Information Security Management System (ISMS)
Organizational Policy Documentation · Version 1.0 · July 27, 2026
1. Information Security Policy (Clause 5)
Statement
Build Link Global (B-Link) is committed to protecting the confidentiality, integrity, and availability of its users' information and that of the organization itself, through an Information Security Management System (ISMS) aligned with the ISO/IEC 27001:2022 standard.
Security Objectives
| ID | Objective | Indicator | Target |
|---|---|---|---|
| OBJ-01 | Confidentiality of personal and payment data | # of data breaches | 0 per year |
| OBJ-02 | Integrity of transactions and contracts | Unauthorized alterations | 0 per year |
| OBJ-03 | Service availability ≥ 99.5% | Unplanned downtime | < 0.5% monthly |
| OBJ-04 | Compliance (GDPR, local laws) | Non-compliance reports | 0 per year |
| OBJ-05 | Respond to incidents ≤ 4h | Mean response time | ≤ 4 h |
Leadership Commitment
Top management will approve and review this policy semiannually, ensure necessary resources, promote a security culture, and require that security objectives be integrated into processes.
Roles and Responsibilities
| Role | Responsibilities |
|---|---|
| ISMS Sponsor (CEO) | Policy approval, resource provision, ultimate accountability. |
| ISMS Owner / CISO | Implementation, maintenance, audits, risk management. |
| Administrators | User management, verifications, disputes, logs. |
| Developers | Secure code, peer review, vulnerability reporting. |
| Customer Support | Incident handling, escalation. |
| All staff | Comply with policy, report incidents, complete training. |
2. Context of the Organization (Clause 4)
External and Internal Context
External: Construction equipment rental market. Suppliers: Stripe (payments), Google (auth, calendar), Base44 (BaaS). Regulations: GDPR, CCPA, state laws. Threats: identity fraud, payment data theft, ownership impersonation.
Internal: Small team with combined roles. React app + Base44 BaaS. Data: profiles, identity/ownership documents, GPS, photos, transactions.
Interested Parties
| Party | Security Needs |
|---|---|
| Equipment owners | Protection of personal data and ownership documents. |
| Contractors | Confidentiality of payments and projects. |
| Employees | Protection of employment data. |
| Suppliers | Compliance with terms of service. |
| Regulators | Data protection compliance. |
3. Risk Assessment & Treatment (Clause 6.1.2)
Methodology
Likelihood × Impact matrix (scale 1–5 each, total risk 1–25).
| Risk Level | Action |
|---|---|
| 1–4 (Low) | Accept and monitor |
| 5–9 (Medium) | Mitigate with controls |
| 10–16 (High) | Mandatory mitigation, quarterly review |
| 17–25 (Critical) | Immediate treatment, escalate to management |
Risk Register — Initial Inventory
| ID | Risk | Level | Treatment |
|---|---|---|---|
| R-01 | Unauthorized access via misconfigured RLS | 10 | Quarterly RLS audit |
| R-02 | Document leak via public URLs | 12 | Signed URLs / private storage |
| R-03 | Identity fraud / ownership impersonation | 9 | Manual verification + badges |
| R-04 | Admin account compromise | 10 | MFA + credential rotation |
| R-05 | Fraudulent dispute with forged evidence | 9 | GPS + timestamped photos |
| R-06 | Service unavailability (BaaS outage) | 8 | Continuity plan + backups |
| R-07 | GDPR non-compliance (no right to erasure) | 12 | Data deletion on request |
| R-08 | API abuse / brute force | 9 | Rate limiting and monitoring |
| R-09 | Data loss from human error | 8 | Backups + audit log |
| R-10 | Social engineering of staff | 8 | Training + verification protocols |
Review
Quarterly, post-incident (48 h), and after significant change (before launch).
4. Access Control Policy (A.5.15–A.5.18)
RBAC Rules
| Role | Permissions |
|---|---|
| admin | Full access: users, verifications, disputes, reports. |
| owner | Their equipment, their bookings, their disputes, their reports. |
| contractor | Search, book, review, contact owners. |
Principles
Least privilege · Separation of duties (verifier ≠ requester) · Access revocation ≤ 24 h · Admin review quarterly.
Authentication
Passwords with minimum requirements · Google OAuth · Recommended: MFA for administrators (pending).
5. Information Asset Management (A.5.9–A.5.13)
Inventory
| Category | Assets | Classification |
|---|---|---|
| Personal data | Profiles, identity documents | Confidential |
| Payment data | Payment intents, Stripe IDs | Restricted |
| Equipment data | Specs, photos, ownership documents | Confidential |
| Operational data | Bookings, inspections, GPS, contracts | Confidential |
| Source code | React app, backend functions | Restricted |
| Documentation | This policy, procedures | Internal Use |
Classification
| Level | Example | Handling |
|---|---|---|
| Public | Equipment catalog | No restriction |
| Internal Use | Internal procedures | Staff access |
| Confidential | Personal data, identity | Need-to-know, encrypted in transit |
| Restricted | API keys, payment data | Minimal access, encrypted at rest+transit, logged |
6. Incident Management (A.5.24–A.5.28)
Process
Detection → Reporting → Classification → Containment → Investigation → Eradication → Recovery → Lessons learned.
