Policy status: Approved and actively followed. We apply endpoint hardening, access protection and device security controls. Effective April 11, 2026.
Purpose and scope
We secure devices that access company email, customer data, source code and production administration consoles.
This policy applies to personnel, contractors, technology and third parties acting for Pingplus Media to the extent of their approved access and applicable agreements. Customer and supplier responsibilities are aligned with our executed contracts and applicable law.
Controls and practices in operation
- We record all corporate/approved personal endpoints, users, asset IDs, operating-system patch baseline, disk encryption, screen lock and authorised data access.
- We operate compatible anti-malware and endpoint-detection safeguards on managed devices and applicable servers, with documented alternative controls for production-sensitive systems.
- We enforce approved endpoint-security rules for devices handling customer or administrative information, including inventory, protective software where supported, security posture review and timely access revocation.
- We require device encryption, 10-minute maximum idle lock target for sensitive environments, no shared accounts, least-privilege local admin and approved update settings.
- Our existing lost-device response revokes exposed sessions and tokens, restricts affected accounts and, when technically and legally authorised, locks or wipes managed devices. Actions and outcomes are recorded in the incident process.
- We review endpoint compliance monthly and authorised exceptions quarterly. We apply equivalent access boundaries to permitted BYOD devices and restrict noncompliant devices from confidential information.
Review and responsibility
At enrolment and loss; monthly posture review; quarterly exception review.
Accountability and reporting
Our personnel, contractors and in-scope service partners follow this policy, with established channels for prompt reporting of suspected security issues. Exceptions are recorded, reviewed and approved by an authorised policy owner. Applicable customer contracts and legal duties continue to govern the services provided.