Personal Information
- Name
- Contact information
- Account information
- Educational information
- Professional information
Information Security Policy
Protecting Information. Securing Trust.
At BrainSeeds, information security is fundamental to the trust placed in us by students, parents, professionals, educators, educational institutions and organisations.
Effective Date: [Insert Date]
Last Updated: [Insert Date]
BrainSeeds
Protect the information.
Protect the individual.
Protect the trust.
Security is more than technology.
We recognise that protecting information requires strong security controls, responsible people, secure technology, controlled access and appropriate processes.
01
Strong security controls
02
Responsible people
03
Secure technology
04
Controlled access
05
Appropriate processes
06
Continuous monitoring
07
Staff awareness
08
Third-party oversight
09
Incident preparedness
10
Continuous improvement
Information-security philosophy
Protect the information. Protect the individual. Protect the trust.
This Information Security Policy establishes the principles BrainSeeds uses to protect information against unauthorised access, alteration, disclosure, loss, destruction and misuse.
Information Security Policy
Protecting Information. Securing Trust.
At BrainSeeds, information security is fundamental to the trust placed in us by students, parents, professionals, educators, educational institutions and organisations.
Effective Date: [Insert Date]
Last Updated: [Insert Date]
BrainSeeds
Protect the information.
Protect the individual.
Protect the trust.
Security is more than technology.
We recognise that protecting information requires strong security controls, responsible people, secure technology, controlled access and appropriate processes.
01
Strong security controls
02
Responsible people
03
Secure technology
04
Controlled access
05
Appropriate processes
06
Continuous monitoring
07
Staff awareness
08
Third-party oversight
09
Incident preparedness
10
Continuous improvement
Information-security philosophy
Protect the information. Protect the individual. Protect the trust.
This Information Security Policy establishes the principles BrainSeeds uses to protect information against unauthorised access, alteration, disclosure, loss, destruction and misuse.
Purpose & Scope
A structured approach to information security.
The policy establishes a structured approach to protecting BrainSeeds information and technology resources, while defining the core principles that guide how information should be protected and made appropriately available.
Foundation
Information
Security
Security
Three foundational principles
Protect the right information, in the right way.
The policy seeks to support three connected principles: Confidentiality, Integrity and Availability.
C
Confidentiality
Information should only be accessible to authorised
individuals and systems.
I
Integrity
Information should remain accurate, complete and protected
from unauthorised modification.
A
Availability
Authorised users should be able to access appropriate
information and services when reasonably required.
SECTION 03
What the policy covers
This policy applies to information and technology resources used in connection with BrainSeeds services, including where applicable:
Websites
Assessment platforms
Applications
Databases
Cloud infrastructure
Servers
Computers and devices
Networks
Communication systems
Administrative systems
Learning platforms
Customer-support systems
Backup systems
Third-party technology services
Information processed by authorised personnel
The policy applies to
Employees
Management
Assessment professionals
Trainers
Consultants
Contractors
Technical personnel
Support personnel
Authorised third-party service providers
Purpose & Scope
A structured approach to information security.
The policy establishes a structured approach to protecting BrainSeeds information and technology resources, while defining the core principles that guide how information should be protected and made appropriately available.
Foundation
Information
Security
Security
Three foundational principles
Protect the right information, in the right way.
The policy seeks to support three connected principles: Confidentiality, Integrity and Availability.
C
Confidentiality
Information should only be accessible to authorised
individuals and systems.
I
Integrity
Information should remain accurate, complete and protected
from unauthorised modification.
A
Availability
Authorised users should be able to access appropriate
information and services when reasonably required.
SECTION 03
What the policy covers
This policy applies to information and technology resources used in connection with BrainSeeds services, including where applicable:
Websites
Assessment platforms
Applications
Databases
Cloud infrastructure
Servers
Computers and devices
Networks
Communication systems
Administrative systems
Learning platforms
Customer-support systems
Backup systems
Third-party technology services
Information processed by authorised personnel
The policy applies to
Employees
Management
Assessment professionals
Trainers
Consultants
Contractors
Technical personnel
Support personnel
Authorised third-party service providers
Information & Classification
Know what information needs protection.