Target Times (SLA)
| Phase | SLA |
|---|---|
| Initial classification | ≤ 1 h |
| Containment | ≤ 4 h |
| Communication to affected parties | ≤ 72 h (GDPR) |
| Eradication and recovery | ≤ 24 h critical / 72 h major |
| Post-incident report | ≤ 5 business days |
Reporting Channel
security@blink.example — confidential channel, no retaliation.
7. Supplier & Third-Party Management (A.5.19–A.5.23)
Inventory
| Supplier | Service | Risk |
|---|---|---|
| Stripe | Payment processing | High |
| OAuth Auth, Calendar | Medium | |
| Base44 | BaaS platform, hosting, DB | High |
| Unsplash | Images | Low |
Assessment
Security certifications (ISO 27001, SOC 2, PCI-DSS) · Review terms/DPA · Classify data to share · Annual review.
8. Business Continuity (A.5.29–A.5.30)
Recovery Objectives
| Process | RPO | RTO |
|---|---|---|
| Rental platform | 1 hour | 4 hours |
| Payment processing | 0 (in Stripe) | 2 hours |
| User support | 4 hours | 8 hours |
| Reports & analytics | 24 hours | 48 hours |
Testing
Data recovery: semiannual · Provider outage simulation: annual.
9. Legal & Regulatory Compliance (A.5.31–A.5.34)
Data Retention Policy
| Data type | Period | Action on expiry |
|---|---|---|
| Active accounts | Indefinite | — |
| Inactive accounts | 3 years | Deletion or anonymization |
| Completed bookings | 7 years (tax) | Anonymization |
| Identity documents | Verification + 1 year | Deletion |
| Ownership documents | Active equipment + 1 year | Deletion |
| Audit logs | 2 years | Archive |
| Resolved disputes | 5 years | Anonymization |
Data Subject Rights (GDPR)
Access · Rectification · Erasure (right to be forgotten) · Portability · Objection. Response SLA: ≤ 30 days.
10. Training & Awareness (A.6.3)
| Audience | Topic | Frequency |
|---|---|---|
| New staff | Security induction | On entry |
| All staff | Phishing, passwords, data handling | Semiannual |
| Administrators | Secure user management | Annual |
| Developers | Secure code (OWASP) | Annual |
| Personal data access | Data protection (GDPR) | Annual |
11. Internal Audit (Clause 9.2)
| Type | Frequency |
|---|---|
| Full ISMS internal audit | Annual |
| Technical controls audit | Semiannual |
| Supplier audit | Annual |
| Post-incident audit | After each critical |
Impartial auditor · Findings: Major / Minor non-conformity / Observation · Corrective action plan with owner and date.
12. Continual Improvement (Clause 10)
Management review semiannual · Non-conformities and corrective actions recorded · KPIs monitored monthly · Incident lessons integrated · Suggestion channel open.
Recommended Next Steps
- Formally designate the ISMS Owner and Sponsor.
- Approve and sign this policy by top management.
- Socialize the document with all staff.
- Implement technical gaps (audit log, MFA, private documents, right to erasure).
- Schedule the first internal audit at 6 months.
- Engage external certification audit at ≈ 12 months.
13. Implemented Technical Controls
Private Signed Documents
Ownership documents are uploaded to private storage (not public) and viewed via 5-minute signed URLs, fulfilling the asset management controls of section 5 (A.5.9–A.5.13) and the access control policy of section 4 (A.5.15–A.5.18).
Audit Logging
Security-relevant actions (booking status changes, equipment status changes, verifications, payment releases, disputes) are recorded in an immutable audit log, supporting the incident management process (A.5.24–A.5.28) and internal audit requirements (Clause 9.2).
Automated Data Retention
A scheduled job anonymizes personally identifiable information (PII) and purges obsolete audit logs in accordance with the retention policy (Section 9.1), fulfilling legal and regulatory compliance obligations (A.5.31–A.5.34) and the GDPR right to erasure.
14. Acceptable Use Policy (A.5.10)
Purpose
This Acceptable Use Policy (AUP) defines the rules and responsibilities for using the B-Link platform, its information systems, and associated assets. It applies to all users, administrators, and staff who access the platform.
Acceptable Use
Users must: use only accounts assigned to them; protect their credentials and never share them; access only data they are authorized to view; use platform resources for legitimate rental business purposes; report suspected security incidents immediately to security@blink.example.
Prohibited Activities
Users must not: share passwords or access credentials; attempt to access unauthorized data; misuse equipment listings, reviews, or dispute mechanisms; upload malicious, fraudulent, or falsified content; attempt to disrupt service availability; use the platform for illegal activities; circumvent payment or verification controls.
Enforcement
Violations may result in account suspension, termination, or legal action. Administrators review violations and apply corrective measures per the incident management process (Section 6). Repeated or severe violations are escalated to the CISO.