Information Security Policy
July 5th, 2025
Contents
Introduction
This Policy document encompasses all aspects of security surrounding confidential company information and must be distributed to all company employees. All company employees must read this document in its entirety and sign the form confirming they have read and fully understand this policy. This document will be reviewed and updated by Management on an annual basis or when relevant to include newly developed security standards into the policy and re-distributed to all employees and contractors where applicable.
Information Security Policy
ShootingRange.com handles sensitive information daily. Sensitive Information must have adequate safeguards in place to protect the account data that includes cardholder data, cardholder privacy, and to ensure compliance with various regulations, along with guarding the future of the organisation.
ShootingRange.com commits to respecting the privacy of all its customers and to protecting any customer data from outside parties. To this end management are committed to maintaining a secure environment in which to process cardholder information so that we can meet these promises.
Employees handling sensitive cardholder data should ensure:
- •Handle Company and account data information in a manner that fits with their sensitivity and classification
- •Limit personal use of ShootingRange.com information and telecommunication systems and ensure it doesn't interfere with your job performance
- •ShootingRange.com reserves the right to monitor, access, review, audit, copy, store, or delete any electronic communications, equipment, systems and network traffic for any purpose
- •Do not use e-mail, internet and other Company resources to engage in any action that is offensive, threatening, discriminatory, defamatory, slanderous, pornographic, obscene, harassing or illegal
- •Do not disclose personnel information unless authorised
- •Protect sensitive account data including cardholder information
- •Keep passwords and accounts secure
- •Request approval from management prior to establishing any new software or hardware, third party connections, etc.
- •Do not install unauthorised software or hardware, including modems and wireless access unless you have explicit management approval
- •Always leave desks clear of sensitive cardholder data and lock computer screens when unattended
- •Information security incidents must be reported, without delay, to the individual responsible for incident response locally
- •Attend security awareness training on an annual basis
We each have a responsibility for ensuring our company's systems and data are protected from unauthorised access and improper use. If you are unclear about any of the policies detailed herein you should seek advice and guidance from your line manager.
1. Network Security
A high-level network diagram of the network is maintained and reviewed on a yearly basis. The network diagram provides a high level overview of the cardholder data environment (CDE), which at a minimum shows the connections in and out of the CDE. Critical system components within the CDE, such as POI/POS devices, databases, eCommerce web servers, re-direction/iFrame servers, etc., and any other necessary payment components, as applicable should also be illustrated.
In addition, ASV should be performed and completed by a PCI SSC Approved Scanning Vendor on a quarterly basis (every 90-92 days), where applicable. Evidence of these scans should be maintained for a period of 18 months. For eCommerce, the scans need to include the re-direction/iFrame servers at a minimum.
For standalone-dialup terminals
For P2PE solutions
For eCommerce that use re-direction/iFrame
2. Acceptable Use Policy
Management's intentions for publishing an Acceptable Use Policy are not to impose restrictions that are contrary to the Company's established culture of openness, trust and integrity. Management is committed to protecting the employees, partners and ShootingRange.com from illegal or damaging actions, either knowingly or unknowingly by individuals. ShootingRange.com will maintain an approved list of technologies and devices and personnel with access to such devices as detailed in Appendix B.
- Employees are responsible for exercising good judgment regarding the reasonableness of personal use
- Employees should take all necessary steps to prevent unauthorized access to confidential data which includes account data/card holder data
- Keep passwords secure and do not share accounts. Authorized users are responsible for the security of their passwords and accounts
- All PCs, laptops and workstations should be secured with a password-protected screensaver with the automatic activation feature
- All POS and POI/PIN entry devices should be appropriately protected and secured so they cannot be tampered or altered
Security Precautions:
- Information contained on portable computers is especially vulnerable, special care should be exercised
- Employees must use extreme caution when opening e-mail attachments received from unknown senders, which may contain viruses, e-mail bombs, Trojan horse code, or phishing attacks
- Users should be trained in the ability to identify any suspicious behaviour where any tampering or substitution may be performed
3. Protect Stored Data
Strict Prohibitions - It is strictly prohibited to store:
- The contents of the payment card magnetic stripe (track data) or chip equivalent track data on any media whatsoever
- The CVV2/CVC2/CAV2/CID (the 3 or 4 digit number on the signature panel on the reverse of the payment card) on any media whatsoever
- The PIN or the encrypted PIN Block under any circumstance
Data Storage Rules:
- ShootingRange.com and its employees are not to store cardholder data in form of PAN or sensitive authentication data in electronic format at all
- All sensitive account data including cardholder data stored and handled in hard copy must be securely protected against unauthorised use at all times
- Any sensitive card data that is no longer required must be discarded in a secure and irrecoverable manner
Display Requirements:
- If there is no specific need to see the full PAN (Primary Account Number), it has to be masked when displayed
- Show six first and last four numbers of PAN maximum
- PAN's which are not protected should not be sent to the outside network via end user messaging technologies
4. Information Classification
Data and media containing data must always be labelled to indicate sensitivity level.
Confidential Data
Information assets for which there are legal requirements for preventing disclosure or financial penalties for disclosure, or data that would cause severe damage to ShootingRange.com if disclosed or modified. Includes account data/cardholder data.
Internal Use Data
Information that the data owner feels should be protected to prevent unauthorized disclosure.
Public Data
Information that may be freely disseminated.
5. Access to the Sensitive Cardholder Data
All Access to sensitive cardholder should be controlled and authorised. Any job functions that require access to cardholder data should be clearly defined.
Access Control Requirements:
- Any display of the account data/card holder should be restricted at a minimum to the first 6 and the last 4 digits of the primary account number (PAN)
- Access to sensitive cardholder information such as PAN's, personal information and business data is restricted to employees that have a legitimate need to view such information
- No other employees should have access to this confidential data unless they have a genuine business need
Third Party Service Provider Requirements:
- If cardholder data is shared with a Service Provider (3rd party) then a list of such Service Providers will be maintained
- Written agreement that includes an acknowledgement that the Service Provider will be responsible for the cardholder data
- Established process, including proper due diligence before engaging with a TPSP
- Process in place to monitor the PCI DSS compliance status of the TPSP
- Responsibilities for ensuring the security of account data/cardholder data must be defined and documented in a responsibility matrix
