INFORMATION SYSTEMS SECURITY POLICY
SECTION 1: PURPOSE AND RESPONSIBILITY
The Company operates various forms of computing and telecommunications systems throughout its operations. For purposes of this policy, the term "systems" shall refer to all computer operations (mainframe, minis, micros, personal computers, and telecommunications) and any other functional areas in which data is transmitted via an electronic or telecommunications medium.
The purpose of the Company's Information Systems Security Policy is to provide the essential guidelines for efficient electronic transaction processing and reporting services, management information systems, and appropriate customer information capabilities for management and the Board of Directors to effectively operate the Company. In addition, this policy is designed to ensure continuous support and improvement of the computing and telecommunications systems of the Company.
Computer Usage Policies:
The purpose of this policy is to outline the acceptable use of computer equipment at A&J,
These rules are in place to protect the employee and information provided to them. Inappropriate use exposes A&J to risks including virus attacks, compromise of network systems and services, and legal
issues.
This policy applies to employees, contractors, consultants, temporaries, and other workers at A&J, including all personnel affiliated with third parties. This policy applies to all equipment that is
owned or leased by A&J.
General Use and Ownership
1. While B&J's network administration desires to provide a reasonable level of
privacy, users should be aware that the data they create on the corporate systems remains the
property of B&J. Because of the need to protect B&J's network,
management cannot guarantee the confidentiality of information stored on any network device
belonging to B&J.
2. Employees are responsible for exercising good judgment regarding the reasonableness of personal
use. Individual departments are responsible for creating guidelines concerning personal use of
Internet/Intranet/Extranet systems. In the absence of such policies, employees should be guided by
departmental policies on personal use, and if there is any uncertainty, employees should consult
their supervisor or manager.
3. InfoSec recommends that any information that users consider sensitive or vulnerable be encrypted.
For guidelines on information classification, see InfoSec's Information Sensitivity Policy. For
guidelines on encrypting email and documents, go to InfoSec's Awareness Initiative.
Information and Communication Security
The Company is to maintain integrity and security controls for protection of all computing and telecommunications systems, which is intended to also address the risks that arise from potential misuse of computing system resources. The establishment of these controls shall include, but not be limited to, the following steps:
i.Logical access controls
ii.An information resource classification method
iii.Network and local access security
iv.Retention and disposal of information
v.An incident reporting system to analyze errors and develop procedures to prevent future occurrences
Measures used to establish and/or enhance such controls should be appropriately justified as to their cost and financial benefit relative to criticality and sensitivity of the information resources being protected.
Contingency and Recovery
Backup systems support contracts shall be established to protect the Company in the event of an unforeseen breakdown or catastrophe. The Company is to develop and maintain a plan that addresses the risk that such events can occur. This shall require planning for alternate computing system processing options (facilities, equipment, etc.) and that the necessary procedures be established in order to successfully achieve each of these alternatives. This is to ensure that the Company can provide for business continuity. Minimum contingency requirements should include, but not be limited to, the following steps:
i.Identification of critical applications to determine their priority for recovery.
ii.Documented backup and recovery plan(s) that include all related or potentially affected information assets (and their probable/potential) effects on any/all operational areas).
iii.Test procedures at least once each year to evaluate the plan's effectiveness on information assets, personnel, and all other potentially affected operational areas.
iv.The Company shall maintain backup data at an off-site location to limit risk and allow for the timely recovery of data should on-site information be destroyed, corrupted, or for whatever reason made unusable.