Information Security Policy

1. Security Overview & Commitment

As a global BIM production and digital engineering partner, VIRCORA handles sensitive intellectual property for commercial, healthcare, industrial, and defense infrastructure projects. We treat information security as an essential engineering discipline, integrating multi-layered security controls across our physical production centers, cloud repositories, and workforce processes.

2. ISO 27001 Security Framework

Our security policies adhere to the international ISO/IEC 27001:2022 standard. Our ISMS governs risk assessment, access controls, cryptography, physical security, network monitoring, supplier relationship security, and business continuity management.

3. Common Data Environment (CDE) & Model File Security

All project modeling and coordination deliverables are managed through secure, enterprise-grade Common Data Environments (CDEs):

• Autodesk Construction Cloud (ACC) & BIM 360: Project permissions are strictly segmented by trade, company, and role. Model files (.rvt, .nwd) cannot be accessed by unauthorized personnel.
• Secure Data Transfer: Point cloud datasets (.e57, .las) and large CAD files are exchanged via encrypted SFTP or ISO 27001 compliant enterprise cloud transfer portals.
• Clean Workstation Policy: Project workstations are monitored to prevent local unauthorized USB storage device usage or unapproved file exports.

4. Identity & Access Management (IAM)

VIRCORA enforces Zero Trust Network Architecture (ZTNA) principles across all systems:

• Role-Based Access Control (RBAC): BIM modelers and engineers are granted access only to active projects to which they are officially assigned.
• Multi-Factor Authentication (MFA): Mandatory hardware/app-based MFA for all cloud infrastructure, corporate email, VPN connections, and CDE portals.
• Quarterly Privilege Audits: User accounts and project permissions are audited quarterly; access for offboarded team members is revoked instantly upon contract conclusion.

5. Infrastructure & Encryption Standards

Our computing hardware and network infrastructure are protected by advanced defense-in-depth security layers:

• Data Encryption: All project data at rest is encrypted using AES-256 bit encryption keys; all data in transit across public networks uses TLS 1.3 encryption protocols.
• Endpoint Protection: Automated real-time endpoint detection and response (EDR) software deployed across all modeling workstations and engineering servers.
• Firewall & Network Isolation: Production networks are segmented with next-generation firewalls (NGFW) and intrusion detection/prevention systems (IDS/IPS).

6. Incident Response & Business Continuity

VIRCORA maintains a formal Incident Response Plan (IRP) tested semi-annually. In the event of a security incident, our Security Operations Center (SOC) executes rapid containment, mitigation, forensic analysis, and mandatory client notifications within 24 hours.

Daily incremental and weekly full encrypted backups are maintained in geographically isolated cloud datacenters, providing a Recovery Point Objective (RPO) of under 4 hours and Recovery Time Objective (RTO) of under 12 hours.

7. Personnel & Workplace Security

All VIRCORA employees undergo rigorous background verification prior to onboarding. Team members receive bi-annual security awareness training covering phishing prevention, social engineering defense, and secure BIM file handling protocols. Non-Disclosure Agreements (NDAs) remain legally binding indefinitely post-employment.

8. Reporting Security Vulnerabilities & Inquiries

If you have questions regarding our security controls or wish to report a potential security issue, please contact our Information Security Officer at: