Communications ~ 

!h .. n.r.. 

-"'!l·...t 

~~~ Legal Troy Kubes 

C2016 Equifax. All Rights Reserved 

v.4.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

Security CAT Plan 

Page 19 

AJISQie 

Doug Steelman 

doug.steelman1il&guifa.~ com 

Matt Modica 

!llDI!b~w m!l!likD@!:lll!ifm~ !<2!!1 

314-214-7273-worl; 

Redacted i mobile 

Do!N\\JIIan 

-~lil!!!·:ii~'"'-

~t Sheree Franklin = Sheree Frank in@~uifax oom 

404-885-8339· office 

[ Re&Cte<}] cell 

Francis (Frank) Finley 

franci~finle-uifa.~ com 

571-267-6450- work 

Redacted 1-mobile 

TonyAiig 

Malk Aii!1£!l!Juifa~.com 

710-740-4710 - office 

Redacted mobile 

Andrew Gingher 

.r.hllouslon 

~ce~oolli!A:u«n 

t;;l:: 

July2016 

EFXCONG·SBC000000102 
199 

EQUIFAX, INC., ‘‘REGIONAL CRISIS MANAGEMENT PLAN’’ 


10417155.eps

EO..UIFAX 

Regional Crisis Management Plan 

Southeast 

Crisis Action Team Plan 

May20J7 

Version 2.0 

The Southeast Rtgjonal CAT tan ht 1ctivattd through tbt Equifu Notifocation 

System or via call tm. Activation should ht initiattd by CAT Ltader or Ahunatt. 

ISOSWIIdolll1!c-1Se 

A~GAlOOOS 

Primary CAT Assembly Point FIJSioa CaJtt Confm""' Room 

I~ floor &~ I 

Secondary CAT Assembly Point V'll1llal Confmno:e Room 

Conference Bridge Line BCP Cri!h ~luap~t~t Brid&t Line 

Brid:rN: 

- I latmtaliwl Tal:! Redacted I Sotothwl Ton Fm: 

:::1 Redacted I 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000103 
200 


10417156.eps

This Document is not an Emergency Response Plan. 

In Case ofFires, Injuries, Threatening Situations, or Other Emergencies: 

Get to a Safe Place and Call911 

(Outside US: Contact Local Emergency Services) 

Serious incidents should be reported as a potential Equifax crisis: 

• Fatalities. serious injuries. threatening situations. or natural disasters. 

• Fires, explosions Of other events causing damage to a facility. 

• The risk or actual occurrenc-e of confidential data COI'IIlption, loss. theft, or compromise. 

• Any incident causing the evaQJation or shelter in place of personnel. 

• Facilil)' ciOS1Jte due to severe weather or other regional emergencies. 

• The risk or actual OCQJrrence of significant operational disruption from any cause. 

Incidents that might be an Equifax crisis should be reported by calling 

the Equifax Fusion Center Hotline: 

+1 770.7405555 

Suspected information security incidents will be reported to the Cyber 

Threat Center (CTC) by phoning: 

+1678-795-7106 or 1-888-257-8799 or emailing: 

security.incident@equifax.com. 

Equifax's first priority is to protect the health and safety of people. 

Once actions are underway to protect people, the action lists found in 

this Crisis Action Plan should be used to guide the overall re.sponse. 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000104 
201 


10417157.eps

Table of Contents 

EnleQ,'OIICJ' Respoose .................................................................................................................. - ............ 4 

Emelg(IICJ' Response Team ....................................................... -.......................................................................... 4 

E.~l ~ Response Commar¥1 ...................................................................................................................... 4 

Crisis Actio• Team Plrul Pul]>ose ................................................... - ............................ ---........................................ 6 

Crisio ana~ PM:iples ... - ... ------··- ···--··-----·------·--··---·· ............. -............. - ... - ..................... 6 

Crisis • Defmi1ion ......... _ ............................................................................................... _ ............................................. 1 

ConiJCI Lisl ............................................. _ ........... _ ... , ................ _ .................................................... - ............ 8 

CAT ASSClllbi) Sitcs .................................................................................................................................... IO 

Actil•alioD Framewod< Oreniew ............. ,.,_ .............. _ ..................... , .......................................... - .......... 11 

Initial Actions-Rtspood l..c\~1 Acm-atiM ................................ -......................................... -..... -.......... 13 

CAT M~ Process .•• - ............ - ..... _ .. _,, .................. -·-······· .................... - ........... - ........... 14 

CAT Teom Roles ood Respon!ibdilits ...... -. ......... - ................. - ...................................................................... 15 

So111 heast CAT-l'llltmial Considcmaions Li!L ....................................................... - ........................................... 16 

~·Mion ood PO!! blcidco1 Actions ................................................................................................................. JI 

ACCD\IIIling for Pwplc Guidaooc ................................................................................................................................ 32 

Revision Hisao.y ........... - ......................... - ........... .............. --.. - .................................................. -.............. 33 

AJlll"odix A: Busiross Coolinuicy Comact LiSl ............................................................. -........................................... 33 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG-SBC000000105 
202 


10417158.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial- For llllemll Use Onl)• 

Emergency Response 

Southeast CAT Plan 

Page4 

The number of trained emergency response salT at each Equifax locations varies by location 

depending of the number of personnel at the location and other factors. All sites have 

established Emergency Response Management Plans. Locations with sole occupancy have an 

established Emergtncy Rtsponst TtoJns and uained emergency responders. Locations 

without sole occupancy have assigned personnel, typically an office manager or most senior 

leader in the office. to be responsible fot emergencies. 

A list oflocations with the level of emergency response capabilities is maintained by tlw 

Equifax Fusion Center. During a site emergency, the emergency response aspects of the 

incident "ill be managed according to the type of plan in place. 

• If a crisis is declared in response to a site emergency, the site emergency response 

representative will: 

• Implement the emergency response plan or general emeTgency guidelinesf11r tbe site. 

• Manage and direct all Equifax emergency response resources at the incident scene or 

related to the incident scene. including the CAT on-scene team. 

• Designate an on-scene person to communicate 1~ith the CAT. 

• Designate the on-scene Equifax spokewerson as appropriate (spokespersons to be 

approved in advance by Communications). 

• Determine if external en1ergency respondm should be called. 

Emergency Response Team 

The Emergency Response T earn provides suppon to the Site Incident Commander, assess 

additional con1pany needs for crisis response, and keep the Crisis Action Team (CA'I) 

infonned of eveniS at the scene. The On-Scene Team Leader or Communications Member 

may act as a local company spokesperson in tieu of site management Any CAT member 

may be designated to participate as a Response Team member. The Response Team may 

also include site personnel dedicated to corporate response activities at the rime of the 

incident 

Once the emergency has stabilized and the health and safety of people bas been secured, 

than the assessment of business operations and any additional response actions will be 

handed over to the Crisis Action Team. 

External Emergency Response Command 

If the emergency requires an e.xtemal response, e.g., if9-l-1 (or similar external emergency 

dispatchers in international locations) is called or a fire alarm is activated, then leadership of 

the emergency response is taken over by local (non-Equifax) emergency responders. In this 

case, the local officials will usually establish an Emergency Operations Center ("EOC") and 

designate a local Incident Command«. The local Incident Commander is typically the Fire 

Chief or Police Cbicf. In e.xtrcmc situations, state or federal emergency responders may take 

over the local Incident Commander's rcle. 

0 2016 £quifax. All Riglts ReSCI\'<d 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG-SBCOOOOOOHl6 
203 


10417159.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial-For llllemll Use Onl)• 

Southeast CAT Plan 

PageS 

If an external response is active, the site emergency response represemarive ~~ill also: 

• Uni~· oommand with the local Incident Commander, by using dte Incident Command 

Syslem1 pro~ocd fullowed by mOSI federal, slate and municipal agencies. 

• Coordinate resoorces and response lllctics with the local Incident Commander 

1 Most city, COWII)" and suue response otg311imons in the US, use the loeident Command S)'stem 

("lCSj , astandanlized on·soene emergency managtment system, which includes an integmled 

organizational struc~t~rc designed to retlect the complexity and dCI!l3llds of single or multiple incidents 

wilhoot being hindered by jurisdictional boundaries. (lntemationalloeations may or may not bave a 

similar system.) The ICS model uses a combination of facilities, c:quipmmt, personnel, procedures, and 

communications protocols operating \\1thin a common orgaoiz:iional structure. It is inttnded to aid in 

m003ging rcso=s during emergencies and is applicable to both small and lalge incidentS. The ICS plan 

provide$ a process for pri1·ate SC(Ior represeollltivcs to assume 1oarious positions in the oo-scctiC incident 

command pOSI and the Emergency Opemlions I Joint lnformarioo Center for the lead responding agency. 

0 20t6 £quifax. All Riglts ReSCI\"<d 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG·SBC000000107 
204 


10417160.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial- For llllemll Use Onl)• 

Soutbeast Crisis Action Team Plan 

Southeast CAT Plan 

Pagc6 

Ounng a Response. be sure to use the ·tnrtral ActJons - Response Level Actrvatron" 

Crisis Action Team Plan Purpose 

100 Southeast Crisis Action Team ("CAT') Plan defines the principles, roles and 

responsibilities for team members who respond in an expedient and orderly manner to 

unplanned events that impact the business The goal is to minimize the impact of any event, 

resulting in an ootage that could compromise ser.icc delivery of critical operations for 

Equifax. This team is known as the Southeast Regional CAT. 

This plan is not iotended to stand alone; it is used to support the Equifax Crisis 

Management Program ("CMP") and the Equifax Crisis Management Team ("CMT"). 

All Southeast Regional CAT membeN must he familiar with the details of the ClfP. 

This plan provides 1 "Potential Considerations List~ for Southeast CAT members, 

designed 10 ensure a consistent, collab<irative response during a crisis by all active CATs. 

100 Southeast CAT is activated by the CAT Leader or the Incident Response Coordinator. It 

will be implemented in context oftbe CMP. TheresponsibilitiesoftheEFX CMT member 

arc listed in Table A of the CMP. 

Crisis Management Principles 

~: The Sootheast CAT scope is typically limited to the Southeast management team 

response to an incident that has been declared a coqxxate incident or corporate crisis by the 

CMT; however, the Southeast CAT may also be activated by the organization for its own regional purposes, if appropriate. 

Focus: The primary focus of the Southeast CAT is on the regional operational services, et 

al. and on issues that cut across organizations or departments. The Southeast CAT will 

also support or consult with other affected departments and offer specialized resources 

available at the regional or corporate level. 

External Resources: The Southeast CAT may require additional resoorces beyond th0<1e 

within the company. In all cases of external resoorces, the resources will be considered 

part of the Sootheast CAT and will operate under the direction of the Regional CATTeam. 

Ooorational Guidance: The Southeast CAT 11ill use the Potential Considerations List to 

manage the department response. Please n01e that all actions on the list may nOI be 

aporopriate in every in<:idenl nor are these the only actions reauired for a successft11 

response. In all em, judgment shoold be Used to detennine the CQI!ect actions. 

0 20t6 £quifax. All Riglts ReSCI\'<d 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG·SBC000000108 
205 


10417161.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial-For llllemll Use Onl)• 

Southeast CAT Plan 

Page 7 

Crisis- Definition 

A crisis is an unplanned event related to Equifax's business that has the potential to: 

• Present a significant threat to human health, safety or the envirooment 

• Cause a significant advent effect on Equifax's reputation. 

• Cause a significant disruption to Equifax's business. 

• Create a perceived or actual violation of a regulatory Of compliance standard. 

• Cause a significant disruption Of outage to Equifax's technology infrastnJcture. 

Notwithsunding the dd'lDition a bon, a crisis is an)' event idr.ntified as such by the CAT 

Leader or designate. 

Examples of potential .Equifax crises may include: 

• Operational issues such as office/data center emergencies. 

• Significant outage of an Equifax system or application that may exceed the established 

Reoovery Time Objective (RTO). 

• Any situation dlat attnlcts the attention of the media and the public and could damage the 

reputation ofEquifax. 

• Natural disasters such as hurricanes. eanhquakes. flooding 

• Public health disasters, epidemics or pandemics. 

• Financial crises. such as significant mmet·related situations, a m~or decline in earnings, 

or fraud. 

• lnfOfmational crises, such as a loss of proprietary and confidential infonnation, tampering 

with oomputer records, security incident or loss of IT infrastructure. 

• Legal issues, such as the indiCI!llent or II!Test of a senior executive. 

• Rcgulalllly issues, such as notices or inquiries from a regulatOl)' or State Attorney 

General. 

• PoliticaJICivil unrest impacting business operations or personnel. 

• Loss of the use of major offices /data centers for any other reason. 

• Any information security incident involving PLL PC~ data compromise and/or 

exfiltration. 

The Regional CAT is activated when the CAT Leader (or designate) decides an event meets or 

has the potential to meet the definition above. Further infonnation on acti1oation procedures is 

provided in Activation Framework Overview. 

0 2016 £quifax. All Riglts ReSCII'<d 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG·SBC000000109 
206 


10417162.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial- For llllemll Use Onl)• 

Contact List 

ll!aJe l'riiiM'YC•tad 

CATLcader S.S..Mtuldlo 

lU!l>O.IIUUidir>'i(yalfauoll 

0: +I (7i0) 7-I0-4l00 

~': 1 Redacted I 

CM COO<'dimtor Mki!Ad Douglas 

m!•!!MllR~l!•otlll!!!fl!&!!l!l 

0: +( (770) 740-731l 

M:i 

o:! Redacted 

BCP Katlliu ii<)'Dold$ dt Oltpi 

Kathemr.RtlliOld.<i.t®uu.ro• 

0: +I 678\231.0812 

:'1 Redacted I 

Secmity Greg Baker 

f!la:.L~!~!rii'$!1!!if!Yi!!l 

0: + I (770) 740-4499 

~~~ Redacted I 

IT Micll>dli&<ffi 

•ichd.ti~~·~·Lmlll 

0: +I 70)7406556 

~71 Redacted J 

ReoiEltl!e KJrtD Di<~ 

!!!llo.J>Itk~aiflLOOIO 

0: ~ 740--1061 

~~ Redacted 1 

HR ShariLolz 

Sha!W!llti£!1!!ifl!&!!"' 

