01
SOPs mandatory for all
Programmers, QA, PMs and management all know and follow incident procedures.
Clear roles from the Compliance Committee down to every staff member, and a deadline for every step after an incident. Report first, investigate later.
// 01 STRUCTURE
Clear roles and responsibilities from the Compliance Committee down to every staff member.
The ISMS Manager, IMO and team leaders are on call 24/7, 365 days a year.
Top body: approves compliance, sanctions and external notices
Owns the ISMS; reports on risks and controls
Leads company-wide reviews; reports to the Committee
Checks each project team's compliance daily
Supports the leader with daily monitoring
Apply security measures in daily client work
// 02 REVIEW
Every staff member's compliance is assessed twice a year and kept as an auditable record.
The IMO and ISMS Manager assess every level with a standard form.
Findings, evidence and status are compiled and verified.
The Committee records results and keeps them for audit.
Any violation gets a corrective action with a deadline.
// 03 INCIDENT RESPONSE
Every step has a deadline, from discovery to closure.
The finder reports to their manager. Estimates are fine.
Set the severity, start containment, escalate to the Committee.
Inform the client and management promptly; authorities and data subjects within 3×24 hours.
Restore service, record the root cause and fixes, then close.
| Severity | What it means |
|---|---|
| High | Data leaked outside, large volume, or active misuse |
| Medium | Limited general personal data may have leaked |
| Low | Internal issue with no external leak |
A no-blame culture means even small issues are shared early. When in doubt, we choose the higher severity.
// PEOPLE
In the end, security depends on people. Everyone works by the same rules.
// 04 ENFORCEMENT
Assessments are recorded in writing, with clear sanctions by severity.
One-off, low-impact lapse. Verbal warning from the Team Leader or ISMS Manager, recorded.
Repeated or uncorrected lapse. Formal written warning after Committee review.
Client-impacting or intentional violation. Decided by the Committee; may mean final warning or dismissal.
LET'S TALK
During the trial you can check our communication and quality before signing a full contract.