InfoSec Resources

Overview

The security policy site set details the high level security principles for ThingLogix Inc. and establishes the framework under which each of the other sections of the security document set should be interpreted, managed and applied. The overall purpose of this policy site is to provide both an overview of ThingLogix information security requirements and standards and a detailed reference document repository which may be used to address specific queries on information security. 

This security policy applies and will be available to all staff in whatever capacity. It is also relevant as evidence of good, recognized information security practices during internal or external audit processes. Relevant sections of the policy may also be used as a reference point in negotiating or agreeing contracts with external suppliers. 

Policy and Procedure Statement

This policy has been developed for use across the whole the whole company and complies with the requirements of widely recognised good information security practice. It will: 

• Assist staff to apply the correct level of security control to their day to day activities in line with good practice and applicable regulation and legislation. 

• Be formatted, controlled and distributed in line with ThingLogix requirements. 

• Assist with the development and commissioning of new processes and systems by detailing the required security settings and standards. 

The policy will be available, as the correct up to date version, on the intranet to all staff. Any departments or staff who have a requirement to store or otherwise use hard copies of this policy should ensure that they frequently check that they have the latest version of the policy and refer any queries to the information security team. They should also ensure that any old, outdated versions of this document are destroyed and replaced as necessary. 

The Importance of Information Security 

Information can be defined as useful data for a particular analysis, decision or task. Information must always be protected appropriately irrespective of how it is stored, presented or communicated. The main aims of information security are to preserve: 

• Confidentiality: ensuring that information is accessible only to those who are authorized to have access. 

• Integrity: safeguarding the accuracy and completeness of information and processing methods. 

• Availability: ensuring that authorized users have access to information when needed. It also aims to support the requirements.

• Accountability: accounting for the actions of individuals by monitoring their activities. 

• Non-Repudiation: legally acceptable assurance that transmitted information has been issued from and received by the correct, appropriately authorized, individuals. 

ThingLogix has a responsibility to securely manage its information assets, the information made available to it by providers, and the people who use providers’ services, as well as that provided by its own employees, contractors, and business partners, and to protect that information from unauthorized disclosure, loss of integrity or availability. 

All parts of the organization are responsible for making sure that information is protected adequately. Senior management are responsible for issuing and endorsing this Security Policy. They recognize the sensitive nature of the information that the organization stores and processes, and the serious potential harm that could be caused by security incidents affecting this information. They will therefore give the highest priority to information security. This will mean that security matters will be considered as a high priority in making any business decisions. This will help ThingLogix to allocate sufficient human, technical and financial resources to information security management, and to take appropriate action in response to all violations of Security Policy.  ThingLogix will use this Security Policy as the basis for an organisation-wide strategy to set the correct level of information security. The security efforts will be: 

Coordinated: security measures will be based on a common framework provided by the Security Policy, and all staff will be involved in maintaining compliance with the security policy. 

Proactive: we will detect, identify and manage vulnerabilities, threats, and security gaps to prevent security incidents as far as we possibly can. 

Supported at the highest level: the executive team are actively committed to information security, own this policy/procedure website, and give their full support to implementing the required security controls that are identified through a continuous risk assessment process. These security efforts will be structured and directed by the Security Policy, which covers all aspects of information security within ThingLogix’s business operations. 

Last Reviewed: Aug, 2022