Information Security Policy

Comprehensive security framework protecting our systems, data, and customers through industry-leading controls and governance

Last Updated: September 2026 | Version 3.1

Policy Statement

POPS.GG (operated by CASH.BH LTD) is committed to protecting the confidentiality, integrity, and availability of all information assets, systems, and data entrusted to us by our customers, partners, and employees. This Information Security Policy establishes the foundation for our security program, which is informed by ISO 27001 and industry best practices, applied proportionately to a small company.

Information security is a fundamental business requirement and responsibility shared by all employees, contractors, and third parties with access to our systems and data. This policy applies to all information in any form, all information systems, and all individuals with access to our resources.

Security Objectives

Confidentiality

Ensure information is accessible only to authorized individuals and protected from unauthorized disclosure through encryption, access controls, and secure handling procedures.

Integrity

Maintain accuracy and completeness of information through validation, change control, and protection against unauthorized modification or deletion.

Availability

Ensure authorized users have reliable and timely access to information and systems through redundancy, backup procedures, and business continuity planning.

Security Framework (informed by ISO 27001)

Our security controls are informed by ISO 27001:2022, providing a systematic approach to managing sensitive company information and ensuring it remains secure.

ISO 27001 Certification Status: POPS.GG is not ISO 27001 certified. This policy is informed by ISO 27001:2022 controls applied proportionately to a small company.

Scope

  • All information assets related to advertising platform operations
  • Customer data, payment information, and personal data processing
  • IT infrastructure, applications, and cloud services
  • Physical and environmental security of data centers
  • Third-party service providers with access to our systems
  • All employees, contractors, and business partners

Security Program Components

Leadership & Context

  • Security policy and objectives
  • Risk assessment methodology
  • Statement of Applicability (SoA)
  • Management commitment

Planning

  • Risk treatment plans
  • Security objectives
  • Resource allocation
  • Compliance requirements

Support & Operation

  • Competence and awareness
  • Documented procedures
  • Operational controls
  • Change management

Evaluation & Improvement

  • Internal audits
  • Management reviews
  • Corrective actions
  • Continuous improvement

ISO 27001 Annex A Controls

We apply proportionate controls informed by the 4 themes of ISO 27001:2022 Annex A:

Organizational Controls (37 controls)

Policies, roles, asset management, supply chain security, HR security

People Controls (8 controls)

Screening, terms of employment, awareness, disciplinary process

Physical Controls (14 controls)

Physical security, access control, equipment security, disposal

Technological Controls (34 controls)

Access control, cryptography, network security, system security, logging

Information Classification & Handling

All information assets must be classified according to their sensitivity and importance to the organization. Classification determines appropriate security controls and handling procedures.

Critical / Highly Confidential

Examples: Authentication credentials, encryption keys, personal identification documents, financial records, trade secrets

Required Controls:

  • End-to-end encryption (AES-256 minimum)
  • Multi-factor authentication for access
  • Strict need-to-know access only
  • Encrypted transmission (TLS 1.3)
  • Comprehensive audit logging
  • Immediate breach notification procedures
  • Annual access review
  • No storage on portable devices

Confidential

Examples: Customer personal data, transaction records, contracts, employee records, internal business plans, security documentation

Required Controls:

  • Encryption at rest and in transit
  • Role-based access control
  • Secure transmission protocols
  • Access logging and monitoring
  • Authorized disposal procedures
  • Semi-annual access review

Internal Use

Examples: Internal communications, procedures, non-sensitive business data, operational metrics, internal documentation

Required Controls:

  • Authentication required for access
  • Standard encryption for transmission
  • Basic access controls
  • Secure storage on approved systems
  • No public disclosure without approval

Public

Examples: Marketing materials, press releases, public website content, published documentation

Required Controls:

  • Integrity verification
  • Version control
  • Approval process for publication
  • Brand and compliance review

Access Control Policy

Access Control Principles

Least Privilege

Users granted minimum access necessary to perform job functions. Elevated privileges require justification and approval.

Need-to-Know

Access to confidential information limited to those with legitimate business need. Data segregation enforced.

Separation of Duties

Critical functions divided among multiple individuals to prevent fraud and error. No single person controls entire process.

