Take appropriate corrective and preventive actions Communicate the results and actions to concerned teams and consult with CISO on improvement plans Ensure that the improvements achieve their intended objective 6.2 Information Security Policy - Acceptable Use Information, regardless of its form, is a valuable asset for the organization. The objective of the information security policy is to ensure confidentiality, integrity and availability of information. To instill security culture among all employees that supports the organization’s information security policy and information security strategy. The information security policy shall cover elements on the acceptable use for the end users which will help build a secure environment across the organization. The acceptable use policy shall cover: Information classification and labelling Password management Endpoints (desktop/laptop and mobile devices) Standard configuration disabling vulnerable services and resources Virus/Malware protection Controls to prevent installation unauthorized/non- standard software Logical access Clear desk Internet access policy Email policy Usage of external/portable storage devices Instant messaging and social media Remote access Wireless access 6.3 Business Continuity & Disaster Recovery Framework Business continuity policy& Management The Organization shall have a Business continuity policy, with clearly identified responsibilities
Take appropriate corrective and preventive actions Communicate the results and actions to concerned teams and consult with CISO on improvement plans Ensure that the improvements achieve their intended objective 6.2 Information Security Policy - Acceptable Use Information, regardless of its form, is a valuable asset for the organization. The objective of the information security policy is to ensure confidentiality, integrity and availability of information. To instill security culture among all employees that supports the organization’s information security policy and information security strategy. The information security policy shall cover elements on the acceptable use for the end users which will help build a secure environment across the organization. The acceptable use policy shall cover: Information classification and labelling Password management Endpoints (desktop/laptop and mobile devices) Standard configuration disabling vulnerable services and resources Virus/Malware protection Controls to prevent installation unauthorized/non- standard software Logical access Clear desk Internet access policy Email policy Usage of external/portable storage devices Instant messaging and social media Remote access Wireless access 6.3 Business Continuity & Disaster Recovery Framework Business continuity policy& Management The Organization shall have a Business continuity policy, with clearly identified responsibilities
Draft-Information-And-Cyber-Security-Framework-For-Insurance-Sector.docx