1. Purpose
The purpose of this Security Policy is to outline the security practices and procedures implemented at Thanawalla Digital to ensure the confidentiality, integrity, and availability of our information systems and data. This policy is designed to protect against unauthorized access, disclosure, alteration, and destruction of company and customer data.
2. Scope
This policy applies to all employees, contractors, consultants, temporary workers, and other personnel who have access to Thanawalla Digital’s information systems, including all electronic devices, networks, and data owned or operated by Thanawalla Digital.
3. Information Security Objectives
Thanawalla Digital’s information security objectives include:
Protecting the confidentiality of data.
Ensuring the integrity of data.
Maintaining the availability of information systems.
Complying with applicable legal, regulatory, and contractual obligations.
Continuously improving our security practices.
4. Roles and Responsibilities
4.1 Management
Ensure that adequate resources are allocated to implement and maintain this policy.
Regularly review and update security policies and procedures.
Promote a culture of security awareness within the organization.
4.2 Employees and Contractors
Adhere to the security policies and procedures outlined in this document.
Report any security incidents, suspicious activities, or breaches immediately to the IT department or security officer.
Participate in security training and awareness programs.
4.3 IT Department
Implement and maintain security controls to protect the organization’s information assets.
Monitor and respond to security incidents and vulnerabilities.
Perform regular security audits and risk assessments.
Ensure that all systems and software are kept up-to-date with the latest security patches.
5. Access Control
5.1 User Access Management
Access to information systems is granted on a need-to-know basis, following the principle of least privilege.
All users must have unique user IDs and strong passwords.
Multi-factor authentication (MFA) is required for access to critical systems and data.
User access rights are reviewed regularly, and access is revoked promptly upon termination of employment or change of role.
5.2 Physical Access Control
Access to physical facilities, data centers, and sensitive areas is restricted to authorized personnel only.
Physical access logs are maintained and reviewed periodically.
Visitors must be escorted at all times and are not allowed to access sensitive areas without proper authorization.
6. Data Protection
6.1 Data Classification
All data is classified based on its sensitivity and value to the organization.
Sensitive data, such as personal information and confidential business data, is subject to additional protection measures.
6.2 Data Encryption
Sensitive data is encrypted both in transit and at rest using industry-standard encryption methods.
Encryption keys are managed securely and access is restricted to authorized personnel only.
6.3 Data Retention and Disposal
Data is retained only for as long as necessary to fulfill its intended purpose or as required by law.
Data that is no longer needed is securely disposed of through shredding, degaussing, or other approved methods.
7. Network Security
7.1 Network Monitoring
The network is continuously monitored for unauthorized access, unusual activity, and security threats.
Intrusion detection and prevention systems (IDPS) are in place to detect and respond to potential security incidents.
7.2 Firewalls and Security Gateways
Firewalls and security gateways are deployed to protect the network perimeter and internal network segments.
Firewall rules are regularly reviewed and updated to reflect the current security requirements.
7.3 Remote Access
Remote access to the network is restricted to authorized users and devices.
All remote access connections must use secure protocols and VPNs.
8. Incident Response
8.1 Incident Reporting
All security incidents, including data breaches, malware infections, and unauthorized access, must be reported immediately to the IT department or security officer.
A clear and documented incident response plan is in place to manage security incidents.
8.2 Incident Handling
Incidents are handled promptly to minimize the impact on the organization.
Root cause analysis is conducted for all incidents, and corrective actions are taken to prevent recurrence.
8.3 Communication
In the event of a security incident that affects customers or partners, Thanawalla Digital will communicate promptly and transparently to inform affected parties.
9. Training and Awareness
9.1 Security Awareness Training
All employees are required to undergo regular security awareness training to understand the importance of security and their role in protecting the organization’s information assets.
Training covers topics such as phishing, password security, data protection, and incident reporting.
9.2 Ongoing Education
Thanawalla Digital is committed to continuous improvement of security knowledge through ongoing education, training sessions, and updates on the latest security threats and best practices.
10. Compliance and Auditing
10.1 Legal and Regulatory Compliance
Thanawalla Digital ensures compliance with all applicable legal, regulatory, and contractual obligations related to information security and data protection.
10.2 Internal Audits
Internal security audits are conducted periodically to assess the effectiveness of security controls and identify potential vulnerabilities.
Findings from audits are documented, and corrective actions are tracked to completion.
11. Policy Review
This Security Policy is reviewed and updated annually or as needed to reflect changes in technology, legal requirements, or business practices. Employees will be notified of any changes to the policy, and the latest version will be made available on the company’s intranet.
Pamela Thanawalla
Chief Operating Officer