Security & Compliance Documentation Pack

This pack gives your IT, cyber security and OT teams everything they need to assess enSights during vendor onboarding: one overview document that answers the common questions, the ISO 27001 certificate, and the policies and procedures it is built on. Start with the Security Overview; open a policy only when you want to check the detail behind a statement.

What's in this pack

Shared under NDA

These documents contain detail that is shared only under a mutual NDA. Their key results are summarized in the Security Overview.

The Security Overview – start here

Every statement in the overview cites the policy and section it comes from (for example IS-P-018 Sec. 3.1) and, where relevant, the ISO/IEC 27001:2022 audit control and page that evidences it (for example A.8.24 – p.25), so your team can verify any claim. Section 9 of the overview links to every source document.

What each policy contains

IS-P-001 Information Security Policy

• Sec. 8 – governance: the Information Security Steering Committee and security roles.
• Sec. 11 – product security and data protection: platform authentication, tenant isolation, encryption.
• Sec. 15–17 – network security, remote access and access control.
• Sec. 18 – R&D security: secure development, vulnerability SLAs, penetration testing, change control.
• Sec. 20–21 – monitoring, incident response, compliance and audit.

IS-P-003 Secure Development Policy

• Sec. 5.1–5.5 – secure SDLC: peer-reviewed pull requests, SAST/SCA, secrets detection and remediation SLAs (Critical 72 hours, High 14 days, Medium 30 days, Low 90 days).
• Sec. 5.6–5.7 – separated environments, no production data in test, secrets management.
• Sec. 6 – third-party components and SBOM.

IS-P-010 Supplier Relationships Policy

• Sec. 2–3 – supplier risk rating (1–5) and due diligence.
• Sec. 4–6 – security clauses in agreements, NDAs and annual review of critical suppliers.
• Sec. 7 – service changes and end of contract, including access revocation within 24 hours.

IS-P-011 Cloud Based Computing Policy

• Sec. 1–3 – shared responsibility, cloud provider due diligence, PII in the cloud.
• Sec. 4–5 – infrastructure as code, change control, cloud security posture management.
• Sec. 6, 8 – network segmentation, administrative access, resilience and backups.

IS-P-012 Logging and Monitoring Policy

• Sec. 2.1–2.2 – monitored systems and real-time alerting.
• Sec. 2.3–2.4 – events to log and retention (90 days operational, 1 year archive).
• Sec. 2.5–2.7 – administrator logs, log protection and clock synchronization.

IS-P-013 Information Security Policy for Supplier Relationships

• Sec. 2 – supplier tiers and review frequency.
• Sec. 3 – assessment, contract principles, sub-processors, supplier access and 24-hour breach reporting.
• Sec. 4 – ICT supply chain security.

IS-P-014 Business Continuity Policy

• Sec. 3.3–3.5 – business impact analysis and recovery targets (RTO 12 hours; RPO 6 hours general, 1 minute for MongoDB).
• Sec. 3.6–3.7 – scripted disaster recovery to a secondary AWS region and immutable backups.
• Sec. 3.9 – annual BCP/DR testing.

IS-P-016 Risk Assessment and Treatment Policy

• Sec. 2.2 – where risks are identified: scans, audits, penetration tests, compliance changes, incidents.
• Sec. 2.3 – likelihood × impact scoring, control effectiveness and residual risk, risk owners.
• Sec. 2.4–2.5 – treatment plans, reporting and annual review.

IS-P-018 Access and Authorization Policy

• Sec. 3 – quarterly access reviews, logging and non-human identities.
• Sec. 4–6 – joiners and leavers, least privilege and RBAC, privileged and break-glass access.
• Sec. 7–9 – MFA, mandatory SSO, password standard and credential recovery.

IS-P-020 Privacy Policy

• Sec. 4.1–4.2 – data minimization, use and disclosure, user access.
• Sec. 4.3–4.5 – data location and encryption, retention and disposal, logging.

Incident Response Procedure

• Sec. 2–3 – alert levels and roles.
• Sec. 5–8 – response stages and ransomware, malware and phishing playbooks.
• Sec. 11 – crisis communication: affected customers receive written notice within 24 hours of detection.

How to

Complete a vendor security questionnaire

1. Open the Security Overview and answer from Section 1 and Section 4.
2. Quote the policy reference next to each answer so your reviewers can check it.
3. Attach the ISO certificate and the relevant policy when a reviewer asks for evidence.

Verify a statement against its source

1. Find the row in the traceability matrix (Section 4 of the overview).
2. Open the document named in Policy source and go to the section number shown.
3. For audit evidence, use the control and page in ISO 27001 audit ref. – the audit report itself is shared under NDA.

Plan SSO and SCIM for your users

1. Read Section 5 of the overview.
2. Share your identity provider's SAML metadata and the attribute and role mapping with enSights.
3. Enable SCIM together with SSO so joiners and leavers are handled automatically.

Notes

• The ISO certificate can be verified at www.sii.org.il. The IQNet certificate is valid only together with the SII certificate.
• References use the form Sec. x.y for policy sections and A.x.y for ISO/IEC 27001:2022 Annex A controls.
• Security contact: Dekel Yaacov, CTO & Co-Founder – dekel@ensights.ai.