Section 1
Purpose and scope
In short
This Policy sets Spectrum's security baseline for all personnel and systems involved in delivering our services worldwide.
The purpose of this Policy is to protect information assets against unauthorized access, disclosure, alteration, and destruction — whether accidental or deliberate.
Scope includes Spectrum Future Tech and Spectrum Future Technology LLC operations, personnel, information systems, and project delivery activities across India, the United States, Canada, Australia, Saudi Arabia, and other regions where we engage clients or subprocessors.
- Applies to full-time employees, contractors, interns, and third parties with authorized access
- Covers cloud, on-premises, and hybrid environments used for delivery
- Complements project-specific security requirements agreed with clients
- Reviewed at least annually or when significant changes occur to risk, regulation, or services
Section 2
Governance and management commitment
In short
Leadership approves this Policy, allocates resources for security, and reviews ISMS performance on a planned cadence.
Spectrum management is accountable for establishing, maintaining, and continually improving the Information Security Management System (ISMS).
Security objectives are aligned with business goals, client commitments, and applicable legal requirements. Topic-specific policies — such as access control, acceptable use, and incident response — support this master Policy.
- A designated security lead coordinates policy maintenance, risk treatment, and audit activities
- Management review evaluates incidents, audit findings, metrics, and improvement opportunities
- Exceptions require documented risk acceptance and time-bound approval from authorized management
- All personnel must acknowledge applicable policies as part of onboarding and refresher training
Section 3
Information security objectives
Spectrum maintains measurable objectives to guide control selection and demonstrate continual improvement. Objectives may include:
- Zero unmitigated critical vulnerabilities in production systems under Spectrum management
- Timely patching of systems according to severity-based SLAs
- 100% MFA enrollment for privileged and remote access accounts
- Security awareness completion by all personnel annually
- Incident response drills and tabletop exercises at planned intervals
- Client security and privacy commitments honored in statements of work and DPAs
Section 4
Roles and responsibilities
Information security is a shared responsibility. The following roles illustrate typical accountability — specific names and escalation paths are maintained internally.
Executive management
- Approve the Information Security Policy and ISMS scope
- Ensure adequate budget and staffing for security controls
- Review significant risks and accept residual risk where appropriate
Security lead / ISMS owner
- Maintain policies, risk register, and control documentation
- Coordinate internal audits, external assessments, and corrective actions
- Serve as primary contact for serious security incidents and regulatory inquiries
Engineering and delivery teams
- Follow secure development, deployment, and access procedures
- Report vulnerabilities, anomalies, and policy violations promptly
- Protect client credentials, keys, and intellectual property
All personnel
- Complete mandatory security awareness training
- Use strong authentication and protect devices issued or approved by Spectrum
- Handle information according to classification and need-to-know principles
Section 5
Risk management
In short
We identify, assess, and treat information security risks using a documented methodology aligned with ISO 27001.
Spectrum maintains a risk management process that identifies threats and vulnerabilities to information assets, evaluates likelihood and impact, and selects treatment options: mitigate, transfer, avoid, or accept.
Risk assessments are performed at least annually, when launching new services or technologies (including AI/ML tooling), and when material changes occur to infrastructure or client obligations.
- Asset inventory covers systems, applications, data stores, and third-party services
- Risk owners are assigned for treatment actions with target dates
- Residual risks are documented and approved by management
- Client-specific risks may be addressed in project risk registers and shared reviews
Section 6
Asset management and classification
Information assets are inventoried and classified to ensure appropriate handling throughout their lifecycle — creation, storage, transmission, archival, and secure disposal.
- Classification levels typically include Public, Internal, Confidential, and Restricted (client/regulated data)
- Labeling and handling rules define storage locations, encryption, sharing, and retention
- Media and equipment disposal uses secure wipe or destruction methods
- Return of client assets and data at project end follows contractual offboarding procedures
Section 7
Access control
In short
Access is granted on least privilege and need-to-know, with MFA for sensitive systems and regular recertification.
Logical and physical access to Spectrum and client environments is controlled through documented provisioning workflows. Access rights are tied to job function and revoked upon role change or termination.
- Unique user identities — shared accounts are prohibited except where technically required and approved
- Multi-factor authentication (MFA) for VPN, cloud consoles, source control, and privileged admin access
- Privileged access management with enhanced logging and just-in-time elevation where feasible
- Quarterly or event-driven access reviews for critical systems
- Automatic session timeout and lockout after failed authentication attempts
Remote and client environments
When delivering in client-controlled environments, Spectrum personnel use client-approved identity providers, jump hosts, and network paths. Client credentials are never stored in personal accounts or unapproved password managers.
Section 8
Cryptography and data protection
In short
Sensitive data is encrypted in transit and at rest using industry-standard algorithms; keys are managed securely.
Spectrum applies cryptographic controls proportionate to data classification and regulatory requirements.
- TLS 1.2 or higher for data in transit over public networks; HSTS where applicable on web properties
- Encryption at rest for laptops, mobile devices, and approved cloud storage containing confidential data
- Secrets and API keys stored in approved vaults — not in source code repositories or chat messages
- Pseudonymization and minimization applied when designing analytics and AI workflows
- Secure file transfer mechanisms for exchanging sensitive deliverables with clients
Section 9
Operations security
Operational procedures protect systems against malware, unauthorized change, and capacity failures while preserving evidence for investigation.
