Information Security Policy

Crowdin Information Security Policy (hereinafter the Policy) defines the objectives and basic principles of information security. Information security means implementation and maintenance of the appropriate level of its properties.

The Policies requirements apply to the entire Crowdin organization and all business processes, and are available mandatory for all employees as well as those involved in these business processes. Compliance with the requirements of the Policy is an important aspect for achieving Crowdin’s strategic goals and objectives.

Crowdin information security policy meets the requirements of ISO / IEC 27001: 2022 and DSTU ISO / IEC 27001: 2015.

This policy sets up:

• The context of the Organization
• Internal and external issues relevant to the purpose of Crowdin
• Interested parties that are relevant to the Information security management systems (hereinafter ISMS)
• The requirements of these interested parties relevant to the ISMS
• Information security objectives
• Information security policy commitments
• Responsibilities for Information Security
• Measurement

Information security processes are described, formally defined and approved, Crowdin’s guidance in the form of standards, policies, regulations and other internal regulatory documents.

Context of the organization

According to ISO, defining the context of an Organization is a “business environment”, “a combination of internal and external factors and conditions that may influence the organization’s approach to its products, services and investments and interested parties”.

Crowdin is a product company with more than 2 million user accounts.

Crowdin’s software solution empowers companies of any shape and size to accelerate their growth by reaching people who speak different languages.

Crowdin team works passionately toward a shared goal: to expand the potential of agile localization. From day one till now, Crowdin’s mission has always been to keep it simple and wow Crowdin’s customers with an outstanding user experience and the latest technology solutions.

Crowdin’s main industrial sector is Software as a service.

The purpose of the ISMS is to ensure that Crowdin is still able to meet its defined business objectives and comply with its policies in the face of potential and actual security incidents.

Policies have been set by the organization in a variety of areas and these must be taken account of during the information security planning process to ensure that they are met.

The main relevant policies are:

• Business Continuity Plan
• Information Security Management Framework
• Risk Assessment Methodology
• Risk Treatment Guideline
• Incident Response Plan
• Acceptable Use Policy
• Access Control Policy
• Clear Desk and Clear Screen Policy
• Control Against Malware Policy
• Cryptography Policy
• Human Resources Security Policy
• Information Backup Policy
• Information Classification and Labeling Policy
• IS Risk Management Policy
• Logging and Monitoring Policy
• Monitoring and evaluating the effectiveness of ISMS Policy
• Network Security Policy
• Password Policy
• Physical Security Policy
• Security in Development and Maintenance Processes Policy
• Segregation of Duties Policy
• Supplier Relationship Security Policy
• Workstation Security Policy
• Сhange Management Policy
• Communication Procedure
• Corrective and Preventive Actions Procedure
• Disciplinary procedure
• Document control procedure
• Internal Audit Procedure
• Inventory and assessment of information assets procedures
• Risk Management Procedure
• Maintaining confidentiality in the work
• Management Review Procedure
• User Access Management Procedure
• Vulnerability Management Policy
• Security in Customer Support Policy

Internal and external issues

There are a number of internal and external issues that are relevant to the purpose of Crowdin and that affect the ability of the ISMS to achieve its intended outcomes.

Internal issues:

• Adopted standards, guidelines and models
• Significant organizational changes
• Governance and organizational structure
• Contractual relationships
• Resources and knowledge (e.g. capital, people, processes and technologies)
• Relationship with staff and stakeholders, including partners and suppliers
• etc.

External issues:

• Changes in technology
• Government regulations and changes in the law
• Competition
• Economic shifts in the market
• Supply chain
• Society and culture
• Interest and inflation rate
• Data protection
• Supporting technologies and infrastructure
• Automation and artificial intelligence
• Military conflicts and political changes
• etc.

These general internal and external issues will be considered in more detail as part of the risk assessment process and will be regularly reviewed and monitored.

The interested parties that are relevant to the ISMS of Crowdin have been determined below with their individual expectations.

An interested party is defined as a person or organization that can affect, be affected by, or perceive themselves to be affected by a decision or activity.

The following are defined as interested parties that are relevant to the ISMS:

• Business Owners
• Governance
• Customers
• Suppliers and partners
• Regulatory bodies
• Customer user groups
• Emergency Services
• Employees of the Organization
• Contractors providing services to the Organization
• Competitors
• Investors
• The media
• Emergency Services
• Auditor

