CyberSecurity Policy

CyberSecurity Policy

Purpose
This Cybersecurity Policy outlines the principles and measures adopted by CADAC Corporation to safeguard the confidentiality, integrity, and availability of information assets, ensuring the security of our IT services, staffing solutions, and background verification services.
Scope
This policy applies to all employees, contractors, clients, third-party vendors, and stakeholders accessing CADAC Corporation’s systems, applications, networks, and data. 1. Data Protection and Confidentiality All client and employee data must be handled in compliance with applicable data protection laws, including GDPR, CCPA, and local regulations. Background verification data and IT staffing details will only be accessed on a need-to-know basis. Any sensitive information (e.g., PII, financial data, or proprietary business details) must be encrypted in storage and during transmission.
2. Access Control Access to systems and data is granted based on the principle of least privilege. Multi-factor authentication (MFA) is mandatory for accessing corporate systems and client portals. Regular reviews of user access rights are conducted to prevent unauthorized access.
3. Secure Network Infrastructure Firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS) are deployed to safeguard CADAC Corporation’s IT environment. Network segmentation is implemented to limit unauthorized lateral movement within the system. Regular vulnerability assessments and penetration testing are conducted to identify and address potential risks.
4. Incident Response and Reporting All employees and stakeholders must report cybersecurity incidents, such as phishing attempts, malware infections, or data breaches, immediately to the IT security team. An Incident Response Plan (IRP) is in place to handle breaches and restore services quickly. CADAC Corporation will notify affected parties and authorities in case of a data breach, following regulatory timelines and requirements.
5. Employee Training and Awareness Mandatory cybersecurity awareness training is conducted annually for all employees, covering phishing, social engineering, and data handling. Employees involved in background verification or IT staffing services receive additional training in secure data management practices.
6. Third-Party Security Vendors and third parties accessing CADAC systems must comply with CADAC’s cybersecurity standards. Non-disclosure agreements (NDAs) and regular audits ensure third-party compliance. Data shared with third parties for IT staffing or background verification purposes must be securely transmitted and limited to essential information only.
7. Software and Device Security All devices used for CADAC business must have updated antivirus software, firewalls, and operating systems. Only authorized software applications are permitted on company devices. Personal devices used for business purposes must follow BYOD (Bring Your Own Device) security protocols, including remote wipe capability.
8. Data Backup and Recovery Regular backups are conducted for critical data, including IT staffing records and background verification details. Backups are encrypted and stored securely, with periodic testing of disaster recovery plans.
9. Policy Compliance and Enforcement Violations of this policy may result in disciplinary actions, up to and including termination of employment or contract. CADAC Corporation reserves the right to monitor systems and conduct audits to ensure compliance with cybersecurity practices.
10. Continuous Improvement The cybersecurity policy is reviewed annually or after significant changes in the IT environment or regulatory requirements. Lessons learned from incidents and audits are integrated into the policy to strengthen security measures.
Contact Information For questions or concerns about this policy, or to report a security incident, please contact: CADAC Corporation IT Security Team Email: cadaccorp@gmail.com