BrainSeeds may process different categories of information across its services. The level of protection required may vary according to the sensitivity of the information.
SECTION 04
Information we seek to protect
BrainSeeds may process different categories of information, including the following.
Assessment Information
- Assessment responses
- Scores
- Assessment reports
- Psychometric profiles
- Multiple Intelligence profiles
- Personality-related information
- Aptitude and competency information
- Learning preferences
Development Information
- Development goals
- Personalised learning plans
- Training participation
- Progress information
- Reassessment records
- Career interests
Transaction Information
- Payment-related information
- Billing information
- Transaction records
Technical Information
- Device information
- IP-related information
- Browser information
- Authentication information
- System logs
- Security events
Organisational Information
- School or institution information
- Corporate programme information
- Business information
- Administrative information
Not every BrainSeeds service collects every category.
SECTION 05
Information classification
BrainSeeds may classify information according to its sensitivity and the level of protection required. A practical classification framework may include:
01
Public
Public
Information intended for public communication.
Examples:- Website content
- Public course descriptions
- Published articles
- Public announcements
02
Internal
Internal
Information intended primarily for authorised BrainSeeds personnel.
Examples:- Internal procedures
- Operational documents
- Internal communications
03
Controlled access
Confidential
Information requiring controlled access.
Examples:- Customer information
- Business information
- Internal financial information
- Programme records
04
Heightened protection
Sensitive / Highly Confidential
Information requiring heightened protection.
Examples may include:- Children's information
- Assessment responses
- Psychometric profiles
- Individual developmental information
- Personal career profiles
- Authentication information
- Security information
↗
The classification of information should influence how it is stored, accessed, transmitted and retained.
Information & Classification
Know what information needs protection.
BrainSeeds may process different categories of information across its services. The level of protection required may vary according to the sensitivity of the information.
SECTION 04
Information we seek to protect
BrainSeeds may process different categories of information, including the following.
Personal Information
- Name
- Contact information
- Account information
- Educational information
- Professional information
Assessment Information
- Assessment responses
- Scores
- Assessment reports
- Psychometric profiles
- Multiple Intelligence profiles
- Personality-related information
- Aptitude and competency information
- Learning preferences
Development Information
- Development goals
- Personalised learning plans
- Training participation
- Progress information
- Reassessment records
- Career interests
Transaction Information
- Payment-related information
- Billing information
- Transaction records
Technical Information
- Device information
- IP-related information
- Browser information
- Authentication information
- System logs
- Security events
Organisational Information
- School or institution information
- Corporate programme information
- Business information
- Administrative information
Not every BrainSeeds service collects every category.
SECTION 05
Information classification
BrainSeeds may classify information according to its sensitivity and the level of protection required. A practical classification framework may include:
01
Public
Public
Information intended for public communication.
Examples:- Website content
- Public course descriptions
- Published articles
- Public announcements
02
Internal
Internal
Information intended primarily for authorised BrainSeeds personnel.
Examples:- Internal procedures
- Operational documents
- Internal communications
03
Controlled access
Confidential
Information requiring controlled access.
Examples:- Customer information
- Business information
- Internal financial information
- Programme records
04
Heightened protection
Sensitive / Highly Confidential
Information requiring heightened protection.
Examples may include:- Children's information
- Assessment responses
- Psychometric profiles
- Individual developmental information
- Personal career profiles
- Authentication information
- Security information
↗
The classification of information should influence how it is stored, accessed, transmitted and retained.
Security Architecture
Security belongs in the design.
BrainSeeds seeks to incorporate security considerations into systems and processes from the beginning rather than treating security as an afterthought.
SECTION 06
Security by Design
Where appropriate, security considerations should be incorporated throughout the technology lifecycle. The objective is to identify and reduce security risks before they become incidents.
01
Planning
02
System design
03
Software development
04
Configuration
05
Testing
06
Deployment
07
Maintenance
08
Change management
09
Decommissioning
SECTION 07
Access with purpose.
