Sample Asset Protection Policy:

Sample Asset Protection Standard

The Asset Protection Standard defines Company objectives for establishing specific standards on the protection of the confidentiality, integrity, and availability of Company information assets. Company information assets are defined in the Sample Asset Identification and Classification Standard.

Objectives

Authorization for access to information assets will be based on the classification of the information and defined to provide only the level of access required to meet an approved business need or perform prescribed job responsibilities. Proper identification and authentication are required. Specific instructions and requirements for controlling access to information assets are provided in the Sample Access Control Standard.

Authorization for remote access to information assets will be provided only to meet an approved business need or perform prescribed job responsibilities. Remote access must be facilitated by using Company-approved methods and programs. Specific instructions and requirements for accessing information assets remotely are provided in the Sample Remote Access Standard.

Information assets must be protected with physical access control of areas containing information assets or processing activities. The physical access controls must be commensurate with the classification of the information and defined to provide only the level of physical access required to meet an approved need or perform prescribed job responsibilities. Specific instructions and requirements for physical access to information assets are provided in the Sample Physical Access Standard.

The supporting infrastructure for systems, networks, telephony, and hardware should be protected from failure and regularly inspected or tested, as appropriate. Supporting infrastructure includes electricity or other power sources, water supply, cabling, external communication lines, heating and air conditioning equipment, sewage, etc.

Encryption must be used to protect Restricted and Confidential information assets that will be transmitted over non-secure or public networks. Storage of Restricted and Confidential information assets must be achieved with similar approved encryption methods. Only Company-approved encryption algorithms and products can be used to protect Restricted and Confidential information. Specific instructions and requirements for encryption are provided in the Sample Encryption Standard.

Information assets must be created and maintained with appropriate controls to ensure that the information is correct, auditable, and reproducible. Specific instructions and requirements for protecting the integrity of information assets are provided in the Sample Integrity Protection Standard.

The Company must establish appropriate controls to ensure information assets are consistently available to conduct business. Business continuity planning to effectively back up, replicate, and recover information assets, as necessary, must be established. Specific instructions and requirements for protecting the availability of information assets are provided in the Sample Availability Protection Standard.

Information assets must be protected from destructive software elements such as viruses and malicious code that impair normal operations. Company-approved virus detection programs must be installed, enabled, and updated on all systems susceptible to viruses and malicious code. Specific instructions and requirements for protecting information assets from viruses and malicious code are provided in the Sample Anti-Virus Standard.

Auditing must be activated to record relevant security events. The audit logs must be securely maintained for a reasonable period of time. Specific instructions and requirements for auditing information assets are provided in the Auditing Standard.

Document Examples

Use these samples as a guide for your policy development. Fully customizable versions are available from The Policy Machine.

• 

  Asset Protection Standard page one of seven.

• 

  Asset Protection Standard page two of seven.

• 

  Asset Protection Standard page three of seven.

• 

  Asset Protection Standard page four of seven.

• 

  Asset Protection Standard page five of seven.

• 

  Asset Protection Standard page six of seven.

• 

  Asset Protection Standard page seven of seven.