0: +I (770) l$62736 

~~~ Redacted 

Collllllllli:atiom loesGutzmtr 

""'-i!"""'rii'.!!Joifn.<om 

0: +I l'*)SS.\8.1.1.1 

~~ ! Redacted] 

Lepl J<Mikrllums 

J£!)niftr.llunriegwlfaLOOtO 

0: +1(40ljS8.1-S09.1 

M: Redacled ' 

0 2016 £quifax. All Riglts RtSCI\'<d 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

I 

I 

Southeast CAT Plan 

PageS 

~Oidur C0111tad 

Br)'tt! Williams 

do<ld.'"lliml'i:~Jfox.rom 

0: +I (7i0) 740-1684 

~' I Redacted I 

Br)'tt\111liams 

ll2!1l!.!iltii!J![•'m!![!l&!!!J! 

0: +I (7i0) 740-1684 

~' I Redacted I Chris Kmatdy (A TL) 

Cbris.Ktototd•·'i'!:!l!!ifauom 

0: +lj7i0)740-7918 

:,'[Redacted! 

MoltllewHymaa 

au~.iJ!-m~~a:! Eifet&!!! 

0:1' (6'j3)S91~ 

~' 1 Redacted , 

hloo ~ldiair 

J:LIIla.MrNair."or'!:!l!!iFil.rom 

0: +I (7i0) 740-.1107 

~' I Redacted I 

Sll(hon Andenon 

shdlouddt®a'i~if.lr . ...., 

0: +I (7i0) 140-.1&18 x.IS48 

~' j Redacted I DtridRoih 

Dllid.Roih'.i'sgoifa•.rom 

0: +I (7i0) 2964950 

~J:' I Redacted I 

S.S..Chana 

mwaxh:uuf«'!11•if4t.l"llm 

0: +I 40l 88.1.S907 

~' I RedactedJ 

TroyiWba 

Tro,.KJ,bts'i£!luiru.mm 

0: + 1(7i0) 3290~ 

M: Redacbld 

May 2017 

EFXCONG·SBC0000001 10 
207 


10417163.eps

Equifax Crisis Management Program 

Proprielal)' and ComJdelllial- For llllemll Use Onh· 

B:l Redacted I 

Fonaooe 1\'uobKillg 

~~'•m.Kill~mwu ..... 

OT'*!8S5-WO l ~~' Redacted 

Global Operations Sco«Vogt 

Scoii.V~'ir'S!I!!~IUOm 

0: +I (170) 7l0-1325 

~',' ! Redacted I 

Madtttin& AptmaSbJh 

AemLSbah~aif Lcom 

0: +I<'* 885-SIOJ 

~~1 Redacted I 

Corpolllle De>'Ciopmcal Ltigh Ann croo .. e 

l.dJ:!l,Ann.!i!ll2!!!c(<i!:9!K!J&I!m 

0: +I (41l1)8SS-3496 

,' j Redacted 1 

PSOL Assad La:larut 

A<lld.L.,.ru<'i~ul•t.c<HD 

0: +I (678) 795-7248 

~,'I Redacted I 

USIS Crai!tCrtbtrlt 

~~l::~l!!!!{~if&t:£!111 

0: +I Q70)740-1602 

~~ Redacted I 

blematiooal CAT Liason Shabid Charania 

~~id.Charatt~!!joifa•.mm 

0: +I (.m) 8S5-S611 

M: 

B:! Redacted I 

I 

AOO.m, AL Leader Braadon Hol<o11b 

hnn!l!!•·l!!!!!!!mh'ir'!'ll•if!>:!!!!•• 0: +I (41)1) 21066t2 

~~ Redacted j 

Cbalkslon. SC Leader Cmrd Baldo·ia 

JiSm:b!hhrin11..wi!!•.!!!!!! 

0: +I (843)375-1307 

~,'j Redacted 1 

0 2016 £quifax. All Riglts ReSCI\'<d 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

Southeast CAT Plan 

Page9 

B:! Redacted I 

Tm~rBurn.1 

T~r.l!om<1/~!fn.com 

0: +l(4W 373-IIOS 

~J Redacted j 

Dll\id Mtl<kn 

Da•id.l\lradeo'ii £9!!ifa.t.rom 

0: +I (673)218-2914 

,'I Redacted I 

Allirudbt Prtdhaa 

""'':l!rodluo'i~if••.ca• 

0: -l(ll4)610-S692 

j Redacted I 

Kdly HHC~t 

!!l!I<,Ht~l.sguifat,!ll!!l 

0: '-1 (.m)8S5.SI23 

~'i Redacted I 

MitT!d'ry 

mikt.((tf<>/cl!'lluirJuJ»m 

0: - I (678) 795-731)1 

~,'! Redacted! 

Julie ~ndersoo 

~!iM•~!l!ll!'ir'mif!t.tOm 

0: +I (770)8.11·2391 

~,'j Redacted I 

Mark Robrwmcr 

nlar\.mhrwaw:r'it~llifu~n' 

0: ·H 4i0 198-HI65 

~~edactedj 

£milyTrt,-lor 

<mi!!:.t!!l:!•r;'o£!l!!ifax.!'l!ll 

0: +I (.m) 394-6236 

~,'j Redacted I 

Brad Rtlf roc 

h!ld:Jln~im!il:t~&2•' 

0: +I (843) 375-1314 

~,' J Redacted I 

May 2011 

EFXCONG-SBC000000111 
208 


10417164.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial- For llllemll Use Onh· 

G=iDe. SCUader Douglas Rn·ls 

O..l:!!!!l<"li!l)•ifu.<VOI 

(): +1 (31 ) 214-7190 

:;j Redacted I 

Wilimington, NC L~r Sba•'l NU!fri 

oo!!o<h'.orloo'li';lqa.com 

(): 

M: 

8: 

Ri!I<Manag<mcnl lddtaCilr1iJ 

ol<tla.tonltli!!ll!if".tom 

0: +L ( -104) SSS-8559 

~~'! Redacted I 

CATA ssem bl ''Y S"t res 

S..tbea.t 

0 2016 £quifax. All Riglts ReSCI\'<d 

v.2.0 

Primal)' 

Secooda~· 

Southeast CAT Plan 

Page 10 

AmyRwh 

Aml.l!mloit~uif..,.toll 

(): .; 1(864)35().2591 

1 Redacted I 

ElloaStJAJ;o 

Ellta,§tul;o1itf1Difauoill 

(): +I (314) 21-1-7108 

H: ~~'I Redacted 

RacheiOisoo 

rodod.eltoo'oi'~oifa•.co•• 

0: +1 (-104) SSS-8976 

~'I Redacted 1 

!lOS W"lndn3111 Co~ 

Alpbamla. GA :lOOOS 

Fusioo Ce111er Collference Room 

lSI Floor • Bllildi'l!l 

Vinual Collfe~eoee Room 

May2011 

I 

I 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG-SBC0000001 12 
209 


10417165.eps

Equifax Crisis Management Program Proprielal)' and CollfJdelllial-For llllemll Use Onl)• 

Activation Framework Overview 

Southeast CAT Plan Page II 

Pbase 1: Assess the Situation & Assemble tbe Team. E'•ent reported to 

Incident er for activation assessment. 

The Incident Manager> will assess lhe threa~ seek guidance from other leadership if needed 

(Regiooal GM, BU Heads), and then determine the level of CAT activation required. The 

Incident Managers are notified via lhe Fusion Center and/or a member of the Equifax 

Management Team and includes: 

• Michael Dooglas 

• Dodd "Bryce" Williams 

Before activating the Regiooal CAT, the Incident Manager, in discussioos wilh the lceal site 

leader, will decide on an appropriate activation level based on tbe specific circumstances of the 

incidenl The level can escalate as necessaiy to acquire resources for crisis response All serious 

incidents must be reported to the CAT Leader or designee immediately. If there is any doubt 

aboot the activatioo level, the Regional CAT should be, at a minimum, activated at the Notify 

Only Level. 

Activation Level Decision: No Action, Notify Only, Stand-by, Respond. 

~otify Oaly Lt•'d 

The CAT is notified when an incident is not an obvious Equifax crisis initially, but wbieh 

warrants monitoring or would be of intereSI to members of theCA T. At this level, CAT 

Membtrs DO NOT mpond or assemble. Members are typically informed of the event during 

normal hOUr!, typically via ~H~~ail, and the Incident Assessment Coordinator becomes 

responsible for tracking incident status. 

St•d-by l.nd 

The Regional CAT may be put oo "Stand-by" wben an incident has the potential to become a 

Equifax crisis but CAT assembly is not yet appropriate. During this slage, CAT members will be 

notified of the incident and placed on notice that the team may be activated in the future CAT 

members should then be making the appropriate arrangements to ensure the CAT is staffed for 

their functioo. CAT Members DO NOTa»embleat the Stand-by level. 

RespOod L<.lrt 

The Regiooal CAT will be activated when there is a high potential for a Equifax crisis to occur. 

The activation can occur immediately upon initial notification or as an event esealates from a 

lower activation level. All CAT members will be notified of the incident and be asked to attend 

an initial briefing. Declaring "Respond-levd" activation immediately invokes the Regional 

Crisis Action Plan. Regiooal CAT activation \\ill l)'pieally use the Mass Notification System. 

0 20t6 £quifax. All Riglts ReSCI\-.d 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG-SBC0000001 13 
210 


10417166.eps

Equifax Crisis Management Program Proprielal)' and CollfJdelllial-For llllemll Use Onl)• 

Communkate to the Regional CAT if needed. 

Southeast CAT Plan Page 12 

In all situations \\'ben the Incident Response Coordinator has determined the incident warrants 

CAT activation at any level, CAT members will be notified as described above. lflheCAT is 

assembled, the Mass Notification System will be activated and simullliDeous communication to 

all CAT members and alternate members will occur. All documented contact points will be 

involved (Office Pbone, Cell Phone, Home Phone, E-mail, etc.). In most cases. a conference line 

will be provided as part of the activation process. 

Only proceed to Phase 2 if a RESPOND level activation is declared. 

Phase 2: .Prepare to conduct the Initial Briefing 

• Collect information. 

• Prepare agenda (ne.xt page). 

Phase 3: Conduct the Initial Briefing (For all CMT members and alt ~ 

usually a call) 

• Briefteam. 

• Disruss actions that are required immediately. 

• Determine what cross-functional coordination is required. 

• Specify ne.-a meeting time/location. 

• Di~CATactivation. 

• Activate CATs and review situation. Get CAT input 

Phase 4 Condud second meeting (CMT assembles) 

• Use pre-determined agenda (next page). 

• Status repon from affected site/business. 

• Status reports from each function (Include information from CAT briefings). 

Phase 5 Continue Response Activities 

• Conduct routine meetings using Brief, Discuss, Action model. 

• Continue management of crisis. 

Phase 6 Conclude the crisis response (Recovery) 

• Stand down CAT-move into recovtl)' stage. 

• Assign responsibility for on-going management elTorts. 

• Charter incident investigsrion team as necessary. 

• Conduct After Action Review. 

0 20t6 £quifax. All Riglts ReSCI\-.d 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG-SBC0000001 14 
211 


10417167.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial- For llllemll Use Onl)• 

Southeast CAT Plan 

Pagell 

Initial Actions-Respond Level Activation 

Review Guiding Prfntiplrs and Priorities: 

I. Place the highest priority on Life Safety - the welfare of all people including personnel, 

clients, visitors, emergency responders and community members, 

2. Protect our assets and preserve our ability to operate and supply our clients. 

3. Maintain a stroog Equifax reputation through ethically and socially aw'IU'e behaviors that 

ultimately preserve shareholder value. 

AFTER Declaring a Activation 

Initial Notification 

• Receive briefing from Incident Response Coordinator. 

• Confirm decisioo to activate CAT. 

• Confirm plan for initial CAT briefing. 

o Time, location, call-in numbers, etc. 

• Consider the need to inform the International Crisis Action Team or C01p001te Crisis 

Management T cam. 

• Consider the need to inform any regulatory agencies. 

Prrp.are for initial CAT britling 

• Review the Initial CAT Briefing Agenda (below) toeonfirm responsibilities. 

• If possible, obtain an updated Slatus oftbe incident 

• Consider the timing for the first full CAT meeting. 

0 2016 £quifax. All Riglts ReSCI\'<d 

v.2.0 May2011 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC0000001 15 
212 


10417168.eps

Equifax Crisis Management Program Proprielal)' and CollfJdelllial- For llllemll Use Onl)• 

CAT Meeting Process 

Briefing State: 

Southeast CAT Plan Page 14 

All CAT members present 

One person presents at a time 

No phones or computers in use 

Only present new and critical information 

Others only talk to seek clarification 

Everyone gets a turn I you can pass 

Action State: 

CAT Leader sets return time/disbands 

CAT members meet with department 

Provide new tasks and timing 

requirements 

Collect new information 

/recommendatlons 

Identify completed tasks and results 

0 2016 £quifax. All Riglts ReSCI\'<d 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

Discussion State: 

All CAT members present 

CAT leader selects lswes to discuss 

Establish clarity on issue 

Purposeful discussion to gain acreement 

Determine task, responsibility and timing 

Go to next issue 

May2011 

EFXCONG·SBC000000116 
213 


10417169.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial- For llllemll Use Onl)• 

Southeast CAT Plan 

Page IS 

CAT Team Roles and Responsibilities 

The prim31)' roles and res)JQilsibilities of the Southeast CAT are listed below: 

• Acts as prim31)'counsd to the CAT on all aspects of the operation in his or her area of 

responsibility including: 

o Local governmental requirements and laws. 

o Cultural expectations and norms. 

o Local conditions such as community reactions, media coverage, physical 

conditions, etc. 

o Travcllogistics. 

0 Security conditions. 

• Provides on-site or regional presence to assist in managing the event, as directed by the 

Incident Respoose Coordinator. 

• The CAT Leader may act as an Equifax spokesperson, if directed by Corporate 

Communications Leadership. 

• Oversees the entire local response process 

• Activates and may prO'.ide guidan<:e to the region's BusintSS Ctmtinuity Plans as 

directed by the Incident ReS)JQilse Coordinator. 

0 20t6 £quifax. All Riglts ReSCI\'<d 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG-SBC0000001 17 
214 


10417170.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial-For llllemll Use Onl)• 

Southeast CAT- Potential Considerntions List 

Southeast CAT Plan 

Page 16 

Please note that all actions in tbe list may not bt appropriate in every incident, nor 

are these the ooly actions required for a sut«Ssful respo~~.~e. n all cases, judgment 

should be used lo determine the correct actions. 

Initial Actions and Assigning Resou rces I CAT Leader) 

0 I. Advise senior management of incident and reaffirm responsibilities. Review roles of 

Southeast Regiooal managemen.l and Slaff. 

O 2. Activate the Southeast Regional CAT and confirm meeting locatioo. 

0 3. Review the need for outside suppliers. If needed, employ outside suppliers and have 

them operate under the direction of the Southeast Regional CAT. 

0 4. Assign a resource to acoount for all depai1Illent employees, contractors and guests and 

report any missing. injured or unaooounled people to the assigned HR resource. 

0 5. Assign a resource to maintain infonnation flow among the CMT, aU other CATs, 

affected departmems, and outside suppliers. 

0 6. Establish and communicate to the Southeast Regional CAT a method to capture action 

log and retain notes for post incident review. 

0 7. Activate additional staff as needed and assign tasks. 

Southeast CAT Considerations 

0 I. Identify key products and partners (channel, and third party) that may be affected, and 

provide list to Business Units. 

0 2. Establish a daily product & services availability review schedule together with Global 

Operations. 

0 3. Work "ith Corporate Communications, Global Operations, Legal and Finance CATs to 

establish priorities under refleaion of contractual obligations and obtain a plan for 

product availability. 

0 4. Establish a recovery schedule that is regularly updated and Te\~ewed as a basis for 

ongoing communications witb clients. 

0 5. Work with Legal CAT oon.tact to delennine impact of Serviee Level Agreements (SLAs) 

0 6. Recover the business as defined by the Business Continuity Priority Plan. 

0 20t6 £quifax. All Riglts ReSCI\'<d 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG·SBC000000118 
215 


10417171.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial-For llllemll Use Onl)• 

Securitv and Safetv Considerations 

0 I, Brief Site security personnel and reception if appropriate. 

Southeast CAT Plan 

Page 17 

n 2. Assist HR to accoont for all pe<Jp!e including staff, contract~m and ~isitors. Each 

department will be rtsponsible for their own staff and report findings to HR. HR will 

need information from Security and Facilities to aid in the search. Some data that they 

may need includes: 

• Security badge data 

• Visitors listS from front desk 

• Hospital transport infonnation as known 

0 3. Prepare and submit a security plan for the CAT Command Center and other critical 

facilities to the CAT leader. 

O 4. Initiate enhanced security proeedum at all sites. Access control and security procedures 

elevated througboot the corporation as necessary. 

0 5. Receive and disuibute to security persoonel official company statement(s) from 

Communications CAT contact 

0 6. Oetennine if CAT relocation is needed. 

0 7. Provide Security liaison to Municipal Authorities and liaisons to Fire'Police Incident 

Command Post as needed at the Emergency Operations Center. Work with Police for site and criminal issues (in conjunction with Legal). Be prepared to supply ~ideo, floor 

plans and other building information as appropriate. 

0 8. Contact outside service providers (Guard service, private invesrigators, law enfOICement 

specialists, etc.) to alert them to the emergency and the potential need for assistanu 

Evaluate lhe providet(s) ability to quickly mobiliu adequate resources upoo request. 

0 9. Review and approve requests foc additional security resources for Canadian office 

locations. This would include alerting security resoorces (Guard service, private 

investigators, Law enforcement specialists, elc.) of the emergency and potential need for 

assislance Evaluate the pr~ider(s) ability to quickly mobili1.e adequate resourus upon 

request. 

0 I 0. Recommend that all other CATs provide a list of the authorizcd/resuicted employees and 

contractors for the alternate woltsite. Provide t{)j)y of list to Security for relocation 

efforts. 

0 II. Provide security advice and consultation for persoonel traveling to the affected site. 

0 12. Provide executive protection for all potential threats to personnel. 

O 13. Conrinuoosly evaluate and miligate threats, including threats to affected site and other 

company facilities. 

0 14. Provide frequent stal\JS updates to the CAT teams members 

0 15. Monitor network security to prevent unauthoriud access by fonner employees, media, 

etc. 

0 20t6 £quifax. All Riglts ReSCI\..0 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2017 

EFXCONG·SBC0000001 19 
216 


10417172.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial-For llllemll Use Onl)• 

Southeast CAT Plan 

Page 18 

0 16. Contact security engineering for any additional resources and/or assistance. 

0 17. Provide notification and potential activation of the Securil}• Jncidt~tt Rt$pD11St T tam 

0 18. Oversee the authorization and implementation of the St~;urity Ru.!ints,, Colflinuily Plan. 

Real Estate Considerations 

0 1. Assess the situation and with the Security & Safely team, detennine the best and safest 

location for the CAT 10 assemble. 

• Is a conference cal11he only initial option? 

• If a physical location, communicate lheappropriale rooms for eath team. 

• Make sure selected rooms are safe and then se1 up the needed equipment and 

technology. 

• Establish catering sclledule to feed teams. 

0 2. Establish communications with facilities staff at affected sites. 

• Assess basic setvices and if suppon is needed. 

• Review the current situation status and recommend initial actions to the CMT and/or 

Southeast Regional CAT. 

0 3. Manage damage assessmenl activities. 

D 4. Identify potemial new and/or temporal)' spate alternatives ifprimuy mspace is 

damaged 

0 5. Obtain a lisl of prioritized business processes to relocate from the CAT. Ensure that the 

facilities relocation team receives direction on teams to be relocated. 

0 6. Work with wthorities to determine if any facility closures are needed. If needed, arrange 

rransportJ!rion for employees. 

D 7. Contact Security & Safety team to e11sure appropriate security has been established for 

business operation groups at alternate site. 

0 8. Discuss the current situation, status and restoration activities with the facilities restoration 

team and repon finding~ to the CAT. 

U 9. Set up a family meeting area, if CAT approves the needror one. 

0 10. Assess the effectS of the incident on mail and oourieroperalions. 

• Detenninea new location for deliveries if needed. 

• Advise delivery setvices of the new location. 

• Set up a procedure to get mail to the addressees from the new location. 

0 II. Include IT review for any production changes prior to deployment 

0 12. Approve and authorize the implementation of the Real Estate &siness Continuity 

Pions. 

0 2016 £quifax. All Riglts ReSCI\..0 

1'.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG·SBC000000120 
217 


10417173.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial- For llllemll Use Onl)• 

(,ommunication Considerations 

Society/Media Aspects 

0 I. Perfonn initial infonnationgalhering: 

• What is !he crisis? 

• What are the immediate eff~s including human and business? 

• Is !here more to come? 

• What is !he worst ease? 

• What are the likely timelines? 

• Has the incident been cootained? 

• What is being said on social media? 

O 2. Review stalling and lbe need for etnside consultants. 

Southeast CAT Plan 

Page 19 

• Determine need for and call in additiooal Communications support staff. 

• If needed, employ outside coosultants (I.e. PR Firm) and have lbem operate under 

lbe direction of lbe Communications team. 

0 3. i\$ign a person to maintain information flow between lbe CMT and all olher impacted 

Regional CATs. 

0 4. Assign a person to manage information flow to the media and handle media calls. 

0 S. Assign staff to develop lbe Core Press Statement and talking p<lints for business unit or 

company spokespersons. 

0 6. In conjunction with Security, determine ifil would be appropriate to assign a 

C001munications Liaison to !he responding officials' Emergency Operatioos Center. 

O 7. Assess crisis efl'ectsto determine if the Communicalio!IS /Jllsiness Continuity Ffan needs 

to be activated. If so, oversee determine riming, priorities and assign resoorces as 

appropriate. 

O 8. If needed, activate a Crisis C001munications Center. 

0 9. As needed and directed by lbe CMT and/or the Regional CAT, dispatch and support OnSeene T earn, including Communicatioos Coordinator if appropriate. 

0 I 0. Identify and prioritize stakeholders; develop notification plan as appropriate. Consider key 

potential audiences groups: 

l. Employees (US & International) 

2. Cust001ers (B2B and B2C) 

3. Boord of Directors 

4. Media 

S. lnvestoo (Financial Community and International Partners) 

0 20t6 £quifax. All Riglts ReSCI\..0 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May 2011 

EFXCONG-SBC000000121 
218 


10417174.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial- For llllemll Use Onl)• 

Southeast CAT Plan 

Page20 

6. Third-Party Stakebolders 

7. Coolpetitors 

8. Government Officials 

9. RegulatOI)' Agencies 

10. Advocacy Groups 

II. Industry Associations 

12. General Public 

0 II. Develop a Communications worst~ase scenario including the potential for rep~~tation 

damage for each stakeholder group. Detennine \Wether to utilize PR firm for this step. 

O 12. Begin develOping a media strategy based on CMT recommendations: 

• Is media already on-site or at designated location? 

• Media briefing location required? 

• Recommend news briefings if appropriate. 

• Reactive or proactive approach? 

0 13. Identify company spohspenon(s) and provide briefing support and guidance. 

• Produce media alms to advise media on rime and location for Press Briefings. 

• Prepare talking points for questions that are likely to be asked by the media. 

• Review talking poims with spokesperson prior to briefings. 

0 14. Identify ao onsite spokespenon and provide with a Core Press Statement and follow-up 

news media briefing statements" 

• Confirm/identify imemal approval process for news media statements. 

• Develop a media schedule for Press Brieflllgs and releases. 

• Produce media alerts to advise media on time and location for Press Briefings. 

• Prepare lalkiog points for questions thai are likcly to be asked by the media. 

• Review lalking points with spokesperson prior to briefings. 

0 IS. Define all the specific media materials that need to be prepared for each audience. 

D 16. Expedite approval process for releasing information to the media and other audiences. 

• Contact !he list of defined contributors for crisis communication process 

• Follow the approval process as delined in the Crisis Communications Plan 

• Receive sign-off from those on the defined Approval list 

• Release information as defined by the approved distribution channels in the Crisis 

Communicatioos Plan. 

D 17. Assign resources to track social media and create timely response. 

0 2016 £quifax. All Riglts ReSCI\'<d 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG·SBC000000122 
219 


10417175.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial-For llllemll Use Onl)• 

Southeast CAT Plan 

Page21 

0 IS. Consider lhe need to activate llallSiation services. 

0 19. Include IT review for any produclion changes prior to deploymenl 

0 20. Monitor all media, including real-time monitoring of broadcast, social media and online. 

Implement a prin~ broadcast and online clipping scr.ice. Forward a oopy of all ooUected 

ooverage to lhe Legal team. 

• Respond as needed to misinformation 

• Establish a summary prooess for reponing media information to CMT 

0 21. Establish oontact with Communications executives/staff in aft'ected locations. 

• Notify and coordinate wilh appropriate departmental personnel 

• Offer communications resoorees from lhe Communications CAT (where !here is a 

unique expertise as listed in Section C) 

• Verify that Security is controlling the media at the affected site and deliver 

message !hat no video or cameras are permitted on Equifax property 

Employee Aspects: 

0 22. Coordinate with HR to prepare and execute a communication plan for employees. 

• If appropriate to situation, remind employees to notify !heir families !hat !hey are 

safe 10 reduce number of families calling in. 

• Identify specific employee groups !hat need information. 

• Communicate phone number for employees to use to get updated information. 

• Identify information vehicles and craft appropriate message(s) to communicate to 

employees. 

0 23. Coordinate wilh HR to set up an employee bot line(s) for employees to call and receive 

information. POS1iible existing call centers and resource include: 

SendWordNOIY Notification System -(hnp:J/www.sendwordnow.neJ) 

CUstaner Aspects: 

O 24. Assess effects on customers and determine necessary communications. 

0 25. Obtain and have available a list of all "call centers." 

0 26. Work wilh Bus and Global Operations to identify appropriate toll free numbers to use for 

customer response to the crisis, confum numbers are staffed and publish numbm via 

appropriate customer communication channels. 

0 27. Create. distribute and update messages to be used by staff at all caU centers as occ~ry 

0 20t6 £quifax. All Riglts ReSCI\..0 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG·SBC000000123 
220 


10417176.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial-For llllemll Use Onl)• 

Southeast CAT Plan 

Page22 

0 28. Work wi1h Bus and Global Operarion.s resources to provide call center staff instructions 

about referring media calls. 

O 29. Activate and populate pertinent infonnation on the internet. 

0 30. Consider 1he need to SCQJre translation services at call center locatioos. 

0 31. Consider 1he need to implement probing surveys to further deuil customer reaction to 1he 

crisis. 

0 32. Monitor and report call center and social media consumer feedback to the Communications 

CMTMember. 

Human Resource Considerations 

Payroll Process Function and Support 

O I. Determine if there 11111 be an impact to payroll and ooordinatecontingency planning. 

• Compensation decisions for facility closure/delayed opening 

• Approval process for over-rime coverage 

• Time-sheet approval process for employees and/or contractors 

0 2. Work wi1h Finance to contact payroll veodor or service and provide decision on how to 

manage payroll cycle. 

• Workday is payroll system of record for US locations. 

• Will payroll file be delayed or sent outside of nonnal schedule? 

• Can payroll vendor re-run last payroll file? 

o Run 40 hour week for US overtime eligible employees 

o Rw1 37.5 hours for Canada overtime eligible employees (may be autopaid). 

*Payroll report ..ill be run automatically through retro process once eorrect time is 

submitted 

HR Emergency Response Of apolicablel 

0 3. Prepare a spreadsheet oo1he heal1h starus of employees, contractors, vendors and visitors 