Access to BrainSeeds information should be based on legitimate business or service requirements.
Guiding principle
The right person. The right information. The right purpose. The right level of access.
01
User authentication
02
Role-based permissions
03
Least-privilege access
04
Administrative controls
05
Restricted database access
06
Secure account management
07
Periodic access reviews
08
Removal of unnecessary privileges
SECTION 08
Access follows responsibility.
Different BrainSeeds users may require different levels of access. Access should be aligned with responsibilities rather than job title alone.
01
Student
May access their own permitted assessment and learning information.
02
Parent / Guardian
May access information relating to their child where authorised and legally appropriate.
03
Trainer
May access information necessary to deliver an assigned programme.
04
Assessment Professional
May access information required for assessment interpretation or professional services.
05
Institution Administrator
May access information permitted under the relevant institutional programme.
06
System Administrator
May have technical access necessary for system administration, subject to appropriate controls.
07
Management
May access information required for legitimate operational, governance or oversight purposes.
Personnel should not access information simply because they technically can.
Security Architecture
Security belongs in the design.
BrainSeeds seeks to incorporate security considerations into systems and processes from the beginning rather than treating security as an afterthought.
SECTION 06
Security by Design
Where appropriate, security considerations should be incorporated throughout the technology lifecycle. The objective is to identify and reduce security risks before they become incidents.
01
Planning
02
System design
03
Software development
04
Configuration
05
Testing
06
Deployment
07
Maintenance
08
Change management
09
Decommissioning
SECTION 07
Access with purpose.
Access to BrainSeeds information should be based on legitimate business or service requirements.
Guiding principle
The right person. The right information. The right purpose. The right level of access.
01
User authentication
02
Role-based permissions
03
Least-privilege access
04
Administrative controls
05
Restricted database access
06
Secure account management
07
Periodic access reviews
08
Removal of unnecessary privileges
SECTION 08
Access follows responsibility.
Different BrainSeeds users may require different levels of access. Access should be aligned with responsibilities rather than job title alone.
01
Student
May access their own permitted assessment and learning information.
02
Parent / Guardian
May access information relating to their child where authorised and legally appropriate.
03
Trainer
May access information necessary to deliver an assigned programme.
04
Assessment Professional
May access information required for assessment interpretation or professional services.
05
Institution Administrator
May access information permitted under the relevant institutional programme.
06
System Administrator
May have technical access necessary for system administration, subject to appropriate controls.
07
Management
May access information required for legitimate operational, governance or oversight purposes.
Personnel should not access information simply because they technically can.
Identity & Privileged Access
Every account. Every privilege. Purposeful.
BrainSeeds seeks to protect user accounts through appropriate authentication controls, while applying additional controls to administrative and privileged access where appropriate.
Authentication
SECTION 09
Authentication &
Authentication &
Account Security
Depending on the system, controls may include the following:
01
Strong password requirements
02
Secure password storage
03
Account verification
04
Session management
05
Login monitoring
06
Multi-factor authentication where appropriate
07
Account lockout or protective controls
08
Password reset procedures
User responsibility
Users are responsible for protecting their own authentication credentials and should never share:
- Passwords
- One-time authentication codes
- Security tokens
- Recovery credentials
SECTION 10
Administrative &
Administrative &
Privileged Access
Administrative accounts can create heightened security risks. BrainSeeds therefore seeks to apply additional controls to privileged access, including where appropriate.
Why additional controls matter
Privileged access should only be used when necessary for legitimate administrative or technical purposes.
Separate administrative accounts
Restricted administrator permissions
Strong authentication
Logging
Monitoring
Periodic review
Removal of unnecessary privileges
Identity & Privileged Access
Every account. Every privilege. Purposeful.
BrainSeeds seeks to protect user accounts through appropriate authentication controls, while applying additional controls to administrative and privileged access where appropriate.
