Security Policy Overview
PrivionGRC maintains comprehensive security policies that establish the framework for protecting information assets, including customer data, intellectual property, and business information. These policies apply to all employees, contractors, vendors, and third parties with access to PrivionGRC systems and data.
Our security program is based on industry standards including SOC 2 Trust Services Criteria, NIST Cybersecurity Framework, ISO 27001 principles, and GDPR data protection requirements.
Policy Owner
Matt Fishman, CEO
Review Frequency
Annual
Effective Date
October 17, 2025
Core Security Policies
Information Security Policy
Establishes the framework for protecting PrivionGRC's information assets, including customer data, intellectual property, and business information. Defines security principles, roles, responsibilities, and control categories.
Access Control Policy
Requirements for managing access to information systems, applications, and data. Includes user account management, authentication requirements, RBAC, and privileged access management.
Data Classification Policy
Framework for classifying and handling data based on sensitivity, value, and regulatory requirements. Defines four classification levels and handling requirements for each.
Incident Response Policy
Procedures for detecting, responding to, and recovering from security incidents. Includes incident classification, response team, communication protocols, and documentation.
Supporting Policies
Change Management Policy
Procedures for managing changes to systems, applications, and infrastructure with proper authorization, testing, and documentation.
Coming SoonAcceptable Use Policy
Guidelines for appropriate use of company systems, networks, and resources by employees and authorized users.
Coming SoonRemote Work Policy
Security requirements and best practices for employees working remotely, including device security and access controls.
Coming SoonVendor Management Policy
Requirements for managing third-party vendors and service providers, including security assessments and data processing agreements.
Coming SoonSecurity Policy Framework
Information Security Principles
- C
Confidentiality
Information accessible only to authorized individuals on a need-to-know basis
- I
Integrity
Information accurate, complete, and protected from unauthorized modification
- A
Availability
Information and systems accessible to authorized users when needed
- A
Accountability
All actions traceable to individuals through comprehensive audit logging
Security Control Categories
Access Control
RBAC, MFA, access reviews, immediate revocation
Data Protection
Encryption in transit/rest, classification, secure disposal
Network Security
Cloud infrastructure, segmentation, vulnerability scanning
Application Security
SSDLC, OWASP Top 10, security testing, code reviews
Compliance Standards
SOC 2
Trust Services Criteria
Q3 2026 TargetNIST
Cybersecurity Framework
AlignedISO 27001
Information Security Management
AlignedGDPR
Data Protection Regulation
CompliantQuestions About Our Security Policies?
Our security team is available to discuss our policies and provide additional documentation as needed for your security assessment.