- Malware protection on endpoints; restrictions on unauthorized software installation
- Change management for production systems with rollback plans and approval gates
- Vulnerability scanning and penetration testing at planned intervals
- Security logging and time-synchronized audit trails for critical systems
- Backup and restore procedures tested periodically
Section 10
Secure development and AI delivery
In short
Security is embedded in SDLC and AI workflows — from design and code review to deployment and monitoring.
Spectrum integrates security into software and AI/automation delivery through secure coding standards, automated testing, and DevSecOps practices.
- Threat modeling for new features handling sensitive or regulated data
- Peer code review and static analysis for security defects
- Dependency and container image scanning in CI/CD pipelines
- Separation of development, staging, and production environments
- AI-specific controls: prompt injection awareness, output validation, human review for high-impact decisions, and governance of training data sources
- No use of client production data in model training without explicit written authorization
Section 11
Physical and environmental security
Physical access to Spectrum offices and facilities is restricted to authorized personnel. Visitors are escorted where required.
- Secure areas for server/network equipment where applicable
- Clean desk and clear screen practices for confidential materials
- Lost or stolen devices reported immediately for remote wipe and credential rotation
- Environmental controls for equipment rooms aligned with vendor specifications
Section 12
Human resources security and awareness
Personnel security measures apply before, during, and after employment to reduce insider risk and maintain a security-aware culture.
- Background checks proportionate to role and client requirements where legally permitted
- Confidentiality and IP assignment agreements for employees and contractors
- Mandatory security awareness at onboarding and annual refreshers
- Phishing simulation and secure coding training for technical roles
- Offboarding checklist: revoke access, recover assets, and transfer knowledge securely
Section 13
Supplier and third-party security
In short
Vendors with access to Spectrum or client data undergo due diligence and contractual security obligations.
Third-party services — cloud providers, SaaS tools, AI APIs, and subcontractors — are assessed for security and privacy before adoption and monitored during use.
- Security questionnaires and review of certifications (e.g., ISO 27001, SOC 2) where available
- Data processing agreements and subprocessors disclosed to clients when required
- Minimum security clauses in contracts covering confidentiality, breach notification, and audit rights
- Annual re-assessment for critical suppliers
Section 14
Incident management and breach notification
In short
Security events are reported fast, classified by severity, and handled through documented response phases.
All personnel must report suspected security incidents, lost devices, phishing attempts, or policy violations without delay. Spectrum maintains an incident response plan covering detection, triage, containment, eradication, recovery, and post-incident review.
- Severity levels (e.g., Critical, High, Medium, Low) with defined escalation paths
- Incident lead coordinates technical response, communications, and evidence preservation
- Forensic procedures applied when required to support investigation or legal obligations
- Post-incident lessons learned documented and tracked to closure
- Client and regulator notification performed per contract and applicable law (e.g., GDPR breach timelines)
Illustrative response targets
- Critical incidents: immediate escalation and containment initiation
- Confirmed personal data breach: client notification without undue delay per agreement and law
- Post-incident report for significant events within agreed client or internal timelines
Section 15
Business continuity and disaster recovery
Spectrum maintains business continuity and disaster recovery plans to restore critical operations and client-facing services after disruptive events.
- Business impact analysis identifies critical processes and recovery priorities
- Backup strategies with off-site or geo-redundant storage where appropriate
- Communication plans for internal teams and affected clients during outages
- Plans tested through tabletop exercises and technical restore drills
Section 16
Compliance and legal requirements
Spectrum complies with applicable information security, privacy, and sector-specific regulations in jurisdictions where we operate and where our clients are located.
- GDPR and UK GDPR for EU/UK personal data processing
- CCPA/CPRA and US state privacy laws where applicable
- India Digital Personal Data Protection Act and local requirements
- Client industry frameworks (e.g., HIPAA BAA, PCI DSS scope) when contractually in scope
- Export control and sanctions screening where relevant to project delivery
Section 17
Monitoring, audit, and continual improvement
The effectiveness of the ISMS is measured through metrics, internal audits, and management review. Nonconformities trigger corrective and preventive actions.
- Key performance indicators: patch compliance, training completion, incident volumes, audit findings
- Internal audits against ISO 27001 control themes at planned intervals
- External assessments and client security audits accommodated under NDA
- Policy review at least annually or upon significant organizational or regulatory change
Section 18
Acceptable use
Personnel must use Spectrum and client systems lawfully and only for authorized business purposes.
- Prohibited: unauthorized copying of client IP, sharing credentials, bypassing security controls, or introducing unapproved high-risk software
- Personal use of corporate resources must not introduce security or legal risk
- AI tools and public cloud services require approval before processing confidential or client data
- Violations may result in disciplinary action, contract termination, and legal remedies
Section 19
Contact and reporting security concerns
For security questions, vulnerability reports, or incident notification, contact Spectrum using the details below. We encourage responsible disclosure and will not retaliate against good-faith reports.
- Email: [email protected] — subject line: "Security Report"
- India (HQ): LALS Enclave, Mehdipatnam, Hyderabad - 500028, India · +91 707 505 4555
- USA: Spectrum Future Technology LLC, 4747 W Pendleton, Peoria, IL 61615 · +1 312 219 3929
- Include sufficient detail to reproduce or investigate the issue; PGP key available on request for sensitive disclosures
Report a security concern
Contact us to report vulnerabilities, incidents, or policy questions. We respond to good-faith security reports promptly and treat them confidentially where appropriate.
[email protected]