Information Security Management System

A formal ISMS is the basis for everything.

ibCom has implemented an ISMS to protect the organisation’s information from internal and external risks and threats — defining the purpose, scope, direction, principles and rules that govern it.

ISO 27001ISO 27017Plan-Do-Check-Act

Introduction

One system. Every form of information.

The confidentiality, integrity, protection and availability of ibCom’s information and customer data are always preserved — whatever the form of the information, and however it is shared, used, communicated or stored.

Overview

Built around ISO 27001 and 27017.

The ISMS reference and policy controls demonstrate management commitment and give the organisation a framework to work within.

Demonstrate management leadership and commitment to information security.
Are appropriate for the company and its products & services.
Include information security objectives, and a framework for setting them.
Include a commitment to satisfy the applicable security requirements.
Include a commitment to continual improvement of the ISMS.
Are documented, communicated within the organisation, and available to interested parties.

Scope

What the ISMS covers.

The scope of ibCom’s ISMS reaches across the whole organisation.

All employees, contractors, consultants, products, services, customers, partners and vendors.
All physical and virtual business offices and operations.
All physical and virtual business systems and processes.
All physical and virtual assets and technology — desktops, laptops, mobile devices, networks and data centres.
All physical and cloud-based business and customer information repositories.
All internal and external business communications.

Objectives

Why the ISMS exists.

Supporting the company’s core mission — providing value to shareholders and confidence to customers.

Assess & treat risk

Identify and assess information security risks, and treat them so that they remain acceptable.

Reduce incidents

Reduce or eliminate information security incidents, and minimise the impact of any that occur.

Continually improve

Continually improve the company’s ability to assess, detect, avoid and ameliorate risks and incidents.

Protect credibility

Maintain the esteem and credibility of the company’s services and the entityOS brand.

Protect privacy

Protect the privacy of all stakeholders — particularly the personal information of ibCom’s customers.

Provide assurance

Give shareholders value and customers confidence through a governed, documented and audited approach.

Principles

The rules we hold to.

Management commits to implementing and maintaining the security policy and its supporting procedures.
All employees are educated in information security and are accountable for the security relevant to their role.
Risks are assessed, managed and treated so they remain within acceptable parameters.
Security controls are adequately provisioned and funded.
The security posture is one of continuous improvement.

The ISMS is available for review by all ibCom employees and any interested parties, and underpins ibCom’s external certification to ISO 27001/17.

← Protection & Security