System and Network Security Policy

System and Network Security Policy

Authorized By: Chief Information Security Officer (CISO)

Purpose/Overview

This policy establishes the requirements for protecting Safire, Inc.’s information assets against cybersecurity threats that could compromise confidential and sensitive data, while ensuring secure and reliable access to the network.

Scope

This Policy covers all Safire cybersecurity practices across all areas of its business. All Safire employees, including contractors, third parties and anyone with access to Safire’s data and related assets, are required to comply with this Policy.

Policy

Approval and Escalation Procedure

To ensure efficient and effective management of system and network security, the following approval and escalation procedure shall be followed:

• Approvals and authority for system and network security controls and policies shall reside with the Chief Information Security Officer (CISO), IT, and Compliance.
• Functional teams (e.g., IT Operations) shall maintain ownership of the implementation and daily operation of controls, while the CISO retains authority over policy definition and compliance enforcement.
• The escalation path for system and network security concerns shall be from CISO, IT, and Compliance to Executive Management

Endpoint Protection Policy

Safire will ensure its computing systems implement the following fundamental security controls and practices, including but not limited to:

• Password requirements, including Multi-Factor Authorization (MFA) for remote connections.
• Installation of approved software.
• Virus protection.
• Host-based firewalls.
• Automatic updates enabled for security updates.

See Safire’s System Protection Management Policy.

Password Requirements

See Safire’s Password Protection Policy.

Installation of Approved Software

• All software to be installed must be approved by the CISO, IT Director, or Compliance Officer.

• Approved software is maintained on a list by the IT Director or designated IT personnel.

• All software installations must be performed by authorized IT personnel or under the supervision of authorized IT personnel.

• All software must meet Acceptable Use Policy requirements.

Anti-virus/Anti-malware Protection

Safire will protect information assets by taking active measures to detect, prevent, and manage malware and virus intrusions and recover from their effects.

• Anti-virus and anti-spyware will be installed on all of Safire’s computing systems and configured to automatically receive updates from the developer no less often than daily .
• A network-based malware detection solution will be used as a compensating control when the CISO or IT Director approves an exception for not installing anti-virus and anti-malware software on its computing devices.
• Scans of systems to identify and remove unauthorized software will be conducted periodically.
• Anti-malware and anti-spyware will be configured to automatically scan downloads, email attachments, and browser usage.
• Comprehensive Anti-malware and anti-spyware scans shall be performed on each computing device (except those granted an exception as detailed above) no less often than weekly .
• Anti-malware and anti-spyware alerts and logging will be enabled.
• All anti-malware and anti-spyware alerts must be prioritized based on severity and addressed in accordance with the Incident Response Plan. All alerts shall be treated as potential incidents under Safire’s Data Breach Incident Response Plan.
• All anti-malware and anti-spyware logs shall be retained in accordance with Safire’s Information Logging Policy.

Automatic Updates/Patching

See Safire’s Patching Policy.

Disk Encryption

Safire’s desktops, servers, and mobile devices will employ full disk encryption with an approved software encryption package. See Safire’s Acceptable Encryption Policy for additional information.

Network Encryption

All traffic on Safire’s networks shall be encrypted where possible. Please see Safire’s Acceptable Encryption Policy for additional details.

Network Security

Host-based/Personal Firewall

• All Safire computers or computers connected to Safire’s network will run a personal firewall with the firewall enabled.

Network-based Firewall/Firewall Router Device

• Safire shall ensure that all external and wireless connections to Safire’s networks will pass through a network firewall.

• Safire’s firewall rules will restrict inbound and outbound traffic to external or trusted networks.

• Safire shall ensure all vendor default settings for network-based firewalls (e.g., passwords, wireless encryption keys, Simple Network Management Protocol community strings) are changed prior to installing equipment in a production environment.

• Safire’s firewall rules shall apply a default-deny rule that drops all traffic except traffic that is authorized.

