Trust Center
Security-First is a single framework of minimum control requirements. It governs internal operations and is a mandatory condition for every supplier and partner in the service delivery ecosystem.
Framework
A comprehensive set of controls, applied across the organization and its entire supply chain.
The information security program is aligned with industry frameworks including NIST and COBIT, with annual risk assessments, continuous control validation and ongoing security awareness training for all personnel.
Confidential information is protected by industry-standard cryptography in transit and at rest. Data loss prevention controls and cryptographic key lifecycle management safeguard sensitive data from exfiltration.
Access follows least privilege and need-to-know. Multi-factor authentication is enforced for all external connectivity and privileged access, every user holds a unique ID, and a documented process governs the granting and recertification of access.
A secure software development life cycle, hardened security configurations and a vulnerability management program with regular scans and penetration tests. Every system is covered by malware prevention and intrusion detection.
Business resiliency and disaster recovery plans are maintained and tested regularly. Recovery strategies meet defined RTO and RPO objectives and address disruptions to staff, sites, applications and critical third parties.
Security is a shared responsibility. Every third-party supplier contractually adheres to the minimum control requirements, and subcontractors are identified, assessed and monitored so the standard holds across the entire service delivery ecosystem.
Scope
The minimum control requirements govern every internal system, process and member of staff.
Adherence to the minimum control requirements is a contractual condition for every supplier and partner.
Subcontractors are identified, assessed and monitored so the standard is maintained across the service delivery ecosystem.
Detailed information about the security program and its control requirements is available on request. Reach the security team directly.