R04 · Version 1.0 · Effective October 25, 2026 · Last CISO review October 25, 2026. Version control records every change and review.
How we control documents
A single Information Security Policy sits at the top of our ISMS. Beneath it, topic-specific policies set the rules for each security domain. ISMS documents and registers set up the ISMS and track what changes over time, such as assets, risks, suppliers, and incidents. Standards and playbooks say how we do the work, and evidence shows controls in operation.| Aspect | How botBrains handles it |
|---|---|
| Identification | Policies and ISMS documents have an ID and a title. Every other document goes by its title, and each piece of evidence also by its date. Policies also carry a version, effective date, and last CISO review at the top of the page. |
| Storage | Public documents are pages on this site. Internal and Confidential documents live in the ISMS workspace in Notion, so their links need employee access. |
| Approval and review | The CISO owns and approves every document and reviews it at least annually and after any material change. The CISO records each policy review by updating Last CISO review on the policy page, including reviews that change nothing, so the git history dates every review. The annual internal audit checks that the records are current. |
| Change control | A change to a policy raises its version. Git history keeps every earlier version of the public pages, and Notion page history keeps earlier versions of internal documents. |
| Access | Classification follows the Data Classification Policy. Public documents are open to anyone. Internal and Confidential documents are open only to botBrains personnel. |
| Retention | botBrains keeps ISMS records and register entries, such as audit results, incidents, access reviews, and evidence, for at least 10 years, as set in the Data Retention Policy. |
ISMS documents
| ID | Document | What it holds | ISO 27001 | Classification |
|---|---|---|---|---|
| R01 | ISMS Scope and Objectives | Boundaries of the ISMS, interested parties, and measurable security objectives with their status | Clauses 4.1-4.4, 6.2, 9.1 | Internal |
| R02 | Statement of Applicability | Every Annex A control with applicability, justification, and implementation status | Clause 6.1.3 d) | Public |
| R03 | Communication Plan | What botBrains communicates about security, to whom, when, and how | Clause 7.4 | Confidential |
| R04 | Document register (this page) | Every ISMS document with its classification and location | Clause 7.5 | Public |
| R05 | Internal Audit Programme | Frequency, scope, participants, and outputs of the annual internal audit | Clause 9.2 | Internal |
| R06 | Legal & Contractual Requirements | Legal, regulatory, and contractual obligations and how botBrains meets them | Clause 4.2; Annex A 5.31 | Internal |
Policies
The CISO owns every policy, and all policies are Public. Each policy page shows its version, effective date, and last CISO review, and the page’s git history records every change and review with a timestamp.| ID | Policy | What it covers | ISO 27001 relevance |
|---|---|---|---|
| P01 | Information Security Policy | Establishes management’s commitment, the ISMS framework, and our top-level security objectives | Clause 5.2; Annex A 5.1 |
| P02 | Roles and Responsibilities | Defines who owns, operates, and stays accountable for information security across botBrains | Clause 5.3; Annex A 5.2-5.4 |
| P03 | Risk Management Policy | Sets our methodology for identifying, assessing, and treating information security risks | Clauses 6.1, 8.2, 8.3; Annex A 5.7 |
| P04 | Acceptable Use Policy | Defines how personnel may use company information, devices, accounts, and AI and SaaS tooling | Annex A 5.10, 6.7, 8.1 |
| P05 | Access Control Policy | Governs how botBrains grants, reviews, and revokes identities, authentication, and least-privilege access | Annex A 5.15-5.18, 8.2, 8.3, 8.5 |
| P06 | Cryptography Policy | Defines encryption standards for data at rest and in transit and how we manage keys and certificates | Annex A 8.24 |
| P07 | Asset Management Policy | Maintains an inventory of information assets and assigns ownership and handling rules | Annex A 5.9-5.11, 7.10, 7.14 |
| P08 | Data Classification Policy | Classifies, labels, and governs how we handle data across its lifecycle by sensitivity | Annex A 5.12-5.14, 8.10-8.12 |
| P09 | Data Protection Policy | Ensures lawful, GDPR-compliant processing of personal and customer data, including AI conversation data | Annex A 5.34, 8.11; GDPR |
| P10 | Data Retention Policy | Defines how long we keep each category of data and how we securely delete it | Annex A 5.33, 5.34, 8.10 |
| P11 | Human Resource Security Policy | Covers screening, onboarding, security awareness, discipline, and offboarding of personnel | Annex A 6.1-6.6, 6.8; Clause 7.2, 7.3 |
| P12 | Physical Security Policy | Protects offices, equipment, and physical media and controls access to secure areas | Annex A 7.1-7.14 |
| P13 | Operations Security Policy | Governs secure day-to-day operations, including change management, capacity, and malware protection | Annex A 8.6, 8.7, 8.9, 8.19, 8.31, 8.32 |
| P14 | Logging and Monitoring Policy | Defines what we log, how we protect logs, and how we monitor and review security events | Annex A 8.15-8.17 |
| P15 | Vulnerability Management Policy | Sets how we identify, prioritize, and remediate technical vulnerabilities through scans, patching, and penetration tests | Annex A 8.8 |
| P16 | Backup Policy | Defines backup frequency, scope, encryption, and tested restoration of critical systems and data | Annex A 8.13 |
