Information Security Policy
Document Version: 1.0
Last Updated: July 19, 2025
Owner: Chief Information Security Officer (CISO)
1. Purpose
This Information Security Policy establishes the framework for protecting the confidentiality, integrity, and availability of DevSecOpsBook’s systems and data in accordance with SOC 2 Trust Services Criteria. It ensures the implementation of appropriate controls to manage security risks across the organization.
2. Scope
This policy applies to:
- All employees, contractors, vendors, and third parties
- All information assets (systems, applications, networks, and data)
- All environments (development, staging, production)
3. Responsibilities
- CISO: Owns and maintains this policy.
- All Employees: Must comply with security requirements.
- Engineering & IT: Implement controls and monitor systems.
- HR & Legal: Support enforcement and incident response.
4. Access Control (SOC 2 CC6.1, CC6.3, CC7.1)
- Access to systems and data is granted on a least privilege and need-to-know basis.
- Role-Based Access Control (RBAC) must be enforced.
- Access reviews must be conducted quarterly.
- MFA is required for administrative and remote access.
5. Asset Management (SOC 2 CC5.2, CC6.2)
- All information assets must be inventoried and classified (e.g., public, internal, confidential).
- Owners must be assigned to each asset.
- Changes to assets must follow the Change Management Policy.
6. Cryptography and Data Protection (SOC 2 CC6.4, CC6.8)
- Data in transit and at rest must be encrypted using strong cryptographic algorithms (e.g., AES-256, TLS 1.2+).
- Secret keys and credentials must be stored in secure vaults (e.g., AWS Secrets Manager).
- Endpoints must have disk encryption enabled.
7. Secure Development (SOC 2 CC8.1, CC7.4)
- All code must be reviewed and scanned for vulnerabilities before deployment.
- CI/CD pipelines must integrate security checks (SAST, DAST, dependency scanning).
- Developers must follow secure coding guidelines.
8. Monitoring and Logging (SOC 2 CC7.2, CC7.3)
- Logs must be generated for critical systems and retained for 12 months.
- Logs must be reviewed regularly for anomalies and unauthorized access.
- All security events must be correlated in a central SIEM platform.
9. Incident Response (SOC 2 CC7.5)
- A formal Incident Response Plan (IRP) must be maintained.
- All incidents must be reported within 24 hours of detection.
- Post-incident reviews are mandatory for severity level P1 and P2 events.
10. Physical and Environmental Security (SOC 2 CC6.6)
- Access to data centers and cloud consoles must be restricted and logged.
- All cloud regions used must be compliant with regional security regulations.
- Backup power, fire suppression, and disaster recovery plans must be in place.
11. Vendor and Third-Party Security (SOC 2 CC9.2)
- Vendors must undergo security due diligence and be re-assessed annually.
- All third-party data sharing must be governed by signed contracts and DPAs.
- Access to systems by vendors must be time-bound and monitored.
12. Policy Review and Awareness
- This policy must be reviewed annually or upon major changes.
- Employees must complete annual security awareness training and pass verification.
- Violations of this policy are subject to disciplinary action.