--- Corporate ---
Policies and Guidelines
INFORMATION TECHNOLOGY POLUCY
-
Introduction
The Information Technology Policy (IT Policy) provides an integrated set of protection measures that must be uniformly applied across Tamilnadu Transport Development Finance Corporation Ltd (TNTDFC LTD) to ensure a secured operating environment for its business operations.
Customer Information, organisational information, supporting IT systems, processes and people that are generating, storing and retrieving information are important assets of TNTDFC LTD. The availability, integrity and confidentiality of information are essential in building and maintaining our competitive edge, cash flow, profitability, and legal compliance.
This IT Policy addresses the information security requirements of:
1. Confidentiality: Protecting sensitive information from disclosure to unauthorised individuals or systems.
2. Integrity: Safeguarding the accuracy, completeness, and timeliness of information.
3. Availability: Ensuring that information and vital services are accessible to authorised users when required
Other principles and security requirements such as Authenticity, Non-repudiation, Identification, Authorisation, Accountability and audit ability is also addressed in this policy.
-
Scope
1. This policy applies to all staff, contractors, service providers, Interns/Trainees working in TNTDFC LTD. Third party service providers providing hosting services or wherein data is held outside TNTDFC LTD premises, shall also comply with this policy.
2. Scope of this IT Policy is the Information stored, communicated and processed within TNTDFC LTD and TNTDFC LTD’s data across outsourced service provider’s locations. -
Objectives
The objective of the IT Policy is to provide TNTDFC LTD, an approach to managing information risks and directives for the protection of information assets to all units, and those contracted to provide services -
Ownership
The Board of Directors of TNTDFC LTD is the owner of this policy and ultimately responsible for IT Policy -
Responsibility
To avoid conflict of interest formulation of policy and implementation / compliance to the policy to remain segregated. Therefore the Information Security Committee (ISC) will be the owner of the IT Policy and Implementation responsibility to rest with IT department of TNTDFC LTD.
The Information Security Officer (CISO) is responsible for articulating the IT Policy that TNTDFC uses to protect the information assets apart from coordinating the security related Issues within the organisation as well as relevant external agencies.
The CISO shall not be a member of IT department and shall be an Independent Director and member of Information Security Committee (ISC).
All the staffs and external parties as defined in policy are responsible to ensure the confidentiality, integrity and availability of TNTDFC’s information assets. -
Information Security Committee (ISC)
ISC to give recommendations regarding the Information Security risk and responsible for maintenance / review of the IS Policy and also for formulating/review of all sub policies derived from IS Policy. -
Policy Exceptions
Refer to Exception handling procedure. -
Periodic Review
The policy shall be reviewed every year or at the time of any major change in existing IT environment affecting policy and procedures, by CISO and placed to Board for approval.
This policy will remain in force until next review / revision. -
Policy Compliance Check
Compliance review of IS policy should be carried out by Internal/External auditor on a periodic basis. Inspection & Audit Division is responsible for monitoring compliance of IS Policy. The compliance report should be placed by IAD to the Audit Committee of Board. -
Information Security Governance
Information security governance consists of leadership, organisational structures and processes that protect information and mitigation of growing information security threats.
Critical outcomes of information security governance include:
1. Alignment of information security with business strategy to support organisational objectives
2. Management and mitigation of risks and reduction of potential impacts on information resources to an acceptable level
3. Management of performance of information security by measuring, monitoring and reporting information security governance metrics to ensure that organisational objectives are achieved
4. Optimisation of information security investments in support of organisational Objectives
It is important to consider the organisational necessity and benefits of information security governance. They include increased predictability and the reduction of uncertainty in business operations, a level of assurance that critical decisions are not based on faulty information, enabling efficient and effective risk management, protection from the increasing potential for legal liability, process improvement, reduced losses from security-related events and prevention of catastrophic consequences and improved reputation in the market and among customers -
Management Responsibility
1. Approve policies related to information security function 2. Ownership for implementation of board approved information security policy
3. Ownership for establishing necessary organisational processes for information security
4. Ownership for providing necessary resources for successful information security
5. Ownership for establishing a structure for implementation of an information security program (framework) -
Organisation Structure
Information security organisation shall comprise of the following
1. Chairman & Managing Director
2. Board of Directors
3. Information Security Committee (ISC)
4. Information Asset Owner / Custodian
5. IT Support Function – System Analyst
6. IT System / Security Audit – External Certification Agency
-
The information Security Organisation is divided into 3 sections
1. Executive Management : Implementing effective security governance and defining the strategic security objectives of an organisation can be complex task. As with any other major initiative, it must have leadership and ongoing support from executive management to succeed.
