Information Security Policy

1. Purpose

This Information Security Policy establishes the principles, guidelines, and commitments of TTPSEC SpA for the protection of information assets belonging to both the organization and our clients. This policy is mandatory for all employees, contractors, and third parties who access the organization's systems and information.

2. Scope

This policy applies to:

• All information assets of TTPSEC SPA, regardless of format (digital, printed, verbal).
• All information systems, networks, applications, and technology services.
• Client information managed during the delivery of cybersecurity services.
• All internal employees, consultants, contractors, and vendors with access to organizational information.
• The offices of Coquimbo and Santiago, Chile, and remote operations.

3. Senior Management Declaration

Senior Management of TTPSEC SPA acknowledges that information security is a fundamental pillar of our operations as a cybersecurity consultancy. We are committed to:

• Protecting the confidentiality, integrity, and availability of information.
• Complying with applicable legislation, contracts, and regulatory commitments.
• Managing information security risks in a systematic manner.
• Continuously improving the Information Security Management System (ISMS).
• Allocating the resources necessary for the effective implementation of this policy.
• Fostering a culture of information security throughout the organization.

4. Guiding Principles

4.1 Confidentiality

Information is classified and protected according to its sensitivity. Only authorized personnel may access the information necessary to perform their duties (principle of least privilege). Client information is handled under strict non-disclosure agreements (NDAs).

4.2 Integrity

We ensure that information is accurate, complete, and protected against unauthorized modification. We implement integrity controls on critical systems and verification processes for consulting deliverables.

4.3 Availability

We ensure that information and services are accessible when needed. We maintain business continuity and disaster recovery plans for critical services.

5. Reference Normative Framework

Our Information Security Management System is based on:

• ISO/IEC 27001:2022 — Information Security Management System.
• ISO/IEC 27002:2022 — Information Security Controls.
• ISO/IEC 27701:2019 — Privacy Information Management.
• NIST Cybersecurity Framework 2.0 — Cybersecurity Framework.
• ISA/IEC 62443 — Industrial Automation and Control Systems Security.
• Ley 21.663 — Cybersecurity Framework Law (Chile).
• Ley 21.719 — Personal Data Protection Act (Chile).

6. Risk Management

TTPSEC SPA implements a formal information security risk management process that includes:

• Identification: continuous inventory of information assets and associated threats.
• Assessment: analysis of the likelihood and impact of identified risks.
• Treatment: selection and implementation of controls proportionate to the risk level.
• Monitoring: periodic review of risks and control effectiveness.
• Acceptance: residual risks are formally accepted by Senior Management.

7. Control Domains

7.1 Access Control

• Multi-factor authentication (MFA) for all systems.
• Role-based access control (RBAC) and principle of least privilege.
• Periodic review of permissions and access rights.
• Centralized identity management.

7.2 Cryptography

• Data encryption in transit (TLS 1.3 minimum).
• Data encryption at rest for sensitive information.
• Secure cryptographic key management.
• Digital signatures for critical documents.

7.3 Operational Security

• Vulnerability and patch management.
• Security monitoring and intrusion detection.
• Protection against malware and advanced threats.
• Encrypted backups with periodic restoration testing.
• Event logging and audit trails.

7.4 Communications Security

• Network segmentation and VPN for remote access.
• Email security (SPF, DKIM, DMARC).
• Traffic filtering and data exfiltration prevention.

7.5 Secure Development

• Secure development practices (Security by Design).
• Code review and static application security testing (SAST).
• Dynamic application security testing (DAST).
• Secure dependency and third-party component management.

7.6 Vendor Management

• Security assessment of critical vendors.
• Non-disclosure agreements and contractual security clauses.
• Vendor compliance monitoring.

8. Security Incident Management

We maintain a formal incident management process that encompasses:

• Detection and reporting: internal and external reporting channels via contacto@ttpsec.com.
• Classification: assessment of incident severity and impact.
• Containment: immediate actions to limit the scope of the incident.
• Eradication: elimination of the root cause of the incident.
• Recovery: restoration of services and normal operations.
• Lessons learned: post-incident analysis and control improvements.

Security incidents involving personal data will be notified to affected data subjects and competent authorities within the legally established timeframes.

9. Business Continuity

TTPSEC SPA maintains a Business Continuity Plan (BCP) and a Disaster Recovery Plan (DRP) that ensure the availability of critical services. These plans are tested and updated on a regular basis.

10. Awareness and Training

All employees receive:

• Information security training upon onboarding.
• Ongoing training on emerging threats and best practices.
• Periodic phishing simulation exercises and social engineering attack drills.
• Updates on changes to security policies and procedures.

11. Compliance and Audit

Compliance with this policy is mandatory. Periodic internal audits are conducted to verify conformance with this policy and the applicable reference standards. Non-conformities are managed through the ISMS corrective action process.

12. Sanctions

Violation of this policy may result in disciplinary measures ranging from formal warnings to termination of the employment or contractual relationship, depending on the severity of the breach. Criminal conduct will be reported to the appropriate authorities.

13. Vulnerability Reporting

If you discover a security vulnerability in our systems, we invite you to report it responsibly to contacto@ttpsec.com. We are committed to investigating and responding to all vulnerability reports in a timely manner. Please refer to our security.txt file for more information.

14. Review and Updates

This policy is reviewed at least annually or whenever significant changes occur in the organization, applicable legislation, or the threat landscape. Any amendments are approved by Senior Management and communicated to all relevant stakeholders.

15. Contact

For inquiries about this policy:

• Email: contacto@ttpsec.com