Cloud Security Policy¶

CLOUD SECURITY Policy

Version history¶

Version Number	Date	Description	Created By	Approved By
0.1	23-Jan-2023	Initial Copy	[Name] [Name]
0.2	18-Jun-2024	Approved	[Name] [Name]	[Name]
0.3	28/Aug/2026	Knowledge kernel, AI/agents, control alignment	Knowledge steward	[Name]

Purpose¶

The purpose of this cloud security policy document is to provide policy requirements for cloud computing technology usage at tecciance, the policy aims to cover the requirements to protect against the common threats, technology risks, and the safeguards to be considered for the public cloud environment.

Scope¶

The Policy applies to the tenants and their corresponding subscriptions used in the tecciance. This policy will be reviewed and updated as part of the annual review program on policies and procedures.

Responsibilities¶

The Site Reliability Engineering (SRE) team and CORP IT team together own all the subscriptions created and maintained under tecciance primarily in the public cloud platform. All security recommendations to be implemented with the help of each subscription owner and contributors in tecciance public cloud.

Information classification¶

tecciance Information/Information assets in public cloud shall be classified based on the level of sensitivity, value, and criticality to tecciance.
Cloud based Information assets (Subscriptions) shall be inventoried and classified as per the Information Classification, Labeling and Handling policy.

Privacy¶

tecciance shall ensure the asset inventory is appropriately labeled according to their nature and sensitivity for maintenance and storage of Personally Identifiable Information.
A clear documentation on data flow on the PII data stored, processed, and transmitted shall be identified and documented as part of every project initiation in the public cloud.
A mechanism should be developed wherein the actual location of data, and the ownership rights should be developed periodically.
All systems and processes built in the public cloud need to be deployed based on the secure principle of “Secure by Design” and industrial best practices.
Business in coordination with the Privacy team in tecciance to ensure an impact assessment needs to be conducted for every project initiation in public cloud to evaluate the origin, nature, particularity, and severity of the privacy risks upon the processing of personal data, according to the applicable laws and regulations. For the same Privacy team shall provide the concerned EPRAs (Enterprise Privacy Risk Assessment Forms.) to be filled by the project owners depending upon the nature of the project.
Furthermore, Business in coordination with IT management to ensure that evaluation and implementation of process and technical controls on the following:
Limitation of purpose in personal data processing.
Transfer and sub processing of personal data within the supply chain.
Disclosure of details of any personal data access by sub-processors.
Data retention, archival and deletion of PII.
Protection of PII throughout the entire lifecycle.
Physical locations of the data which includes the location used for backup.

Risk Assessment¶

Risk assessment should be performed in the cloud infrastructure during the following scenarios:

Upon Implementation of a new cloud service to meet a specific business requirement.
Before any major upgrades/updates made to the existing cloud services that can impact the security of the cloud infrastructure.
After any changes made to the configuration of the cloud services.
When following up on a security event or incident.

Also, the risk assessment shall include the risk assessment observations, ownership, severity, mitigation plans and timelines for tracking and closure of risks.

Security Baseline¶

The Business owner in coordination with IT management shall be responsible for establishing and maintaining the baseline security hardening measures for all the applications and services running on public cloud.

Information Security Awareness¶

All users of Cloud Infrastructure (Owners, Contributors, and network contributors) shall be provided with role-based security training for cloud related services.
All users must mandatorily attend and complete the training activities to continue their access to the cloud environment.

Technical Control Security Requirements¶

The organization shall put into place necessary controls to securely manage the workloads and a centralized visibility of the cloud service infrastructure.
For those workloads which includes virtual machines used for hosting the application and database
Servers appropriate network and system security controls need to be configured and maintained as per the security guidelines.
tecciance IT management in coordination with the business and Information security must evaluate the need of the security controls to protect and safeguard the data hosted in the cloud environments.

The details of technical security controls are listed as follows.

Identity and Access Management¶

Users must be granted only based on the approval of the project manager/business owner.
Upon Separation/transfer/termination of the user who has been granted access to the cloud portal/instances/services, the project manager/business owner is responsible for notifying the IT team to remove access to those users.
Business should refrain from enabling access to the guest user and any such enablement of guest users who are added outside of the organization without the information security approval will be considered as a security violation for enabling the same without approval.
Normal users should not be enabled with critical privileges to perform operations such as security group creation, user delegation, configuration changes etc., and should be restricted with limited privileges to perform the level of duties they are assigned. The principle of least privilege shall be followed while granting any access to the cloud resources for authorized business purposes only.
Users with similar access and privileges to a single resource within the directory service, a dedicated group shall be created, and permissions shall be allocated and applied to all users belonging to the specified group.

Authentication Management¶

All users who have access to environments must be enabled with multi-factor authentication regardless of access method.
The Account and Password policies enabled for the user accounts and services in cloud platform must adhere to the password policies and account setting standards defined, documented, and approved by the tecciance management.
All users must be issued with unique user accounts for identification.

Securing Data at Rest¶

By this term we mean data that is not being accessed and is stored on a physical or logical medium. Examples may be files stored on file servers, records in databases, documents on flash drives, hard disks etc.