Regular Review

Access rights reviewed quarterly for appropriateness. Unused accounts disabled, excessive privileges removed.

User Access Management

Account Provisioning

  • Formal access request process with manager approval
  • Identity verification before account creation
  • Role-based access control (RBAC) assignment
  • Unique user accounts (no shared credentials)
  • Default deny access model

Account Maintenance

  • Quarterly access rights review by the company director
  • Automated notification of unused accounts (30 days)
  • Automatic disabling after 60 days of inactivity
  • Re-certification required for privileged access (annually)

Account Termination

  • Immediate account disabling upon termination
  • Return of all access devices and credentials
  • Knowledge transfer procedures before access removal
  • Exit interview including security briefing

Authentication Requirements

Password Policy

  • Minimum 12 characters length
  • Complexity requirements (uppercase, lowercase, numbers, symbols)
  • No password reuse (last 12 passwords)
  • 90-day expiration for privileged accounts
  • Immediate lockout after 5 failed attempts
  • Password manager recommended for users

Multi-Factor Authentication (MFA)

  • Mandatory: SSH key authentication for server access; MFA on all hosted/admin accounts
  • Required: All employee accounts, customer accounts accessing sensitive data
  • Methods: Authenticator apps (preferred), SMS codes
  • Backup codes: Securely stored offline for account recovery

Privileged Access Management (PAM)

  • Secrets kept in a restricted vault on the server; no shared credentials
  • Administrative access is logged

Network Access Control

  • Host firewall with default-deny inbound, fail2ban, and CDN/WAF in front of the web tier
  • Remote server access by SSH key only
  • Firewall rules following least privilege principle

Cryptographic Controls

Encryption Standards

Data at Rest

  • Passwords are hashed; backups are AES-256 encrypted
  • TLS for all transport

Data in Transit

  • TLS 1.3 for all external communications
  • TLS 1.2 minimum (deprecated protocols blocked)
  • Encrypted email for sensitive communications
  • SSH for remote server access

Key Management

  • Key Generation: Cryptographically secure random number generators
  • Key Storage: Encryption keys are held in a restricted file on the server with an offline copy
  • Key Rotation: Keys rotated on compromise or when retired
  • Key Access: Restricted to the company director
  • Key Destruction: Secure deletion when keys are retired or compromised

Digital Signatures & Certificates

  • TLS certificates are issued and auto-renewed by our CA/CDN provider
  • Certificate revocation procedures for compromised certificates

Security Monitoring & Logging

Logging Requirements

Comprehensive logging enabled for all security-relevant events:

  • User authentication (success and failures)
  • Privileged access and administrative actions
  • System and application errors
  • Access to sensitive data
  • Security control changes
  • Network connection attempts
  • File integrity monitoring events
  • Data export and large data transfers

Log Management

  • Centralization: Logs are centralised on the server and included in encrypted backups
  • Retention: 90 days online, 1 year in archive, 7 years for audit logs
  • Time Synchronization: NTP servers for accurate timestamps
  • Access Control: Log access restricted to the company director
  • Review: Automated alerting; manual review periodically and on incident

Security Monitoring

Monitoring

  • Automated monitoring and alerting
  • CDN/WAF threat blocking

Detection Capabilities

  • fail2ban brute-force blocking
  • CDN/WAF threat blocking
  • Server log review

Alerting & Response

  • Risk-based alert prioritization (critical, high, medium, low)
  • Automated blocking (fail2ban, CDN/WAF) for common attacks
  • Critical alerts are sent to the operator; response as soon as practicable

Vulnerability & Patch Management

Vulnerability Scanning

  • Frequency: Dependency and OS vulnerability updates applied regularly
  • Scope: Server operating system, application dependencies, database
  • Tools: OS package updates and open source dependency checks
  • Coverage: Internal and external attack surfaces
  • Validation: Manual verification of critical findings

Patch Management

Critical Vulnerabilities

  • CVSS 9.0-10.0
  • Active exploitation in the wild
  • Emergency patching within 24 hours
  • Testing in staging, then production

High Vulnerabilities

  • CVSS 7.0-8.9
  • Patching within 7 days
  • Testing before deployment
  • Workarounds if patch unavailable

Medium Vulnerabilities

  • CVSS 4.0-6.9
  • Patching within 30 days
  • Included in monthly patch cycle
  • Risk assessment for prioritization

Low Vulnerabilities

  • CVSS 0.1-3.9
  • Patching within 90 days
  • Risk-based prioritization
  • May defer if mitigating controls exist

Security Testing

  • Responsible Disclosure: Responsible-disclosure contact published in security.txt at /.well-known/security.txt

Security Governance

Roles & Responsibilities

Company Director

All security roles are held by the company director: accountability, strategy, policy approval, day-to-day security operations, monitoring, incident response and vulnerability management.