in ooordination lli1h 1he Incident Commander and/or local au1horitiesfpublic officials. 

• Names and location (hospilal)ofinjured and brief status of condition if available. 

• Names of anyone killed 

• Names of anyone missing or unaccounted for. 

• List of evacuated employees, contractors etc. 

0 2016 £quifax. All Riglts ReSCI\..0 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG-SBC000000124 
221 


10417177.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial- For llllemll Use Onl)• 

Southeast CAT Plan 

Page2l 

0 4. Obtain repon from Secwi!y and Emergency Managemem and repon to CMT regarding 

response details: 

• Number and staius of ,;ctims 

• Victim llansport-which hospitals? 

• law enfon:ement involvement 

• Evaruation status (If applicable) 

• Access to building and property 

• Immediately identified damage 

O S. Work with Security to unify operations with local medical officials at the incident scene. 

• Determine if employees have been injured or sent to hospital, and if hospitalized, 

assign bospitalwatch personnel. 

• Determine if employee fatalities have ocrurred. If so, pro>ide support as appropriate 

to assist public officials involved in next-of-kin notification. Coordinate infonnalion 

with Communications team, Regional CAT and/or CMT. 

• Contact the health insurance company to inform them of incident and hospitalization 

of employees. 

0 6. Obtain Security badge list and vi~tor lists as ~ble from Serurity. 

0 7. Communicate with external vendors to alen them of the incidem and coordinate effOrts 

aocoooting for contractors that may have been site at the time of the incident 

0 8. As possible, establish/activate employee infonnation hotline. 

0 9. Provide suppon and information as possible to authorities to conduct Next of Kin 

Notifications. 

0 10. Coordinate closely with EAP for family notifications and support. 

0 II. Work closely with Communications team to develop messaging for employees and 

families. 

O 12. Establish ongoing communication with family members of affected employees: 

• Establish phone number for family members to call. Establish pre-recorded message 

if necessruy based on call volume. 

• Lead the process of contacting the families of those injured, as necessary; provide 

information on the nature of the injuries and the name, location and phone number of 

the hospital where the injured employees have been taken. 

• Send an Equifax representative to the hospital to which employee(s) was transported. 

If possible, send one company representative for each seriously injured person. 

• Determine if need for a family gathering area off-site for affected families. Work 

with Serurity and Facilities/Travel teams for arrangements. 

• Staff the family gathering area with EAP personnel-determine the neod for 

0 20t6 £quifax. All Riglts ReSCI\..0 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG-SBC000000125 
222 


10417178.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial-For llllemll Use Onl)• 

Southeast CAT Plan 

Page24 

couoselro at the hospitals or other locations to pr<r.ide suppon to families. 

• Estal>lish and maintain a log offam.ilies clJecl<inginto gathering 

• For ex•pat families in Sootheast review medical coverage and assist os possible. 

• For ex·pat families affected abroad determine special needs suclJ as repatriation of 

remains, visa issues, evacuation, etc. (Consult ISOS as needed for international 

incidents.) 

0 13. Work with EAP to arrange for counselors toassistemployees upon return to work. 

Human Resources Business Support 

0 14. Establish and maintain communications with EIR leadership in the affeaed BUs and with 

the affected localion(s) if noi a main campus facility. 

• Review relevant HR issues/policies (benefit plan summaries, coverage. etc.) and be 

prepared to respond to related questions. 

• Assess basic seMces and if suppon is needed. 

• Offer affeaed departments(s) Human Resources expertise from the HR team (where 

there is a unique expenise as listed in Seelion C). 

0 15. Determine which critical HR activities are time-sensitive and respond accordingly. 

D 16. Access and veruy the contact listing of company, alfeaed department and outside 

penonnel wbo are essential in the HR team's ability to respond to thisevenL 

0 17. Assess the stalling impacts of the inciden~ including: 

• Make recommendations to CMT if shifts should be cancelled or reduced and what 

communications shoold be sent to the general employee population. 

• Estal>lish or interpret policy on compensation of workers not reporting because of 

the incident. Address pay issues and benefits related to employees who are told not 

to eome to wock because of facility damage, etc. for a few days or weeks. 

• Address policy for keeping people on payroll if site is shut down for an extended 

period of time (weeks to months). 

• Assess the impact of staffing cllanges on agreements for contract employees. 

• Address special temponuy staffing needs and use of contractors and/or consultants. 

Confirm the dispatch of and the estimated anival times of additional staffing. 

O IS. Accelerate/facilitate processing the following: 

• Medical services 

• Realth benefits 

• Other benefits ( 40 I (k) loans. withdrawals, etc.) 

• Leaves (FMLA. DL etc.) 

• Life insurance claims 

• Workers compensation claims 

0 19. Engage HRRepresentatives in identifying and responding to employee issues at the 

department level. 

0 20t6 £quifax. All Riglts ReSCI\'<d 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG·SBC000000126 
223 


10417179.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial-For llllemll Use Onl)• 

Southeast CAT Plan 

Page2S 

0 20. Ensure HR Slaffing capability at backup or redundant facility: assist affected department 

to acquire temporoy staff if needed. Ensure staffing is available throughout the "Return to 

Normal" uansition. This may require additional stafftoocOJpy both lherecovety loc.ation 

and lhe "home'' location. 

0 21. Prepare rapid training planning for empiO'fees as necessary to address technology skill 

tr11nsfer. 

0 22. Develop an HR-based W{)rst-case scenario. 

0 23. Monitor locatioo of employees and assess lhrcals related to the incident on global 

emplO'fee base. 

0 24. Assess the need for unique high~cvcl, external HR contacts at the company level. (For 

example Ministl)' of Labor) 

0 25. Evaluate HR record systems and special record retrieval activities at the affected site, 

0 26. Implement manual reeocds (hard copies) as needed. 

0 27. Include IT review for any production changes prior to deployment 

AR Communication Issues: 

O 28. Work wilh Communications resourteS to ensure language of internal and external 

releases is protective of HR policies. 

O 29. Communicate the HR petSpective on lhe incident oo a regular and timely basis to internal 

audiences, specifically lhe CMT and other CATs. 

O 30. Prepare, in coordination with Communication CAT, a Communication Plan for 

emplO'fees. 

0 31. Ovmee lhe entire emplO'fee communications process for lhe company's response 1vith a 

perspective of maintaining emplO'fee morale and eonfiden<:e. 

n 32. Provide input to CMT on whether employees should report to work. 

0 33. In conjunction with Communications, communicate to employees if they should return to 

work or not. Also possibly communicate any pay/benefits decisi.ons during the crisis. 

0 34. Communicate regularly to ernplO'fees about the incident and set up a process for 

employees to obtain updates on the crisis situation and for company HR to receive 

information from employees regarding questioos. Provide answers tocmplO'fee questions as 

necessary. 

0 35. Activate an employee hot lint(s) to answer employees' questioos. 

• Establish incoming and outgoing communication capability 

• Make preparations for banslation of messages into all required languages 

0 36. Coordinate providing employees' access to TV/cable news stations at sites. 

0 37. Establish communications with contractor/vendor companies that may have empiO'fees 

oo site (on coordination wilh IS). 

0 38. Evaluate potential for HR issues to spread to other areas or locations n« immediattly 

affected by the crisis. 

0 20t6 £quifax. All Riglts ReSCI\'<d 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG·SBC000000127 
224 


10417180.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial-For llllemll Use Onl)• 

Southeast CAT Plan 

Page26 

Technology Considerations 

0 I, Offer IT resources to affected departments, especially when there is a unique expef1ise 

listed in Section C. 

n 2. Provide IT resources to external par1ies on the scene. Note: all resouroe requests must be 

balanced between the business need and IT Recovery via the IT team. 

0 3. Assess crisis todeiermine ifthe IT Disaster Recove!)' Plan needs to he activated. If so, 

oversee implementation and liaise between IT reoove!)' opcrations and the rest of the 

company. 

0 4. Determine an IT worst-case scenario including the potential for widespread data or voice 

failure, data loss. unauthorized aceess to proprieta!y information, etc. Determine lhe 

need to lock down data center and if needed have authorities sweep data center. 

0 S. Establish and communicate to IT team a meihod to capture i!Ciion log and main notes for 

post incident review. 

D 6. Work with IT Service Desk and review number and types of IT issues. 

O 7. Coordinate dte needs of the CMT and CATs including the items listed below in a secure 

fashion. The IT CAT member will coordinate widt dte Equifa.x Disaster Recove!)' Team 

and will request technology requirements. Ensure the IT Disaster Recovery T cam 

secures and makes available all needed technology including: 

Send an IT resource to CMT location to provide support. 

Additional pbane ~ts in meeting rwms. in conjun~tion with facilities group. 

Computers for anyone involved in dte response that needs one. Configure dte 

computer for appropriate applications aceess and provide user identification and 

password information. 

Provide initial access training to those using supplied computers, 

0 8. Maintain communications \\ith other Equifa.x sites regarding the status of their networit 

and any technology related issues that may affect them. Gather information from 

impacted sites regarding key ilems: 

Data center options. 

Business and systems capabilities. 

Nightly processing suppon. 

SLA breaches. 

0 9. Work widt IT executives as appropriate, 10 declare an "IT Disas1er." 

0 10. Work with all organizations to assess the impact of the incide01 on "business-as-usual" 

call handling and staffing levels. If needed work with 1elecomm providers to reroute 

crisis calls to elimina1e effects on other departments. 

0 II. Communicate the IT perspective on !be incident on a regular and timely to inlernal 

audiences, specifically the CMT and other CATs. 

0 20t6 £quifax. All Riglts ReSCI\'<d 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG·SBC000000128 
225 


10417181.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial- For llllemll Use Onl)• 

Southeast CAT Plan 

Page27 

0 12. Determine need (or not) to control/limit communication channels (e-mail filters, 

limitation, phone red ~s, etc.) 

0 13. Work with Communications team to develop any messages regarding IT issues ensure 

that £quifax's "One V(j,ce" message tocustomedcusromer-facing teams is consistent 

0 14. Provide "initial assessment" to the IT CAT member of current capabilities of the 

infrastructure 11ith infonnation provided by the IT Disaster Reoovery T earn regarding: 

Overall effects on all systems. 

Technology outages (including estimated durations). 

Timing of new set up. 

Available systems. 

Potential locations for business resumption based on buildings that have working 

infraslructurc. 

0 15. Identify business needs and then shift resoorces as possible based on insights from the IT 

Disaster Reco~ery Team. Once priorities are decided, ensure IT Disaster Recovery 

Team executed recovery against established priorities. 

0 16. Ensure IT Disaster Reco~ery Team monitors activity on company and site phone systems 

and take required action to keep telecon1m systems operational. 

0 17. Ensure IT Disaster Recovery T earn monitors security of netWorlcs to prevent 

unauthorized access by fomter employees, media, and others. Assess if destructive code 

has entered the system or threatening emails. 

0 18. Ensure IT Disaster Recovery Team fills requests from theCMTand CATs for 

collaboration tools, remOte data and voice access, teleconferencing and videocooferencing capabilities and suppons these tools. 

0 19. Prepare the systems for extra workdays (Sat., Sun.) if needed. Review resources for IT 

Help Desk and increase number of staff and resources as needed. 

0 20. Work with Facilities to monitor and confirm delivery and receiving process of new or 

relocated equipment Installation will be provided by the IT Disaster Recovery Team. 

0 21. Nocify CMT when alternate locations are operational and application and data 

restorations have been completed 

Global Operations Considerations 

O I. Advise employees of the situation and coordinate the actions associated 1vith the Global 

Operations BCP plan. 

0 2. Recommend to CMT the actions needed to continue critical company operation 

processes, agree on tasks and priorities. 

0 3. Establish contact 1vith the key sales and Global Operations leader(s) at the affected site(s) 

and obtain initial onnditions and suppcrtneeds. 

0 4. Evaluate thesiruation to determine if the disruption will compromise the ability to 

conduct and support business, for what period and which areas of Global Operations 

would be impacted by the disruption. 

0 20t6 £quifax. All Riglts ReSCII'<d 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2017 

EFXCONG-SBC000000129 
226 


10417182.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial-For llllemll Use Onl)• 

Southeast CAT Plan 

Page28 

0 S. Evaluate the potential financial effects of lhe disruption and provide an assessment to lhe 

CMT.If needed, determine lhe requirements for prioritizing services. 

0 6. Assess potential for the incident to affect other Global Operations. Those Global 

Operations po«eotially affected have been given situational guidance, e.g., shu1 dowo or 

increase preparedness. 

0 7. Communicate v.;lh external service providers to ensure safe, orderly services exist as the 

locations can handle thero. 

0 8. Work with thinl party suppliers to ensure coopa11tion iflhe crisis involves lhcir 

employees or locations. 

0 9. Assess the customer service Global Operations and provide ltCOO!mcndations to the 

CMT if Global Operations haYe been affected. Oversee the timely recovery of customer 

service Global Operations. 

0 10. Ensure customer service representatives have accurate information about the incident and 

have a scripted response to customer questions created in conjunction v.ith th~ 

Communications CMT Member. 

Legal Considerations 

0 I. Determine key legal and comptiancc issues and assess availabilil)' of internal/external 

resources !hat are required. 

0 2. Advise all functional areas of potential legal and compliance issues and assure 

appropriate response. 

0 3. 0\'eTSee the entire information galhering and recording process for lhe company's 

response wilh an eye toward discovery-related issues and record-keeping requiremems. 

Advise those involved in incidenl response as to whal types of written communications to 

make and what records to keep. 

0 4. Work \vith the Communications team to develop appropriate messages, including advice 

on internal/ex1emal communications. 

0 5. Coordinate wilh Rcoords Management about salvagiomrotecting existing vilal records. 

0 6. Ofl'er Legal Department resources from the Legal team to afl'eded operations (where 

there is a unique expertise as lis1ed in Section C). 

0 7. Appoin1legal counsel on-site, if needed. 

0 8. Monitor, via lhe Security team, actions oflccallaw enforcement officials at lhe incident 

scene if applicable. Assess the poiential criminal aspoots oflhe inciden~ including: 

• Whether the oompany, its officen or any <llher employees or contractors may have 

potential criminal liability for the incident or the results of the incidenL If so, assess 

need for represemation and obtain if warranted 

• De1ermine iflhe incident is relaied 100r as a result of criminal action on the part of 

someone not associaJed wi1h Equifax. If so, ensure local cooperation wi1h criminal 

investigation in coojunction with SCQirity. 

0 9. Develop contlct wilh lccal regulatory officials a11he inciden1 scene if applicable. Assess 

the regulatory aspeCts of lhe incident, including; 

0 2016 £quifax. All Riglts ReSCI\'<d 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG·SBC000000130 
227 


10417183.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial-For llllemll Use Onl)• 

Southeast CAT Plan 

Page29 

• Determine if Jhe required regulatory agency reporting requirements have been met. 

• Determine if regulatory inspections m planned, an<l if regulatory actions are possible, 

and assig~~ Legal Department resouroes to assist and monitor the 311dits. 

0 10. Assess the potenriallegal & compliance risks at the incidentscene and at other shes, with 

specific focus on: 

• The protection of employees and property, 

• The proteaion of evidence and forensic state of the incident scene. 

• Assess J)O(entialliability issues including: 

• Potential human health, personal injwy and wrongful death claims. 

• Potenrial property damage claims. 

• Potential regulatory fines and peoalties. 

• POtential supplier, vendor or customer breach of oontract 

O 11. Assess the need for unique high-level, external legal Department contacts at the 

company level. (For example, Jhe U.S. Anorncy or local District Anomey, 

Administrators of Federal Regulatory Agencies, heads of key Non-Government 

Organizations; equivalents in olhcr countries or regions.) 

Finance Considerdtions 

0 I. Establish oommunications \l-ith the Finance Department staff at the affected site. 

0 2. Offer financial resources from the Finance Department to aJTected site (where !here is a 

unique expertise liSied in Section C). 

0 3. Create an estimated budget for crisis response acliviries and present 10 Jhe CMT. 

0 4. Assess effects of crisis on reporting requirements and take necessary action. (e.g. 1a.x, 

insurance providers, iovesunent oommunity, SEC and olher regulators) 

0 5. Notify external agencies of the crisis sirualions as appropriate. 

0 6. Sectlre hard copies of books and records for reference if technology is nOt available. 

0 7. Obrain spending authorization from the CMT. 

0 8. Notify external auditors, via the CMT leader of the crisis situations as appropriate. 

0 9. Assess clearing and sealement operations SlaiUs. 

0 10. Assess Acooonts Payable and Accounts ec~vable/Cred t operations an<l provide 

situation repcn to CMT. 

0 II. Identify manual options to provide Acoounts Payable and Accounts Receivable/Credir 

process. 

0 12. Assess status of payroll operations and reoommend methods to pay employees if normal 

technology is nOt operational. 

O 13. Report the incident to appropriate insurm and establish claims as needed. 

0 2016 £quifax. All Riglts ReSCI\'<d 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG-SBC000000131 
228 


10417184.eps

Equifax Crisis Management Program 

Proprielal)' and ComJdelllial- For llllemll Use Onl)• 

Southeast CAT Plan 

PagclO 

0 14. Prepare a report for the CMT decailing !he applicable coverage, de<hictibles and coverage 

limils. 

0 15. Establish special cos1 centerto collect/aocumulate losses related to !he crisis. 

0 16. Track response COStS forinsumncepurposes. 

0 17. Recommend actions to re<hice additional losses. 

0 18. Coordinate with insurance providen and adjustors that will come to the site. Schedule 

adjustor visits considering the safety of access to the affected site. 

0 19. Review response budget detennine if cash availability is adequate. 

0 20. Determine cash positions and assess if any actions are needed to protect access to cash.. 

O 21. Reach out to banks as appropriate to notify them about any potential irregularities in 

banking procedures. 

O 22. Collect costs related to the inciden11o provide documentation of the loss. Verify the 

documentation is categorized by loss type accooling to policies in force. 

O 23. Implement the Finance Dtp1111~ 1 BusilltSS Cuntilwity Plan. 

0 24. Assesslmodify internal controls for the crisis management program. 

0 20t6 £quifax. All Riglts ReSCI\'<d 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG·SBC000000132 
229 


10417185.eps

Equifax Crisis Management Program 

Proprielal)' and CollfJdelllial- For llllemll Use Onl)• 

Southeast CAT Plan 

PagcJI 

Marketing C'..o sideration ~ 

0 I, Identify key productS and pa11ners (channel, and third party) that may be affected, and 

prO'Iide list to Business Units. 

n 2. Esu.blish a daily product & services availability review schedule together with Business 

Operations. 

0 3. Work with Corporate Communicatioos, Global Operatioos, Legal and Finance CATs to 

establish priorities under reflectioo of contractual obligatioos and obtain a plan for 

product availability. 

0 4. Esu.blish a recovel)' schedule that is regularly updated and m1ewed as a basis for 

ongoing communications 1vith clients. 

O 5. Work 1vith Legal team to determine impact of Service Level Agreements (SLAs) 

Business Unit I Sales Considerations 

0 I. Identify key products and pa111lers (channel, and third pany) that may be affected, and 

prO'Iide list to CAT members. 

0 2. Esu.blish a daily product & services availability review schedule together 1vith IT and 

Global Operations. 

0 3. Work 1vith Corporate Communications, Global Operatioos, Legal and Finance teams to 

establish priorities under reflection of contractual obligatioos and obtain a plan for 

product availability. 

0 4. Esu.blish a recovel)' schedule that is regularly updated and reviewed as a basis for 

ongoing communications with clients. 

0 5. Work with Legal team to determine impact of Service Level Agreements (SLAs) 

0 6. No6fy theCA T of any risks associated with losing the transaction during any ac~uisition 

activity. 

0 7. Determine ifM&A activity lvill need to be suspended until after the crisis 

Deactivatiao and Post Incident Actions 

0 II. Coordinate and disseminate "Return to Normal" message to employees, vendors, 

contractors, and other stakeholders. 

0 12. Compile all documented activities in incident starus report. Collect and retain all notes 

and logs created during the event for later post-incident review. 

0 13. Deactivate SoulheaSI Regional CAT and all response vendors as appropriate. 

D 14. l'ar1icipate in debriefing sessioos as directed by the CMT. 

0 20t6 £quifax. All Riglts ReSCII'<d 

v.2.0 May2011 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000133 
230 


10417186.eps

Equifax Crisis Management Program Proprielal)' and CollfJdelllial- For llllemll Use Onl)• 

Accounting for People Guidance 

Southeast CAT Plan Pagcn 

The Se<:urity and/or HR I eam is respoosible for compiling all data aboot the status of people 

during a crisis; however, each departmental area is responsible for reaching out to their 

departmen~s line cwganization or other resources to help aocount for their staff 

I. Once safely out of the area of danger, assign a resource to track departmeDt staff status 

infonnation. Ideally, this person should not be member of your CAT, but another person 

who does not have another emergency management or crisis management role. 

2. If assembled physically, writt.down the names of people you know to be safe and the 

ones you cann.ot account for (within vicinity~ If you have evacuated, this may be chaotic, 

but write down as many names as possible. Ask employees if they know anyonetohave 

been injured as well as any staff members that they know were not in the area of the incident 

(such as on vacation, traveling. etc.) 

3. Through chain of command within departmtn~ ask managers call out to cheek on 

employees and st.nd results to assigned resource. Ask managers to track their information 

and provide a summary to you at a regular inteMI (daily, evet)• 3 hours, etc.) 

4. For identified injured employees, notify the BR CAT contact immediately! Try to get 

additional information as possible about the location of the victim. Alwavs doanneni the 

soorce of information. What hospital? Has the family been notified? 

S. As possible, account for any contractors and guests and send to the 8R CAT contact 

6. Do not contact families or conduct Nexf.of-kin notif~tations. The HR team will coordinate 

all family notificatioos. Remember that SOOie of the infonnation collected in the immediate 

aftennatb of an incident may be incorrect. If you have home numbers and are attempting to 

reach out to employees, be prepared to talk to family members. Calmly infunn them that an 

incident has oocurred. Instruct them to call back or have their family member call back when 

they see them. Do not spoculate. Do not provide incident details, but be polite and 

compassionate. 

7. Accounting for people tak~ time. Keep HR regularly updated on your efforts. 

Send all of your information to the RR Team. Within the first hour of the response, the 

8R Team will reach out to each department contact to provide a method to receive your 

information. If you do not hear from the HR Team, send your information to 

EFXpeoplewatcb'lileguifas.com. 

Keep the 8R Team updated rt2ularly on l'Our efforts. Accouo!int for peotJie takes time! 

0 20t6 £quifax. All Riglts ReSCI\'<d 

v.2.0 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG·SBC000000134 
231 


10417187.eps

Equifax Crisis Management Program Proprielal)' and ComJdelllial-For llllemll Use Onl)• 

Revision History: 

Southeast CAT Plan Pagc 33 

Complete bistOI)' of updates is captured within the Crisis Matulgement Plan HistOI)' W& 

field 

Appendix A: Business Continuity Contact List 

11'1111 

AU:wa ·Legal 

AU:wa • Corpor.te Del~ opmect 

Ad:wa · USIS 

Alp!mtia · Global Opernlioos Gf Coau11C0Cial 

AU:wa • Fonocc SfO USIS and Ope011ions 

AlplmtiJ ·IT USIS 

llo~ ·Global OpeOI1ioDS OBS 

AlplmtiJ · Global OO"lCC Allomatlon 

AU:wa. FunllCC CO!lrollersbip 

p~Mtla • MalteUog 

Adilllla · FrmnceTax 

AlplmtiJ • inlel())lllleCI PS 

AlplmtiJ • USTS 

AlplmtiJ • Global Seeori~· 

Alplmt~a · Global Opetlltioos and Co1111"butor 

Sci> ices 

AlplmtiJ · Global Solutions llelivCI)' O>C 

AlplmtiJ ·Global Solutions DeliveJJ• CMS 

AU:wa • Fonocc lo\'eSIOr Relations 

AlplmtiJ · IFS 

0 2016 £quifax. All Riglts ReSCI\'<d 

v.2.0 

Mallldia.Susan 

·-· Oroon~e Leig_b 

Oaldller, Mlcllld 

Waid.Scou 

Dtandberg, Doogbs 

Arasllmlpalli. HWb 

1\'oeks,lulbon)• 

w~ Greso'l' 

KiJ>&Nuab 

Cr.-~llll: ro Adriano 

Elll'ood.Joho 

Myers, Wade 

Brnndon, Dennis 

Manldin. Susan 

Drew 

Dcigtwl. AndrtW 

Vogt.Scon 

Dodge, Jeffrey 

Andtadc, Carlos 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

May2011 

EFXCONG·SBC000000135 
232 


10417188.eps

Equifax Crisis Management Program 

Proprielal)' and ComJdelllial-For llllemll Use Onh· 

Cbade.10n • WS _ elbority Salcs BU 

Alplmcl2 · Global Soo!t~ Ofl'JCe 

OltCOI'illc·WS_~Illions 

1\lplmlla • Global Coosumet Sollllio~ 

Alplmcl2 ·Global P~onn Scnices 

All3ma · F'maoce Audil 

All3ma • M:llir(t~ 

