Confidentiality
Information is accessible only to authorized personnel based on their responsibilities and required access.
Protect your Data
TCA Information Security
Your data. Our responsibility.
People, processes, and technology working together to protect your business.
Integrity
Controls help keep information accurate, complete, and protected against unauthorized modification.
Availability
Monitoring and recovery processes help keep critical systems and information available when needed.
Protection across every layer
TCA combines preventive controls, endpoint monitoring, centralized security visibility, and defined response procedures. Each layer supports the next, helping protect sensitive information, identify suspicious activity, connect security signals, and respond when action is required.
Data Loss Prevention
Sensitive information is classified and protected through policies designed to identify and help block unauthorized sharing while maintaining traceability.
Endpoint Detection and Response
Devices are monitored for suspicious behavior so potential threats can be identified, affected endpoints isolated, and relevant evidence preserved for investigation.
Security Information and Event Management
Security activity from multiple systems is centralized and analyzed to connect related signals, provide context, and surface priority events.
Continuous Monitoring
Continuous surveillance supports defined escalation, containment, recovery, and documented review when a potential security event is identified.
Protection is strongest when every layer works together - from prevention and detection to investigation and response.
Security begins before access is granted
Technology is only one part of protecting client information. TCA combines access controls, employee responsibilities, security awareness, and defined procedures to manage how information is accessed throughout the working relationship.
Access and people controls
Role-based access
Access is limited according to each person's responsibilities and required work.
Multi-factor authentication
Additional verification is used for remote and administrative access where applicable.
Periodic access reviews
Accounts and permissions are reviewed to confirm that access remains appropriate.
Immediate access removal
Access is adjusted when responsibilities change and revoked promptly when an engagement ends.
Confidentiality agreements
TCA employees formally acknowledge their responsibilities for protecting information.
Security-awareness training
Training covers phishing, information handling, clean-desk practices, and screen security.
Secure service lifecycle
Before the engagement
Identify authorized users and sensitive information, assess risks, and establish appropriate access and communication channels.
During the engagement
Maintain controlled access while monitoring, incident procedures, backup validation, training, and vendor oversight support the engagement.
After the engagement
Remove access, securely return or delete information as required, and verify applicable security obligations.
Every stage has defined controls, from preparation and daily access to secure offboarding.
Security commitments you can verify.
TCA’s Information Security Program is informed by recognized security frameworks and applicable data-protection requirements. This alignment helps guide how we manage access, assess risk, monitor activity, and protect information throughout an engagement.
Information-security governance
ISO/IEC 27001:2022
This framework informs how TCA organizes information-security responsibilities, evaluates risk, documents policies, and supports continuous improvement.
How it informs our approach
- Defined security responsibilities
- Documented security policies
- Risk identification and assessment
- Access-control governance
- Incident-management planning
- Review and improvement
Scope clarification: Alignment informs TCA's operating model. Independent certification, where applicable, is presented separately with its scope and validity.
Security-control guidance
ISO/IEC 27002:2022
This guidance supports the selection and application of practical information-security controls across people, processes, technology, and physical working practices.
How it informs our approach
- Access-control practices
- Secure authentication
- Information classification
- Endpoint security practices
- Logging and monitoring
- People-related security
Scope clarification: The framework provides control guidance. Any independent certification is presented separately with its specific scope and validity.
Prioritized cybersecurity safeguards
CIS Controls v8.1
The CIS Controls help prioritize practical safeguards that reduce common cybersecurity risks and support consistent operational security practices.
How it informs our approach
- Account and access management
- Data-protection practices
- Secure device configuration
- Security logging
- Incident response
- Recovery preparation
Scope clarification: CIS alignment supports the prioritization of safeguards within TCA's operating environment and applicable client engagements.
Personal-information protection
Colombian Data-Protection Regulations
Applicable Colombian requirements inform how personal information is collected, accessed, handled, retained, and protected within relevant TCA operations.
How it informs our approach
- Responsible information handling
- Restricted access
- Confidentiality practices
- Secure information transfer
- Retention and deletion controls
- Documented accountability
Scope clarification: Applicable legal requirements depend on the information, service, and processing activity involved. Specific obligations should be confirmed for each engagement.
Security controls can be adapted according to the service provided, the sensitivity of the information involved, and the client's applicable compliance requirements.
Security commitments you can verify
TCA’s Information Security Program is informed by recognized security frameworks and applicable data-protection requirements.
These references help guide how we manage risk, control access, monitor activity, and protect information throughout an engagement.
Our commitments are supported by documented policies, assessments, training records, access reviews, recovery testing, and vendor-compliance information available for appropriate client review.