All Employees

Responsible for following security policies, reporting incidents, completing security training, and protecting company assets.

Risk Management

  • Risk Assessment: Annual comprehensive risk assessment, quarterly updates
  • Risk Treatment: Documented risk treatment plans with assigned owners
  • Risk Register: Risk register reviewed periodically by the company director
  • Risk Acceptance: Accepted risks are approved and recorded by the company director
  • Third-Party Risk: Vendor security assessments before onboarding, annual reviews

Policy Framework

  • This Information Security Policy: High-level governance document
  • Standards: Specific technical requirements (encryption, access control, etc.)
  • Procedures: Step-by-step implementation guides
  • Guidelines: Best practice recommendations
  • Review Cycle: Annual policy review, update as needed for regulatory changes

Compliance Management

  • GDPR (General Data Protection Regulation) compliance
  • Security controls informed by ISO 27001 (not certified)
  • UK Data Protection Act 2018
  • Financial regulations (Companies Act, AML regulations)
  • Annual internal compliance review by the company director

Security Awareness & Training

Training Program

New Employee Onboarding

  • Mandatory security training during first week
  • Policy acknowledgment and acceptable use agreement
  • Role-specific security training
  • Security contact information and incident reporting procedures

Annual Refresher Training

  • All employees complete annual security awareness training
  • Updated content covering current threats and best practices
  • Completion tracked and reported to management
  • Non-compliance escalated to HR

Specialized Training

  • Developers: Secure coding practices, OWASP Top 10
  • IT Operations: Security configuration, incident response
  • Management: Risk management, compliance requirements
  • Customer Service: Social engineering awareness, data handling

Security Communications

  • Security alerts for critical threats or vulnerabilities

Physical & Environmental Security

Data Center Security

  • Data Centre: Physical security of the data centre is the responsibility of our hosting provider, which publishes its own certifications

Office Security

  • We have no physical office; staff work remotely under the Acceptable Use Policy
  • Clean desk policy for sensitive information
  • Secure document disposal (cross-cut shredding)

Security Incident Management

For comprehensive incident response procedures, refer to our dedicated Security Incident Response Plan.

Key Requirements

  • All employees must report suspected security incidents immediately
  • Incidents reported to security@pops.gg are handled as soon as practicable
  • Formal incident response plan with defined procedures
  • Post-incident reviews and lessons learned
  • Regulatory breach notifications as required by law

Policy Compliance & Enforcement

Compliance Monitoring

  • Annual internal security review by the company director
  • Automated monitoring and alerting

Non-Compliance

Violations of this policy may result in disciplinary action up to and including:

  • Verbal or written warning
  • Suspension of system access privileges
  • Mandatory retraining
  • Termination of employment or contract
  • Legal action for intentional violations

Disciplinary actions are proportionate to the severity and intent of the violation.

Exceptions

  • Policy exceptions require formal written request with business justification
  • Company director approval required for all exceptions
  • Compensating controls must be implemented
  • Exceptions documented in risk register
  • Annual review of all active exceptions

Policy Review & Updates

  • Annual Review: Comprehensive policy review by the company director
  • Regulatory Updates: Updates within 30 days of regulatory changes
  • Incident-Driven: Updates following major security incidents
  • Version Control: All versions maintained with change history
  • Communication: Material changes communicated to all staff
  • Approval: The company director approves major policy changes

Contact Information

Security Team

Company Director (all security roles)

Email: security@pops.gg

Report Security Incidents:

Email: security@pops.gg (checked daily; automated alerts for critical events)

Company Information

CASH.BH LTD

Company Number: 14298863

71–75 Shelton Street, Covent Garden
London, WC2H 9JQ, United Kingdom

General: compliance@pops.gg