~~~· l!SIS 

~o~ ·Global CollltlmtrSollllions 

Ad:wa · F'Ul3DCe Treasuttr 

UK·Giobal()peations 

AlpkltU> • Con:Sofi•111e E~ CSE) 

A lplmiia • Global Corpomlt Ptalfonns 

Ad3ma· HR 

No~ ·Global Operntions 

!iO~·F'Ul3DCe 

Adm_Real£513le·l'loollttnelll 

0 2016 £quifax. All Riglts ReSCI\'<d 

v.2.0 

James,Ma!k 

BIOI\'D. Timoih)• 

Rawls,Doodas 

FriOOricb. Roben 

Li&t!ll.Micbael 

Blaloct, Cbristopber 

Gutttner, Maria lliCS 

Morrison.Daaicl 

Lalllros.Assld 

Booi'JCkl ~flCbacl 

Rudd.Janice 

Reid, lames 

Bayer.lbilnniel 

83111C,Micbael 

Wcd<s.Anlhouy 

Bambarger,Ri<bard 

Briscoe, Philip 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. 

Southeast CAT Plan 

Pagc34 

May2011 

EFXCONG·SBC000000136 
233 

EQUIFAX, INC., ‘‘SECURITY INCIDENT HANDLING POLICY AND 

PROCEDURES’’ 


10417189.eps

Security Incident Handling Policy & Procedures 

!>.go I PAGE \' MERGEFORW.T I 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. E.FXCONG·SBC000000137 
234 


10417190.eps

Document Change Management 

o.c...-

- !'q.i'ols.wtylrQdert~-

ll!>': Flllloy& 

"""""~ 

- No. 

~-- Moo.Mogol lssiledBy. Gl:ibal Secuiy 

~By. -Mogl 

~ Ncl<~ 

....... Dolo: Jw7f1!1 

...... - Ocool:<f3)14 

-- Oco>ber3l15 Dolo: Dolo: 

Dllt 

- Vonlo o....-.ct~ 11 

Moyaxl6 Nclcl/edoo04> 1 l'!odu:tiM-e...:od. 

mm N. ~O,-. 6 ~od 1o comW. Ttctncol. O.o n Plljoicol 

s. Cl'dk<y Seculy An no ,... IIWed Seculy lrcid«i RMponse Flan 

Foinoryl!XII N.~D-.s. 

s. adlory i Yuoty \.l>dm 

Ftlnay 3)10 N.~ ,_, 8 eMy upaaleO 

s, adlory 

Fobn.oryall l N.~ . 8 l!lfy ~ I s. Cl'dk<y 

Oddior lOll ~= ,_, 9.1 

-lOll N. ~ 9.1 ==~......-~ \.l>dlloiSoclion li iX>---oiiR I CcttociUtl-&~ ... 

-lDii Ra-t~ 9.1. \.l>daled~Fard creoteda_.. 

2 doco.r1oertfo<ltleirlomlolion.Vdedwol> 

= .- coo-lowordi'Qn 

Oddior lD12 fG.tSIMirigor 9.3 \.l>dllllo OOoS poococln 

JwlD14 FIWsFfliey 9.4 \.I>CIIIIIOamd-. a~W'Q.d!rifr 

iii'QuOge,and«garrzzlionrotln.I:IIJtg. 

Odotllr3l14 rancio>ney 9.5 :=!!':..":"...:.. . ....;.6ckeli'q 

- O:i<i>o<lD14 TodlloeOoilliii\Cil 9.5.1 

----- I -

__ ....... -IOol>bt-ID 'll.ns,be--

~lloodi';fc<tord ...... IO--ICOP* --'lillo,.n..,_Toe, 

Table ofContents[TOC \O "1·3" \h \Z \U] 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000138 
235 


10417191.eps

1. General Information 

1.1 Purpose 

11K""IUI-"'"'**"'fcrhlrdir1!Secuiylr<ijft{SI)floi"'*Y-- lhiMilbliy,HeglyllldcortdorOoll)>oiE4Jax 

d!lallld- Tl'oJ>OIIIO'OofM- ~poli<yisiD: 

• ll:>cunen.-•n--otioom.,.--hoRIIrG.,....... -~om-wltin 

lhl E<Jiax GloboiSecuiy ...... ~ .. boot- • Fdlotocoopor..,llldWonnolioroo~amotvoiEqoifarpettOI'I'IOI*"' ._-tcrdefodioQ.~.doclnvllld 

r~IOCUI}'-

Canply..th E<;UiaX S«uuly l'<llq, ,_ onj Slate IN, Pajmo<l Conj i'dl.olry ~ reqtltftnem, and -lro:tllt- on! Teclmlogy (NISl)glidroo. 

1.2 Mission Slalement 

Tl'oj)Up(IOO dlhl[qt.ifalcGioboiSeculyilcop!Oildo _., oeo.dyiOI!Iod-~. aeoloaglobal ~oloeo.dy 

Mtt~Oithe-lir>e~~·-"""· ·-·dGiobais-i!y- bhlobeen.-.od "'* pcoo:M.,..,....to,.-the global £qliflx ~ mpor>~loolupecledn..miediOCUI}'...,_- to~ 

&Pa<~dMI>pordpotoloh- """""""'trd--ordbMip<l<lioo~IO&Pa• 

""'*"""' 

Tl'o~ollhlh:fdeRRecprx'08-niD: 

&<p-ecomccclioc1oMtooiCrilriolclala. ----cotlldy. lilim--ifl>od-lhl&pfili'ITN-. 

• Li¥ illll>eliilt Wdderii1'4)ICI .. -. ard tuiltu Pl/1llii'S. 

_._lhollCi:!eROCQI!Od. 

-·-iniialedlhefrdde<t 

Enue .,;.orv pciOot ard-ml>llooedltld upd!Ud il"""'l> ~Utile< 1111ct 

1.3 Scope 

liK""""''I'PiesiOoi~~.-P<--~~ ~-...ondother ... ~lelor Wiol<I!*<Miltlddlio. Fa- ~PCiclolaEq<h ... ~ erQOIOihe$>0)medlnr'<k pe<lle< 

oespodiR tdderl - proooct.m 

Nl-E<;UiaX GloboiSecuiydocun .... , h:tl:illllle&!t.ifalc SecUiy lrd!erl Recprx'08 - ... 10 be-lltldlelled ..... IMIIIylo....,.mmasonio-ondolreiMrl ~neciJ:ai>jcnh-. h:fdeRR--Iilsa<Otobt 

-ond~~ ......... --......ctmrl.. Tl'o£q~Secuiy- RHpOI't;t-ilcl<le<-l:r~ Secuiy- ~£qUia hll!$ideobe1Men E<;>J'.n-Oper3lloos~-~~llxm~ ~andE....,IliSastetl!ea>Ye~C<irli'tty~(llres.IO"f 

..... ~ ~.luriono anll>!-.ocdclem.O<.~ 

&.xlllrddorard.dtlcosoldai>-lly olir\¢>noldo:aot'l'itmltUgoiy ~ot dorialda.olabllylltldvlol..,otlwnlwn 

lhoealol-ollheEqllfosSoo.dy Policy cc-.. -..;ty~ 

~dSecuiylncidorlseteasDinlat<IISoMo« 

M-oordsspocillyCI1ft>d,-aiOaWik>-.Ciulrqlll>c:raol\ 

Nl-clrtdotln!l1dsol"'--lood-10otrel•"""'' TCPACMP~,.pc<OIMII>Ihl 

----- CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000139 
236 


10417192.eps

M*louseock 

A...,.,.-openlleslweolo~i'11ect-l'&nhd"""'*""''Oilinan ~ 

N>-or~Wibsnllorloodccodoonas~•-~ -· 

M_-._...,""'*vfnxnan-..'Mdorlllala-.W.is--lopidlyYiae-majJ~itle 

-Tht.W.-~~~~11wls.,._ fn trM/~h~s-88MdonP<Mu 

-fncldoo1s, h---INih-WI.owli'11ectSCO)tofb--hr.ll ---

1.1\Mhodl:od-.s: 

M-IIJlSanexploiiiOOIIogailooceosloalfiM(s~llo. 

~dlcaro~adm ....... .lewl.._.loa$)01011ardho -l!ie'li;iimtlollhe~oflie 

tnat-ln.tbo-lolhel""lh «gaAZa6ondoe<,...payadetigroledM1ci""'"'V. 

N>Womol_..-.oiy_«ob<s"'""'*dola. 

M--mai:iouoly10pon&falo6c!ala. ""--~--­

• ._w.~~sq: 

A...,..,..;deollogalocPoool-elo-lim9lpeer~fieshali'q-. 

M~-CO!pO!aledllafor.,.._Qiit A--... --~~voug~-. 

Datll.o<s:Auoertlfrit<xmali:iouoly"""l"IO-onclrillcflloo.iJilooflheEqtlfw -~~~~~~ ........ 

1.4 OrvanizationaiStrucwre 

tqoi'>xGioboiSocu'lywllnsll\loanlmmal-.clsec..rtylnc~entR"!''"'"T iii (SIRT),_ lllln>Odol_a_ SIRT comlyb:atell.hlhosU~for sll f<iderl~nlylio. ard ._.... Tht Eq.l'«xSeMiy Incident R"ponse Tea., E-SIRl) -~IOihealtfSocu'lyard~OIIcor(CSCO). Hpennw<tE SiiiT '"""""""loca<!d-lhoGobal 

Socu'lyloam. 

n;, rode! pnM!eo. c:em'lzod-u. .... colecl i-loJml6on""".""' _, dCorlOiluerl- ard qUcldy .,._ ard 

-tl....,lheonoqrilo Tht E·SIRT._-.Iolo_.d_ocMyorohrRI!ott...,.... - ..... ~,;,­

ard'I'Jne1obity....,....,lerdOCII«<iieilletli'QO<.....,;nglie-..i)'dh"*'1>rioe.ordflo'rt poadiloroloin~~ 

secu~y--ardlliini'Gihwfo<lh~ r 'I'P'OIIrialoaoto~-

ThtSIRTI-ooU.uhdylol!'lllfleac!MyardU «-.uhdy loleopordlo irQdert OCIMy., l oocm No~ action con 

bo-«--11-e ORIRM!ofhE·SIRT-Irdt.WO'_,..;Ie.g. VPdC)'berllmiCtnleror ClioiSocu'ly ard Complance Ollar). 

Tht...., also to&lhe lllhcfly to rilrot """"Y and ml'golicn lhiOgies ollh !he II'P'M! ard -d ,_ mar_..,-t. aw.iorolard 

ll>cllorollri-attrdifocfcl"''aclioniObt ln tholrattasanrla<tirM>Mdhlllo~- ·-nn""' .. 

~· -Thtl .... tooihedatyl>roleose~-ard-docunetts_ ~betlj~tl~Cticeo.- ard ____ seculyll?dlloo, 

Tht_.., .. .,.,__for~ardniyqsiiPS«ohr~ logs. Thtorvarialionv.lollwlheE-SIRT.t>iliiWir>lilesinhparorto<ganZalfonl> eroet--or.tle!hotlheywl-.rd-lobo 

corriodOI.Ibyihelxalsystom. MCUiy.ard--ilooel>dilioion. 

1.5 Repor1ilg a Suspeded lnddent 

~seculyh:ir!Mswlbtrepcnedlolho~ilvNICttt;or CTC)byJlhll'i"li+1678-1!5-7106«1-88SS-81119ortnllllil)) 

H\'PEll!JN(...,. .....ty.i>ddort~'lll 

-wlbtirclujodinihel'oclrlonRospotoo-baoodon_lo....,~ardwl bo~ll- nhRespcne_, M.nJol Two <iolird-oil flrdlon61i-q lhel'oclrlon Respcne-onet-. ard cne mngeriil Tht 

-~- .. """'_.'"'"'"'-on-tolil<oactionard.,..;cto....,.,.,-cn r<g~ArCONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000140 
237 


10417193.eps

1.6 Sel\ices Plovided 

ThoCTCis._-fcr~~ardaJ<T<iali"gdala maiEqullaxii!CUiyllllll'iO:rirv- Urde!h~ 

IIIOd!l.lh!Cybe<Threo1C.rl""iiiiOI'el!lllseadyrr.ori~ocrv~lll(letlheCTC.~IIIeloil>oi'G-

-~of---pcs.Npp:oprialt ... go.donlal<;j-ardft ........ ard- mty. 

OioriJ<Iionofii!CUiyoclliooriet. 

tertlill:odr~ 

- ·-ardl'andfrv. 

Ptrfr>rmill"**''liiy-

• PtoWit 1.&11 ar.<at1tlKS ard IJii'to. 

C<arlni&lod<tspoq~elt"'a...,•'"v'e~~~nelQert _.........,.lottt.ogl:lba!Eq.ilax 

ertorpioe. 

1.7 Roles and Respoosibilities 

Cc!elncident Response Team Members 

ser:urtty Prog~arn .,_, (CSCO)o 

o ltashlautajyooal-.reliUiglolhe~loamajlr II!CUiylo:lderL 

0 Rocprnibltlotn:OI\i'lllljlptOjlrilltpol1iocof11Mariy-llotcoUd- hlocuod_Gf_ 

-ard""""rogUall¢aleotooerlcnlhe SMdyoftt.oltml. 

. ......... lhertleuodioadori<1illedo Sermeslt.ocorr.odpoirtwil>lheO>II""""""'"depnnort 

o EnamllliiSJ1Um--~intt.oH!I>~MII!CUiy hilorimase.......,..._.., lf9'RIIO-dlhe~dlr*m>r:ionardii'IINcon:uroralnlhefnlldamagtf11l0d. 

• lr1ddft RHpcrut TMIIIII-II'I'C)btt T11111t CtntK, VI' Globll Co!po<llt Securtty& s.nt)j: 

o -1 SIRT wlhlhorwceswt ldlurd~ loqLiclljretpcndlo0 ~inoodenli'rordklglll8I'Og«1llrr(;joiEfXdedind-.rlyil:iderV>ih ...,.;gtCO!lt.ciyio ....... hlol leporl>.-d._..,.are~_.. poooomo~ ... iM>hod.~~n-.-dprcp< 

-... -,.-~~~~- 0 ~lotn<ri'l!ioadori~il"""""""'*bj; 

~llloiR>ioftrespotMpoooomolara"*"'--ard trdorsOO!IhW~ lhe~• 

io::ideft~-

.lcriocl'g. ~ II>P<VIi'Qend enori'Qtinelyil;ideridoolft. 

~~lnd~tt..,..,ladicllprooodl.m b ~lnd,_-.jil!loi'dciWio 

1-arOirf!llU'Sl-.:til ~wlhlli<-. 

o Noll!I'Gti'e Soculy Plogram IA!Nger lrmettal!lf* c:or6malmti'rllaii!CUiy lnoil!ri ,.._ 

o Roq..-'"'"""' tor. hSecuiyF'Iopn.._loret .. n~cmise<l I'JSI~IO.,..-IIAriiA(.,...,. lhlt-- ~Nmainollnolnd-edfnnllll-lril"""""i& - · 

0 ~~-rtUn lo-~oti\24 lv.nolfooMI"''*t 

o ~lctnol~tbes.cuty~,.,.,...,-~al -.rlyil:iderVInd~r~ 

1¢iieobooedenlho~dll1ooi. 

o ln casood~dliios.refofllloweloltmon-b ·--..... .... ~ 

o -hlli'll,_.iomodl«<a-.-ardlflioralden bol'oloflbeCSCO. 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000141 
238 


10417194.eps

• s..... •lie Oepome~ Polito( Cottad (POC) foroolediru an! niyzlrv l'obmalion "'-

o MoiD"'codacl.thH-priesan!p.odo-..-..,.is no<dedlo.......,lhot-reqlilodlo 

.-a socuiyiwidortlll-

• ~.th---.logill'of coilod.ifdJ)IIMM-..-. 

o ~.th~lomol<ede<8coor~llle5e«riylrci!<tt Poooil:lodecioionsid<de:dU'*""'o( 

c,.um.~or.,.....-I<Hf «--... -. 

0 --ltpCfll«<al"""lroldtm"'SlA...,.._ 

o -oope.oflholileoti~cnsoa.Ryporkl:ls._...an!aleltsloh depol1menlleodenlo-lliei! 

!MiofiiOIIy.......-. 

o Tal<e< lho ~--roprcW!eadoq o: .. «uiyln,._ erM!Mr.M;....,ohU!Imal6 

~forlrol....uiono(alsocuiy-

• _IIOIIy __ _ 

o -lrroov.lodgto(Choiwidort_.plonan!....,.ll'll l lslobooclttm<II'IJ'i<lo.lqaniddorl. 

• ~bridge coils •-by ll'o lncidorl Rftponot r, .. Jo~ngor. 

o £roousoccuo(e"*"an!.-,...,.roconltdduirvlheinoilert 

o s..u.....q,...,...,all>ioltd~os-~ol>ylton:idrri Reopcne Toamloloroga . 

• £roouslholfrcllerjhordlrlgdnloloen ... ln ~.th~polde$ ..,potedlm~il<XIel(cbe 

ou. 

o MBIDiroaMt<lr<leflo<oar6...allollrgc<al""'"-ld-illldlhei! ~ 

o --lnlhi<Sj111111-.,llpidyim!MM!Nidin"''ftdlo nillgo!o«COIIOCt"'fidrilodiwidortard 

peofonn~-llii!Nil<XIel(;col:ialydoood;lleliolioro-blnol>diOh:iloti~

..... 

0 -~~----pcooiled~lo ...... syo1orochMbetnOdoqulloiJ~ ... seo.aly""*dpicriO,.,piooofllOI1IlOI operolio(lo.lnod6iion.I<'Aew ... lteCTCiher..ut.of&jlleol"""' 

o Coo!d'Nieo .th Olbotl1>ed OOC'tard S<RT'' .t.n ~ 

o - e-nportcnal open*lllyiloidenswill-<r>....uionc 

• Coordi'oloo.th---ereicoleaoolo~ -an!l'_..._pdo! eW:teooe. 

o -aoorooidaled"'''OIooalopeniOO<ilriynilorawlh-cn ~ 

0 --ltpCfiiO!Ialepennilora!*SlA~. 

o -"""'o( -WormolioocniiOIIy~.-an!oledsiOIN ctopoo1mort-IO-Ihei! !Mio(-'iy.......-. 

NO~:Thttr.esl\)alirQCTCWyv.sholbldiOII•toRCo«dnalc ni-ed;otor'CcnRolos' wibl~ll •-Jor 

SEV-3 0<~i'ddemooi)'. 

l.egiiS....,._ 

o '-~~~h-.... rei'*<!IOOI!CIIIyandpi"'J. 

o &o.uslhe&SRTcioeorlliW>lorle"'f .... olie~iw>derU. 

- S.Urdoll Sj>ecW!st: 

• llaiQ/rw ~m~~ec~ge ~-par1ner> i1Ml1Yadn "'fseMy lnci!ari 

. llaileo.th~---.. ,-,...,.lo!"'**lflllfart--

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000142 
239 


10417195.eps

llliNII-Spodalltl: 

o ElwtslhollfwE.siRTcfoosnot""*""plojtts.li!IUdlli'GIIItiMtligolioncl-. 

o Enolnslhola~clilclp[My-••usedlan~flloi.Ntobolfw""""dllltllcldort 

CompoltfF<>Msi<sE>:pt<t&wtslholllltMoligooioniopotfonned ina-....,..,.llli1!lhol.- isoolacoocl 

""'11ol9dp!OpOiiy. 

EFX C)l>ef Til lUI Cenltr. 

• s.r... .. tOngleP<ICfor~clpolrialotaduaiC)WSe<Wiy inciSom.2~""'•doJ . .....,da!>l"f-. 

• --~~ aupected secuiylr<ido!U f1om !he ""'*9-

• -glollol~dllan.,tlblloa'!fl*llllt*'"Ypc>~~~nd£q<ifax lf\.dziroglollolctGioilonily -lholn;gtt....,c~opnewt.n'liewod ~ 

0 J'loOelesteclri;ol-onl~in O<W>td-~ 

o lnocl-oihclepatr.lertCIO'uNcmlhol~l)<lamshMbeeo paiCiiedonl-boforaln<idorl 

dow1n3j)p(MIID..unto~~>e......nor -•"""""of_IP_ 

o -EfX~E.sJRT-.olh lq)OI1ioeht .. tnoblelfwm IO-t lhtioootn0CIIf1'lolt i!liWI!tPQI14oMln. 

o RMwsiPS~Id.lcirQIPS-"'!_ID.....,.INIII-.ynmeri¢1101te .... and_.._ ilhi?S-n lr-~toml ... n'""""-

• looisl> il lhepcpjeiicntcurerl~-oftlsecuiylr<ido!Uonlo RMwsaiHruoi:n.._arec:ol-..df""'-llom"""""'vl)ll-. 

o Aso9>s ,., EfX ITN lo eact.-. 

lnc:iden1 SpecifiC T earn Members 

SiSiemM-Itors: Gtlhei>andp«Mciocloto~O)StomOOilllg.nlionondwetrtyasrecpsle<JIIyllwE.siRT in tn 

~m ....... 

~ Sptciollsts:Gohnnp<Mdedlla"'l'cdro.-ic~oni""'llf"')iodS)lleol ~ .. requesl!d llylhe E.s!RTh anupedled ........ 

