Progic is committed to protecting your information and personal data, ensuring confidentiality, integrity, and availability, in accordance with legal, contractual, and regulatory requirements, to guarantee business continuity and brand protection.<\/p>\n\n\n\n
Comprehensive information protection <\/strong>: Information must be protected throughout its entire lifecycle, ensuring confidentiality, integrity, and availability.<\/p>\n\n\n\n \u2022 Privacy and protection of personal data<\/strong> : The processing of personal data must comply with legal and contractual requirements, guaranteeing the rights of data subjects and transparency in the company’s role, whether as a controller or processor.<\/p>\n\n\n\n \u2022 Security and privacy by design<\/strong> : Information security and data protection should be incorporated from the design stage of technological solutions, systems, and infrastructures.<\/p>\n\n\n\n \u2022 Control, traceability, and risk management<\/strong> : Access to information must be controlled, monitored, and auditable, with continuous management of threats, vulnerabilities, and incidents.<\/p>\n\n\n\n \u2022 Resilience and business continuity<\/strong> : Information security must support service continuity and the ability to recover from adverse events.<\/p>\n\n\n\n \u2022 Shared responsibility and security culture<\/strong> : Information security is everyone’s responsibility, supported by awareness, continuous training, and adequate governance, including in the supply chain.<\/p>\n\n\n\n \u2022 Compliance and continuous improvement<\/strong> : Progic is committed to meeting applicable customer, legal, regulatory and normative requirements, as well as pursuing continuous improvement of the Integrated Management System.<\/p>\n\n\n\n Progic maintains an up-to-date list of emergency contacts and relevant authorities, available on SharePoint and physically at headquarters, for consultation and immediate action when necessary.<\/p>\n\n\n\n Progic establishes and maintains contact with special interest groups, specialized forums, professional associations, security communities, and relevant vendors to expand its knowledge and keep up-to-date on information related to information security. To do this, it must:<\/p>\n\n\n\n \u2022 Identify the groups, forums, associations, communities, and specialized sources relevant to the context, technologies, and risks of Progic.<\/p>\n\n\n\n \u2022 Define who will be responsible for monitoring and maintaining the applicable contacts and registrations.<\/p>\n\n\n\n \u2022 Regularly monitor alerts, guidelines, best practices, threats, vulnerabilities, and relevant changes published by these sources.<\/p>\n\n\n\n \u2022 Evaluate the information received and, when applicable, forward it to the responsible areas for handling risks, vulnerabilities, incidents, or improvements in security controls.<\/p>\n\n\n\n \u2022 Maintain records of established contacts and relevant information used by Progic.<\/p>\n\n\n\n \u2022 Share external information only with authorized individuals, respecting the company’s confidentiality, data protection, and communication requirements.<\/p>\n\n\n\n The implemented controls are based on the principle that it is first necessary to identify and manage the information assets (information, equipment, systems, devices, software, responsible parties, etc.) from which the other controls are contextualized. The practices involve:<\/p>\n\n\n\n \u2022 Inventory the assets relevant to the operation and maintain a designated responsible party throughout their lifecycle.<\/p>\n\n\n\n \u2022 Allow the use of personal equipment for work, when applicable, provided it meets minimum performance, safety, and monitoring requirements and is treated as part of the information security perimeter.<\/p>\n\n\n\n \u2022 Acquire and use equipment, software, and other assets in accordance with approved standards, safety requirements, copyrights, and applicable licensing, prohibiting pirated or unlicensed software.<\/p>\n\n\n\n \u2022 Block removable portable storage media on Progic workstations and prevent the copying of corporate data to removable portable storage media on employee-owned equipment.<\/p>\n\n\n\n \u2022 Perform secure wiping of storage assets before reuse, donation, or disposal, ensuring that corporate or personal data cannot be recovered.<\/p>\n\n\n\n \u2022 Upon termination of the employment relationship, return Progic’s assets and remove corporate access, data, and software from personal assets.<\/p>\n\n\n\n After identifying the information assets, it is defined who can access them and under what conditions. Access control is one of the fundamental controls for protecting assets and requires:<\/p>\n\n\n\n \u2022 Grant access based on the principle of least privilege, separating conflicting functions and requiring formal approval before release.<\/p>\n\n\n\n \u2022 Use unique user identification, prohibit sharing of credentials, and require strong passwords, supplemented by multi-factor authentication when applicable, especially for remote access and administrative accounts.<\/p>\n\n\n\n \u2022 Apply compensating controls to legacy systems that do not fully support security requirements.<\/p>\n\n\n\n \u2022 Review access periodically according to the internal schedule, including privileged accounts and administrative access.