Drift och säkerhet

Information security policy Scope This policy defines the purpose, direction, principles, and basic rules for the information security management system (ISMS) at Addsystems. General objectives Addsystems strives to minimize the risk of security incidents and ensure that internal and client data is managed in a secure manner. We preserve confidentiality, integrity, and availability through a structured risk management process and by meeting all legal, regulatory, and contractual requirements. Addsystems conducts long-term and systematic information security work based on ISO 27001. We follow up on information security performance by reporting deviations, managing deficiencies, assessing risks, and reporting incidents to relevant authorities when required. Our goals and activities are defined using updated analyses of interested parties and risk assessments and by using a SWOT. Goals •The information at Addsystems including client data is protected at an appropriate administrative and technical level, based on completed information security classifications and risk analyses. •To be an organization with a clear division of responsibilities for information resources and with relevant roles for management and implementation of systematic information security work. •All employees must be familiar with this policy and thereby be observant on risks, suggest improvements, in combination with seeking necessary information to live up to this policy. The company will provide relevant training on fixed intervals for all employees. The CEO must ensure that sufficient resources are available to maintain and improve the ISMS. Responsibility The Management Team is accountable for the ISMS and must annually review this policy, evaluate objectives, and ensure that internal audits are conducted. The ISMS Steering Committee is responsible for decisions related to significant changes to the ISMS. The ISMS Team coordinates the ongoing operational work