SiSion~ GallwrsardpO'oldodolar~lllt- syslnorlll'l<:ollonand.., modil'cca!lcnll1ooio.as 

r~ ll)'lheE-SIRT n onOIPedled ....... 

--ollltors: 

o Goelersonll"''"'edoiaregri~lhe-onl..,-.,illec1Co,"' ,...-byhE.s!RTi1111e>pedloci 

""""'· o Vrios-etorgoslwwboonrnldt101ht_.,;,.d~- lln.dllaor~ 

o Vriloo_,d..,bostspaci6<PI"'JWWI'hMboonn>edilod. 

• s~emo..ners: F-inl-expedilodservicodoliwly...,s~ ... Adnlr~stt~ton, COnmi-SptCUiists, 

System DMtopOlS & -Ad~-

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000143 
240 


10417196.eps

1. E-SIRT Activation and Initiation Process 

2.1 Ovel'liew 

Theiocidetl--tos-smeo. mm.~pr..-~poc-<ncctnnlyoio. Tht!Njotliooesotltotiocidetl 

--IIIO<IfnodlftliUMla<izedileloo. l isimpetllMIIIwlootl>olltot!losesio-ln a-lftlpr1Cill,.... ......... rapdlftllholoogh~ 

Em-.moyoocum¥1ri:u&_a_lleloo. O.:oltotE.stRTtoamm boonnodlloddapollliial-. 

"""""'"dbogohtodancliilill.,;y,lslftliwttl\lllonol OCCIIinmeclalolylo-arddeha.....tyollhtiuue. 11il 

- ioO<Ifnod lnlht OMtdlon. .....,lylio &-plwto bobw. 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000144 
241 


10417197.eps

Stcurlty lncldtnt Declaration & Classlflcalton Otcislon Flow 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000145 
242 


10417198.eps

2.2 Incident Response Management Bridge Procedure 

2.2.t Proeedure Summary 

Thio~""""'""'t.e...,olion,.,..,olbeiMwedturQE~Sec;Pylnc:i:lenll!.oponee(E·SIRncor~e<onc:ecalo. 

TheCTC~wilmoiion~forld>ed"~on:l~t.e ~collolllletpp<opioton,.., .. delned ilt.e Eql.ftx Seourly lnc:ldtnt Rtoponoe Moruol (excetpt below} 

SEV4 lllnlo<Nioolll 

Cool""' lnoileot 

Upd .. 

Mee&1gs 

Oelolnc:i:lenl 

=.,. 

2.2.2 Pra<Mlre Delais 

tlollnlnTo1 Free·1-

Weeldy 

IIJA 

Tot 1·71!).387-6697 

Pao1itipat<"-"''o Redactlld ! 

Mt<Ciog Mocltrllor R..,..slblllles: 

Severity Determination 

SEV3 SEVZ 

IIWomloal ltScmtl 

OOiyonl EWI)41ws 

-· uiil 

Wotllyclolil'fl cortai»d. 

- EWI)-

lwsto daydlli'IJ 

-· -l'olnlo ,.._ dost. 

Weeldyo.nil 

resci'led. 

AnE.SIRT l.l._.tlllOdorlllelle«riere,...eoll. 

1. CorWcland cloMleot roll call 

SEVt 

It~ 

EWI)21ws 

.... 

ClOI'IIIIned. 

Dalydtm) 

-....... ,. 

-

Dolytrd · 

r.-. 

2. Remird llporrj:ipon(s Ill oonldriollyndice and lhellhe ir4ormatlon en toe col is not lobe shored will anyone ...aide of 

lhe<d. Violalio<'ooflhopo6cy<IO<Adr..utild""'*"rrodion.incid~r.rmillllon. IJreq-lorinlom>olion ~lollith:ido~~bt lnC!edto andapp<O'IOdby,llitModefl!orfc<releote.lloir4ormallon~bt 

-wihlltrfcollorrlen/p...,.,.or...Ooa.,.pas~ bythePIIJii<:RelallonaSpecia!ot 

3.""'-idtcureotlllllUSofllltoUiion. 

4. lloM!eti.II1Signand '4'dal .. dloftittmsard l!ad<01. 

s.-..--

8. DeiWr~""'matyloMandatoryPallic:i>ads~lhemetliog. 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000146 
243 


10417199.eps

P..ucipont Rtspooslblltles: 

t. -linolyupdat .. on oawa as equet~M by ere Mng .... 

2. PIMtglidlnct, ldW:eanddocioioncrelllodto...,.onopeciicll .. ol-. 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000147 
244 


10417200.eps

3. Incident Handling Guidelines 

3.1 OveMew 

- · rm.a~~co~ec~m~ogytm-amc.m!erlfal 0aoa ... """""......,.to ~adMJ .. ~by niiTIOiw--.....,_I_R_... R)IIaro<frG is anmpalaliondrtq<ired-der,.;lalr•DIIII.ooc-

"'""""Soculy,.led -eon"'tit-innewOI!Opilyc:N~IT The-tcm.-nonoeculy-art lho<tl!lll 

lrMiho!q,ondto-'111- -••m~oo-tlllr<idtrll. ,......ilcl<ltrt..........,oaaillcol-da 

IMIIftiviclert_...ntaplbilly. 

PtM<iiM poceclue$ ouch .. ..., edutolion. pol<l> ~ fmoollo. iWiion ,_nion ..,._ riolcend~ 

.......,..,.ard,..;ga~~co""'.--.NocaJiviclerU""'"' _.,.s.Aielli>ltnadap131ieilcide,._capdyoa '*"""YP'•d"""'!'rG~ oeculylinalsasdamagoloiT$)118llstomaoecu'lyivicleAeanoccurinasloo<lpori>d. 

3.2 Goals & Priorilfes 

Thtgoolodltolncldtrc~-" •-· Tr.p'ocitioo$ho<.lill>e-mdlyao .-triooo-JFdedbylto 

Secuiyl'logromMonogoror -~ r...., ,..,__ 

· Slop--dCor6do:Cillirlonnallco; 

llnl-lleld!rlhpa:l-toEqtii»<IT~ 

•llnlil\-ileld!rlill!*flo""'"'*'and_.,..._ 

·-01--cotlh.ty, ·--.:.: 

• Oo!Mninehowltoileld!riGCIIUI"Od; 

•llolomine-ftioledltoiocidert;ond 

Eiwt~polcMond-ds ort- nd~in oolorO>pr.....C f1.r1htc lll!ocl. 

3.3 Incident Definition and Declaration 

Pn- olto actaf>lolalirv anel<j)i::l 01 ~"""' pcky. The.,.. d adMy tot nwldeiJ *"'Jized .. ~ oeculy ln:lclerosart-COI'9'11:ed ... I:Uattnctfllllod10. -pCs (litwlailedOis.-.toi)IOgain--IOt'l"f**O< 

EfXd!la.-~« derialdoef\b.ltolllltlhori!edU$1dtlj'l!emlotlto~<J<$1CAg6ddaia.O<chorQ«Io ----.. ---11-o-·~ ............. ond _.w. Thtlolold_.,....dan.-rtlt<$tohrtlalilot~il'oson"'C<plzallco. Thtl)llt$ dirjlocli-loolddili;lto loooorlhold~IT-..-Oicor6der<eil)enEfX_".......,,...byhgennip.licOI..-.n;<la 

ligi>IMiddirnogeltolmUIIbe conecr.edprio<l>s,.,..,resiWIIinlto e.pax C)ber Tlnal C.,W,oecu'ly ivicleAs shal becledaled r.. h'*'"'v .....,.... 

~droor-ilorirQS)'IIomoeporllltolol'cwol!rodq---ilhtogo; 

llcd<:oiMbyan-ertttdanEl'XIPOI...--~Itoca>.acr,;ab d-<1qt.o!<liorela 

act.ly; 

-~or""'*'*melhol-~-"~ltolan EfXIPedmo(s ~hlalgel 

Cl~d-adMy, 

• Comp1li1s by an lntlrol Serob-OSP) ltoldlllloptdlc, prolibled- by an EFXhool. I' -01- tcldms; 

FloodtdW...,-ondTrojanlioneol>rwtil>ri<1111i:io<acodolarll-Wia-elonctMioblt.ln -"*' """'hallactt-rd"'tit~io-lllo1icol.oro EFXivicleArombe<Wtbeasoigrodl>rltorief"CCO'( 

Comp1li1s ~cno!lle p:lllic." Olhol ~tot idulotpcilic .,..,pies orreleron:a di-eppopialeor ilegol1.00 by 

EFX""""'""'CIXIj)aatOIS,_or_ ~EFXIT: end 

Aotl.-.,byanEFXoogorilallcolhll""*lht-dM>Incidtrc t..ma - .txkY-.. --.etc) 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000148 
245 


10417201.eps

3.4 lllcidenl CJassmcalion 

Secu11y-.a<e_led_llleyeresetiun-m>jolrnrom.~ard -.nwlbe!loo«<"'an i!Uimt.........nofh-h:bl~: Mlberd- ~.-t<niiOCtb.oioeoe,.._imiiOCt...-.ilwtr<>4 

-...,.,, _.,~ anc!lllepolrilltor-IOEFX(e.~--·- """""'IMI."Eqtl!uimagt 

i<rc>ado), 0\.bdbebr .. aiecio tor.-tylrdcleRs (See) REF Rel3911~1h) lo< ldllionel ;tlda!<el: 

SEV·1(CRm;AI.)i>cidnuo_,.lhlti>I<McompoooistdEq,Ux~ardolo, clln~lldipltljiiiJm<C<dolo 

-"' pooe .,..,_,,..,.laoiltieo .. emplojoeL n--· btlordedimmedio1ely adO!*lie ... tll'd ooed-1-- E>amllleaofCRinCAI.Ir<iderls~ l\earti1j~REi'<illorl; 

_pooiv.....,.llreollofacilr«~ 

~~towdf.qt.faxC<:rildet<ialdatatoan"'OINI '*"""""""""""""*•~"' 

-·~-rir. PNclirg-agamEq.lax; _ .... ___ br __ r.r_ 

--1DdataotqotlniS,_r.r_; ~ofEqoi!ardomft; 

Crimod"""9'M<

~loosor""""""oferiiolldoll: _ ... _, .-__ .. ~~ 

EFX--"'"'~ 

s-hllloSab:lebr £FX.,.,.CI011antEFXs- lkOOtaizodu<eda~•yoteonb~CI~~nco>IDar pcdiiledclaloar~and 

krt-of~local. .... ~-.. -law. 

SEV.Z(SMRf)IMI &a.rlylncl!erls.,.polrialr....._....airM>I><edacrli;ol 8SMI olh mocl!nttdmgtan!!~Qij be 

--o;c(81~wtallotlhtM<tOOCIIICI rDiificoliondhiYII'IiomolotolhtEFX<loi>IICjborTimiC..or. llio 'IQJidi>ctlde ~e-1Dcatdenilldalabyan~u- -"--lhid party. l\earti1jWARNINGincillorl; 

CoiYOdiooof.....,l'alled.....,s 

Chorqoo1D$yol!onhor6. .... -otao:esodoWe1D<:<tfljYJ<ff"""""'{s) .......... "" .......... ; ~ 

,_.,ompioyM_,.,~IIIool*to.....,.,Cort>drialdo!a <X.IIidoofhE<PfaJ<-inan 

tNffCOWd m..w; 

-dAtlnpll ,._ -~-""""'"'""""" Eq.ilax &ally C<mlo; 

lotsused<:<tfljYJ<ffPf'll"'Y Iar:llie<otMI'Iioesinclufrg~pt!>M'I«""'*Io~-1DorUS6of 

EFXIT-in....,.dore'n<.Gl:riy. S<d>ao_l<li'G_.~ ;, .,...._cfol.nco>ID 

..,., ardintJrc"'"""'iro-ad 

llioc:oloryofliii<INI-becoroCRillCAL. 

SEV-3fNARHING)IMISec:uity-irMMdror><dical-ardilt<ian>IOL They !~Qij!Jehltdloclwtil241wsmr 

lht"""'"""'"rdJocalicndhM<iiomadeto bEFXGiobaiOjberllmiC..et. 

• l\earti1j ltt'ORIAAllOHAI. incillorl; 

• ~ollo'liololoo£tPa>cOola~poicyfRo.9>DI.P --dlowvoUnlsddlia 

• --.o IPS"""'IIlildohdoiyMmt<imor-sysiM>-"""'pt; 

-"'·~ ... datyltem bproeeWq 01SIIlliro £FXdola( 

~ 

~ 

... Cishori'GoiU'OIAhor!Ztdsollwort; CCillp<ier ww..m,, (deperdrq"' in'4"'' todepoilmert and lh ;,-.ish ,.....of • .-tr poicy 

-.: 

-or~"'*"'>b>ilyloolaled ...... dr1oi<J; ard 

llioc:oloryoltill<tot-btcomasevERE 

SEV~ (WFOAMA!lOtW.) IeYeiSec:uity_,.,..lheleaol.....,.ardOh><ldbe ~-m(2)l10110r'Q da;<anerh 

twtoxus.Wcrmall:n>llr<iderlsh:ble. 

lociOilJ>IOYMo--(laptop.IDciberly) -empiojeel>::idert {e. ~-aedl·) 

-..PSOli>cldarls(o.g . .._) 

S<.opecled~oiEFXIhl-oiCcrnpir1y_.;y,_oncl_ 

~~6noool&e~Of!OI) erd 

~ww..rms(~0<1impadtoCool*1)1~k 

SPNot and 

• llioc:olory<Jiriokllwloo<JdbeoomeWAANING 

Otllorl)fOSofhdd!marecattgOrbd .. .a..,..soculy.-.nsnaltotbod- soculylnd<lor<s....,. ,_k ·-

"""""""'"d""'"~·-kl EFXdataor~eecalalbltoaiOCUiiylncderi. 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000149 
246 


10417202.eps

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000150 
247 


10417203.eps

4.1ncident Response Phases 

4.1 CM!Niew 

--~~lli<*IY"""'"""*-IIIion-rdod!~oninOdo<t_...~ .. lhlth~il 

'""'r10Mj)CI'dlo-..,tu...,_.avld!!m bytnllli'glhlt..,....,~-.w""*"""'artSIJidt<oly_,.. Sl.dl 

--...... mlfll'ims,lnclufr;bl.lnollmledloh~ 

CdledlonoiCUUC< -for Col> and- Speci!elrddelt Rospor<o TNIII --~ - · """"'· hoOie, ek: . ....... Cdledlon oi<Of'la<l-for 1linl Palty lnciderl Recloo&e Tm> ,....;dm; 

Nb<ionolidtodrtJ>011ir9--; 

ElalcUi>nolrh!Sea.dy~-lor Eqlilax-S)Stms; 

Cdledlon...., up bepol Mdelt ni)oll-atdtollwn; 

llocurortiiOonoiMdeltorolysis-"""'•portio<J.""""'dioglwnt,e<cc); 

--p!OCOMII-.slor"'P'ndiiilolw .... Rid«<cogorios;atd 

Tes&wolh Eq\.lfaxSea.dykrcl:lelt Rloporoe4.2 Detection and Analysis 

4.3 Containment Eradication and Recovert 

Tllsl'hasoollrDde!<Rlopcn;o"!ia,.h~dChlllllCnlOii. Tllsp....ei&..ur.dwiEnan rdol!rlt..boond!!ldecfandan!lyted. 

