Record the Management Board's approval of the Information Security Policy

Purpose

This Policy sets the direction for information security at Tidewell IT. We run workplaces, networks, and hosting for about 120 small and mid-sized business customers from two Dutch data centres, and they trust us with their data and their daily work. This Policy states how we protect that trust.

Scope

This Policy applies to everyone who works for Tidewell IT, including employees, contractors, interns, and Management Board members. It covers all information, systems, sites, and services inside the ISMS scope, and the suppliers that handle our information or our customers' information.

Policy statements

Commitment and objectives

1. This Policy is appropriate to the purpose of Tidewell IT as a managed IT service provider.
2. The Management Board approves this Policy. It provides the framework for setting information security objectives, which are measurable, recorded in the Objectives register, and reviewed every year.
3. Tidewell IT meets the applicable requirements for information security: customer contracts, the Cyberbeveiligingswet, Regulation (EU) 2016/679, and ISO/IEC 27001:2022.

Roles and authority

1. The Management Board is accountable for the information security management system and provides the resources it needs.
2. The ISMS Manager runs the system day to day and reports its state to the Management Board.
3. Every person at Tidewell IT is responsible for following this Policy and the documents that support it.

Risk-based approach

1. We choose security measures by assessing risk, as the Risk Management Policy describes.
2. We record a decision and its justification for every control of ISO/IEC 27001:2022 Annex A.
3. Security measures are proportionate to the risk and to the value of the service they protect.

Documented information

1. Policies and Procedures are written, approved, versioned, and kept in the Compliance register.
2. Every document has an owner and is reviewed at least once a year and after a significant change.

Competence and awareness

1. Everyone who works under our control has the competence for their tasks and knows this Policy and how their work contributes to information security.
2. Every starter completes induction awareness in the first 2 weeks, with an annual refresher.

Continual improvement

1. We commit to continual improvement of the information security management system.
2. Internal audits, incident reviews, and the management review feed Findings and Tasks, and we track each one to closure.

Communication

1. This Policy is communicated to all staff and is available to them on the intranet.
2. Customers, suppliers, and other interested parties receive it on request from security@tidewell-it.example.
3. Staff are told when a revised version is approved and what changed.

Roles and responsibilities

The Management Board approves this Policy and sets the objectives. The ISMS Manager owns this Policy, keeps the system running, and reports to the Management Board. The Internal Auditor checks that the system works as written. The Data Protection Officer advises on the protection of personal data.

Exceptions

An exception needs a written request to the ISMS Manager that states the reason, the risk, and an end date. The Management Board approves an exception that lowers the level of protection for a customer environment.

Compliance and enforcement

Breaches of this Policy lead to disciplinary measures under the HR process. We check compliance through internal audits and management reviews.

Related documents

• ISMS scope
• Risk Management Policy
• Access Control Policy
• Incident Response Policy
• Personal Data Protection Policy
• Security Awareness and Training Procedure
• Internal Audit and Management Review Procedure

Review

The ISMS Manager reviews this Policy at least once a year and after a significant change. The Management Board approves each revised version.