Security Built
Into Everything.

Our Security Philosophy

Compliance Frameworks

Ornetis aligns with industry-leading security and compliance frameworks to ensure our practices meet and exceed regulatory requirements:

We hold and maintain documentation to demonstrate compliance. Clients may request relevant security documentation under NDA for due diligence purposes.

Data Protection

All data entrusted to Ornetis — whether client data, personal data, or project information — is protected by multiple layers of security:

• →
  Encryption in transit — All data transmitted over networks uses TLS 1.3 or higher; older protocols are explicitly disabled
• →
  Encryption at rest — All stored data is encrypted using AES-256; encryption keys are managed using industry-standard key management systems
• →
  Data classification — We classify data by sensitivity (Public, Internal, Confidential, Restricted) and apply controls appropriate to each level
• →
  Data minimization — We collect and retain only data necessary for the stated purpose
• →
  Secure deletion — Data is securely wiped or destroyed using NIST 800-88 guidelines when no longer needed
• →
  Backup integrity — Regular automated backups with integrity verification; tested restoration procedures

Network Security

Access Controls

Access to systems and data is strictly controlled at every level:

• →
  Multi-Factor Authentication (MFA) — Required for all employees on every system that processes sensitive data, including email, cloud environments, and collaboration tools
• →
  Role-Based Access Control (RBAC) — Access is granted based on job role and the principle of least privilege; no user has more access than required for their function
• →
  Privileged Access Management (PAM) — Privileged accounts (admin, root) are managed in a PAM vault with just-in-time access provisioning and full audit logging
• →
  Access reviews — Quarterly access reviews ensure permissions remain appropriate; terminated employees' access is revoked within one hour of departure
• →
  Single Sign-On (SSO) — Centralized identity management with SSO reduces credential sprawl and simplifies access governance

Physical Security

Physical security controls protect our office environments and any on-premise infrastructure:

• →Office access requires key card authentication; visitor access is logged and escorted
• →Sensitive hardware and physical media are stored in locked cabinets or secured server rooms
• →CCTV surveillance in all server and infrastructure areas with 90-day retention
• →Clean desk and screen lock policies are enforced for all employees
• →Secure shredding for all physical documents containing sensitive information
• →Third-party data centers used by Ornetis maintain SOC 2 Type II or ISO 27001 certification

Application Security

Security is integrated throughout the software development and delivery lifecycle (DevSecOps):

• •
  Secure coding practices — Developers follow OWASP guidelines; code reviews include security checks before merging
• •
  Static Application Security Testing (SAST) — Automated vulnerability scanning on every code commit
• •
  Dynamic Application Security Testing (DAST) — Runtime vulnerability scanning of web applications in staging environments
• •
  Penetration testing — Annual third-party penetration tests on all client-facing and internal systems; critical findings remediated within 72 hours
• •
  Dependency management — Automated scanning of third-party libraries for known CVEs; patches applied within defined SLAs based on severity
• •
  Web Application Firewall (WAF) — WAF deployed in front of all web-facing applications

Vendor & Supply Chain Security

We apply rigorous security criteria to all vendors and partners who may access our systems or client data:

• →Security assessment questionnaire and review before onboarding any vendor with data access
• →Contractual security requirements and data processing agreements (DPAs) with all vendors processing personal data
• →Annual vendor reviews and continuous monitoring of critical suppliers
• →Vendor access is scoped to the minimum required and logged; remote access uses VPN with MFA
• →Software bill of materials (SBOM) maintained for key client-facing applications

Incident Response

We maintain a comprehensive Incident Response Plan (IRP) aligned to NIST 800-61. Our process covers:

• •
  Preparation — Trained incident response team, defined playbooks for common incident types, pre-authorized tools
• •
  Detection & Analysis — 24/7 SIEM monitoring; incidents triaged within 1 hour of detection
• •
  Containment — Automated and manual containment actions; isolation of affected systems
• •
  Eradication & Recovery — Root cause analysis, patching, and clean system restoration; full documentation required
• •
  Post-Incident Review — Lessons-learned analysis and process improvement within 30 days of incident closure

Business Continuity & Disaster Recovery

Ornetis maintains a Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP) to ensure service resilience:

• →Recovery Time Objective (RTO): Critical systems restored within 4 hours
• →Recovery Point Objective (RPO): Maximum 1 hour of data loss for critical data
• →Automated daily backups with geographic redundancy across multiple data center regions
• →Quarterly DR drills and tabletop exercises to validate recovery procedures
• →Redundant internet connections and failover systems for critical infrastructure
• →All critical data and systems replicated to geographically separate backup environments

Employee Security Training

Every Ornetis team member is a line of defense. Our security culture is built through:

• →Mandatory security awareness training during onboarding and annually thereafter
• →Regular phishing simulation exercises with remediation training for failures
• →Role-specific security training for developers, system administrators, and client-facing staff
• →Security champions program with dedicated ambassadors in each team
• →Monthly security briefings on emerging threats and company-specific risks
• →Clear acceptable use policies with acknowledgment required annually

Vulnerability Disclosure

We welcome responsible disclosure of security vulnerabilities in our systems or website. If you discover a potential security issue, please:

• →Report the vulnerability to info@ornetis.com as soon as possible
• →Include a clear description and, if possible, steps to reproduce the issue
• →Allow us a reasonable time (typically 90 days) to investigate and remediate before public disclosure
• →Avoid accessing, modifying, or deleting data beyond what is necessary to demonstrate the vulnerability