Information Security and Privacy Policy
Purpose
This Information Security and Privacy Policy establishes Grayphite's management framework for protecting information assets, safeguarding personal data, and ensuring the secure and responsible operation of business processes, technologies, and services. This policy defines Grayphite's commitment to implementing, maintaining, and continually improving its Information Security and Privacy Management Systems in alignment with internationally recognized standards and applicable regulatory requirements.
Scope
This policy applies to all Grayphite employees, contractors, consultants, temporary staff, affiliated partners, subsidiaries, third-party service providers, and any entity acting on behalf of Grayphite that accesses, processes, stores, manages, or transmits Grayphite information assets or personal data.
This policy applies to:
Business operations and corporate functions
Software development and delivery environments
Information systems, applications, and infrastructure
Physical and digital information assets
Customer, employee, vendor, and partner information
Cloud platforms, hosting environments, and third-party services
Personal data and privacy-related processing activities
All facilities, networks, devices, and communication channels owned or managed by Grayphite
Policy Principles
Grayphite is committed to protecting its information assets and privacy interests through a risk-based, continuously improving management framework.
1. Information Security and Privacy Management Framework
Grayphite shall establish, implement, maintain, and continually improve its Information Security Management System (ISMS) and Privacy Information Management System (PIMS) in alignment with internationally recognized standards, including:
International Organization for Standardization ISO 27001
International Organization for Standardization ISO 27701
These frameworks shall provide the foundation for security objectives, privacy objectives, risk management, and operational controls.
2. Legal, Regulatory, and Contractual Compliance
Grayphite shall identify, monitor, and comply with all applicable legal, regulatory, contractual, and business requirements relating to information security, privacy, confidentiality, and data protection.
3. Protection of Information Assets
Grayphite shall protect all information assets to ensure:
Confidentiality — information is accessible only to authorized individuals
Integrity — information remains accurate, complete, and protected from unauthorized modification
Availability — information and systems remain accessible when needed for business operations
Security controls shall be applied proportionate to the classification, sensitivity, and business value of the information.
4. Privacy Protection
Grayphite shall implement privacy controls to ensure personal information is collected, processed, stored, shared, and disposed of in accordance with applicable privacy laws, contractual obligations, and internal privacy standards.
Personal data shall be protected throughout its lifecycle using appropriate technical and organizational safeguards.
5. Risk Management
Grayphite shall identify, assess, monitor, and manage risks affecting:
Information assets
Technology platforms
Business operations
Personnel
Physical assets
Third-party relationships
Privacy and regulatory obligations
Appropriate controls, mitigation plans, and contingency measures shall be implemented to reduce identified risks to acceptable levels.
6. Business Continuity and Resilience
Grayphite shall establish, maintain, and periodically test business continuity and disaster recovery capabilities to ensure critical operations remain resilient during disruptions, cyber incidents, operational failures, or other emergencies.
7. Secure Working Environment
Grayphite shall maintain secure physical and digital environments that protect personnel, systems, facilities, and information assets from unauthorized access, accidental damage, environmental threats, and occupational hazards.
8. Personnel Awareness and Training
All personnel shall receive appropriate information security, privacy, and compliance training relevant to their roles and responsibilities.
Training includes:
Information security responsibilities
Privacy obligations
Secure handling of information assets
Incident identification and reporting
Regulatory and contractual compliance requirements
Training shall be conducted during onboarding and periodically thereafter.
9. Data Protection Controls
Grayphite shall implement relevant technical, administrative, and operational controls to protect personal and business data throughout collection, processing, storage, transmission, archival, and disposal.
10. Incident Prevention and Response
Grayphite shall maintain processes to identify, report, investigate, respond to, and recover from information security and privacy incidents in a timely and effective manner.
11. Third-Party Security and Privacy
Third-party vendors, partners, contractors, and service providers with access to Grayphite information or systems shall comply with applicable security, privacy, and contractual requirements.
Appropriate due diligence, contractual safeguards, and periodic assessments shall be performed.
12. Policy Enforcement and Accountability
Compliance with this policy is mandatory for all applicable personnel and third parties.
Grayphite management shall monitor compliance through:
Internal reviews
Management oversight
Risk assessments
Security monitoring
Internal and external audits
Violations of this policy may result in corrective, disciplinary, contractual, or legal action based on the severity and impact of the violation.
13. Policy Waivers
Where business or operational requirements necessitate exceptions to this policy, formal waiver requests must be submitted to authorized management with documented business justification, risk assessment, and compensating controls.
Waivers:
Must be formally approved prior to implementation
Shall have defined validity periods
Shall be periodically reviewed
Shall not be extended indefinitely without re-approval
Governance
The implementation, oversight, and enforcement of this policy is governed by Grayphite's Information Security, Privacy, Risk Management, and Executive Leadership functions.
Responsibilities include:
Defining security and privacy objectives
Monitoring compliance with internal policies and standards
Conducting management reviews
Approving policy changes and waivers
Reviewing incidents, risks, and corrective actions
Coordinating internal and external audits
Ensuring alignment with business and regulatory requirements
This policy shall be reviewed at least annually, or whenever significant business, technological, legal, or regulatory changes occur.
Continuous Improvement
Grayphite is committed to the continual improvement of its Information Security and Privacy Management Systems to address evolving business requirements, technology changes, threat landscapes, and regulatory obligations.
Continuous improvement activities include:
Periodic policy reviews
Internal audits and external assessments
Risk and vulnerability assessments
Security and privacy incident reviews
Corrective and preventive actions
Training effectiveness reviews
Technology and process enhancements
Management review meetings
Contact
For questions regarding Grayphite's security and compliance practices, please contact: security@grayphite.com