...., • Sealiy --"'· 

~~~::.k~"t:.,':':,~:;:;..~=~-::-

- ··-~ E<jlilaxpilr&shrltbMI ... -iiStdionl1 

4.4 Pos!-lncidentActMty 

Conduolrqa-.leomodpootmorlem~aol:t.,.rqh~qi.OOiicq.atditff/otel lhltneioaaii:ol~ollleR>opcn;opooeoo. Su:h .,..q, alowE.siRT -lo -lllalmim~ inal I' ...... I_, Rlopcn;o~ 

O.....:ioroad>IShbobrtliclldtoaddt.....t 

.. Exaoty ... ._.. ........... -1 b. How""did1tal!atd"""'9'111"1J*fcmlilc~Nli'Gwl!lrhtlrDde!<?w.ttlht -~-WI!<O 

hy adoqultt? 

~ llhltrmn«ionwao"""""l<lOOII'l 

4. Wtltitff/"'PCOiac:IIOn&laktnllllrift--hrt<J>IOI'(I 

e. 1\tot-lhedatd~doclfr<lritllero>tinea..,..Mdelt """'? 

I llhltCOIT«<iYt-"'"p<Mit.miatfnOc!orltilhi.Nt? 

g. \ll•uddlicnoltoclt«r-mr.ededlocfeloci.I<Wya.andmiligooefw1 incidoroo? 

~.a"*"""r>rtport"""*'lio-odbli'e~and--.lodMft{o)as --

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG-SBC000000151 
248 


10417204.eps

lt!r.i!!!t R!spo:>sf Alpg!m!ri 

1. l'!tpirtaltj)OrtlcrEquQxe-.M~toid.Oo: 

a.Eolb\llt~~ 

b-Mrx>lillloncl;ri'glhon;;dort(tlllleclricololtial): 

•· Fcllowoo-noed!dloelinhile<rniligatelho-lly; 

d.M:ietor~lhalreq<ire~ard 

a.EMIIi<MIIOnirinizolililies«...,._,.. 

2. l'!ooifelwchlonologitellil!onlonyO)Oieolouclllogoreq.IOIIodl>jlhoEJ<iordodT-. 

3.0oc:unerlioooxlolomldonltntRlttl'elncilortR_Pton_,6trl/, 

EotllldtdTNm 

LogolordF'"""""""wihhlocol~ao~in lho-lhalti'ei>cideo1;ordHR 

11111 Corp. Se<uiy""" will Eq.ifix ,.._...;IOdotonnN <io:ih<Y odloo ntho..,. fol li'e 

Ri:leri .. fltlm in iienW tcUte 

4.5 Incident Report Ha~ Gu!delnes 

Ti'e s..u.iy I,_ Retpotoe TeMI (E.s!Rl) M ......, h oorvcled - d II 

""""""' pertamg to a OEWiy irDdOii. To IHo Ofld, lho fol:>oYig gUdolnes - be ill- """'"eolilitt.IACidetiR<potl(tR)priltto-ard-~llltres>ott 

I. labetlliet'I'Otlas'Cclt:lenlial:r*tott.GiobeiWctmolions.ariyl'oieyfot...,.lnbmllicnonloodtill 

'toltderOor dilL -··-'I'Od~~. 

z. Thc~diiGIIi!lcllhol.ldbedajlllyodonlltfi111pagcG!GleiR(~.,.. 

poge - ): 

'Stcudly~ Acco!stoll!odolaisri/li$-is~tobtptrMdedllllh 

a.li>otinliot>rilhoC/ie/Soculy& ~OifltM(CSCOjlo!lo!t!qlholleediO 

Knotrs-.lyA;q,./. Tm-<l>«<ldtlCibe~""""'­

permlssioorilhoCSCO. FliNolollQilj!/yoM!IIois~moy--. 

~-i~>IO*ldint~Atlg-' 

3. n..fottoMtq .... -be--lhltlldoclmet(.pmenlllywlilllohoad« fer--· bRI)Ulllq0<7oblnte11143F£dRII'r\lwl 

Tolidehl<ol.c!o~tocclluofllleforlto-. AIIAe-lhlllU'I(>Il(ca6onis"'to 

--~lliulri"'!niafoo oa!Mtli'oVPC)WThmtC.rtM. 

4. When!kltedelecln>:icOtf,lllehilortR<potl!llo<Jdbt~wlh·-~ 

llldtodd~ lloforlotheGiobeltrlotm!lions..u.iyPoioy.--7.13Eraypti:n 

R"'*emertslol11111t- Tho~lcr"''"""'""l'lidlle!llo<Jdod)lle 

~-thelncidertRet901'00TeomMngetonlthehi:ledRet901'00 

Teom Ctotdnoiol. /vJfohtl""""'"i-lllUIIbe-l>jtflehillrt R-Team~. 

5. CSCO~rlthe-iolnulbeplodpriltto6. To--~thetopo:~.od)cist!biea.....,dthelRihltlas-"'*<1 

., aPOf. Tt..POf....,aroobe""l'lidilbwlhllle~-

7. When~IIIOIRV.lcb,_..ChdeMry<¢ft10ptei'O<t~dhemol 

l>!~lllelcoloolrlg: 

.. s.l!ctNewlolemo>llet.ety()pllono(ard 

b.s.l!ctllle-Coll!i'Gched~Joo<hnOK 

fniom11Uit<J<jy PogeiPAGE ~MERGEFOOMAT ) 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000152 
249 


10417205.eps

5. Computer Incident Handling Checklists 

5.1 lnftialllltidenl HandHng 

The-inToble3pr""*h•il<!lolobepelfolmodinltleintiolhlndlil!d"'ime<t. Thellems-<riyltle- nanalj!lsdM~o&rlhllhasbeen<><>ql!led.h:id«t -shoUd ... -.tota:egta!Odii:W>:dapaolit*l)pe 

dime<t.Sooictt.52ev..q,5.7 ..... hlrdt!l-toroo:lldll'o ... h:id«teooegori!o.Agerorl:ddilli&p«Mccedin 

Totlo3torhlndlil!incidons1Ntdo""ilioio..,dlhecotogorioo. 

NolllhlilheacluiiC..,.piltor!rodlllly'Nfbnodonbl)l>ldmitltboivlwdoclnlht """'dinchlbi-.For """1P1e.~lllt--exoelly""""-'-'"<~boood<~~ anol)oiodi>dicalin(Toble3,~1.1~1toefemoybenonoedlo 

portormSiopoi20<I.31oUtor -lheadi>tf, Theclled<lolspoW!ogoidorcolO-"onlhe...;,r&~eplhoishoUdbe 

porfomled;toyclo""-""exaaeequencedaopoltolmlll~be-. 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000153 
250 


10417206.eps

52 Denial of SeMc:e or Distribu1ed Denial of Sel'lice (OoS or ODos) 

A-dteM:e(!loS)~.,adionlhll_.,.«lmpaish-""d-q11em•or ~br~ 

""""""""'"c:ero.I~..U(CPU).- bontl>lil:t\and .w.._. ~dOoS!IIadcsirdt.do: 

IJsitllalr.olablt"'""""bencloiclltlbr~"""""'~-d-

~..-TCPAP ""*""loa .. MrroiNlb~S)'ltA!nl .. aaoh 

Sendillliogal teq ...... ID., il!llbtiM lo etath l 

thli1lmlt'f--teq~M$10illallht-Sp"""""""""'*'U\' -(I.D.<~lhtl~ 

11»-l>""l''looeilltPlY) 

Ccns&.nlrllal.-di!l<-brcree&Qmry~llo&. 

Theriledchti>Toble5pr<Mdesh-!tepololleperfoonedinhtrcli1la0oSi<icleri.Holohl the.,.._...da~ops""1 

""'J-MdJeNlndirdWI.olh:id!m,and"'llitotno:.gios """"'brlht~lxh>lfrGOo$-lflalattfn 

progtss. 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000154 
251 


10417207.eps

5.3 Malicious Code Incident Hand!l1g 

Melciu<Ccfe,.....loai"'I""'ITalilo:>«<lyl'oetlednoiW'dterp«>gramoihlhei1erCiodeSioy dato.""""*'-ori1MNe P'01'1M.«--ilobiOCtriy«irO!gliydllt W:lln'sda!a.Gon!dly.mali:iou&<Ccfeisclosignedlopetboa-

-l.nOicr<oihlttlhe ')CIOM's....,~Malitlool-mc~<seanbe<lladnot.~C318garioe ......., T"*"'"""" 

-.noollitGOI!6.wThe- Table61""i*te"'*'~~opslobopetfoftnedinhan:ltc!•llllici:lus<Ccfeir<ida<t. lliod>o:idisliso~d 

Tolllol lrillollnddort~O'I!dlisi.N«eltelb""' _d...,.mayvwybasedonhrlilndin<WO.olino:i:lert<WII 

tolhlegie<cl>ooenbylhecrgri.Jiionlo<~-

l'liooU!atohardi!Qdb iDclerC balodon"""-ln'j>ael 

1.1 I"'f1irtTolli:llrt""'"'llM--ordforecastwtieh'"""",.bo12 Et<inotolheomnlroclpc4onililtclricoltllocldlho1.3 Firdlhe~cet($)nltlel'l'o<'IZ--.basedonltle--arvl-

-lhtlneilo<tli>lht i1tnol . .,. .... Corilittoiv:idoft Co~Uinr!od.~ --- 3.1 lderelyitecledi)OI .... 

32 ~!,..-biwyhasrdalroadyboM-.d,lll""flfli>teOO\Orllwough 

3.3 -"""""""''mite- 3.4 lfqjale_lhll..,.hJICiltdbflhe--- 35 11-.blxlll'e--forh-- -lhe- ~I -~"*>o,clelelo.wrep~ootWtoledllet 

•. 2 llliQMtlheexplojed-forolh«lalsw'tlt>lheor~ ,_mlhei'Odert 5.1 Colm\ II'OIIheoiJeC!o<loy;lomoorOI\rdiorW'vi'«<M'II 5.2 w,...,.,..,... ~-.."""*"'>'loloc*tor~Wn-.taaricy. 

,.._141.tt 

Hollo_.. c-afolow<4>f110011 __ 

5.4 Unauthorized Access Incident Handling 

lvt---~oo:m'Oillna""'gm""""'lo"""""lhallhe....,..,rol HtrdediO-~­

isiJpicalygoi'od~lheecplolllioncl~oyo~emct IR*D>n.....__"'qioiiond.--n~" 

-~- mat-hlod_lllcugh ... "'*"'>'>ily, arv1 ... 11111 """lolllldclhrougholht< wlnerol>iliieo. -.oly~l'qw-d-.Elalmplosd....-.cl_,.i'<idrlisincl<lo: 

l'orfcmii'Garomcerool-ilodan...,.,_ 

lle"'"v•w.bGueGsi'll naar:l<iv~ 

~·-~aocilconl­

~--lncluii'GI'O)!Oil-wlll4dl:aiWoron-.whiRlntv a podcolorifier cnawodcalalicnlocapm"""""" ord ~ 

l.loi'Qopennisoicn-cnan.,..,.,.....FTP-to-~-.reorvi......CIIoo 

Oiolrvl1oan..-.edmodemWII~Irlomol,....,...,_. 

~ .... .-.ealilllhthetpde!fc.fe!d'Gihe-uive'•...,.~n ~eont~glht,.,.~ 

IJoi'OMt.Nii"'**,logged-il-wi!WpennisOcn. 

Pogo I PAGE O!EllGEfORMAT J 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000155 
252 


10417208.eps

The-i>T,..6P""*Itomajor"'potobtJ)Oifcm>odi>~onllliiAtlorizod- i<idorL Tlis-io• 

<OIIiullionofhiallrdderiHar<qCiledliolinfalielllolelhll h--of~••rvet'/beoedonhr<llnof 

ildllldlalh:i<ferisanlonflet1111egies<h><fnbyfle~lol0lftainl'clirdderts. 

5.5 Inappropriate Usage Incident 

Nl~towgeinddolt "'"'-auoerpalolm& odiorolholliolote~~ ... palk:Ot.lftwllou:h 

..,_o:oommtaewlyreloled.hordl'Qihnlowry.....,ID lonclro~ircidetts. ~ofWldetbtletm 

m~ liard~ h:l.dt '"'" wt.>: 

-~~looioorpor!Woptlf 

Ser4opomji<OI1lOIIi'IJt""'""""""" 

E .... homq_to_ 

Sol1.1>an-Wtllsllocncroofllltorgariz>icn's...._ 

U..ltornuio~""""'IO~rtor6Ritiu•pdedTiftlorsenoMNiociolsmh~lo--., 

Cedli>~I.IOgOWidetbtltmcn~IOhan:llebotauotlhoyllttJrgetedtlawidtpal5es,Of- li'llllllily"""*"'-'M>al-1hosti>:idn~ """"'islhllin--lht~iorda<UiyltoSO<ICt<l 

lht~ toO<Aoidei'OJtieshllhe.-,-lhem.Thttendiefltho<lclm<P*!YID~illt 

acot.lly.eoleetr.ider<e anldeO.....,IIIleacot.ily.,.;gnao.dflomlhe..-~-or ¥"'"'-~of~ ---·-portieo- ,..--~""""'.-.. p<lllicw.bol• 

""-'"""""""""itornsm.,...-llilllldon-"'"'~ 

Alhi<lf*!YW<illl'!*"-wii>Sf>OOitd"""' ..... _lhll_to~ tolht~ 

A1hi<ll*lfJ)Iffunir'Qa0oSigtinllln~b1~pocketswill'f)OOled """IPtdciosaslhllbelorg to lhe..-

Pogo I PAGE O!EllGEfORMAT J 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000156 
253 


10417209.eps

Tlo dleclislln Tallie 8 pNdes Ito-.epa lobe p!fbmed in""""'"' 311 ~ uuge h:ifert llis-io a a>r6uJicnofttolrUih:idert~CI>edci!t in Table lNotob>l tto_..,.of*!"rM1VIrfbaoodonltordueof inMkJalinaderU. 

Pogo I PAGE O!EllGEfORMAT I 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000157 
254 


10417210.eps

6. Data Investigation Procedures 

6.1 lnvestiga1ions Notification Procedures 

1 l'llo!tocloa.osqjlte~wih..,...«OikirvqO!l!liro~!Oan ~lteillowirg"'"'"'""...al 

IIUibe .... lolte~ 

To Morr~ F""'- Equtax$eoldy 

S<llject lmpa1ar< Ccrido:tall;f -

lliskloW<>li\)'OIIIhacl""'boc:crtodi'g)'OIItoglld'IJ¥1~~ Seo.tlyk~ Yooacet"oteby""'-dlhal 

..,........,.,_toL'>sc:ol, .,...,.,.....,.onclio<:uooedonlte..aio<ridrial YounpOOI>Iedm """'*"t!W 

..-ollh.,.,..ln"'f""""'"'""""'-. aycu ... - ~~y_,.,.....,;tea!Eq<lfa<s..uty_.rrg!Hsisu )I>U 

.. rottodocuool .... lho!n,ard)'OIImustCCI'lac:l""'imedlolely. Vola!i:ns Git!Wpolcyootld..Uin cb:ophty adloo, icW5'Q 

-

2. SEI""alloaH!)hi'Ji:dyanlt ct•e<t...al-""uslrg~tloollly~Optio'", pe«llissions,OCldoelo<I'OONOT 

FOif>NII.rY', >ilo 101o<t R<quti< > d!IMty O!lll llt>d RK\oipt 

l Co!Ntllll""""rtoti>twnal,""""m'Pimalcloli,and""asapwtollho ~-

• --Clillldelqs: 

t llhn a:hodting........,..,."9onnlv• ""f'dod ~ ew.t 111e 1o1oo0rg o1o11 i'dude nllle bodJ dlh>colo'dar 

-

YouhM-iwlodtop8l'iclpottcnacoll•podalan-.w--,d .ticll nll'oleact~. Youa<thooi>y I'Allifiedhlllfl.........,'*odiolhi<IIL•'Mil,.lrlonNOcn-onlhecall•~ y,.,.,epoohtilod m 

C1ioMqllillllllltr'Oillii'IJO!'On•-"YIIltn""""'. I)'OU"' ""'adodl'fii'IJO!'Ooc.llidtCJ!EqulaXStcuiy~t!W 

...,.,ycu .. rdto dilcuoa~olhther.l,andyoui!Uicoriodmein~~CJ!IIioiXllcyootld -lnlio<.i;liwt adlon.~...,..,.,., 

2. l'llo! lo b<gtrrg ltec:al. lilt illoMrg-,... bo read to lilt padi:ipacD; 

ThriJOUb~ent!Wcal. IIWJOdto""""'JOUhlwirrllnNiiiwltollld..,....,o_...,..,ycuarop!Oill>cod 

!un..._llio.,.I'Mwll\ll'ljO!'O. nycun-byll'ljO!'O-r:IEq.illx~llgtl<t!glhiicut.)'OUn rdlo _I..,,...,Otdycumr.otCCIDd •~ir..-y, 

l OootrneCthllhe __ ,.., .... ~ •• partr:llheif.ooljgaionroteo. 

6.2 Credit F~e Investigations Procedures 

I -ala IOCI.Ily ....rt k -1\lotCUII:lrner,..,...,...lawtnb<OrnOA;SOioo; a..tarM StMce; Soc:uiyNit~ 

2. -E\'OI.oiuh•li:I>Otd-I!POCJ!....rt 

.....,.,User 

c ~-~ P«eaandalmbon 

-OUIIO<lltr--dll> 

o ~-.....,pt-oPORT it!l'rralioMIIP 

• ~-lllllDlori!od 

• P$Ol 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000158 
255 


10417211.eps

3. ctti>-•'oilaillo~li'e Ali: 

-· -U...anclllcaOon 

o R-!.llfldioiyandconduOi'MKiigllicn 

• --flesllle- """"""" 

-o o-..... _,.(l<'ooonor.m-llnol) 

• o-NOmt 

. 

< -CUolcme<-(I) 

• 

0-

Soloofllon 

• llll!(sjofteinOdert 

o St.opt<l(ll}nameard.,..._Woomlli:n 

o lloleoft¥llilicoti>l 

0 St!ariylligls 

• H.....,S.v.lienardb1whom? 

• HcNrgocl, "'*'ardl>1""""1 

< O!dofdliiiOISipfrtardblocltl""'polriii>I::IN-· 

• HMp<cmtleolorpc<ertiolhl.dc -of-r.olvodandlllt_of_ 

. • ..... tmloof~~ ~--irdteiepta"oiUiber 

• Pdioeeepod 

4. Eraoril<oSoo<riyC.O.Lcg~D.E). 

5. o:..ut...-anc~ .... tcr-- CISicraclllio<al--

Gocgle 

Y<lloo 

--·-

Oo!aQA!ape..rtiy 

6, Nfl,-

7. -

lol;ngel(t) -~­

-Non 

Sa1N 

~ 

• C<ln!urolt 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000159 
256 


10417212.eps

6.3 ResePer lrwestigalion Proced~res 

I. So:ulyisncdi!doj Md:Reoeilor,"'"-:llwerm.mer(II'O!Ilorfw"P'f11 

2.0!itailrt...melo<--10bogi!~ 

A"""""Yoflhoi'<iclefthti'Q .. ..aotirlcmloliooforlhoprieo~ 

w..-... -~ ... ..__hl .. ccmP"'''-.. ~ ....scomct Wonmiion. 

Oil~elhit til fWd OOCU'Ied 

Dalt"""IOCq.Dxirlctmojjon-~ 

v.llo~h-

- ............ -edllfhIJstojh-o!lededl>llho3. Ltw-(l"""'ll*loreogercyio.._,ilcludelhol:bllgforeod'j: 

Cotol.wt--rclllol 

Na.lrldlccalionojll>oNomelrldoorlodi~oflho~ 

• h:ideaOllll'oflhopobiOj)Oit 

4~~-

Dalenolicalfcnlelta'mal«< 

ilcludeiOllll'oflholelta'forf'l!.ilx ....... pil<IOreleaoe 

s. EriM no Secuty c.. Log (lwor6x c.ll} 

6.4 PS0Linves6ga1ion ProcMJres 

I.Reoeiw-ofosecoliy....t: 

• ~CIOIIjllairCoj....utallodPSOl,FPGTOIAAICCMI 

~compllhof-Ciedilcord .... 

O""""wspi:ionol""'"""'loollon 8diliy 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000160 
257 


10417213.eps

' !drily-of -by~Soi>ol: 

-"""""""'"'l 

-OIWI'io:«r -IP-

--CII<II'io:«)' 

a.lddlicnl~w.......n.Goof#e.«-tcoio 

~ ·-·-toid'll«'fi«-Wcnnalixl 

~ F«CC<allitf~«-~Re<pOndiOPS<il.._.throdsof ......... 

&Fotlow-.orto.llpoonM: 

Plhdocuneris ~ardre<kt ~ Equiax l*lnnal!cnw:h .. Sil"""' n EID '""""""* p..,._ ... l>lrw-~-[>iarce.thN190tra 

• Slgn..-. l pi<M'ded 

Fu«owr<'Cii_in,_tolheol:ipotoo 

7. Fotlaw--

Cordd~IO--~tOnbe(l(OWiedtolowCi'ecllaw"*'-trronol:ipotoo-

& F«latg.,coltPSOl~ 

NoiifJ ncldolt~TIlo<eminelaw-~ 

9. Ropcowlrldctn:ilnlllttefn<C......_ (Apj>encbD, E) 

6.5 Phishing Response Proce<ilres 

U.. P<QCOClleodelli htltll' l> ~ord ollocMiy mpordlo pHshirv- agWlll E~puta'$. 

I. Ncilkot'too-~d·~-~CC!l)e~variouo-n-. .. id;de; 

1-lddy (l~ ll .. coriadli:loleSmll<i~(IU<rollclriyil ~tidpwty ........... 

mcri«fl«pHshirv-ogolnitEcpkx-} 

NOfllob*>~Acuotom~ i'e>boen~onEqUfoolo~- llla ~-l«al!>bin Non 

DolvonllltEmai.J.MvosPI<escanbeMinlicolorda plishirvlllllct. 

• F....-_011-ald>fi"'P"--ordW.ShlrtpOII~ ernalsllrpliolirQ- agairll E(llifal<. 

' lriliol Holt- Far .. pojdolaltl<b. ~of noiii:o6>n - · hfcii>MrG poi10mll ohoUcJ bt l'oOikt Cybe< TIYell Cener Ot>C;I ·(lfi'I>ERUNK'mailo:setuly.~""'"' "'I '11J1.m. 1011 1· 18a-257~ Old pm<l 1o< s.a.;,y 

a -v"""""'-I'IMnoiic«icnh~-·Wiilied: 

• R>MandrtpOIIbys.c..iyOpn:ion'•-ltam. 

• Rom andrtpOII by IIRrrdldrily. 

4. lmmllldrily~--tn-ldrilyl>ptdcml-dal-~sl ... 

ltttm>IU..Criy Poge)PAGE YII.EllGEFORMATJ Ocoobtr:<ll14 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000161 
258 


10417214.eps

5. l.lngomortAA<! 

'""""""'""" ~ tot• ~ elad<moaured.lhe Ike Pmllent o1 Seeuiy 1~ ioao be 

• -· Nul.....,.ll'ofolloot'Q_.-.i il o~bidgtiO_Ihe_ord -~·­

"'""""' llcev!iak«,V9GioboiCorpor.ies.My&SaleCy 

Ncolos.niJ\ Sr. ~-galien 

Ad"" 11agll, V9 Cybor 1lrut Cooter 

• Tm!OWI.Moclo-. 

• llin Btmoz!Siy en<. Comnuricocloro 

GtegWaglet. Lt<usi'mHostet. Hoi>Oeol< 

Rlclad Goeru. Ugol 

--folhpor1ai-{AI'PEIQXF) 

Te<lri;ofcontoc~fo<lllepotlalillad<od(APPa.OIX F) 6. .... __ 

Brio!e-.M~on-ord,_procerlno. 

• '"""'lhe~Hfl>lleskrogatdqplit/q-101batitloy0111--""'""'"' 

• hlrldlllehe\>cleoklo~WormNcoleSmllcl""'-· $01'illeyfol'licilllolhe.aadt 

• hlrldllleholpdetlclom.doloiy~lhelogi-ord-doclfl!l -..mo .. yllleyr.ll'licilllo 

ltleelad<. 

lrtclm_..-....,,......,clltle..,odpotlalsoltloyeon.,_ -•quMiiorv. 7 . ..... cu._.. 

Plocta~polltllortonlhellloclocll""*~page. 

• Coi13d lrfcnalionln (APPENDIX F) 

-lliao-..eard-lo«NiiCUIIolrltiScllhe.-portll 

PloctoniMrlcnU.mai>Eqtilalc...,page 

8. I!Mihetoctricalloamandlrt-lclordycollecl...,pio<lorHof llesk ~ "'"f''II m ...:omeos 

9. _plilltll_foi.....,«~~Ciopa~Mo 

10. ""lyze"""polle<r$cl""".i<od-er1:Millm...,..,......clal_lll<_lo __ io. 

""""'-ll'o..,.,IPI<Irlm 

Pogo I PAGE O!EllGEfORMAT I 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000162 
259 


10417215.eps

6.6 EW!ence Hancling Procedures 

lhe~,..the-"""*v~ardgtO!elro<-~IDinregatdsiDdgial ard""""er-.ID 

folcw><urrtt~beolprottmlothanlrgard-"!ldiJibl -., ard liodocun«<ioperio<Jcoly~lodre!odhM 

p<adiooo.Theoep<OOOCis"ard ~-~the---.,...deW!en:o~ .. -al-i....,nora mrdall..""" iMOiigoion may ••• """' lflil'OICh .. agood 'I'M bf .. !*1ios. 

• e.lcleocoA<q~-

N~-muibeq!fodlna_lhal_h~ollbof..tdonco.OoigNI -.eslo.idbeoeandard 

pq>er ..... ol...aodyaooled ~G). --olh OVN'olio<M be"eoitdfor ... Int.........,_ 

o No!WolaiiJeM!era!l-"haol-«""""'con!slabo!l~"'biiMI'""Innicaly"""'-.,a 

-...a-.naiMiodcyA!m.Ncopie<tlloiAdbe \'llllodawe~copiosdthe~~h"" 

ofmaitlenlablhashesoucll,.l.()510d Sll'.t 

o ln...,."""•~'-"""'ion11eooibleltldlt.riokio_...."'*_olaoqlioiionoucllosboclil!lomecia. q.lolion dl>o aS)'Iom. «por1ial ~ moy be pel!omecl~ t...tror.dandlor ~;,­

m.oltclriqJeo. o V-Ndera.-.-ym hliMsliglllol\lsbeola<qlhd~~-~~~~~odttJ!Iobiwlosor 

sollware"'"vitanalemalemecia bf-tror.d-.l'or _,.rad nlho !)'pool~ 

Ndiglal-.,.ml.llbeiranllolredlnamamerlbof,.,...,.lle~dlheeWien:eard mamro•-•do..o~ott. 

.h mef'<>ddlr1nlferatx.Mbea_.w.bllod., lheMnllilillclthlda. 

o EWieraollo<Mbeo~Wod •""""'llll-l"""cfomaclt.l.e. U..aAiiciorl f>'dolli'Q-!Niwawt> 

mll:ttnllft. 

o EWieralslloclo~Wod--'OihlhllntwbCIOISNiodto-~ l~Seol1'9 lhllntwbCIOiwtl> 

eW!en:otapt«"'1'9~·""'1nli'*G"""'"'"• .... 

o Evidence is best ~~Wed~ t!'e<ilat...,... olh"""i'G penon lotcleWery. 

o --Ooglloo.noponorot<lata,oto ... )maybttl!ipped~FtdExv.itlol.l -..-.. 

• S«oh-.,. (lotereic iNgesidlcq """'"""~dab) io beo1 ""'YPiPd beb> "'i>Pi'G witt FedEx 1o ,..;de-..- • c.iic:of-(~M!roct W<Y...-ptlllll11ior.......,da M< ... )i&bt<l d-eci"*G&m......., 

axrilroti-ard......,reciiD«p<kadllp~IDptl1<tVIOI. 

Ndigia!MW<eiiUtbtslc<>dilamamotlhal.,.....telrieg~ani<XIIlfirler&liyofll'ot.wlence. 

o ~oto<Mbe-...d eoo<~nlx«ionit«'"""" l.t romaini-aletoa,..,. ~ 

-a MNdera!llbastMor!db:bdtlad!Kti:::atedsafeor~aSI!!I:::lllldfOO"'II. 

o l.lrimaly.-cb:lly""""ooftlbl-.e(l'eld'*'"'.CDI.D\IOs,mM!O<Ytticl<l M<._)otx.Mbt11Dred 

lodctd lna -sat.«-...d"""'-

o Sl<qgool_...uiirlg_oWltrlce{Pogn.colpi1lroo.""'""'Y.tlc .. J .....,bt clc:no iu""""'lllol 

-iro-lolhe-,_v,.,lhetooool-.,., 

· -lllspoSII 

EWieretatx.Mbtdlsj)Oiecld«<fatM""'**l-.l btnolo!v«-lot"''d.l.cti!INI.« --Hannlltt. 

cli;l.liMW<eis"""""n""""",.l-r-

• l"11"""~olclgi!al~-maybt'""ll0filaaoetfttoco5cn 

o l.l>onr~diJibiMfototmay .. btdlsj)Oiecldby. 

• Logi:olcleanDco- lopeiledly ........... lholliO<iahNdercoftSidesor!will r.nlomdilla 

• Pt'J'ical""""""'-plrj!icaly~hm«ioheWlon:eraifeson 

Pogo I PAGE O!EllGEFORMAT J 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000163 
260 


10417216.eps

6.7 EW!ence ShiP!)ing Procedures 

Qilfnil.-is...ctHppod ........ --appc<MIItomoli!'i>lhosoc:uty~ n......,, __ be-..donoileiiRl*lenct)'IQdfo<onoic:i'nogeclllleeWiercettc:Ud besl\optd. 

Roq\.iltd: 

• ,_., irogecl oVd0 FleoottirirQK!;Oildlo<SII'.ft.sllesclllle-le(s) 

o Entrjplioo-e(-AESor30ES ... fllibll;ey) 

-~-to-the-

• EfX EW!onco Qolodf f<ml 

Wornin90: 

_"".,--..orpo1erfoly--~ 

&weK!;..-.I'c<SII'.It.sllesore-clthe.....,~IIRli>cblednlhe shioptddoQ. 

1. e ..... etotll>torigiwiMieocololo:otf-..dMI>.,EfXE\idtruCIJolodfF""'. 

2. Enonhlofotet.r. iNgecllhe or\iinll....., io mn•••l. 

. Qtflo!Qn/QrSII'.lhlllllfQfllc-fll(l}n-lhMIHI~@o. 

la;eiUilberecileomaybe~otodiYodlog<t!w"""'IJ!O<vt.«l&'SiiAI -

lnoUiecq>iescllliNgrgnolosonlkxllllllog$ 