2. Governance : Governance is the set of responsibilities and practices exercise by the board and executive management with the goal of providing strategic direction, ensuring that objectives are achieved, ascertaining that risks are managed appropriately and verifying that the enterprise resources are used responsibly.
3. Availability: Ensuring that information and vital services are accessible to authorised users when required -
Roles and Responsibilities
The roles and responsibilities of the Information Security Organisation members are as follows:
Board of Directors
1. Approving the Information Security Policy.
Information Security Committee (ISC)
1. The Independent Director shall be the chairman of the ISC. The ISC shall have the Joint Managing Director and representation from TNeGA or NICSI Experts
2. Members from Admin, HR, Legal, Finance and other departments should be called for the ISC meeting on need basis.
The ISC roles and responsibilities shall be as follows ,
1. Developing and facilitating the implementation of information security policies, and procedures to ensure that all identified risks are managed within a TNTDFC’s risk appetite.
2. Approving and monitoring major information security projects and the status of information security plans and budgets, establishing priorities, approving procedures.
3. Supporting the development and implementation of a TNTDFC-wide information security management program
4. Reviewing the position of security incidents and various information security assessments and monitoring activities across the TNTDFC
5. Reviewing the status of security awareness programs
6. Assessing new developments or issues relating to information security
7. Requirement for generating effective metrics for measuring performance of security control
8. Reporting to the Board of Directors on information security activities
9. Conducting regular ISC meetings (at least quarterly) and maintenance of MOM
-
Information Security Officer (CISO)
1. Establishing, implementing, monitoring, reviewing, maintaining and improving Information Security Management System (ISMS)
2. Reviewing the security policies/procedures and suggesting improvements
3. Coordinating the ISC meetings
4. Providing consultative inputs to the ISC on security requirements
5. Coordinating information Security initiatives in the organisation
6. Driving and monitoring the ISC directives in the organisation 7. Updating ISC about IS initiatives, issues and incidents
8. Facilitating and Conducting risk assessments of Information Assets used and recommend mitigation controls
9. Promote security awareness amongst staffs, customers and service providers -
Joint Managing Director
1. As a Head of Business Unit, Joint Managing Director is ultimately responsible for managing information risk in their respective business as part of their wider risk management responsibilities
2. Nominate Asset owner / Manager
3. Providing resources and support to the Asset Owners for information security implementation within TNTDFC LTD -
Information Asset Owner / Custodian – Manager
Information asset owners shall be allocated to each information asset and shall ensure that security processes associated with these assets are established. For data and IT systems, they are called as application owners. The asset owner or the application owner is usually the business owner. Each application should have an application owner (asset owner) who will typically be part of the concerned business function that uses the application.
Responsibilities would include, but not be limited to:
1. Assigning initial information classification and periodically reviewing the classification to ensure it still meets business needs under guidance of Information Security Committee (ISC)
2. Ensuring security controls are in place, as recommended by ISC
3. Reviewing and ensuring currency of the access rights associated with information assets they own
4. Determining access criteria and back-up requirements for the information assets / applications they own. -
IT Security Function – System Analyst
The IT Security is responsible for the execution of Information Risk policies, framework, guidelines and control processes.
