Purpose
The purpose of this policy is to define the organization’s commitment to protecting information assets and to establish a framework for the Information Security Management System (ISMS).
Scope
This policy applies to all employees, contractors, systems, processes, and information assets within the organization, regardless of format or location.
Policy Statement
The organization is committed to protecting the confidentiality, integrity, and availability of information and to managing information security risks in line with business objectives and applicable requirements.
Commitments
The organization shall:
- Protect information assets against unauthorized access, disclosure, alteration, and loss
- Establish and review measurable information security objectives
- Identify, assess, and treat information security risks systematically
- Maintain and continually improve the ISMS
- Ensure compliance with applicable legal, regulatory, and contractual requirements
- Provide awareness and training so that personnel understand their security responsibilities
- Report and respond promptly to information security incidents
Responsibilities
- Top Management is responsible for establishing, implementing, and maintaining this policy and for providing the necessary resources
- Employees and contractors are responsible for adhering to this policy and for reporting security incidents and weaknesses
Review
This policy shall be reviewed periodically to ensure its continuing suitability and alignment with organizational objectives.
