Information Security Policy¶

Organization: Cloudnaut Technologies LLP
Classification: Internal
Document status: Effective
Version: 1.0
Owner: Management / Security Owner
Effective date: 2026-10-15
Review cycle: Annual; interim revision upon material change to services, delivery model, law, or customer contractual requirements

Document control¶

Role	Name
Prepared by	Management / Security Owner (Cloudnaut)
Reviewed by	Sandeep AC
Approved by	Sandeep AC

Revision history¶

Version	Date	Summary	Reviewed by	Approved by
0.1	2026-10-15	Initial draft: consolidated information security policy referencing the existing policy library.	Sandeep AC	—
1.0	2026-10-15	Initial effective release.	Sandeep AC	Sandeep AC

Purpose¶

This policy sets out Cloudnaut’s overall commitment to information security, the objectives the security program works toward, how the program is governed, and which policy governs each control area. It is the top-level document of the Cloudnaut policy library; topic-specific policies provide the detailed requirements and are referenced rather than repeated here.

Scope¶

This policy applies to:

All Cloudnaut employees, contractors, consultants, and subcontractors (“personnel”).
Cloudnaut-owned or Cloudnaut-managed information, systems, endpoints, accounts, and repositories.
Customer information, systems, and environments to the extent Cloudnaut personnel are given access to them during an engagement.

Cloudnaut delivers engineering and consulting services, usually inside environments that the customer owns and operates. The customer remains responsible for the security controls of its own infrastructure, accounts, and platforms. Cloudnaut is responsible for the conduct of its personnel, the security of its own endpoints and corporate systems, and the quality and security of the work it delivers. The split of responsibilities by delivery model is defined in the Engagement Responsibility Model.

Where a customer contract, statement of work, or security addendum imposes stricter requirements, those requirements take precedence for that engagement.

Security objectives¶

Cloudnaut’s information security program aims to:

Protect the confidentiality, integrity, and availability of customer and company information entrusted to Cloudnaut.
Keep customer engagements separated so that access, data, and credentials for one customer or engagement are never used for another.
Deliver code and infrastructure-as-code that meets a documented secure development baseline.
Ensure personnel are screened, trained, and aware of their security obligations.
Detect, report, and respond to security incidents promptly, and meet contractual notification obligations.
Maintain accurate, evidence-backed statements about Cloudnaut’s security posture in customer and vendor assurance reviews.

Measurable targets for these objectives are recorded by the Security Owner and reviewed at the management review described below. Example measures include training completion rate, patch compliance, and open high-severity findings.

Governance¶

Management sets security direction, approves policies, accepts residual risk, and provides resources for the security program.
The Security Owner maintains this policy library, coordinates risk assessment, incident response, and evidence collection, and reports security status to management. The person holding the Security Owner role is designated by management and recorded internally.
Policy approval: new policies and material revisions are approved by management before they become effective. Approval, effective date, and reviewer are recorded in each document’s revision history.
Management review: management reviews the security program at least annually, covering policy currency, risk register, incidents, audit and certification results, customer assurance findings, and open actions.
Certifications: Cloudnaut’s certifications and attestations are governed by Security Certifications and Attestations. Claims are made only to the extent supported by the controlled register.

Roles and responsibilities¶

Role	Responsibilities
Management	Approves policies and exceptions; accepts risk; owns business continuity decisions; ensures resourcing.
Security Owner	Maintains the policy library; runs risk management, incident coordination, access reviews, and supplier security reviews; maintains the evidence register.
HR / People Operations (designated by management)	Screening, onboarding and offboarding records, confidentiality agreements, disciplinary process — see HR Security Policy.
Engagement Lead	Applies customer requirements to the engagement; requests and revokes engagement access; is first escalation point for engagement incidents.
All personnel	Comply with this policy library and customer requirements; complete training; protect credentials and data; report incidents and weaknesses without delay.

Policy statements by control area¶

Each control area below is governed by the referenced policy. This section states the baseline requirement; the referenced policy contains the detail.

