1. Objective

This Information Security Policy (“ISP”) aims to establish the principles, concepts, and general guidelines regarding Information Security (I.S.), intended to protect the information of Combateafraude Tecnologia da Informação S.A. (“CERTTA”) and its clients. This is a strategic document designed to promote the secure use of CERTTA’s information assets and to guide all employees, clients, and partners regarding the information security directives adopted.

Accordingly, this Policy shall be understood as a formal statement of the company’s commitment to protecting the information under its custody and must be complied with by all employees.

2.  Scope and Assumptions

This Policy outlines comprehensive guidelines for the protection of information, ensuring the fundamental principles of confidentiality, integrity, and availability. Its scope encompasses all CERTTA operations and establishes essential premises for preserving information security at all organizational levels.

Given the growing reliance on information technology (IT) assets, it is essential that administrators and users of these assets adopt appropriate protection measures, comply with the controls required by CERTTA, and maintain operational risk levels involving data and information within acceptable criteria. 

3. Coverage and Applicability

This Policy applies to:

• All CERTTA Employees, regardless of (i) their area of activity, (ii) hierarchical level, or (iii) headquarters, branch, or country where they are allocated;
  
  
• All Third Parties (goods and service providers) who perform professional activities at CERTTA or represent it for any purpose, regardless of their headquarters, branch, or country.
  

For the purposes of this Policy, Employees and Third Parties shall be jointly referred to as “Collaborators.”

4. Information Security Principles

Information security aims to preserve the properties of confidentiality, integrity, and availability of information, whether in electronic, physical, or verbal form, as well as the systems that store such information, based on the following pillars:

Confidentiality: Access to CERTTA’s information, as well as that of its clients, suppliers, and third parties, is granted only to authorized individuals and only when necessary, preventing unauthorized access.
Integrity: CERTTA ensures the accuracy and completeness of information and its processing methods, as well as the integrity of client data under its responsibility.
Availability: CERTTA ensures that information and related assets are available to professionals who genuinely require access, in accordance with the service levels agreed with clients.
Authenticity: CERTTA ensures the legitimacy and veracity of the origin of information, guaranteeing the unequivocal identification of the author of data recorded in its systems. Mechanisms are adopted to prevent unauthorized changes and ensure traceability throughout the information lifecycle.

5. Definitions

For better understanding of this Policy, the following definitions apply:

Threat: Potential cause of an incident that may result in harm to CERTTA’s business.
Cloud Computing Environment: Model for delivering IT resources (infrastructure, platform, or software) via the internet through external providers, with high scalability and flexibility.
Anonymization: Use of reasonable and available technical means at the time of processing by which data can no longer be associated, directly or indirectly, with an individual.
Antivirus/Antimalware: Security solution installed on devices to detect, block, and remove malicious software.
Information Asset: Any item that contains, processes, or supports CERTTA data, including files, systems, physical devices (such as laptops and servers), and printed documents.
Audit: Systematic, documented, and independent process for obtaining evidence and evaluating the extent to which audit criteria are met.
Backup: Secure copy of corporate information stored in a safe location, used for recovery in case of loss, failure, or incident.
Information Security, Privacy, and Data Protection Committee: Permanent multidisciplinary working group appointed by CERTTA’s Board to address matters related to privacy, data protection, and information security.
Encryption: Technique used to encode information to prevent unauthorized access, even in the event of interception or leakage.
Personal Data: Information relating to an identified or identifiable natural person.
Sensitive Personal Data: Personal data relating to racial or ethnic origin, religious belief, political opinion, union membership, health, sexual life, genetic or biometric data linked to a natural person.
Firewall: Device or software used to control network traffic, allowing or blocking connections based on security rules.
Information Security Incident: Any event that compromises the confidentiality, integrity, or availability of information, including but not limited to personal data.
Processing: Any operation performed on Personal Data, such as collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation, modification, communication, transfer, dissemination, or extraction.
Vulnerability: Weakness in systems, processes, or configurations that may be exploited by a threat.

