Information Security Policy
Our commitments to operating, auditing and continually improving the Information Security Management System.
ISO 27001Information Security Management System
- The organisation forms task teams to run the ISMS.
- The task teams are responsible for operating, auditing and improving the ISMS.
- Risk assessment, control selection, implementation of controls and ongoing risk monitoring are a continuous activity in which all asset owners and employees must take part.
- Management allocates the resources needed to operate and improve the ISMS.
- For the ISMS to be sustained, all staff must receive the necessary information security training.
- The ISMS task team reviews the ISMS at periodic meetings every six months, monitors changing risks and the controls in place, and decides on any corrections needed.
- Top management holds a Management Review meeting once a year.
- An internal audit team is trained to audit the ISMS within the organisation; it monitors the system with a continuous audit mindset and audits it in line with the internal audit plan.
- All sub-policies published under the ISMS are written for their specific subject. Every employee is expected to adopt these policies as working rules and to comply with them.
Our Management Systems
Our other policies
Our quality, security and continuity processes are certified through independent audits under seven ISO standards.
