Security Policy

1. Statement Policy

1.1 It is the policy of Acme Inc. that all information in the form of written, spoken, recorded electronically or printed, will be protected from accidental or intentional unauthorized modification, destruction or disclosure throughout its life cycle. This protection includes an appropriate level of security over the equipment, software used to process, store, and transmit ACME Inc. information. All policies and procedures must be documented and made available to individuals responsible for the implementation and compliance of Acme Inc. All activities identified by the policies and procedures must also be documented. All documentation must be periodically reviewed for appropriateness and currency, a period of time to be determined by each entity within Acme Inc. All departmental policies must be consistent with this policy. All existing systems and software; and those implemented after the effective date of these policies are expected to comply with the provisions of this policy in each department where needed. Failure to comply with this policy may subject you to disciplinary measures or termination.

2. RISK ASSESTMENT AND MANAGEMENT

2.1 A thorough analysis of all Acme Inc. information networks, software and systems will be conducted on a periodic basis to document the threats and vulnerabilities that are stored and transmitted. Upon current analysis, the Network Administrator examine all types of threats – internal or external, natural or manmade, electronic and non-electronic, that affect the ability to manage the information resource of Acme Inc. This analysis also documented the existing vulnerabilities within each entity which potentially expose the information resource to the threats. Finally, the analysis also included an evaluation of the information assets and the technology associated with its collection, storage, dissemination and protection.

From the combination of threats, vulnerabilities, and asset values, an estimate...