<\/p>\n\n\n\n \u2022 To have administrative accounts approved by senior management and manage them in a restricted, traceable, and periodically reviewed manner.<\/p>\n\n\n\n \u2022 Block or adjust access promptly upon termination, contract end, leave of absence, or vacation, except in cases of approved exceptions.<\/p>\n\n\n\n \u2022 Use only an approved virtual private network for external access to the product’s corporate network.<\/p>\n\n\n\n \u2022 Lock workstations after a period of absence.<\/p>\n\n\n\n \u2022 Use the corporate network, internet, and corporate email in an ethical, professional manner, consistent with the company’s objectives.<\/p>\n\n\n\n \u2022 Store corporate files only in approved locations, prohibiting the storage of Progic content on your own computer.<\/p>\n\n\n\n \u2022 To enable the monitoring of technological resources for compliance, traceability, and asset protection purposes.<\/p>\n\n\n\n Once access is defined, sensitive information is protected through encryption and proper key management through:<\/p>\n\n\n\n \u2022 Use encryption to protect sensitive and confidential information in transit and at rest, through cryptographic mechanisms approved by the company.<\/p>\n\n\n\n \u2022 Prohibit the use of unauthorized cryptographic technology.<\/p>\n\n\n\n \u2022 To protect cryptographic keys against unauthorized access, improper alteration, loss, and unauthorized destruction, restricting access to them to formally designated individuals.<\/p>\n\n\n\n \u2022 Renew keys at the intervals defined by Progic.<\/p>\n\n\n\n \u2022 Obtain authorization from management for key changes that impact critical transactions and services.<\/p>\n\n\n\n \u2022 Prohibit credentials, passwords, application programming interface keys, or secrets directly in the source code, applying secrets management practices in the applicable documents.<\/p>\n\n\n\n After defining who can access the information and how it is protected, Progic defines how it can be shared internally or externally, establishing the following rules:<\/p>\n\n\n\n \u2022 Use only official tools approved by Progic for professional transfers, or \u201cAuthorized Systems\u201d. The use of personal accounts or non-approved transfer tools to send, store, or share company files and information is prohibited.<\/p>\n\n\n\n \u2022 Conduct external transfers in accordance with the authorization matrix applicable to the information classification.<\/p>\n\n\n\n \u2022 Recurring transfers mapped in transaction records or current contracts should be considered previously authorized.<\/p>\n\n\n\n \u2022 Obtain specific authorization for new recipients, new flows, or transfers not foreseen in the routine, validating personal data flows with the Data Protection Officer when applicable.<\/p>\n\n\n\n \u2022 Use a corporate virtual private network for technical transfers, administrative connections, or scenarios that require a secure tunnel.<\/p>\n\n\n\n \u2022 Request and document technical exceptions from the Information Technology department.<\/p>\n\n\n\n With the assets identified and protected, availability and recovery controls come into play, including backups and restores. The practices should:<\/p>\n\n\n\n \u2022 Maintain automatic and periodic backups for all critical assets, with a frequency defined according to criticality, data volatility, and an acceptable Recovery Point Objective for the business.<\/p>\n\n\n\n \u2022 Store backups in a physical location separate from production and protect them with encryption at rest, restricted access control, and measures against unauthorized alteration, such as versioning or immutability.<\/p>\n\n\n\n \u2022 Maintain backups for the defined retention period, consistent with Progic’s legal and operational requirements, and periodically verify their integrity and restorability.<\/p>\n\n\n\n \u2022 Protect backups containing personal data to the same extent that data is protected in production.<\/p>\n\n\n\n \u2022 Re-execute deletions of personal data after restoration, when applicable and technically feasible, unless legally required.<\/p>\n\n\n\n Log records provide traceability, monitoring, and evidence of previous controls. They serve to detect deviations and support investigations. For this, it is necessary to:<\/p>\n\n\n\n \u2022 Configure critical systems, web applications, and infrastructure services to generate logs of relevant events, including user activity, system errors, security transactions, and operations involving personal data, where applicable.<\/p>\n\n\n\n \u2022 Synchronize the system clocks with a single, reliable time source.<\/p>\n\n\n\n \u2022 Protect records against unauthorized access, tampering, forgery, and loss.<\/p>\n\n\n\n \u2022 Avoid storing sensitive data in plain text, such as passwords, financial information, or other details that could increase the risk of exposure.<\/p>\n\n\n\n \u2022 Define record retention according to legal, regulatory, and business requirements.<\/p>\n\n\n\n \u2022 Analyze records regularly to identify anomalies, support investigations, and demonstrate the effectiveness of controls.<\/p>\n\n\n\n Vulnerability management implements continuous controls to improve and protect the already identified, protected, and monitored environment. Here, Progic completes the technical risk management cycle by requiring:<\/p>\n\n\n\n \u2022 Follow a continuous cycle of vulnerability detection, assessment, treatment, and measurement.