Information security policy
The top-level policy of the ISMS. It applies to everyone who works for d-centralize or its companies, and to all information and systems in the scope.
Annex A controls: 5.1, 5.4, 5.31, 5.35, 5.36, 5.37.
What we want to achieve
Section titled “What we want to achieve”- Our customers’ data and their users’ data stay confidential, correct and available.
- We build secure software on infrastructure we set up securely.
- We meet the law, our contracts and the ISO 27001 standard.
- We find our weak spots before others do and keep improving.
The information security objectives make these goals measurable.
Our commitments
Section titled “Our commitments”- Management provides the time and money the ISMS needs and reviews it every year.
- We meet the applicable requirements: the GDPR, the agreements and SLAs with our customers, and the requirements customers place on their suppliers, such as the BIO for municipalities.
- We continually improve the ISMS through the cycle described in improvement.
Topic-specific policies (5.1)
Section titled “Topic-specific policies (5.1)”| Policy | Covers |
|---|---|
| Access control | Accounts, authentication, access rights, source code |
| Information handling | Classification, transfer, privacy, cryptography, deletion |
| People security | Screening, contracts, confidentiality, remote working |
| Asset management | Inventory, return and disposal of equipment |
| Physical security | Office, equipment, clear desk and screen |
| Supplier management | Suppliers, cloud services, outsourced development |
| Incident management | Reporting and handling incidents, authorities |
| Business continuity | Backups, restore tests, redundancy |
| Change management | Small and big changes, projects, software installation |
| Secure development | Development life cycle, secure coding, testing, licences |
| Operations security | Endpoints, vulnerabilities, monitoring, networks |
The detailed procedures behind these policies are the processes and conventions in this handbook (5.37).
Responsibilities and compliance
Section titled “Responsibilities and compliance”- Management approves this policy and the topic-specific policies. The roles that carry security responsibilities are in leadership.
- Managers and role holders make sure the people they work with follow the policies (5.4, 5.36). The yearly internal audit checks compliance with them.
- The ISMS is reviewed independently by the external Internal auditor and by the certification body (5.35).
- Violations of the policies are handled through the disciplinary process in the people security policy.
Review
Section titled “Review”The Information Security Officer reviews this policy and the topic-specific policies every year, and after significant changes, before the management review. The policies are public in this handbook, so they are available to employees and to interested parties.