A.6 Organisation of information security
Version: 3.0
Valid until: 2025-03-26
Classification: Low
Version Management
Version | Author(s) | Change(s) | Date approved |
1.0 | Stefan van Aalst Edward Robinson | Initiation document | 2022-05-23
|
1.1 | Edward Robinson | Additions/changes as part of the periodic review and improvement.
Renamed this document to A.6 Organisation of information security from B01 Information security policy. | 2022-12-13
|
2.0 | Edward Robinson | Additions/changes as part of the annual review.
Per recommendation of the internal auditor the link to anDREa's Roles and Responsibilities Matrix including toxic combinations was added. In addition, more special interest groups were added.
| 2023-05-15 |
2.1 | Stefan van Aalst | Updated the link of the responsibility matrix. | |
3.0 | Edward Robinson | Additions/changes as part of the annual review.
Updated link to the responsibility matrix under A.6.1.2 as it did not match the one under A.6.1.1.
| |
Purpose & background
anDREa B.V. (hereafter called anDREa) is committed to protecting the security of its business information in the face of incidents and unwanted events and has implemented an Information Security Management System (ISMS) that is compliant with ISO/IEC/27001:2017, the international standard for information security.
The purpose of this document is to describe the organisation of information security.
This document will be updated at least annually and when significant change happens.
Objective
The objective of this control is:
To establish a management framework to initiate and control the implementation and operation of information security within the organisation (A.6.1).
To ensure the security of teleworking and use of mobile devices (A.6.2)
Scope
The scope of this document is described in Clause 4 Context of the organisation.
Availability
This document is:
Norm elements
A.6.1 Internal organisation
A.6.1.1 Information security roles and responsibilities
“All information security responsibilities shall be defined and allocated.”
A.6.1.2 Segregation of duties
“Conflicting duties and areas of responsibility shall be segregated to reduce opportunities for unauthorised or unintentional modification or misuse of the organisation's assets.”
A.6.1.3 Contact with authorities
“Appropriate contacts with relevant authorities shall be maintained.”
anDREa will maintain appropriate contact with the Autoriteit Persoonsgegevens in case of a data breach.
A.6.1.4 Contact with special interest groups
“Appropriate contacts with special interest groups or other specialist security forums and professional associations shall be maintained.”
anDREa maintains appropriate contacts with:
Microsoft.
Subscription to the Nationaal Cyber Security Centrum (NCSC) RSS feeds.
User reports.
Following websites like bleepingcomputer.com.
A51 security newsletter.
Security Officers of our customers.
A.6.1.5 Information security in project management
“Information security shall be addressed in project management, regardless of the type of project.”
A.6.2 Mobile devices and teleworking
Related Articles
20220607 Security Management Report
As part of anDREa's commitment to maintaining an Information Security Management System (ISMS) based on ISO 27001 please feel free to download and read the attached anDRE's 20220607 Security Management Report.
20220714 Security Management Report Addendum
As part of anDREa's commitment to maintaining an Information Security Management System (ISMS) based on ISO 27001. This document is an addendum to the 20220607 Security Management Report and addresses the on 2022-07-14 reported findings of the ISO ...
20220713 Report Azure White Box Security Audit
Version: 2022-07-14 Introduction anDREa has a Pentest Program program as part of the commitment to protect the security of its business information. At least once a year we request an external party to do the pentest and a white box security audit. ...
20210224 Pentest 2021-Q1 Report & 20210301 White Box Security Audit 2021-Q1 Report
In accordance with our Pentest Program, anDREa engaged nSEC/Resilience for the anDREa White Box Security and the Pentesting 2021-Q1. The core questions being: Can non-authorized people or services access Workspaces or affect anDREa’s core services? ...
A.5 Information security policies
Version: 3.0 Valid until: 2025-03-26 Classification: Low Version Management Version Author(s) Change(s) Date approved 1.0 Stefan van Aalst Edward Robinson Initiation document 2022-05-20 1.1 Edward Robinson Additions/changes as part of the periodic ...