Information Security Policy and Cybersecurity Measures

1. Introduction

At [Company Name] (hereinafter “the Company”, “we”, “us”, or “our”), we recognize that information security is essential to the protection of our customers’ sensitive data and the integrity of our business. This Information Security Policy sets out the guidelines and measures adopted by the Company to ensure the protection of the confidentiality, integrity and availability of information, in compliance with current regulations, including the obligations of the General Data Protection Regulation (GDPR).

2. Objective

The objective of this Policy is to establish a framework for:
  • Protect the sensitive and personal data of our customers, employees and business partners.
  • Ensure the continuity of the Company's operations.
  • Comply with legal and contractual regulations related to information security.
  • Reduce risks related to unauthorized access, loss, alteration or destruction of information.
  • Ensure that all employees and third parties with access to Company information understand and comply with security standards.
    •

    3. Scope

    This Policy applies to all employees, contractors, consultants and third parties who access or process information on behalf of the Company. It covers all information processed on the Company's systems, whether in digital or physical format, including personal data of clients, information on stock portfolios and any other sensitive data.

    4. Information Security Principles

    The Company undertakes to follow the basic principles of information security:
  • Confidentiality: Only authorized persons will have access to confidential or sensitive information.
  • Integrity: Information will be accurate and complete, and will be protected against unauthorized alterations.
  • Availability: Information will be available when needed for its legitimate use, minimizing the risks of service interruption.
    •

    5. Cybersecurity Measures

    In order to comply with the principles of information security, the Company adopts the following cybersecurity measures:
    5.1. Access Control
    By using our Service, you agree to the following:
  • Authentication and Authorization: Access to Company systems will be controlled through robust authentication mechanisms, such as strong passwords, two-factor authentication (2FA), and role-based controls to ensure that only authorized personnel can access sensitive information.
  • Password management: Passwords must be complex (at least 8 characters, combining letters, numbers and symbols) and must be changed periodically. The use of default passwords is not permitted.
  • Least privilege policy: Access to systems and data will be limited according to the principle of least privilege, where users will only be able to access the information they need to do their job.
    •
    5.2. Protection of Personal Data
  • Data Encryption: Sensitive information and personal data will be encrypted both in transit (using SSL/TLS) and at rest (with AES encryption or other equivalent mechanisms). This will ensure that data is protected against unauthorized access.
  • Anonymisation and pseudonymisation: Where possible, we will use techniques to anonymise or pseudonymise personal data, reducing the risks in the event of a data breach.
  • Retention Policy: Personal data will be retained only for the time necessary to fulfill the purposes for which it was collected, in compliance with our Privacy Policy. Once the period has elapsed, the data will be securely deleted or anonymized.
    •
    5.3. Network and Systems Security
  • Firewalls and Intrusion Detection Systems (IDS): We will implement firewalls and intrusion detection systems to protect our systems from unauthorized access and network attacks.
  • Updated software: All systems and applications will be updated regularly to ensure they have the latest security patches.
  • Network Segmentation: Network segmentation practices will be used to isolate critical systems from less sensitive systems, thereby reducing the attack surface in the event of an intrusion.
  • Backups: We will perform regular backups of key data and critical systems, ensuring they can be restored in the event of a security incident. Backups will be encrypted and stored in secure locations.
    •
    5.4. Monitoring and Incident Response
  • Continuous monitoring: We will implement continuous monitoring tools to detect unusual activities or potential threats. This includes access logs and relevant event logs.
  • Incident Response Policy: We will establish a clear security incident response protocol, including incident identification, containment, eradication, recovery, and reporting. Each incident will be analyzed to improve prevention of future risks.
  • Notification of security breaches: In the event of a security breach affecting personal data, we will notify the relevant authorities and affected individuals within the time periods established by law (GDPR establishes a maximum of 72 hours from detection).
    •
    5.5. Training and Awareness
  • Ongoing training: All employees and contractors will receive regular training on information security and cybersecurity best practices, including topics such as preventing phishing attacks, secure information handling, and incident response.
  • Acceptable Use Policy: Each employee will sign and comply with an Acceptable Use Policy for Company systems, which outlines responsibilities and permitted use of technology resources.
    •

    6. Security Risk Management

    The Company will conduct periodic risk assessments to identify potential threats to information security and to evaluate the effectiveness of the security measures implemented. Based on these assessments, decisions will be made on improving security controls or implementing new procedures.

    7. Legal and Regulatory Compliance

    We are committed to complying with all applicable information security regulations and legislation, including the General Data Protection Regulation (GDPR). Should any regulations change, this Policy will be reviewed to ensure continued compliance.

    8. Audits and Control

    The Company will periodically conduct internal and external audits to ensure compliance with information security standards and policies. These audits will verify compliance with the Information Security Policy, cybersecurity controls and internal procedures.

    9. Policy Violations

    Any violation of this Information Security Policy will be treated seriously and may result in disciplinary action, including termination of employment or contract, depending on the severity of the violation. In addition, violations involving illegal activities may be reported to the appropriate authorities.

    10. Review and Update of the Policy

    This Policy will be reviewed and updated annually or when necessary, based on changes in regulations, emerging risks and the needs of the Company. Any changes will be communicated to all employees and collaborators.

    11. Contact

    For any questions or queries regarding this Information Security Policy, you can contact the information security officer using the contact form.
    Contact US

    Contact laptop charging with a professional

    Any question or remark? just write a message