Communications Security Policy
Protection of communications and information transfers
Purpose
Ensure the protection of information during its transmission and transfer, both internally and externally.
Scope
Applies to all communications and data transfers, including email, files, mobile devices and messaging platforms.
Standards
- Encryption: All transfers must use recognized encryption techniques, validated by the information security team.
- Passwords: Encrypted transfers must comply with the company's password policies.
- Information Classification: Information must be classified according to internal policies to ensure adequate protection during transfer.
- Email and Insecure Channels: Transmitting sensitive information through insecure means is prohibited; if email is used, encryption and a password are required.
- Mobile Devices: Only corporate devices with encryption and password protection should be used; the use of personal devices is discouraged.
- File Transfer: Use secure protocols such as SFTP or VPN for sensitive data.
- Monitoring and Review: Regular assessments to ensure compliance and continuous improvement.
Monitoring and Action
- Oversight: The information security team, together with IT, monitors communication and transfer practices.
- Incidents: Any non-compliance is reported immediately; it's investigated and corrected with appropriate measures.