At Sapoto, we prioritize the security of our systems, data, and customer information. This Security Policy outlines the principles and practices we implement to safeguard against security threats and ensure the integrity and confidentiality of our data.

1. Purpose and Scope

The purpose of this Security Policy is to protect Sapoto's information assets from all threats, whether internal or external, deliberate or accidental. This policy applies to all employees, contractors, and third parties who have access to Sapoto's systems and data.

Roles and Responsibilities

Information Security Officer (ISO): The ISO is responsible for overseeing the implementation of this policy, managing security risks, and ensuring compliance with relevant laws and regulations.

Employees and Contractors: All individuals with access to Sapoto's systems must adhere to this policy, report any security incidents, and participate in security training programs.

3. Access Control

User Access Management: Access to Sapoto's systems and data is restricted based on the principle of least privilege. User access rights are regularly reviewed and adjusted as necessary.

Authentication: Strong authentication methods, such as multi-factor authentication (MFA), are required for accessing sensitive systems and data.

Creating a comprehensive security policy is essential for an IT software company like Sapoto. This policy should outline the measures taken to protect the company's data, systems, and customer information. Below is a template for Sapoto's Security Policy that can be customized based on the specific security practices and requirements of the company. Sapoto Security Policy Effective Date: [Insert Date] At Sapoto, we prioritize the security of our systems, data, and customer information. This Security Policy outlines the principles and practices we implement to safeguard against security threats and ensure the integrity and confidentiality of our data. 1. Purpose and Scope The purpose of this Security Policy is to protect Sapoto's information assets from all threats, whether internal or external, deliberate or accidental. This policy applies to all employees, contractors, and third parties who have access to Sapoto's systems and data. 2. Roles and Responsibilities Information Security Officer (ISO): The ISO is responsible for overseeing the implementation of this policy, managing security risks, and ensuring compliance with relevant laws and regulations. Employees and Contractors: All individuals with access to Sapoto's systems must adhere to this policy, report any security incidents, and participate in security training programs. 3. Access Control User Access Management: Access to Sapoto's systems and data is restricted based on the principle of least privilege. User access rights are regularly reviewed and adjusted as necessary. Authentication: Strong authentication methods, such as multi-factor authentication (MFA), are required for accessing sensitive systems and data. 4. Data Protection

Data Classification: Sapoto classifies data according to its sensitivity and applies appropriate security controls based on the classification.

Encryption: Sensitive data, both at rest and in transit, must be encrypted using industry-standard encryption methods.

Data Backup: Regular backups are performed to ensure data availability and integrity. Backups are securely stored and periodically tested for restoration.

5. Network Security

Firewalls and Intrusion Detection Systems (IDS): Firewalls and IDS are implemented to monitor and protect the network from unauthorized access and malicious activities.

Network Segmentation: Critical systems and data are segregated from less sensitive areas of the network to reduce the risk of unauthorized access.

6. Incident Response

Incident Reporting: All security incidents must be promptly reported to the Information Security Officer.

Incident Management: Sapoto has an established incident response plan to manage and mitigate the impact of security incidents. This includes steps for containment, investigation, eradication, and recovery.

7. Physical Security

Facility Security: Access to Sapoto's facilities is controlled and monitored to prevent unauthorized entry.

Equipment Security: Hardware and equipment are secured against theft, damage, and unauthorized access.

8. Third-Party Security

Vendor Management: Third-party vendors with access to Sapoto's systems and data must comply with Sapoto's security standards and undergo regular security assessments.

Contracts and Agreements: Security requirements are incorporated into contracts with third-party vendors to ensure they maintain adequate security controls.

9. Compliance and Auditing

Regulatory Compliance: Sapoto complies with applicable laws, regulations, and industry standards related to information security.

Audits: Regular security audits and assessments are conducted to evaluate the effectiveness of security controls and identify areas for improvement.

10. Security Awareness and Training

Training Programs: All employees and contractors are required to participate in regular security training to stay informed about current threats and best practices.

Awareness Campaigns: Sapoto conducts ongoing awareness campaigns to promote a security-conscious culture within the organization.

11. Policy Review and Updates

This Security Policy is reviewed annually or whenever significant changes occur in the organization or regulatory environment. Updates to the policy are communicated to all relevant parties.

12. Contact Information

For questions or concerns regarding this Security Policy, please contact the Information Security Officer at helpdesk@sapoto.in.