Security Awareness Policy¶
| Field | Value |
|---|---|
| Status | draft |
| Owner | DIR |
| Applies to | The operator and every future contributor (employee or contractor) with access to Partile systems or data. |
| Review cadence | Annual; plus onboarding of each new contributor. |
| Mapped controls | GOV-01 (governance/people); supports access-control, acceptable-use, and incident-response policies. |
| Evidence | This policy; ../procedures/onboarding-offboarding-procedure.md; acknowledgement records (Tier 2 — restricted, when contributors exist). |
| Exception handling | A contributor who cannot complete awareness onboarding gets scoped/limited access until they do. |
Purpose¶
Keep the people with access to Partile security-aware, sized honestly for a single-operator company today, with a clear path that activates as the team grows.
Current honest state¶
Partile is operated by one person; there is no team to train yet. This policy sets the baseline so that the first hire triggers real awareness onboarding rather than a retrofit. The operator already practises the core behaviours (no secrets in repo, reviewed PRs, minimization).
Awareness baseline (every contributor)¶
On joining and annually thereafter, each contributor:
- Reads the
information-security-policy.md,acceptable-use-and-device- policy.md, anddata-classification-and-handling-policy.md, and acknowledges them (record kept Tier 2). - Understands the two-tier rule — what may never enter Git (secrets, real PII, Tier-2 records).
- Can recognize and report a security incident, and knows the
incident-response-policy.mdreporting path. - Is briefed on the threats most relevant to Partile: phishing/credential theft (the LinkedIn-anchored identity is a target), social engineering, and the physical-safety dimension of a stranger-matching product.
Role-specific awareness¶
- INFRA/MOBILE: secure-development patterns (
secure-development-policy.md) — authorize-in-SQL, whitelist input, no IDOR, no secrets in code. - OPS: Secret Manager, private GCP data-plane isolation, Cloudflare token handling, production preflight gates.
- DIR/COUNSEL: breach-notification clock and the counsel-queue hand-off.
Reinforcement¶
Security is reinforced in-flow rather than via annual theatre: the per-PR control-register upkeep rule, the release-review secret scan, and incident post-mortems are the live awareness mechanisms.
Exceptions¶
A contributor needing access before completing awareness onboarding receives scoped, supervised access only, recorded by DIR, until onboarding is complete.