Authentication
SECTION 09
Authentication &
Authentication &
Account Security
Depending on the system, controls may include the following:
01
Strong password requirements
02
Secure password storage
03
Account verification
04
Session management
05
Login monitoring
06
Multi-factor authentication where appropriate
07
Account lockout or protective controls
08
Password reset procedures
User responsibility
Users are responsible for protecting their own authentication credentials and should never share:
- Passwords
- One-time authentication codes
- Security tokens
- Recovery credentials
SECTION 10
Administrative &
Administrative &
Privileged Access
Administrative accounts can create heightened security risks. BrainSeeds therefore seeks to apply additional controls to privileged access, including where appropriate.
Why additional controls matter
Privileged access should only be used when necessary for legitimate administrative or technical purposes.
Separate administrative accounts
Restricted administrator permissions
Strong authentication
Logging
Monitoring
Periodic review
Removal of unnecessary privileges
Data Protection Architecture
Protecting information where it moves.
BrainSeeds seeks to protect information through appropriate safeguards across transmission, storage and controlled database environments.
Protected
Information
SECTION 11
Data Encryption
Where technically appropriate, BrainSeeds seeks to use encryption to protect information.
01
Data transmitted over networks
02
Sensitive information stored within systems
03
Backups
04
Administrative communications
05
Other appropriate security-sensitive environments
The exact encryption technologies and configurations may vary depending on the system, service provider and technical architecture.
SECTION 12
Secure Data Transmission
BrainSeeds seeks to protect information while it moves between users, systems and authorised service providers.
01
→
Secure communication
Secure communication protocols and encrypted connections may be used where appropriate.
02
→
Protected exchange
Protected APIs, authentication, access controls and secure file-transfer mechanisms may form part of the safeguards.
03
→
Authorised destination
Information is intended to move between users, systems and authorised service providers through appropriate safeguards.
Secure communication protocols
Encrypted connections
Protected APIs
Authentication
Access controls
Secure file-transfer mechanisms
Sensitive information should not knowingly be transmitted through insecure channels where a secure alternative is reasonably available.
SECTION 13
Database Security
BrainSeeds databases may contain information requiring controlled access. Database-security measures may include the following.
Access restrictions
Authentication
Encryption where appropriate
Role-based permissions
Network restrictions
Monitoring
Backup procedures
Administrative controls
Data lifecycle management
↗
Direct database access should be restricted to authorised technical personnel where necessary.
Data Protection Architecture
Protecting information where it moves.
BrainSeeds seeks to protect information through appropriate safeguards across transmission, storage and controlled database environments.
Protected
Information
SECTION 11
Data Encryption
Where technically appropriate, BrainSeeds seeks to use encryption to protect information.
01
Data transmitted over networks
02
Sensitive information stored within systems
03
Backups
04
Administrative communications
05
Other appropriate security-sensitive environments
The exact encryption technologies and configurations may vary depending on the system, service provider and technical architecture.
SECTION 12
Secure Data Transmission
BrainSeeds seeks to protect information while it moves between users, systems and authorised service providers.
01
→
Secure communication
Secure communication protocols and encrypted connections may be used where appropriate.
02
→
Protected exchange
Protected APIs, authentication, access controls and secure file-transfer mechanisms may form part of the safeguards.
03
→
Authorised destination
Information is intended to move between users, systems and authorised service providers through appropriate safeguards.
Secure communication protocols
Encrypted connections
Protected APIs
Authentication
Access controls
Secure file-transfer mechanisms
Sensitive information should not knowingly be transmitted through insecure channels where a secure alternative is reasonably available.
SECTION 13
Database Security
BrainSeeds databases may contain information requiring controlled access. Database-security measures may include the following.
Access restrictions
Authentication
Encryption where appropriate
Role-based permissions
Network restrictions
Monitoring
Backup procedures
Administrative controls
Data lifecycle management
↗
Direct database access should be restricted to authorised technical personnel where necessary.
Secure Development
Security across the application lifecycle.
BrainSeeds seeks to develop and maintain applications with appropriate security considerations, with security considered throughout the application lifecycle.
