ITO Nexus Logo
Book A Call

SECURITY AND ACCEPTABLE USE POLICY

Security and Acceptable use policy  for ITO Nexus Technologies

  1. PURPOSE AND SCOPE

This Security and Acceptable Use Policy (“Policy”) governs the use of all technology platforms, systems, services, and resources provided by ITO Nexus Technologies (“Provider”, “We”, “Us”, or “Our”) to clients (“Client”, “You”, or “Your”). This Policy is incorporated by reference into all Master Services Agreements and establishes mandatory security requirements and usage guidelines.

  1. SECURITY REQUIREMENTS

2.1 Authentication and Access Control

  • Multi-Factor Authentication (MFA) is mandatory for all administrative accounts and privileged access
  • Password Requirements: Minimum 12 characters with complexity requirements
  • Account Management: Immediate notification required for employee terminations
  • Privileged Access: Administrative access limited to authorized personnel only

2.2 Device Security Standards

  • Endpoint Protection: All devices must run approved antivirus/anti-malware solutions
  • Operating System Updates: Automatic updates enabled for security patches
  • Device Encryption: Full disk encryption required for all devices with business data
  • Mobile Device Management: Company-provided devices subject to MDM policies

2.3 Network Security

  • Firewall Requirements: Business-grade firewall with intrusion detection
  • Wi-Fi Security: WPA3 encryption minimum, guest networks isolated
  • VPN Usage: Required for remote access to business systems
  • Network Monitoring: Continuous monitoring for security threats

2.4 Data Protection

  • Data Classification: Confidential data must be properly identified and protected
  • Backup Requirements: Daily automated backups with regular restore testing
  • Data Retention: Business data retained per regulatory requirements
  • Secure Disposal: Proper sanitization of storage media before disposal
  1. FAIR USAGE STANDARDS

3.1 Platform and Resource Usage

  • Reasonable Use: Services must be used for legitimate business purposes only
  • Resource Consumption: Usage should align with business needs and plan limits
  • AI and Automation: Consumption should reflect normal business operations

3.2 Usage Monitoring and Limits

  • Automated Monitoring: Platform usage continuously monitored
  • Threshold Alerts: Notifications sent at 75% and 90% of usage limits
  • Overage Billing: Excess usage billed at published rates
  • Fair Use Violations: May result in service limitations or termination

3.3 Usage Thresholds (Monthly)

  • API Calls: Based on service tier and business requirements
  • Email/SMS Communications: Aligned with legitimate business communication
  • Storage and Compute: As defined in service agreement
  • Voice/Telephony: Normal business communication volumes
  1. PROHIBITED ACTIVITIES

4.1 Illegal and Harmful Activities

  • Illegal Content: No illegal, fraudulent, or harmful content
  • Intellectual Property: No infringement of third-party IP rights
  • Malicious Activity: No malware, viruses, or harmful code
  • Unauthorized Access: No attempts to bypass security controls

4.2 Business and Operational Restrictions

  • Spam and Abuse: No unsolicited communications or network abuse
  • Competitive Activities: No use for direct competitive activities
  • Resale Restrictions: No unauthorized resale or sublicensing
  • Mining and Excessive Computation: No cryptocurrency mining or excessive computational activities

4.3 Data and Privacy Violations

  • Privacy Violations: No collection or processing of data without proper consent
  • HIPAA/GDPR Violations: Compliance with applicable data protection laws
  • Confidentiality Breaches: No unauthorized disclosure of confidential information
  1. COMPLIANCE REQUIREMENTS

5.1 Regulatory Compliance

  • Industry Standards: Adherence to applicable industry regulations
  • Data Protection Laws: Compliance with GDPR, CCPA, HIPAA as applicable
  • Financial Regulations: SOX, PCI-DSS compliance where required
  • Documentation: Maintain compliance documentation and audit trails

5.2 Security Compliance

  • Security Frameworks: Alignment with NIST Cybersecurity Framework
  • Risk Assessments: Annual security risk assessments
  • Vulnerability Management: Prompt remediation of security vulnerabilities
  • Incident Response: Defined procedures for security incidents
  1. INCIDENT REPORTING AND RESPONSE

6.1 Security Incident Reporting

  • Immediate Notification: Security incidents reported within 24 hours
  • Contact Methods: support@itonexus.com or (509) 414-1486
  • Required Information: Description, impact, affected systems, timeline
  • Cooperation: Full cooperation with incident investigation

6.2 Data Breach Procedures

  • Breach Assessment: Immediate assessment of data breach scope
  • Regulatory Notification: Compliance with breach notification requirements
  • Client Notification: Prompt notification to affected clients
  • Remediation: Implementation of corrective measures
  1. VIOLATIONS AND ENFORCEMENT

7.1 Violation Response

  • Warning System: Progressive warnings for minor violations
  • Service Limitations: Temporary restrictions for moderate violations
  • Service Suspension: Immediate suspension for serious violations
  • Contract Termination: Termination for repeated or severe violations

7.2 Investigation Procedures

  • Investigation Rights: Provider may investigate suspected violations
  • Access Requirements: Client cooperation required for investigations
  • Evidence Preservation: Logs and evidence preserved per legal requirements
  • Legal Action: Provider reserves right to pursue legal remedies
  1. CLIENT RESPONSIBILITIES

8.1 Security Maintenance

  • User Training: Regular security awareness training for employees
  • Policy Compliance: Ensure staff compliance with security policies
  • System Maintenance: Maintain systems per Provider recommendations
  • Access Management: Proper user access management and controls

8.2 Monitoring and Reporting

  • Security Monitoring: Monitor for suspicious activities
  • Incident Reporting: Promptly report security incidents
  • Change Management: Notify Provider of significant environment changes
  • Compliance Maintenance: Maintain required compliance certifications
  1. POLICY UPDATES AND MODIFICATIONS

9.1 Policy Changes

  • Update Authority: Provider may update this Policy at any time
  • Notification Method: Website publication provides sufficient notice
  • Effective Date: Changes effective immediately upon publication
  • Continued Use: Continued service use constitutes acceptance

9.2 Version Control

  • Version Tracking: All Policy versions maintained and dated
  • Change Documentation: Significant changes documented and communicated
  • Archive Retention: Previous versions archived for legal compliance
  1. CONTACT INFORMATION

Primary Contact:

Security Incidents:

Policy Questions: