Policy
5.2
-
Last updated
Mandatory
Catalog reference
Top management must establish an information security policy that fits the organisation's purpose, sets objectives or a framework for them, commits to meeting requirements and to continual improvement, and is communicated and available.
Narrative — how we satisfy this requirement
The Management Board has approved the security policy. Every employee acknowledges it when they join and after each yearly revision.
Review
On trackNext review is 10/27/2027 — no urgency right now.
- Review cadence
- Every 365 days
- Last reviewed
- Next review due