The responsibilities of IT Security includes, but not limited to:
1. Enable Information Security controls
2. Define IT security procedures and guidelines in line with the IS Policies
3. Provide Security Architecture
4. Implement and monitor operational effectiveness of mandatory IT controls
5. Analysis of Security incidences, both internal and external and arriving at Lessons learned -
Technology Infrastructure Service Providers
1. Infrastructure services shall be provided by strategic outsourced partners with Service Level agreements. The service providers are custodians of IT assets on behalf of TNTDFC LTD and are responsible for the implementation and operation of the infrastructure as appropriate to meet the Confidentiality, Integrity and Availability ratings specified by TNTDFC LTD
2. Develop Standard Operating Procedures (SOP’s), Security Guidelines for the assets managed
3. Manage IT assets as per TNTDFC LTD approved policies and procedures. -
Application Developers
Application systems (including both business applications and generic supporting software, e.g. middle-ware, databases) may be developed and maintained by an internal IT function or by a third party. These parties are responsible for ensuring that systems are developed and maintained, incorporating user requirements and information security requirements that are in adherence to TNTDFC LTD Policies for Information Risk. They are also responsible, in conjunction with the provider of the underlying technology infrastructure, for ensuring that information risk is adequately managed in development and test environments and report to TNTDFC LTD IT Security -
User Manager
The user manager is the immediate manager or supervisor of the staff. User manager has the ultimate responsibility for all user IDs and information assets owned by TNTDFC staff. In the case of non-staff individuals such as contractors, consultants, etc., this manager is responsible for the activity and for the TNTDFC assets used by these individuals. He/she is usually the manager responsible for hiring the outside contractor -
End Users
1. End Users are responsible for the following with regard to information security.
2. Responsible and accountable for activities associated with an assigned account, as well as assigned equipment and removable media.
3. Protect secrecy of passwords and Business Information.
4. Report known or suspected security incidents -
Audit Team
Conduct information Security audits to check compliance against Policies and procedures. -
Policies, Procedures and Guidelines
At TNTDFC LTD considering the security requirements, Information Security policies have been framed based on a series of security principles. All the Information Security policies and their need have been addressed below: -
1. Asset Management Policy
Information assets shall be accounted for and have a nominated asset owner. Owners shall be identified and catalogued for all information assets and the responsibility for maintenance of appropriated controls shall be assigned. The implementation of specific controls may be delegated by the owner as appropriate but the owner remains accountable for the proper protection of the assets Ref: IT-Asset Management Guideline -
2. Information Risk management Procedure
Detailed risk assessments for Information risks (e.g. application risk assessment, Infra risk assessment) shall be undertaken in order to identify pertinent threats, the extent of vulnerability to those threats, the likelihood and the potential impact should a threat mature as a result of the vulnerability. This assessment shall determine acceptable, transferable and avoidable risk and the risk that shall be reduced by risk treatments (control mechanisms).
Ref: IT-Information Risk management Procedure -
3. Data Classification Policy
To ensure that Confidentiality, integrity and availability of information is maintained, a data classification scheme has been designed. The level of security to be provided to the information will depend directly on the classification of the data Ref: IT-Data Classification Guideline -
4. Acceptable IT Usage Policy
This Policy has been prepared and implemented to ensure that all the users and staff at TNTDFC LTD are aware of their responsibilities towards the IT Resources of TNTDFC LTD. This Policy details the end users aware of their responsibilities and the acceptable use of the IT Resources of TNTDFC LTD. Ref: IT-Acceptable IT Usage Guideline -
5. Access Control Policy
Data must have sufficient granularity to allow the appropriate authorised access. There is a delicate balance between protecting the data and permitting access to those who need to use the data for authorised purposes. This balance should be recognised. The Access Control Policy addresses this need. Ref: IT-Access Control Guideline -
6. E-mail Security Policy
TNTDFC LTD shall implement effective systems and procedures to ensure that e-mails are used as an efficient mode of business communication and implement control procedures so that the e-mail facility is not misused by the users. It also needs to be ensured that e-mail service and operations remain secure, efficient while communicating within intranet as well as through the internet. The Email Security Policy of TNTDFC LTD addresses this. Ref: IT-Email Security Guideline -
7. Internet & Intranet Security Policy
TNTDFC LTD should utilise Internet as an important resource for information and knowledge to carry on the business more efficiently. Users must also understand that any connection to the Internet offers an opportunity for unauthorised users to view or access corporate information. Towards this direction, TNTDFC LTD has developed systems & procedures to ensure that Internet is used only for business purposes in a secure manner, (without endangering the security of the TNTDFC LTD’s network) with a uniform code of conduct. Ref: IT-Internet & Intranet Guideline -
8. Password Security Policy
