DivisionCero

Terms and Conditions for Employees

T&Cs for employees organized according to Kudo's eight cybersecurity domains

Purpose

Establish the operational conditions every employee must accept and comply with, organized according to the eight domains of the Kudo framework, so that each area of the organization can require from employees what corresponds to its risk domain.

Scope

Applies to every employee onboarded in accordance with the Talent Acquisition Procedure. An employee is only subject to the domains relevant to the position they hold.

COR - Organizational Coherence

  • The employee accepts the ISMS policies that apply to them and the statements made during their onboarding process.
  • They must report personal or third-party situations that create a conflict of interest with their position.
  • They cooperate with the audits, self-assessments and compliance checks the organization carries out on their role.

CAP - Application Cybersecurity

  • If they develop or maintain software, APIs or integrations for the organization, they must follow the secure development lifecycle (SDLC) practices defined in the Secure Development Policy.
  • They must declare the third-party and open-source components used, and remediate critical or high vulnerabilities identified before deployment.
  • They must report vulnerabilities discovered in the organization's systems or applications while performing their duties.

CIP - Identity and Endpoint Cybersecurity

  • The employee uses individual, non-shared credentials and activates their secure first access according to the current procedure.
  • Remote access to the organization's systems requires multi-factor authentication (MFA).
  • They're responsible for the proper use of the equipment and devices assigned to them, and immediately report their loss, theft or compromise.

CIF - Infrastructure Cybersecurity

  • Employees with access to cloud infrastructure or servers comply with the secure configuration standards defined by the organization.
  • They don't share the organization's confidential information on unauthorized storage or messaging services.
  • They respect environment segmentation and the access restrictions of their role.

THP - Human Talent and Vendors

CCN - Business Continuity and Change

  • The employee knows and carries out their role within the Business Continuity Plan when their position requires it.
  • They give reasonable advance notice of absences or changes that may affect the continuity of processes under their responsibility.
  • They follow the change and configuration management procedures before modifying production systems.

ADR - Cybersecurity Analysis, Detection and Response

  • The employee reports any security incident, suspicious event or vulnerability they become aware of within 24 hours of detecting it.
  • They cooperate with the Information Security team in investigating incidents involving their role or access.
  • They don't hide, alter or delete evidence related to an ongoing incident.

DIA - Data and Artificial Intelligence Cybersecurity

  • The employee processes personal data in accordance with applicable regulations and solely for the purposes of their position.
  • They don't enter the organization's confidential information or personal data into unauthorized artificial intelligence tools.
  • They classify and protect information in accordance with the Asset Management Policy.

Acceptance and Validity

Accepting these Terms and Conditions is a prerequisite for onboarding the employee and is formalized together with the employment contract. They remain valid for as long as the employment relationship, and the confidentiality and intellectual property obligations survive its termination.

Monitoring and Review

These terms are reviewed annually together with the Human Resources Security Policy and upon changes to the Kudo framework domains.

Employee Clauses

Mandatory contractual information security clauses applicable to employees

Awareness Procedure

Communications plan, talks, phishing campaigns and validation checklists for the Awareness Program

On this page

PurposeScopeCOR - Organizational CoherenceCAP - Application CybersecurityCIP - Identity and Endpoint CybersecurityCIF - Infrastructure CybersecurityTHP - Human Talent and VendorsCCN - Business Continuity and ChangeADR - Cybersecurity Analysis, Detection and ResponseDIA - Data and Artificial Intelligence CybersecurityAcceptance and ValidityRelated DocumentsMonitoring and Review