Application
Security
SECTION 14
Application Security
Depending on the system, security practices may include:
01
Secure authentication
02
Input validation
03
Access-control validation
04
Session security
05
Secure APIs
06
Error handling
07
Logging
08
Vulnerability management
09
Secure configuration
10
Software updates
SECTION 15
Secure Software Development
Where BrainSeeds develops or customises software, security should be considered during requirements, design, development, testing, deployment, maintenance and retirement.
Requirements
Identify security and privacy requirements.
Design
Consider threats, permissions and data flows.
Development
Apply secure coding practices.
Testing
Identify security weaknesses and unexpected behaviour.
Deployment
Use appropriate configuration and access controls.
Maintenance
Address vulnerabilities and security improvements.
Retirement
Securely decommission systems and access.
SECTION 16
Vulnerability Management
Technology vulnerabilities can emerge as software and threats evolve. BrainSeeds seeks to identify and address relevant vulnerabilities through appropriate processes.
01
Software updates
02
Security patches
03
Dependency management
04
Vulnerability scanning
05
Configuration reviews
06
Security testing
07
Risk assessment
08
Remediation
09
Monitoring
Risk prioritisation
Priority may depend on several factors.
The priority assigned to a vulnerability may depend on factors such as those shown here.
Severity
Exploitability
Exposure
Information affected
Business impact
Availability of mitigation
Secure Development
Security across the application lifecycle.
BrainSeeds seeks to develop and maintain applications with appropriate security considerations, with security considered throughout the application lifecycle.
Application
Security
SECTION 14
Application Security
Depending on the system, security practices may include:
01
Secure authentication
02
Input validation
03
Access-control validation
04
Session security
05
Secure APIs
06
Error handling
07
Logging
08
Vulnerability management
09
Secure configuration
10
Software updates
SECTION 15
Secure Software Development
Where BrainSeeds develops or customises software, security should be considered during requirements, design, development, testing, deployment, maintenance and retirement.
Requirements
Identify security and privacy requirements.
Design
Consider threats, permissions and data flows.
Development
Apply secure coding practices.
Testing
Identify security weaknesses and unexpected behaviour.
Deployment
Use appropriate configuration and access controls.
Maintenance
Address vulnerabilities and security improvements.
Retirement
Securely decommission systems and access.
SECTION 16
Vulnerability Management
Technology vulnerabilities can emerge as software and threats evolve. BrainSeeds seeks to identify and address relevant vulnerabilities through appropriate processes.
01
Software updates
02
Security patches
03
Dependency management
04
Vulnerability scanning
05
Configuration reviews
06
Security testing
07
Risk assessment
08
Remediation
09
Monitoring
Risk prioritisation
Priority may depend on several factors.
The priority assigned to a vulnerability may depend on factors such as those shown here.
Severity
Exploitability
Exposure
Information affected
Business impact
Availability of mitigation
Endpoint · Network · Cloud
Protection across connected environments.
BrainSeeds seeks to protect authorised devices, networks, communications infrastructure and cloud environments through appropriate controls.
Endpoint
Authorised device
SECTION 17
Malware &
Malware &
Endpoint Protection
BrainSeeds seeks to protect computers and other authorised devices used to access its information systems. Where appropriate, safeguards may include:
01
Security software
02
Endpoint protection
03
Operating-system updates
04
Application updates
05
Restricted administrative privileges
06
Device access controls
07
Secure configuration
08
Malware detection
Personnel should not knowingly install unauthorised or suspicious software on systems used for BrainSeeds activities.
SECTION 18
Network Security
BrainSeeds seeks to protect networks and communications infrastructure through appropriate controls. Depending on the architecture, these may include:
Connected systems
Systems and communication infrastructure requiring protection.
Network protection
Appropriate controls
Depending on the architecture
Secure access
Access restrictions and secure remote access may form part of
the safeguards.
Firewalls
Network segmentation
Secure protocols
Access restrictions
Monitoring
Intrusion detection or prevention capabilities
Secure remote access
Administrative controls
Network-security measures should be appropriate to the sensitivity of the systems and information involved.
SECTION 19
Cloud Security
BrainSeeds may use cloud infrastructure and hosted technology services. Cloud environments may support a range of technology functions.
