Information security is an essential component of business continuity, operational resilience and client confidence.
At VeroMinds, we recognize that our consulting, technology advisory, data management, business transformation and implementation governance engagements may involve access to confidential business information, personal data, operational records and technology environments.
We are committed to handling such information responsibly and promoting appropriate security practices throughout our business activities and client engagements.
This Information Security & Incident Management Overview outlines our security principles, governance approach and response philosophy.
1. Our Information Security Commitment
VeroMinds seeks to protect information based on three fundamental principles:
Confidentiality
Ensuring that information is accessible only to authorized individuals and entities.
Integrity
Maintaining the accuracy, completeness and reliability of information and preventing unauthorized modification.
Availability
Supporting the availability of information and systems required for authorized business operations.
Our information security approach is guided by risk awareness, accountability, access discipline, confidentiality and continuous improvement.
2. Information Security Governance
Information security is treated as a business responsibility and not merely a technology function.
Our governance approach considers:
Identification of information assets and associated risks.
Appropriate classification and handling of information.
Defined responsibilities for authorized personnel.
Access management and confidentiality obligations.
Assessment of relevant technology and service providers.
Incident identification, escalation and response.
Business continuity and recovery considerations.
Periodic review of relevant security practices.
Security expectations may be further defined through client agreements, project-specific requirements and applicable contractual obligations.
3. Access Control and Information Handling
Access to information should be based on business necessity and authorized responsibilities.
Our approach promotes:
Need-to-know access principles.
Appropriate user authorization.
Protection of authentication credentials.
Restrictions on unauthorized sharing or downloading.
Secure handling of documents and electronic records.
Removal or modification of access when roles or engagement requirements change.
Appropriate confidentiality obligations for personnel and authorized third parties.
Client access arrangements and security requirements will be considered based on the systems and environments involved in each engagement.
4. Data Security and Protection Measures
VeroMinds seeks to apply safeguards appropriate to the nature, sensitivity and risk associated with information handled during an engagement.
Depending on the service environment and applicable requirements, these may include:
Appropriate access restrictions and authentication.
Secure information transfer mechanisms.
Protection of stored electronic records.
System and endpoint security measures.
Backup and recovery arrangements.
Appropriate logging and monitoring.
Confidentiality and personnel awareness measures.
Secure retention and disposal practices.
Specific technical controls, security configurations and infrastructure arrangements will depend on the relevant systems, service providers and contractual requirements.
5. Third-Party and Technology Risk Management
External technology providers, cloud platforms, software vendors, implementation partners and subcontractors may form part of our service delivery ecosystem.
VeroMinds recognizes the importance of evaluating relevant third-party risks before granting access to client information or integrating external services into an engagement.
Our assessment approach may consider:
Vendor reputation and service capability.
Security and privacy practices.
Data hosting and processing arrangements.
Access and authentication controls.
Subcontracting and onward disclosure.
Incident notification arrangements.
Data retention and deletion.
Business continuity and service availability.
Contractual confidentiality and data protection commitments.
Third-party involvement in client engagements is subject to applicable authorizations and contractual arrangements.
6. AI and Technology Security
As organizations increasingly adopt AI, automation, cloud applications and integrated business platforms, security governance must extend to these environments.
VeroMinds promotes appropriate assessment of:
AI and technology platform security.
Data access and usage permissions.
Confidentiality and information-sharing restrictions.
Vendor data retention and processing practices.
Model-training and data-reuse arrangements.
Integration and API access risks.
User access and privilege management.
Output validation and human oversight.
Client confidential information and personal data should not be shared with public or unapproved AI platforms without appropriate authorization and safeguards.
Our Responsible AI & Data Governance Policy provides further details of our approach.
7. Incident Management Framework
Despite preventive measures, information security incidents may occur.
VeroMinds recognizes the importance of identifying, assessing, containing and responding to incidents in a timely and structured manner.
An incident may include:
Suspected or confirmed unauthorized access.
Loss or theft of devices or information.
Unauthorized disclosure of confidential information.
Malware or ransomware activity.
Phishing or credential compromise.
Accidental deletion or alteration of information.
Unauthorized use of client data.
Security incidents involving third-party service providers.
