mediumvioletred-gnat-525132.hostingersite.com

Menu
Home
Services
Contact Us
News

Information Security Policy

Purpose

This Information Security Policy establishes Nettverk’s commitment to protect information assets and customer data in alignment with the ISO/IEC 27001:2022 Information Security Management System (ISMS) framework. It provides a comprehensive overview of security objectives, controls, and responsibilities to ensure information confidentiality, integrity, and availability. This policy also ensures compliance with relevant laws and regulations, including the Australian Privacy Act 1988 (Cth), and industry best practices.

Scope

This policy applies to all employees, contractors, partners, systems, infrastructure, data, and services under Nettverk’s operational control—especially those involved in:

  • Integration development and delivery (Salesforce ↔ Xero, WooCommerce ↔ Salesforce).
  • Cloud-hosted platforms and connectors.
  • Customer data synchronisation, invoicing automation, and financial tracking.

This policy must always be followed to ensure the confidentiality, integrity, and availability (CIA) of Nettverk’s information assets.

Information Security Objectives

Nettverk’s information security objectives include:

Data Protection

Nettverk’s information security objectives include:

Regulatory Compliance

Meeting ISO 27001:2022, Australian Privacy Act, and contractual security requirements.

Secure Development

Integrating security into the Software Development Lifecycle (SDLC) to prevent vulnerabilities.

Incident Response & Recovery

Detecting, responding, and recovering from security incidents efficiently. Continuous

Improvement

Regular security audits, risk assessments, and policy updates.

Policy Statements

Leadership Commitment (Clause 5.1 and 5.2)

Senior management commits to integrating information security into our strategic planning and business operations. Information security roles and responsibilities are clearly defined across technical, operational, and executive functions.

Risk-Based Approach (Clause 6.1)

Nettverk maintains an Information Security Risk Assessment Methodology to identify, assess, and treat risks aligned with its connectors, APIs, cloud services, and client data.

Access Control (Annex A 5.15, 5.16, 5.17)

Only authorised users shall access production and development environments based on least privilege and business need.

Secure System Integration (Annex A 8.24, 8.25)

All integration between Salesforce, Xero, and WooCommerce must follow secure API practices, including:

  • Authentication via OAuth2.
  • Secure token storage.
  • Logging and monitoring of all data flows.
  • Automated alerts for unauthorised access attempts.

Asset Protection (Annex A 5.9, 5.10, 5.12)

Information assets, including integration codebases, customer credentials, API keys, and logging systems, shall be:

  • Inventoried and classified.
  • Protected using encryption and backup.
  • Governed by secure configuration baselines.

Threat Intelligence and Monitoring (Annex A 5.7, 5.28, 5.30)

The SOC team shall collect threat intelligence relevant to cloud APIs, connector vulnerabilities, and SaaS platforms. Security logs are analysed to detect anomalies across the integration infrastructure.

Business Continuity and Resilience (Annex A 5.29, 5.30)

Nettverk ensures the resilience of integration services through:

  • Cloud redundancy and automated failover.
  • Regular backup and disaster recovery testing.
  • RTO ≤ 4 hours; RPO ≤ 24 hours for client integrations.

Data Privacy and Compliance (Annex A 5.14, 5.31)

Customer data exchanged between systems shall be handled with:

  • End-to-end encryption
  • Data minimization
  • GDPR-compliant practices and consent management

Policy Statements

Policy Adherence​

Users must adhere to all related policies and procedures.

Reporting Violations

Users must report any violations of this policy to their manager or the IT department immediately.

Disciplinary Actions

Violations of this policy may result in disciplinary action, including termination of employment or contract and legal action where applicable.