Skip to main content

Security Policies

Owner: Mahdi Moradi
Status: Draft
Version: 0.1.0
Last Updated: 2026-03-16
Applies To: Bornara AI

Overview​

This document defines mandatory security policies and practices for all Bornara AI systems and projects. Compliance with these policies is non-negotiable.

Access Control​

Authentication​

  • Multi-Factor Authentication (MFA): Required for all user accounts
  • Password Requirements: Minimum 12 characters, complexity requirements
  • Service Accounts: Use managed identities or secrets management
  • API Keys: Rotate regularly, store securely

Authorization​

  • Principle of Least Privilege: Users get minimum permissions needed
  • Role-Based Access Control (RBAC): Use roles not individual permissions
  • Regular Access Reviews: Quarterly audit of permissions
  • Temporary Elevated Access: Time-bound, logged, approved

Data Protection​

Data Classification​

Public​

  • Can be freely shared
  • No protection requirements
  • Example: Marketing materials

Internal​

  • For company use only
  • Basic access controls
  • Example: Internal documentation

Confidential​

  • Sensitive business information
  • Strict access controls
  • Encryption required
  • Example: Financial data, customer information

Restricted​

  • Highest sensitivity
  • Need-to-know basis only
  • Enhanced encryption and auditing
  • Example: Security keys, PII

Encryption​

  • In Transit: TLS 1.2+ for all network communications
  • At Rest: AES-256 for all confidential and restricted data
  • Key Management: Hardware security modules (HSM) or cloud KMS
  • Certificate Management: Automated rotation, valid certificates only

Data Retention​

  • Active Data: Retained per business requirements
  • Archived Data: Moved to cold storage after [X] months
  • Deletion: Secure deletion when no longer needed
  • Backups: Encrypted, tested quarterly

Network Security​

Perimeter Security​

  • Firewalls: All external-facing systems behind WAF
  • DDoS Protection: Cloud-native DDoS mitigation
  • VPN: Required for remote access to internal systems
  • Network Segmentation: Separate networks for different security zones

Application Security​

  • Input Validation: All user inputs validated and sanitized
  • Output Encoding: Prevent XSS attacks
  • SQL Injection Prevention: Parameterized queries only
  • CSRF Protection: Anti-CSRF tokens required
  • Rate Limiting: Protect against abuse

Vulnerability Management​

Scanning​

  • Dependency Scanning: Automated scanning of all dependencies
  • Container Scanning: All container images scanned before deployment
  • Code Scanning: SAST tools in CI/CD pipeline
  • Penetration Testing: Annual third-party assessment

Patching​

  • Critical Vulnerabilities: Patched within 24 hours
  • High Severity: Patched within 7 days
  • Medium/Low: Patched within 30 days
  • Zero-Day: Emergency response procedures

Incident Response​

Incident Classification​

  • P0 - Critical: Active breach, data exposure
  • P1 - High: Vulnerability exploited, service down
  • P2 - Medium: Potential threat detected
  • P3 - Low: Policy violation, minor issue

Response Procedures​

  1. Detection: Automated alerts and monitoring
  2. Containment: Isolate affected systems
  3. Investigation: Determine scope and impact
  4. Remediation: Fix vulnerability, restore service
  5. Post-Mortem: Document lessons learned

Communication​

  • Internal: Incident commander notifies stakeholders
  • External: Legal and PR review required
  • Regulatory: Report per compliance requirements

Compliance​

Regulatory Requirements​

  • GDPR: For EU customer data
  • CCPA: For California residents
  • SOC 2: Type II certification
  • [Other applicable regulations]

Audit Trail​

  • Logging: All security-relevant events logged
  • Retention: Logs retained for 12 months minimum
  • Immutability: Logs cannot be modified
  • Review: Regular review for anomalies

Secure Development​

Code Review​

  • Peer Review: All code reviewed before merge
  • Security Review: Security-sensitive changes require security team review
  • Automated Checks: Linting, SAST, dependency scanning

Secrets Management​

  • No Secrets in Code: Never commit secrets to version control
  • Secrets Vault: Use Azure Key Vault, AWS Secrets Manager, or equivalent
  • Rotation: Rotate secrets every 90 days
  • Access Logging: Log all secret access

Third-Party Code​

  • License Review: Verify license compatibility
  • Security Assessment: Scan for known vulnerabilities
  • Vendor Assessment: Review vendor security practices
  • Updates: Keep dependencies current

Training and Awareness​

  • Security Training: Mandatory annual training for all employees
  • Phishing Tests: Regular simulations
  • Security Champions: Designated security advocates per team
  • Threat Intelligence: Share relevant threat information

Physical Security​

  • Device Security: Full disk encryption, screen locks
  • Clean Desk: No sensitive information left visible
  • Visitor Management: Sign-in required, escorted
  • Asset Disposal: Secure wiping or physical destruction

Cloud Security​

Azure-Specific (if applicable)​

  • Azure Security Center: Enable for all subscriptions
  • Azure Sentinel: Centralized SIEM
  • Azure Policy: Enforce compliance automatically
  • Private Endpoints: Use for PaaS services

AWS-Specific (if applicable)​

  • AWS Security Hub: Enable for all accounts
  • GuardDuty: Threat detection enabled
  • CloudTrail: Logging all API calls
  • VPC: Private subnets for sensitive workloads

Policy Violations​

Reporting​

  • Security incidents or policy violations must be reported immediately
  • Anonymous reporting channel available
  • No retaliation for good-faith reporting

Consequences​

  • Minor Violations: Coaching and training
  • Moderate Violations: Written warning, additional training
  • Major Violations: Suspension or termination
  • Criminal Activity: Report to law enforcement

Policy Exceptions​

Exceptions require:

  • Written risk assessment
  • Compensating controls documented
  • CISO approval
  • Regular review

Review and Updates​

  • Scheduled Review: Quarterly
  • Triggered Review: After incidents or regulatory changes
  • Approval: CISO and Legal review

Next Review: 2026-06-16

Contact​