Version: 1.2
Last Amendment:

November 2023

Next Review:

November 2024

Keywords' Information Security& Privacy Frameworks

Department:

Information Security
Contact:

infosec@keywordsstudios.com
To be read in conjunction with:

CONFIDENTIAL AND PROPRIETARYEXECUTIVE SUMMARY
1. For any business travel, reason should prevail. People should manage their bookings and expenses as if it was
their own money.
2. We shouldn’t travel if we don’t need to: that’s better for our finances and that’s better for the planet.
3. Where the Navan platform is available, its usage to manage travel and hotel bookings will be mandatory.
4. Seat reservation options can be flexible depending on your band in the Group, but by default, we should always
try to limit ourselves to economy classes.
5. All travel and expenses need to be approved by your manager. Please do so ahead of booking a new trip.
6. All exceptions to this policy should be approved by an ExCo member.

Document Title

Keywords' Information Security &Privacy Frameworks

Document No.

Versionn/a1.2

Last Revision Date

Nov 2023

Page 1 of 4

Document History
DateVersionDescrip�onAuthor

Dec 2021

1.0

Publica�on date

Infosec

Nov 2023

1.1

Design updated

EkaterinaUs�na

Nov 2023

1.2

Minor updates

Alec Barea

CONFIDENTIAL AND PROPRIETARY - Proprietary notes apply. Printed documents are subject to change. Verify correct revision before use.

PROPRIETARY NOTE: This document contains information proprietary to Keywords Int’l. Any disclosure or use is expressly prohibited, except upon explicit written permission.

Document Title

Keywords' Information Security &Privacy Frameworks

Document No.

Versionn/a

1.2

Last Revision Date

Nov 2023

Page 2 of 4

Table of Contents
1.

SUMMARY ....................................................................................................................................................................... 3

2.

THE GLOBAL INFORMATION SECURITY & PRIVACY TEAM ............................................................................................... 3

3.

THE INFORMATION SECURITY & PRIVACY FRAMEWORKS .............................................................................................. 3

4.

COMPLIANCE CHECKS ..................................................................................................................................................... 4

CONFIDENTIAL AND PROPRIETARY - Proprietary notes apply. Printed documents are subject to change. Verify correct revision before use.

PROPRIETARY NOTE: This document contains information proprietary to Keywords Int’l. Any disclosure or use is expressly prohibited, except upon explicit written permission.

Document Title

Keywords' Information Security &Privacy Frameworks

1.

Document No.

Versionn/a

1.2

Last Revision Date

Nov 2023

Page 3 of 4SUMMARY
Keywords information Security Program is managed by the Global Information Security & Privacy department, to ensure on goingprotection and monitoring of Keywords globally. This dedicated organization is managed by the Global Information Security
Director who reports to the Chief Digital Information Officer.

2.

THE GLOBAL INFORMATION SECURITY & PRIVACY TEAM
The team is composed of experienced information security professionals with local presence in North America, Europe and Asia.
The department develops and implements state-of-the art security capabilities to protect the corporation from risks related tocybersecurity. This includes:
••
••••

3.

Managing the Security & Privacy framework
Monitoring of Keywords Studios’ information systems and infrastructure
Security & Privacy incident management
Raising employee awareness
Client Security & Privacy assessments
Testing of internal privacy and security controls

THE INFORMATION SECURITY & PRIVACY FRAMEWORKS
Information security and Privacy policies are based on the NIST Cyber Security Framework and the NIST Privacy Framework.
The global Information Security & Privacy framework is made of policies, guidelines and procedures, covering industry bestpractices. All studios must adhere to this framework.
It covers topics such as:••••••••••••••••••••••

General Ownership and Usage
User Accountability and Responsibility
Access Management
Information Classification and Protection
Device Protection
Email and Internet Use
Social Media and Other Platform Use
Monitoring
Incident Reporting
Asset Management
Access Management
Operations Security
Information Protection
Logging and Monitoring
Personnel Security
Incident ManagementBusiness Continuity & Disaster Recovery
Cyber Risk Management
Third-Party and Cloud Security
Physical and Environmental Security
Data breaches
Data protection
CONFIDENTIAL AND PROPRIETARY - Proprietary notes apply. Printed documents are subject to change. Verify correct revision before use.

PROPRIETARY NOTE: This document contains information proprietary to Keywords Int’l. Any disclosure or use is expressly prohibited, except upon explicit written permission.

Document Title

Keywords' Information Security &Privacy Frameworks

4.

Document No.

Versionn/a

1.2

Last Revision Date

Nov 2023

Page 4 of 4COMPLIANCE CHECKS
The framework incorporates compliance checks to ensure studios meet the Keywords standard security posture.
Supplementary penetration tests are executed as necessary, in addition to compliance assessments performed by 3rd parties on
an ongoing basis.
In addition to the Keywords Studios’ internal security processes, external clients assess our security posture on a regular basis at
a rate of over 150 times per year.
Several studios hold and maintain, or are in the process of acquiring, information security and privacy related certifications,including, but not limited to: Trusted Partner Network (TPN), Supplier Security and Privacy Assurance (SSPA), PCI-DSS, ISO 27001,SOC-2, NP3.

End of document.

CONFIDENTIAL AND PROPRIETARY - Proprietary notes apply. Printed documents are subject to change. Verify correct revision before use.

PROPRIETARY NOTE: This document contains information proprietary to Keywords Int’l. Any disclosure or use is expressly prohibited, except upon explicit written permission.