1. Commitment to Information Security
The Board of Directors and management of Absolute Networks, located at The Cavendish Building, Agard Street, Derby, operating in the IT services sector, are fully committed to preserving the confidentiality, integrity, and availability of all physical and electronic information assets across the organisation. This commitment ensures the protection of Absolute Networks’ competitive edge, financial stability, legal and regulatory compliance, contractual obligations, and corporate reputation.
Absolute Networks will align its information security requirements with its strategic goals. The Information Security Management System (ISMS) serves as a mechanism to facilitate secure information sharing, ensure efficient electronic operations, and mitigate information-related risks to acceptable levels.
2. Scope of the Policy
This policy applies to all employees, contractors, consultants, and external parties who access or handle Absolute Networks’ information assets. The ISMS encompasses all business functions, physical locations, and systems, including outsourced functions and cloud services, as identified in the Statement of Applicability.
3. ISMS Framework and Risk Management
Absolute Networks’ ISMS is established and maintained in alignment with ISO 27001:2022 standards. The ISMS framework integrates with the organisation’s business strategy and risk management practices. Key elements include:
- Risk Assessment and Treatment: Information-related risks are identified, evaluated, and controlled through a structured risk management framework. The Risk Register and Statement of Applicability document the controls in place to address these risks.
- Continuous Improvement: The ISMS undergoes systematic review and refinement to adapt to evolving threats, business requirements, and technological advancements.
- Responsibility and Accountability: The Head of Risk oversees the risk treatment plan’s management and maintenance. Additional risk assessments are conducted when necessary.
4. Security Objectives
Absolute Networks sets defined, measurable information security objectives in accordance with its business goals, operational context, risk assessments, and legal and regulatory requirements. These objectives are reviewed regularly to ensure relevance and effectiveness.
5. Control Measures
Absolute Networks implements and maintains documented policies and procedures to achieve the following control objectives:
- Business Continuity and Contingency Planning: Ensure resilience and recovery capabilities to minimise disruptions.
- Data Backup and Restoration: Maintain secure, reliable backups of critical data to prevent loss.
- Cybersecurity Measures: Protect systems and networks from viruses, malware, and unauthorised access.
- Access Control: Restrict access to information and systems to authorised personnel only.
- Incident Management: Establish processes for reporting, managing, and mitigating security incidents.
6. Training and Awareness
All employees, contractors and relevant external parties will receive mandatory information security awareness training. Specialised training will be provided to personnel with roles that require deeper knowledge of specific security practices. The consequences of non-compliance are defined in the disciplinary policy and third-party agreements.
7. Legal, Regulatory, and Certification Requirements
Absolute Networks is committed to:
- Maintaining certification of its ISMS to ISO 27001:2022.
- Ensuring compliance with the General Data Protection Regulation (GDPR) and other applicable legal and regulatory requirements.
- Regularly reviewing and updating policies in response to changes in regulations or business context.
8. Definitions
- Information Security: Preserving the confidentiality, integrity, and availability of information assets.
- Confidentiality: Preventing unauthorised access to information.
- Integrity: Ensuring the accuracy and completeness of information and systems.
- Availability: Ensuring information and systems are accessible to authorised users when required.
- Assets: Includes physical assets (e.g., hardware, cabling, and physical documents) and information assets (e.g., electronic data, software, and communication systems).
- ISMS: The Information Security Management System is a comprehensive set of policies, procedures, and controls designed to manage information security risks effectively.
- Security Breach: Any incident that compromises the availability, confidentiality, or integrity of Absolute Networks’ information assets.
9. Review and Maintenance
This policy will be reviewed at least annually or whenever significant changes occur in the organisation’s risk profile, regulatory requirements, or operational context. The review process ensures the policy remains relevant and effective in addressing emerging challenges.
10. Leadership and Governance
The Board of Directors and senior management demonstrate leadership and commitment by supporting the ISMS and allocating the necessary resources to achieve its objectives. They ensure that security policies are communicated, understood, and implemented across all levels of the organisation.
11. Stakeholder Engagement
Absolute Networks recognises the importance of engaging stakeholders, including clients, partners, and regulatory bodies, to ensure alignment with security requirements and mutual trust.
This policy is integral to Absolute Networks’ commitment to robust information security and continuous improvement.