Policy status: Approved and actively followed. We carry out documented information-security risk identification, treatment, ownership and periodic review. Effective April 11, 2026.
Purpose and scope
We identify, analyse, treat and track risks to confidentiality, integrity, availability, privacy, messaging continuity and contractual compliance.
This policy applies to personnel, contractors, technology and third parties acting for Pingplus Media to the extent of their approved access and applicable agreements. Customer and supplier responsibilities are aligned with our executed contracts and applicable law.
Controls and practices in operation
- We maintain a risk register using five-point likelihood and impact scales and record inherent risk, current controls, residual risk, risk owner, treatment choice, due date and evidence link.
- We assess new suppliers, software, major changes, partner connections, personal-data flows and material vulnerabilities before go-live, and validate implemented controls and evidence as part of risk treatment.
- High and critical risks are escalated to the Founder & CEO within one business day of classification. The owner documents acceptance, mitigation, avoidance or transfer and reviews residual risk before closure.
- We review high/critical risks monthly and the complete register quarterly. Open exceptions are time-bound, owned and have compensating controls.
- We assess hosting/storage, loss of production database, plaintext network exposure, SMS abuse, backup dependencies, privileged-access failures and third-party confidentiality as distinct scenario classes.
- We assess each observation against documented evidence and record the resulting actions and follow-up.
Review and responsibility
Monthly high/critical review; quarterly full review; on every major change/incident.
Accountability and reporting
Our personnel, contractors and in-scope service partners follow this policy, with established channels for prompt reporting of suspected security issues. Exceptions are recorded, reviewed and approved by an authorised policy owner. Applicable customer contracts and legal duties continue to govern the services provided.