ISMS Policy

Information Security Policy

• Introduction

  At ZenData, we are committed to protecting the confidentiality, integrity, and availability of all information assets entrusted to us by our stakeholders. This Information Security Policy outlines our approach to ensuring effective information security practices across the organization.

• Scope

  This policy applies to all employees, contractors, and third-party users who have access to ZenData Integration's information assets, including electronic data, physical documents, and communication networks.

• Policy Statement

  ZenData is committed to:

  • Confidentiality: Protecting sensitive information by ensuring it is only accessible to authorized individuals.
  • Integrity: Maintaining the integrity of information by preventing unauthorized modification, deletion, or corruption.
  • Availability: Ensuring the availability of information and systems to support business operations.
  • Compliance: Adhering to all relevant laws, regulations, and contractual obligations concerning information security.
• Governance

  ZenData has established a robust governance structure to oversee the Information Security Management System (ISMS). Key roles and responsibilities include:

  • Senior Management: Provides leadership, allocates resources, and ensures that security initiatives align with organizational objectives.
  • Information Security Manager: Develops, implements, and maintains the ISMS, conducts risk assessments, and monitors compliance.
  • Employees: Comply with ISMS policies, report security incidents, and participate in security awareness training.
• Risk Management

  We adopt a risk-based approach to information security, which includes:

  • Risk Assessment: Identifying threats, vulnerabilities, and potential impacts on information assets.
  • Risk Treatment: Implementing controls to mitigate or eliminate identified risks, balancing cost-effectiveness and business requirements.
  • Risk Monitoring and Review: Continuously reviewing and updating risk assessments to account for internal and external changes.
• Information Security Controls

  ZenData implements a wide range of security controls to protect information assets, including but not limited to:

  • Access Control
  • Encryption
  • Network Security
  • Incident Response and Management
  • Business Continuity and Disaster Recovery
  • Supplier and Third-Party Risk Management
  • Personnel Security
• Compliance

  We ensure compliance with applicable laws, regulations, and contractual obligations, including:

  • Data Protection and Privacy Laws
  • Industry Standards and Best Practices
  • Customer and Supplier Contracts
  • Internal Policies and Procedures
• Training and Awareness

  ZenData provides ongoing training and awareness programs to ensure that all employees, contractors, and third-party users understand their information security responsibilities. Training includes:

  • Security policies and procedures
  • Recognizing and reporting security threats and incidents
  • Data handling and protection guidelines
• Incident Management

  We have established clear procedures for reporting, investigating, and responding to security incidents:

  • Incident Reporting: Employees must promptly report suspected or actual security incidents.
  • Incident Investigation: The Information Security team investigates the cause and impact of incidents.
  • Incident Response: Predefined response plans ensure that security incidents are mitigated and normal operations are quickly restored.
• Continuous Improvement

  We are committed to continuously improving the ISMS through:

  • Periodic audits and reviews
  • Monitoring and measuring security control performance
  • Implementing lessons learned from incidents and near misses
  • Incorporating stakeholder feedback to enhance security policies and procedures

Conclusion

This Information Security Policy reflects ZenData Integration's commitment to protecting its information assets and maintaining high security standards. All employees, contractors, and third-party users are expected to adhere to this policy to help safeguard sensitive information.

Policy Review and Revision

This policy will be reviewed regularly to ensure its relevance and effectiveness. Any changes will be communicated to relevant stakeholders, and employees will be trained accordingly.