Policies

The rules the product enforces on every transfer. Changing these changes what users are allowed to do — not what they are asked to remember.

Read-only

Only an ISMS administrator can change policy. Switch persona to Farid Zulkifli to edit.

Supplier risk tiers

What each tier entitles a supplier to receive. The tier sets the ceiling on onboarding and at every security review; releasing above a vendor's ceiling needs a recorded ISMS exception — ISO 27001 A.5.19 / A.8.3.

Risk tier	Ceiling	Basis
Tier 1 — Strategic	Restricted	Long-term partner under continuous assurance; audited, with design data integral to the engagement
Tier 2 — Standard	Confidential	Established supplier with periodic review; receives project data but not the full design intent
Tier 3 — Limited	Internal	Limited or transactional engagement; receives only what the work strictly requires

Classification	Approval	Max link life	Max downloads	Watermark	Identity check
Public	None	90 days	Unlimited	Optional	Optional
Internal	None	30 days	10	Optional	Recommended
Confidential	Manager	14 days	5	Required	Required
Restricted	Manager + ISMS on exception	7 days	3	Enforced	Enforced