# 10 Information security policy

| | |
| --- | --- |
| Version | 0.1 draft |
| Effective | [date of approval] |
| Owner | Security Owner |
| Approved by | [director names] |
| Review | Yearly, and after any major change to the system or the company |
| Applies to | All directors, employees, contractors and interns of Rang & Mall Private Limited, and every system inside the [SOC 2 scope](/soc2/01-scope) |

## Purpose

To protect the confidentiality, integrity and availability of customer data and of the systems that deliver Rang & Mall's services, and to meet the commitments made to customers.

## Policy

1. Rang & Mall operates an information security program made of the policies numbered 10 to 25 on this site, the [control matrix](/soc2/02-controls), and the [compliance playbook](/). Where they overlap, the stricter rule applies.
2. Every policy names an owner, is approved by the directors, is reviewed at least yearly, and is acknowledged by personnel at hire and yearly.
3. Security roles are assigned in the [owners table](/soc2/#owners). One person may hold several roles, except that the author and the approver of a production change must be different people.
4. The directors review the program at least quarterly: open risks, incidents, control exceptions, audit findings, and the roadmap. Minutes are kept (GOV-03).
5. Control owners self-assess their controls each quarter and record exceptions as tickets with an owner and a due date (MON-01, MON-03).
6. Risks are managed under [23 Risk management](/soc2/23-risk-management).
7. Customer commitments about security (terms, DPA, security page, sales answers) must describe controls that operate today. A commitment that is not yet true is not made. Red line 1 of the [universal baseline](/playbook/02-universal-baseline) applies to every security claim.

## Exceptions

An exception to any policy is requested in writing with the reason, the risk, the compensating control, and an expiry date no longer than 12 months. The Security Owner approves or refuses. Approved exceptions are listed in the risk register and reviewed quarterly. An expired exception is a violation.

## Violations

Violations are handled under [11 Code of conduct and acceptable use](/soc2/11-conduct-acceptable-use).

## Policy index

| No. | Policy |
| --- | --- |
| 10 | Information security (this policy) |
| 11 | [Code of conduct and acceptable use](/soc2/11-conduct-acceptable-use) |
| 12 | [People security and training](/soc2/12-people-security) |
| 13 | [Access control](/soc2/13-access-control) |
| 14 | [Asset and data management](/soc2/14-asset-data-management) |
| 15 | [Cryptography and key management](/soc2/15-cryptography) |
| 16 | [Secure development and change management](/soc2/16-secure-development-change) |
| 17 | [AI coding agents](/soc2/17-ai-agents) |
| 18 | [Operations security](/soc2/18-operations-security) |
| 19 | [Network security](/soc2/19-network-security) |
| 20 | [Incident response](/soc2/20-incident-response) |
| 21 | [Business continuity, disaster recovery and backup](/soc2/21-continuity-recovery) |
| 22 | [Vendor management](/soc2/22-vendor-management) |
| 23 | [Risk management](/soc2/23-risk-management) |
| 24 | [Physical and environmental security](/soc2/24-physical-security) |
| 25 | [Data retention and disposal](/soc2/25-retention-disposal) |

## Approval

| Name | Role | Signature | Date |
| --- | --- | --- | --- |
| [ ] | Director | | |
| [ ] | Director | | |