Policy status: Approved and actively followed. We maintain controlled ISMS documents, approval records, review cycles and compliance evidence. Effective April 11, 2026.
Purpose and scope
We keep policy versions, approvals, evidence and audit findings accurate, accessible to authorised reviewers and up to date.
This policy applies to personnel, contractors, technology and third parties acting for Pingplus Media to the extent of their approved access and applicable agreements. Customer and supplier responsibilities are aligned with our executed contracts and applicable law.
Controls and practices in operation
- Our approved policies are issued through document control with a document ID, version, sponsor, custodian, reviewer, approver, effective date, review date and change history. The controlled register identifies the adopted and currently effective versions.
- We maintain a central evidence index of certificates, signoffs, reviewed access lists, training attendance, incident logs, quarterly risk reviews, monthly log checks, supplier reviews, backup reports and VAPT results.
- We separate publicly shareable policy summaries from restricted architecture, security reports, credentials, source code, customer messaging content and incident details.
- We conduct quarterly control self-checks for customer and partner assurance, maintain supporting evidence, review observed exceptions and track any approved corrective action through an assigned owner and closure record.
- We record approved policy exceptions with a business reason, risk assessment, mitigation, expiry and responsible authority. Legal and executed customer-contract obligations remain applicable.
- We review controlled policy versions at least annually and after material changes. We record approved effective dates, actual review activity, training, exercises and certification details accurately in our document-control history.
Review and responsibility
Quarterly evidence/control review; annual policy review; on contract/incident change.
Accountability and reporting
Our personnel, contractors and in-scope service partners follow this policy, with established channels for prompt reporting of suspected security issues. Exceptions are recorded, reviewed and approved by an authorised policy owner. Applicable customer contracts and legal duties continue to govern the services provided.