Isms Doc 5

Document Control
Reference: ISMS DOC 5

INFORMATION SECURITY POLICY Issue No: 5
(TIER 1) Issue Date: 28 June 2018
Page: 1 of 3
1. Purpose
The purpose of this document is to define the role that Arkk Solutions’ top
management takes in the Information Security Management System (ISMS). In
particular, this ensures the commitment to information security, the development
and propagation of the information security policy, and the assignment of
appropriate information security roles, responsibilities and authorities.
2. Scope
To define Arkk Solutions’ information security policy and ensure the appropriate
information security roles, responsibilities and authorities are assigned.
3. Responsibilities
The Board of Directors of Arkk Solutions is responsible for setting and approving the
information security policy.
The Chief Technology Officer (CTO) is responsible for ensuring that roles,
responsibilities and authorities are appropriately assigned, maintained and updated
as necessary.
All employees are responsible for adhering to the requirements of the information
security policy and for fulfilling any duties related to assigned roles, responsibilities
or authorities.
4. Information Security Policy
The information security policy is developed in accordance with both clause 5.2 of
ISO 27001 and Annex A control 5.1.1. All information security policies are reviewed
in accordance with Annex A control 5.1.2.
The Board of Directors and management of Arkk Solutions, located at 44-46 New Inn
Yard, London EC2A 3EY, which operates in the financial services sector, helping
organisations transform internal data for submissions to regulators are committed to
preserving the confidentiality, integrity and availability of all the physical and
electronic information assets throughout their organisation in accordance with the
scope outlined below, in order to preserve its competitive edge, cash-flow,
profitability, legal, regulatory and contractual compliance and commercial image.
5. Scope Statement
This ISMS covers the delivery of software and services that enable customers to
transform internal financial data for submission to regulatory bodies, including
managing clients’ data, from the London and Belfast Offices.
Public
Document Control
Page: 2 of 3
Third party service providers (including information processing service providers) are
beyond the scope, however assurance exists in the form of contractual agreements,
and the review of these is within the scope.
6. ISMS Establishment and Objectives
Arkk Solutions’ current strategic business plan and risk management framework
provide the context for identifying, assessing, evaluating and controlling
information-related risks through the establishment and maintenance of an ISMS.
The Risk Assessment, Statement of Applicability and Risk Treatment Plan identify
how information-related risks are controlled.
Arkk Solutions aims to achieve specific, defined information security objectives,
which are developed in accordance with the business objectives, the context of the
organisation, the results of risk assessments and the risk treatment plan. Arkk’s
ISMS aims to achieve the following information security objectives:
• To improve information security governance within Arkk
• To assist in conforming to regulations, and complying with relevant laws.
• To protect confidentiality, integrity, and availability of Arkk’s information, and
that of interested parties where relevant.
• To be adhered to by all employees, and third parties, where relevant.
• To offer a framework for the effective functioning of an Information Security
Committee.
All employees of Arkk Solutions, contractors, and certain external parties identified
in the ISMS are expected to comply with this policy and with the ISMS that
implements this policy. All employees and certain external parties, will receive
appropriate training. The consequences of breaching the information security policy
are set out in Arkk Solutions’ disciplinary policy and in contracts and agreements
with third parties. Any observed or suspected security breaches are to be reported.
The ISMS is subject to continual, systematic review and improvement. Arkk
Solutions has established an Information Security Committee, chaired by the CTO,
and including the Information Security Manager and Executive Assistant to support
the ISMS framework and to periodically review the security policy. Arkk Solutions is
committed to achieving by June 2016, and maintaining thereafter, certification of
its ISMS to ISO27001:2013.
This policy will be reviewed to respond to any changes in the risk assessment or
risk treatment plan and at least annually.
In this policy, ‘information security’ is defined in accordance with ISO 27000:2014

as the “preservation of confidentiality, integrity and availability of information”.
The ‘ISMS’ is the Information Security Management System, of which this policy,
the Information Security Manual (‘the Manual’) and other supporting and related
documentation is a part. The ISMS has been designed in accordance with the
specification contained in ISO 27001:2013, and externally certified as being fully
compliant with these specifications.
Public
Document Control
Page: 3 of 3
A ‘security breach’ is any incident or activity that causes, or may cause, a break
down in the availability, confidentiality or integrity of the physical or electronic
information assets of Arkk Solutions.
7. Organisational roles, responsibilities and authorities
Relevant roles and responsibilities with regard to information security and the ISMS
are expanded upon in all the relevant ISMS documentation.
These roles and responsibilities are determined by top management on the basis of
ensuring that the ISMS conforms to the requirements of ISO 27001:2013.
Document Owner and Approval
The CTO is the owner of this document and is responsible for ensuring that this
policy document is reviewed in line with the requirements in Clause 5.1.2 in the
Manual.
A current version of this document is available to all members of staff on Arkk

Solutions’ SharePoint. It does not contain confidential information and can be
released to relevant external parties.
This information security policy was approved by the Board of Directors on 6th May
2016 and is issued on a version controlled basis under the signature of the CTO.
Public

Isms Doc 5

Uploaded by

Copyright:

Available Formats

Isms Doc 5

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Isms Doc 5

Uploaded by

Copyright:

Available Formats

Document Control

Reference: ISMS DOC 5

4. Information Security Policy

In this policy, ‘information security’ is defined in accordance with ISO 27000:2014

7. Organisational roles, responsibilities and authorities

Document Owner and Approval

A current version of this document is available to all members of staff on Arkk

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.