MPAA Site Security Program - Fight Film Theft

1 MPAA site Security Program CONTENT Security BEST PRACTICES. COMMON guidelines . Version May 15, 2011. MPAA site Security Program May 15, 2011. D OCUMENT H ISTORY. Version Date Description Author December 31, 2009 Initial Public Release Deloitte & Touche LLP. MPAA. MPAA Member Companies May 15, 2011 Updates and Revisions PwC LLP. Consolidation into Common guidelines and MPAA. Supplementals MPAA Member Companies MPAA Best Practices - Common guidelines Page i MPAA site Security Program May 15, 2011. T ABLE OF C ONTENTS. I. Best Practices Overview .. 1. II. Facility Overview .. 2. III. Risk Management .. 3. IV. Document Organization .. 4. V. Best Practices Format .. 5. VI. Best Practice Common guidelines .. 6. Appendix A 48. Appendix B MPAA Title and Distribution Channel Definitions.

2 51. Appendix C Mapping of Controls to References .. 53. Appendix D Frequently Asked Questions .. 57. Appendix E Suggested Policies and Procedures .. 58. Appendix F Other Resources and References .. 59. Appendix G Reporting Piracy to the MPAA .. 60. MPAA Best Practices - Common guidelines Page ii MPAA site Security Program May 15, 2011. I. B EST P RACTICES O VERVIEW. Introduction Purpose and Applicability For more than three decades, the Motion Picture Association of The purpose of this document is to provide current and future third America, Inc. (MPAA) has managed site Security surveys on behalf party vendors engaged by Members with an understanding of of its Member Companies (Members): Walt Disney Studios Motion general content Security expectations and current industry best Pictures; Paramount Pictures Corporation; Sony Pictures practices.

3 Decisions regarding the use of vendors by any particular Entertainment Inc.; Twentieth Century Fox Film Corporation; Member are made by each Member solely on a unilateral basis. Universal City Studios LLC; and Warner Bros. Entertainment Inc. Content Security best practices are designed to take into Starting in 2007, these reviews were performed using a consideration the services the facility provides, the type of content standardized survey model, process and report template. Since the facility handles, and in what release window the facility then, over 300 facilities have been surveyed in 32 countries. operates. The MPAA is committed to protecting the rights of those who create Best practices outlined in this document are subject to local, state, entertainment content for audiences around the world.

4 From regional, federal and country laws or regulations. creative arts to the software industry, more and more people Best practices outlined in this document, as well as the industry around the globe make their living based on the power of their standards or ISO references contained herein, are subject to ideas. This means there is a growing stake in protecting intellectual change periodically. property rights and recognizing that these safeguards are a cornerstone of a healthy global information economy. Compliance with best practices is strictly voluntary. This is not an accreditation Program . The MPAA site Security Program s purpose is to strengthen the process by which its Member content is protected during Exception Process production, post-production, marketing and distribution.

5 This is accomplished by: Where it may not be feasible to meet a best practice, facilities should document why they cannot meet the best practice and Publishing a set of best practices by facility service outlining implement compensating measures used in place of the best standard controls that help to secure Member content; practice. Exceptions should also be communicated directly to the Assessing and evaluating content Security at third-party Member. partners based on published best practices;. Questions or Comments Reinforcing the importance of securing Member content; and If you have any questions or comments about the best practices, Providing a standard survey vehicle for further individual please email: discussions regarding content Security between Member and their business partners.

6 MPAA Best Practices - Common guidelines Page 1. MPAA site Security Program May 15, 2011. II. F ACILITY O VERVIEW. The following table describes the typical services offered, content handled and release window involved with each facility type. No. Facility Typical Facility Type of Content Release No. Facility Typical Facility Type of Content Release Type Services Window Type Services Window 1 Audio, Original and Foreign Low-Resolution Pre-Theatrical 7 DVD Compression Clean Full Feature Pre-Home Dubbing and Language Dubbing Watermarked/Spoiled Pre-Home Creation Authoring Video Sub-Titling Subtitling Full/Partial Feature Video Encoding SFX Content Regionalization Scoring Audio Masters Special Features ADR/Foley Check Disc QC. 2 Courier, Courier Services Varied Pre-Theatrical 8 Film Negative Processing Clean Full Feature Pre-Theatrical Delivery and Delivery Services Pre-Home Lab Cutting Freight Shipping Companies Video Release Prints Catalog In Flight IFE Lab High-Resolution Full or Pre-Theatrical 9.

7 3 Creative Non-Finishing Watermarked, Spoiled Pre-Theatrical Entertainment IFE Integration Partial Content Pre-Home (IFE) and Advertising Trailer Full/Partial Feature Pre-Home Hotel Spoiled Full or Partial Video Hospitality TV Spots Content Video Services Airline Content Catalog Teasers Stills Catalog Cruise Ship/Ferry Graphics Clips Libraries Web Ads Hospitals 4 Digital Digital Cinema High-Resolution Full or Pre-Theatrical Prisons Cinema Mastering Partial Content 10 Post- Telecine High-Resolution Full or Pre-Theatrical Replication Digital Cinema Distribution Production Duplication Partial Content Pre-Home Key Management Masters Services Editing Video Digital Cinema Packages Finishing Catalog 5 Digital Digital Intermediate Clean and High Pre-Theatrical QC.

8 Services Scanning Resolution Full or Partial Catalog 11 Replication Pre-Mastering High Resolution Pre-Home Film Recording Content (Film Tape) Mastering Clean Image Video Film Restoration Replication 6 Distribution Distribution High Resolution Pre-Theatrical Check Disc Creation Fulfillment Clean Image Pre-Home 12 Visual Digital Post- High-Resolution Partial Pre-Theatrical Backroom/Film Depot Video Effects Production Frames, Shots, Post- DVD/Tape Recycling Catalog (VFX) Computer Generated Sequences and Stills Theatrical (2D. Imagery Scripts to 3D). Animation Storyboards MPAA Best Practices - Common guidelines Page 2. MPAA site Security Program May 15, 2011. III. R ISK M ANAGEMENT. Risk Assessment In consultation with the Member (its client), an organization is Risks should be identified through a risk assessment, and responsible for determining which client assets require a higher appropriate controls should be implemented to decrease risk to an level of Security .

9 The following table provides an example of how to acceptable level and ensure that business objectives are met. classify content: The International Organization for Standardization (ISO) 27000. defines risk as the "combination of the probability of an event and Classification Description Examples its consequence." For example, what is the probability that content High- Security Any content that the Theft of a blockbuster can be stolen from a facility s network and released publicly and Content organization believes feature before its first what is the business consequence to an organization and the client would result in worldwide theatrical if this occurs ( , contractual breech and/or loss of revenue for financial loss, release that release window).

10 Negative brand Theft of home video The importance of a robust management system is also highlighted reputation, or serious content before its first in the ISO 27001 standard that shows how to establish an penalties should the worldwide street date Information Security Management System (ISMS). asset be stolen or Theft of masters or leaked screeners Asset Classification Additional information about risks generally associated with each One way to classify assets at your facility is to follow a four-step facility type is also included in each supplemental best practice. process, which is summarized below: Security Controls Identify and The IT Governance Institute defines controls as the policies, Classify Assets procedures, practices and organizational structures designed to provide reasonable assurance that business objectives will be Monitor and Determine achieved and undesired events will be prevented or detected and Evaluate Minimum Security corrected.