Securing data at rest is one of the primary security objectives to enable safe and secure business operations in tecciance. There are multiple controls available to secure data at rest.

Database authentication shall be configured based on the Active Directory authentication mechanism, therefore reducing the overhead for managing the policy on those respective database instances.
Auditing the user activities must be enabled at the database server level to track and monitor the actions performed on databases.
Critical user activities must be logged on to the database server with a defined retention period approved as per the tecciance data retention standards.
Sensitive data shall be protected on databases/virtual machine disks with encryption mechanisms and the secret keys for encrypting the sensitive data must be isolated and stored separately, altogether on a different database store.
Key management procedures shall be followed to manage and rotate the keys on a periodic basis (90 days). Also, the capability to manage secret keys shall be completely owned and controlled by tecciance IT management.
Implementation of appropriate cryptographic algorithms as per the industrial best practices to secure the data at rest based on the classification and sensitivity of data.
In case of termination of contract / services in the public cloud, Industrial best practice and accepted methods shall be implemented for secure disposal of data.
All sensitive/ PII data stored in Cloud services will also be appropriately protected using encryption. The encryption can either be managed using the Cloud Service Provider (CSP)/ SaaS/ PaaS provided encryption keys or using BYOE/ BYOK (Bring your own Encryption/Keys) managed by tecciance IT.

Securing Data in Transit¶

Data that travels through email, web, collaborative work applications or any type of private or public communication channel. It is information that travels from one point to another.

Access to cloud Infrastructure and instances from the Internet must be allowed only through secure network connections. E.g.: VPN tunnel.
Access to the cloud resources should be allowed only from trusted sources.
Authentication mechanisms used for gaining access to the cloud resources must be achieved only through secure keys.
For any access given in critical instances such as storage accounts, always share temporary links preferably through a secure channel with limited time validity.

All network connections between applications and databases must be encrypted using a secure channel for communication.

Securing Data in Use¶

Data opened by one or more applications for its treatment or and consumed or accessed by users.

Access to cloud Infrastructure and instances from the Internet must be allowed only through secure network connections. E.g.: VPN tunnel.

Threat Detection and Response¶

Threat detection and monitoring is one of the most important security requirements for workloads running within the private and public cloud platform.

Security Controls should be configured to detect several types of security issues on public facing instances/services, unencrypted data on storage devices or in transit, Failure to install critical security updates, Security misconfigurations, Operating System vulnerabilities, Identification and removal of viruses and various other malicious codes on the servers.
Monitoring solutions should assess all inbound / outbound network security connections and rules.
Any public facing instances enabled with firewalling capabilities shall be monitored for alerts.
Cloud infrastructure should be configured with next generation firewalling capabilities to extend the network protection beyond the controls enabled using the network security groups.
Adaptive application controls must be applied to allow only a limited set of applications to be run on the host devices which will eventually reduce the exposure against virus / malware attacks.
For any security related threat intelligence / alerts received from cloud service provider or solution, dedicated personnel from the IT team should be able to receive the alerts through a separate email address allotted by tecciance.

Application Security and System Design¶

Application layer security controls help tecciance to prevent application related threats and risks.

Perimeter protection needs to be enabled for application services employing the latest security technologies such as web application firewalls and rules.
Establish and maintain a secure lifecycle on developing applications and systems based on the management approved policy on Systems Acquisition and Development.
For In House/COTS applications, security code review, code scanning and penetration testing need to be conducted/verified prior to the deployment and as well as on a regular basis as per the vulnerability management process of tecciance.
Hardening of OS and application services need to be performed according to the baseline security guidelines.
Periodic assessment shall be performed on the supporting cloud infrastructure which includes the virtual machines, hypervisors etc.,
Regular scans shall be performed on the servers including to determine the patch status to remediate missing patches in the cloud infrastructure.
Patches need to be updated regularly based on the severity and defined timelines.

Logging and Monitoring¶

The Cloud computing resources used for conducting the business in tecciance need to be configured with robust security control mechanisms to capture, monitor, and retain logs based on the standards defined by the tecciance management.

Access to the critical resources which include the portal/instances/network flow are configured with logging features to track and monitor the activities performed by the users.
The retention period is defined as per the standards approved by tecciance, and it should ensure sufficient time is given for the IT management to detect and respond against an incident or a breach.
The container/repository used to store and monitor logs and activities are restricted to limited users with minimal privileges and not publicly accessible to any users.
Access to the secret keys will be logged to monitor the sensitive user activities performed with confidential data.
Any critical changes (Creation/Deletion/Modification) made to the network security access control/rules, unauthorized modification of the baseline configurations on the
instances/resources/services in cloud will be logged and an alert will be generated to the respective incident monitoring team for review.
Audit and Logging capabilities should be configured on the storage accounts to detect and analyze the access performed on the storage accounts which include critical audit events such as read, write and
delete operations and other diagnostics events. Logging and monitoring capabilities shall include the ability to forward/share the logs to tecciance or its authorized third party for logging and monitoring services.

Network Security¶

Adequate network security shall be maintained to safeguard against internal or internet-based attacks originating from untrusted sources and provide predominant consideration to implement controls against both external and internal threats.

