Purpose

​

The purpose of this policy is to ensure the confidentiality, integrity, and availability of all information processed, stored, or transmitted by AA2. This policy outlines the steps to protect against unauthorized access, data breaches, and information security risks.

​

Scope

​

This policy applies to all employees, contractors, third-party partners, and stakeholders who have access to AA2’s information systems and data. It covers all digital and physical information assets.

​

Policy Principles

​

1. Confidentiality:
   All data must be handled with the utmost confidentiality. Only authorized individuals shall have access to sensitive information, such as customer data.

2. Data Integrity:
   Measures will be taken to ensure that data is accurate, reliable, and protected from unauthorized modification or corruption.

3. Data Availability:
   Information must be accessible to authorized individuals when required. Redundancies and backups will be maintained to ensure the availability of data in the event of a system failure.

4. Access Control:
   Access to company systems and data will be based on the principle of least privilege. Employees and contractors will be granted access only to the data necessary for their role.

5. Data Encryption:
   Sensitive data, including customer information, will be encrypted in transit and at rest. Encryption standards will follow industry best practices.

6. User Responsibility:
   All users of AA2’s systems are required to:

   • Use secure passwords that comply with company guidelines.

   • Report any suspected security breaches or vulnerabilities immediately.

   • Follow data privacy laws, including GDPR and other applicable regulations.

7. Third-Party Security:
   Any third-party partners or vendors with access to AA2 data must comply with the information security standards outlined in this policy. Contracts with third parties must include data protection clauses.

8. Incident Management:
   In the event of a data breach or security incident, an established incident response plan will be followed. The plan includes immediate containment, notification to affected parties, and an investigation to determine the cause and prevent future occurrences.

9. Regular Audits & Monitoring:
   Regular audits of information systems will be conducted to ensure compliance with the security policy. Monitoring tools will be implemented to detect and prevent unauthorized access or data leaks.

10. Training & Awareness:
    Employees and contractors will undergo regular information security training to ensure awareness of their responsibilities and current best practices.

 

Consequences of Policy Violation

​

Any violation of this policy, whether intentional or accidental, may result in disciplinary action, up to and including termination of employment or contract.

​

Policy Review

​

This policy will be reviewed annually or as needed to ensure it remains up to date with evolving security threats and regulatory requirements.