1. Purpose
Make security responsibilities clear throughout a person’s work with Moogul, from joining to changing roles or leaving. Personnel must understand how to protect confidential information, use systems safely, and report concerns. This policy supports the Information Security Policy.
2. Scope
This policy applies to founders, full-time and part-time employees, interns, and contractors. Vendor personnel with access to Moogul information or systems must meet equivalent relevant requirements through their agreements and access conditions.
3. Joining, Changing Roles, And Leaving
Before access, the CEO or responsible manager must confirm suitability for the role, agree confidentiality obligations, and obtain acknowledgment of the applicable security policies. Access must follow the Access Control Policy.
On a role change or departure, the responsible manager must arrange immediate removal of access that is no longer authorized, return of company equipment, and return or secure removal of company information from personal devices and accounts. Retain a completion record and preserve records subject to legal retention obligations.
4. Security Awareness Training
All personnel must complete security awareness training during onboarding, before receiving sensitive access, and at least annually while working with Moogul. Training may be a documented briefing appropriate to the person’s role; it must cover phishing, MFA, secrets, device security, customer-data handling, safe AI use, and incident reporting.
Record completion, acknowledgment, and confirmation of understanding. Provide additional guidance after material policy changes, relevant incidents, or changes in responsibilities. The CEO ensures the training is assigned and completed, with support from the Security Review Team.
5. Performance Reviews
Employees and their managers must complete an annual performance review that includes security responsibilities, adherence to policies, and any training or corrective actions needed. Both participants must acknowledge and date the review; keep it in restricted personnel records.
The CEO reviews contractors’ security responsibilities when their role or engagement changes and at least annually for continuing engagements. Until a separate manager is designated, the CEO handles management duties and records an annual review of their own security responsibilities and outstanding actions.
6. Roles And Responsibilities
- CEO: Accountable for this policy, confidentiality arrangements, training completion, and personnel review records; may designate a responsible manager.
- Security Review Team: Reviews training needs and security findings with engineering, product, and operations; supports implementation and follow-up.
- Managers and engagement owners: Explain role-specific duties, conduct reviews, and coordinate access changes and departures.
- All personnel: Follow applicable policies, complete training, protect devices and information, and immediately report suspected incidents to [email protected] or directly to the CEO.
Policy review, exceptions, and enforcement follow the parent Information Security Policy. Keep personnel records restricted; link completion evidence rather than copying private review content into shared security documents.