Practical safeguards, applied in proportion to risk.

1. Purpose and scope

Auxesis, LLC (“Auxesis”) maintains a risk-based information security program designed to protect the confidentiality, integrity, and availability of information and systems used in our business.

This policy applies to Auxesis personnel, contractors, company-managed information, and systems or services under Auxesis control. Client-managed environments remain subject to the client’s policies and the applicable engagement terms. Stricter legal, regulatory, or contractual requirements take precedence where they apply.

2. Governance and risk management

• Auxesis management is accountable for security risk and for approving this policy, material exceptions, and response priorities.
• Security measures are selected based on the sensitivity of information, business need, threat exposure, contractual requirements, and the cost and practicality of safeguards.
• Material systems, information, providers, and risks are reviewed when introduced or significantly changed and periodically thereafter.
• Security responsibilities are assigned to the people who operate, administer, or use the relevant systems.

3. Data minimization and handling

• Auxesis collects and retains only information reasonably needed for business, legal, contractual, or service-delivery purposes.
• Information is handled according to its sensitivity and any applicable client, legal, or contractual restrictions.
• Sensitive information may be stored or transmitted only through approved systems and shared only with authorized recipients who have a business need.
• Records are retained according to business and legal needs and securely deleted, destroyed, or de-identified when no longer required.

4. Identity and access management

• Access is granted on the principles of least privilege and need to know.
• Users must use individual accounts where systems support them and must not share passwords or authentication factors.
• Strong authentication is required, and multi-factor authentication is enabled for material business systems when supported.
• Administrative access is limited and separated from routine use where practical.
• Access is reviewed based on risk and removed promptly when no longer needed or when a working relationship ends.

5. Systems and devices

• Business systems and devices must use supported software, security updates, secure configuration, screen locking, and malware protection where appropriate.
• Portable devices used for sensitive work must use device encryption when supported and be protected against unauthorized physical access.
• Credentials and secrets must be stored using approved password, identity, or secrets-management tools rather than in public files or source code.
• Personnel must promptly report lost devices, suspected compromise, or unusual system behavior.

6. Information protection and transmission

• Auxesis uses encryption in transit for internet-facing business services and encryption at rest where supported and appropriate to the risk.
• Sensitive information is not sent through ordinary email when an approved, more secure method is required by its classification or applicable terms.
• Sharing permissions are limited to intended recipients and reviewed when the purpose for sharing ends.
• Backups or recoverable copies are maintained for business-critical information when appropriate to the system and service.

7. Service providers and supply chain

Auxesis uses third-party cloud, communications, financial, and professional services. We consider the nature of the service, information involved, provider safeguards, availability needs, and contractual protections when selecting or materially changing a provider. Providers receive only the information and access reasonably needed for their role. Additional diligence or written security terms may be required when risk, law, or a client agreement warrants them.

8. Secure development and change management

• Changes to business-critical systems and externally delivered technology must be authorized, reviewed, and tested in proportion to their risk.
• Source code and configuration are maintained with access controls and change history where appropriate.
• Software dependencies and externally sourced components are evaluated and updated based on security relevance and operational risk.
• Production secrets, client credentials, and sensitive data must not be committed to public repositories or embedded in distributable code.

9. Vulnerability, logging, and monitoring practices

• Auxesis monitors relevant security advisories and addresses identified vulnerabilities according to severity, exposure, and business impact.
• Security patches and configuration changes are prioritized based on risk, with urgent issues handled on an accelerated basis.
• Material systems use available security logging, alerts, and provider controls appropriate to the service.
• Suspected vulnerabilities must be reported responsibly and must not be exploited to access, alter, or retain information without authorization.

10. Incident response

Auxesis maintains an incident-response approach appropriate to its size and operations. Reported or detected events are assessed and, when warranted, contained, investigated, remediated, and documented. Recovery actions are prioritized according to operational and information risk. Auxesis notifies affected clients, individuals, authorities, insurers, or other parties when required by law or contract and cooperates with authorized investigations. Lessons learned are used to improve safeguards.

11. Continuity and recovery

Business-critical services and information are identified so that reasonable continuity and recovery measures can be maintained. Depending on the service, these measures may include provider redundancy, backups, restoration procedures, alternate communications, and documented dependencies. Recovery arrangements are reviewed or exercised in proportion to their importance and risk.

12. Personnel and remote work

• Personnel and contractors with access to Auxesis or client information are expected to protect it, follow applicable confidentiality obligations, and complete security guidance appropriate to their role.
• Remote work must use appropriately secured devices, accounts, networks, and work areas.
• Sensitive work must not be performed on shared or public computers, and unattended devices must be secured.
• Security responsibilities continue after an engagement or working relationship ends, as required by applicable agreements and law.

13. Client, controlled, and regulated information

Auxesis accepts client information only when the engagement, systems, and safeguards are appropriate for that information. Classified information, controlled unclassified information, export-controlled data, protected health information, payment-card data, and other specially regulated information must not be provided unless Auxesis has expressly agreed in writing to receive it and the required environment and controls have been established.

14. Exceptions and enforcement

Any exception to this policy must be documented, limited in scope and duration, supported by a business reason, and approved by Auxesis management after considering risk and compensating safeguards. Violations may result in removal of access, termination of a working relationship, contractual remedies, or other appropriate action.

15. Assurance statement

This policy describes Auxesis’s current minimum security expectations. It is not a warranty of absolute security and does not, by itself, represent that Auxesis has been independently audited, certified, or authorized under NIST, CMMC, ISO 27001, FedRAMP, NISPOM, or any other framework or government program. Engagement-specific representations must be stated in the applicable written agreement.

16. Reporting and policy review

Report a suspected security issue involving Auxesis systems or information to contact@auxesisops.com. Please provide a clear description and a safe way to contact you, but do not include secrets, exploit code, or sensitive data in the initial email.

This policy is reviewed at least annually and when material changes in operations, technology, obligations, or risk warrant an update.