How we protect information under our ISMS.

Scope

This policy applies to all information created or received by IT Security C&T, in any form, and to the people, systems and equipment that handle it. It is the foundation of our Information Security Management System (ISMS) and of every related policy and procedure.

Purpose

The policy defines our information security requirements, based on best practice and relevant standards, for managing information security threats and incidents. Its aim is to reduce risk and protect IT Security C&T from internal and external threats by preserving the confidentiality, integrity and availability of information, in line with ISO/IEC 27001, and to support our operations, mission and strategic objectives.

Policy statement

IT Security C&T protects its information assets, people, intellectual property, computer systems, data and equipment from all threats, whether internal or external, deliberate or accidental, on a cost-effective basis. We protect information assets from unauthorised access, comply with regulatory and legislative requirements, and maintain a high level of competence among our staff.

Access: need-to-know and least privilege

Access to information assets is controlled and restricted on the principles of need-to-know and least privilege. People are given access only to the information and systems their role requires, and only at the level needed to carry out that role.

Risk management

Information security risks are identified, assessed and treated in accordance with the IT Security C&T Risk Management Methodology. Risk decisions are based on the value of the information and assets involved and on the likelihood and impact of the threats they face.

Incidents and vulnerabilities

Security incidents and suspected vulnerabilities are reported, treated and resolved according to their nature. Lessons learned from each incident feed back into our controls, procedures and risk assessments.

Roles and responsibilities

All managers are directly responsible for implementing this policy within their areas and for monitoring their staff's adherence to it. Every member of staff and every third party with access to our information is responsible for following this policy and its supporting policies, standards and procedures.

Compliance with this policy

Compliance with this policy and all supporting policies, standards and procedures is mandatory for staff and third parties. Violations lead to corrective action by management, and any disciplinary action is consistent with the severity of the violation, as determined by an investigation.

Compliance with ISO/IEC 27001

Our ISMS is designed, operated and maintained to meet the requirements of ISO/IEC 27001. This policy, together with our supporting policies and procedures, provides the framework for setting and reviewing information security objectives.

Continual improvement and review

IT Security C&T is committed to continually improving its ISMS and its information security posture. We measure the performance of the ISMS, identify the actions needed to keep it effective, and review this policy at planned intervals and whenever significant changes occur.