6. Guidelines

‍

CERTTA is committed to complying with applicable legislation. To effectively guide its business activities, CERTTA establishes a structured and transparent Information Security Policy. Accordingly, the following guidelines apply:

‍

• Treat all information confidentially and ethically throughout its lifecycle;
• Ensure segregation of duties to prevent conflicts of interest or self-sabotage;
• Monitor and respond to incidents involving all CERTTA assets and services;
• Promote awareness and engagement through regular training;
• Adopt and disseminate security best practices throughout the application development lifecycle and in new processes and products.

Additionally:

• Information and technological environments are the exclusive property of CERTTA;
• Client, partner, third-party, and employee information must be handled ethically and in compliance with applicable laws, especially data protection laws;
• Information must be used only for authorized purposes;
• System and information usage may be monitored and logs used as evidence;
• CERTTA commits to adopting appropriate security techniques for data processing;
• Confidential information must never be shared without authorization and secure mechanisms;
• Responsibilities for information security must be widely communicated;
• This Policy is supported by additional security standards and procedures;
• CERTTA is committed to continuous improvement of its Information Security Management System in accordance with ISO/IEC 27001.

‍

7. Roles and Responsibilities

7.1 All Collaborators

• Be aware of and comply with the guidelines established by CERTTA, especially the information security criteria set forth in this document;
• Classify information in accordance with the criteria defined in CERTTA’s internal Information Classification Policy;
• Strictly comply with this Policy, CERTTA’s Information Security Standards and Procedures, and any other documents related to information security;
• Participate in information security training sessions, campaigns, and workshops provided by CERTTA;
• Protect information against unauthorized access, modification, destruction, or disclosure;
• Ensure that the technological resources, information, and systems made available are used only for purposes approved by CERTTA;
• Comply with laws and regulations governing intellectual property and fair competition;
• Do not discuss confidential work matters in public places or exposed areas (airplanes, public transportation, restaurants, social gatherings, etc.), including posting comments or opinions about confidential matters on blogs and social media;
• Do not share your access credentials to CERTTA Systems with third parties, including other collaborators;
• Immediately report any non-compliance with or violation of this Policy to the Information Security area via email: [email protected];
• Notify the DPO (Data Protection Officer) and CERTTA’s Privacy area via [email protected] and [email protected] in the event of incidents and/or questions related to personal data privacy, in accordance with the applicable Privacy Policies;
• In the event of a violation of this Policy, contact CERTTA’s Whistleblowing Channel (https://www.contatoseguro.com.br/caf) or the Compliance team directly via email: [email protected].

7.2 Responsibilities of the Information Security Team

• Review and validate CERTTA’s Information Security Policies, ensuring compliance with applicable legislation;
• Identify and communicate potential technical vulnerabilities related to the Information Security System, acting as the guardian of the Information Security System Organization Policy and ensuring compliance with this document and other relevant guidelines;
• Support CERTTA’s Information Security, Privacy, and Data Protection Committee in mitigating organizational risks and contribute to achieving the strategic objectives of the Information Security System;
• Implement and manage information security controls and standards by broadly promoting and reviewing Information Security Policies, Standards, and Procedures for all collaborators, including third parties;
• Promote information security awareness initiatives for all collaborators;
• Propose and manage projects and initiatives related to CERTTA’s information security management;
• Manage and monitor the systems and controls under the responsibility of CERTTA’s Information Security area and those of its clients;
• Manage software, assets, scripts, privileged accounts, vulnerabilities, equipment, and other activities that ensure the security of information managed by CERTTA;
• Control changes made to IT assets, ensuring they are properly analyzed and tested to prevent adverse impacts on CERTTA’s operations or information security.

7.3 Responsibilities of the Compliance Area

• Communicate legislative changes that impact these policies, proposing the necessary adaptations;
• Provide support to the business areas in handling cases of non-compliance, including the recommendation of disciplinary and/or legal measures, when applicable;
• Support other areas in adopting containment measures in situations involving improper use of data.

7.4 Responsibilities of the Privacy Area and the DPO

• Advise CERTTA on the adoption of best practices in personal data protection, in compliance with applicable legislation;
• Monitor and propose solutions to mitigate risks related to privacy and personal data protection;
• Educate collaborators on secure and appropriate personal data processing practices;
• Act as a point of communication between CERTTA, data subjects, and governmental authorities.

