Policy
Information Security Policy
To ensure that information security is systematically managed, risks are mitigated through proportionate controls, and the organization maintains compliance with ISO/IEC 27001:2022, ISO/IEC 27002:2022, NIST CSF 2.0, COBIT 2019, and CSA CCM v4.1.
- Type
- Policy
- Version
- 1.3.36
- Date
- 2026-10-27
- Owner
- Chief Information Security Officer
- Approving authority
- Governance Library Maintainer
- Classification
- Public
- Confidentiality
- Public
- Category
- Information Security
- Review frequency
- Annual and upon material threat, framework, or regulatory change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose
- 2. Scope
- 3. Governance and accountability
- 4. Policy statements
- 5. Framework alignment
Frameworks it maps to
Related documents
- Logging and Monitoring Standardsecurity
- Identity and Access Management Policysecurity
- Data Classification and Handling Standardsecurity
- Enterprise Governance and Risk Management Policyrisk
- AI Security and Risk Standardai
- Canada Public Sector GRC Requirements Annexcompliance
Next
All Documents