Cloud Environment
Hosted technology services
Cloud environments may be used for:
Application hosting
Database hosting
Storage
Backup
Disaster recovery
Analytics
Communication
Other technology functions
BrainSeeds seeks to manage cloud security through appropriate:
Access controls
Authentication
Configuration management
Encryption
Logging
Backup
Monitoring
Vendor management
Shared responsibility: Responsibility for security may be shared between BrainSeeds and cloud providers depending on the service model.
Endpoint · Network · Cloud
Protection across connected environments.
BrainSeeds seeks to protect authorised devices, networks, communications infrastructure and cloud environments through appropriate controls.
Endpoint
Authorised device
SECTION 17
Malware &
Malware &
Endpoint Protection
BrainSeeds seeks to protect computers and other authorised devices used to access its information systems. Where appropriate, safeguards may include:
01
Security software
02
Endpoint protection
03
Operating-system updates
04
Application updates
05
Restricted administrative privileges
06
Device access controls
07
Secure configuration
08
Malware detection
Personnel should not knowingly install unauthorised or suspicious software on systems used for BrainSeeds activities.
SECTION 18
Network Security
BrainSeeds seeks to protect networks and communications infrastructure through appropriate controls. Depending on the architecture, these may include:
Connected systems
Systems and communication infrastructure requiring protection.
Network protection
Appropriate controls
Depending on the architecture
Secure access
Access restrictions and secure remote access may form part of
the safeguards.
Firewalls
Network segmentation
Secure protocols
Access restrictions
Monitoring
Intrusion detection or prevention capabilities
Secure remote access
Administrative controls
Network-security measures should be appropriate to the sensitivity of the systems and information involved.
SECTION 19
Cloud Security
BrainSeeds may use cloud infrastructure and hosted technology services. Cloud environments may support a range of technology functions.
Cloud Environment
Hosted technology services
Cloud environments may be used for:
Application hosting
Database hosting
Storage
Backup
Disaster recovery
Analytics
Communication
Other technology functions
BrainSeeds seeks to manage cloud security through appropriate:
Access controls
Authentication
Configuration management
Encryption
Logging
Backup
Monitoring
Vendor management
Shared responsibility: Responsibility for security may be shared between BrainSeeds and cloud providers depending on the service model.
Resilience & Recovery
Ready to recover. Ready to continue.
Backups, recovery capabilities and continuity processes form part of the resilience approach described in the BrainSeeds Information Security Policy.
SECTION 20
Backup & Data Recovery
Backups are an important part of resilience and recovery. Where appropriate, BrainSeeds may maintain backups of relevant systems and information.
01
Scheduled backups
02
Access restrictions
03
Secure storage
04
Backup monitoring
05
Recovery testing
06
Appropriate retention
07
Protection against unauthorised modification
Backups should not be treated as an excuse for indefinite data retention. They should operate consistently with BrainSeeds' Data Retention & Deletion Policy.
SECTION 21
Disaster Recovery
BrainSeeds seeks to maintain appropriate capabilities to recover important systems following significant disruption.
Recovery context
Significant disruption can take many forms.
Recovery priorities should consider service criticality, impact on users, information involved, operational requirements and security considerations.
Hardware failure
Software failure
Cybersecurity incidents
Data corruption
Infrastructure outages
Natural disasters
Human error
Third-party service disruption
Recovery priorities should consider
Criticality of the service
Impact on users
Information involved
Operational requirements
Security considerations
SECTION 22
Business Continuity
Information security is closely connected with business continuity. BrainSeeds seeks to maintain appropriate processes to continue essential services during significant disruptions.
Continuity planning may consider:
Planning for significant disruptions may take into account operational, technological and organisational dependencies.
- Critical systems
- Key personnel
- Alternative processes
- Communication
- Technology dependencies
- Third-party dependencies
- Recovery priorities
Continuity principle
Keep essential services moving through significant disruption.Business-continuity planning connects information security with the processes needed to maintain essential services when significant disruptions occur.
Resilience & Recovery
Ready to recover. Ready to continue.