8. Information Classification and Handling

To establish robust security criteria in line with governance best practices, CERTTA adopts formal information classification and labeling practices, as set forth in its Information Classification Policy.

Information is categorized according to its level of importance, criticality, sensitivity, and relevance to CERTTA’s business, using the following standard labels: Public, Internal, Restricted, Confidential.

All information must be adequately protected in accordance with CERTTA’s information security guidelines throughout its entire lifecycle, including its creation, handling, storage, transportation, and disposal.
Information must be used ethically, transparently, and exclusively for the purposes for which it was collected, in compliance with the principles of privacy and personal data protection established by the LGPD.
When information is used for statistical purposes, reports, or analyses, anonymization is mandatory, ensuring that the data does not allow the direct or indirect identification of clients, third parties, or collaborators, except where expressly consented to or required by law.

9.  Information Security Measures

In order to protect CERTTA’s assets and ensure the confidentiality, integrity, availability, and authenticity of data, CERTTA adopts a robust set of information security measures, applied both within its internal environment and across the products and services offered to the market. These measures aim to mitigate risks, prevent security incidents, and ensure compliance with legal and regulatory requirements. The measures adopted by CERTTA are described below.

9.1 Access Management

In order to ensure the effectiveness of the Information Security System, all access granting, revocation, and review activities are performed by the IT department, based on the principle of least privilege, as set forth in the Logical Access Management Policy.

Accordingly, access permission levels are limited strictly to the information necessary for the performance of the user’s duties, preventing access to information that is not required for their role.

All collaborators and service providers are responsible for complying with these guidelines, using only the accesses that have been formally granted (upon proper approval) and maintaining the confidentiality of their credentials.

Considering that a significant portion of collaborators work remotely (home office), they are responsible for adopting appropriate physical protection measures in their work environments, including, but not limited to:

• Ensuring that devices used for work are protected against unauthorized access by third parties;
• Avoiding the storage of sensitive information in unsecured locations;
• Locking the screen when away from the workstation to ensure confidentiality;
• Avoiding the discussion of confidential matters in public places;
• Complying with the clean desk policy, avoiding the placement of information on sticky notes or similar materials attached to computers or work equipment.

Regarding physical access to CERTTA’s facilities, especially environments containing technological resources, access is restricted and controlled, in accordance with the following principles:

• Access to CERTTA’s physical premises is granted only upon formal authorization;
• Visitors must be previously identified and registered and, when necessary, accompanied by an authorized collaborator throughout their stay.

9.2 Password Management

Passwords and access codes for personal devices and systems must not be shared under any circumstances, as they are personal and non-transferable information, in accordance with the guidelines and recommendations set forth in CERTTA’s Password Policy.

In addition, CERTTA collaborators must comply with minimum security standards, including the use of a password vault.

Each collaborator is fully responsible for all actions performed using their credentials, as well as for any damages or losses resulting from the disclosure of their password to third parties, regardless of the reason.

9.3. Encryption

In order to establish the highest security standards, CERTTA seeks to implement cryptographic controls for the storage and transmission of information in the course of its activities. Accordingly, all confidential data of CERTTA must be protected through encryption, including data on all equipment used by collaborators and/or third parties, in compliance with the guidelines and recommendations set forth in the Encryption Policy.

In addition, whenever new controls are implemented, they shall be tested and evaluated with regard to their security level and effectiveness, ensuring that the established protection criteria are being met.

9.4. Corporate Email

The use of corporate email services must be exclusively related to CERTTA’s activities and interests. All information stored or transmitted through the corporate email system is the exclusive property of CERTTA. The account holder is fully responsible for its use, and the following actions are prohibited:

• Storing emails or any organizational information in a personal mailbox or in any other digital or printed storage medium;
• Forging, falsifying, or altering any information contained in messages;
• Producing, transmitting, or disclosing messages containing hostile information;
• Sending email messages using CERTTA’s domain or another person’s username or email address that the sender is not authorized to use;
• Disclosing unauthorized information or screenshots, systems, documents, or similar materials without express authorization.

9.5. Use of Equipment

‍

CERTTA’s equipment is provided exclusively for the performance of professional activities and includes content filtering and monitoring tools, with the purpose of protecting collaborators, preserving the company’s assets, and ensuring compliance with this Policy and the Code of Conduct.

