Security Risks Management:

swedencornet’s (Core Net AB) information security strategy supports swedencornet’s (Core Net AB) aims by identifying, prioritizing and managing its security risks. Operational teams throughout the organization are responsible for identifying, assessing and managing their risks in accordance with swedencornet’s (Core Net AB) Risks Management Policy. Security and privacy risks are addressed through the application of appropriate security controls and associated risk treatment plans and the acceptance and management of residual risks. Oversight and governance of the risk management processes is exercised by the CEO and CISO as appropriate.

Governance:

swedencornet (Core Net AB) operates in an environment where it must: comply with national and international laws, consistently demonstrating an effective ISMS. Additionally, as threats constantly change and develop, so must swedencornet’s (Core Net AB) controls whilst at the same time continuing to support business aims.

Therefore, swedencornet’s (Core Net AB) ISMS may be kept under regular review to ensure that the policies and controls in place continue to support business aims by adapting to the changing threat landscape, incorporating any statutory or regulatory requirements is considered when applying and managing controls; that consequential risks are identified and appropriately managed; and that any changes to the legal or regulatory environment are incorporated. For these reasons swedencornet’s (Core Net AB) monitors the effectiveness of its controls by: conducting tests against its infrastructure, for example penetration or vulnerability testing; by collecting information on policy compliance, such as endpoint encryption and AV status; by conducting audits across the ISMS by its internal teams; and by exercising its contingency and response plans.

The results of these governance activities may be contained in reports distributed to the appropriate teams and their management and it is the responsibility of the control owners to ensure that any weaknesses are mitigated and managed.

Logical Access:

Access to swedencornet’s (Core Net AB) systems and information must be controlled to protect its confidentiality, integrity and availability. Accordingly, access is restricted to those with a ‘need to know’ and is reviewed periodically to ensure appropriate access is maintained. Access credentials must meet specific minimum requirements, depending on the subject system, to reduce the risk of unauthorized access.

Business Continuity:

swedencornet’s (Core Net AB) has global presence and offers services, and products to its customers. The implementation of an effective Business Continuity policy ensures preparations are made to identify risks which may affect swedencornet’s (Core Net AB) ability to operate during an incident and recover quickly in the aftermath. All swedencornet’s (Core Net AB) employees must ensure they understand the business continuity process and their place in it. Business continuity plans and processes may be regularly reviewed and tested to ensure effectiveness.

Information Classification, Handling and Retention:

Information assets created, stored and used within swedencornet’s (Core Net AB) have value, which must be identified by the asset owner or creator to allow the appropriate security controls to be applied. Additionally, information processed for customers in swedencornet’s (Core Net AB) services, and products must be classified according to its value to the customer.

All employees are required to protect information according to the data classification assigned to it. Access to all classified information is based on the Need-to-Know principle. Although people might be authorized to access information, they should only access data when strictly required.

Security Incident Management:

A risk-based approach to security focused on supporting business aims, such as that implemented by swedencornet’s (Core Net AB), results in the likelihood that a security incident will occur at some point. Therefore all swedencornet’s (Core Net AB) employees must ensure they know how to identify and report a security incident and must be fully familiar with their involvement in the incident management process. swedencornet’s (Core Net AB) security incident management processes must be in place and tested.

swedencornet’s (Core Net AB) security incident management process follows a four stage approach focused on: Preparation; Detection & Analysis; Containment; Eradication & Recovery; and Post-Incident Activity. This supports swedencornet’s (Core Net AB) business continuity policies and processes.

Physical Security:

Information and assets at swedencornet’s (Core Net AB) facilities must be classified according to their organizational value and appropriately protected. swedencornet’s (Core Net AB) physical security policy defines guidelines for the identification, assessment and management of physical security risks and the implementation of several security zones within the facility.

Data Privacy:

swedencornet’s (Core Net AB) employees may handle a variety of Personal information for both other swedencornet’s (Core Net AB) employees and for customers. In some cases this personal information may fall into the category of sensitive information such as healthcare data, which requires increased levels of protection. In all circumstances, personal information and sensitive personal information must be processed and stored in accordance with swedencornet’s (Core Net AB) policies and any applicable local legislation.

swedencornet’s (Core Net AB) Data Privacy Officer may maintain a Privacy Legislation Framework to meet regulatory requirements for data privacy. The Privacy Legislation Framework covers relevant privacy legislation for swedencornet’s (Core Net AB) as a data controller and/or data processor.

Privacy Impact Assessment:

The implementation of swedencornet’s (Core Net AB) Privacy Legislation Framework, supports privacy by design. Part of privacy by design may be the execution of a Privacy Impact Assessment to ensure proper protection of personal data.

ICT Systems Management:

Information and Communication Technology (ICT) Systems includes all ICT systems used by swedencornet (Core Net AB) in swedencornet’s (Core Net AB) ICT infrastructure wheather in-house built or hosted by 3rd part service providers. swedencornet’s (Core Net AB) must meet the baseline security requirements for ICT system installation and maintenance.

Cryptography:

swedencornet (Core Net AB) uses cryptography to protect physical and logical assets. Cryptographic solutions must be employed correctly for them to be effective and cryptographic keys must be managed to ensure their availability.

Vendor Management:

swedencornet’s (Core Net AB) supply chain constitutes a risk due to the reliance on a third party implementing appropriate controls to protect services and information. swedencornet’s (Core Net AB) vendor on-boarding process must include an information security assessment which varies in detail depending on the goods or services to be provided, or the level of physical or logical access provided to the vendor. Additionally, appropriate ‘Right to audit’ clauses must be contained in all vendor contracts which allow swedencornet’s (Core Net AB) to carry out periodic assessments of the effectiveness of a vendor’s controls. Vendor contracts may also include a set of minimum expected security requirements for protecting swedencornet’s (Core Net AB) assets and information and an obligation for the vendor to inform swedencornet’s (Core Net AB) if they suffer a successful cyber-attack.

Secure Software Development:

Application source code and algorithms developed by swedencornet’s (Core Net AB) are considered Intellectual property. Such information is accessible on a Need-to-Know basis and requires specific security controls. Such controls are documented by teams holding such information.

Training & Awareness:

Information security training is provided to all swedencornet’s (Core Net AB) employees, contractors and vendors, through a variety of media. The CISO is responsible for the content of the ‘in house’ training delivered within swedencornet’s (Core Net AB) and approves any externally provided training for specific roles.