Information Security Policy
Protection of the organization's information, assets and reputation
Purpose
Establish standards and guidelines to protect the organization's information, assets and reputation, ensuring regulatory and contractual compliance and good security practices.
Scope
Applies to all people, processes and technologies involved in the development, maintenance and delivery of the organization's software and technology services (Website, SaaS, Consulting, Support).
Leadership and Governance
- Management actively supports information security, defines roles and responsibilities and ensures adequate resources and training.
- The Board of Directors independently oversees controls and policies, including the involvement of external advisors if necessary.
- All staff and interested parties must comply with the policy; violations lead to proportionate disciplinary action.
Roles and Responsibilities
- Clear, documented roles in: Management, Information Security, IT, Finance, HR and Development.
- Segregation of duties to ensure independence in critical activities.
- Ongoing training and communication of security expectations according to each role.
Compliance and Contracts
- All employees and contractors must sign confidentiality and intellectual property clauses.
- Security responsibilities that remain in force after termination or change of employment are formally defined and communicated.
- Ongoing information security education and training is ensured.
Risk Management and Cybersecurity
- Identify, assess, treat and monitor information risks.
- Integrate cybersecurity risk management into strategic, operational and project decision-making.
- Document risks, mitigation measures and residual risk.
- Periodically review policies, controls and processes in light of legal and regulatory changes and emerging threats.
ISMS Operation (Information Security Management System)
- Maintain documented, up-to-date and accessible policies, standards and procedures.
- Train staff and assess competencies so they can fulfill their roles.
- Document exceptions and deviations with approval from Management and the Security Team.
- Periodically review control activities and adjust them to the needs of the security environment.
Operating Procedures
- Document procedures for critical, new or infrequent activities.
- Specify owners, configurations, information handling, backup, monitoring, maintenance and support contacts.
- Review and update procedures when there are significant changes.
Contact with Authorities and Interested Parties
- Inform Management and authorities of incidents that violate legal, regulatory or contractual rules.
- Maintain regular communication about information security with customers, auditors, partners, the media and internal staff.
- Consider the impact of third parties on structures, roles and responsibilities.
Legislation and Regulations
- Comply with GDPR, CCPA and equivalent local data protection laws.
- Identify and comply with industry-specific regulations.
- Incorporate legal and regulatory changes into the ISMS to minimize legal risks.
Reporting and Confidential Channels
- Periodic meetings to review risks and control performance and update documents.
- Confidential channels for reporting security violations or problems, guaranteeing anonymity or confidentiality.
Monitoring and Review
- Internal audits and periodic reviews of the ISMS to ensure compliance, effectiveness and continuous improvement.
- Identify areas for improvement and implement corrective and preventive actions.
- Management receives regular updates on performance and corrective actions to ensure the ongoing effectiveness of the ISMS.
Continuous Improvement
- Regularly evaluate the effectiveness of the ISMS and make adjustments to improve information security.
- Document findings, actions and results for organizational learning and traceability.