Interested party	Expectations	Requirement
Owners of the business	Effective information security influences the organization’s financial success	Return on capital
Governance	Organisational reputation must be protected	Documentary and practical confirmation of the implementation of ISMS
Customers, Customer user groups	The confidentiality, integrity and availability of data is secured at all times	ISMS ISO 27001 Certificate
Suppliers and partners	Adhering to agreements and payment terms	Evidence of adhering to agreements and payment terms
Regulatory bodies	The activities of the Organization comply with current legislation	Official confirmation of legal requirements (reports, certificates, etc.)
Employees of the Organization	Personal data security, social welfare benefits, appropriate remuneration, training & support, safe working environment etc.	Legislative documents and regulations, NDA terms & conditions, clear instructions on how to handle sensitive data etc.
Contractors providing services to the Organization	Adhering to agreements and payment terms; Personal data security, social welfare benefits, appropriate remuneration	Evidence of adhering to agreements and payment terms; Legislative documents and regulations, NDA, clear instructions on how to handle sensitive data etc.
Competitors	The Organization responding to rival marketing campaigns with its own initiatives and set prices competitively	Results of market monitoring
Investors	Profitability, expected return on investment	Return on investment, Financial Statements
The media	Transparency regarding security incidents	Coverage of data breaches and a wider public interest in the way organisations protect personal information
Auditors	Expect that a proportionate level of security controls are in place at all times to protect assets	Documentary and practical confirmation of the implementation of ISMS
Emergency Services	Safe working environment etc.	Fire Safety, First aid provision etc.

Information security objectives:

• Ensure compliance with the requirements of ISO / IEC 27001: 2022 which will allow Crowdin to be a certified company and trusted supplier for its customers. (View Certificate). Ensure compliance with relevant laws, regulations (legislation of Estonia, Ukraine), contractual agreements, and organizational policies related to information security.
• Ensure the availability, integrity and confidentiality of both customer and employee data, confidentiality of internal business processes.
• Continuously reduce risks within the organization’s ISMS.
• Prevent or minimize potential IS incident damage.

This strategic objectives are supported by annual KPIs, described in more detail in the ISMS-PL-Monitoring and evaluating the effectiveness of ISMS Policy policy:

• Availability time of the service (>99,95% yearly)
• Data confidentiality incidents count (goal: 0)
• Data integrity incidents count (goal: 0)
• Physical security incidents count (goal: 0)
• Prioritized issues to be fixed immediately (goal: <100)
• Vulnerabilities count found during pentest (security level: strong or very strong)
• Vulnerabilities count found via reporting program (goal: no critical reports)
• Planned ISMS tasks done in previous period (goal: 100%)
• Quantity of unsuccessful or defective system updates (goal <25)
• Active risks distribution (decrease or increase of identified risks number) (goal <10 risks classified as very high)
• Phishing testing: percentage of compromised users (goal: 0%)

What will be done

Current policies, processes, and security measures will be continuously reviewed. Any gaps in alignment with ISO/IEC 27001:2022 standards will be identified and addressed.

A proactive risk management strategy will be maintained. This strategy includes conducting regular risk assessments, vulnerability scans, and security audits. Identified risks will be analyzed, and continuous mitigation measures will be implemented.

What resources will be required

• Professionals with expertise in information security, data protection, and risk management.
• Security technologies, including secure data storage solutions, device management solutions, encryption technologies, vulnerability assessment tools.
• Skilled auditors and analysts to assess the effectiveness of implemented security measures and identify areas for improvement.
• Access to up-to-date threat intelligence sources
• Adequate budget allocation to support investments in security technologies, personnel, training programs, and processes improvements.

Who will be responsible

The ISMS Committee has the final responsibility for Information Security Risks across Crowdin.

Detailed information about the functions, regulation, duties and responsibilities of the ISMS Committee is in the Regulation on ISMS Committee.

Managers/Head of Departments are responsible for information security within their departments/teams. They must ensure that the department/team has communicated their own informational security needs to the CISO.

CISO is clearly accountable for the provision of appropriate, timely advice to the management to ensure that an effective information risk management framework is implemented, operated and maintained in alignment with the business strategy, the business and the legal requirements.

All personnel, regardless of function, level and role, shall have explicit personal responsibilities for Information Security Management.

Responsibilities are described in detail in the ISMS-FR-Information Security Management Framework, and in other corresponding policies.

When it will be completed

Continuous monitoring and improvement of ISMS will be an ongoing task to maintain compliance.

Regular risk assessments and mitigation activities will be scheduled periodically. Vulnerability assessments will be conducted regularly as part of the organization’s ongoing security practices. Proactive measures will be implemented immediately upon identification of vulnerabilities to ensure continuous protection.

The Incident Response Plan is annually reviewed, updated and tested to ensure its effectiveness in minimizing potential damage in the event of a security incident.

How the results will be evaluated

Systems, processes and activities that can be monitored in the ISMS include, but are not limited to:

• Audit;
• Risk assessment process;
• Risk management of third parties;
• Business continuity management;
• The maturity of implementation of ISMS processes;
• Incident management;
• Vulnerability management;
• Configuration management;
• Training and level of awareness raising activities;
• Access control, firewall and other event logs;
• Management of physical and environmental safety; and
• System monitoring.

The organization’s compliance with ISO/IEC 27001:2022 is evaluated through internal audit, management review, ISMS committee meetings. Annual external audits conducted by certification bodies will further validate our compliance status.

Key performance indicators defined will be closely monitored. Any security breaches or incidents will trigger immediate investigation and corrective action to ensure the security of customer and employee data, as well as our internal business processes.

Monitoring and evaluating the effectiveness of ISMS processes is described in the ISMS-PL-Monitoring and evaluating the effectiveness of ISMS Policy.