Information Security Management System (ISMS) Policy

This policy sets out how Orel Technology Solutions Inc. (“Orel”) manages information security. It is the top-level statement of our Information Security Management System (ISMS). Our more detailed procedures, standards and guidelines must follow it.

As a cybersecurity company, protecting information is the core of what we sell. This policy makes sure we hold ourselves to the same standard we help our clients reach.

This policy applies to:

• People: all Orel employees, contractors, consultants and anyone else who works on our behalf or uses our systems.
• Information: all information Orel creates, receives, stores or sends, in any form, including client data we handle during engagements.
• Systems: the devices, networks, cloud services, applications and tools we use to run the business and deliver services, including our website.
• Services: the services we deliver, such as vulnerability assessment and penetration testing (VAPT), managed security operations and managed detection and response (SOC/MDR), SOC deployment, Orel Prowl, security training, and related consulting work.

Orel’s management is accountable for information security. Management commits to:

• Set the direction of the ISMS and make sure it supports our business goals.
• Provide the people, budget, tools and time needed to run it well.
• Assign clear security roles and the authority to carry them out.
• Make sure security risks are understood and treated at the right level.
• Lead by example and communicate why security matters to staff, clients and partners.
• Review the ISMS regularly and drive its continual improvement.

Our information security objectives are to:

• Protect confidentiality: only authorized people can see information.
• Protect integrity: information stays accurate and complete, and changes are controlled.
• Protect availability: information and services are there when our clients and team need them.
• Protect client data and the findings, credentials and evidence we handle in every engagement.
• Meet our obligations under applicable laws, regulations and contracts, including the Data Privacy Act of 2012 (Republic Act No. 10173). See our Privacy Policy.
• Improve continually, by measuring how well our controls work and acting on what we learn.

Management sets measurable targets for these objectives and reviews progress as part of the ISMS review.

We put these objectives into practice through the following principles.

• Risk-based approach. We identify, assess and treat information security risks, and focus effort where the risk is highest.
• Least privilege and access control. People get only the access they need for their role, for as long as they need it. Access is reviewed and removed promptly when no longer needed.
• Secure handling of client findings and evidence. Vulnerability findings, reports, credentials and evidence are classified as confidential, stored and shared securely, limited to the engagement team, and disposed of securely when no longer needed. We test only what a client has authorized in writing.
• Incident management and reporting. Security events are reported quickly, investigated, contained and learned from. Clients and authorities are notified when contracts or the law require it.
• Supplier security. We assess suppliers that handle our or our clients’ information and set security expectations in our agreements with them.
• Business continuity. We plan, back up and test so that critical services can continue or recover after a disruption.
• Awareness and training. Everyone receives security awareness training when they join and regularly after that, with extra training for technical and high-risk roles.
• Secure development and operations. We build, configure, patch and change our systems and tools in a controlled, secure way.
• Asset management. We keep track of our information and technology assets, who owns them and how sensitive they are.
• Logging and monitoring. We log important activity on our systems and monitor it so we can detect and investigate suspicious behavior.

Management

Approves this policy, sets security objectives, provides resources, accepts remaining risks and reviews the performance of the ISMS.

ISMS Owner (Chief Technology Officer)

Runs the ISMS day to day: maintains this policy and supporting procedures, coordinates risk assessments, tracks incidents and improvements, and reports to management. This role is held by the Chief Technology Officer.

All staff and contractors

• Read, understand and follow this policy and the procedures that support it.
• Protect the information and systems they use, and the client data they are trusted with.
• Complete required security training.
• Report security incidents, weaknesses and concerns right away.

Everyone in scope must comply with this policy. We check compliance through reviews, monitoring and internal checks.

Breaking this policy can put our clients and our company at risk. Violations may lead to disciplinary action, up to and including termination of employment or contract, and may be reported to the authorities where the law requires. Any exception to this policy must be approved in advance by management, documented and reviewed.

Management reviews this policy at least once a year, and sooner after a significant change, such as a new service, a major incident, or a change in law, regulation or client requirements. Updated versions are approved by management and shared with everyone in scope.

If you notice a possible security issue involving Orel, please tell us right away.

• Everyone: email support@oreltechnologies.net with the subject “Security Concern”. Please include what you saw, when, and how we can reach you.
• Clients: use the incident reporting channel agreed in your service agreement, so the right team responds as fast as possible.
• Staff and contractors: report to the ISMS Owner (Chief Technology Officer) or through our internal incident process.

For general questions, contact sales@oreltechnologies.net.