POL00029591
POL00029591
Message
From: Steve Allchorni
on behalf of — Steve Alichorn {_ .
Sent: 05/06/2013 11
To: Alwen Lyons }
Subject: FW: Second Sight Info
Importance: High
Alwen
Further email request from me to Pete Newsome following some initial control documents he sourced and sent through.
Steve
From: Steve Allchorn
Sent: 05 June 2013 12:41
Newsome Pete’
imon Baker; Davidson James; x.bill. membery
Subject: RE: Second Sight Info
Importance: High
Pete — thanks very much for sending through some preliminary information quickly.
Can I just reiterate that although these documents are both relevant and additional information, what we require are
some clear statement of facts in response to lan’s key questions raised below.
Can you ensure that each of lan’s points are provided with a response. These will then collectively assist Second Sight in
determining the viability of the allegations set out in the Spot Review.
Alwen Lyons is keen to get a further meeting set up early next week therefore an urgent response to each of the
questions would be greatly appreciated and by the end of this week at the latest please.
Thanks
Steve
Sent: 04 June 2013 15:
To: Steve Allchorn
Cc: Simon Baker; Davidson James; x.bill.membery
Subject: FW: Second Sight Info
Steve
The audit report above describes the separation and controls around the test and live systems. Bill is also going to
provide the SLD and HLD which will show that the live system in not accessible from the basement in Bracknell, i.e. the
member of staff in question can only have been talking about the test system. At the time indicated the system on test
was the as yet brand new HNGx release 1 so there was no live instance available.
Hope this helps.
Pete
Pete Newsome
POL-0026073
POL00029591
POL00029591
Business Change Manager
Fujitsu UK&l
onment - do you really need to print this email?
= Please consider the envire
From: Membery Bill
Sent: 04 June 2013 11:55
To: Newsome Pete
Subject: RE: Second Sight Info
Hi Pete
Yes the best report is the ISAE3402 report which shows change Management in section 4.9.9 the Technical segregation
of Test and Live is also documented across various sections.
PO Ltd also have copies of their PCL DSS Annual report and Link report that both review these Topics unfortunately as
these reports are PO Ltd’s IPR we do not get these (Mark Pearce is best Contact here)
Omniport the IRM Audit review tool actually stores the PCI DSS Auditors findings and Raj Patel and Security Operations
have access to print these out with PO Ltd’s permission.
The [SO 27001 standard to which we are accredited reviews this when it is selected as a topic area by the Auditors I have
attached the Schedule of the last Audit where you can see they covered Change Management.
can extract all earlier reports if required as well as others from Business assurance.
In addition to this PO Ltd have ensured Penetration Tests for PCI have taken place and as part of the approval process
for the change to Horizon.
{have attached the one from Horizon to HNG-X, Dave King at PO Ltd should have those instigated by PO Ltd again as.
they are PO Ltd’s IPR. ( I might have unofficial copies)
Kind Regards
Bill Membery
Quality and Compliance Manager
POA
Fujitsu
Unit 1-4
Raglan Court
Clayton Road
Risley
Warrington
Cheshire
WAS 6SZ
toy
{>
fi (
Fujitsu is proud to partner with Shelter, the housing and homeless charity
Reshaping ICT, Reshaping Business in partnership with FT.com
POL-0026073
POL00029591
POL00029591
From: Newsome Pete
Sent: 04 June 2013 10:17
To: Membery Bill
Subject: Second Sight Info
Bill
As a result of our meeting yesterday with PO we need to be able to show how the Test and Live environments are
separated both physically and in terms of access and process.
Do you have any documentation as part of the audits around change?
I will give you a call.
Pete
Pete Newsome
Business Change Manager
Post Office Account, Fujitsu UK&l
wa Please consider the environment - de you really nee
Unless otherwise stated, this email has been sent from Fujitsu Services Limited, from Fujitsu (FTS) Limited, or
from Fujitsu Telecommunications Europe Limited, together "Fujitsu".
This email is only for the use of its intended recipient. Its contents are subject to a duty of confidence and may
be privileged. Fujitsu does not guarantee that this email has not been intercepted and amended or that it is virus-
free.
Fujitsu Services Limited, registered in England No 96056, registered office 22 Baker Street, London W1U
3BW.
Fujitsu (FTS) Limited, registered in England No 03808613, registered office 22 Baker Street, London W1U
3BW.
PFU Imaging Solutions Europe Limited, registered in England No 1578652, registered office Hayes Park
Central, Hayes End Road, Hayes, Middlesex, UB4 8FE.
Fujitsu Telecommunications Europe Limited, registered in England No 2548187, registered office Solihull
Parkway, Birmingham Business Park, Birmingham, B37 7YU.
POL-0026073