Information Security
This page preserves the intent of the existing policy: use ISMS as a management framework, protect confidentiality, integrity and availability, and make monitoring, review, audit, training and continuity a shared responsibility.
Enable the information security management system to operate effectively, remain supervised and improve continuously while protecting confidentiality, integrity and availability and giving colleagues clear daily guidance.
Core principles
Apply information security management across the organization, protect business data and systems, reduce risks from disclosure, damage, loss and improper management, and continue monitoring, review and audit.
Use training and maintained procedures so people understand and apply their responsibilities, helping important operations continue or recover quickly when incidents occur.
Establish directions for emergency response, notification, backup and disaster recovery to reduce impact on people, data, systems, equipment and networks.
Every colleague has a duty to participate in and maintain information security management for people, data, information systems, equipment and networks.
The management system should be monitored continuously, reviewed regularly and audited as needed so risk remains acceptable and service quality keeps improving.
Training, continuity planning, emergency response and disaster recovery reduce disruption to services and operations when unexpected events occur.