<\/p>\n\n\n\n \u2022 Classify vulnerabilities by risk level and prioritize treatment according to technical severity, impact on security, privacy, and environmental exposure.<\/p>\n\n\n\n \u2022 Address high or critical vulnerabilities according to a defined timeframe, and do not maintain critical vulnerabilities in production without a formal remediation plan.<\/p>\n\n\n\n \u2022 Address critical vulnerabilities through emergency public exploitation.<\/p>\n\n\n\n \u2022 Correct, monitor, or formally accept medium or low vulnerabilities according to the timeframe and cycle defined for the risk level.<\/p>\n\n\n\n \u2022 Test fixes in a staging environment before production.<\/p>\n\n\n\n \u2022 Formalize, through the technical area manager, the justification and the palliative mitigation plan for accepting medium-level risks that cannot be corrected within the timeframe.<\/p>\n\n\n\n \u2022 Obtain formal approval from the Board of Directors\/Senior Management to accept high or critical risks, assuming responsibility for the residual risk.<\/p>\n\n\n\n \u2022 Assess security vulnerabilities in systems, integrations, and third-party partnerships.<\/p>\n\n\n\n Secure software development incorporates information security and privacy requirements throughout the entire solution lifecycle, from conception to discontinuation. This requires:<\/p>\n\n\n\n \u2022 Integrate security and privacy requirements and controls into the planning, design, implementation, testing, deployment, maintenance, and discontinuation phases of the software.<\/p>\n\n\n\n \u2022 Record all product changes, including features, improvements, refinements, and bug fixes, and assess their security risks during planning and prioritization.<\/p>\n\n\n\n \u2022 Apply privacy by default, minimizing the processing of personal data and using only the data necessary for each purpose.<\/p>\n\n\n\n \u2022 Maintain segregated Development, Staging, and Production environments, preventing direct changes by developers in Production, except for formally authorized and audited emergency access.<\/p>\n\n\n\n \u2022 Prohibit the use of real personal data in Development and Testing environments, using synthetic or anonymized data instead; any exceptions must be formalized and approved by the Data Protection Officer, applying the same security controls as in Production.<\/p>\n\n\n\n \u2022 Store source code in centralized official repositories with version control and restricted access as needed.<\/p>\n\n\n\n \u2022 Maintain repositories of source code and critical development process artifacts covered by backup and restore routines.<\/p>\n\n\n\n \u2022 Adopt secure coding practices to mitigate common vulnerabilities, including input validation, encryption of sensitive data, strong authentication where applicable, and proper error and log handling.<\/p>\n\n\n\n \u2022 Generate logs that support traceability, fault detection, and investigations, avoiding unnecessary personal data, and perform automatic code scanning in the continuous integration and continuous delivery pipeline.<\/p>\n\n\n\n \u2022 Allow the use of enterprise artificial intelligence for productivity only with mandatory human review of the code before commit, prohibiting the use of personal or free artificial intelligence.<\/p>\n\n\n\n \u2022 Acknowledge that all source code, documentation, and developed models are the exclusive property of Progic, prohibiting their distribution, copying, or external use without express authorization.<\/p>\n\n\n\n Senior Management defines and communicates the Information Security Policy, ensuring alignment with the strategy, adequate resources, and effectiveness of the Integrated Management System (IMS).<\/p>\n\n\n\n The information security and infrastructure team implements, operates, and maintains information security controls, such as system protection, access management, monitoring, vulnerability treatment, and service continuity support, following established policies.<\/p>\n\n\n\n Employees and third parties must comply with the Information Security Policy, use technological resources securely, protect the information under their responsibility, and report security or privacy incidents or events immediately.<\/p>\n\n\n\n This policy is communicated internally and made available to stakeholders on the company’s official website.<\/p>\n\n\n\n Its review occurs periodically to ensure its continued suitability and relevance to the company’s strategy.<\/p>\n","protected":false},"excerpt":{"rendered":" Purpose Progic is committed to protecting your information and personal data, ensuring confidentiality, integrity, […]<\/p>\n","protected":false},"author":14,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"class_list":["post-23537","page","type-page","status-publish","hentry"],"acf":[],"yoast_head":"\nControls Implemented<\/h2>\n\n\n\n
Contact with Authorities<\/h2>\n\n\n\n
Contact with Special Interest Groups<\/h2>\n\n\n\n
Information Assets<\/h2>\n\n\n\n
Access Control<\/h2>\n\n\n\n
Cryptography and Key Management<\/h2>\n\n\n\n
Information Transfer<\/h2>\n\n\n\n
Backup<\/h2>\n\n\n\n
Logs<\/h2>\n\n\n\n
Vulnerability Management<\/h2>\n\n\n\n
Secure Software Development<\/h2>\n\n\n\n
Responsibility<\/h2>\n\n\n\n
Communication and availability<\/h2>\n\n\n\n