Information security policy

Purpose#

To protect the confidentiality, integrity and availability of customer data and of the systems that deliver Rang & Mall's services, and to meet the commitments made to customers.

Policy#

1. Rang & Mall operates an information security program made of the policies numbered 10 to 25 on this site, the control matrix, and the compliance playbook. Where they overlap, the stricter rule applies.
2. Every policy names an owner, is approved by the directors, is reviewed at least yearly, and is acknowledged by personnel at hire and yearly.
3. Security roles are assigned in the owners table. One person may hold several roles, except that the author and the approver of a production change must be different people.
4. The directors review the program at least quarterly: open risks, incidents, control exceptions, audit findings, and the roadmap. Minutes are kept GOV-03.
5. Control owners self-assess their controls each quarter and record exceptions as tickets with an owner and a due date MON-01, MON-03.
6. Risks are managed under 23 Risk management.
7. Customer commitments about security (terms, DPA, security page, sales answers) must describe controls that operate today. A commitment that is not yet true is not made. Red line 1 of the universal baseline applies to every security claim.

Exceptions#

An exception to any policy is requested in writing with the reason, the risk, the compensating control, and an expiry date no longer than 12 months. The Security Owner approves or refuses. Approved exceptions are listed in the risk register and reviewed quarterly. An expired exception is a violation.

Violations#

Violations are handled under 11 Code of conduct and acceptable use.

Policy index#

Approval#