Licensed and Regulated by the Central Bank of Kenya Read More
HomeProductsPlatformDevelopersWho We ServeBlogCompany
Information Security policy


1. PURPOSE

The purpose of this Information Security Policy is to ensure the confidentiality, integrity, and availability of Zamupay's information systems, data, and network infrastructure. This document outlines the principles, policies, and procedures designed to safeguard information assets from internal and external threats.

The policy is intended to:

  • Protect customer cardholder data island maintaining confidentiality, availability and integrity.
  • Establish a consistent approach to managing information security.
  • Reduce business risk and ensure continuity of operations.
  • Comply with legal, regulatory, and contractual obligations.

2. SCOPE

This policy applies to all employees of Zamupay, including full-time, part-time, and contract workers. It also covers third-party vendors, partners, and service providers with access to Zamupay's systems.

It applies to all data processing systems, including cloud-based infrastructure, on-premise systems, mobile applications, APIs, and databases that handle sensitive information. This policy also covers physical, logical, and network access to information assets.

3. CYBERSECURITY OBJECTIVES

Zamupay’s Cyber Security objectives include but not limited to the following:

  1. To protect the confidentiality, integrity, and availability of Zamupay’s Technology resources (such as storage, communication links, file systems, servers, networking devices and all services) from threats like unauthorized access, malicious actions and attacks, and to detect unauthorized use of network resources and technology systems.
  2. To ensure that only authorized persons are granted access to Zamupay’s information, IT systems and network resources.
  3. To ensure that all employees and third-parties understand their responsibilities with regards to information security.
  4. To ensure that third party individuals and entities deliver services in a way that meets Zamupay’s minimum cyber security requirements and as guided by the Third-party management policy.
  5. To ensure compliance with Central Bank of Kenya cybersecurity guidelines, data protection and privacy requirements as described in relevant legislation, regulations, and contractual clauses.
  6. To implement a consistent and effective process for the reporting, resolving and closure of cyber/information security incidents to minimize risk to information assets and according to the Incident Management Policy.
  7. To ensure that information security requirements are identified and agreed upon before development and/or during maintenance of existing systems based on Technical and Operations procedures in Zamupay.
  8. To ensure that information security risks to Zamupay’s business are identified, assessed and treated invariably across the organization.

4. GENERAL CYBER SECURITY POLICIES

  1. The Information Security team shall communicate Zamupay’s cybersecurity requirements and awareness training through emails at regular intervals and at the discretion of the Management to all staff and, where necessary, specific staff.
  2. It is the responsibility of each Zamupay system/service user to ensure prudent and responsible use of the allocated computing device/equipment, network resources and authorized access.
  3. Zamupay prohibits the use of applications bought from the dark web or unauthorized websites on its platform or assets. Therefore, all staff are to confirm with the Support Lead and the Information Security team where they have questions or are in doubt about an application observed on their assets.
  4. Zamupay’s personnel are prohibited from installing any software that can compromise, undermine, remove, or otherwise modify any information security controls for the purpose of bypassing, avoiding, or defeating any restrictions, filtering, monitoring, or other security controls Zamupay may have in place. Uninstalling or suspending any security tool without written approval from the Security and Compliance officer is prohibited.
  5. All Zamupay personnel with access to any Zamupay assets or resources are expected to comply with the respective acceptable use policy in the use of information created, stored, transmitted, or disposed of in the course of their job duties, regardless of the medium in which that information is maintained.
  6. Zamupay personnel are prohibited from actively attempting to circumvent, beat, tamper or subvert any of the information systems security controls in place without written approval from the Security and Compliance officer.
  7. In case of an observed, suspected or confirmed security breach, all employees must escalate the issue immediately and directly to the Information Security Team in writing, through the dedicated security communication channels and adhere to the incident response actions detailed in the Incident Management Policy.
  8. Altering, deleting or formatting of data in any company asset without written approval from both the Head of Technology and the Security and Compliance Officer is prohibited, regardless of any intention, which includes confirmed security breach.
  9. Zamupay’s internet resources are only used for work delivery and in support of work delivery, such as accessing work, relevant work study, and research material.
  10. All changes to technology infrastructure assets (these include network and system configurations/changes) must be authorized, made traceable, documented and labelled using a version control mechanism by all staff, as per the Change Management Policy.
  11. All user access to any company asset or resources must be granted in writing following the approved access management process communicated to all staff. The access requests must be approved in writing by the Line Manager and the Security and Compliance officer. Any access acquired without going through the due access management process shall be deemed as unauthorized access and tantamount to a system breach.
  12. Zamupay’s staff are prohibited from sharing passwords and using generic usernames that conceal user identity. All staff must use their allocated user identity and passwords at all times for accountability purposes.
  13. All cybersecurity and information security training are mandatory. Failure to complete successfully any cyber security training without written approval from the Security and Compliance Officer is a breach of this policy and might lead to specific user access suspension after expiry of the training.
  14. Zamupay has CCTV video surveillance at different locations within its office premises for security purposes.

