The key controls operated by the Group IT division include, but are not limited to: � threat protection such as network and application firewalls, anti-virus and patching; � threat detection including vulnerability management, penetration testing and security monitoring; � identity access management and specifically privileged access control and email verification, e.g. SPF; � disaster recovery test coordination for data centre facilities, major offices, local offices and recovery sites; � security incident response; and � global data centre facility is ISO 3402 assurance report. 64 Rothschild & Co | Corporate Responsibility Report 2020 A.3.