Add SECURITY.md

Signed-off-by: Alex Vanin <a.vanin@yadro.com>
Signed-off-by: Pavel Pogodaev <p.pogodaev@yadro.com>

SECURITY.md

@@ -0,0 +1,52 @@
+# Security Policy
+## Purpose
+This document outlines the security policy for TrueCloudLab. It defines the principles, standards, and procedures to protect our information assets, systems, and data from unauthorized access, use, disclosure, modification, or destruction.
+
+## Scope
+This policy applies to all employees, contractors, vendors, and partners who have access to our systems and data. It covers physical, logical, and personnel security measures.
+
+## Principles
+**Confidentiality**: We protect sensitive information from unauthorized disclosure.
+
+**Integrity**: We ensure the accuracy and completeness of our data.
+
+**Availability**: We maintain the availability of our systems and services.
+
+**Authentication**: We verify the identity of users before granting access.
+
+**Authorization**: We control access based on user roles and permissions.
+
+**Non-repudiation**: We provide evidence of actions taken by users.
+
+**Auditability**: We log events for security monitoring and forensics.
+
+**Compliance**: We comply with relevant laws, regulations, and standards.
+
+**Incident Response**: We have a plan for responding to security incidents.
+
+
+## Standards
+**Encryption**: Sensitive data is encrypted at rest and in transit.
+
+**Access Controls**: User accounts are protected with strong passwords.
+
+**Network Security**: Firewalls, intrusion detection/prevention systems are used.
+
+**Physical Security**: Data centers are secured with access controls.
+
+**Vulnerability Management**: Regular scans and patching are performed.
+
+**Backup and Recovery**: Data is backed up regularly and tested for recovery.
+
+**Disaster Recovery**: A plan is in place for restoring operations after a disaster.
+
+## Procedures
+**Password Management**: Users must change passwords regularly.
+
+**Security Awareness Training**: Employees receive training on security best practices.
+
+**Incident Reporting**: Suspicious activity is reported to the security team.
+
+**Risk Assessment**: Risks are identified and mitigated.
+
+**Third-Party Security**: Vendors are screened for security risks.