• Safire shall adequately test any change to an external connection to the configuration of the firewall, and personnel authorized by the CISO, IT Director, or Compliance Officer shall document and approve such change.

• Safire shall physically place network-based firewalls within a secure space accessible only to those whose roles and responsibilities permit them to manage the firewall.

• Safire shall ensure network-based firewalls will be configured by a secure, encrypted connection with access restricted only to those whose roles and responsibilities permit them to manage the firewall.

• Safire shall periodically back up network-based firewall configurations and store backups securely and accessible to only authorized personnel.

Wireless Networking

• Wireless networks will be segmented between external guests and internal networks.
• Non-company devices are prohibited from connecting to Safire’s internal network.
• Users inside the Safire firewall will not connect to the internal network if they are using a bridged wireless connection to connect to an external network.
• Wireless access points or routing devices with wireless capability are not allowed unless approved by the CISO or Compliance Officer.
• Logical and physical user access to wireless network devices will be restricted to authorized personnel.
• Perimeter firewalls will be implemented and configured to restrict unauthorized access.
• All vendor default settings for wireless devices (e.g., passwords, wireless encryption keys, Simple Network Management Protocol community strings) will be changed prior to installing wireless equipment in a production environment.
• Safire will use wireless security protocols that are of the highest encryption possible and consistent with Safire’s Acceptable Encryption Policy.
• Safire will require the use of strong passwords for setting encryption for all wireless SSID and will require passwords to be changed periodically (e.g., in accordance with the Password Protection Policy) or upon compromise.
• Wireless device audits will be conducted periodically to determine if any rogue devices exist on the Safire’s network.
• Findings from wireless device audits will be presented as soon as possible to the CISO or Compliance Officer and all rogue devices will be documented and removed from the network.
• Wireless routers and access points configurations will be backed up periodically and stored securely with access to the configurations restricted to authorized personnel.

Email Security

• Anti-Spam and anti-phishing software will be installed and implemented at entry/exit points of the network and on computing devices connected to the Safire network.

• Anti-Spam and anti-phishing software will be updated to new releases to ensure Safire is protected from the latest email threats.

• All Safire employees and contractors will attend a phishing awareness and training program at least twice a year as per Safire’s Anti-Phishing Policy.

• Safire will require strong authentication measures, including MFA, for access to cloud email such as Office 365 or Gmail in order to reduce account takeover risk.

Monitoring and Auditing

• Safire will maintain and monitor system and network traffic logs for all network devices and systems for security auditing purposes and legal and regulatory requirements.
• Access to log management systems will be recorded and limited to authorized individuals with a specific need for such access as determined by the CISO, IT Director, or Compliance Officer.
• For a period of no fewer than 90 days, Safire will securely maintain systems audit trails designed to detect and respond to cybersecurity events that have a reasonable likelihood of materially harming any material part of the normal business operations.
• Safire will reserve the right to monitor, access, retrieve, read, and/or disclose data communications when there is reasonable cause to suspect a policy violation, potential criminal activity, monitoring required by law enforcement, or an appropriate management request approved by the CISO, IT Director, Compliance Officer, or Executive Management.

Compliance

Compliance Measurement

The policy owner will verify compliance through methods such as business tool reports and internal and external audits. Oversight is provided by CISO, IT, and Compliance functions. Enforcement of this policy is coordinated through Human Resources and Executive Management.

Exceptions

Any exceptions to this policy must be approved by the CISO, IT, and Compliance. Escalation of security concerns shall follow the procedure outlined in the Approval and Escalation Procedure section of this policy.

Non-Compliance

An employee found to have violated this policy may be subject to disciplinary action, up to and including termination of employment.

Related Standards, Policies, Plans, and Procedures

• Acceptable Encryption Policy,
• Anti-Phishing Policy,
• Data Breach Incident Response Plan
• Information Logging Policy
• Patching Policy
• Password Protection Policy
• System Protection Management Policy

Revision History

2026-08-20 — Darren Rush

Merge pull request #2 from safire-dev/dev (16cb681)

Edit this Page