---
title: "Security & Compliance Documentation Pack"
url: "https://ensights.productfruits.help/en/article/security-compliance-documentation-pack"
language: "en"
last_updated: "2026-10-01T20:29:41.656Z"
---

# Security & Compliance Documentation Pack

This pack gives your IT, cyber security and OT teams everything they need to assess enSights during vendor onboarding: one overview document that answers the common questions, the ISO 27001 certificate, and the policies and procedures it is built on. Start with the Security Overview; open a policy only when you want to check the detail behind a statement.

## What's in this pack

| Document | Read it when | File |
| --- | --- | --- |
| **enSights Security, Compliance & Identity Overview**<br>(main document) | You need answers for a vendor security review: certifications, audits, security testing, controls, SSO/SCIM and IoT/OT security – each traced to its source. | [Download (PDF)](https://nissanet33.github.io/ensights-cheatsheet/enSights_Security_Compliance_Overview__1.pdf) |
| **ISO/IEC 27001:2022 certificate**<br>(SII, no. 1125445) | You need proof of certification. Valid until 27 March 2028. | [Download (PDF)](https://nissanet33.github.io/ensights-cheatsheet/ISO27001_Certificate_1125445.pdf) |
| **IQNet certificate**<br>(IL-1125445) | You need the internationally recognized version of the ISO certificate. Use it together with the SII certificate. | [Download (PDF)](https://nissanet33.github.io/ensights-cheatsheet/ISO27001_Certificate_1125445_IQNet.pdf) |
| **IS-P-001 Information Security Policy** | You want the umbrella ISMS policy: governance, risk, access control, product security and compliance. | [Download (Word)](https://nissanet33.github.io/ensights-cheatsheet/IS-P-001%20Information%20Security%20Policy.docx) |
| **IS-P-003 Secure Development Policy** | You are reviewing how enSights builds, tests and releases software. | [Download (Word)](https://nissanet33.github.io/ensights-cheatsheet/IS-P-003%20Secure%20Development%20Policy.docx) |
| **IS-P-010 Supplier Relationships Policy** | You are reviewing how enSights rates, contracts and monitors its suppliers. | [Download (Word)](https://nissanet33.github.io/ensights-cheatsheet/IS-P-010%20Supplier%20Relationships%20Policy.docx) |
| **IS-P-011 Cloud Based Computing Policy** | You are reviewing the AWS hosting model, cloud security posture and network design. | [Download (Word)](https://nissanet33.github.io/ensights-cheatsheet/IS-P-011%20Cloud%20Based%20Computing%20Policy.docx) |
| **IS-P-012 Logging and Monitoring Policy** | You need to know what is logged, how alerts are handled and how long logs are kept. | [Download (Word)](https://nissanet33.github.io/ensights-cheatsheet/IS-P-012%20Logging%20and%20Monitoring%20Policy.docx) |
| **IS-P-013 Information Security Policy for Supplier Relationships** | You need supplier tiers, review frequency, sub-processor rules and supplier access controls. | [Download (Word)](https://nissanet33.github.io/ensights-cheatsheet/IS-P-013%20Information%20Security%20Policy%20for%20Supplier%20Relationships.docx) |
| **IS-P-014 Business Continuity Policy** | You need RTO/RPO targets, disaster recovery and backup arrangements. | [Download (Word)](https://nissanet33.github.io/ensights-cheatsheet/IS-P-014%20Business%20Continuity%20Policy.docx) |
| **IS-P-016 Risk Assessment and Treatment Policy** | You want the risk methodology: scoring, residual risk, owners and treatment. | [Download (Word)](https://nissanet33.github.io/ensights-cheatsheet/IS-P-016%20Risk%20Assessment%20and%20Treatment%20Policy.docx) |
| **IS-P-018 Access and Authorization Policy** | You are reviewing access reviews, joiners and leavers, privileged access, MFA, SSO and password rules. | [Download (Word)](https://nissanet33.github.io/ensights-cheatsheet/IS-P-018%20Information%20Security%20Access%20And%20Authorization%20Policy.docx) |
| **IS-P-020 Privacy Policy** | You need to know what personal data the platform processes and how it is protected. | [Download (Word)](https://nissanet33.github.io/ensights-cheatsheet/IS-P-020%20Privacy%20Policy%20.docx) |
| **Incident Response Procedure** | You need the incident handling process, roles and customer notification commitments. | [Download (Word)](https://nissanet33.github.io/ensights-cheatsheet/Information%20Security%20and%20Cyber%20Incident%20Response%20Procedure_EN.docx) |

## Shared under NDA

These documents contain detail that is shared only under a mutual NDA. Their key results are summarized in the Security Overview.

| Document | Summary in the overview |
| --- | --- |
| **ISO 27001 surveillance audit report**<br>(SII, May 2026) | Section 2.2 |
| **Penetration test executive summary**<br>(Aikido, May 2026) | Section 2.3 |
| **Disaster Recovery Test Summary**<br>(October 2026) | Section 2.4 |
| **SOC 2 report** | Shared once issued |

## The Security Overview – start here

Every statement in the overview cites the policy and section it comes from (for example **IS-P-018 Sec. 3.1**) and, where relevant, the ISO/IEC 27001:2022 audit control and page that evidences it (for example **A.8.24 – p.25**), so your team can verify any claim. Section 9 of the overview links to every source document.

