Information security

Information Security Policy of JSC CB "GLOBUS" (Public Version)

General Principles of the Bank's Information Security

1. Approaches to Ensuring Information Security

1. The Bank applies the following approaches to ensuring information security:
   1. a list of information subject to restricted access has been developed and approved;
   2. a list of critical business processes has been developed and approved, for which information security risk assessments and subsequent risk treatment are carried out;
   3. rules governing access to information resources and hardware and software systems have been established;
   4. physical and logical access to all designated resources is controlled;
   5. password protection is provided for software and service resources;
   6. anti-virus protection is provided for software and service resources;
   7. network protection is ensured;
   8. identification and authentication of all designated resources are ensured;
   9. cryptographic protection of information is ensured;
   10. internal ISMS audits and management reviews of the ISMS are conducted;
   11. the ISMS is monitored and continuously improved.

2. Rules for Ensuring Information Security and Business Continuity

1. The Bank adheres to the following rules:
   1. the Bank's employees and third parties participate in maintaining an appropriate level of information security and are held accountable in accordance with applicable laws and internal regulations;
   2. information security requirements are taken into account during the development, implementation and operation of hardware and software systems;
   3. the Bank's public services and internal networks comply with information security requirements;
   4. the Bank establishes and monitors compliance with information security requirements stipulated in agreements with third parties concerning payment systems;
   5. the information security and IT development strategy is taken into account in the Bank's projects;
   6. the Bank's management ensures systematic information security training for employees;
   7. emergency response plans are developed, tested and updated:
      • Business Continuity Plan;
      • Information Systems Business Continuity Plan.

3. Information as a Business Resource

Information and the Bank's information assets are important business resources. The Bank takes measures to protect them against unauthorized use, modification, destruction and denial of access, as well as to ensure the integrity and traceability of information processing activities.
The primary objective of information security is to minimize the Bank's information security risks in accordance with its security policy.

4. Authority and Responsibility

Defining information security objectives, strategies and areas of focus falls within the remit of the Bank's Management Board. Responsibility for ensuring information security is assigned to a dedicated department.
All Bank employees must be familiar with and comply with information security requirements.

5. Basis for Developing the Information Security Policy

The Information Security Policy is developed in accordance with applicable laws, the Bank's security policy and contractual obligations. In the event of any discrepancies, the requirements of Ukrainian law shall prevail.

6. Information Classification and Access

Information is classified according to access restriction categories. The Bank is required to restrict access to banking secrecy, insider information and personal data.

Employees and outsourced personnel are granted access to restricted information only after signing a non-disclosure undertaking.

Third-party organizations are granted access only upon the provision of legally binding documents concerning information protection.

Personal data may be disclosed only with the consent of the individual concerned.

7. Cooperation with Payment System Participants

Information security requirements governing interaction with payment systems are based on the mutual distrust model.

8. Protection of the Bank's Rights

The Bank has the right to take lawful measures to protect information in the event of its unauthorized disclosure or other unlawful actions.

9. Information Protection System (IPS)

Information security is ensured through a set of measures (IPS) designed to guarantee:

1. the impossibility of disabling or bypassing the IPS;
2. the integrity and continuity of protection;
3. an optimal and sufficient level of protection;
4. access segregation based on the "need-to-know" principle;
5. minimization of the number of gateways between internal and external environments;
6. the use of modern technologies and cryptography;
7. the highest possible level of protection for key information;
8. minimization of the human factor.

10. Personnel as Part of the IPS

The Bank establishes professional competence and reputation requirements for employees performing key information security roles and provides them with appropriate training.

11. Risk Analysis

The Bank continuously analyzes information security risks. The Information Security Policy is regularly reviewed and updated.

12. Incident Response

The Bank has implemented a mechanism for reporting and responding to information security incidents.

13. IPS Monitoring

The Bank continuously monitors the operation of the IPS and critical systems.
The Bank has the right to monitor the activities of its personnel and third-party organizations within the limits established by applicable law.

14. Business Continuity

The Bank plans measures to ensure business continuity and preserve critical information in emergency situations. The Business Continuity Plan is approved by the Management Board.

15. Recommendations for Customers on Safe Internet Use and Remote Banking Services