The Service
Policies & Initiatives
The objective of this Information Security & Compliance Policy is to protect the information assets processed by HFRS from all appropriate threats, whether internal or external, deliberate or accidental.
In support of this objective, HFRS are fully committed to information security and shall:
This Information Security & Compliance Policy establishes the requirements HFRS have for achieving and maintaining compliance with all information security policies, processes, guidelines, and applicable legislation.
This Information Security & Compliance Policy shall apply to:
•All employees who use HFRS information assets and information processing facilities regardless of whether they are processed electronically or in paper form.
•All external third parties that provide services to HFRS in respect of information processing facilities.
This Information Security & Compliance Policy states that HFRS shall ensure that:
In support of this Information Security & Compliance Policy, more detailed security policies and processes shall be developed for employees, information assets and information processing facilities.
Activities related to the use of information assets and information processing facilities shall be monitored to ensure that HFRS requirements for confidentiality, integrity, and availability are maintained. Employees with access to information assets and information processing facilities shall be responsible for reporting any suspicious activity, security breaches or security violations to IT.
Senior Managers shall ensure continuous compliance monitoring within their area of jurisdiction. Compliance with HFRS security policies shall be a matter for periodic review by IT. Non-compliance with security policies, standards and processes shall result in corrective action by management.
The Senior Management Team of HFRS shall be accountable for ensuring that appropriate security and legal controls are identified, implemented and maintained by information owners. They shall be supported in this task by all employees.
The role and responsibility for managing information security at an operational level shall be performed by the Information Security Officer.
Information owners within HFRS shall be responsible for the identification, implementation and maintenance of controls that are commensurate with the value of the information assets they own and the risks to which they are exposed.
It is the responsibility of all employees to adhere to this Information Security & Compliance Policy.
Non-compliance with this Information Security & Compliance Policy by any employee shall result in disciplinary action.
The Senior Management Team of HFRS has approved this Information Security & Compliance Policy.
