🔒 Information Security Policy
Last Updated: September 24, 2025
This Information Security Policy (“Policy”) defines how Red Door Marketing Co. protects company and client information assets.
1. Purpose & Scope
This Policy applies to all employees, contractors, and vendors with access to company systems, data, and infrastructure. Objectives:
- Protect confidentiality, integrity, and availability of data.
- Comply with applicable laws (privacy, marketing, communications).
- Reduce risks from unauthorized access, data loss, or misuse.
2. Data Classification
- Public: marketing materials, website content.
- Internal: general business communications, non-public docs.
- Confidential: client lists, contracts, financial records.
- Restricted: credentials, API keys, payment details, incident reports.
3. Access Control
- Least privilege: only the access needed for each role.
- MFA: required for admin accounts and remote logins.
- Password hygiene: strong passphrases, no reuse, rotate after compromise.
- Termination protocol: access removed within 24 hours of role change.
4. Device & Network Security
- Company devices must use encryption, screen locks, and updated OS/software.
- Install antivirus/endpoint security on all company devices.
- Remote wipe enabled for mobile devices.
- Sensitive data encrypted in transit (TLS/HTTPS) and at rest.
5. Application & Website Security
- Keep all CMS/plugins updated (e.g., WordPress, Shopify).
- Use secure coding practices; sanitize inputs/outputs.
- Secure storage of API keys and secrets.
- Protect forms with spam/bot filters (e.g., reCAPTCHA).
6. Vendor & Third-Party Management
- Maintain a list of critical vendors (hosting, analytics, communications).
- Assess vendors’ security/privacy practices; require DPAs where applicable.
- Limit integrations to essential services only.
7. Incident Response
- Report: suspected breach or misuse must be reported within 24 hours.
- Contain: isolate impacted systems and reset access.
- Notify: inform affected clients and regulators if required.
- Review: conduct a root cause analysis and strengthen controls.
8. Training & Awareness
- Provide annual security and privacy training for employees.
- Run periodic phishing simulations and awareness campaigns.
9. Enforcement
Violations of this Policy may result in disciplinary action, including termination or legal action.
10. Contact
For security concerns, contact:
info@reddoormarketingco.com
Phone: 267-574-6444