5. DATA CLASSIFICATION

5.1. Information Sensitivity Classifications

All information will be handled in accordance with our internal classification standards, categorized in reference to the Data Protection Act of Kenya 2019.

  • Public data –This refers to the information that is freely available and is not linked to an identifiable individual. Information is approved for open sharing. Unauthorized access or changes pose little to no risk to Zamupay. This includes the company’s published reports.
  • Personal data – This refers to any data that identifies or could identify a natural person. This includes name, ID number, phone number, email. The individual's consent is required to allow holding and processing of this data.
  • Sensitive Personal Data – This refers to any high risk personal data requiring strict protection. This includes highly sensitive data such as cardholder information or financial transaction records. Unauthorized access, modification, or destruction could cause serious risk to Zamupay. Access is granted only upon request and approval by the Security and Compliance Officer, who also conducts the risk assessment. This is regulated through strict access control, encryption and audit logging.
  • Confidential Business Data - Internal business information not covered by Data Protection Act but still considered sensitive. This is regulated through internal controls and company policies.
  • Internal: Data that is not intended for public release but is less sensitive. This includes internal communications or standard procedures. Access is limited to staff and secured with basic protective controls.

In instances where the internal data classification defined in this policy conflicts with the definitions or requirements outlined in the Kenya Data Protection Act, 2019, the provisions of the Act shall take precedence.

6. GENERAL CARD DATA SECURITY POLICIES

Zamupay will process and transmit, but not store, cardholder data within its operations. The cardholder data handled by the organization for the purpose of its payment processing activities.

These operations involve system components, servers, and applications that interact with cardholder data, specifically:

  • Primary Account Number (PAN)
  • Cardholder Name
  • Card Expiry Date

Zamupay explicitly DOES NOT store any Sensitive Authentication Data (SAD), such as:

  • CVV/CVV2
  • PIN data
  • Track 1/Track 2 magnetic stripe data

All employees and third-party entities must inform their Line Manager and Security and Compliance Officer if they are aware of observed, suspected, or successful fraudulent use of account data.

An internal formal risk assessment of all systems, processes and procedures relating to the protection of cardholder data must be conducted at least annually.

All system, device logs and alerts must be actively monitored and analysed (via automated or manual process) within intervals not exceeding 12 hours to ensure early detection, prevention,and mitigation of information security compromises.

All system and device audit logs must be constantly replicated and backed up on a centralised log server such as a Security Incidents and Events Management solution with archiving features.

7. ROLES AND RESPONSIBILITIES.

All Employees

  1. All Zamupay employees share the responsibility of protecting the company’s information assets.
  2. All Zamupay employees are required to carefully read and uphold the guidelines defined in this information security policy.
  3. All Zamupay employees must read and understand this policy, and where something in this policy is not clear, seek guidance in writing from the Information Security Team before executing any task for Zamupay.

