A documented information security policy exists and is approved by management.

Information security responsibilities are formally assigned within the organisation.

The policy is reviewed and updated on a defined cycle.

Information security objectives are linked to business risk, not treated as a standalone IT topic.

Confidentiality obligations are included in employment contracts or equivalent agreements.

New employees receive information security awareness training during onboarding.

Regular refresher training is provided to all staff with access to sensitive information.

A defined process exists for revoking access when employees leave or change roles.

An inventory of information assets (data, systems, devices) is maintained and kept current.

Assets are classified according to sensitivity (e.g. public, internal, confidential, strictly confidential).

Rules for handling and labelling classified information are documented and followed.

Removable media and mobile devices are covered by defined handling rules.

Access to buildings and sensitive areas is controlled (badges, visitor logs, escort rules).

Server rooms and data centres have restricted access separate from general office access.

Clear desk and clear screen practices are defined and observed.

Environmental risks (fire, water, power loss) are addressed for critical infrastructure.

User access follows a least-privilege, need-to-know principle.

Access rights are reviewed on a defined schedule and removed promptly when no longer needed.

Multi-factor authentication is used for remote access and privileged accounts.

Encryption is applied to sensitive data at rest and in transit, aligned with a defined standard.

Patch management and vulnerability handling follow a documented process.

Information security requirements are included in supplier and subcontractor agreements.

Third parties with access to sensitive information are assessed before onboarding.

A process exists to monitor supplier compliance with agreed security requirements on an ongoing basis.

A documented process exists for reporting and handling information security incidents.

Roles and escalation paths for incident response are defined and known to relevant staff.

Business continuity and disaster recovery plans exist for critical systems and processes.

Continuity plans are tested or exercised on a defined cycle.

A data protection framework aligned with applicable privacy law (e.g. GDPR) is in place.

Processing of personal data is documented, including legal basis and retention periods.

A process exists for handling data subject requests and personal data breaches.

Safeguards are in place for international transfers of personal data (e.g. standard contractual clauses).