fno)fltllf<ltnioi'nogellesond_._lleswiltono~"""" ~ 

4. e.....ehiEfXho>ille~le-lodoct)ptlo-.,._ 

5. EilwtR:'!!thitiniiWiuolyon~llltlioOR 

~ MMlhtllesorto"""f''ftdllltlio~e.""'l''tdlwllmor~tapo) 

1. FIO<IIOEIOiln:ecuo.dyFonn~G)fotllle~d•n~~ocetotmil lhe l*boilewilllhtmtdio. 

8. Pod<ogelhemtdioloben..ltnedinAft.-~Willtllll>tl*boge- will lope. 

9. SiglyrM~m~e..,..lhelope....tllllatont-hollci'P'Osl""'"isonllleloptond-lo onlllel*bogeael. 

0.Siipelllloroe·""lheel'l:lel1l0poc!:oge, teqtiilg~IO: 

--

&jl.iaxD: 

Mol Dq>: NP411110~ Rood 

-GAll:l2B 

11. Etrellhella:lclvrunbet wder<!)lilcnpo-11> (tii'PERUIII<'llllilo!lcolum~cam'"J 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000164 
261 


10417217.eps

6.8 Remole Imaging Procectlres 

Tlis~elodosl!rodll>ossiotno<>-po<1<11101illa11Diglonr&lclmogesdPCoha """"'illoloonbe ~-byEFX~I<nllio.,..,... 

·-: Ths p!OCOCI.n IOies on~ • too I\IIITci syotem. colecirQ- doll nl ~ • U 6sk image m llotsyotom. 

Thst.oilloglrQ~iouoodforr-.ilnolllr'IJinCOMOYote!elionol ~logoll--cntitnf 

>~len I is rd pcd;eilo ~the ocVo1 OW.. lehcUI rdbe uoodo~J>:iu pioc appcowld an EFX fotonoi: """'""·The 

~p<-"""'"lmaglr'IJ--Ihe .... .tE..:aoe&lelptila.£rease&lelptlla•t-lhe,_,p<Neoo 

atd"'ftlsii>ndeWl<nco.th--ofhll.opodS)'IIoln. 

• Reql*ed: 

• W"'*'9s: 

·- "' 

-(<emoltot~IOhii.OpOdlj!tomanl--llotwll-h 

ir41olalionof-

"""<lhlOesl£reaseErlolp<iooSeM<IIor~("""""'!!ilb121Riti!Ofl!et) , 

Connected to lhe nolwolfcf11« an EillemeC<el:lef-1'NanlYMi are aleopooollie W no1 prefened) 

Theatii~IOcomed...,llle..-loh£reaseErlotprise-S....... (17226.2.12)on 

TCPpo.15818. 

Connecteclloe _ _,.;,,.,....,localiol\ 

Theatilyoo_,.lhe-•)'llem_,qco!>ett iil j>(<lledt<llrom~nl~ 

.,. lll'esyo~an>io""'*ltd<lbelr'IJinfoaedNih-._lhenlheu-I.OOdonlhesyotaraehcUI __ ~soot 

Whays180tMChas~!MI--.Itow.Aellhotldbelnolaled~l!llao:arlasll\)oo 

-arelicelyal:oadyaxnp<omisecll """"'"'tohattisonlte•j!lem. 

····--isroddiOnl>llhe -bj)OOIWORiehcUI bodloi'Qod 

inmlciiWyoll!lheir41111-iocanploloct The _.t ehcU!boci8'QOdona<li1e<Jttl}lllm 

lhinlheiiJil'OdS)'IIoln. 

ldlldyb syo~om....,.n! IP-<IIheMPcb.o 0<My01 O)l!om uoodby~. 

ConnectO<YitllylyiiOmic_.loltoEFXV.nlylh!l!hesyslemiScom>cledloapo~<er""""lialwiiMibecltoomer.1ed. 

N.noponislponnMil:loiO-rnyolhordtw:eololheljOt"'po<IS-~Jyilow:ood 

byhrocp ..... 

U..a<el:le k>d< rx""' 16ariymolllodbpr<iod h ci6Wolml 111oa .tile fma9lr'IJ ~lis cWd M 

cwmgliot-clays~ 

Coniaa,.....,..dlorbm&11 STLatdNrtiGarg for al"'*locaiono"'''""fliMIIIoEIIC3<e 

SeM<Ibedeplojocliolheoyst..,.l.lliflSCCM. 

Pogo I PAGE O!EllGEFORMAT J 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000165 
262 


10417218.eps

.. ,. ..... """''"""'""""bedeployedusir9SCCII\IheSeMttwilneedtobeirlo1aled OIOO.Oiy. 

ltllei.Oeris.,...«canbemadeeware,tlle""""eanbepnMdedtotlle...,VlJ.......t: 

Shalt«IHff-l)'!l'ard_to_,_ 

fftlleuoetili'I:IIMre,t.o:aliTCMNtaltlle"""ttotlleo""'"toma-W..or 

OS:Cl:almedia. 

tftolhe......,.lshlalled,opona'-""'-COOl andd!eckln~ t><111ol 1n262.121!'d"'"''backiDIOq!JIISI((F<nroicE.<omillt). 

Opentasfcmngorandcntho"'-l>bcid<"SSItM-Iaol d -.· tton>tdytNI 

tnatt.m or tl'lltll164.txt i•t\IYW!gonfltl)'ltrlln. 

Ropoc1tti<-alionbadc1Dihe-O'(Fo<weElcamo\ol), 

The lorenotce-wJvorlty~andattllatpontllesystomoa .. neanbebdlod. 

6.9 Lost!SiolenAssel lnvestigalion Procedures 

I. -~l:ot"Wlon,...(ToM> IItocl<bony)io <OCOiYodllanC)Wll'm1c.nteror - lrdc!ott: 

looiO<«olon-tlol.tlboltpOCiod241'oC•In~ID 1$$71520<1· m 740-4351or'lio0111i11o 

• --~.oo~cr-.-lhcUdaobefOPC)Iledto H'Il'ERlllf<'lnlilto:Searity ~·v.~or1· 

sas.<57-81911 " 1=0 

«172 

2. Coraa~or-lfldolitoinlhei>llooqOoto,lineandlo<oli:>n~tooo 

IIOiiiloolioio 

l'obltpOCII'I.mbefandcmar::ti1bmacion-aloo--olpolioe-' .....,_ 

-~VPN!Wn-lool 

_i ___ "_""" 

v.rifylo;lop-""l''led 

~ .. -.,..._locltedwllltlletopop 

Verifyro"""EfXa,.. .. loot 

$ Verify-IO,IIPNtolo!nand_.-ho\Oslboen4. ProporeSeculyn:ideftRepoot~l1) 

5. Tranomilfti!erl"'"''to\lceP,slderl~andCtioiSeariyOiloe< 

6. ~'lill~ripolceNportiopt<Mdedfor7. Ropoc1fn:idettin ~ofnxC...IIInoger(/llper'dlxll) 

Page I PAGE O!EllGEfORMAT J 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000166 
263 


10417219.eps

7. Security Event Consumer Notification Procedures 

7.1 Consumer Notification Procedures 

-to""""""'moybed!layed~an~law-- cle!emlholtool"""""'-.. "'"• wllla.mnlhlooligollonrd ~Equlatwllla-.-or..,OIII~Iobt-bya-""'"­

.. lhedolly. 

'.llfecRd""""""'· to""""nodcet .. be~.a<eCO<arnPto"""" ..-&ihm or-c:o.ld-ob !OIIo--o-usecllt«'_""'"""'_ .. Fc<.,..._ . ......, __ . men a-·,...,.,- or~..-. i> ""*"'""" '011 Ito con!tl!ll(&- -..iy rullbc, driW• ra...e-.IClOOtl'l...-. <ndlo-dollicaodi'I.Olbe<.orapermali!orliltaliM-<t-dltool....tdpennil IIOCOOitolhe-·--"'""""ino<mml'alooiY:I.J:Ioo llfO/_cl __ ol_ 

illomliMolhi....,oliolr...,....tobg -or...-lhe........,..""""'"'-wdlosuser"'""rd_,.,.,or ~ rdiClOOti'IIIUIH. 

• Soastdto~aJann--.,tdfee< .. behtedlO.,.......,...wtc!iqU!aldelemlhedlhal.,....of 

to<-.donl'os~oris..,.....c~y pooollie l~cielenMosltoole"""offles.,...-in!lr"""'. 

IILI~-oode'.tmlinolht<pde""""""Wom>ao!oncllll--. lilltlllllllislsoot.tocr.orWamalion ... 

-·~ EqUfax .. rdJral""""""'i>"'-

~lhe-•1116eholycllhenolicetolhe'-""""""' n.-• 

llo~lnadoalalll~- -by...,.ornwoii'g 

Wldetcrilelhelnddoltln_,._andidrilylllei)!)Oot-lni><mao!onlllol-bi<Aljoclof 

flt~IOCeltOC'UM 

Y,._wNIE4ilo><l'osdoosto"""'lllt-•lnfcmlaionfrom l\llhlr~ad-wdl 

ISiallirq lleir <ndl fie ollh, alii m Ito ........,..., _,..c. reP>ce Ito lie blod< m 1 hod o1ett 

h:Uita ... ht~,..,b«lhal.......,.cancai .. I.JIIIet~andAemir'd """"""'"'Ito ntad to"""""**""" ... .,........, lh!lr ooodlillosMalltne~ 

-~ ...... ; 

- ...... , •• s; 

• HowUI ctail<q:IIKd hi' CliCii lit from ndtdllnt lll6lnoidt COOMII!CIIdl f1IICIIIi'o ........ 

To topo!lllfO/...pc:iol.oWo!malot\toh........,~agerq 

it>oiO"""""'flllOi.Chcri!tdtqJt\oslolleircttdtlle 

AI>Waclf'lltal.d_ID,...c<edt""' 

• __ ,.lo..,.,"'fSUSjliciol4adMiylo .... ...._ 

--rsliowlorecoi.o.,.<ndlmonlotl-v......,..,tho!iqU!axctedlfile 

- n:...-m lllef1Cabol.loow" IX- .-idefiiylllellbf ptO\O!i'll,. FTC's~W~> sio -and-·~- 10-idenitJilletgUdaroeand ..,.,OUij)Oded-of iderCity M; 

lloo""""' atfJ oddiilrollnl:itmallonllllllliiJ be req<ied b)' $1010 oocuiy --laws: 

NolifyE>pnoaiiiT""'lnonlnoliles .. beoerlto...,.thonl.IXll'Niod>dcotall!On'. lhno&esln:blot.<<O!tad 

-

Pogo I PAGE O!EllGEfORMAT I 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000167 
264 


10417220.eps

7.2 law Enforcement No1ification 

'()fy lliO'IIdo-clallaii>P'Md by Manogfmerl 

PllblllngAitoci::N!Oiyf81-

C..sumlfOIIIInl111111 

Forhudn.MrQnwoi«""*lnflonndm""""lriool!onlb 

lelo!imt. fox. ,.._, 

NcOfy IXMd-PooiJISri:t(USPIS)In-o!Mhud 

-.nod.$UI90d -· otvldim ,_ 

.Modi:Uon "''i'esnOI'IIolo din by SUI9'd 

\oldin!nonoiOiyglidolinomHmunowllcll""t>tottalnedmUSI'IScor~ac~ 

o ForlraldiM>Mogcndlcolds, """"''l'-etc: 

NcOfyUSSecntS«YYc:e(USSS)il-wrthudOCXIIlOd,IU!j>Od 

reoides.otW:IiiiiOiides 

_,..,.... _ _,byllllj>Od 

VdiMnonerary~ """"'• wNcll can be obc.r.dltlimUSSS cutacl 

-· EXIImal Thltli 

o Forhudltwo!WolnfiJPed edONI-kptiolq,lecl;~ --....,, 

""" NcOfyfll! in ~t~~o...,..lroudooomd IUIC*I,__.,'*~"',_ 

FII~.Aiid:&n"'l'"-.... adionbJ-

\oldin!nonoiOiy~lltmiimunowilcll""lltottalnedlromUSPlSOotlad 

lo~ ltplops: Corlod poi<e .-tot 11>01< r<pert 

Pogo I PAGE O!EllGEfORMAT J 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000168 
265 


10417221.eps

8. Physical Security Event Procedures 

8.1 Ovefv'eH 

8.2 General Procedures 

Arunllold~-Eqtifu._boeoMieded•'Qiois~IO-a linoly_....ar)dlot ...... inlhtM11 

ofllrt,IOmadoorbconbllmt. 

Ia Oills IAadon hM .. -vo«Y-""'"""""* ......-.. Ewo:uolionmapurd~ artpootodon.,.lhlo<lgholilho~~ll'oulcl--willllle.,...­

IO<Aohmll ..... oflheldly. 

8.3 Crisis leader/Manager Respo~~sillilities 

~--.......,..,......,.lhllal.,.,....,.ptoceed tot>ls .. cp:fdyondl3tofy., poaibte. Ch<lal_.,.tlowal<ontlle 

filttateofal~ysondErot.nlhllal.,.,....,. ...... _.,._.,._.otilly. a.ed<dbo.COI>fondl'h .-o.r-ondconlol1t<e""""' H 

tlo(tlsahoa~~lnop.J-bto•ro thtyO<t-.cltlio--. 

8.4 Fire Procedure 

I !~'on lo aitin'PJ oteo.noly Ser:uty Comlllond~. tdriy lht Door locoliorlond tile ....my dlho ln. CQ1acl 5eos1y,. Fdlieo 

Managlmetl ".,.."" !re .-. 

-FirtMSI!!!ol 

1. -.,.~ ..... 

2.llsttlltMCUiilonprocoufoU'dlnOills3. Coll911gWy;tlie-loco:lor\ardoll.O(i:o. 

8.5 Tornado Procedure 

8.6 Bomb Threat Procedure 

In tile"""' ola-llml hM ""ploojoo<rp;lcly chtd<orocnltlloi ortafor --btfora MCUiilon Woon lhtlllll*i!Ot: IF All 11£1116 FOUNO, DO NOT TOUCH m 

I Kotplllentfdualonlht~ 

2. GollioranJJdlri>orlllllcnabolilllebcrnba~ 

~ lt80!1Sllmtisrocoiwd.""""""'notifys-tyConomondCerWr. 

• Tl\e4idYOioadiooelhtllJiirllm...,.,for....,.. .. bt!l"'ffo4thiltlm• 

5.-pe!loeiiOillsPtan. 

Pogo I PAGE O!EllGEfORMAT J 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000169 
266 


10417222.eps

8.7 Medical Emergency Pnx:edlll'e 

I. Col911erdtema!nwll>vlclilludMocltaiT--

2. ColoaoiWonnaiicn-lo~wll>lhemeOtol--. 

Pogo I PAGE O!EllGEfORMAT J 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000170 
267 


10417223.eps

Appendix A- Definitions 

~ .. -MI-.~"'*hdspio)•edYe<lsirQ~.tilonmi'QtiXOVJJm. ~reird<.dnocliliorelc:odelhai 

-.lhoacii,Wicllconbe.......,~- -«llft>ugllabarlhll-onlbt""""'"scrMn.lU01.0ly 

id.detc:odelholhcbause(s90<'Cf"OIItonnelionw-lonlo!lidpar"--hUiel's~O<~ 

b'oet-A-ol"""'""'loed....,.,.lhai<Onbe"""elycort<>lledbyanal:acb<. !Mioll'eltimmenoosizeW.ol 

- ol-hlcanbelrl<od lcgeltlll). hy pooa •-• llmi IOIMcar.,."'siT-I.dlll, 

--Niyllogolponolllllion«......,.izod"""'co'""""*'l)lltmhl...- -. ...... u.pcW6olco ...... 

damagt. 

o.ino!CUolody · -ol-bytodl_...plllyto.....,.agnlooo, bloolago.alorlllionO<-

har<Q.Protoclion..,ltd.4et_.tyM<IIi9. ~wdol'r!l.a... 

ean.,.m;.. -Tho~ diodoo!lo. modlcalion ...t.tiiAion..,..,. a ...u.. irloonation "'""_,ao1iootoirwod< s)'l..,by~~-..nlsocuiy.A""'p<.te<hao -~.for....,P.."'*'aTrojontl>'sohaobean-. 

~aHogty-Nrt..........nzedmodti:otiono!-«dela. 

CjO<~Secl.rlyhidett-A..-,.,inninot-ofW:Ioiionoi-Oielriy pclcies.~..,..,-

-soculypclilios.ll&a>any-.e Mrlwlwtby...,.llpOCiola-p<.te<s)'lemil-iledao:lossol 

dalaccnldetlially; <iln¢inofd!laiieglly, <iln¢inol Mlaloiity. alooimon asadorialo( .. ,;ce. 

llnoge-TM-dol""*«-plrjt<ol«logocai-- .,,.,....oiWonN!iorl«diiJIRim 

.,ITS!'Iem. 

llorial aSenice(OoS) - lvoilolliilytouoe ·--ilelo ""vaitdty, for e>am~~o. -~~~-hao6sableda ,)'l...,a.-WO<mhao--tonctMclh.lll IP-haobooolcodod.., __ O<hi)OI"" -""al-..... b!colneloctodot.to!as)'leon. 

Ewrt-N!robeeMI:Itct-oa:urer<e~tay!llniiX-.Ewmr.t~~lncl.de. b<.<l!lrdhlodiO,a-

~~·•fltslln a"""~'-"''Wfb pagt,tUIII'strdrG-mal.and"""liltoctdi'Qa 

---~ --£-lha,iogo,._bti>IIXIIl!ll'i'Gilwlisl.oedlo"'''''''III•ilol'*t 

frWo-MMI'IIX""""""'ilwiNy_o_Cf_CIYOilol..-,ofQlOipo.QrMQiiypolcloo,~ 

use poi:ie<,IX """*d- oocuiy .,.-fi'drg& req.*eogetdooiX OCIOCS lrolysiopiot 10 beconW;Wih:ide.._ 

r.--AI)-hl--nllio-lwo-lomnrizeUI'oJJiorioed trollio«oo:eoo.f-<an~ 

-ard•yslemsmexptoiolionot- -~"'"-"'""'loi'M't-.cltnell'OI""" tom ~pri¥ale-ccmecledlohlrlemol. 

llorm-To<OUOe~ irj.nctinpoiiTs)'lemslllill--·"'*""" -~~....,,.iderdy 

hit. 

l'lddoftao..ro«Oocoot.I-Tholatlp._o!l.-,lwdngliloeydt~Wicllll-oiRTIIAimishl'lddoftltjlOIIIOh 

-

CSCOCTOior""""and comn>01.Cboot.tlsrdfr•hrdpoor,_l'as_"""""'"'andalquoslionuegetdi'ci lllo 

... .--.,. -.(C)betSoc<ltjj-A_«........,_ol_a_MQ~ty pololes,o:copollleuse«llordinl ""'p<.~e<oocu~y.,-nisaiooany-.etY!t'l wlwoby_.llpOCiola_ljOI..,it_pootlioed,....,.,loooa 

dllo~IIJ. "'""""ofd!lanegrly,ciln.,cion«deriltolw.i:e. Tl'OI)I>oiofil:ilerisn- dalollednotow. 

II.EDlld«MIGHieoets~""lho.....oty. 

_.Oec:la,.tion-Tl'O~ollheileilerti'otdrqiteqdefili1io!icha EQUIFAX -"""bCfis~an:llhe 

oespnlltaEQUIFAXO<gOrizilionbeifrolsilc:ldert l'ord!O-gpiCxeto.lvoilc:ldertisclecla!Odbya~rdopor1mert,o1a(loilce,~ 

h:ldtnrMporoo""'QRl)llwla_.ulanddo<unoroodaobeii'Q,_-f<lfh::!dort l'ord!O-g. 

-~s,.c-(1!'5~ U1todS!aos~~ -Ti'o~...,..,...-d_Mfelnddon- R!oproo Team(US.CERl),llw_,._s.M:f_OSI'l ""'-"""-- hiMinddoft --lirdudoc~lf-o-l'iddoftlyJ)O.\'Irit;i'olht'oiclhot-<($ r~""''I'IJ. 

*'*91'- comf*11'. l ... «qi.ho "PPOiiil. ~~ 10. R>iigoiii'Q arddooii'Qa EQI.!FAXCSinddoft 

-~ Tliop!Mealheidtlorthlrllqlfoc)de,_lheformal lllnlmiloionoldoclnd--to , __ lwdng« _ ... _...intllaEQlJIFM~IhilbeiCpffoor<II'QaCSinddoft 

lrdlort();rnog~-Tl'O-olorvcirg_and........,ollrdlort ...... bylhe Eqthxhidettllondlrg~ 

etadl', or....,_torni~-&ttlfaxft:idert ,_<lsonlhelU!lbotolin:ldemdodotodcpendooetlorPage I PAGE O!EllGEfORMAT I 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000171 
268 


10417224.eps

-.Poepo116on Tl'ispi*Oolltooi'<idert~liloqde-pr'l"'i"9-""' ~--onltoo 

--l't- · - Thispi*Oollhtl,odettlandlrl)lieqdo-h,._olalel!s. ......Jrgslfti""'JICO<d.....UI!om 

"""""""""'· lnadclliln,lbdYesc:onn.o...I)SIIm ~lftl-olrOI<-bi)'II!I>V;..,ti;I>CSr.c&t 

--

-~-lliopi)IOtillc:llo&alomlll~byhEquifaoli'<ilorl -ll1olaCSineidoft18100Mid 

lftllhal.-ololpellllfrol~b ._.qlo.adi'GUilOf\«leooMroani'<idertho,.beenl<died. Thei>ciderl 

~---olll'oCSA:O. 

l'<ideltReoplne-The procesooladi'o-"'-ideniiedin:idem. The-- wl)tisolbowhi>ciderl o:<I<MIId, __ to_llit ___ lhiCO'Mdlto -."""ltodimogo,lft!-l!omlhli<iclortThS 

pl)llt-c:olleeiol)lftl ""*""""''"--~amod"1>0111ft!...-illhe~oloni!CidertftPQil 

I'GdeltT~-The-""~b&!Jiexll>lllliUin~~ ol .. i<iderlsl!omlhtlimeol 

-ll'olt#lclooll• 

11Mirl-M~hippl<lpriate«legolidMybyinoidolt«OUSilelslhalmbt ...-.dapotiOOiiionola•,..,. 

--Apenonwh>iolht~ala~oeculyi<idm-... Oieo refel11111o•-.,.....-._ -..a,.litflleclri:alq>et~s•tapenohtod ~s)'llem&;lhelemtCia<biS8lolhtGp81ts..,lhlallie)lo--<l>dc ""'"'*' $)$1emur11oeculybatrier>.lloolollhe'"'-<tad<orioUIOdlooelerlom«e- iWienn<r:lllplerairli'olo. A.,_lsa-otaruybt0Pif1li'lll!om- E<!Jflxor~mlllt..aldt. 

LMiol~- Thelnpaaanh:ldlr1hlsonan~~--al dlla;lhlcocttoaf<llitaxcom~« 

--: negoiNe -lob orgrioli>n (~g. dimogo .... ~ Wllltoornq&dtofdimogolllll nul bt 

-llolclo.aC<>de-.<lsollroon,. · __ e(INIIdou;-. io """'"'erc:odeorpnvom des9>edtodenJ,desboy,rnodly,or 

~a$)$1<1n t..,..ilioo.PIOV-.riUIIoo,«<ablet.loWcicoocode_,.;,-.~r-..~"'-WII...,• 

.....,.lJrotthori!od ... olan-~«-byanirill.der«.-......, («i'41d!r). 

N!ed-tol(n:W. The-..tylcra.-to.~ot.or_.;onot_cr_ ....t'.oWIX!II!IioniiO<dertoeany 

walldlly""""-dciAieo.AeoponiiJIIIylo! ~-·-~o:uies"'!!h_.;on«.,...,ollili""'"""" 

..... -h-hl'qeulllt~ OI"""""'i?)ollto--,lftlnot -llieprooptdM oeciPim Tl'ispiriploio~-h~recipierlisan ,__,._, 

~-kleiQllcilollheOoni>NoneSeMr I»>S)Ihaliiesto«"*"'!-l:mlslf'e ~talnamelrG>..-IP 

OddMs. The"fi'Orme(""'l'•-bctilgslnb<to 

•levlinol•sl•""-"""'"'Wor,nlilooloom~-....., ........ ~ ..... ~-

l'fillill-klaiQllcillhal-legt.rnlia~- .. -,..,., • ......, ...-.MorprMio~or-• 

ltpico don •:rioli'G wo1> pogo tol>d a ....,no Uri1i'Q ....-. lnorcial """""""'doll. 

--AMiolloolsUIOdbyon-olor~root-ao:oatoahooltocon:oollt'o -•-onlhtlotllftl ...,.. .... _lo ___ lolhehoot llmJIICOI'IdS9y«in l<rtledrologylhalaidsil~-aboliaporacncxorgariZallon wll"lliAtll!ir~-ltil 

..,...,eiocaledo"'!')l>ot"«-tadiru- ~i&pJin"""""~"""pJerlo_,.,gail'oriiormaiC>nabolih..., 

"'""'~"'~' Wllrtllyl lo........._fortlgn"""""',n--odparlloc.Spjwaraeonbt -•1"'1<>~•..,., 

worm,ou....tm-olapropn.SW«ar.isohn il'llblod'Oilh1thl06f&ooroerlaood!M-by-.by<icli'll 

IXIIOilOopiionola d!ce¢\e-«~..,.,,..,...,.__., 

Ttnai4.-.CO!'Ii!on.« ..... ..,.,.l"'fl01iaa ....... hatm,pellllfrolardl>r -·-fnl!>olormol detl:n.dion,tioeloate,.-xnotriU,IloS.anrl'crhul. _..,_The_ounmonoecuilyllmls .. lo-

•,....,.._NM1IImll"**~~lloS.,..cbb~ 

TRijoiHoc$e A..,....<~pnvomlhol_,.lol'w'"a....U""""'IU~..aity ""·---· VM- A-pieoeol""li:iouooodtht-loelllo""""'PIOVII!l··cllesrollllllon b-tu-·lhehoot 

popnilnn 

Worm-AI)Ptol--lhaladtaoon~-"'-""'*'UIIJOIIy..pr:ott looil-h.mini'lera<lion""" .,...sya~omto""""'. 

Pogo I PAGE O!EllGEfORMAT I 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000172 
269 


10417225.eps

Appendix 8 -Abbreviations 

"""' 1_..__<!1Cfti9>)'11om 

ACIS 

- S)ltom 

NJO --tliloSyo: .. 

IGrN -ccr..m..llsp.le- CiliA ccr..m..OIIIhi."*Y- ao 1"""'--0b as CUolomot - $jllom alA Ccnouw ~ }qltq 

cs C)bot So:uly 

csco Cliol So:uly and~ Olbr 

CTC C)berllmlc.rtlor 

ESIRT Eqo.ifaxSecuiyln:ic!otiR_..T.,.. 

llCAT CUolomot lllrlboi6 Tobie 

~ lllOmai1NomeSeiYol 

OoS OoroaloiSeM:t 

EfX E<!<ifax EllS EqUfax Mot1gOgt - ..oscAR Elo:lroti>OnhS<UontorC<xl'(iiOtw- R!pco1re 

fCAA IFW ' FTP Fltl"'*Protoo>l 

IHT h:idorlltwdiVTo., 

p 

PS ---""'"'*"Sjtl .. Ill lro:icloriRetoonro 

ISP 

IT --P!ow!et ldomoalionTliN lnddedlklcai'MlCOr 

MSSP lolngod So:uly-P!OYidot 

I'OA ~d.ldin 

""' I I'OROI'"""" 

PSOI. 

SA --

s,....,._ soc l-()po111ir<Ctrotr 

u&aRT lkiociSI>Ies~~R-T..,. 

"'ere Y<AJI'Itoidori.C)be<Threolc.M 

Pogo I PAGE O!EllGEfORMAT I 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000173 
270 


10417226.eps

Appendix C -Incident Classification Matrix 

s-tylle1etmin:iion 

a.-.. SE\14 

l!lrlom>aliotol) SEVJ(W~) SM(Se'IO<t) SE\11 {Oialj 

SenoiMytJ - - Oticll Oticll -

s....lt.tyd - Fo!I""""U.. Ccnf,cloRial and Ccnidet'llal andhitOf lloiJ Ortr hl;lol 

~tJ None«scrne llritf llritf(<41lo<n) &tt!ded(>ll'ootn) -......... 

E'l"'' -

None lmemol lriOfi'Oioreoclomol lrltmoloreoclomol 

R~SlA'o 

N<6t &.lneso l!o<ihly \\'eelcJy 4i'cln 1llw Own« 

N<6(CU!Iocion Wot»y Oily 2 i'cln 1llw 

N<6(CSCO l!o<ihly ·- 2llwo 1llw 

Dlly.ni E....,4i'ol.nlrfi £....,2i'ol.nri 

CO..p.Jalrddert ~ -·-J - .E.etyclllor ""-.OoiJMII UpcfU~ 

'-010-

Mllbulinesl . diJMI! 

i'clniDdoot. 

tr..IM& --10 -· lleiol<idert WA Jr. needed. \Veokly.ni-. oo~.nJ.-. ~·MMii'gc 

Pogo I PAGE O!EllGEfORMAT) 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC00000017 4 
271 


10417227.eps

Appendix D -Archer Ticketing System 

Tho""hiltiol<oli'9•JII<m ohil beuooclilr~dals-fl-. Thelieldooodlogie"'...-n ...no...,.ltolwhen lleiilmalbnil-od ii ...,..;Jy al-iilmalbn.O be~"""-"'"~• n.Mters,sem MI ... as ~to·~ ... .,..,....grarled~-~·· 

Tl-e""hil1)'itemconbe_,.bya-tom llillil tl'o~-l>-*' 

H'IPERIJNI(,.pdarchor.tk.~..W.. I 

--------------------------------~--------------------

j1',•6ft'\ :Odc;!f,f~..-!i:~:ll:l ...... ,.... 

!~S .!J. ~d 

... ( ... 

1f 

-· -- , .. _ ·~- ·-- i 

.-. ..... """~ lfft~ 

- ~--- -.. - ·- ~n~ ill 

-·- -·- ii!l 

........... tlll.t. ut.w ~ -

=--·, I 

·-

- ll . - .....,_ j[ - - I 

·--

-

-~ !Jlu:lentt A:tl til':<. ~%ef~ ~.-·" 

!~ 8!~ J.. ... 

.l _ ~ 

r- 11 

.... _ ... lrn.r- ld 

--...... ' I 

'==:w-:,::.:.., ......... r:··tftll......,...., .. ., ..... --wt~ ........... "",. ..... ......., 

........... II ., ......... -