Security and Compliance Officer

The Security and Compliance officer has the responsibility of ensuring that this Cyber Security Policy is successfully implemented by:

  1. Creating awareness of the policy’s existence annually and at all staff inductions. 2. Steering conformance to the policy requirements.
  2. Ensuring continuous integration of the information security management systems requirements into all Zamupay processes.
  3. Ensuring adequate security controls and recommending the required resources for the successful implementation of this Information Security Policy.
  4. Obtain relevant access on all systems for periodic reviews and spot security audits to ensure security is maintained at all times.
  5. Communicating with Senior Management about security-related industry trends.

Heads of Departments

  1. The Head of Departments are responsible for creating awareness and enforcing compliance to this Information Security Policy within their departments and to the different third parties, vendors and service providers working directly under their supervision.
  2. Head of Departments are responsible for continuous fine tuning of this Information Security Policy to ensure adequate internal security controls.
  3. Head of Departments are responsible for creating guidelines concerning department-specific use of network systems.

Human Resources

    The Head of Human Resources is responsible for:

  1. Ensuring Information Security Policy awareness is included as part of the induction process.
  2. Supporting business areas in incidents that involve security investigations for Zamupay personnel
  3. Assisting in enforcing the disciplinary process for non-compliance with Information Security Policy requirements.
  4. Ensuring that any change in the life cycle of an employee either via employment, termination or change of role or function shall be defined, communicated officially with the individual concerned.
  5. Administration management should ensure that unauthorized physical access, damage and interference to the organization’s information and information processing facilities are prevented.

8. EDUCATION, TRAINING AND AWARENESS

  1. All new Zamupay personnel must be made aware of the importance of Information security and their responsibilities during the induction program.
  2. All Zamupay personnel must receive sufficient Information security training to meet their security responsibilities and obligations annually. These periodic cybersecurity training sessions are mandatory for all Zamupay personnel.

    3. a. Recognizing and avoiding phishing and social engineering attacks.

    b. Secure password creation and management.

    c. Safe use of email, internet, and mobile devices.

    d. Reporting suspicious activity and security incidents.

    Completion is tracked through filling an internal questionnaire and non-compliant employees may be subject to follow-up or escalation.

  3. All Zamupay personnel have full-time access to necessary information regarding cybersecurity requirements, efforts and news.
  4. The Information Security Team, in collaboration with other appropriate functions at Zamupay, will share knowledge/educational information to Zamupay personnel regarding data governance and cyber security matters.
  5. All Zamupay personnel are expected to ask questions and seek clarification immediately on matters cyber security that are not well understood.

8.1 Participate in Incident Response Simulations

All employees, especially those in critical roles (e.g.,Engineering, Operations, Support, Security), are required to take part in incident response simulations also known as tabletop exercises.

These simulations prepare staff to respond quickly and effectively to security incidents such as:

  1. Data breaches.
  2. Ransomware attacks.
  3. Insider threats.
  4. System outages due to cyberattacks.

The exercises involve mock scenarios where employees walk through response procedures:

  1. Identifying and reporting the incident.
  2. Activating the incident response team.
  3. Communicating with stakeholders.
  4. Containing and mitigating the issue.
  5. Documenting lessons learned.

These simulations help evaluate the organization’s incident response plan and identify gaps in preparedness or communication.

By fulfilling these responsibilities, personnel across all departments contribute to a security-first culture, reduce the risk of human error, and help the organization maintain compliance with industry standards

9.DISSEMINATION AND ACKNOWLEDMENT

Ensuring that all employees, contractors, and relevant third parties are aware of the Information Security Policy is critical to its effectiveness. The organization must implement a structured dissemination and acknowledgment process to communicate security expectations and hold individuals accountable for compliance.

Distribution methods::

Internal Publication on the Company central repository.

The finalized and approved version of the Information Security Policy will be published on the organization's internal Outline platform, ensuring that it is readily accessible to all employees at any time. This will serve as the central repository for the current version of the policy as well as related security documents such as, acceptable use policy and incident response management plan.

Email Dissemination to All Staff and Partners

Upon policy updates or annual review completions, formal email notifications will be sent to all employees, contractors, and relevant external partners. These communications will:

  1. Include a summary of key changes, where applicable.
  2. Provide a link to the full policy document.
  3. Instruct users on the required steps for acknowledgment.

