Information Security Policy

INFORMATION SECURITY POLICY

WHEREAS, the organization endeavors to protect the confidentiality, integrity, and availability of its information assets and systems;

WHEREAS, this policy establishes mandatory controls, roles, and procedures to manage information security risks and comply with applicable legal and contractual obligations;

Purpose

The purpose of this Information Security Policy is to define the minimum security requirements for the protection of all information assets owned, processed, or managed by the organization, and to set forth the responsibilities of personnel who access those assets.

Policy Owner and Effective Date

Effective Date:

Scope of Policy

This policy applies to all employees, contractors, consultants, temporaries, vendors, and other personnel who access information systems or handle the organization’s data in any format, including electronic, paper, and verbal information.

Definitions

For the purposes of this policy: "Information assets" means data, systems, applications, and infrastructure; "Confidential information" means data that if disclosed could cause harm to the organization or its stakeholders.

Roles and Responsibilities

The Chief Information Security Officer (CISO) is responsible for policy governance, risk assessment oversight, and program enforcement. IT Operations is responsible for technical controls and change management. Managers must ensure personnel comply with assigned controls. All personnel must follow the rules and report suspected incidents immediately.

Access Control

Access to systems and data will be granted on a least-privilege, need-to-know basis. Account provisioning, deprovisioning, and periodic access reviews are mandatory. Multi-factor authentication is required for remote access and for accounts with administrative privileges.

Password minimum length: characters. Password rotation frequency (days):

Data Classification and Handling

All information must be classified as Public, Internal, Confidential, or Restricted. Handling, storage, transmission, and disposal practices must align with the classification level to prevent unauthorized disclosure, alteration, or loss.

Encryption and Cryptography

Encryption is required for Confidential and Restricted data in transit and at rest using industry-accepted cryptographic algorithms and key management practices. Keys must be stored and rotated in accordance with the organization’s key management procedures.

Physical and Environmental Security

Physical access to critical systems is restricted and logged. Facilities housing sensitive systems must have appropriate controls against unauthorized entry, environmental hazards, and theft.

Incident Response and Reporting

All incidents affecting confidentiality, integrity, or availability must be reported immediately to the incident response team. Incidents will be triaged, contained, eradicated, and documented. Post-incident analysis is required and corrective actions must be tracked to closure.

Third-Party and Vendor Security

Vendors with access to organizational data must demonstrate security controls consistent with this policy. Third-party agreements must include security obligations and the right to audit or evidence of controls where required by contract or risk assessment.

Training and Awareness

All personnel must complete security awareness training at hire and annually thereafter. Additional role-based training is required for personnel with elevated privileges or sensitive duties.

Monitoring, Audit, and Compliance

Systems shall be monitored for security events and logs retained in accordance with retention requirements. Regular audits and risk assessments will be performed to validate control effectiveness and compliance with this policy.

Policy Violations and Sanctions

Non-compliance with this policy may result in disciplinary action up to and including termination of employment or contract, civil liability, and criminal prosecution where warranted. Managers must escalate violations to Human Resources and the CISO for review.

Policy Review and Amendment

This policy will be reviewed at least annually or following a significant security event, change in law, or material change to systems or business operations. Amendments must be approved by the designated Approving Officer.

Confidentiality and Legal Compliance

Confidential information covered by this policy must be handled in a manner consistent with applicable privacy and confidentiality laws and contractual obligations. Personnel must not disclose restricted information except as required for legitimate business purposes and in accordance with approved procedures.

Governing Law and Authority

This policy shall be governed by and construed in accordance with the laws applicable to the organization’s principal place of business. Nothing in this policy limits rights or remedies available under applicable law.

Entire Policy

This document constitutes the entire Information Security Policy of the organization with respect to the subject matter herein and supersedes all prior policies and statements on this subject. If any provision is held unenforceable, remaining provisions remain in effect.

Acknowledgment

By signing below, the Approving Officer affirms that the policy has been reviewed and approved for publication. By signing below, the Acknowledging Representative confirms they have read, understand, and will comply with the policy.

Sign Now