Policies

• DOC-01Context, scope and interested parties

  States what this service is, what it runs on, who it affects, and where the boundary of the management system sits.

  27001 Clause 4.1 27001 Clause 4.2 27001 Clause 4.3 42001 Clause 4.1 42001 Clause 4.2 42001 Clause 4.3

• DOC-02Information security policy

  The top-level commitment: what this service protects, what it refuses to do, and what an acceptable use of it looks like.

  27001 Clause 5.2 27001 A.5.1 27001 A.5.10 27001 A.5.36

• DOC-03Roles, responsibilities and authorities

  Who is accountable for what, and an honest statement of what a single operator can and cannot separate.

  27001 Clause 5.3 27001 A.5.2 27001 A.5.4 42001 Clause 5.3 42001 A.3.2 42001 A.10.2 42001 A.4.6

• DOC-04Risk assessment process

  How a risk to this service is identified, analysed and evaluated, and the criteria that decide whether it is acceptable.

  27001 Clause 6.1.1 27001 Clause 6.1.2 27001 Clause 8.2 42001 Clause 6.1.2 42001 Clause 8.2

• DOC-05Risk treatment process

  How a decision is taken between treating, accepting, avoiding and sharing a risk, and how the resulting plan is approved and verified.

  27001 Clause 6.1.3 27001 Clause 8.3 42001 Clause 6.1.3 42001 Clause 8.3

• DOC-06Statement of Applicability

  The controlled cover for the applicability decisions: what is covered, at which version, approved by whom, and the rules by which each status was chosen.

  27001 Clause 6.1.3 d) 42001 Clause 6.1.3

• DOC-07Risk treatment plan

  The assessment itself: the risks this service actually carries, scored under the stated method, with the decision taken on each and what remains.

  27001 Clause 6.1.1 27001 Clause 6.1.3 e) 27001 Clause 8.2 27001 Clause 8.3 42001 Clause 6.1.2 42001 Clause 6.1.3 42001 Clause 8.2 42001 Clause 8.3

• DOC-08Security and AI objectives

  What this service is trying to achieve, stated so that each objective can be measured from a route rather than asserted.

  27001 Clause 6.2 42001 Clause 6.2 42001 A.6.1.2 42001 A.9.3

• DOC-10Control of documented information

  How the documents in this set are identified, versioned, approved, published, changed and retained — and why none of that is maintained by hand.

  27001 Clause 7.5.1 27001 Clause 7.5.2 27001 Clause 7.5.3 42001 Clause 7.5

• DOC-17Nonconformity and corrective action

  How a failure against a policy, a control or a standard is recognised, classified, corrected, and prevented from recurring — and where the record of each one is.

  27001 Clause 10.2 42001 Clause 10.2

• DOC-18Asset inventory and information classification

  What this service has, who owns it, what each asset holds, how information is classified, and how that classification is enforced rather than labelled.

  27001 Annex A.5.9 27001 Annex A.5.12 27001 Annex A.5.13 27001 Annex A.5.16

• DOC-19Access control, supplier and endpoint policy

  Who and what may reach each part of this service, what is entrusted to the one supplier it has, and the rules covering the machine it is deployed from.

  27001 A.5.15 27001 A.5.19 27001 A.5.20 27001 A.5.22 27001 A.5.23 27001 A.6.7 27001 A.7.7 27001 A.7.9 27001 A.8.1

• DOC-21Continuity, backup and restore

  What this service does to survive disruption, what it copies, how a copy is proven to restore, and what it honestly cannot do.

  27001 Annex A.5.29 27001 Annex A.5.30 27001 Annex A.8.13

• DOC-22Legal, regulatory and contractual register

  The obligations that apply to this service, where each comes from, how it is met, and the privacy notice the data protection obligations require.

  27001 A.5.5 27001 A.5.31 27001 A.5.32 27001 A.5.34

• DOC-24Secure development and operations

  The rules under which code is written, checked, released and run — including the two places where this service is weaker than the rules would suggest.

  27001 A.5.8 27001 A.5.37 27001 A.8.7 27001 A.8.24 27001 A.8.25 27001 A.8.28 27001 A.8.29 27001 A.8.32

• DOC-25AI policy and AI system impact assessment

  What the AI in this service actually is, what it is allowed to do, and an assessment of who it can affect.

  42001 Clause 5.2 42001 Clause 4.4 42001 Clause 6.1.4 42001 Clause 8.4 42001 A.2.2 42001 A.2.3 42001 A.2.4 42001 A.5.2 42001 A.5.3 42001 A.5.4 42001 A.5.5 42001 A.9.4

• DOC-26AI system life cycle

  The technical record of the computer-controlled sharks: what they are specified to do, how they are built, how that is verified, how they are deployed and used, and what is deliberately withheld from them.

  42001 A.3.3 42001 A.4.2 42001 A.4.4 42001 A.6.1.3 42001 A.6.2.2 42001 A.6.2.3 42001 A.6.2.4 42001 A.6.2.5 42001 A.6.2.7 42001 A.7.4 42001 A.8.2 42001 A.8.5 42001 A.9.2 42001 A.10.4

• DOC-27Operating records

  The dated records produced by activities this management system defines and now performs: access review, supplier monitoring, compliance review, AI policy review, and the change-management records an assessor samples.

  27001 Annex A.5.18 27001 Annex A.5.22 27001 Annex A.5.36 27001 Annex A.5.4 42001 Annex A.2.4

• DOC-28Operational planning, resources, communication and performance

  How the management system itself is planned, resourced, communicated and measured — the clauses that describe running the system rather than any one control.

  27001 Clause 4.4 27001 Clause 6.3 27001 Clause 7.1 27001 Clause 7.4 27001 Clause 8.1 27001 Clause 10.1 42001 Clause 4.4 42001 Clause 6.3 42001 Clause 7.1 42001 Clause 7.4 42001 Clause 8.1 42001 Clause 9.1 42001 Clause 10.1

• DOC-29Internal audit and management review

  The internal audit programme and the management review, performed at the scope one person can honestly perform them at, with the limitation stated rather than designed around.

  27001 Clause 5.1 27001 Clause 7.2 27001 Clause 7.3 27001 Clause 9.3 42001 Clause 5.1 42001 Clause 7.2 42001 Clause 7.3 42001 Clause 9.3

No document matches that search.