{"id":1938,"date":"2024-10-10T11:00:55","date_gmt":"2024-10-10T06:00:55","guid":{"rendered":"http:\/\/gfg.com.pk\/cpl\/?page_id=1938"},"modified":"2026-10-06T11:01:10","modified_gmt":"2026-10-06T11:01:10","slug":"it-security-policy","status":"publish","type":"page","link":"https:\/\/gfg.com.pk\/cpl\/it-security-policy\/","title":{"rendered":"IT Security Policy"},"content":{"rendered":"<div class=\"wpb-content-wrapper\">[vc_row full_width=&#8221;stretch_row&#8221; css=&#8221;.vc_custom_1568879018810{background-image: url(https:\/\/gfg.com.pk\/cpl\/wp-content\/uploads\/2019\/09\/companyprofile-banner.jpg?id=118) !important;}&#8221; el_class=&#8221;inner-banner-head&#8221;][vc_column][vc_custom_heading text=&#8221;IT SECURITY POLICY&#8221; font_container=&#8221;tag:h3|text_align:center&#8221;][\/vc_column][\/vc_row][vc_row el_class=&#8221;sectionpadding codeofthics-section&#8221;][vc_column][vc_custom_heading text=&#8221;IT SECURITY POLICY&#8221; font_container=&#8221;tag:h2|text_align:center&#8221; el_class=&#8221;mainsameheadmaroon&#8221;][vc_separator el_class=&#8221;centerlineshort&#8221;][vc_column_text css=&#8221;&#8221;]The IT Security Policy aims to ensure business continuity and minimize damage by preventing and limiting the impact of security incidents.<\/p>\n<p><strong>Policy<\/strong><\/p>\n<p>The purpose of the Policy is to protect Company information assets from all types of threats including cybersecurity threats, whether internal or external, deliberate or accidental. These assets relate to information stored and processed electronically. IT Security policy ensures that:<\/p>\n<ul>\n<li>Safeguarding information from unauthorized access.<\/li>\n<li>Preventing unauthorized disclosure or interruption.<\/li>\n<li>Protecting against unauthorized modification to maintain information accuracy and completeness.<\/li>\n<li>Meeting regulatory and legislative requirements, including record-keeping standards.<\/li>\n<li>Producing, maintaining, and testing Disaster Recovery Plans to ensure availability of information and services.<\/li>\n<li>Making information on security matters available to all staff.<\/li>\n<li>Reporting and investigating all breaches of information security, actual or suspected.<\/li>\n<\/ul>\n<p><strong>Standards<\/strong><\/p>\n<p>To support this Policy, the Company follows recognized security standards, frameworks, and best practices. These standards include regulations, guidelines and procedures covering matters such as (not limited to) cybersecurity threats, data security, backup, endpoints users control and password protection;<\/p>\n<ul>\n<li>Meeting business requirements for information availability and system functionality.<\/li>\n<li>Assigning responsibility for information security to a designated officer.<\/li>\n<li>Ensuring all managers implement the policy within their areas and ensure adherence by their staff.<\/li>\n<li>Requiring each employee to adhere to the policy.<\/li>\n<\/ul>\n<p><strong>Industry specific requirements for cybersecurity and strategy<\/strong><\/p>\n<p>The Company\u2019s IT team has successfully implemented several advanced security measures, including next generation edge network firewalls, a cloud-based web application firewall and endpoint Extended Detection and Response (XDR) solution, an email security gateway, and comprehensive user access policies and procedures aligned with industry best practices. To further strengthen cybersecurity, additional capabilities have been integrated for proactive risk exposure management, enabling enhanced threat detection, faster response, improved data visibility, and actionable insights through advanced analytics and threat intelligence. These measures ensure a resilient security posture against evolving cyber risks.<\/p>\n<h4><strong>Board\u2019s Risk Oversight Function for Cybersecurity<\/strong><\/h4>\n<p>The Board of Directors of the Company has delegated oversight of cybersecurity risk management to the Group IT Steering Committee. This delegation ensures alignment with management on the appropriate risk appetite related to cybersecurity, recognizing it as an enterprise-wide issue affecting all divisions and functions.<\/p>\n<h4><strong>Formation of Group IT Steering Committee<\/strong><\/h4>\n<ul>\n<li>Group IT Steering Committee, composed of directors from each company including Cherat Packaging Limited. This committee plays a pivotal role in promoting broader accountability for cybersecurity risks at the management level. Its responsibilities include discussing strategic initiatives, prioritizing risks, and reviewing IT security policies and recommendations from third-party audits.<\/li>\n<li>The IT Steering Committee has actively endorsed and directed the IT teams to implement a variety of cybersecurity controls aimed at mitigating the risks associated with cyberattacks.