FAQ

Symetra has enacted security protocols for both employees and customers to prevent unauthorized access.

Our employees

• Strong employee password standards for length, complexity and required password changes.
• Two-factor authentication requirements for privileged account access.
• Monitoring of suspicious incoming email, calls and correspondence to detect and prevent fraud.
• Constant monitoring of infrastructure, network and systems to identify and respond to potential threats.
• Need-to-know-only access restrictions for systems and customer data.
• Software vulnerabilities identified and mitigated on a regular basis.
• Cybersecurity threat drills identify strengths and opportunities for improvement.
• Standards of ethical behavior and protocols for annual refresher training. High standards of ethical behavior are set and enforced. Protocols exist for reporting violations.
• Privacy training at time of hire and annually thereafter. You can read our privacy statement here.
• Annual information security training for all associates.
• Internal and external audits to review and assess security and technology controls and business operations.
• Segregation of Duties (SOD) assessments to prevent conflicts of interest and manage risks.
• Vendor reviews to ensure compliance with industry data security standards.
• Business continuity, IT disaster, and resilience plans to address recovery from disruptions, failures or disasters. You can review our Business Continuity Statement for additional detail.

Our customers

• Identity verification required before account access is granted by phone or online.
• Unique user name and passwords required for account access. Passwords must employ a mix of numbers, upper and lower case letters, and special characters.
• Customers may be prompted to answer security questions when attempting to log in from a new device.

Multiple layers of security are in place to strengthen protection of your data. Here are some of the key ways we use technology to keep information safe.

Our systems

• Antivirus solutions to detect and prevent malicious code.
• Email filtering to block spam, phishing and malicious content.
• Firewalls to protect the network and systems from unauthorized access.
• Geographic IP address content filtering to block connections from known bad actors or foreign sourced locations.
• Employee device encryption to protect data in the event of loss or theft.
• Intrusion detection and data leakage systems to diminish the risk of incoming attacks.
• Restricted physical access to offices, data centers and other buildings.
• Scheduled data and system backups to ensure preservation of systems and customer information.

Customer devices

• Online account access is encrypted using 128-bit, two-way data encryption.
• Current web browsers with industry-accepted encryption protocols are required for account access.
• Customers are automatically logged out after a period of inactivity to secure account information.