The equipment does not allow the use of mass storage devices (such as USB flash drives and external USB disks). In addition, access to CERTTA’s services requires the mandatory use of MFA (Multi-Factor Authentication) tools through authenticator applications.

9.6. Backup

In order to ensure the integrity and availability of the information under its custody, CERTTA performs recurring backups of its databases, as set forth in the Backup Policy.

CERTTA also conducts restore tests to confirm the integrity of backup copies and their recovery time.

10. Use of Artificial Intelligence

CERTTA aims to establish guidelines for the responsible, ethical, and secure use of Artificial Intelligence (AI) in the development of products, services, and tests carried out by CERTTA, in accordance with its institutional principles and governance structure. Accordingly, collaborators involved in the design, development, deployment, and monitoring of AI systems must base their decisions on the following principles, as reinforced by CERTTA’s AI governance framework:

• Security and Reliability: AI systems must be designed to operate in a secure and reliable manner, including in the face of unforeseen situations;
• Transparency and Accountability: The right to information regarding automated decisions made by AI systems must be ensured, making AI systems understandable;
• Ethics and Fairness: The entire AI lifecycle must be conducted in an ethical, fair, non-discriminatory, and trustworthy manner, based on impact assessments;
• Accountability: Collaborators must assume responsibility for decisions and impacts arising from the use of AI;
• Risk Management: An organizational culture focused on continuous monitoring and mitigation of risks associated with AI must be implemented.

Accordingly, CERTTA is committed to developing products and systems that:

• Operate in a fair manner, actively recognizing and correcting disparities;
• Do not make distinctions of any kind, including but not limited to race, color, sex, gender, age, national or social origin, or any other condition.

CERTTA also commits to continuously monitoring the use of artificial intelligence in alignment with its principles, values, and strategic objectives.

‍

11. Personal Data Protection

CERTTA maintains a robust governance program for privacy and personal data protection. As provided in its Privacy Policy, all necessary measures are adopted to ensure CERTTA’s compliance with applicable data protection legislation.

Among the measures adopted, access to information is restricted to authorized individuals only, including data sharing with third parties when necessary, as well as defined data retention periods and secure data disposal procedures.

12. Risk Management, Objectives, and Information Security Incidents

CERTTA has a Risk Management Policy and a formal procedure that governs the handling of Information Security incidents, establishing guidelines, responsibilities, and procedures to ensure the proper protection of its information assets.

Risk management is carried out through risk assessments, including the identification, evaluation, and treatment of risks that may impact CERTTA’s operations, assets, reputation, or legal and regulatory compliance.

This process is aligned with the organization’s strategic context and aims to preserve the principles of confidentiality, integrity, availability, and authenticity of information.

Identified risks are assessed based on their likelihood and impact and are treated according to their criticality through mitigation, acceptance, transfer, or elimination actions, always in accordance with the risk levels defined by Senior Management.

Regarding information security incidents, CERTTA adopts formal procedures that establish:

• Identification, categorization, and analysis of incidents;
• Immediate response and treatment for containment and damage mitigation;
• Detailed incident recording for audit and continuous improvement purposes;
• Communication to internal stakeholders and, when applicable, notification to clients, regulatory authorities, or other stakeholders, as required;
• Execution of lessons-learned activities to strengthen security controls.

All collaborators are required to immediately report any event or suspected security incident using the official channels made available.

13. Information Asset Management

CERTTA’s information assets must be properly identified, classified, and recorded in a centralized inventory, whenever applicable, in accordance with internal guidelines. Responsibility for maintaining, periodically updating, and ensuring the accuracy of the information asset inventory lies with CERTTA’s Information Security team, with the support of the respective asset owners, who must ensure that the information remains accurate and up to date.

Proper asset management is essential to ensure the protection of CERTTA’s information throughout all stages of its lifecycle, promoting the integrity, confidentiality, and availability of corporate data and resources.

14. Security Awareness Training

We recognize our collaborators as a first line of defense in protecting CERTTA’s data and that of our clients. To support this role effectively, we maintain a dedicated team focused on promoting security awareness, starting from the onboarding process for new collaborators to ensure their familiarity with secure practices. In addition, we remain committed to continuous training in data security and the protection of personal information.

