Identity, Passwords, MFA and Privileged Access

Policy status: Approved and actively followed. We operate role-based access control, privileged-access reviews and supported multifactor authentication. Effective April 11, 2026.

Purpose and scope

We enforce individual accountability and least privilege across workforce identity, administrative surfaces, infrastructure and service accounts.

This policy applies to personnel, contractors, technology and third parties acting for Pingplus Media to the extent of their approved access and applicable agreements. Customer and supplier responsibilities are aligned with our executed contracts and applicable law.

Controls and practices in operation

1. We assign named, manager-approved and role-limited identities to each member of the workforce. Shared administrator access is restricted to approved and monitored emergency use.
2. We apply strong workforce password standards, screen for known compromised or default credentials and enable MFA where technically supported. Contract-specific credential-rotation controls are maintained for the systems to which they apply.
3. We use strong workforce passwords, screen for known compromised or default credentials, and apply MFA wherever supported. Any contract-specific rotation interval is tracked per relevant system with appropriate technical exceptions.
4. We enforce phishing-resistant or authenticator-based MFA for privileged, hosting, cloud, email and remote-access systems where supported, and track any remaining technical limitation for resolution.
5. We maintain service account ownership, secret storage outside code, noninteractive least privilege, access expiry where supported and reviewed key/token rotations.
6. We review privileged access quarterly and other workforce access at least semiannually. The established exit-control process revokes access as soon as employment or contractual authorisation ends and records the completion time.
7. We administer SMPP bind credentials as separate machine-to-machine transport controls. We follow SMPP 3.4 protocol constraints and coordinate active credential changes through an approved partner migration process.

Review and responsibility

Quarterly privileged reviews; semiannual general reviews; immediately at offboarding and on incident.

Accountability and reporting

Our personnel, contractors and in-scope service partners follow this policy, with established channels for prompt reporting of suspected security issues. Exceptions are recorded, reviewed and approved by an authorised policy owner. Applicable customer contracts and legal duties continue to govern the services provided.