1. Purpose
COPASTUR establishes this Information Security Policy as an integral part of its corporate management system, aligned with accepted best practices and standards, in order to protect the technological assets, processes, and people who interact within the COPASTUR environment. This policy also informs clients, suppliers, partners, and other stakeholders of our commitment to information security.
2. Scope
This Policy applies to all clients, suppliers, partners, and other external stakeholders who have, have had, or will have access to COPASTUR information and/or who use, have used, or will use COPASTUR’s computing infrastructure resources, in accordance with the established operating agreements.
3. Core Principles
To ensure the effectiveness of this Policy, COPASTUR adopts the following principles:
- Policies and Procedures: Develop, implement, and fully comply with information security policies, regulatory guidelines, and procedure manuals. Ensure that the essential requirements of confidentiality, integrity, and availability of information are met through controls against internal and external threats;
- Education and Awareness: Promote education and awareness among employees regarding the information security practices implemented by COPASTUR.
- Compliance: Meet the information security requirements established by regulations, laws, and contractual clauses;
- Incident Management: Fully manage information security incidents, ensuring that all of them are properly recorded, classified, investigated, remediated, documented, and, when necessary, reported to the competent authorities. Company departments must provide the information needed for incident response;
- Business Continuity: Ensure business continuity through the implementation, testing, and continuous improvement of continuity and disaster recovery plans;
- Continuous Improvement: Promote the continuous improvement of information security management by systematically establishing and reviewing security objectives at all levels of the organization.
4. Guidelines
To ensure adequate protection, we have implemented an Information Security Governance System (ISMS) that is robust and aligned with the requirements of the ISO/IEC 27001:2022 standard. We have adopted a Business Continuity Management System (BCMS) and identify threats and potential impacts on operations, providing a resilient structure capable of responding effectively and protecting the interests of the parties involved. Our day-to-day management of Information Security events and incidents aims to prevent, monitor, respond to, and recover our environment from cyberattacks. We maintain an Internal Information Security Policy with guidelines that are periodically updated to protect client and employee information. The correct assignment of the sensitivity level of information is ensured by a well-established and implemented Information Classification Policy. We ensure the protection of information through logical access controls, preventing unauthorized access that could compromise the confidentiality, integrity, and availability of information. We use encryption techniques at rest and in transit, in addition to secure communication methods with partners. We adopt physical measures to ensure that all facilities with information resources have adequate and monitored access control, protecting against unauthorized access and environmental risks. We maintain backups with periodic restoration tests to ensure the continuity and integrity of information in the event of disasters. Machines and workstations are protected with restrictions on changes to administrative settings, data export, installation of unapproved software, and use of removable media. We use robust tools for vulnerability scanning, threat detection, and information exfiltration detection. We enter into Non-Disclosure Agreements (NDAs) with employees, service providers, and partners to prevent unauthorized disclosure of data. We map, monitor, and report risks related to privacy and information security with the participation of top management, ensuring the protection of personal and confidential data in compliance with applicable legislation and internal policies, and guaranteeing that data subjects’ rights are respected in accordance with the LGPD (Brazilian General Data Protection Law).
5. Definition and Maintenance
For security alerts and/or incidents, notifications must be sent to: seguranca.ti@copastur.com.br.
6. Final Considerations
COPASTUR reserves the right to modify, change, add to, or remove parts of this document at any time, in order to continuously improve its information security.