ISO 27001 Security Policy

This Security Policy provides the framework for information security desired by APPCRAFT management

The context for this policy
The framework for establishing security objectives
The governance system and IT security organization at APPCRAFT

APPCRAFT offers the following product and services:

APPCRAFT event management platform, consisting of the following applications:

Event website
Participant application
Back office application
Contributor application
Check-in application


Consequently, maintaining the confidentiality, integrity, and availability of our data and our customers' data is our priority.

Information security objectives will be defined in the following form:

A target to be achieved
A measure (action) to be implemented

All of these objectives will be established by management and identified in the ISMS summary document, taking into account the following points:

The results of the risk analysis
The necessary technical measures from Annex A of the ISO 27001 standard
Regulatory requirements
Contractual requirements
The organization's guidelines

The roles and responsibilities related to information security are:

Management is responsible for the security of company information and that of its customers. Management has final approval of high-level security projects.
The Chief Information Security Officer (CISO) is responsible for information security policy, risk management, internal auditing, compliance, and all documentation related to information security. The CISO reports to management on the performance of the information security management system.
Managers are responsible for applying information security rules within their scope of responsibility and for alerting the CISO as soon as possible of any non-compliance they observe.
The IT Manager is responsible for managing the IT infrastructure.
The Data Protection Officer is responsible for ensuring that APPCRAFT complies with the legal framework relating to personal data (GDPR).
The Security Incident Manager is responsible for defining and enforcing the incident management process.
The Supplier Manager is responsible for defining the criteria for selecting and evaluating suppliers. He or she is also responsible for validating the choice of suppliers and conducting reviews.
The Technical Manager/Lead Developer is responsible for implementing technical security measures based on security rules and principles.
Employees and subcontractors are required to comply with the security rules applicable to them at all times and in all circumstances.