Backups, recovery capabilities and continuity processes form part of the resilience approach described in the BrainSeeds Information Security Policy.
SECTION 20
Backup & Data Recovery
Backups are an important part of resilience and recovery. Where appropriate, BrainSeeds may maintain backups of relevant systems and information.
01
Scheduled backups
02
Access restrictions
03
Secure storage
04
Backup monitoring
05
Recovery testing
06
Appropriate retention
07
Protection against unauthorised modification
Backups should not be treated as an excuse for indefinite data retention. They should operate consistently with BrainSeeds' Data Retention & Deletion Policy.
SECTION 21
Disaster Recovery
BrainSeeds seeks to maintain appropriate capabilities to recover important systems following significant disruption.
Recovery context
Significant disruption can take many forms.
Recovery priorities should consider service criticality, impact on users, information involved, operational requirements and security considerations.
Hardware failure
Software failure
Cybersecurity incidents
Data corruption
Infrastructure outages
Natural disasters
Human error
Third-party service disruption
Recovery priorities should consider
Criticality of the service
Impact on users
Information involved
Operational requirements
Security considerations
SECTION 22
Business Continuity
Information security is closely connected with business continuity. BrainSeeds seeks to maintain appropriate processes to continue essential services during significant disruptions.
Continuity planning may consider:
Planning for significant disruptions may take into account operational, technological and organisational dependencies.
- Critical systems
- Key personnel
- Alternative processes
- Communication
- Technology dependencies
- Third-party dependencies
- Recovery priorities
Continuity principle
Keep essential services moving through significant disruption.Business-continuity planning connects information security with the processes needed to maintain essential services when significant disruptions occur.
Security Operations
See the signal.
Respond with structure.
BrainSeeds seeks to use appropriate logging, monitoring and incident-management practices to help identify suspicious activity, investigate incidents and improve security.
⌁
23 · Security Logging & Monitoring
Security activity can leave a useful trail
Where appropriate, BrainSeeds may maintain logs relating to activity across authentication, accounts, administration, applications, systems and infrastructure.
- Authentication
- Account activity
- Administrative actions
- System events
- Security events
- Application events
- Infrastructure events
What monitoring can help us do
Logs may support operational and security activities when reviewed and used appropriately.
Detect suspicious activity
Investigate incidents
Troubleshoot problems
Support accountability
Improve security
Access to security logs should itself be appropriately restricted.
24 · Security Incident Management
No technology environment can reasonably be assumed to be completely free of security risk.
If a potential security incident is identified, BrainSeeds seeks to respond through an appropriate incident-management process.
Unauthorised access
Data disclosure
Account compromise
Malware
Phishing
Ransomware
Data loss
Data corruption
Security vulnerability
Unauthorised system modification
25 · Incident Response Process
Depending on the nature of an incident, the response may include:
01
Identification
Determine that a potential incident has occurred.
02
Containment
Take reasonable steps to prevent further impact.
03
Investigation
Determine what happened and what information or systems may be affected.
04
Remediation
Address the underlying issue.
05
Recovery
Restore affected systems and services safely.
06
Notification
Make notifications where required by applicable law or appropriate to the circumstances.
07
Lessons Learned
Review the incident and improve controls.
Structured response
Incident handling is presented as a sequence that can move from identification through recovery and review, depending on the nature of the incident.
Continuous improvement
Lessons learned provide an opportunity to review the incident and improve controls.
Security Operations
See the signal.
Respond with structure.
BrainSeeds seeks to use appropriate logging, monitoring and incident-management practices to help identify suspicious activity, investigate incidents and improve security.
⌁
23 · Security Logging & Monitoring
Security activity can leave a useful trail
Where appropriate, BrainSeeds may maintain logs relating to activity across authentication, accounts, administration, applications, systems and infrastructure.
- Authentication
- Account activity
- Administrative actions
- System events
- Security events
- Application events
- Infrastructure events
What monitoring can help us do
Logs may support operational and security activities when reviewed and used appropriately.
Detect suspicious activity
Investigate incidents
Troubleshoot problems
Support accountability
Improve security
Access to security logs should itself be appropriately restricted.
