Information security policy Objective Set the tactical direction for information security in an organisation through documented information security policies. Policy requirements Information security policies are to address requirements created by: business strategy regulations, legislation and contracts current and projected information security threat environment. Some consolidation of policies may be warranted depending on the mix of individual organisational security risks and requirements. Procedures Baseline procedures Responsibility Procedure description Organisations must have an information security policy to meet the needs Management of their organisation that is reviewed and updated at least annually. The information security policy must address security principles, security responsibilities, and an ‘acceptable use policy’ for any organisation technology equipment, systems, resources and data. An information security policy document must be approved by management and published, reviewed and communicated regularly to all employees and relevant external parties. Ensure that all employees are aware of the information security policy and System kept informed of any changes and updates. administrator Read, review, understand and follow obligations under the information User security policy.
Information security policy Objective Set the tactical direction for information security in an organisation through documented information security policies. Policy requirements Information security policies are to address requirements created by: business strategy regulations, legislation and contracts current and projected information security threat environment. Some consolidation of policies may be warranted depending on the mix of individual organisational security risks and requirements. Procedures Baseline procedures Responsibility Procedure description Management Organisations must have an information security policy to meet the needs of their organisation that is reviewed and updated at least annually. The information security policy must address security principles, security responsibilities, and an ‘acceptable use policy’ for any organisation technology equipment, systems, resources and data. An information security policy document must be approved by management and published, reviewed and communicated regularly to all employees and relevant external parties. System administrator Ensure that all employees are aware of the information security policy and kept informed of any changes and updates. User Read, review, understand and follow obligations under the information security policy.