Sample Information Handling Standard:

Sample Information Handling Standard

The <Your Company Name> (the "Company") Sample Asset Protection Policy defines objectives for establishing specific standards for protecting the confidentiality, integrity, and availability of Company information assets.

This Information Handling Standard builds on the objectives established in the Sample Asset Protection Policy, and provides specific instructions and requirements for handling information assets. These instructions address handling requirements for printed, electronically stored, and electronically transmitted information.

I. Scope

All employees, contractors, part-time and temporary workers, and those employed by others to perform work on Company premises or who have been granted access to Company information or systems, are covered by this standard and must comply with associated guidelines and procedures.

Confidentiality classifications are defined in the Sample Information Classification Standard.

Information assets are defined in the Sample Asset Identification and Classification Policy.

Exchangeable media refers to diskettes, tapes, removable hard drives, compact disks, etc.

II. Requirements

A. Printed Information

1. All printed information shall be handled based on its confidentiality classification. A description of handling requirements for each confidentiality classification category is provided in the following table:

	Restricted	Confidential	Internal Use Only	Public
Labeling
Intra-Company or Office Mail
Duplication
Mailing of Documents
Disposal
Storage

B. Electronically Stored Information

1. All electronically stored information shall be handled based on its confidentiality classification. A description of handling requirements for each confidentiality classification category is provided in the following table:

	Restricted	Confidential	Internal Use Only	Public
Labeling (application or screen)
Labeling (electronic media)
Stored on fixed media with access controls
Stored on fixed media without access controls
Storage on removeable media
Disposal of electronic media
Disposal of information

C. Electronically Transmitted Information

1. All electronically transmitted information shall be handled based on its confidentiality classification. A description of handling requirements for each confidentiality classification category is provided in the following table:

	Restricted	Confidential	Internal Use Only	Public
Local Area Network
Wide Area Network
Non-Secure/Public Networks
Electronic Mail
Fax
Voice-Mail

III. Responsibilities

The Chief Information Security Officer (CISO) approves the Information Handling Standard. The CISO also is responsible for ensuring the development, implementation, and maintenance of the Information Handling Standard.

Company management, including senior management and department managers, is accountable for ensuring that the Information Handling Standard is properly communicated and understood within their respective organizational units. Company management also is responsible for defining, approving and implementing procedures in its organizational units and ensuring their consistency with the Information Handling Standard.

Asset Owners (Owners) are the managers of organizational units that have primary responsibility for information assets associated with their functional authority. When Owners are not clearly implied by organizational design, the CIO will make the designation. The Owner is responsible for ensuring that the Information Handling Standard is properly communicated and understood within their respective organizational units, as well as defining, approving and implementing procedures in its organizational units and ensuring their consistency with the Information Handling Standard.

Asset Custodians (Custodians) are the managers, administrators and those designated by the Owner to manage, process or store information assets. Custodians are responsible for providing a secure processing environment that protects the confidentiality, integrity, and availability of information and coordinating with administrators to ensure proper handling of information during processing and storage.

Users are the individuals, groups, or organizations authorized by the Owner to access to information assets. Users are responsible for familiarizing and complying with the Information Handling Standard and associated guidelines, and handling information in manner that is consistent with the Information Handling Standard.

IV. Enforcement and Exception Handling

Failure to comply with the Information Handling Standard and associated guidelines and procedures can result in disciplinary actions up to and including termination of employment for employees or termination of contracts for contractors, partners, consultants, and other entities. Legal actions also may be taken for violations of applicable regulations and laws.

Requests for exceptions to the Information Handling Standard should be submitted to <Insert Title> in accordance with the Information Security Standards Exception Procedure. Prior to official management approval of any exception request, the individuals, groups, or organizations identified in the scope of this standard will continue to observe the Information Handling Standard.

V. Review and Revision

The Information Handling Standard will be reviewed and revised in accordance with the Sample Information Security Program Charter.

Approved: _______________________________________________________

Signature

<Insert Name>

Chief Information Security Officer