65 lines
2.5 KiB
Markdown
65 lines
2.5 KiB
Markdown
Title: Information Transfer Policy
|
|
Document ID: [POL-TRANSFER-001]
|
|
Version: 0.1 Draft
|
|
Status: Draft
|
|
Owner: CISO (Paul Jenkins)
|
|
Approver: CEO (Paul Hague)
|
|
Classification: Internal
|
|
Effective date: [DD Month YYYY]
|
|
Review date: [DD Month YYYY]
|
|
|
|
# Information Transfer Policy
|
|
|
|
## Purpose
|
|
|
|
This policy defines BlackDice's requirements for transferring information securely between internal teams, customers, suppliers, and other authorised parties.
|
|
|
|
## Scope
|
|
|
|
This policy applies to electronic and physical information transfer involving in-scope information, including customer communications, support processes, supplier exchanges, and operational data sharing.
|
|
|
|
## Objectives
|
|
|
|
- protect information during transfer against unauthorised access or loss
|
|
- ensure transfers are appropriate to classification and business need
|
|
- reduce risk in cross-organisational and multi-jurisdiction exchanges
|
|
|
|
## Principles / Policy Statements
|
|
|
|
Information must only be transferred where there is a legitimate business need and an approved transfer method appropriate to the information's sensitivity.
|
|
|
|
Transfer mechanisms for sensitive information must include suitable protections such as access restriction, encryption, integrity assurance, and recipient validation where appropriate.
|
|
|
|
Operational data shared with suppliers, customers, or operator-hosted environments must be limited to what is necessary and handled according to agreed requirements.
|
|
|
|
Transfers that may involve legal, regulatory, or contractual obligations must be assessed and approved through the relevant process.
|
|
|
|
Unauthorised use of personal email, consumer file-sharing, or other unapproved channels for sensitive business information must be prohibited.
|
|
|
|
## Roles and Responsibilities
|
|
|
|
- [Role] must define information transfer expectations.
|
|
- Information owners must approve transfer arrangements where required.
|
|
- Users must use approved methods and verify recipients before sharing sensitive information.
|
|
|
|
## Compliance / Exceptions
|
|
|
|
Exceptions to standard transfer controls must be documented, justified, and approved based on risk and business need.
|
|
|
|
## Monitoring and Review
|
|
|
|
This policy should be reviewed through incident analysis, supplier review, privacy review, and audit.
|
|
|
|
## Related Documents
|
|
|
|
- Information Security Policy
|
|
- Data Classification and Handling Policy
|
|
- Privacy and Data Protection Policy
|
|
- Supplier Security Policy
|
|
|
|
## Version Control
|
|
|
|
| Version | Date | Description of Change | Author |
|
|
| --- | --- | --- | --- |
|
|
| 0.1 Draft | [DD Month YYYY] | Initial draft. | [Name or Role] |
|