BCG’s information security policies and practices are risk-sensitized and follow the framework established by the International Standard ISO/IEC 27002 (Information technology – Security techniques – Code of practice for information security controls).