Information Security Infrastructure

Information security requires a governance structure to ensure a coherent direction with the ability to drive the implementation of the Security Policy within the organization and to ensure the constant monitoring and improvements of the overall security system.

ThingLogix operates an Information Governance Group which will include the Security Manager as well as members of the Executive management team. The primary tasks of the group are to assess and address security-related issues on a regular basis, provide strategic guidance, review and monitor significant information security risks, and take management decisions affecting security.

Information Security Coordination

Meetings will take place as required with staff that have operational or project security responsibilities in the various areas of the organizations. These meetings will take place to address issues, review status, and monitor progress of planned security enhancements or security requirements in projects. Issues raised and actions taken are logged and tracked under the responsibility of the information security manager.

Allocation of Information Security Responsibilities

The Chief Executive Officer has overall responsibility for information security. This is delegated, to the information security manager for all day to day operational aspects of information security. Further delegation of responsibility for specific security issues will be carried out within ThingLogix as appropriate. Information and physical security is also a key responsibility of all employees, and this is regularly communicated.

Senior Manager Information Security

The Senior Manager Information Security (SMIS) is a team member with responsibility for ensuring that information risk policy is developed, implemented, reviewed and its effect monitored. The SMIS will be familiar with information risks and their mitigations, including information risk assessment methodology. They will provide focus for the assessment and management of information risk at board level, providing briefings and reports on matters of performance, assurance and cultural impact. In the area of risk management the SMIS will be supported by department leaders at ThingLogix who's responsibilities include:

• Understand and address the risks to the information assets they own and, provide assurance to the SMIS on the security and use of those assets.
• Ensuring that policies and procedures are followed
• Recognising potential or actual security incidents,
• Consulting the SMIS on incident management,
• Ensuring that the information asset registers are accurate and maintained,
• Regular monthly review access rights to all systems.

Annual Review and Assessment

ThingLogix will conduct a review and assess security policies and procedures annually or as there are major changes to infrastructure, assets or architecture. The annual review will be conducted with a third party reviewer.