This document details the regulatory framework, technical standards, and procedural controls implemented across all corporate endpoint systems, on-premise infrastructure, and cloud environments of Care Container Lines Pvt. Ltd. (CCLPL), Kolkata.
These policies enforce continuous data integrity, strict access control, and complete traceability to prevent data misuse and external cybersecurity threats — in full compliance with international AEO logistics audit standards.
Endpoint Security & Antivirus Policy
Deployment Standard
All corporate workstations, laptops, and server architectures must have Microsoft Defender for Endpoint (Enterprise Tier) permanently installed.
Real-Time Protection
Real-time engine monitoring, behavior monitoring, and cloud-delivered protection must remain active at all times. End-users are strictly barred from modifying or disabling any software module.
Centralized Console Management
All endpoints link to a cloud-based administrative security console managed exclusively by the IT Department. Local threat alerts trigger automated containment and notify the security team immediately.
Signature & Engine Updates
Anti-malware signatures and heuristic maps are configured to check for updates hourly, with automatic daily background updates enforced across all endpoints.
System Protection & Infrastructure Integrity
Secure SDLC
All proprietary applications and internal workflows must be developed under a Secure Development Life Cycle framework with vulnerability isolation scans before public staging.
Patch Management
Critical security patches for Windows/Linux systems and infrastructure hypervisors must be tested and rolled out globally within 7 days of commercial release.
Network Isolation & Firewalls
No operational software or database layer may face the public internet directly. All traffic must transit through a WAF or encrypted VPN with NGFW deep-packet filtering.
Tamper-Proof Configurations
Administrative privileges are removed from standard user profiles. Registry edits, software installations, or modification of security daemons require authenticated IT administrator credentials.
Employee Monitoring & Data Theft Prevention
- Principle of Least Privilege (PoLP): User accounts are assigned access permissions strictly mapped to documented job roles (RBAC). Cross-department database access is blocked by default.
- Data Loss Prevention (DLP): Enterprise-wide DLP policies actively monitor and block transmission of sensitive business logs, customer profiles, and financial ledgers. USB storage, personal webmails, and unapproved cloud storage are completely restricted at endpoint level.
- Immutable Auditing Trails: Every user action within core applications — including authentication attempts, data exports, record updates, and document generation — is permanently logged with immutable timestamps linked to a unique user identifier.
- User Behavior Analytics (UBA): System events are fed into a SIEM pipeline. Anomalous actions such as mass file modifications, off-hours network handshakes, or unauthorized data queries flag high-severity warnings for immediate isolation.
Audit Note: All log repositories are safely retained in a compressed, encrypted write-once-read-many (WORM) format for a statutory minimum of 3 years to facilitate retroactive digital forensics, in compliance with international logistics standards.
Malpractice & Manipulation Countermeasures
Segregation of Duties (SoD)
Critical operational and financial transactions require split authentication. No single employee can both initiate and finalize/approve an entry within core ERP systems.
Cryptographic Tracking
All state entries, administrative edits, and system inputs are digitally signed by user sessions, ensuring full accountability and complete anti-repudiation during post-incident reviews.
Periodic Privilege Re-evaluation
User operational parameters undergo quarterly internal review by IT and Management Heads. Permissions for reassigned, resigned, or inactive staff are terminated immediately upon status change.
Cloud Infrastructure & Encryption Standards
- Data-at-Rest Encryption: All server blocks, shared cloud drives, database files, and backups use industry-standard AES-256 cryptographic encryption.
- Data-in-Transit Encryption: All publicly routable network traffic must use TLS 1.3. Legacy unencrypted protocols (HTTP, FTP, Telnet) are completely disabled.
- Identity Protection & MFA: Access to enterprise cloud systems requires explicit Multi-Factor Authentication. Static credential verification alone is blocked from initializing any secure cloud session.
Attendance Management & Core On-Premise Servers
- Attendance Tracking: Workforce attendance is routed through physical biometric terminal hardware and secure proximity cards linked directly to the primary HR Management ERP database.
- Core Server Topology: Mission-critical operational databases, accounting modules, and logistics configurations are housed in a restricted, climate-controlled on-premise server room at Head Office (H.O.), Kolkata.
- Physical Server Access Controls: The H.O. server room is secured by digital locking systems, continuous video surveillance, and dual-custodian authentication. Only designated IT engineering staff are permitted physical access.
- Hybrid Cloud & Off-site Storage: Enterprise infrastructure leverages secure hybrid instances on Microsoft Azure and AWS for redundant operations, cloud application gateways, and off-site cloud backups.
| Infrastructure Element | Hosting / Location | Primary Security Control |
|---|---|---|
| Core Logistics ERP | On-Premise Server Room (H.O.) | Network Isolation, RBAC, MFA VPN |
| Attendance Database | On-Premise / Central HR Instance | Biometric Terminal Encryption, Immutable Logs |
| Cloud Operations & Mail | Hybrid Cloud (Azure / AWS) | Conditional Access Policies, Mandatory MFA |
| Disaster Recovery Backups | Geo-Redundant Cloud Storage Vault | AES-256 Encryption, Air-Gapped Snapshots |
AEO Auditor Quick Verification: This document matches the organizational objective to ensure comprehensive control over global supply-chain electronic records. For structural evidence during physical inspection, please refer to our active EDR central dashboard logs, network architectural layout blueprints, and live DLP rule configuration sets.