Information Security Policy

Document
DIR065
Revision
02
Date
Aug/18/26
Classification
Public

1. Objective

With the goal of meeting best business compliance practices, SoftExpert Software companies have been making efforts to improve their information security standards and personal data protection.

SoftExpert is ISO 27001:2022 certified. The ISO 27001 standard is the international standard and reference for Information Security Management, which has as its general principle the adoption of a set of requirements and controls with the objective of adequately mitigating the organization's risks.

SoftExpert Information Security Policy is a formal statement from Senior Management regarding its commitment to protecting the assets and information it owns and/or has in its custody.

The application of this policy seeks to preserve SoftExpert information regarding:

  • a) Confidentiality: ensuring that access to information is obtained only by authorized individuals.
  • b) Integrity: ensuring that information is maintained in its original state, aiming to protect it, during storage or transmission, against improper, intentional, or accidental alterations.
  • c) Availability: ensuring that authorized users can access information and corresponding assets whenever necessary.

Finally, the Integrated Management System (IMS) includes the Information Security Management System and the Quality Management System, based on the normative requirements of ISO 9001 and ISO 27001.

2. Scope

This policy applies to all employees and service providers who have had and/or have a relationship with SoftExpert and who have accessed and/or access company or client information.

3. References

The following are the standards that this document adopts:

  • a) NBR ISO9001 - Quality management systems - Requirements.
  • b) NBR ISO 27001 – Information security management systems – Requirements

4. Terms

There are no terms to be detailed for this document.

5. Guidelines

The Information Security Policy is supported by a set of other specific policies, procedures, and controls to ensure adequate protection of information and mitigation of related risks.

SoftExpert declares that it adopts solutions that consider appropriate techniques, application costs, nature, scope, and risks to the business. Furthermore, it commits to:

  1. a) To comply with regulations, laws, standards, and contractual clauses related to Information Security and Privacy.
  2. b) To handle any Information Security incident appropriately, including recording, classifying, investigating, correcting, and documenting it, as well as, when necessary, reporting it to the competent authorities.
  3. c) To maintain a Risk Management program that meets SoftExpert business needs.
  4. d) Maintain a program of internal and external audits to validate the compliance of your Integrated Management System (IMS).
  5. e) To supervise and regulate the physical and logical access of all people, including employees and service providers.
  6. f) Categorize information related to the scope of the Integrated Management System (IMS) to ensure it receives appropriate protection.
  7. g) Invest in training and awareness programs to educate users about their responsibilities and the importance of protecting information under their care.
  8. h) Having a business continuity plan to ensure the continued supply and support of services, even in adverse situations.

SoftExpert seeks to establish relationships with its employees and service providers who share the same commitment to information security, privacy, and the quality of products and services, attributing to these aspects the same importance and relevance that the organization assigns.

6. Roles and Responsibilities

6.1 Senior Management

  1. a) To support the dissemination and maintenance of the Integrated Management System (IMS).
  2. b) To provide the necessary resources for the maintenance of the Integrated Management System (IMS).
  3. c) Perform critical analysis and monitoring of IMS results at planned intervals.

6.2 Information Security Committee

  1. a) To support the analysis of the efficiency and effectiveness of controls adopted in the Integrated Management System (IMS).
  2. b) To support the definition of actions to ensure the continuous improvement of the Integrated Management System (IMS).
  3. c) To support the dissemination of the IMS throughout the organization.
  4. d) The committee's composition should include at least one member from each area.

6.3 Leaders

  1. a) To demonstrate exemplary performance in complying with the guidelines of this Information Security Policy, as well as other internal Policies, Standards and Procedures that complement it.
  2. b) Ensure that your team is aware of the guidelines in this Security Policy, as well as the other Policies, Standards, and Procedures that complement it.

6.4 Other users

  1. a) Comply with internal information security policies, guidelines, and procedures.
  2. b) Use information assets appropriately.
  3. c) Seek guidance if you have questions related to information security.
  4. d) To ensure the safekeeping and protection of the company's confidential information against unauthorized access, modification, destruction, or disclosure.
  5. e) Report information security incidents as soon as they are identified.
  6. f) Report any potential information security risks identified.
  7. g) Participate in training sessions and awareness campaigns.

7. Compliance

Failure to comply with the requirements set forth in this Information Security Policy will result in a violation of the company's internal rules and will subject the user to applicable administrative and legal measures.