The purpose of this policy is to establish a standard for the creation of strong passwords, the protection of those passwords and the frequency of change all application software in TNTDFC LTD will have to comply with minimum password standards as specified in this document. Ref: IT-Password Security Guideline -
9. Information Security (IS) Incident Management Policy
Incident management is required and needs to be established to ensure a quick, effective, and orderly response to security incidents. Such a policy would vary in scope depending on the sensitivity and size of the information systems being managed. A companywide incident management policy has been established for all systems. Ref: IT-IS Incident Management Guideline -
10. IT-Change Management Policy
Changes to information technology facilities and systems should be controlled in order to ensure that changes made to a production component are applied in a secure and consistent manner Ref: IT-Change Management Guideline -
11. Application Security Policy
It may be required to develop and maintain software, applications and add-on modules from time to time. Proper procedures, access controls and security requirements need to be addressed in the entire process. The application security policy has been framed to address these needs. Ref: IT-Application Security Guideline -
12. Operating System Security Policy
TNTDFC LTD shall protect its operating system resources by providing security at a level that is appropriate for the nature of the data being processed. The operating system security policy has been framed for achieving this. TNTDFC LTD shall protect all business data, related application systems and operating systems software from unauthorised or illegal access. Access to the operating system must be restricted to those people who need the access to perform their duties. Ref: IT-Operating System Security Guideline -
13. Network Security Policy
Appropriate controls should be established to ensure security of data in private and public networks, and the protection of connected services from unauthorised access. TNTDFC LTD’s Network infrastructure needs to be protected from unauthorised access. A range of security controls is required in computer networks to protect these environments. Considering the above, the network security policy has been framed for TNTDFC LTD. Ref: IT-Network Security Guideline -
14. Anti-Virus Policy
Virus, Trojans, Worms, etc., are malicious programs called malware and can corrupt or destroy data or may spread confidential information to unauthorised recipients, resulting in loss of Confidentiality, Integrity, availability of the information. Malware detection and prevention measures as appropriate need to be implemented. The basis of protection against Malware should be founded on good security awareness and appropriate system access controls. The Anti-Virus policy has been framed on the above grounds. Ref: IT-Anti Virus Guideline -
15. Backup & Recovery Policy
In order to safeguard information and computing resources from various business and environmental threats, systems and procedures have been developed for backup of all business data, related application systems and operating systems software on a scheduled basis and in a standardised manner across TNTDFC LTD. The backup and recovery procedures must be automated wherever possible using the system features and be monitored regularly. The backup & recovery policy that has been framed for TNTDFC LTD considers these points. Ref: IT-Backup & Recovery Guideline -
16. Log and Audit Trail Policy
The log and audit trail policy addresses the framework for logging & auditing operating system events, application events, database events in the local area network and the network events. Ref: IT-Log and Audit Trail Guideline -
17. Mobile Computing Policy
The mobile computing policy applies to all TNTDFC LTD staffs and staff provided with a company laptop or portable electronic device. It is the staffs’ responsibility for the proper care and use of the laptop computer / PED (Portable Electronic Device), data and accompanying software while using the same. Ref: IT-Mobile Computing Guideline Ref: IT-Mobile Computing Guideline -
18. Version Control Policy
The version control policy of TNTDFC LTD addresses implementing, managing and controlling the changes in versions of application systems, and customised add-on modules, network and operating system software, interfaces and utilities. This Policy is aimed at ensuring uniformity in versions running across TNTDFC LTD and would involve maintaining up to date documentation for the entire version change process. Ref: IT-Version Control-Guideline -
19. Data Archival Policy
Proper data management will facilitate and improve the retrieval, evaluation, use and storage of critical and related information. The purpose of the data archival policy for TNTDFC LTD is to address the proper archival all its project related data as per the client requirement to support its high quality research service and also to ensure availability, integrity and confidentiality of the data. Ref: IT-Data Archival Guideline -
20. Encryption Policy
In the current environment of increasingly open and interconnected systems and networks, network and data information security are essential. This policy describes cryptography as a tool for satisfying a wide spectrum of the Information Security Management System (ISMS) needs and requirements. Ref: IT-Encryption Guideline -
21. Wireless Security Policy
Wireless Local Area Networks (LANs) form part of the TNTDFC LTD’s corporate network infrastructure. In order to protect the business needs of TNTDFC LTD, the wireless network must meet the same level of security employed by the rest of the infrastructure. This policy is to ensure that the deployment of wireless networking is controlled and managed in a centralised way to provide functionality and optimum levels of service whilst maintaining network security.
