Information security policy

Preface and document control

This document is intended to provide information security policy, procedure, standards, or guidance in respect of TBTL and shall be reviewed at least annually to ensure validity.

Neither all nor part of this document shall be reproduced or released by a recipient without the explicit authorisation.

Purpose

To be defined as “to outline The Blockhouse Technology Limited (TBTL)’s approach to information security management and provide guiding principles and responsibilities to ensure TBTL’s security objectives are met and given appropriate priority alongside its commercial enterprise.”

Scope

This policy is applicable to TBTL Oxford and individually applies to:

All individuals who have access to TBTL information and technologies.
All facilities and systems that are used to process information.
All information processed in any format by TBTL pursuant to its activities.
Internal and External processes used to handle TBTL information.
External parties that provide information processing services.

Information Security policy

Information is critical to TBTL’s operations and failure to protect information increases the risk of financial and reputational losses. TBTL is committed to protecting information, in all its forms, from loss of confidentiality, integrity and availability ensuring that:

Objectives

To establish and embed a culture to ensure that all activities consider and encompass information security
To establish controls over the Company’s flow of information, to prevent loss, whether accidental or intentional
To keep staff aware of their responsibilities
To identify and manage information risks
To ensure business continuity with respect to information security
To enable authorised users to perform their roles
To ensure and reinforce the proper qualifications and expertise of staff involved in information processing or the security of information
To ensure that the technologies and services properly balance usability and security
To meet contractual, regulatory, and legal obligations with respect to information security
To handle and resolve incidents in an industry standard way, to learn from them and to enhance security as a result.

The Framework

Information and intellectual property are critical to operations, and a failure to protect information increases the risk of loss and harm. TBTL commits to protect information in all its forms from loss of confidentiality, integrity, and availability:

All information processing shall comply with applicable security law in the countries in which TBTL operates
All staff read through the handbook and info sec documents and confirm they agree to all policies and procedures
Risks to be managed and risk assessments on IT and business systems performed
All infosec requirements to be specified in agreements with third-party suppliers that need access to any confidential or business critical data, and compliance to be monitored
Security controls are to be implemented to protect facilities and services that are processing TBTL information
Any infosec incidents are to be reported in a timely manner via appropriate management channels, and those incidents to be properly investigated and managed, following the data breach procedure
Information Assets are to be identified, and their owners defined; to be classified based on their sensitivity.

The policy and its baseline controls are to be communicated fully and effectively to users internally, and to external parties where relevant.

The policy is to provide the foundation of a pragmatic information security framework, TBTL has implemented a set of minimum information security controls, these can be found in the handbook and as separate policy documents.

Responsibilities

The following bodies and individuals have specific information security responsibilities:

The General Manager is accountable for the effective implementation of this information security policy, and supporting information security rules and standards, within TBTL Oxford. The CEO is responsible in the General Manager’s absence
The Directors have executive responsibility for information security within TBTL. Specifically for overseeing the management of the security risks to TBTL, its infrastructure and its information
The General Manager and IT Manager are jointly responsible for establishing and maintaining TBTL’s information security management framework to ensure the availability, integrity, and confidentiality of TBTL information. The General Manager and IT Manager will lead on the definition and implementation of the TBTL information security arrangements
The IT Manager is responsible for ensuring that security guidance is available and carried out. They will appoint a suitable temporary replacement in their absence with TBTL’s agreement
Users are responsible for making informed decisions to protect the information that they process.

Compliance

TBTL will endeavour to make sure that objectives and the requirements of this policy are met. Wilful failure to comply will be treated extremely seriously and may result in enforcement action.

Review and Development

This policy, and supporting documentation, shall be reviewed, and updated by The General Manager and IT Manager on an annual basis to ensure they:

remain operationally fit for purpose
reflect changes in technologies
are aligned to industry best practice; and
support continued regulatory, contractual, and legal compliance.

This information security policy shall be read alongside the Acceptable Use Policy and Mobile Device Policy.