Attachment During Employee Onboarding

The Information Security Policy will be a mandatory component of the onboarding package for all new hires. This includes:

  • Full-time employees
  • Interns
  • Temporary staff
  • Third-party service providers or consultants

During onboarding, new personnel must review the policy and complete an acknowledgment exercise before being granted access to company systems, networks, or data.

Acknowledgement Mechanisms

Digital Signatures or Acceptance via HRMS Systems

All personnel are required to digitally acknowledge their understanding and acceptance of the Information Security Policy using the organization’s Human Resource Management System (HRMS) or other approved compliance platforms, with the utilization of digital signature tools. This ensures an auditable and time-stamped record of agreement.

Records Maintained by Human Resources and Information Security

Acknowledgment records are securely stored and maintained by the Human Resources department. These records are:

  1. Linked to employee profiles for easy reference during audits or compliance reviews
  2. Used to confirm that individuals have read and agreed to the latest version of the policy
  3. Periodically reviewed to ensure all personnel are up to date with their responsibilities

Policy Violations

Non-compliance with the Information Security Policy, whether intentional or accidental, will trigger a formal investigation by the Information Security team and/or HR department. Depending on the severity of the violation, disciplinary actions may include:

  • Verbal or written warnings
  • Suspension of system access
  • Mandatory re-training
  • Termination of employment or contract
  • Legal action where applicable

All disciplinary actions follow the company’s internal disciplinary procedures and are proportionate to the nature and impact of the violation.

10.ACCEPTABLE USAGE OF TECHNOLOGY

Zamupay personnel and contractors will be required to adhere to respective acceptable usage policies including but not limited to the following:

General Systems Use and Ownership

  1. While Zamupay desires to provide a reasonable level of privacy, all users know that data they create/store on Zamupay’s assets remains the property of Zamupay.
  2. Usage of Zamupay’s asset and information systems requires access requests to the Line Manager and Information Security team, approvals for all users as a standard control as guided by the access management process.
  3. All Zamupay devices in use shall always be accessed/authenticated with username, password and secondary factor authentication as shall be implemented. Gaps identified by users regarding use of username, passwords and secondary factor authentication must be reported to the Support team and the Information Security team.
  4. An inventory of all Zamupay devices will be maintained to reflect authorized personnel allowed to access such devices. No device will be transferred among users without the Support Lead’s consent. The Support Team is responsible for labeling/naming of devices with owner contact information, and purpose of use.The Lead Support will maintain a register of Zamupay-approved applications and software.
  5. Exporting software, technical information, encryption software or technology, in violation of local laws and PCI DSS standards is illegal and in violation of Zamupay policies. Approvals are required from the Head of Technology.
  6. Introduction of malicious programs into Zamupay’s network or servers (e.g. viruses, worms, Trojan horses, e-mail bombs, etc.) emanating from negligence or intent is a violation of Zamupay policies.
  7. Revealing personal user account password to others or allowing use of individual accounts by others is strictly prohibited. This includes family and other household members when working from home.
  8. Using the company’s assets to actively engage in procuring or transmitting material that is in violation of sexual harassment or hostile workplace laws and policies in the user’s local jurisdiction is strictly prohibited.
  9. Making fraudulent/unauthorized offers on products, items, or services originating from any Zamupay account is prohibited.
  10. Using Zamupay’s devices to download, install or distribute pirated software or unauthorized data is prohibited.
  11. Posting or storing Zamupay’s data or Zamupay’s customer information on public databases/websites or cloud storage sites is prohibited.
  12. Sharing personal devices used to access Zamupay’s systems, or portable media containing internal, confidential or restricted information or assets, with third parties (including family members) is prohibited.
  13. Zamupay personnel using public devices (computer or mobile device at cybercafé businesses) and public internet to access Zamupay’s internal, confidential or restricted data is prohibited.
  14. Using Zamupay devices and network resources to access malicious internet sites for gambling or other illegal activities is prohibited.
  15. Resetting, deleting, formatting, or wiping of company devices including computer systems can only be done by the Information Security Team or Support team after obtaining approval by the Security and Compliance Officer.
  16. Employees are responsible for exercising good judgment regarding reasonable personal use of company devices and systems. Individual departments are responsible for creating guidelines concerning the personal use of network systems. In the absence of such policies, employees should consult their Line Manager/ Supervisors