Ref: IT-Wireless Security Guideline -
22. Data Migration Policy
Sometimes, a need may arise to migrate data from one system / database to another. This typically occurs during replacement of existing application / database. This policy outlines the care to be taken during such migrations of data.
Ref: IT-Data Migration Guideline -
23. Security Awareness
All staff of TNTDFC LTD and, where relevant, contractors and third-party users shall receive appropriate awareness training and regular updates in organisational policies and procedures, as relevant for their job function -
24. Security monitoring
As per Cyber Security guidelines issued by RBI, a Security Operations Center shall be established for security monitoring of logs of critical IT Assets
Ref: Security monitoring procedure -
25. Hardware Acquisition & Maintenance
All staff of TNTDFC LTD and, where relevant, contractors and third-party users shall receive appropriate awareness training and regular updates in organisational policies and procedures, as relevant for their job function Ref: IT-Hardware Acquisition & Maintenance Guideline -
26. HR Security Guidelines
To ensure that staffs, contractors and third party users understand their responsibilities to reduce risk of theft, fraud or misuse of facilities, controls shall be implemented.
Ref: HR Security Guidelines -
27. Data Security Physical, Technical and Organisational Security Measures
Appropriate physical, technical and organisational security procedures that restrict access to and disclosure of personal data within TNTDFC are implemented. TNTDFC uses encryption, firewalls and other technology and security procedures to help protect the accuracy and security of sensitive personal information and prevent unauthorised access or improper use.
TNTDFC adapts RBI best practice guidelines for Physical, Technical and Organisational measures to ensure the security of personal data including the prevention of their alteration, loss, damage, unauthorised processing or access. -
28. Remote Access Policy
The purpose of this policy is to define standards for connecting to TNTDFC network from any host. These standards are designed to minimise the potential exposure to TNTDFC from damages which may result from unauthorised use of TNTDFC resources. Damages include the loss of sensitive or company confidential data, intellectual property, damage to public image, damage to critical TNTDFC internal systems, etc.
Ref: IT-Remote Access Policy -
29. Exception Handling Procedure
Information security policies and procedures constitute controls for protecting the Information assets. While every attempt should be made to comply with the policies and procedures there could be exceptions. The exception handling procedure should be followed for taking exceptions to the Information Security Policy. Ref: IT-Exception Handling Procedure -
30. Physical & Environmental security
To prevent unauthorised physical access, damage and interference to the organisations premises and information, critical or sensitive information processing facilities shall be housed in secure area, protected by secure parameters, with appropriate entry controls.
Ref: Physical Environment Guidelines -
31. Desktop Security Guidelines
The objective of desktop security guideline is to provide a secure computing environment where data is processed. All desktops on Local Area Network (LAN) shall be configured as per these guidelines. These guidelines are also applicable to Laptops provided by TNTDFC LTD to its staffs / contract staffs for its official use.
Ref: IT-Desktop Security Guidelines -
32. License Management Guidelines
TNTDFC uses operating systems, applications and database software that is under license agreement and limits the use of the software to specific machines. Copies of such software are limited to backups only. It is important to have a control on the use of software on the computers.
Ref: IT-License Management Guidelines -
33. Patch Management procedure
A Patch Management process needs to be in place to address technical system and software vulnerabilities quickly and effectively in order to reduce the likelihood of a serious TNTDFC’s Operations impact arising.
