1. Introduction

The purpose of this security policy is to outline the measures and practices that SofaTurkey™ adopts to ensure the confidentiality, integrity, and availability of our systems and data. This policy applies to all employees, contractors, and third-party entities that have access to our systems and information. Adherence to this policy is mandatory to protect our business and customer information from unauthorized access, disclosure, alteration, or destruction.

2.Access Control

2.1 User Accounts:

  • User accounts will be created for all employees and contractors accessing the wholesale online business systems.
  • User accounts will be granted based on the principle of least privilege, ensuring that individuals have access only to the resources required to perform their job responsibilities.
  • Strong passwords will be enforced, requiring a combination of uppercase and lowercase letters, numbers, and special characters.
  • Multi-factor authentication (MFA) will be implemented for all user accounts to provide an additional layer of security.

 2.2 Third-Party Access:

  • Third-party access to our systems and data will be granted only on a need-to-know basis.
  • Third-party entities will be required to sign a confidentiality agreement and adhere to security standards and practices consistent with our own.

3.Data Protection

3.1 Data Classification:

  • All data will be classified based on its sensitivity and criticality to determine appropriate levels of protection.
  • Data classification guidelines will be provided to employees to ensure proper handling, storage, and transmission of data.

3.2 Data Encryption:

  • Transmission of sensitive data will be encrypted using industry-standard encryption protocols, such as SSL/TLS.Encryption mechanisms will be implemented to protect data at rest, especially for sensitive information stored indatabases and file systems.

3.3 Data Backup and Recovery:

  • Regular backups of critical data will be performed and stored securely at an off-site location.
  • Backup integrity and restoration processes will be periodically tested to ensure data recoverability in the event of a disaster.

4.Network Security

  • Firewalls and Intrusion Detection Systems:
  • Firewalls and intrusion detection systems will be deployed to protect our network infrastructure from unauthorized access attempts and malicious activities.
  • Regular monitoring and analysis of network traffic will be conducted to identify and respond to any potential security incidents.

4.1 Secure Remote Access:

  • Remote access to our systems will be allowed only through secure channels, such as VPNs (Virtual Private Networks).
  • Remote access accounts will be protected by strong authentication mechanisms and monitored for any suspicious activities.

5.Incident Response

5.1 Incident Reporting:

  • Employees and contractors will be trained to promptly report any security incidents, breaches, or suspicious activities to the designated point of contact.
  • Incident reporting procedures will be clearly communicated and periodically reviewed to ensure timely response and resolution.

5.2 Incident Response Team:

  • An incident response team will be designated to handle security incidents, investigate breaches, and coordinate appropriate actions.
  • Roles and responsibilities of team members will be defined, and their contact information will be readily available.

5.3 Incident Recovery and Lessons Learned:

  • Prompt action will be taken to mitigate the impact of security incidents and restore affected systems and data.
  • After each incident, a post-incident review will be conducted to identify lessons learned and implement necessary improvements to prevent similar incidents in the future.

6.Physical Security

6.1 Access Control:

  • Physical access to data centers, server rooms, and other critical areas will be restricted to authorized personnel only.
  • Access control mechanisms such as biometric authentication, key cards, and CCTV surveillance will be implemented as appropriate.

6.2 Equipment Protection:

  • All computer equipment, storage media, and portable devices will be protected against theft, loss, or unauthorized access.
  • Employees will be trained to securely store and handle equipment, especially when working remotely or traveling.

7.Training and Awareness

7.1  Security Awareness Training:

  • Regular security awareness training will be provided to all employees and contractors to educate them about security best practices, policies, and procedures.
  • Training sessions will cover topics such as password security, phishing awareness, data handling, and incident reporting.

7.2 Policy Acknowledgment:

  • All employees and contractors will be required to review and acknowledge their understanding and compliance with this security policy.
  • Acknowledgments will be regularly updated and maintained as part of the personnel records.

8. Policy Review and Updates

This security policy will be reviewed periodically and updated as needed to reflect changes in technology, regulations, or business requirements. All employees and contractors will be informed of any updates, and their adherence to the revised policy will be required.

By implementing and enforcing this security policy, we aim to protect our wholesale online business, customer data, and maintain the trust of our partners and clients.