Information Systems Management Policy

Information security and system management standards

Policy Scope

This policy establishes the basic principles and standards regarding the management of Berg Rent a Car's information systems, data security, and technology infrastructure.

The policy covers all information systems, network infrastructure, servers, databases, applications, and our digital assets.

Information Security Principles

1. Confidentiality

Necessary measures are taken to prevent information from being accessed and disclosed by unauthorized persons.

2. Integrity

Controls are performed to protect information from unauthorized changes and ensure its accuracy.

3. Availability

Information systems are ensured to be accessible by authorized users when needed.

Technical Security Measures

The following technical measures are taken to ensure the security of our information systems:

  • Use of strong encryption protocols (SSL/TLS)
  • Firewalls and network segmentation
  • Regular security updates and patches
  • Intrusion detection and prevention systems (IDS/IPS)
  • Regular security scans and penetration tests
  • Automated backup and recovery systems
  • Maintenance and monitoring of access logs

Access Control

Access to information systems is limited by the "need-to-know" principle:

  • User authentication and authorization mechanisms
  • Strong password policies and multi-factor authentication
  • Role-based access control (RBAC)
  • Regular access rights reviews
  • Immediate cancellation of access rights of departing personnel

Data Backup and Recovery

To prevent loss of critical data:

  • Daily automated backup operations
  • Storage of backups in secure and separate locations
  • Regular backup restoration tests
  • Disaster recovery plans and procedures
  • Determination of maximum acceptable interruption times (RTO/RPO)

Incident Response

For responding to security incidents:

  • Determination of incident response team and responsibilities
  • Incident detection and notification procedures
  • Incident analysis and root cause analysis
  • Post-incident improvement activities
  • Regular incident response drills

Staff Training and Awareness

All our staff regarding information security:

  • Receive regular training
  • Are informed about security policies
  • Are encouraged to report suspicious activities
  • Participate in awareness campaigns

Third-Party Service Providers

When working with third-party service providers:

  • Security requirements are specified in contracts
  • Regular security audits and evaluations are conducted
  • Data processing agreements are made
  • Security standards of service providers are checked

Policy Updates

This policy is regularly reviewed and updated according to technological developments, legal changes, and business requirements. All updates are shared with relevant personnel.

Contact

You can contact us for questions about this policy or security concerns.