| P17 | Secure Development Policy | Embeds security into our software development lifecycle, code review, testing, and deployment | Annex A 8.25-8.31 |
| P18 | Network Security Policy | Governs segmentation, secure configuration, and protection of our networks and network services | Annex A 8.20-8.23, 8.9 |
| P19 | Incident Management Policy | Defines how we report, triage, escalate, and learn from security incidents | Annex A 5.24-5.28, 6.8 |
| P20 | Breach Notification Policy | Defines our obligations and timelines for notifying authorities and affected parties of a data breach | Annex A 5.26; GDPR Art. 33/34 |
| P21 | Business Continuity and Disaster Recovery | Ensures botBrains can continue and recover critical services during and after disruption | Annex A 5.29, 5.30, 8.13, 8.14; Clause 8.1 |
| P22 | Supplier Management Policy | Manages information security risk across our vendors, subprocessors, and cloud providers | Annex A 5.19-5.23 |
| P23 | Responsible Disclosure Policy | Gives external researchers a safe channel to report vulnerabilities to botBrains | Annex A 5.7, 6.8, 8.8 |
| P24 | Code of Conduct | Sets ethical conduct expectations for personnel, including anti-bribery and anti-corruption | Annex A 5.4, 6.2 |
Registers
| Register | What it holds | ISO 27001 | Classification |
|---|---|---|---|
| Risk Register | Identified risks, owners, treatment decisions, and residual risk | Clauses 6.1.2, 6.1.3, 8.2, 8.3 | Confidential |
| Asset & Tool Inventory | Systems, tools, and information assets with their owners | Annex A 5.9 | Internal |
| People | Personnel records, signed NDAs, and security awareness evidence | Clauses 7.2, 7.3 | Internal |
| Suppliers (incl. Subprocessors) | Suppliers with DPA, certification, data residency, and risk rating | Annex A 5.19-5.23 | Internal |
| Exceptions & Waivers | Approved policy exceptions with justification and expiry, plus gifts and hospitality | Annex A 5.4, 5.36 | Internal |
| Corrective Actions | Nonconformities and the corrective actions that close them | Clause 10.2 | Internal |
| Incident Log | Security incidents and personal-data breaches | Annex A 5.24-5.28; GDPR Article 33 | Confidential |
| Legal Holds | Data kept beyond its retention period for legal reasons | Annex A 5.33 | Internal |
| Record of Processing Activities (RoPA) | Personal-data processing as controller and processor | Annex A 5.34; GDPR Article 30 | Internal |
| Legitimate Interest Assessments | Balancing tests for processing based on legitimate interest | Annex A 5.34; GDPR Article 6(1)(f) | Internal |
Standards and templates
Standards to follow, and forms and templates to fill in.| Document | What it covers | ISO 27001 | Classification |
|---|---|---|---|
| Secure Coding Standards | Mandatory secure coding practices for botBrains code | Annex A 8.25-8.29 | Internal |
| Security Awareness Training | Phishing and secure communication guidance for personnel | Clause 7.3; Annex A 6.3 | Internal |
| Background Check | Pre-hire screening checklist | Annex A 6.1 | Internal |
| Confidentiality Agreement | NDA template for employees and freelancers | Annex A 6.6 | Internal |
| Yearly Policy Acceptance | Form personnel sign each year to acknowledge the policies | Clause 7.3; Annex A 5.1 | Internal |
| Internal Audit Template | Checklist, findings, and sign-off form for each internal audit | Clause 9.2 | Internal |
Playbooks
Step-by-step procedures for recurring and triggered work. Each playbook names the register or record it updates.| Document | What it covers | ISO 27001 | Classification |
|---|---|---|---|
| Joiner | Onboarding a new team member | Annex A 5.16, 5.18, 6.1, 6.6 | Internal |
| Mover | Adjusting access when a person changes role | Annex A 5.18 | Internal |
| Leaver | Revoking access and recovering devices when a person leaves | Annex A 5.11, 5.18, 6.5 | Internal |
| Incident Response | Handling a reported security event | Annex A 5.5, 5.24-5.26 | Internal |
| Data Breach | Handling an incident that affects personal data | Annex A 5.26; GDPR Articles 33, 34 | Internal |
| Database Backup / Restore Test | Restoring the database and measuring RPO and RTO | Annex A 8.13 | Internal |
| Data Subject Request (DSAR) | Answering a data subject who exercises a GDPR right | Annex A 5.34; GDPR Articles 15-22 | Internal |
| Autoscaling | Responding to capacity alerts | Annex A 8.6 | Internal |
| Downtime Situations | Responding when a provider or region fails | Annex A 5.29, 5.30, 8.14 | Internal |
| Asset & Tool Inventory Discovery | Finding assets and tools missing from the inventory | Annex A 5.9 | Internal |
Evidence
Dated audits, reviews, tests, screenshots, and configuration exports that show the ISMS and its controls in operation.| Document | What it shows | ISO 27001 | Classification |
|---|---|---|---|
| Internal Audit & Management Review | Dated internal audit reports and management review minutes | Clauses 9.2, 9.3 | Internal |
| Access Reviews | Per-system review of authentication, named accounts, and VPN enforcement | Annex A 5.18, 8.5 | Confidential |
| Backup & DR Test | Dated restore and disaster recovery tests with measured RPO and RTO | Annex A 5.30, 8.13 | Internal |
| Backup & capacity evidence | Backup retention, restore results, and capacity alerts | Annex A 8.6, 8.13 | Confidential |
| Logging & monitoring evidence | Log collection, retention, alerting, and clock synchronization | Annex A 8.15-8.17 | Confidential |
| Network & firewall evidence | Firewall rules and network exposure | Annex A 8.20-8.22 | Confidential |
| Cryptography / TLS / KMS evidence | Key rotation, TLS versions, VPN, and encryption at rest | Annex A 8.24 | Confidential |