Our collaborators are trained to effectively identify and report commonly used attack vectors, such as phishing. The effectiveness of our awareness programs is monitored through performance indicators, ensuring continuous improvement. Training schedules are periodically reviewed to incorporate market trends and the evolving maturity of our collaborators.

We foster an active security culture through various communication and engagement initiatives, including:

• Biweekly newsletter: continuous communication on security topics with all collaborators;
• Social media content: sharing useful security tips with our clients and followers;
• Corporate podcast: a space where collaborators share knowledge on security;
• Engagement events: events open to the public and collaborators’ families aimed at bringing security awareness to the community, as well as events focused on collaborators and third parties to exchange knowledge and experiences related to cybersecurity beyond the work environment.

These initiatives ensure that our collaborators are always informed and prepared to face security challenges, reinforcing our proactive posture in data protection.

15. Engagement and Use of Tools Provided by Suppliers and Third Parties

CERTTA maintains a robust KYS (Know Your Supplier) process. All suppliers must undergo a prior privacy and information security due diligence assessment, both at the time of engagement and throughout the duration of the contractual relationship.

Depending on the service or product provided, the supplier may also be required to present information security and business continuity certifications, such as: ISO/IEC 27001, ISO/IEC 27701, ISO/IEC 27017, ISO/IEC 27018, and ISO 22301. Such certifications must be issued by an Accredited Certification Body (ACB) holding national or international accreditation.

All tools and systems used by collaborators must be previously authorized by the Information Security area in order to ensure that they meet the appropriate security standards. The use of non-approved systems may result in the sanctions established in this Policy being applied to the offending user.

Likewise, all third-party or supplier tools must be used in good faith and in compliance with CERTTA’s policies and standards, with users being aware of their accountability for any improper use or use in violation of the established policies.

16. Exceptions

Collaborators who require an exception to this Policy must:

• Submit a formal request containing a detailed explanation of the need for the exception, with prior approval from their immediate manager;
• Register the request by opening a ticket directed to the Information Security area;
• Await the analysis, documentation, and final decision of the Information Security area, with validation by CERTTA’s Executive Management.

In situations where the exception represents a risk to information security or regulatory compliance, formal risk acceptance may be required, in accordance with the applicable Risk Management Policy. In such cases, CERTTA’s Risk Management team will be engaged to perform the risk assessment, document the decision, and, when applicable, obtain approval from Senior Management.

17. Sanctions

In the event of non-compliance with the rules established in this Policy by collaborators or third parties, the sanctions set forth in CERTTA’s Code of Ethics and Conduct shall be applied. The severity of the sanctions will be determined according to the level of seriousness of the conduct committed by the collaborator.

18. Final Provisions

This Policy shall remain in force for a period of one (1) year; however, it may be reviewed, updated, or amended at any time, at CERTTA’s sole discretion, whenever a relevant fact or event justifies its revision.

The Information Security area is responsible for supervising compliance with this Policy and for referring any relevant cases to executive management. In the event of questions related to this Policy, it is recommended to contact the Information Security area via email at [email protected].

19. References

‍

The following guidelines and supporting documents are an integral part of this Information Security Policy for legal purposes and must be equally observed:

‍

• Audit Log Management Procedure;
• Backup Policy;
• Brazilian Law No. 13,709/2018 – General Data Protection Law (LGPD);
• Cloud Security Policy;
• Code of Conduct & Ethics;
• Data Retention and Disposal Policy;
• Encryption Policy;
• Equipment Use Policy;
• Information Classification Policy;
• Information Security System Organization Policy;
• ISO 31000 – Risk Management;
• ISO/IEC 27001 – Information Security Management;
• ISO/IEC 27002 – Information security, cybersecurity, and privacy protection – Information security controls;
• Logical Access Management Policy;
• Password Policy;
• Personal Data Breach and Information Security Incident Management Procedure Manual;
• Privacy Policies;
• Procedures Manual for the Secure Disposal of Data and Sensitive Information;
• Security Measures Applied by CERTTA;
• Standard for the Secure Disposal of Sensitive Information;
• Trust Services Criteria for SOC 2 Type 2.

‍

20. Version History