Information Security Policy

Last Reviewed 30/01/2024

Introduction

Andy Gardner Web Design (the organisation) is committed to protecting the confidentiality, integrity, and availability of its information assets. This policy outlines the guiding principles and procedures for maintaining the security of our information.

Scope

This policy applies to all the organisation employees, contractors, consultants, temporary workers, interns, and other personnel (personnel) who have access to our information systems and data. It also applies to all information systems, networks, and data owned, operated, or managed by the organisation.

Policy

Security Officer

Andrew Gardner acts as the Security Officer.

Access Control

  1. Access to information systems and data must be granted based on the principle of least privilege, meaning that users must have only the minimum permissions necessary to perform their job functions.
  2. Access requests must be approved by the relevant manager and documented.
  3. User accounts must be assigned to individuals and not shared among multiple people.
  4. Passwords must be strong, unique, and kept confidential.

Data Security

  1. All sensitive data must be encrypted at rest and in transit.
  2. Data backups must be performed regularly and stored securely offsite.
  3. Data must be classified into different categories based on its sensitivity, and appropriate security controls must be applied to each category.

Incident Management

  1. All security incidents must be reported to the Security Officer immediately.
  2. The Security Officer must investigate and respond to security incidents promptly and effectively.
  3. The incident response procedure must include steps for containment, eradication, recovery, and post-incident activities.

Malware Protection

  1. Anti-virus software must be installed and updated on all devices.
  2. Malware scans must be performed regularly.
  3. Suspicious emails and attachments must be avoided, and employees must not open files from unknown sources.

Bring Your Own Device (BYOD)

  1. Personnel are allowed to use their personal devices for work purposes, but they must adhere to the organization’s security policies and procedures.
  2. Personal devices must meet the organization’s security standards, including up-to-date anti-virus software and strong passwords.

Remote Working

  1. Remote working must be approved on an as needed basis and must comply with the organization’s security policies and procedures.
    1. Remote access to the organization’s information systems must be secured using VPN or other approved remote access tools.

Compliance

  1. The organization must comply with all relevant laws and regulations related to information security.
  2. The organization must maintain best practice aligned with industry-standard certifications and compliance frameworks, such as ISO 27001 or NIST Cybersecurity Framework.

Training and Awareness

  1. The organization must provide regular training and awareness programs for personnel on information security best practices.
  2. Personnel must understand their roles and responsibilities in maintaining information security.

Third-Party Suppliers

  1. The organization must evaluate the information security risks associated with third-party suppliers before engaging in business with them.
  2. The organization must ensure that third-party suppliers comply with its information security policies and procedures.

Monitoring and Review

  1. The organization must continuously monitor and review its information security policies and procedures to ensure they remain effective and relevant.
  2. The organization must conduct regular security audits and penetration testing to identify vulnerabilities and weaknesses.

Conclusion

Information security is everyone’s responsibility, and we must work together to protect our information assets. Adherence to this policy is mandatory, and failure to comply may result in disciplinary action. This policy will be reviewed annually or whenever there is a significant change in our information systems or business operations.