| Section | What it covers |
| --- | --- |
| 1\. Summary of requests and responses | One-line answers to the standard onboarding requests, with a pointer to the detail. |
| 2\. Standards compliance and audits | ISO 27001 certificate (no. 1125445, valid until 27 March 2028), the May 2026 surveillance audit, penetration testing, disaster recovery testing and SOC 2 status. |
| 3\. Information security policies | The register of all policies and procedures, with versions and download links. |
| 4\. Security controls – traceability matrix | Controls across governance, data protection, access control, infrastructure, secure development, operations and resilience – each with its policy section and audit reference. |
| 5\. Identity integration – SSO and SCIM | SAML 2.0 single sign-on and SCIM user provisioning (both fully supported) and how onboarding works. |
| 6\. IoT / OT and site-device security | How site telemetry and control traffic reaches the platform and how device credentials and data are protected. |
| 7\. Hosting and architecture | AWS hosting, regions, compute, data stores, identity, observability and customer connectivity. |
| 8\. Requesting documents | What is shared under NDA and how to request it. |
| 9\. Source document index | Version, date and download link of every source document. |

## What each policy contains

### IS-P-001 Information Security Policy

-   **Sec. 8** – governance: the Information Security Steering Committee and security roles.
-   **Sec. 11** – product security and data protection: platform authentication, tenant isolation, encryption.
-   **Sec. 15–17** – network security, remote access and access control.
-   **Sec. 18** – R&D security: secure development, vulnerability SLAs, penetration testing, change control.
-   **Sec. 20–21** – monitoring, incident response, compliance and audit.

### IS-P-003 Secure Development Policy

-   **Sec. 5.1–5.5** – secure SDLC: peer-reviewed pull requests, SAST/SCA, secrets detection and remediation SLAs (Critical 72 hours, High 14 days, Medium 30 days, Low 90 days).
-   **Sec. 5.6–5.7** – separated environments, no production data in test, secrets management.
-   **Sec. 6** – third-party components and SBOM.

### IS-P-010 Supplier Relationships Policy

-   **Sec. 2–3** – supplier risk rating (1–5) and due diligence.
-   **Sec. 4–6** – security clauses in agreements, NDAs and annual review of critical suppliers.
-   **Sec. 7** – service changes and end of contract, including access revocation within 24 hours.

### IS-P-011 Cloud Based Computing Policy

-   **Sec. 1–3** – shared responsibility, cloud provider due diligence, PII in the cloud.
-   **Sec. 4–5** – infrastructure as code, change control, cloud security posture management.
-   **Sec. 6, 8** – network segmentation, administrative access, resilience and backups.

### IS-P-012 Logging and Monitoring Policy

-   **Sec. 2.1–2.2** – monitored systems and real-time alerting.
-   **Sec. 2.3–2.4** – events to log and retention (90 days operational, 1 year archive).
-   **Sec. 2.5–2.7** – administrator logs, log protection and clock synchronization.

### IS-P-013 Information Security Policy for Supplier Relationships

-   **Sec. 2** – supplier tiers and review frequency.
-   **Sec. 3** – assessment, contract principles, sub-processors, supplier access and 24-hour breach reporting.
-   **Sec. 4** – ICT supply chain security.

### IS-P-014 Business Continuity Policy

-   **Sec. 3.3–3.5** – business impact analysis and recovery targets (RTO 12 hours; RPO 6 hours general, 1 minute for MongoDB).
-   **Sec. 3.6–3.7** – scripted disaster recovery to a secondary AWS region and immutable backups.
-   **Sec. 3.9** – annual BCP/DR testing.

### IS-P-016 Risk Assessment and Treatment Policy

-   **Sec. 2.2** – where risks are identified: scans, audits, penetration tests, compliance changes, incidents.
-   **Sec. 2.3** – likelihood × impact scoring, control effectiveness and residual risk, risk owners.
-   **Sec. 2.4–2.5** – treatment plans, reporting and annual review.

### IS-P-018 Access and Authorization Policy

-   **Sec. 3** – quarterly access reviews, logging and non-human identities.
-   **Sec. 4–6** – joiners and leavers, least privilege and RBAC, privileged and break-glass access.
-   **Sec. 7–9** – MFA, mandatory SSO, password standard and credential recovery.

### IS-P-020 Privacy Policy

-   **Sec. 4.1–4.2** – data minimization, use and disclosure, user access.
-   **Sec. 4.3–4.5** – data location and encryption, retention and disposal, logging.

### Incident Response Procedure

-   **Sec. 2–3** – alert levels and roles.
-   **Sec. 5–8** – response stages and ransomware, malware and phishing playbooks.
-   **Sec. 11** – crisis communication: affected customers receive written notice within 24 hours of detection.

## How to

### Complete a vendor security questionnaire

1.  Open the Security Overview and answer from **Section 1** and **Section 4**.
2.  Quote the policy reference next to each answer so your reviewers can check it.
3.  Attach the ISO certificate and the relevant policy when a reviewer asks for evidence.

### Verify a statement against its source

1.  Find the row in the traceability matrix (Section 4 of the overview).
2.  Open the document named in **Policy source** and go to the section number shown.
3.  For audit evidence, use the control and page in **ISO 27001 audit ref.** – the audit report itself is shared under NDA.

### Plan SSO and SCIM for your users

1.  Read **Section 5** of the overview.
2.  Share your identity provider's SAML metadata and the attribute and role mapping with enSights.
3.  Enable SCIM together with SSO so joiners and leavers are handled automatically.

## Notes

-   The ISO certificate can be verified at [www.sii.org.il.](https://www.sii.org.il./) The IQNet certificate is valid only together with the SII certificate.
-   References use the form **Sec. x.y** for policy sections and **A.x.y** for ISO/IEC 27001:2022 Annex A controls.
-   Security contact: Dekel Yaacov, CTO & Co-Founder – [dekel@ensights.ai](mailto:dekel@ensights.ai).