Disruption or compromise of relevant business systems.
All suspected incidents should be escalated through the appropriate internal or client communication channels.
8. Incident Response Lifecycle
Our incident response approach is structured around the following stages.
Stage 1 – Identification and Reporting
Identify suspected or confirmed incidents through personnel reporting, system alerts, client communications or other relevant channels.
Stage 2 – Initial Assessment
Assess the nature of the incident, affected information or systems, potential impact and urgency.
Stage 3 – Containment
Initiate appropriate measures to limit further exposure, unauthorized access, damage or disruption.
Stage 4 – Investigation and Remediation
Investigate the incident, determine the likely cause and scope, and coordinate corrective measures.
Stage 5 – Notification and Coordination
Inform affected clients, relevant stakeholders and competent authorities where required by applicable law or contractual commitments.
Stage 6 – Recovery
Support restoration of affected services, information or operational activities, as appropriate to the incident and the agreed responsibilities.
Stage 7 – Review and Prevention
Document relevant findings, assess root causes and identify corrective and preventive actions to reduce the likelihood of recurrence.
9. Client Notification and Coordination
Where an incident affects client information, systems or services, VeroMinds will coordinate with the relevant client in accordance with the applicable contractual arrangements and legal requirements.
Depending on the incident, relevant communications may cover:
Nature and general description of the incident.
Known or suspected affected information or systems.
Potential business or operational impact.
Containment and corrective actions initiated.
Recommended actions for affected stakeholders.
Further investigation and remediation updates.
Where VeroMinds acts as a data processor or service provider, notification and cooperation obligations will be governed by the applicable Data Processing Agreement and other relevant contractual provisions.
VeroMinds will also consider applicable statutory reporting obligations and timelines. Contractual coordination will not be treated as a substitute for any independent legal reporting obligation applicable to a party.
10. Business Continuity and Recovery
Information security and incident management are closely connected with business continuity.
VeroMinds recognizes the importance of preparing for disruptions that may affect information availability, systems, technology platforms or service delivery.
Our approach encourages consideration of:
Identification of critical business processes.
Assessment of operational dependencies.
Appropriate information backup and recovery arrangements.
Alternate service delivery mechanisms, where feasible.
Communication and escalation procedures.
Recovery priorities and responsibilities.
Coordination with relevant technology and service providers.
Specific recovery arrangements and service commitments will be defined according to the engagement scope and contractual requirements.
11. Personnel Awareness and Accountability
Information security is a shared responsibility.
VeroMinds promotes awareness of confidentiality, responsible technology usage and secure information handling among individuals involved in its business activities and client engagements.
Personnel and authorized service providers are expected to:
Handle information responsibly.
Follow applicable access and confidentiality requirements.
Avoid unauthorized disclosure or external sharing.
Use approved systems and communication channels.
Report suspected security incidents promptly.
Follow applicable client-specific security instructions.
Protect credentials and access information.
12. Compliance and Regulatory Considerations
VeroMinds seeks to consider applicable information security, privacy and cybersecurity requirements relevant to its business and client engagements.
These may include:
Information Technology Act, 2000 and applicable rules.
Digital Personal Data Protection Act, 2023 and applicable rules.
CERT-In directions and applicable cybersecurity requirements.
Relevant contractual and sector-specific security obligations.
Applicable international requirements where relevant to client engagements.
The specific obligations will depend on the nature of the services, the parties' roles, the systems involved and the applicable legal framework.
13. Continuous Improvement
Information security is not a one-time activity.
VeroMinds seeks to strengthen its security and incident management practices in response to evolving business risks, technology developments, client expectations and regulatory requirements.
Our approach encourages periodic review of relevant risks, safeguards, third-party dependencies, incident learnings and corrective actions.
Our Commitment
Security is not just about protecting systems. It is about protecting business continuity, information integrity and client trust.
At VeroMinds, we approach information security as an integral part of responsible business operations and technology governance.
For information security, data protection or incident-related inquiries, please contact:
VeroMinds Private Limited
Email: compliance@verominds.in
Email: privacy@verominds.in
Address: #55, 3rd Cross, 3rd Main Road, VHBCS Layout, Mahalakshmipuram, Bengaluru, Karnataka – 560086.