Governance & Security
Information Security and Cybersecurity Policy
The guidelines that protect the information of Bamex, our clients and partners, built on references recognized in Brazil and worldwide.
ISO/IEC 27001
Information Security Management System
Our commitments
Information security is part of everyone's routine at Bamex and reflects the values that guide the company. Through this policy, we commit to:
Safeguard data and technology resources against any access, change, loss or exposure without proper authorization.
Keep the processes and systems essential to our operation running, avoiding interruptions.
Act in accordance with the laws and regulations of our industry, including data protection and intellectual property rules.
Identify, assess and address cyber risks on an ongoing, structured basis.
This policy is managed by the Information Security and Data Governance team, which reviews it periodically, keeps it up to date and shares it with everyone, together with the supporting standards and procedures. Its guidelines apply to the board, employees, service providers and anyone acting on behalf of Bamex.
Principles
What guides our security
Four pillars shape the way we handle every piece of information:
Confidentiality
Information is accessed only by those who are authorized and genuinely need it, with duties segregated according to defined criteria.
Integrity
Information stays accurate and complete throughout its life cycle; any change requires approval from the data owner.
Availability
Anyone with permission finds information accessible and ready to use whenever they need it.
Authenticity
The origin of every piece of information can be proven, so its author cannot deny having sent it (non-repudiation).
Where this policy applies
This policy covers Bamex's entire technology environment, including servers, databases, systems, equipment, networks, telephony and mobile devices. It also applies to partner and supplier environments that connect, physically or logically, to our infrastructure.
Our practices follow references recognized in Brazil and worldwide:
ISO/IEC 27001
Information Security Management System
CIS
Center for Internet Security
Controls
How we protect everyday operations
Bamex's internal security controls are organized into six areas:
Assets and configuration
- Up-to-date inventory of hardware and software
- Secure configuration baselines for servers, workstations and applications
- Hardened configuration of firewalls, routers and switches
Identity and access
- Access granted on a need-to-know basis
- Restricted, supervised use of administrative accounts
- User account life-cycle management
- Wireless network control
Networks and data
- Network perimeter protection
- Restriction of exposed ports, protocols and services
- Security filters for email and web browsing
- Protection against malicious software
- Data protection mechanisms
- Secure disposal of information
Monitoring and response
- Ongoing identification and remediation of vulnerabilities
- Audit log collection and analysis
- Structured incident handling process
- Penetration tests and response team drills
Continuity
- Data backup and recovery
- Business continuity plan
People and development
- Security awareness and training program
- Secure application development
Partners and suppliers
We expect suppliers and service providers to take the same care with information that we do. That's why we set security requirements that must be followed throughout the partnership.
Policy compliance
Violations of this policy or related standards are subject to disciplinary action and, where applicable, the corresponding legal measures.