65 lines
2.4 KiB
Markdown
65 lines
2.4 KiB
Markdown
Title: Asset Management and Acceptable Use Policy
|
|
Document ID: [POL-ASSET-001]
|
|
Version: 0.1 Draft
|
|
Status: Draft
|
|
Owner: CISO (Paul Jenkins)
|
|
Approver: CEO (Paul Hague)
|
|
Classification: Internal
|
|
Effective date: [DD Month YYYY]
|
|
Review date: [DD Month YYYY]
|
|
|
|
# Asset Management and Acceptable Use Policy
|
|
|
|
## Purpose
|
|
|
|
This policy defines BlackDice's expectations for identifying, managing, and using information assets and technology resources appropriately.
|
|
|
|
## Scope
|
|
|
|
This policy applies to information, software, cloud resources, endpoints, repositories, collaboration platforms, removable media, and other assets used within the ISMS scope.
|
|
|
|
## Objectives
|
|
|
|
- maintain accountability for important assets
|
|
- ensure assets are used appropriately and securely
|
|
- reduce misuse, loss, and uncontrolled exposure of business information
|
|
|
|
## Principles / Policy Statements
|
|
|
|
In-scope information assets and supporting technology assets must be identified and assigned an owner.
|
|
|
|
Assets must be handled in accordance with their classification, business value, and criticality.
|
|
|
|
BlackDice technology resources must be used only for authorised business purposes unless limited personal use is expressly permitted by [Policy or Role].
|
|
|
|
Users must not use company assets to bypass security controls, introduce unapproved software, or perform unsafe activity that could affect cloud services, customer data, or corporate systems.
|
|
|
|
Where assets support cloud-native operations, source code, build artefacts, infrastructure definitions, and deployment configurations must be treated as controlled assets.
|
|
|
|
## Roles and Responsibilities
|
|
|
|
- Asset owners must ensure assets are identified, classified, and appropriately protected.
|
|
- Users must use assets responsibly and report loss, misuse, or security concerns.
|
|
- [Role] must oversee the asset management framework.
|
|
|
|
## Compliance / Exceptions
|
|
|
|
Non-compliant use may lead to removal of access, investigation, and corrective action. Exceptions must be approved through the defined process.
|
|
|
|
## Monitoring and Review
|
|
|
|
This policy should be reviewed alongside asset inventory accuracy, acceptable use issues, incidents, and audit findings.
|
|
|
|
## Related Documents
|
|
|
|
- Information Security Policy
|
|
- Data Classification and Handling Policy
|
|
- Asset Register Template
|
|
- Remote Working Policy
|
|
|
|
## Version Control
|
|
|
|
| Version | Date | Description of Change | Author |
|
|
| --- | --- | --- | --- |
|
|
| 0.1 Draft | [DD Month YYYY] | Initial draft. | [Name or Role] |
|