Information Security Policy
Principles and requirements for protecting the confidentiality, integrity, and availability of information.
Document Control
| Document Title | Information Security Policy |
| Document Type | Policy |
| Version | 1.0 |
| Document Owner | Chief Technology Officer (CTO) |
| Approved By | Executive Management |
| Approval Date | 2025-09-01 |
| Effective Date | 2025-09-01 |
| Review Frequency | At least annually |
| Last Review Date | 2025-09-01 |
| Next Scheduled Review | 2026-09-01 |
| Classification | Internal |
| Storage Location | Secure internal document repository |
1. Purpose and Scope
The purpose of this Information Security Policy is to establish principles and requirements for protecting the confidentiality, integrity, and availability of information and systems used by the organization.
This policy applies to all employees, contractors, systems, applications, cloud services, devices, and data used in support of business operations and service delivery. It is designed to be proportional to the organization's size, operational complexity, and risk profile.
2. Security Governance and Roles
Information security is governed at the management level and integrated into business operations.
Roles and Responsibilities
- Management
- Approves this policy and related security policies
- Ensures information security risks are managed appropriately
- Provides oversight for security incidents and improvements
- Security / IT Responsibility (designated role)
- Oversees implementation of security controls and practices
- Coordinates incident response and vulnerability management
- Advises management on security risks and improvements
- Personnel
- Comply with security policies and procedures
- Protect information and systems under their control
- Promptly report suspected security incidents
3. Risk-Based Security Approach
Information security controls are implemented using a risk-based approach.
Security measures are selected based on:
- Sensitivity of information
- Criticality of systems
- Legal, regulatory, and contractual obligations
- Threat landscape and operational risk
Risk considerations are integrated into:
- System and service design
- Vendor selection
- Operational changes
- Incident response and business continuity planning
4. IT Operations & Security Practices
The organization operates primarily in a cloud-first, remote-first model and relies on reputable cloud and managed service providers.
High-level IT security practices include:
- Secure configuration of systems and services
- Controlled access to administrative functions
- Change review prior to material system changes
- Reliance on provider-managed infrastructure security where appropriate
Detailed operational procedures are maintained as needed and reviewed periodically.
5. Endpoint & Device Usage Policy
Endpoints used to access organizational systems or data must be protected against unauthorized access and misuse.
Endpoint security requirements include:
- Use of approved and authorized devices
- Device-level authentication (passwords, biometrics)
- Encryption where supported
- Endpoint protection software where appropriate
- Prompt reporting of lost or stolen devices
Only managed or approved devices may be used to access sensitive systems or data.
6. Data Protection Principles
Information is protected throughout its lifecycle in accordance with the following principles:
- Confidentiality: Access to data is restricted based on job role and business need
- Integrity: Controls are implemented to prevent unauthorized modification
- Availability: Systems and data are protected against loss or disruption
Data protection measures may include:
- Access controls and authentication
- Encryption at rest and in transit where appropriate
- Secure storage and transmission
- Secure disposal in accordance with records retention requirements
7. Access Control
Access to systems and data is managed in accordance with the Access Control Policy.
Key principles include:
- Least privilege
- Unique user accounts
- Strong authentication, including multi-factor authentication (MFA) where supported
- Prompt removal of access when no longer required
Privileged access is restricted and monitored at a high level.
8. Logging and Monitoring
Security-relevant events are logged and monitored to support detection, investigation, and response to potential security incidents.
Logging and monitoring may include:
- Authentication and access events
- Administrative actions
- System and application alerts
- Cloud provider security notifications
Monitoring capabilities leverage available platform, cloud-provider, and security tooling.
9. Vulnerability and Patch Management
Vulnerabilities are identified and addressed in a timely manner using a risk-based approach.
High-level practices include:
- Use of vendor and cloud-provider security updates
- Application of security patches where appropriate
- Review of vulnerability notifications relevant to systems in use
- Prioritization of remediation based on risk
Responsibility for patching may be shared with cloud or managed service providers depending on the service model.
10. Acceptable Use
Systems, networks, and data may only be used for authorized business purposes.
Users are prohibited from:
- Sharing credentials
- Bypassing security controls
- Accessing systems or data without authorization
Detailed acceptable use requirements are documented in the Employee Handbook and related policies.
11. Incident Management
Security incidents are handled in accordance with the Incident Response Plan.
This includes:
- Prompt reporting of suspected incidents
- Coordinated response and escalation
- Investigation, containment, and recovery
- Handling of privacy-related incidents where applicable
12. Third-Party and Cloud Security
Third-party and cloud service providers are selected and managed in accordance with the Third-Party Risk Management Policy.
Security considerations include:
- Provider security controls and practices
- Contractual security and confidentiality requirements
- Reliance on independent audit reports where available
- Ongoing oversight proportional to risk
13. Policy Compliance
Failure to comply with this policy may result in disciplinary action, up to and including termination of access or contractual relationship.
Questions or concerns regarding this policy should be directed to management or the designated security contact.
14. Policy Review and Maintenance
This Information Security Policy is:
- Reviewed periodically and updated as necessary
- Reviewed following material security incidents or significant changes
- Approved by management and communicated to relevant personnel
Approval:
This Information Security Policy is approved by management and is effective as of the date of approval.