Example Of Business Plan On The Protection Applies To All Enterprise Information, Hardware And Software And The Entire Network Infrastructure Of The Enterprise.

Information Security Policy

1.  Purpose
This policy outlines and explains the process employed by Harriet’s Fruit and Chocolate Enterprise for evaluating, reacting to, and administering privacy incidents and information security. The privacy incidents comprises of information alteration and disclosure, illegal access by either internal or external attackers or others.
2.  Scope

3.  Incident Management procedure
This section consists of various parts which include high level incident management flow, duty or responsibility to report and help, evaluation and assessment, incident management, notification and lastly remediation.

Strategic incident management process

The top management team will be responsible for offering oversight and course for all incidents within Harriet’s Fruit and chocolate Enterprise in terms of high level incident management process. In particular, the chief information security officer of the enterprise will offer oversight along with course for incidents that is not associated with national information system safety.

Responsibility to report

The employees will be responsible for reporting considerable incidents such as secured business information, incidents that involves national information safety system will all be reported to the security officer of the enterprise. Other considerable incidents not associated with national information safety or secured enterprise business information will be reported to the Chief information security officer of the enterprise. Any other third party individual will report security incident in question to the enterprise employee who is responsible for authorizing access, disclosure and use of the system.

Evaluation and assessment

The top management together with Chief information security officer of the enterprise will be responsible for:-
Assigning the office of enterprise security officer with the task of evaluating and assessing every area of the enterprise based on national information safety incident.

Assigning the office of IT security compliance with the task of analyzing and assessing national information safety.

Assigning the office of enterprise Chief information security officer with the task of evaluating and assessing all areas of the enterprise with respect to all incidents not associated with national information safety, national system safety or secured enterprise information.
The elements of incident response plan will comprise documentation, evidence preservation and chain of care, evaluation and assessment, communication to the assigned official, containment, remediation and finally reporting in that order to the respective officers. In addition, the assigned office for a given incident is expected to take suitable actions where appropriate with the system operators in order to get and keep the evidence necessary, assess risks and alleviate extra risks.

Management of incident

Depending on the incident, the top management and the Chief information security officer shall assign enterprise security officer, chief privacy officer and enterprise chief information security officer to manage national safety information, secured enterprise information and every incident not associated with national safety information and protected enterprise information respectively. They will engage other assigned officials where possible in the management of these incidents with the help of incident manager.

Notification

The incident manager shall be responsible for facilitating all notifications to the respective parties of the enterprise with the help of incident management team in accordance with the available laws and regulations that governs the enterprise.

Addressing incident harm

The address of any incident harm shall begin at any appropriate time in the process of incident management as long as evidence is preserved.
4. Limitations for disclosure
Evidence and information associated with incidents will be handled with care in order to obey state laws that restrict information disclosure.
5.  Maintenance of policy
The top management of the enterprise and the enterprise Chief information security officer shall be responsible for reviewing this policy statement once after every two years in order to react to changes in the environment of information security laws.