Information security policy

Extranet Systems Pty Ltd (ABN 29 632 743 189) ("Extranet Systems", "we", "us") designs, builds and operates technology for organisations that depend on it. The confidentiality, integrity and availability of the information we handle is central to that work. This policy states our commitments to information security and the way we govern it. It is the public summary of the Information Security Policy that forms part of our information security management system (ISMS). The detailed policies, standards and procedures beneath it are internal documents and are available to clients and auditors under a confidentiality agreement.

Scope

This policy applies to all information that Extranet Systems creates, receives, stores, processes or transmits, in any form, including client information, personal information, commercial information and information about our own systems. It applies to every director, employee, contractor and labour hire worker of Extranet Systems and its related bodies corporate in Australia, Bahrain and Egypt (together, "our people"), and to every system, service, location and supplier that handles our information, including PentestOps and the other services we host.

Certification

Our ISMS is certified to ISO/IEC 27001, the international standard for information security management, and our artificial intelligence management system is certified to ISO/IEC 42001. Certification is maintained through independent surveillance and recertification audits. Certificate details are available on request to info@extranetsystems.com.au.

Our commitments

Extranet Systems commits to:

• Protect information in proportion to its value and risk. We classify information, identify the threats to it and apply controls that are proportionate to the harm a breach would cause, reviewed through a documented risk assessment and treatment process.
• Meet our legal and contractual obligations. Including the Privacy Act 1988 (Cth) and the Australian Privacy Principles, the Notifiable Data Breaches scheme, the Security of Critical Infrastructure Act 2018 (Cth) where it applies to a client engagement, the laws of the other countries in which we operate, and the security terms of every client contract.
• Apply recognised controls. Our control set is drawn from ISO/IEC 27001 Annex A and informed by the Australian Cyber Security Centre's Information Security Manual and Essential Eight maturity model. Controls include access control on the principle of least privilege, multi-factor authentication, encryption of information in transit and at rest, secure configuration and patching, malware defences, logging and monitoring, secure software development, backup and recovery, and physical security of our offices.
• Keep client information segregated and under the client's control. Client environments, data and credentials are segregated from each other and from our own. We access client systems only as authorised in writing, for the agreed purpose, for the agreed period, and we record that access. Australian client information is held in Australia and accessed only by our Australian team; our overseas offices have no access to it. Client information is never used for any purpose other than delivering the agreed services. We may use anonymised data, from which no client, person or system can be identified, to improve our own services and models; customer-specific data is never used for that purpose.
• Prepare for and respond to incidents. We maintain an incident response plan, test it, and treat any suspected breach of security as an incident until proven otherwise. Where an incident affects a client, we notify the client without undue delay and in any case within the period required by law or by contract, and we cooperate fully in the response. Eligible data breaches are notified to affected individuals and to the Office of the Australian Information Commissioner as the Privacy Act requires.
• Manage our suppliers. Suppliers who handle our information or our clients' information are assessed before engagement, bound by written security obligations, and reviewed. Where we use cloud services, we know in which country information is stored and we keep Australian client information in Australia unless the client agrees otherwise.
• Build security into what we deliver. Secure development practices, code review, dependency management, vulnerability scanning and penetration testing are part of how we build software, including PentestOps, and of the services we run for clients.
• Ensure our people are competent and accountable. Our people are screened before engagement, bound by confidentiality obligations, trained in information security on joining and at least annually, and subject to disciplinary action, up to termination, for breaches of this policy. Access is removed promptly when a person's role changes or ends.
• Welcome responsible disclosure. Security researchers who find a vulnerability in our systems can report it under our Responsible Disclosure Policy.
• Improve continually. We set information security objectives, measure performance against them, audit the ISMS internally, review it at management level at least annually, and act on the findings of audits, incidents and changes in the threat environment.

Governance

Our board of directors is accountable for information security and approves this policy. Day-to-day management of the ISMS is assigned to a nominated manager with the authority and resources to maintain it. Every manager is responsible for security within their area, and every one of our people is responsible for following our security policies, completing training and reporting security concerns and incidents immediately.

What we ask of clients and partners

Security is shared. We ask clients and partners to protect the credentials and access we provide to them, to tell us promptly about any suspected compromise that could affect systems we support, and to agree with us, before work starts, the security requirements that apply to each engagement. Where a client's own policies are stricter than ours, the stricter requirement applies to that engagement.

Reporting a security concern

Anyone can report a security concern about Extranet Systems or the services we provide by emailing info@extranetsystems.com.au with the subject "Security". Please include enough detail for us to act, and do not include passwords or other secrets in the email. For a suspected vulnerability in our systems, please follow our Responsible Disclosure Policy.

Review

This policy is reviewed at least annually, and whenever a significant change to our business, our systems, the law or the threat environment requires it. The current version is always the one published at extranetsystems.com.au/policies/information-security/.

Contact

See all our policies