Skip to content
English
More support Customer portal
Go to spacetoco.com
  • There are no suggestions because the search field is empty.

SpacetoCo Information Security and Risk Management Policy

An overview of SpacetoCo's ISO/IEC 27001:2022-certified ISMS framework, risk management practices, and infrastructure security controls.

This article outlines SpacetoCo's ICT and security risk management framework. It applies to all SpacetoCo systems, services, production, staging, and test environments, and to all staff and contractors who access company or Customer data.

SpacetoCo maintains an independently audited Information Security Management System (ISMS) certified to ISO/IEC 27001:2022.

 

Framework Purpose and Objectives

The ICT and Security Risk Management Plan provides a structured framework to identify, assess, control, and monitor security risks across the company.

Key objectives include:

  • Identifying, assessing, and mitigating ICT and security risks across all system environments.
  • Providing clear visibility of residual risk to leadership and decision-makers.
  • Supporting compliance with legal, regulatory, and contractual obligations.
  • Aligning all risk management practices with SpacetoCo's ISO/IEC 27001:2022 ISMS governance framework.

Risk Assessment Method

SpacetoCo identifies and evaluates threats across all operational phases—before implementation, during setup, and during ongoing business-as-usual (BAU) operations.

Risks are evaluated using a matrix based on:

  • Likelihood: The qualitative probability of a threat occurring (Low, Medium, High).
  • Impact: The potential severity if a risk occurs (Low, Medium, High, Extreme).

Risk ratings are residual, factoring in active controls and safeguards. Ratings and mitigations are re-evaluated when new controls are implemented or when system environments change.

Summary of Security Controls and Mitigations

End-User Devices

  • Development and sensitive tasks are restricted to company-issued devices.
  • Full-disk encryption is mandatory on all laptops and mobile devices.
  • Access requires unique credentials, strong passwords, auto-screen locks, multi-factor authentication (MFA), and Mobile Device Management (MDM) for remote wiping.
  • Access permissions are revoked immediately when staff leave.

Cloud Infrastructure (AWS)

  • Infrastructure follows AWS security best practices, including IAM roles, security groups, and network segmentation.
  • Privileged accounts are strictly limited and protected by mandatory MFA.
  • Development, staging, and production environments are strictly separated.
  • Data is encrypted both in transit and at rest.
  • Automated logging, monitoring, and alerts flag anomalous activity.

Email and Collaboration Platforms

  • Productivity suites enforce enterprise-grade security and mandatory MFA for all accounts.
  • Centralised administration enables rapid access revocation and remote device wiping.
  • Role-based access controls and ongoing security awareness training reduce phishing risks.

Platform Uptime and Availability

  • Cloud-native architecture is deployed across multiple availability zones for high availability.
  • Automated health checks, capacity planning, and on-call incident response procedures ensure continuous platform performance.

Payment Processing (Stripe and GoCardless)

  • SpacetoCo does not store or process full credit card or bank account details.
  • Payment processing is handled via secure APIs and tokenisation using PCI-compliant payment gateways (Stripe for card payments and GoCardless for direct debit).

Database Security (MongoDB Atlas)

  • Managed database infrastructure uses role-based access control, authentication, and minimal administrator privileges.
  • TLS encryption secures client-database communication, alongside encryption at rest and secure backup processes.

Identity, Access, and Password Management

  • Centrally managed password managers enforce strong master credentials and MFA.
  • Role-based access controls align strictly with job function, with shared accounts restricted or eliminated.

Data Breach and Incident Response

  • Documented incident response procedures follow Office of the Australian Information Commissioner (OAIC) Notifiable Data Breach (NDB) guidance.
  • Incident procedures define clear steps to contain, assess, notify, review, and improve.

Secure Coding and Deployment

  • Software development adheres to OWASP secure coding guidelines.
  • Mandatory peer code reviews by senior developers and automated pipeline tests are required for all production deployments.
  • Regular vulnerability scanning and third-party penetration testing are conducted, with remediations tracked to completion.

Governance and Policy Review

SpacetoCo's ISMS and Security Lead maintains the ICT Risk Register in coordination with executive leadership and product engineering leads.

Risks and controls undergo formal review at least every six months, with full policy reviews conducted annually. The framework is audited through internal reviews as well as external ISO/IEC 27001:2022 surveillance and recertification audits.

For security or compliance inquiries, contact SpacetoCo support via email at info@spacetoco.com.