Initial commit

01-policies/network-and-infrastructure-security-policy.md

@@ -0,0 +1,64 @@
+Title: Network and Infrastructure Security Policy
+Document ID: [POL-NETINFRA-001]
+Version: 0.1 Draft
+Status: Draft
+Owner: CISO (Paul Jenkins)
+Approver: CEO (Paul Hague)
+Classification: Internal
+Effective date: [DD Month YYYY]
+Review date: [DD Month YYYY]
+
+# Network and Infrastructure Security Policy
+
+## Purpose
+
+This policy defines BlackDice's expectations for securing networks, infrastructure components, and supporting platform services.
+
+## Scope
+
+This policy applies to cloud networking, connectivity, infrastructure services, administrative access paths, supporting compute resources, and related management components within the ISMS scope.
+
+## Objectives
+
+- protect infrastructure and network pathways from unauthorised access or misuse
+- support segmentation, resilience, and controlled administration
+- reduce exposure from insecure configurations and unmanaged services
+
+## Principles / Policy Statements
+
+Infrastructure and network services must be designed and operated according to approved security requirements.
+
+Administrative interfaces and management paths must be restricted, monitored, and protected with stronger controls.
+
+Network exposure should be minimised according to business need, and externally accessible services must receive appropriate protection and review.
+
+Infrastructure security arrangements must consider cloud-native service patterns, container orchestration dependencies, and operator-facing deployment requirements where applicable.
+
+Changes to network and infrastructure controls must be subject to defined assessment and approval.
+
+## Roles and Responsibilities
+
+- [Role] must define infrastructure and network security expectations.
+- Platform and infrastructure owners must maintain secure configurations and access controls.
+- Operational teams must monitor and manage infrastructure risks.
+
+## Compliance / Exceptions
+
+Exceptions must be documented and approved where baseline infrastructure or network requirements cannot be met.
+
+## Monitoring and Review
+
+This policy should be reviewed through configuration reviews, vulnerability management, incident analysis, and audit.
+
+## Related Documents
+
+- Information Security Policy
+- Cloud Security Policy
+- Secure Configuration Standard
+- Change Management Policy
+
+## Version Control
+
+| Version | Date | Description of Change | Author |
+| --- | --- | --- | --- |
+| 0.1 Draft | [DD Month YYYY] | Initial draft. | [Name or Role] |