Standard security policies and procedures
At Scalable Operations we take the security of our data, our clients' data, and our systems seriously. This document sets out how we protect the confidentiality, integrity, and availability of sensitive information assets across every engagement.
Scope
These policies apply to all employees, contractors, and third-party vendors working with Scalable Operations. This includes anyone with access to:
- Company-issued devices, including computers, laptops, and phones
- Cloud-based systems, including client Salesforce and HubSpot instances
- Sensitive client information
- Company financial or operational data
Roles and responsibilities
- Management. Holds ultimate responsibility for maintaining these policies and ensuring all team members receive adequate training.
- IT administrator. Handles technical implementation, manages user access, maintains security software, and conducts security audits.
- All employees and contractors. Comply with these policies and report potential security incidents immediately.
Password security
- Strong passwords. Passwords must meet complexity requirements covering length, special characters, numbers, and no dictionary words, and be changed at least every 90 days.
- Unique passwords. Reuse of passwords across systems and accounts is prohibited.
- Password managers. Use of an approved password manager is mandatory.
- Multi-factor authentication. MFA is required for access to all critical systems, including Salesforce, email, and cloud storage.
Data security
- Confidentiality. All sensitive client data is treated as confidential. Client information is discussed only on a need-to-know basis and only in secure settings.
- Classification. Data is classified as Confidential, Internal, or Public. Access and sharing are controlled according to classification.
- Storage and encryption. Sensitive data is stored in approved locations with appropriate encryption, including at rest.
- Sharing and transfer. Secure file-sharing methods, such as encrypted file transfer and company-approved platforms, are mandatory for client data.
Incident response
- Reporting. Any suspected security breach or incident must be reported immediately to the IT administrator or designated security representative.
- Investigation. The IT administrator leads the investigation and determines scope and impact.
- Containment. Immediate steps are taken to isolate affected systems and prevent further damage.
- Recovery. Systems and data are restored from backups as needed.
- Documentation. All incidents are documented for analysis and improvement.
Network security
- Firewalls. Firewalls control network traffic and block unauthorized access.
- Intrusion detection. Monitoring is maintained to identify potential malicious activity.
- Software updates. All systems and applications are kept current with the latest security patches.
User access controls
- Role-based permissions. User access to Salesforce and other systems is granted on a least-privilege basis.
- Provisioning and de-provisioning. A formal process governs granting access for new users and revoking access immediately when a user leaves.
Mobile device security
- Encryption. Any company or client data stored on mobile devices must be encrypted.
- Remote wipe. Devices are configured for remote data erasure if lost or stolen.
Third-party vendor management
- Risk assessment. All third-party vendors with access to sensitive data undergo a security risk assessment.
- Contractual agreements. Vendor contracts include specific security requirements and data protection clauses.
- Regular monitoring. Vendor performance is monitored, with periodic assessment of security controls.
Training and awareness
- New hire training. These policies form part of onboarding for all new employees and contractors.
- Ongoing training. Regular security awareness training covers phishing, password management, and social engineering.
Salesforce environments
- Security configuration. Salesforce security settings, including password policies, field-level security, and session timeouts, are configured to match the sensitivity of the data stored.
- Periodic reviews. User permissions and access logs are audited periodically to maintain access integrity.
- AppExchange packages. The security implications of third-party AppExchange packages are evaluated before installation.
Review and updates
This document was last reviewed in August 2026. It is reviewed annually and updated to reflect changes in the security landscape, applicable regulations, and company operations. Questions about any policy stated here can be directed to eric@scalableoperations.co.