Information Security Policy

Policy Statement

The Company is committed to safeguarding its information assets from unauthorized access, disclosure, alteration, and destruction. This Information Security Policy establishes the framework for managing and protecting information in alignment with ISO/IEC 27001 standards and applicable legal and regulatory requirements.

Objectives

• Ensure confidentiality, integrity, and availability of information assets.
• Protect information from unauthorized access, disclosure, or misuse.
• Comply with applicable data protection, IT security, and privacy laws.
• Establish a culture of information security awareness across the organization.

Scope and Applicability

This policy applies to all employees, contractors, vendors, consultants, and third parties who have access to the Company's information systems, networks, or data. It covers information stored, processed, or transmitted in any form, including digital, printed, and verbal communication.

Information Security Governance

• The Board of Directors and Management are responsible for approving and reviewing the Information Security Policy.
• The Information Security Officer (ISO) shall oversee implementation and monitoring of security controls.
• Department Heads must ensure compliance within their respective teams and processes.

Key Principles of Information Security

• Confidentiality: Information is accessible only to authorized personnel.
• Integrity: Information is accurate, complete, and safeguarded from unauthorized modification.
• Availability: Information and systems are accessible when required for business operations.
• Accountability: Employees are responsible for protecting Company information under their control.

Information Classification

All Company information shall be classified based on sensitivity and criticality to ensure appropriate protection measures:

• Public: Information approved for public disclosure.
• Internal: Information used for internal business operations.
• Confidential: Sensitive information requiring restricted access.
• Restricted: Highly sensitive information that could cause significant harm if disclosed.

Access Control

Access to Company information systems shall be granted on a need-to-know and least-privilege basis. User access rights shall be reviewed periodically and revoked immediately upon employee separation or role change.

Physical and Environmental Security

• Secure access to offices, data centers, and work areas using ID badges or biometric controls.
• Prohibit unauthorized devices in restricted zones.
• Ensure physical records are stored securely in locked cabinets.
• Implement fire suppression, power backup, and environmental controls in server rooms.

Network and System Security

The Company shall implement appropriate technical measures to protect its networks and systems, including:

• Firewalls, intrusion detection/prevention systems (IDS/IPS), and antivirus software.
• Secure configuration and patch management of IT systems.
• Encryption of sensitive data in transit and at rest.
• Regular monitoring and logging of system activities.

Incident Management

All information security incidents, such as data breaches, malware attacks, or unauthorized access, must be reported immediately to the Information Security Officer. An Incident Response Plan shall be followed to contain, investigate, and remediate the incident.

Data Backup and Recovery

Critical business data shall be backed up regularly and stored securely offsite or on cloud systems with redundancy. Periodic restoration tests shall be conducted to ensure backup integrity and business continuity.

Vendor and Third-Party Security

All vendors and service providers handling Company data must comply with this policy and sign data protection and confidentiality agreements. Third-party systems shall be evaluated for security compliance prior to integration.

Employee Responsibilities

• Adhere to all information security guidelines and report security violations.
• Use strong passwords and multi-factor authentication for system access.
• Avoid downloading unapproved software or sharing sensitive information.
• Secure laptops, mobile devices, and removable media when not in use.

Training and Awareness

The Company shall conduct regular information security awareness programs for all employees. Training shall cover cybersecurity best practices, phishing prevention, data handling, and incident reporting.

Policy Violations and Disciplinary Action

Any violation of this policy may result in disciplinary action, including suspension, termination, or legal action, depending on the severity of the breach. All incidents shall be recorded, investigated, and reviewed by the Compliance and HR Departments.

Policy Review

This policy shall be reviewed annually or upon significant changes in business processes or regulatory requirements. Updates shall be approved by the Board of Directors and communicated to all employees.

Employee Acknowledgment

I acknowledge that I have read and understood the Information Security Policy of the Company I agree to comply with the provisions outlined and to safeguard Company information assets at all times.

Employee Name: __________________________

Signature: ______________________________

Date: _________________________________