Classification: Low
3.0 | Edward Robinson | Additions/changes as part of the annual review. Added links to folders on the new anDREa Google Workspace. Added link to HR Manual under 7.2. Added 'objectives' under 7.5.2. |
anDREa B.V. (hereafter called anDREa) is committed to protecting the security of its business information in the face of incidents and unwanted events and has implemented an Information Security Management System (ISMS) that is compliant with ISO/IEC/27001:2017, the international standard for information security.
The purpose of this document is to describe anDREa’s commitment to support the ISMS.
This document will be updated at least annually and when significant change happens.
The objective of this control is:
To determine and provide the resources needed for the establishment, implementation, maintenance and continual improvement of the ISMS (7.1).
To assess competence of the employees (7.2).
To increase and maintain information security awareness (7.3).
To determine the need for internal and external communications relevant to the ISMS (7.4).
To control documented information (7.5).
The scope of this document is described in Clause 4 Context of the organisation.
Availability
This document is:
required reading for:
all employees and contractors of anDREa.
available for all interested parties as appropriate.
a) determine the necessary competence of person(s) doing work under its control that affects its information security performance;
b) ensure that these persons are competent on the basis of appropriate education, training, or experience;
c) where applicable, take actions to acquire the necessary competence, and evaluate the effectiveness
of the actions taken; and
d) retain appropriate documented information as evidence of competence.”
a) the information security policy;
b) their contribution to the effectiveness of the information security management
system, including the benefits of improved information security performance; and
c) the implications of not conforming with the information security management
system requirements.”
a) on what to communicate;
b) when to communicate;
c) with whom to communicate;
d) who shall communicate; and
e) the processes by which communication shall be effected.”
a) documented information required by this International Standard; and
b) documented information determined by the organisation as being necessary for the effectiveness of the information security management system.”
a) identification and description (e.g. a title, date, author, or reference number);
b) format (e.g. language, software version, graphics) and media (e.g. paper, electronic); and
c) review and approval for suitability and adequacy.”
The front page will at least have:
The title of the document.
Version number.
Review date of the document.
Classification.
Version management table with authors, changes and approval date.
Approval date will be linked to a ticket or article, where explicit approval by management has been given.
Rules of version change:
Prior to changes, a copy is made with a timestamp after the file name in the format: <title>_YYYY-MM-DD. The time stamp is the date at which the copy was made and implies that the document was valid until that day.
Archived versions are stored in anDREa's Google Workspace.
A version number is incremented to a whole number when the document is periodically revised (annual review).
The version number is raised by 0.1 if changes are made in between the periodically revision periods.
The following elements are (at least) present in policies:
Purpose & background.
Scope.
Objectives.
Availability.
Description of the norm elements.
If applicable, administrations.
a) it is available and suitable for use, where and when it is needed; and
b) it is adequately protected (e.g. from loss of confidentiality, improper use, or
loss of integrity)
For the control of documented information, the organisation shall address the
following activities, as applicable:
c) distribution, access, retrieval and use;
d) storage and preservation, including the preservation of legibility;
e) control of changes (e.g. version control); and
f) retention and disposition.
Documented information of external origin, determined by the organisation to be necessary for the planning and operation of the information security management system, shall be identified as appropriate, and controlled.”