Actonic Products GmbH Information Security Policy was compiled in accordance with ISO27001 Information Security Management System standard. The Policy outlines a systemic approach to the process of managing sensitive third-party data and information in relation to the Actonic Products family of products.
Note that the term “data” is used in this document to indicate both data (plural and singular), as well as the information that data represents.
The objective of this Policy is to establish the process and procedures aimed at protecting sensitive third-party data.
At a high level, Actonic Products GmbH will ensure that the following process is in place:
Identify, for each product, what sensitive data is being stored.
Clarify how sensitive the data is stored, breaking it down into as granular sections as required.
Actively avoid storing sensitive data wherever possible.
Where sensitive data must be stored, ensure it is stored in the most secure sections of our infrastructure and will not be transferred to less secure sections (unless under appropriate encryption during transit).
Where sensitive data is managed by a third-party, ensure those parties implement robust security policies and actively check those policies are updated and enforced.
Actively review internal code for security vulnerabilities and ensure understanding of the process to follow when any are found.
Actively review any external code used for security vulnerabilities and ensure the understanding of the process to follow when any are found.
The roles of senior staff in relation to sensitive data are:
Continuous review of the implementation of this policy - CEO
Risk identification and analysis - CTO
Instilling a culture of security awareness in the company - CEO
Communication and review following a breach - CEO
Review of this Policy and its enforcement - Annually
Security Risk Review - Quarterly