<\/li>\n<\/ul>\n<h4><strong>Management Engagement<\/strong><\/h4>\n<ul>\n<li>Ensuring that cybersecurity is understood and managed across all divisions, with clear communication about controls, employee training, and incident response protocols.<\/li>\n<\/ul>\n<h4><strong>Control and Procedures for Cybersecurity Early Warning System and Associated Risks<\/strong><\/h4>\n<p>As networks and systems continuously evolve due to emerging threats, organizational growth, and new regulatory or business requirements, traditional analysis tools primarily focus on recording and identifying threats through logging, analysis, and reporting over time.<\/p>\n<p>The IT Steering Committee regularly reviews security policies, controls, and third-party audit findings. In response, the IT team has deployed a variety of security solutions and monitoring tools.<\/p>\n<p><strong>Current Measures:<\/strong><\/p>\n<ul>\n<li>Security system including network monitoring, next-generation firewalls, web application firewalls, email security gateways, and endpoint extended detection and response (XDR) solutions and newly integrated cyber risk exposure management capabilities.<\/li>\n<li>A centralized firewall log management and analytics platform that centralizes configurations, events, and alerts, offering advanced threat visualization and actionable insights.<\/li>\n<\/ul>\n<p><strong>Implementation of Recommendations:<\/strong><\/p>\n<ul>\n<li>Third-Party Audits ensure that recommendations from independent security assessments are implemented promptly to address identified vulnerabilities and strengthen overall resilience.<\/li>\n<\/ul>\n<h4><strong>Comprehensive Security Assessment of Technology Environment<\/strong><\/h4>\n<p>Information Security Policies and assessment of IT objects serve as the backbone of any mature information security program. IT steering committee has implemented information security policies that support its organizations\u2019 business objectives while also adhering to industry standards and regulations.<\/p>\n<p>The IT Steering Committee supports and participates in comprehensive security assessments, including Vulnerability Assessment and Penetration Testing (VAPT).<\/p>\n<p><strong>Assessment Process:<\/strong><\/p>\n<ul>\n<li><strong>VAPT Approach:<\/strong> The IT Steering Committee has instructed the IT teams to conduct Vulnerability Assessment and Penetration Testing (VAPT) of IT assets by a third-party company every two years. As part of this exercise, cybersecurity risk assessments of critical assets will also be performed to provide deeper insight into potential threats and prioritize remediation efforts. This process offers a detailed view of vulnerabilities affecting applications and infrastructure, enabling the IT security team to focus on mitigating high-risk exposures.<\/li>\n<li><strong>Review and Implementation:<\/strong> VAPT reports are reviewed by the IT Steering Committee, leading to the implementation of recommended patches and revalidation by third-party providers.<\/li>\n<\/ul>\n[\/vc_column_text][\/vc_column][\/vc_row][vc_row el_class=&#8221;displaynone&#8221;][vc_column][vc_icon][\/vc_column][\/vc_row]\n<\/div>","protected":false},"excerpt":{"rendered":"<p>[vc_row full_width=&#8221;stretch_row&#8221; css=&#8221;.vc_custom_1568879018810{background-image: url(https:\/\/gfg.com.pk\/cpl\/wp-content\/uploads\/2019\/09\/companyprofile-banner.jpg?id=118) !important;}&#8221; el_class=&#8221;inner-banner-head&#8221;][vc_column][vc_custom_heading text=&#8221;IT SECURITY POLICY&#8221; font_container=&#8221;tag:h3|text_align:center&#8221;][\/vc_column][\/vc_row][vc_row el_class=&#8221;sectionpadding codeofthics-section&#8221;][vc_column][vc_custom_heading text=&#8221;IT SECURITY POLICY&#8221; font_container=&#8221;tag:h2|text_align:center&#8221; el_class=&#8221;mainsameheadmaroon&#8221;][vc_separator el_class=&#8221;centerlineshort&#8221;][vc_column_text css=&#8221;&#8221;]The IT Security Policy aims to ensure business<span class=\"excerpt-hellip\"> [\u2026]<\/span><\/p>\n","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-1938","page","type-page","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/gfg.com.pk\/cpl\/wp-json\/wp\/v2\/pages\/1938","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/gfg.com.pk\/cpl\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/gfg.com.pk\/cpl\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/gfg.com.pk\/cpl\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/gfg.com.pk\/cpl\/wp-json\/wp\/v2\/comments?post=1938"}],"version-history":[{"count":5,"href":"https:\/\/gfg.com.pk\/cpl\/wp-json\/wp\/v2\/pages\/1938\/revisions"}],"predecessor-version":[{"id":2100,"href":"https:\/\/gfg.com.pk\/cpl\/wp-json\/wp\/v2\/pages\/1938\/revisions\/2100"}],"wp:attachment":[{"href":"https:\/\/gfg.com.pk\/cpl\/wp-json\/wp\/v2\/media?parent=1938"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}