Risk management¶

Information security risks to Cloudnaut and to customer engagements are identified, assessed, assigned an owner, and treated or formally accepted. See Risk Management Policy.

Asset management and information classification¶

Cloudnaut maintains an inventory of the endpoints, accounts, repositories, and SaaS services it uses for customer and company work. Information is classified as Public, Internal, Confidential, or Restricted and handled according to its classification. See Data Handling Policy and Endpoint Security Policy.

Identity and access management, MFA, and least privilege¶

Access is granted on a need-to-know and least-privilege basis, approved before provisioning, reviewed periodically, and removed promptly when no longer required. Multi-factor authentication is required for Cloudnaut corporate accounts, source-control accounts, and cloud console access wherever the platform supports it. See Access Control and Identity Management Policy and Engagement Access Isolation Policy.

Endpoint security¶

Endpoints used for customer work must have full-disk encryption, endpoint protection, host firewall, and current security patches before accessing customer systems. See Endpoint Security Policy.

Encryption¶

Data at rest on endpoints is protected by full-disk encryption (LUKS on Linux, BitLocker or approved equivalent on Windows). Data in transit uses encrypted protocols (for example TLS, SSH, HTTPS). Encryption requirements for systems delivered to customers follow the secure configuration baseline in the Secure SDLC Policy and the Cloud Security Policy. Customer-specified encryption standards take precedence.

Vulnerability and patch management¶

Operating system and application patches are applied per the Patch Management Policy. Code and dependency vulnerabilities are detected and triaged per the Code Security Scanning Policy.

Secure development¶

Code and infrastructure-as-code are developed under the Secure Software Development Lifecycle Policy, using tools permitted under the Approved Development Tools and Plugin Policy, and delivered under the Customer Deliverable Development and Review Policy.

Cloud security¶

Work in AWS and other cloud environments follows the shared responsibility model and the Cloud Security Policy.

Artificial intelligence¶

Use of AI tools and the engineering of AI and agentic systems follow the AI Governance and Acceptable Use Policy.

Security awareness and training¶

Personnel complete security awareness training at onboarding and annually. See Information Security Training Policy.

Human resources security¶

Personnel are screened, bound by confidentiality obligations, onboarded, and offboarded under the HR Security Policy and Background Verification Policy. Expected conduct is set by the Code of Business Conduct and Ethics.

Incident management¶

Suspected security incidents are reported immediately and handled under the Incident Response and Management Policy and Incident Response Procedure.

Supplier and third-party security¶

Suppliers and subcontractors with access to Cloudnaut or customer information are assessed before engagement and reviewed periodically. See Third-Party and Supplier Security Policy and Engagement Role Boundaries and Security Governance Policy.

Business continuity¶

Cloudnaut plans for continuity of its own services and supports customers’ continuity arrangements to the extent defined in each engagement. See Business Continuity and Disaster Recovery Policy.

Compliance, monitoring, and review¶

Cloudnaut complies with applicable law, including Indian law applicable to its operations (for example the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 as its rules come into force), and with customer contractual obligations. Applicable laws and jurisdictions are confirmed with legal advice as required.
Compliance with this policy library is monitored through the evidence each policy defines (training records, access reviews, endpoint attestations, scan results, incident records), the internal evidence register, management review, and certification audits.
Each policy is reviewed at least annually and upon material change.

Exceptions¶

Exceptions to any policy in this library must be requested in writing, state the business reason, the risk, any compensating controls, and an expiry date, and be approved by management (and by the customer where the exception affects a customer engagement). Approved exceptions are recorded and reviewed at or before expiry.

Non-compliance¶

Violations of this policy library may result in removal of access and disciplinary action under the HR Security Policy, in addition to any contractual or legal consequences.

Records¶

Records demonstrating this policy include approved policy versions and revision histories, management review minutes, the risk register, exception approvals, and the records listed in each referenced policy. Records are held in Cloudnaut’s internal, access-controlled locations and are not published on this site.

All policies in the Policy index.