Purpose and scope
Cloud Legion’s Information Security Policy sets out measures to preserve the confidentiality, integrity and availability of information, the three basic components of information security, and defines the requirements for protecting the information, equipment and technology services that support our business processes.
It is the cornerstone of Cloud Legion’s Security Framework: the set of rules, standards, procedures and guides that develop it. It is part of the scope of our Information Security Management System (ISMS), certified under ISO/IEC 27001, and covers all Cloud Legion information, whatever its form, the medium that holds it, who accesses it or where it is located.
Principles
- Strategic scope: information security has the commitment of every level of management and is integrated with our other strategic initiatives.
- Comprehensive security: it is a process that covers technological, human, material and organizational elements, present in the design, development and maintenance of systems.
- Risk management: risk analysis and management keep a controlled environment, reducing risks to acceptable levels with measures that balance impact, likelihood, effectiveness and cost.
- Proportionality: protection, detection and recovery measures are proportional to the risks and to the criticality and value of the information.
- Continual improvement: measures are periodically assessed and updated, and security is reviewed and audited by qualified staff.
- Security by default: systems are designed and configured to provide a sufficient level of security from the start.
These principles follow ISO/IEC 27001 good practice, current personal data protection legislation and the information security regulations that apply to Cloud Legion. All staff must know, understand and accept this policy.
Management commitment
Aware of the importance of information security to its business objectives, management commits to:
- Promote information security roles and responsibilities across the organization.
- Provide adequate resources to achieve the information security objectives.
- Promote awareness of this policy among team members.
- Require compliance with the policy, current legislation and regulators’ requirements.
- Take information security risks into account in decision-making.
Security organization
Cloud Legion has a designated officer responsible for defining, implementing and monitoring cybersecurity and information security measures, independent of operational areas and reporting to the board and the Cybersecurity Committee. Their duties include applying segregation of duties, maintaining contact with authorities and special interest groups, and keeping this policy up to date. Every ISMS policy is assessed by the Cybersecurity Committee and approved by senior management.
People
- Security requirements apply before hiring, during employment and when it ends.
- All staff receive regular information security training and awareness, with a particular focus on confidentiality and preventing information leaks, and are informed of updates to policies and procedures.
- We apply a clear desk and clear screen policy: sessions are locked when leaving the workstation (manually and automatically), and documents and media are kept out of sight, with confidential ones under lock and key.
Information management and classification
The information assets needed for our processes are identified and inventoried, and each has an owner responsible for its classification and protection throughout its life cycle: creation or collection, distribution, use, storage and secure destruction once the retention periods set by legal, regulatory and business requirements have expired.
Information is classified into four levels according to its sensitivity:
- Public
- Can be shared inside and outside the organization without risk.
- Internal
- For use by members of the organization.
- Confidential
- Sensitive information, with additional protection measures and limited access.
- Strictly confidential
- Critical information, with access restricted to senior management or defined groups and least privilege.
Information is labeled and handled according to its classification, and privileged information is safeguarded throughout its life cycle. Backups of information, software and systems are automated, with cloud redundancy, and verified periodically.
Information leak prevention
We analyze possible leak vectors according to the criticality and classification of each asset, and define procedures to prevent leaks and to respond to a reported leak. This covers, among other things, removable and mobile devices, email, Internet use, printing and taking documents off-site, and unattended equipment.
Access control and identities
- All information systems have logical and physical access control.
- Accounts are personal and are not shared; service accounts require authorization from the Cybersecurity Committee.
- Access is granted by role, on a need-to-know basis, with least privilege and segregation of duties.
- Multi-factor authentication (MFA) is used wherever possible and is mandatory for systems reachable from public networks.
- A password policy aligned with good practice is known to all staff.
- The identity life cycle (creation, periodic review, modification and removal) is aligned with Human Resources processes.
- Privileged access is granted through a formal authorization process, logged, set to expire and reviewed regularly.
- Remote work is carried out over secure connections and from devices that meet minimum security requirements.
Physical and environmental security
Our operation is distributed, so each team member is responsible for the physical security of the devices authorized to access information, and must report theft or loss immediately so the device can be locked or wiped remotely. Paper information is kept in locked cabinets.
Cloud, operations and communications
- We maintain a cloud working policy with security measures suited to each service model (infrastructure, platform or software), including evidence of providers’ security.
- Systems that process or store our information have monitoring, change control and periodic reviews.
- We apply prevention, detection and response measures to communications, with additional controls for sensitive data travelling over public networks.
Secure development
The acquisition, development and maintenance of systems include security requirements in line with industry good practice, together with test management, change tracking and software inventory.
Suppliers
We assess the criticality of outsourced services and, for those relevant to security, take care over selection, contractual requirements, service level monitoring, data return and the supplier’s security measures, which must be at least equivalent to those in this policy.
Incident management
All team members must report to the security officer any incident that could compromise information assets. We have a response procedure that defines how incidents are categorized, their impact analyzed and escalated.
Business continuity
We maintain a Business Continuity Plan and a Disaster Recovery Plan, which are updated and tested periodically, and we train staff in their use.
Compliance, audits and vulnerabilities
We provide the resources needed to comply with the information security laws and regulations that apply to us. We periodically identify technical vulnerabilities in our systems and applications and remediate them with a risk-based approach, according to each asset’s criticality and exposure.
Exceptions and non-compliance
Every exception to this policy is recorded, reported to the information security officer and analyzed according to the risk it introduces. Non-compliance may lead to disciplinary action under the internal process, and all team members must report any situation that may amount to non-compliance. Anyone can confidentially report possible security or privacy violations to grc@cloudlegion.com.ar.
Review
This policy is reviewed and approved annually by the Cybersecurity Committee, and also whenever there are relevant changes in the organization or in the threat, legal, regulatory or contractual environment.