Information security at Maestro Analytics Private Limited
Classification: Public
A summary for clients and other outside readers, drawn from our ISMS Manual, which is internal. Reviewed annually and whenever our certification status or scope changes.
Who we are, and what is covered
Maestro Analytics Private Limited is a Nepali company, registration 312353/79/080, in Ward No. 3, Jhamshikhel, Lalitpur. We build and run data engineering, analytics and business intelligence services, our clients including banks.
Our information security management system covers the provision of data engineering, analytics and business intelligence services, and the associated computer programming, data processing and application support activities, delivered from our Lalitpur office. All of our delivery work and everyone who performs it sits inside that boundary, and no Annex A control is excluded: all ninety-three apply to us.
Our commitment
We protect the confidentiality, integrity and availability of the information entrusted to us by our clients, our group and our own staff. Our management sets the policy and the objectives, provides the people, tools and money the system needs, and reviews how it is working at least annually. A named Security Officer is accountable day to day, with named owners for each area of control. Everyone here signs an acceptable use policy, and security awareness training is delivered annually with a quiz that has a pass mark.
How we work
From risk. We keep a risk register, assess each risk, decide how to treat it and track that treatment to completion. Our Statement of Applicability records our decision on every control and the reason for it.
Your data stays where it belongs. Our engineers work inside client systems using accounts the client issues, under the client's own change control. Company laptops hold no client data: our people work on virtual machines reached over a VPN. Where a client requires attendance on its premises, that is how we work.
Access is controlled and reviewed. Named accounts, granted on approval and removed on departure. Multi-factor authentication on Microsoft 365 and on the password vault, and we are extending it to the other systems that support it. Passwords generated and held in a managed vault. Our rule is that no credential is kept in a document or a chat message, and we audit against it. Access reviewed on a schedule, and any account that cannot be personal is a documented exception with compensating controls and an owner.
Events are logged. Systems send their logs to a central store with a deliberate retention period, and we have a defined cycle for reviewing them rather than looking only when something goes wrong.
Incidents are handled, and clients are told. We run a documented procedure with severity levels, defined response times and a log of every event. If an incident affects a client we notify them within the window their contract requires, and within 24 hours where no shorter window is set, and we record what was said, when and to whom.
Suppliers are managed. We keep a register that records what each supplier sees and whether it is critical to us, and we review the critical ones on a defined cycle.
We are checked. The system is audited internally by an independent auditor against the whole standard, reviewed by top management, and audited externally by our certification body. Findings get an owner, a date and evidence of closure.
Legal and regulatory
We operate under Nepali law, including the Individual Privacy Act 2075 (2018) and its Regulation 2077 (2020), the Electronic Transactions Act 2063 (2008), the Labour Act 2074 (2017), the Companies Act 2063 (2006) and the Copyright Act 2059 (2002). What each requires of us in practice is recorded, with a named owner.
Certification
We are being certified to ISO/IEC 27001:2022 by United Registrar of Systems Limited, accredited by UKAS under accreditation number 0043. The Stage 1 audit was held at our office on 27 September 2026.
No certificate has yet been issued. This section is updated with the certificate number, its date of issue and expiry, and the scope as printed on it, when it is.
Contact
zealot@maestro-analytics.com — Security Officer.