Information Security at ICL | Certified Data Protection

Information security is always a top priority at ICL. We incorporate best practices in all facets of our security program to maintain the integrity and security of our systems, networks, and data. We are vigilant in our efforts to monitor and manage our information systems and work to continuously improve our security posture.

Certifications and Compliance

ICL is ISO/IEC 27001:2022 certified and is regularly audited by independent third-party firms.

ICL is ISO 9001:2015 certified and is regularly audited by independent third-party firms.

ICL is a registered TISAX (Trusted Information Security Assessment Exchange) Participant. Assessment results are available on the ENX portal at https://enx.com/tisax.

Infrastructure Security

Our cloud-based architecture leverages AWS tools and infrastructure to build highly secure, scalable, and hardened environments to ensure the applications our customers rely on are available.

Data exchanged with our applications is encrypted in-transit and at rest, ensuring the confidentiality of customer data.

Environments are configured for redundancy, and coupled with RDS snapshots, allow us to meet the RTO (Recovery Time Objective) and RPO (Recovery Point Objective) requirements of our customers.

Environments are monitored by dedicated IT and security resources. System alerts and SIEM (Security Information and Event Management) dashboards provide early visibility to suspicious or anomalous events.

Access to internal networks is only allowed through a secure VPN connection that requires two-factor authentication (2FA).

Regular third-party penetration testing is performed by a reputable cybersecurity firm.

Vulnerability and patch management processes ensure that known vulnerabilities are addressed quickly.

Security in People and Process

Our security program extends beyond technology solutions and includes:

A formal risk management process, where risks are identified, evaluated, prioritized, and addressed.
Role-based access controls applied with the principle of least privilege.
Required security awareness training for all employees.
Security controls that are built into operational activities and scheduled user access reviews to ensure only authorized users have access to systems and applications.
Security policies are formally documented and maintained, with senior and executive management involved in the review and approval process.