Tru Performance Information Security Management System (ISMS) Policy

Effective Date: 22 December 2023

Version: 1.0

1. Purpose

The purpose of this Information Security Management System (ISMS) Policy is to protect the information assets of Tru Performance from all threats, whether internal or external, deliberate or accidental, to ensure business continuity, minimize business risk, and maximize return on investments and business opportunities.

2. Scope

This policy applies to all employees, contractors, and third-party users of information systems and services within Tru Performance. It encompasses all aspects of information security related to the digital marketing, IT development, and BPO services provided to our clients, especially those based in North America and India.

3. Information Security Objectives

Confidentiality

Ensuring that information is accessible only to those authorized to have access.

Integrity

Safeguarding the accuracy and completeness of information and processing methods.

Availability

Ensuring that authorized users have access to information and associated assets when required.

4. Policy Framework

Risk Management

Regularly assess risks to the company’s information assets and implement appropriate measures to mitigate identified risks.

Usage Data

We may also collect information how the Service is accessed and used (“Usage Data”). This Usage Data may include information such as your computer’s Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

Employee Training and Awareness

All employees will receive regular training on information security and its importance.

Access Control

Access to information will be controlled on the basis of business and security requirements.

Incident Management

Information security incidents will be reported and investigated to prevent recurrence.

Compliance

Compliance with legal, statutory, regulatory, and contractual requirements will be ensured.

5. Responsibilities

Management Commitment

Senior management is committed to supporting ISMS initiatives to improve the overall security posture of Tru Performance.

Employee Responsibility

All employees are responsible for adhering to the ISMS policy in their day-to-day operations.

ISMS Team

An ISMS team shall be responsible for implementing, maintaining, and improving information security.

6. Legal Compliance and Audits

  • Tru Performance is committed to complying with all applicable legal, statutory, and regulatory requirements related to information security.
  • The company is willing to undergo periodic audits to demonstrate compliance and meet the information security obligations outlined in client contracts.

7. International Data Transfers

Tru Performance will ensure compliance with international data transfer regulations when handling client data across borders. The company will implement measures to protect the privacy and security of client data in accordance with relevant laws and agreements.

8. Dispute Resolution

Dispute resolution mechanisms related to information security matters will be established, clarifying how disputes will be resolved between Tru Performance and its clients.

9. Records Retention and Training Records

Tru Performance will maintain records related to information security incidents, risk assessments, and compliance activities to meet potential legal and regulatory requirements. Tru Performance will maintain records of employee training on information security, useful for demonstrating compliance during audits or legal inquiries.

10. Definitions

Key terms, including “information assets,” “security incidents,” and “authorized users,” are defined to ensure a common understanding among employees.

13. Updates to Legal Requirements

Tru Performance is committed to staying informed about changes in legal and regulatory requirements related to information security and will update the ISMS policy accordingly.

14. Review and Evaluation

This policy will be reviewed annually or following significant changes to the organization or the risk environment, to ensure its continuing suitability, adequacy, and effectiveness.