Free preview: Information Security Policy

Our Operating Context and Threat Profile

[Company Name] delivers managed IT and security services to approximately [number] client organizations. To deliver those services, our engineers and service desk staff hold standing privileged access into client networks through tools such as our RMM platform, centralized password vault, remote access gateways, and cloud administration portals. A single compromised technician account or management tool could therefore expose not one organization but every client we serve.

Managed service providers are deliberately targeted by sophisticated attackers precisely because of this aggregation of access. Real-world supply-chain attacks against MSP tooling have shown that a compromise of the management layer can be used to push ransomware or malicious updates simultaneously to hundreds of downstream client networks. Our clients understand this risk, and an increasing number contractually require evidence of our own security controls before and during an engagement.

Policy Statement

The leadership of [Company Name] is committed to protecting the confidentiality, integrity, and availability of all information assets entrusted to the organization, whether owned by the organization, its clients, or its suppliers. Leadership commits to operating an ISMS aligned with ISO/IEC 27001:2022, to resourcing it adequately, and to improving it continually.

All workforce members must comply with this policy and its subordinate documents as a condition of employment or engagement. Security requirements apply equally to permanent staff, contractors, and any third party granted access to our systems or, through our systems, to client environments.

Security Principles

The following principles guide every security decision at [Company Name]. Subordinate policies must implement them; staff must apply them when no specific rule exists.

Information Security Objectives

Leadership sets the following measurable objectives. The [Information Security Manager] must report performance against each objective to the [Managing Director] at least [quarterly], and the objectives must be reviewed for continued suitability at each management review.