Skip to main content

Information Security Policy (A.5.1)

Document ID: information-security-policy
Version: 1.0
Effective from: 2025-01-01
Owner: ISMS owner
Review cycle: Annual

note

This document is aligned to ISO/IEC 27001:2022 Annex A as a self-assessment. SigmaShake holds no ISO 27001 certification.

Policy statement​

SigmaShake is committed to protecting the confidentiality, integrity, and availability of information assets entrusted to us by customers, employees, and partners. This policy establishes the framework for managing information security risks and aligning with ISO/IEC 27001:2022 Annex A. This alignment is self-assessed. SigmaShake holds no ISO 27001 certification.

Objectives​

  1. Protect customer data — Customer governance configurations and usage data are stored with encryption at rest and in transit. Access is restricted to authenticated, authorised parties only.
  2. Maintain evidence integrity — All compliance evidence is Ed25519-signed and Merkle-chained. Tampering is cryptographically detectable.
  3. Manage third-party risk — All vendors with access to customer or production data, or that receive visitor personal data (IP address, user agent, referrer), are subject to annual due-diligence review. The DPAs for Google, Cerebras and jsDelivr are still pending; see the open exception in the supplier security policy.
  4. Achieve continuous coverage — Automated collectors run on defined cadences (daily / weekly / monthly / quarterly) and gaps are surfaced automatically.
  5. Support legal compliance — Controls address GDPR data-subject rights, CCPA, and applicable privacy regulations for the markets SigmaShake operates in.

Principles​

  • Least privilege — Every system account and API token is scoped to the minimum required permissions.
  • Defence in depth — Controls are layered: network (staff-portal IP allowlist), application (accounts GitHub session for an allowlisted staff user ID), data (encryption + signing), and governance (ssg hook eval).
  • Continuous improvement — Monthly self-evaluation and quarterly access reviews feed a living risk register.
  • Transparency — Signed evidence is publicly verifiable via /.well-known/compliance-pubkey.

Scope​

This policy applies to all information systems listed in the ISMS Scope document and to all personnel, contractors and third parties who interact with those systems.

Responsibilities​

RoleResponsibility
ISMS ownerAll ISMS decisions, control implementation, audit responses
Automated collectorsEvidence generation (daily–quarterly cadences)
Cloudflare / GitHubPhysical and infrastructure controls (inherited)

Enforcement​

Violations of this policy must be recorded as incidents in the incident register and evaluated for corrective action. The governance hook (ssg hook eval) enforces coding-level controls automatically on every file write.

Policy hierarchy​

This document is the apex policy. Topic-specific policies derive from it:

  • Access Control Policy (A.5.15)
  • Data Classification Policy (A.5.12)
  • Cryptographic Controls Policy (A.8.24)
  • Secure Development Policy (A.8.25)
  • Supplier Security Policy (A.5.19)
  • Incident Management Procedure (A.5.24)
  • Business Continuity Plan (A.5.29)

Reviewed and approved by the ISMS owner. Next review due 12 months from effective date.