Cloud resources need to be protected against security threats such as malware, brute force attacks, Denial of service attacks and other forms of system compromises.
Remote connectivity to cloud assets and all kinds of non-console level access to users through Internet connection must be blocked and access should be provided only through VPN (Virtual Private Network).
Database services should be made accessible only to authorized and trusted sources of IP addresses.
Network monitoring solutions should be enabled to detect anomalies, perform troubleshoot & diagnostics, Capture network flow information for investigation and analysis.
Network level segregation should be performed to isolate and protect critical servers used for mission critical activities.

Endpoint protection¶

tecciance owned endpoint protection and response need to be enabled for the virtual machines to regularly detect, monitor, and respond to security incidents against threat agents, malware, and viruses.
For cloud based virtual machines which are hosted on a public network / Partially connected to public and private network and hosted only on a public network, baseline hardening shall be implemented and monitored as per the virtual machine security guidelines.

Vulnerability management solutions need to be implemented to identify and mitigate critical vulnerabilities and missing security patches at the operating system level.

Security Incident Management¶

In the event of a data breach, both the cloud service provider and tecciance must perform an assessment of systems and users that are directly or indirectly involved in the incident to determine the method of access, such as physical, via software / malware or through human error.

Regular incident reports must be generated and reviewed.
All kinds of suspicious activities which include database injection/manipulation attacks or anomalous behavior patterns on database access must be logged and alerts need to be generated and shared with the incident monitoring team of tecciance.
High-priority incidents discovered must be immediately escalated to the Management and CISO
The Cloud IT team must generate a monthly report showing the number of security incidents and the percentage that were resolved and it needs to be reviewed with the Information security team.

Change Management¶

All types of changes made to the cloud infrastructure and resources must be controlled through management approved change control procedures.
Changes made to the applications, servers, networks, and all other instances of cloud infrastructure must be prioritized as per the change management procedures.
Critical/High/Medium rated changes that can impact security of business operations must be reviewed and approved by the Information security team based on the outcome of the Impact assessment.
Critical/High/Medium rated changes must be evaluated thoroughly using a dedicated staging/UAT environment before rolling out the changes into production environments.
Changes must be supported with an adequate rollback plan to resume back to original state in case of unexpected occurrence of failures.

Operations Management¶

All critical servers used for conducting business operations must be enabled with backup jobs for regular backup.
Performance monitoring solutions need to be deployed on critical servers to continuously monitor and alert the device’s health status.
In case of failure to perform regular jobs or tasks which includes the routine backups, alerts must be generated and notified with backup engineers to immediately respond to the failures / tasks.

Business Continuity¶

In the event of a business disruption in Cloud, the business shall coordinate with Tech BCP team and IT management shall ensure continuity plans address cloud-specific scenarios, including, but not limited to:

Loss of a region
Compromise of a Cloud Service Provider’s account/subscription
Loss of connectivity to a Cloud Service Provider
Loss of specific services within a region

Further, tecciance IT management to ensure confidentiality, availability, and integrity of the backup data for resilience. Also, Service level agreements need to be monitored and reviewed by the business to ensure the compliance related to continuous availability is achieved as promised and offered by the service provider.

Disaster Recovery¶

tecciance management must ensure the restoration of business and IT operations by executing a well-defined cloud-based disaster recovery plan through conducting the following activities:

Business Impact analysis for all the applications and components in the cloud.
Proper SLA (Service Level Agreement) with RTO (Recovery Time Objective) and RPO (Recovery Point Objective).
Defined Control measures to Prevent, Protect, Mitigate and Respond and Recover from cloud-based disasters and failures.
Assignment of roles and responsibilities to manage disasters.
Testing, Training and Maintenance of the disaster recovery controls and procedures.

Exception¶

All the exceptions to this policy are managed by the exception management process.

Artificial intelligence, software agents, and organizational knowledge¶

This section is added in version 0.3 so the policy applies equally to employees and to software agents, and so reusable knowledge stays provenanced.

Software agents, bots, service accounts, CI jobs, and coding assistants are identities. They are in scope of this policy wherever people are.

Every retrieve or use of organizational knowledge or classified data requires a verified identity, a stated purpose, and a classification ceiling. Missing purpose is deny.

AI may extract, draft, rank, or propose. AI shall not approve access, classify or reclassify information, set reuse rights, waive a control, merge to a protected branch, or treat search ranking as truth.

Approved reusable knowledge is a governed claim with source, owner, lifecycle, applicability, and limitations. Raw chat, tickets, and scanner output are not approved knowledge.

Embeddings, summaries, caches, and compiled agent skills are derivatives. Withdrawal, reclassification, or destruction of a source shall propagate to derivatives.

Secrets, credentials, production data dumps, and Restricted (including client/PHI) material shall not be pasted into public generative-AI services or stored in vector indexes unless an authorized path and agreement exist.

HIPAA-regulated PHI is out of default scope. Enable the HIPAA pack and a business-associate path before any PHI is processed by agents or knowledge indexes.

Change to a must procedure (including knowledge used by agents) is a change under the Change / Release procedure and SOC 2 CC8.1. Agents cannot approve that change.