65 lines
2.4 KiB
Markdown
65 lines
2.4 KiB
Markdown
Title: Network and Infrastructure Security Policy
|
|
Document ID: [POL-NETINFRA-001]
|
|
Version: 0.1 Draft
|
|
Status: Draft
|
|
Owner: CISO (Paul Jenkins)
|
|
Approver: CEO (Paul Hague)
|
|
Classification: Internal
|
|
Effective date: [DD Month YYYY]
|
|
Review date: [DD Month YYYY]
|
|
|
|
# Network and Infrastructure Security Policy
|
|
|
|
## Purpose
|
|
|
|
This policy defines BlackDice's expectations for securing networks, infrastructure components, and supporting platform services.
|
|
|
|
## Scope
|
|
|
|
This policy applies to cloud networking, connectivity, infrastructure services, administrative access paths, supporting compute resources, and related management components within the ISMS scope.
|
|
|
|
## Objectives
|
|
|
|
- protect infrastructure and network pathways from unauthorised access or misuse
|
|
- support segmentation, resilience, and controlled administration
|
|
- reduce exposure from insecure configurations and unmanaged services
|
|
|
|
## Principles / Policy Statements
|
|
|
|
Infrastructure and network services must be designed and operated according to approved security requirements.
|
|
|
|
Administrative interfaces and management paths must be restricted, monitored, and protected with stronger controls.
|
|
|
|
Network exposure should be minimised according to business need, and externally accessible services must receive appropriate protection and review.
|
|
|
|
Infrastructure security arrangements must consider cloud-native service patterns, container orchestration dependencies, and operator-facing deployment requirements where applicable.
|
|
|
|
Changes to network and infrastructure controls must be subject to defined assessment and approval.
|
|
|
|
## Roles and Responsibilities
|
|
|
|
- [Role] must define infrastructure and network security expectations.
|
|
- Platform and infrastructure owners must maintain secure configurations and access controls.
|
|
- Operational teams must monitor and manage infrastructure risks.
|
|
|
|
## Compliance / Exceptions
|
|
|
|
Exceptions must be documented and approved where baseline infrastructure or network requirements cannot be met.
|
|
|
|
## Monitoring and Review
|
|
|
|
This policy should be reviewed through configuration reviews, vulnerability management, incident analysis, and audit.
|
|
|
|
## Related Documents
|
|
|
|
- Information Security Policy
|
|
- Cloud Security Policy
|
|
- Secure Configuration Standard
|
|
- Change Management Policy
|
|
|
|
## Version Control
|
|
|
|
| Version | Date | Description of Change | Author |
|
|
| --- | --- | --- | --- |
|
|
| 0.1 Draft | [DD Month YYYY] | Initial draft. | [Name or Role] |
|