10. USER IDS AND PASSWORDS

Zamupay personnel:

  1. Are prohibited from sharing passwords assigned/created on any company asset.
  2. Must select an obscure password and change it frequently as per the company’s password management requirements.
  3. Are accountable and responsible for all activities done using their username/account identification.
  4. Must ensure that other people/applications cannot learn their password.
  5. Must report immediately to the Information Security Team and the Head of Engineering should they have reason to believe that their username/account identification or password has been compromised.

Please refer to Zamupay’s Password Management policy for more guidance.

11. USE OF INFORMATION / DATA

Zamupay personnel:

  1. Will only access accounts, files, and data that belong to them, that are publicly available and those that they have approvals to access.
  2. Must ensure adequate security to the data they access or use.
  3. Must comply with the data classification standards as guided by this policy.
  4. Will only use company information for tasks related to assigned responsibilities and not for personal purposes.
  5. Must ensure they maintain the highest form of confidentiality on all company information they come across while discharging their duties.

12. ACCEPTABLE USE OF SOFTWARE AND HARDWARE

Use of Zamupay’s data, computer systems and network assets shall only be used for legal and authorized purposes. Unauthorized or illegal use will include the below PROHIBITED activities:

  1. Destruction of or damage to equipment, software, or data belonging to Zamupay, its customers or personnel, vendors or service providers.
  2. Unauthorized copying of copyright-protected materials from whichever source of the data.
  3. Conducting private business unrelated to Zamupay activities.
  4. Engaging in any activity that might be harmful to the company’s systems or to any information/data stored thereon, such as:

    5. a. Creation, usage or propagation of malicious software or viruses.

    b. Disrupting services or altering or corrupting Zamupay data, files; or

    c. Making unauthorized or unapproved changes.

  5. When vacating the computer workstations, log-off/sign-off or secure the system from unauthorized use.
  6. Use only legal versions of authorized/copyrighted software on computers or network resources, in compliance with vendor license requirements.
  7. Zamupay personnel must be aware of any restrictions attached to or affecting the provision of resources and services before use:

    8. a. Consult the Support Team for any questions about system workload or performance.

    b. Refrain from monopolizing systems, overloading systems, or networks with excessive data, or wasting computer time, connection time, disk space, print papers and other resources.

13. MONITORING, BREACH AND/OR DISRUPTIONS OF NETWORK RESOURCES

Zamupay security breaches include, but are not limited to, accessing, storing, copying and sharing data, records without authority or logging into a server or an account that the employee is not explicitly authorized to access and share Zamupay’s data or Zamupay’s customer/vendor/partner information with unauthorized parties/people.

For purposes of this section, ‘disruption’ includes, but is not limited to, network sniffing, ping floods, packet spoofing, denial of service, Domain Name System (DNS) poisoning, forged routing information for malicious intent, amongst others.

  1. Port scanning or security scanning is strictly prohibited unless prior notification to do it is communicated and approved..
  2. Executing any form of network monitoring which will intercept data not intended for the employee’s host, unless this activity is a part of the employee’s job/duty is strictly prohibited.
  3. Circumventing user authentication or security controls of any host, system, network or account is strictly prohibited.
  4. Intentionally interfering with or denying service to any user other than the employee’s host (for example, denial of service attack) is strictly prohibited. 5. Use of any intrusive program/script/command or to send messages of any kind with the intent to interfere with or disable a user’s terminal session via any means locally or via the internal/external networks is strictly prohibited.
  5. Providing information about Zamupay’s data or information about Zamupay’s employees to parties outside Zamupay or unauthorized parties is strictly prohibited.
  6. Use of any unauthorized intrusive or hacking tools that enable unauthorized users to access, phish, monitor or spy over Zamupay data, other user sessions or communications is strictly prohibited.

