Ivan Carlos Consulting, as a technical and strategic operation of information technology resources offered to its clients, adopts the following rules and specifications to ensure that mitigating measures are taken in case of unavailability, abrupt contract termination, or force majeure incidents:
- Essential infrastructure services must always be contracted directly by the client, with the consulting firm providing the applicable technical, operational, or security support for the delivery of services.
- The client must always have access with permissions equal to or higher than those of the consulting firm, which can be granted with the authority to generate new equivalent accesses for use by the client or another technology consulting firm.
- Examples of essential infrastructure services:
- software licensing for core activities
- internet connection service
- email and collaboration service
- IaaS model service
- domain registrar service
- IP telephony service
- finance, management, or production systems
- Secondary impact services that are not part of the essential service types described in item (1) should be transitioned to another information technology consulting company as a mitigating measure.
- The consulting firm holds elevated access to secondary impact services; the client may request access to the environment when possible.
- Examples of secondary impact services:
- transactional message dispatch
- virtual server hosting
- various monitoring services
- backup service
- DNS zone services
- tokens for form validation
- For this policy, the following contacts have been designated for initiating mitigating actions:
- IT consulting partner: vCard available soon
- Contacts for access credentials: vCard available soon
Please note that the mitigating action of the risk mitigation policy should only be triggered in the event of a complete breakdown of access and communication channels, preventing the consulting firm from providing a planned and impact-free data transition method. Improper use of the mitigating action increases the risk of security impact, business impact, and financial impact to the company initiating the action.