Incident Management Information Risk Management Maintenance of planned ISMS Program Goals To manage and minimise the risks to an acceptable level through the design, implementation and maintenance of a formal Information Security Management System (ISMS). To comply with Legislation including (but not limited to): Applicable legislation, regulatory and customer requirements; Commitment to be in compliance with ISO 27001: 2013. Commitment to achieve continual improvement by adherence to security and governing best practices, wherever applicable. Methodology Specific policies / practices exist to support the methodology, that include mandatory requirements to ISO 27001, some of which are referred (not exhaustive): ISMS Roles and responsibilities Risk Assessment and Risk Treatment Procedure Acceptable Usage Policy for all end users Incident and Weakness Management Procedure Non-Disclosure Agreement with all employees & business partners Responsibilities In order to operate the ISMS a separate forum with the management exists which combines representations form all units of the organisation, and consists of the following key roles: Steering Committee ISMS Manager Head of departments Internal Auditors (internal and external) All Personnel The ISMS Manager is a role that facilitates the implementation of this policy through the appropriate policies and practices. Each department head/team leader promotes information security within their respective teams thereby ensuring that all personnel have a responsibility to follow the policies and practices to maintain the ISMS. Disciplinary Action Any deliberate attempt to jeopardise the information assets or the supporting infrastructure will be subject to disciplinary action, including but not limited to immediate termination.
Incident Management Information Risk Management Maintenance of planned ISMS Program Goals To manage and minimise the risks to an acceptable level through the design, implementation and maintenance of a formal Information Security Management System (ISMS). To comply with Legislation including (but not limited to): Applicable legislation, regulatory and customer requirements; Commitment to be in compliance with ISO 27001: 2013. Commitment to achieve continual improvement by adherence to security and governing best practices, wherever applicable. Methodology Specific policies / practices exist to support the methodology, that include mandatory requirements to ISO 27001, some of which are referred (not exhaustive): ISMS Roles and responsibilities Risk Assessment and Risk Treatment Procedure Acceptable Usage Policy for all end users Incident and Weakness Management Procedure Non-Disclosure Agreement with all employees & business partners Responsibilities In order to operate the ISMS a separate forum with the management exists which combines representations form all units of the organisation, and consists of the following key roles: Steering Committee ISMS Manager Head of departments Internal Auditors (internal and external) All Personnel The ISMS Manager is a role that facilitates the implementation of this policy through the appropriate policies and practices. Each department head/team leader promotes information security within their respective teams thereby ensuring that all personnel have a responsibility to follow the policies and practices to maintain the ISMS. Disciplinary Action Any deliberate attempt to jeopardise the information assets or the supporting infrastructure will be subject to disciplinary action, including but not limited to immediate termination.
Policy-Information-Security-Management-System.docx