14. DEFAULT SYSTEM ACCOUNTS PASSWORD MANAGEMENT POLICY

To ensure systems continuity, Zamupay has retained default administrative system accounts (root and administrator) while implementing the following security controls.

  1. All default Windows ‘Administrator’ accounts should be renamed across all systems and access denied to Zamupay employees, apart from the Support Lead.
  2. Passwords for root and administrator accounts should be changed to a complex 12+ character alphanumeric password enhanced with special characters.
  3. The default administrative accounts should only be used in the event that Zamupay’s business continuity or service delivery needs can only be ensured by use of these administrative accounts.

15. SYSTEM AUDITING AND MONITORING

Refer to Zamupay’s ‘Log Management Policy’ and ‘Support SOP’ for specific standards and detailed procedures regarding system monitoring. Below are highlights of the primary tasks of the Support team, guided by the Support Lead:

  1. Ensure that alerts are generated to the appropriate personnel during the administration of user accounts, including but not limited to additions, deletions, and modifications.
  2. Monitor and analyze security alerts and information and distribute to appropriate personnel.
  3. Monitor and analyze the network scans and alerts and distribute to appropriate personnel.
  4. Monitor and control all access to data.
  5. Ensure back-ups are encrypted and stored securely
  6. Ensure all servers and workstations, and mobile devices maintain current anti-virus updates.
  7. Ensure appropriate firewall(s) are in place and functioning properly.

15.1 Network Monitoring and Traffic Analysis:

Network logs are monitored with the use of the Security Information and Event Management tool (Wazuh). Aggregates logs and alerts from firewalls, IDS/IPS, endpoint agents, and authentication systems for real-time threat detection and response. Automated alerts are triggered based on pre-set thresholds or suspicious behavior.

15.2 Network Access Controls and Hardening

Least Privilege Principle: Network access is granted strictly on a need-to-know, need-to-access basis. Administrative privileges are minimized and audited. IP address filtering and port security are used on internal firewalls to prevent rogue device connections.

Unused ports and services are disabled across all network devices.All administrative access to network devices is logged, monitored, and secured using encrypted protocols.

16. PHYSICAL SECURITY.

Zamupay enforces rigorous physical security controls to prevent unauthorized access to the office premise.

  • Biometric readers: These are at the point of entry and the employees are required to authenticate themselves before proceeding to the office premise.
  • 24/7 CCTV Surveillance: High-definition cameras monitor all critical entrances, exits, and sensitive areas. Footage is retained for a minimum of 90 days.
  • Security Personnel: On-site security staff monitor entry points 24/7.

Visitor Access Procedures:

All visitors must present valid identification at the information desk before proceeding to the office premise.

Visitors are issued visitor-access documentation, that will require to be authenticated and stamped before departing the office. The same is presented to the Security personnel at the information desk while leaving. All visitors should be escorted by authorized employees at all times.

17. POLICY REVIEWS AND UPDATES

It is required that all security policies remain current, relevant, and aligned with the organization’s evolving risk landscape, legal obligations, and business objectives. Regular reviews and timely updates ensure the effectiveness and accuracy of these policies in guiding security practices.

The Policy Shall Be Reviewed:

  1. Annually, by the Information Security Team The Security and Compliance Officer is responsible for conducting a formal and comprehensive review of the policy on an annual basis. This ensures that the policy aligns with evolving best practices, regulatory requirements, and internal risk assessments. The review includes an evaluation of whether the policy reflects the organization’s current technologies, operations, and threat environment.
  2. Immediately following significant business changes or new threat intelligence - Outside the scheduled annual review, the policy must be reviewed and updated whenever there are major business events or external triggers.

These may include:

  1. Structural changes such as significant shifts in IT infrastructure.
  2. Discovery of critical vulnerabilities or exploits relevant to the organization’s systems.
  3. New or updated regulations and compliance mandates.
  4. Emerging threat intelligence reports indicating potential risks to operations. Such changes require an expedited review to ensure the policy remains robust and actionable under new circumstances.