To All Employees,

As Kalpataru continues to expand its digital footprint and integrate advanced enterprise resource planning systems across all subsidiaries, the safeguarding of our corporate data has never been more critical. The IT department, in conjunction with the Executive Risk Committee, has completely overhauled our cybersecurity frameworks. Effective immediately, the following Comprehensive IT Security Guidelines are mandatory for all full-time employees, contractors, and vendor partners accessing Kalpataru networks.

1. Password Complexity and Rotation Protocol

The reliance on legacy password systems presents a significant vulnerability. We are migrating to a zero-trust architecture. All Active Directory (AD) passwords must now meet the following stringent criteria:

• Minimum length of 14 characters.
• Must contain at least two uppercase letters, two lowercase letters, two numbers, and two special characters.
• Passwords cannot contain dictionary words, your name, or your employee ID.
• Mandatory rotation every 60 days. The system will prevent the reuse of the last 12 passwords.

Please note that any account with a password older than 60 days will be automatically suspended. Reinstatement will require a manager's approval and an in-person or video verification with the IT Helpdesk.

2. Multi-Factor Authentication (MFA) and Single Sign-On (SSO)

We are deprecating direct logins to standalone applications. All corporate applications (including HRMS, ERP, Procurement Portals, and internal email) are now routed through our unified Single Sign-On (SSO) gateway. Accessing the SSO from any device outside of the physical corporate office networks will trigger a Multi-Factor Authentication (MFA) challenge via the Microsoft Authenticator app.

Do not approve MFA requests on your mobile device unless you are actively attempting to log into a corporate service. If you receive an unsolicited MFA prompt, report it immediately to the Security Operations Center (SOC) as it indicates your password has been compromised.

3. Phishing, Vishing, and Smishing Prevention

Social engineering remains the primary attack vector against corporate networks. We have observed a sophisticated increase in phishing emails masquerading as internal HR communications (e.g., "Urgent Payroll Update") or IT requests. Remember:

• Kalpataru IT will never ask for your password via email, phone, or instant messaging.
• Always verify the sender's email address, not just the display name. All official communications will originate from the `@kalpataru.com` or `@kalpataruprojects.com` domains.
• If an email contains external links urging immediate action, hover over the link to inspect the actual destination URL before clicking.
• Use the "Report Phishing" button integrated into Outlook for any suspicious correspondence.

4. Clean Desk and Clear Screen Policy

Physical security is just as important as digital security. When leaving your workstation, even for a short duration, you must lock your computer (Windows Key + L). Documents containing Sensitive Personal Information (SPI), financial projections, or unreleased project blueprints must be secured in locked drawers when not in active use. Whiteboards in meeting rooms must be wiped clean after confidential discussions.

Compliance with these guidelines is non-negotiable and forms a part of your employment contract. Regular audits will be conducted, and simulated phishing campaigns will be run unannounced to test organizational readiness. Employees who consistently fail security simulations will be required to undergo mandatory remedial training.

If you have any questions or require assistance setting up your Authenticator app, please raise a ticket via the IT Service Portal or contact the Helpdesk at extension 5000.

Chief Information Security Officer (CISO)
Kalpataru Group

Back to Communication