Cybersecurity Policy
Organization: Thermodyne Engineering Systems
Effective Date: [Insert Date]
Policy Version: 1.0
Approved By: [Insert Name / Position]
1. Purpose
This Cybersecurity Policy establishes a framework to protect Thermodyne Engineering
Systems's digital assets, systems, networks, and sensitive data from unauthorized access, cyber
threats, and misuse. It aims to safeguard business continuity, maintain data integrity, and ensure
compliance with national cybersecurity regulations.
2. Scope
This policy applies to:
All employees (permanent, temporary, contract)
Vendors, consultants, and third-party service providers
All IT assets (desktops, laptops, mobile devices, ERP, finance systems, CCTV, servers)
All communication tools and data transfer mechanisms (email, USB, cloud)
3. Roles & Responsibilities
Role Responsibility
IT Administrator Manage firewalls, antivirus, system updates, backups
Department Heads Ensure team compliance with policy
Users (All Employees) Follow best practices for data and system security
Third-party Vendors Secure data access as per contract; follow NDA guidelines
[Optional] Security Lead Oversee security audits, incident response, and awareness
4. Acceptable Use Policy
Company systems are to be used only for authorized business purposes.
Use of unauthorized software, personal USBs, or cloud services (e.g., Google Drive,
Dropbox) is prohibited.
Internet access must not be used for illegal, inappropriate, or malicious activities.
Personal email accounts must not be used to share business data.
5. System Access Control
Access to systems (ERP, finance software, shared folders) must be role-based.
Users must not share login credentials.
All systems must have automatic session timeouts (e.g., 15 minutes).
Remote access (e.g., VPN) must be approved and logged.
6. Password & Authentication Standards
Passwords must be:
o Minimum 8 characters
o Include upper/lower case letters, numbers, and a symbol
Change passwords every 90 days
Enable multi-factor authentication (MFA) where available
Do not write down or share passwords
7. Endpoint Security
All company devices must:
o Have up-to-date antivirus software
o Be protected by strong passwords or biometrics
o Be reported immediately if lost or stolen
Removable media (USBs) must be scanned before use
8. Email & Communication Security
Do not open suspicious attachments or links from unknown senders.
All official communication should be done via company email.
Report phishing attempts to the IT team immediately.
9. Data Backup & Recovery
Regular automatic backups must be taken for:
o ERP system
o Petty cash and financial records
o Inventory and stores data
Backups must be:
o Encrypted
o Stored offline or in a secure cloud
o Tested monthly for restoration
10. Software & Patch Management
Only licensed and approved software is allowed.
IT must:
o Keep systems updated with the latest patches
o Schedule monthly patch reviews
Users must not install or update software on their own.
11. Incident Reporting & Response
All cybersecurity incidents (e.g., malware, phishing, data breach) must be reported to IT
within 30 minutes.
The IT team will:
1. Contain and assess the incident
2. Notify management and, if needed, legal authorities
3. Document the response and implement corrective actions
12. Third-Party & Vendor Security
Vendors accessing systems or data must:
o Sign NDA and data processing agreements
o Use secure access methods (e.g., restricted VPN or monitored access)
o Undergo periodic security assessments
13. Training & Awareness
All employees must:
o Complete cybersecurity awareness training during onboarding
o Undergo annual refresher courses
o Be aware of social engineering, phishing, and ransomware threats
14. Compliance & Auditing
Quarterly internal audits will be conducted for:
o Access logs
o Antivirus/patching status
o Policy adherence
Non-compliance may result in disciplinary action or contract termination
15. Policy Violations
Violations of this policy may lead to:
Formal warnings
Suspension of access rights
Termination of employment or vendor agreement
Legal action in case of willful damage or data theft
16. Policy Review
This policy will be reviewed annually, or earlier if:
New threats or vulnerabilities emerge
Legal or business requirements change
A major cybersecurity incident occurs