Predix Platform Security

At the moment that data leaves an asset, ensuring its availability, validity, and
integrity is of primary concern. Predix Platform is secure by design. Built with
defense-in-depth across every layer, and continuously monitored, Predix Platform
security addresses the security of the platform itself, the applications it powers, the
software development process, and the security of data that flows through the
platform. Predix Platform provides capabilities such as two-party encryption and
supports end-to-end chain of custody reporting for code and data.

8
Security and Compliance at Every level

Secure support

Predix platform and applications support a wide range of industry, regional, privacy
and data governance regulations, and our security practices encompass perimeter
security, data security, and access control

Secure platform and applications

GE's secure development lifecycle (SDLC) framework includes tools, security-related

guidelines, and processes that help to secure Predix Platform-powered applications
and  services during the development process.

9
Governance, compliance, and certification

GE Digital's holistic approach comprises international standards, security controls

from vertical markets, and regional variations. Predix Platform helps to ensure that an
organizations fine grained controls (specific to geography or industry) are in place,
validated, and audit-ready. This removes the cost for an organization to design and
build their own security controls. Predix Platform is built on a common infrastructure
governance model based on ISO 27001/2, NIST 800-53, and FIPS 140-2.

Continuous monitoring and incident response

Predix Platform is continuously monitored by security analysts for anomalies and
suspicious events that may require incident response. GE Digital’s Incident Response
Program, including on-going training, table-top exercises, pen testing, and
vulnerability management, is enhanced by its threat intelligence program. Predix
Platform incident responders handle end-to-end coordination with stakeholders for a
swift, deterministic incident response from incident notification, investigation,
forensics, and close-out.

10