Information Security Policy
For JL PARTNERS LLC
Version: 1.0
Effective Date: April 5, 2025
1. Purpose
The purpose of this policy is to establish and maintain the security of payment card data and other sensitive information handled by JL PARTNERS LLC in compliance with the Payment Card Industry Data Security Standard (PCI DSS).
2. Scope
This policy applies to all employees, contractors, consultants, temporary staff, and other workers at JL PARTNERS LLC including all personnel who develop, maintain, or support software or solutions that may interact with payment card data.
3. Policy Requirements
3.1. Data Protection
- Cardholder data must never be stored unless absolutely required and must follow PCI DSS storage rules.
- Sensitive authentication data (e.g., full track data, CVV/CVC, PINs) must never be stored post-authorization.
- All data in transit must be encrypted using strong encryption (e.g., TLS 1.2 or higher).
3.2. Access Control
- Access to systems that store, process, or transmit cardholder data must be restricted to authorized personnel only.
- Access must be granted based on the principle of least privilege.
- All access must be logged and regularly reviewed.
3.3. Secure Software Development
- All software development must follow secure coding practices and be based on recognized frameworks (e.g., OWASP Top 10).
- Developers must receive regular security training.
- All applications must be tested for security vulnerabilities before deployment (e.g., code review, penetration testing).
3.4. Network Security
- A firewall must be implemented between internet-facing systems and internal networks.
- Network segmentation is recommended to isolate cardholder data environments (CDE).
- Anti-malware solutions must be in place and regularly updated.
3.5. Incident Response
- A documented incident response plan must be maintained and tested annually.
- All employees must be aware of how to report suspected security incidents.
3.6. Vendor Management
- Third-party service providers with access to cardholder data must be PCI DSS compliant.
- Due diligence and regular assessments of vendors must be conducted.
3.7. Policy Review
- This policy must be reviewed at least annually and after any significant changes to business or technology that may impact PCI DSS compliance.
4. Roles and Responsibilities
- CIO/CISO/Security Officer: Owns and maintains the Information Security Policy.
- Developers: Must adhere to secure coding and data protection requirements.
- IT & Security Teams: Enforce access control, encryption, and monitor compliance.
5. Acknowledgment
All personnel must read and acknowledge this policy. Records of acknowledgment must be kept.