The purpose of this Security Policy is to establish a framework for protecting the organization's information assets against unauthorized access, disclosure, alteration, and destruction.

This policy applies to all employees, contractors, and third-party service providers who access or manage the organization's information systems and data.

• All information must be classified according to its sensitivity and importance.
• Classification levels include:
  • Public: Information that can be freely shared.
  • Internal: Information meant for internal use only.
  • Confidential: Sensitive information that requires protection from unauthorized access.
  • Restricted: Highly sensitive information that requires strict access controls.

• Access to information systems must be restricted based on the principle of least privilege.
• All users must have unique user accounts and strong passwords that comply with the organization's Password Policy.
• Multi-factor authentication (MFA) is required for accessing sensitive systems.

• Sensitive data must be encrypted both in transit and at rest.
• Regular backups of critical data must be performed and stored securely.

• An Incident Response Plan (IRP) must be established to address security incidents promptly.
• All employees must report suspected security incidents immediately to the IT Security Team.

• All employees must complete security awareness training annually.
• Training will cover topics such as phishing, social engineering, and secure data handling practices.

• IT Security Team: Responsible for implementing security measures and monitoring compliance with this policy.
• Employees: Responsible for adhering to this policy and reporting any security concerns.

Failure to comply with this policy may result in disciplinary action, up to and including termination of employment or contract.

This policy will be reviewed annually or as necessary due to changes in regulations or organizational structure.

This document is intended for internal use only and should not be distributed outside the organization without proper authorization.