LexisNexis® Risk Solutions Cloud Transformation

LexisNexis Risk Solutions is moving its applications and infrastructure from two data centers to the Microsoft® Azure cloud.

The benefits of our migration to Microsoft Azure include enhanced speed, elasticity/scalability, resiliency and more comprehensive disaster recovery solutions for our products. The agility that a cloud environment provides will help us increase our speed to market for new products and services and drive further innovation into our platforms.

The cloud enables benefits that traditional data center solutions are not capable of offering. Moving to the cloud allows us to deliver these added benefits for your business:

• Dynamic Scalability: Our services will perform consistently, regardless of load.
• Product Innovation: The cloud allows for rapid product prototyping, faster feature deployments and better alignment between our customers and our technology.
• Business Agility: Our business can respond faster and better to meet your business and market needs.
• Improved Security Posture: Provides the ability to perform continuous patching and allows for improved encryption protocols.

The project will take place in a phased manner between now and Q3 2024. We’re committed to ensuring a smooth transition for our customers every step of the way.

Any action required by our customers will be communicated in advance with additional information and support. Our goal is to make this process as seamless as possible. We will continue to keep customers aware of any changes or preparations that they need to make.

The actions required will vary based on your connectivity and the LexisNexis Risk Solutions products and platforms you access. You will be required to do some or all of the following:

All Customers will take the following actions:

• Add platform URLs and/or new IP ranges to firewalls: LexisNexis Risk Solutions highly recommends adding URLs to your existing firewall rules in lieu of IP additions, however, this capability may not be available for every customer. Refer to question five for more details about IP ranges.
• Make Batch Changes: All batch transfers will utilize SFTP or HTTPS with PGP encryption over the secured public internet. Customers accessing an SFTP site will need to redirect to a new endpoint URL and obtain new passwords. Additional communications will be delivered in Q3 of this year and our batch support teams will be available to assist every step of the way.
• Security and Documentation: We encourage you to initiate any internal review processes and submit questionnaires to LexisNexis Risk Solutions for completion.

Some customers will be required to take the following additional steps. You will be contacted with additional instruction if these steps are required for your organization.

• Change Domain Names from LexisNexis.com to LexisNexisRisk.com for certain applications. Additional specific communications will be delivered, and our teams will be available to support you in these changes.
• Upgrade your system-to-system connectivity to web services over the secured public internet. You will receive specific communications and we will work hand in hand with your teams on any changes needed.
• Update some Security Certs to maintain successful SSL connectivity.

Customers with IP restrictions, firewalls or proxies in place will need to add new IP ranges to their allowed lists. If you use IP firewalls, locate where you have those existing rules in place and add these additional ranges:

• Subnet IPv4 – 198.62.62.0/23
• Subnet IPv4 – 69.84.182.0/23 – NEW RANGE ADDED as of June 2022
• Subnet IPv6 – 2620:100:403e::/47

Please contact your Support team for information about validating your connections.

Validation environments may be available for some product delivery platforms. If they are available, details about when those environments will be live and how to access them will be provided in advance of any cutovers or redirects.

Traffic redirects to the Azure cloud environment will be completed by the delivery platform and will take place only after our clear and timely communication to customers.

Microsoft ensures the highest levels of information security within their cloud environment leveraging decades of enterprise software experience to implement and continuously improve security-aware software development, operational management and threat-mitigation practices essential to continuously maintaining a secure cloud environment.

We continuously engage with Microsoft to leverage their security capabilities to complement our overall security posture as we transition to the cloud. Microsoft’s tools and technologies help us analyze threats in real-time, identify and react to suspicious user and device activity on our network, and provide multiple levels of access security.

LexisNexis Risk Solutions will continue to collect, use and distribute personal information in accordance with our customer agreements and applicable laws. LexisNexis Risk Solutions does not disclose any customer data to government or law enforcement unless required by law.

We consistently implement controls to enforce any geographic restrictions and requirements currently in practice, such as GLBA, FCRA, HIPAA and DPPA. These practices will be carried over to the cloud environment

LexisNexis Risk Solutions will no longer run our own data centers as they will be hosted within Microsoft Azure. For this reason, data center visits are not applicable in a cloud-based environment.

LexisNexis Risk Solutions will implement all necessary redundancy to meet the current requirements of high availability and disaster recovery while in the cloud.

In the likelihood that we experience some impact due to an unplanned spike, cloud-based services will allow us to respond to these unexpected changes more quickly than our current configuration allows.

In 2023, LexisNexis Risk Solutions teams met with the Microsoft team to learn more about Microsoft’s approach to security and compliance in the Microsoft Azure environment and the partnership between both organizations. These presentations were recorded so they could be shared broadly and provide insight into Microsoft best practices. The Microsoft team gave four different presentations:

• Privacy: A Microsoft Security and Compliance Architect explains how Azure systems are structured, and provides an overview of data protection practices, security controls and privacy attestations.
  View video here.
• Physical Security: Microsoft operates more than 100 different types of physical data centers all around the world. In this session, a Microsoft Security and Compliance Architect provides LexisNexis Risk Solutions with an overview of Microsoft’s physical security practices, including perimeter security, fire suppression, multi-factor authentication and extensive monitoring.
  View video here.
• Security Practices: A Microsoft Security and Compliance Architect for Microsoft, outlines the core tenets of Azure security, best practices for securing the Azure platform and how creating a secure environment is a shared responsibility between LexisNexis Risk Solutions (the "you" in this presentation) and Microsoft.
  View video here.
• Compliance: Microsoft Azure has the deepest and most comprehensive compliance coverage in the industry. In this session, a Microsoft Security and Compliance Architect provides insight into the Microsoft Azure compliance responsibility model and how they meet regulatory and compliance standards.
  View video here.