Introduction
In order to optimise the processes and the quality of the organisation's output, ONEtobeONE business operations must be properly safeguarded and optimized. To achieve this, ONEtobeONE has set up and implemented a management system in accordance with the requirements of ISO 27001. Satisfying the expectations of customers and relevant stakeholders and continuously improving the internal organization is central to this.
A combination of risk inventories, internal project evaluations, laws and regulations compliance checks and internal audits helps to identify possible improvements within the processes of our organization. By analyzing information and implementing improvements based on this information, a learning organization where continuous improvement is central.
The ONEtobeONE Information Security Policy applies to all business functions within the scope of the Information Security Management System and covers the information, information systems, networks, physical environment and people supporting these business functions. This document states the Information Security objectives and the Information Security Policy.
Objective
The objective of Information Security is to ensure business continuity and minimise business damage by preventing and minimising the impact of security incidents. In particular, information assets must be protected in order to ensure:
- Confidentiality i.e. protection against unauthorised disclosure
- Integrity i.e. protection against unauthorised or accidental modification
- Availability as and when required in pursuance of ONEtobeONE business objectives.
Responsibilities
- The management has approved this Information Security Policy.
- Overall responsibility for Information Security rests with the Security officer.
- Day-to-day responsibility for procedural matters, maintenance and updating of documentation, promotion of security awareness, liaison with external organisations, incident investigation, management reporting etc. rests with the Security officer.
- Day-to-day responsibility and liaison with external Organisations for legal compliance including data protection rests with the Security officer.
- All employees or agents acting on ONEtobeONE behalf have a duty to safeguard assets, including locations, hardware, software, systems or information, in their care and to report any suspected breach in security without delay.
- The Security officer is responsible for implementing this Security Policy and for maintaining any of the similarly related documents within this Management System.
- As with other considerations including Quality, Environmental and Health and Safety, Information Security aspects are taken into account in all daily activities, processes, plans, projects, contracts and partnerships entered into by the Organisation.
- The Organisation’s employees are advised and trained on the specific aspects of Information Security, according to the requirements of the Organisation. A confidentiality clause is signed by all members of staff as part of their conditions of contract.
- Adherence to Information Security procedures as set out in ONEtobeONE policies and guideline documents is accepted as being part of the standard operating procedures within the Organisation. Failure to comply will result in disciplinary action being taken.
- In view of ONEtobeONE’s position as a trusted provider of global threat intelligence, hunting and response technology, particular care is taken in all procedures and by all employees to safeguard the information security and data transfer of its clients.
- All statutory and regulatory requirements are met and regularly monitored for changes.
- A Disaster Recovery/Business Continuity Plan is in place. This is maintained, tested and subjected to regular review.
- This Information Security Policy is regularly reviewed and may be amended by the Security officer in order to ensure its continuing viability, applicability and legal compliance, and with a view to achieving continual improvement in the Information Security Systems.