Virtus Group - Security Overview (NZISM)

Executive Summary

This document describes Virtus Group’s standard for this area and how it is applied in practice. It is derived from our internal policies and standards and is intended for both reviewers and operations.

Scope & Assumptions

• In scope: systems and processes directly managed by Virtus Group per contract.
• Out of scope: client-owned or third‑party systems not onboarded to our managed service.
• Dependencies: connectivity, power, and named client contacts for decision making.

Control Summary & Source References

Requirements (Key Controls)

• Acceptable Use: It is vital that we safeguard both our customers and ourselves and ensure that the trust they place in us is retained. (VGL.Acceptable.Usage.Policy.docx)
• BCDR: The purpose of this policy is to ensure that all our staff members, and business partners act in compliance with our ethical standards and relevant laws and regulations. (VGL.Anti.Fraud.Anti.Corruption.Policy.docx)
• General: Virtus Group Ltd staff members must comply with all applicable anti-fraud, anti-corruption and anti-bribery laws and regulations, including but not limited to the Organised Crime Bill, OECD Anti-Bribery Convention, the United Nations Convention Against Corruption (UNCAC), the Foreign Corrupt Practices Act (FCPA) and the UK Bribery Act. (VGL.Anti.Fraud.Anti.Corruption.Policy.docx)
• Risk Management: All staff members must report any suspicious activity or potential AML risks to the finance team, including transactions that are inconsistent with a customer's known business, or transactions that involve high-risk countries, individuals, or entities. (VGL.Anti.Fraud.Anti.Corruption.Policy.docx)
• Vendor Management: Virtus Group Ltd staff members must not give or receive gifts or hospitality that could be perceived as an inducement or influence on business decisions, and/or might place the Virtus Group Ltd staff member under an obligation to a third party. (VGL.Anti.Fraud.Anti.Corruption.Policy.docx)
• Capacity Management: The purpose of this Capacity Management Plan is to ensure that Virtus Group Ltd. (VGL.Capacity.Management.Plan.docx)
• Incident Response: Cybersecurity operations must address the following domains: (VGL.Cybersecurity.Operations.Standard.docx)
• Identity & Access: Multi-Factor Authentication (MFA) must be enabled for all business systems (VGL.Cybersecurity.Policy.docx)
• Endpoint / MDM: All devices must be managed by Virtus Group (MDM/endpoint protection) (VGL.Cybersecurity.Policy.docx)
• Encryption: Encryption must be enabled on all laptops and mobile devices (VGL.Cybersecurity.Policy.docx)
• Change Management: Change Advisory Board (CAB) – Reviews and approves changes, ensures risk and impact assessments, holds regular meetings, and monitors change trends.Head of Security & Compliance – Policy owner, chairs the CAB, and has final authority to accept or reject changes.IT Operations Manager / Principal Engineer – Acts as subject matter expert (SME), provides technical input, supports CAB decision-making, and ensures testing and rollback plans are in place.Managers – Approve changes for their teams, ensure communication of impacts, and verify staff compliance.All Staff – Must follow this policy, participate in approvals or testing where relevant, and report breaches or issues. (VGL.IT.Change.Management.Policy.docx)
• Asset Management: Director – Provides governance, approves exceptions, and ensures adequate resources.Head of Security & Compliance – Owns this procedure, oversees compliance, and ensures audits.IT Operations Manager – Maintains the asset register and oversees provisioning and de-provisioning.People & Culture – Ensures HR processes trigger asset allocation and retrieval.Managers – Approve allocation requests and ensure proper use of assigned assets.Asset Owners – Ensure correct classification, handling, and compliance.Custodians – Maintain custody and day-to-day protection of assigned assets.All Staff – Must comply with this procedure, report loss/theft, and return assets on termination. (VGL.Information.Asset.Management.Procedure.docx)
• Privacy & Breach: Availability: Ensuring information and systems are accessible when required. (VGL.Information.Security.And.Privacy.Framework.docx)
• Governance & Assurance: Security policies, standards, and procedures must be maintained and embedded into business processes. (VGL.Information.Security.Assurance.Policy.docx)
• Network Security: To define the required controls and responsibilities for securing Virtus Group Ltd’s network environments, ensuring alignment with ISO/IEC 27001:2022, CERT NZ, NCSC guidelines, and applicable New Zealand legislation. (VGL.Network.Security.Standard.docx)
• Physical Security: This procedure provides detailed definitions and process steps for implementing physical security controls to ensure Virtus Group Ltd premises are properly managed and protected. (VGL.Physical.Security.Procedure.docx)
• Collaboration / DLP: Collaboration must occur using approved VGL systems (Microsoft 365: Outlook, SharePoint, OneDrive, Teams) (VGL.Sharing.and.Collaboration.Standard.docx)
• SDLC / DevSecOps: The purpose of this standard is to ensure that security and compliance are embedded into all system, service, and technology acquisitions or developments at Virtus Group Ltd. (VGL.System.Acquisition.and.Development.Standard.docx)

Procedures / Playbooks

Standards Mapping — NZISM ↔ PSR

This table maps our public artefacts to the PSR pillars and the most relevant NZISM chapters/sections.

KPIs & Reporting

• Policy review ≤ 12 months

Evidence & Records

Records are maintained per the VGL Document & Record Control guidelines, including logs, approvals, test outputs, meeting minutes, and reports.