Introduction
This security policy outlines the measures and guidelines that Get It Lease a division of Mons Huygens Solutions Private Limited ("Company") shall implement to protect its information assets and ensure the confidentiality, integrity, and availability of its systems and data. This policy applies to all employees, contractors, and third parties who have access to the Company's information assets. This policy is in addition to the Privacy Policy of the Company.
Information Classification
The Company shall classify its information assets based on their sensitivity and criticality. The classification levels shall include, but not limited to, the following:
Confidential: Information that, if disclosed, could cause significant harm to the Company's business, reputation, or legal obligations.
Internal: Information that is not publicly available and is intended for internal use only.
Public: Information that is intended for public release and has no confidentiality requirements.
Access Control
User Access Management
Access to information assets shall be granted based on the principle of least privilege, ensuring that users have access only to the resources necessary to perform their duties.
User access rights shall be reviewed periodically and adjusted based on the principle of need-to-know.
User access credentials, including passwords, shall be protected and stored securely.
Authentication and Authorization
Strong authentication mechanisms, such as two-factor authentication, shall be used for accessing sensitive systems and data.
User access requests shall be approved by authorized personnel based on documented authorization procedures.
Data Protection
Data Privacy
The Company shall comply with reasonable security measures at minimum those mandated under data protection laws viz., Information Technology Act and Sensitive Data Information Rule to protect the privacy of personal and sensitive information.
Data subjects shall be informed about their personal data's purpose, collection, use, and retention.
Data Backup and Recovery
Regular data backups shall be performed to ensure the availability and recoverability of critical systems and data.
Backup media shall be stored securely, both onsite and offsite, to prevent unauthorized access or damage.
Data Retention
The Company shall establish data retention policies to ensure that data is retained for the required period based on legal, regulatory, and business requirements.
No longer required data shall be securely disposed of using approved methods.
Incident Management
Incident Reporting
Employees and contractors shall promptly report any suspected or confirmed security incidents to the designated incident response team.
Incident reporting channels and procedures shall be communicated to all personnel.
Incident Response
The Company shall maintain an incident response plan to address security incidents promptly and effectively.
The incident response plan shall include procedures for containment, eradication, recovery, and post-incident analysis.
Physical Security
Physical Access Control
Access to the Company's premises, data centers, and sensitive areas shall be restricted and controlled through physical access control measures, such as locks, access cards, and surveillance systems.
Visitors shall be escorted and supervised while on the Company's premises.
Equipment Protection
Company-owned equipment, including computers, laptops, and mobile devices, shall be protected against theft, loss, and unauthorized access by internal security measures such as stringent security in the Company’s premises, including 24-hour surveillance, access control, etc.
Portable storage media, such as USB drives, shall be encrypted to protect the data stored on them.
Security Awareness and Training
The Company shall provide security awareness and training programs to all personnel to promote a culture of security.
Employees shall be trained on security policies, procedures, and best practices to mitigate risks and protect information assets.
Compliance and Auditing
The Company shall regularly monitor, assess, and audit its security controls to ensure compliance with this security policy, applicable laws, regulations, and contractual obligations.
Non-compliance or security breaches shall be addressed promptly, and appropriate corrective actions shall be taken.
Policy Review and Updates
This security policy shall be reviewed periodically to ensure its effectiveness and relevance. Updates to the policy shall be communicated to all personnel, and training shall be provided as necessary.
Policy Acceptance
By joining the Company or accessing its information assets, all employees, contractors, and third parties agree to comply with this security policy and the associated procedures. Failure to comply may result in disciplinary action, termination of contracts, or legal consequences, as appropriate.
Last Update: 5th July 2023