Information Security Policy

1 Acceptable Use

Company devices and networks are for business purposes. Personal use must not interfere with work, consume excessive bandwidth, or violate any policy.

2 Access Control

• Unique user IDs and strong passwords (minimum 12 characters, MFA enabled)
• Access is based on the principle of least privilege
• Immediate revocation upon termination or role change

3 Data Classification & Handling

Data is classified as Public, Internal, Confidential, or Restricted. Confidential data (client EPF details, payroll) must be encrypted at rest and in transit.

4 Incident Response

All security incidents (lost devices, phishing, unauthorized access) must be reported to security@fogsconsultants.com within 2 hours.

5 Physical Security

Remote workers must secure company equipment. Clean desk policy applies in office.

6 Compliance & Audits

We conduct quarterly vulnerability scans and annual penetration tests. Non-compliance may lead to disciplinary action.