~~~~ ~!.:! - ~ [I .. ' """" [~ I l :,II --- .. 

- .. ... _ .. . 

Pogo I PAGE O!EllGEfORMAT I 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000175 
272 


10417228.eps

Appendix E -Internal Security Investigative Worksheet 

Note: To be used when Aldler Is not available. 

p!!EBI!AI USER l!fOl!MArntf 

Uoofollooc ______ _ 

--~ 

OWID:__ J\CAO__ M:IS __ 

llaloE•~ --

~0~ ~'------- ~~--- v ________ locolix< ______ _ 

_ ONIITNC1 -- COMa AMI lfi'C!tMAIK!i 

'*-'" ------- TtleplmoNllli>H ---- ------ - ------------ Eqb,w -------

0.00<1 ____ """------

0.00"~ --- -ofCowutnon-..t --

k~~------------------

~-===========~-r.,_ ___ N----~--:-~- -------- LAW E!fa!CEM£Hl 

~ o-M; 

~ .. _. _____ --------

oOPrinl~ Ollocin.. o.w __ 

Pogo I PAGE O!EllGEfORMAT I 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000176 
273 


10417229.eps

Appendix F-Security Investigative Worksheet 

-To be USAld when Art her is not ava.ilable. 

~~~-~----------------~~~----------

MaW· _______________________ ~~----------

0..000"""'------------Tio<. ______ __,EN--·~· ---------

O.()ooo .......... _ 

----------- --------- o...____ ~Yes o-. __ _ 

~~· -----------T~~~-------' ----------

~--------------------~~---------- c..•---- ..,._, _______ _ 

::~----------T-----~--~==~-----'~ ---------- .--- Eq;o,r, -------------

1

- -'------------- ~llr.t- T--~-------·--------------

~ 

oOSM 

oealnlomaiU..Only 

-

0TIII"Tm 

0-Aiol 

O~~>eu~os ---

0 Oodoellall: ... 

OIMEnbwnenl 

Page (PAGE I' MERGEFOil!MT ( 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG-SBC000000177 
274 


10417230.eps

Appendix G- Evidence/Property Custody Document 

EVID£Nrei'ROPERTY CUSTODY DOCUMENT I _ .......... r ..... d..,,_•Equtu -..Opntoo- l ·-...... Equifax. lnc. ~ i,~cfwardCoM>Our.;e etta,GA30005 

0 -~-

I""""'' I""""'"''""' I= 

IW' _,., ~t#Hmcuuece.m 

,...._.tDIW..ntrurc..CIMI.b'ttal...-aw111 

e< """ """"""' Rf<S'IB) 

_, 

CION>! Cf 

1 .. """" I"""""' 

"""'""""' _...,""' ~~--- ~~~ 

"""'""""' .... ...,""' 

""""""' 

MIIEM>l!!lf -.,....,mu .......... """'""' 

-"""'"' 

_...,_ 

I""""'"' I"""'"" 

t.NIEH01N IWIENll1111! 

p~ <I ___ _ 

Page (PAGE I' MERGEFOil!MT ( 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000178 
275 


10417231.eps

N 

!if' l)o.lt IBWEOBY O£aMI)I!f l'l.fFOEIO<,.C>i/oNOfOF Ol$!00Y 

!""""'"" , ........... 

MWEA.•«;mn.E tMIIIEANJUfLE 

, .......... I'"""-

"'11£.\'<Dmte !WoEAIC)TI!lE 

!"'"""""' !""""'""' 

MY.U'f>Tlli.E ~NI)TI'I\.E 

, ............ I"""'""' 

Hi.~'«lTln.E w.a!EAN)Tm.E' 

, .......... !""""""' 

8\\fU'I)Til\E NAIENClTm.e 

, ........... , ..... _ W.Y£.\..,Tm.E IWIIENDtrn.E 

, ........... , ... ,.,...., 

*VEA.If>rm.E NAIENClTm.e 

!"'"""""' !""""'""" 

"'11£'-'Gmte NAIENClTm.e 

Ra.EASEJO<:weCROnER 

-- e&mOY 

~ ONtKSIXXl.IV9IT,PefW,If«:iTOKtCIStl' MQ.VM; ___ -

- -- <&WO!)Nlt.aoclel 

ISIJREOASEW&CENf)WAYiieCJSPOSEDCFASNXATEDABDIE *fCWf-*6t~d>i..:tt9\0.t~n .. 

- J 

-

llE.ARrJ.::t.ElS)USJS)ASRa. ~ NIJ.SI(V-D!Sl""""81 

lt 'f~O. lM EIIC.O £0N!Di£ 

- PAGe OF 

!'ago l PAGE \' MERGEFORI/AT I 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000179 
276 


10417232.eps

Appendix H -Sample Security Incident Report 

SECUAtTY IMCIOM REPORT 

10: VPGICW-Secodyls.l .. 

ftlOM: tN'ESTIGATOR 

IIJ8JECT> JCifiDOeSTClSHAPTa> 

DUE: 1001fl012 

CC: CHIEf SEOMIY OfiiC!R 

On.laro.wy1,:1009 at~·tq,m,Joln0oe.(rlllt).-101lt--l'e111111'0d 

10 11ohc>o'AIIIppl0limotoly~.ht-1hlllhthomt'-<lbeon~bocl< 

-hadbeoobld<ol\ Ththome-loclledot 1234-Sreel,.lllolia,GI\:mlB.""""e lht iomo !OI.on ._.TV . .....,., iPOO. ord 11olal*l> bog. The bog-m1'1109 ard RSf< 

bobn Join Doe-F'*>n Coon~ Poioe Ooporlme<t ord fled a "1"'1 will DIC.W.. OoGood, 

(«14) 5!i&1212JolnDo .. l~aecpyollhepolcortpl!!"'*'l i .. - . 

Jctn DoeCOIUclod EqUtor ord rtpOIIOd lilt lla so IN< 1'1<-0 ord Jl*'MI(dcoUd bt 

-..od.HsRSAicl:en~-aloo.S.ablertThtlop;op-O'I:I)Itod.No_.,..,. 

loeal!dwtllltotlap~q>. Thtiapcq>di1t<t-"l'""""""'«PURgu" H-1: Ex.mplt <I a S.Cudty lncld8ll Rtp>rt. 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000180 
277 


10417233.eps

Appendix I -Security Dial in Phone Numbers 

Socul7 t.lnig«Mit 8rldge 

Tot 1·119-387-5697 

Tel F...: I-

""*""'~ 

SecurityConferen~ (Technical) Bridge 

Tclt 1-71~231-1815 

Tclfree: t823:l-«<ll) ""*""' Ccdo.i Redaclod I 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000181 
278 


10417234.eps

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000182 
279 


10417235.eps

Appendix J - Physical Security Emergency Contacts 

Name T"le Wort Al1emate lOeB 

Gam- a.--~·MY 110T40.4151 R- I Redacted ~ ,..._ a.--SOt-1/W 710.7404244 ..__ 0.0.0-... - ·1510 _,.. _,.. 

........ 41()(1$5_6187 

........ - <0<.186.8134 

-- <0<.186.8!11) 

~Cod<>· <0<186..&43:1 -Mf """''""'"' "" ~= 

- 1110.!<0.<1<> 

"""""tiiU\lO!I 11lOHO<H1 

"""' ... '""''·!2ll I""'"'""' ...,,..,_ .... 120.7408&1) 

--

"""'Oooi<a.,... 1_..,.. I''""'""" 

"'""' __ ., ..... _ 1"·- Rtd.lded -91ft0YCI!IIdl0$ 

_ ... _ ,..,._ 

--- ...,,..,. 

"""- <O<.IWII2 

"""'- -s •ron• ___ ....., 

... -_ , ... 

TabltJ.t:Usiolpii)'Sical_,litytmlflltOCY..,.._. -

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000183 
280 


10417236.eps

Appendix K-Payment Card Industry (PC I) and Contract Contact References 

~ 

IHYI'ERllNK'Nip.A\Joa,,;,,"""""'--...._..,rkisp-"'*.faqHmi'V.I (lilcsliled"MMIIToOol~and~ToAOolaBctach') 

\lisa Flu! IIMSiigliionoandrodort ~-(!li0}432 2978 

lllsletCald IHVI'ERUNK 

'Nip:Uww.r-I<I~..JI'OP'\)l 

tJrl' '111 "'"'liJed "MooletCIRt Oola SeQrly ~ (PCfY) FRAIJOOI.fHTIMSTl:RCAAD E.w.!L ORSECURilY CONCERNS 

l)leoooconaotlhe -..-..Colier. 

Calcoloctm.,.....,.g~c~Wr.•len:z.7n1 or loU<etorolhe\Ned-+1-«<)Q7o8372YcuiN)aloooerd"'...,.."' llfi'I'ERUNK _, .......... ~ao!Oitail!.com"V.I 

AMEX 

I HYI'ERllNK 

"""'~americ:ar>expr ... ~seMet?requeG_~Ili.."".....-....,:n'""""P, 

1111·~11-V.I 

I HYI'ERllNK 

,.~ ... ~oric:aoexp( ... i:OIM>ort~ort~~rar<se<>~«~ I)'P6ooci""""Pa""-~4>*"""" .. ~ 

""'US&im~to-V.I 

- ... !he AilE)( OolaSec>rly ~Poky Sedion 2.1orlldeloit pe<1oilq to Doll lnciloiCt.larogomolt~. 

- Expr.,.&;Ofllrioe lnOdort ~Plop> (EIRP) lolholl {Sia)732-3751WS Otfy, or at I~.;JOZI-orOIIOI IHVI'ERUNK'Inalo EIRP@ae>ll c:om"'lll 

DSCOVER 

IHYPERUNK 

'Nip:l/ww.r~J(dal-101'1 

'lllllio>o"'--R_..T...,. 

-

~ 

j800)347o31X13 

(8001347·7f1i2 

JCB 

IHYI'ERIJNK'Nip:l'ww.jebuol.oomf '111 T<l:l-lrol:l6-'111(Tcii'M) 

rx21u;1-8lt1 

ForaiCloftlnciloiC-.. ... CjberTivooiCette<oiiWOII<oilh""1>0C'Ct-.and"""'!lheCienlttlil~ 

•.onogolllooppopriltoly..mct""-lholortol!octedbyon r.iderl,inlhe~-- loreodlcie<L Tte&in'COE OPS-IT~'distoheionkiWibeU&edlocortattlhe-""""""'I<POC,wh!namon!j>Oci6;..,nage<isrd"-'. 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC000000184 
281 


10417237.eps

Acknowledgements 

1hs docunen- der!Yed i> ~Mh NST Speael P\.Oiicol1011~1. Com!>Uer s.c.rty 1.-tHardrQGide. ~ 

F\Jilcaiion8»61 1- antn:sr-gUdan:e, ll'IOibeoch ..... n....,Ueroeculy""" h C<Ifal>oooliYe-... 

nl.lilly, """"""'""'-~ sP~l • .,..c:oroidotod ....... ..-bf""'"Y'*""""- S'8»61 ihoo.ldbeiEOdaa<ete<""'go.i!eil~oithllis-. 

CONFIDENTIAL TREATMENT REQUESTED BY EQUIFAX INC. EFXCONG·SBC00000018S