24 · Security Incident Management
No technology environment can reasonably be assumed to be completely free of security risk.
If a potential security incident is identified, BrainSeeds seeks to respond through an appropriate incident-management process.
Unauthorised access
Data disclosure
Account compromise
Malware
Phishing
Ransomware
Data loss
Data corruption
Security vulnerability
Unauthorised system modification
25 · Incident Response Process
Depending on the nature of an incident, the response may include:
01
Identification
Determine that a potential incident has occurred.
02
Containment
Take reasonable steps to prevent further impact.
03
Investigation
Determine what happened and what information or systems may be affected.
04
Remediation
Address the underlying issue.
05
Recovery
Restore affected systems and services safely.
06
Notification
Make notifications where required by applicable law or appropriate to the circumstances.
07
Lessons Learned
Review the incident and improve controls.
Structured response
Incident handling is presented as a sequence that can move from identification through recovery and review, depending on the nature of the incident.
Continuous improvement
Lessons learned provide an opportunity to review the incident and improve controls.
Human Security Layer
Security improves when people know what to notice.
BrainSeeds places importance on prompt incident reporting, awareness of phishing and social engineering, and clear responsibilities for everyone who has access to BrainSeeds information.
26 · Security Incident Reporting
Report suspected incidents promptly
Employees, contractors and authorised users should report suspected security incidents promptly. Early reporting can significantly reduce potential impact.
Suspicious emails
Lost devices
Unexpected login activity
Suspected credential theft
Unauthorised access
Accidental disclosure
Malware warnings
Suspicious system behaviour
Prompt reporting helps create an opportunity to respond before a potential
security issue has a greater impact.
27 · Phishing & Social Engineering
Human behaviour is an important component of cybersecurity. BrainSeeds seeks to raise awareness of common social-engineering threats.
Phishing
Fake login pages
Impersonation
Social engineering
Fraudulent support requests
Malicious attachments
Credential theft
Verify unusual requests, particularly requests involving:
Passwords
Financial transactions
Personal information
Administrative access
Security credentials
28 · Employee & Personnel Security
Access comes with responsibilities.
Individuals with access to BrainSeeds information are expected to understand their responsibilities. Depending on their role, personnel may be required to follow appropriate security and confidentiality practices.
01
Maintain confidentiality
02
Follow security procedures
03
Protect credentials
04
Use authorised systems
05
Report incidents
06
Avoid unauthorised disclosure
07
Complete appropriate security awareness activities
Access should be removed or adjusted when personnel change roles or leave the organisation.
Human Security Layer
Security improves when people know what to notice.
BrainSeeds places importance on prompt incident reporting, awareness of phishing and social engineering, and clear responsibilities for everyone who has access to BrainSeeds information.
26 · Security Incident Reporting
Report suspected incidents promptly
Employees, contractors and authorised users should report suspected security incidents promptly. Early reporting can significantly reduce potential impact.
Suspicious emails
Lost devices
Unexpected login activity
Suspected credential theft
Unauthorised access
Accidental disclosure
Malware warnings
Suspicious system behaviour
Prompt reporting helps create an opportunity to respond before a potential
security issue has a greater impact.
27 · Phishing & Social Engineering
Human behaviour is an important component of cybersecurity. BrainSeeds seeks to raise awareness of common social-engineering threats.
Phishing
Fake login pages
Impersonation
Social engineering
Fraudulent support requests
Malicious attachments
Credential theft
Verify unusual requests, particularly requests involving:
Passwords
Financial transactions
Personal information
Administrative access
Security credentials
28 · Employee & Personnel Security
Access comes with responsibilities.
Individuals with access to BrainSeeds information are expected to understand their responsibilities. Depending on their role, personnel may be required to follow appropriate security and confidentiality practices.
01
Maintain confidentiality
02
Follow security procedures
03
Protect credentials
04
Use authorised systems
05
Report incidents
06
Avoid unauthorised disclosure
07
Complete appropriate security awareness activities
Access should be removed or adjusted when personnel change roles or leave the organisation.