Ref: IT-Patch Management Procedure -
34. Asset Security Testing Procedure
With rapid use of Information Technology for processing financial data, and its use in day to business processes, evaluation of Information Security measures and implementation of an effective security monitoring controls has been identified as key requirements as per TNTDFC Information security policies.
Ref: IT-Asset Security Testing Procedure -
35. Effective Measurement
This document defines the metrics for collection and analysis of meaningful and quantifiable data to measure the effectiveness of the ISMS implementation. Metrics are to identify areas of improvements and formulate security strategies for continuously improving the security processes for the TNTDFC
Ref: IT-AIT-Effective measurement procedure -
36. Database Security Procedure
In accordance with the Information Security Policy, all databases owned by TNTDFC LTD must be adequately protected to ensure confidentiality, integrity, availability, and accountability of such systems. Databases normally provide a data storage mechanism as a back-end to an application that provides access to the data. In addition to electronic data storage, databases typically are associated with management systems which organise data into a collection of schemes, tables, queries, reports, views and other objects. Ref: IT-Database Security Procedure
-
37. Data Sanitisation Guidelines
Data Sanitisation is the process of protecting sensitive information in non-production databases from inappropriate visibility. After sanitisation, the database remains perfectly usable - the look and feel is preserved but the information content is secure. Data Sanitisation establishes relationship between technology and the expectation of privacy in the collection and sharing of personally identifiable information.
Ref: IT-Data Sanitisation Guidelines -
38. Key Management Procedure
Key management is the set of techniques and procedures supporting the establishment and maintenance of cryptographic key relationships between authorised parties within TNTDFC and its business partners, regulatory entities etc.
Ref: IT-Key Management Procedure -
39. Online Channels Security - Internet Banking & Mobile App
The implementation of appropriate authentication method and security controls should be based on assessment of the risks posed, and considering customer acceptance, ease of use, reliable performance, scalability to accommodate growth, and inter-operability with other systems. -
40. New Technology Adoption
1. Introduction of new technology and deployment of application & Infrastructure shall go through Risk assessment and sign off process before implementation in production.
2. Procedures and guidelines for new technologies shall be developed.
3. The risks associated with adoption of new & emerging technologies shall be assessed and approved. -
41. Cloud computing
Cloud computing requirements shall be assessed in detail for data security, privacy, legal requirements, sustainability of the provider, service levels, geographical location of data storage and processing, including trans-border data flows (if-any), business continuity requirements, log retention, data retention, audit trails, etc, during the risk assessment process. -
42. Social Media
Usage of Social Media within TNTDFC LTD’s network is restricted, unless approved specifically.
Staffs are personally responsible for the content they publish on-line, whether in a blog, social computing site or any other form of user- generated media.
Staffs are not authorised to publish or discuss the following on Social Media 1. TNTDFC LTD’s confidential or other proprietary information 2. To cite or reference Customers, partners or suppliers without their approval 3. To use TNTDFC LTD’s logos or trademarks unless approved to do so. -
43. Compliance
Compliance with Regulatory requirements.
1. Compliance to statutory, regulatory and contractual requirements such asInformation Technology Framework for the NBFC Sector, 2017, directives and recommendations given by Reserve bank of India shall be ensured
2. Compliance with terms/conditions and license requirements for the usage of copyrighted software or any other proprietary information/material shall be maintained
3. Cross border movement of data shall be in accordance with legal and regulatory requirements
4. Records shall be retained and managed based on legal and regulatory requirements
Compliance with Information Security policy and procedures
1. Information processing facilities shall be used as per information security policy and acceptable usage policy
2. While TNTDFC LTD respects the privacy of its staffs it reserves the right to audit and/or monitor the activities of its staffs and information stored, processed, transmitted or handled on any assets/devices/services used by staff
3. Exception to security policy and procedure shall be approved through the exception management process
4. Policy exceptions shall be reviewed at least annually and as deemed necessary based on security risks envisaged, emerging threats etc.
5. Violations or any attempted violations of security policies and procedures shall result in disciplinary actions
Information Systems Audit
1. Audits shall be conducted to ensure compliance with the information security policies, procedures and guidelines
2. The use of information systems audit tools shall be controlled and authorised to prevent any possible misuse of tools.
