INFORMATION SECURITY MANAGEMENT POLICY


EDC is committed towards maintaining and improving Information Security (IS) levels across all the functions. Information covers storage both in hard copy and soft copy. Information Security is to secure information. Security consists of information confidentiality, integrity and availability at the required time. It applies to all information, information systems, networks, applications, all locations and all information users. Scope of lnformation Security covers information under the domain of IT and non-IT.
**The information security management will consist of the following activities:**
  1. Information Security Risk Identification
    CEO /All HODs /Head-IT will undertake Information Security Risk Identification on a continual basis, across all the functions, locations that pose threat to business. This consists of threats to the information assets, related vulnerabilities and impacts that may have on the business.

  2. Information Security Risk Assessment
    Based on the above security risk identification, security risk assessment will be conducted by independent party. That consists of levels of risk and "consequences arising out of those levels ofrisks. Classify them into acceptable and unacceptable risks.

  3. Information Security Risk Mitigation
    All HODs will decide and implement risk mitigation plans & strategies (where required) to bring the Residual Risk to as Low as Reasonably Practicable (ALARP) both in short term and long term. This will ensure IS resilience necessary for business survival and growth.

  4. Information Security Risk Review & Reporting
    CEO/All HODs and Process Owners (employees) will be responsible to inform about information security incidents, threats, risks to IT department as required to take effective corrective, preventive and improvement actions to drive continual improvement in IS standards.

  5. Information Security Objectives
    All HODs and Process Owners will derive the IS SMART Objectives from this IS Policy. They will work towards achieving these objectives by complying to existing detailed IS procedures issued by IT dept. to all employees.

  6. Compliance to ISO 27001
    EDC strives to work towards compliance to ISO 27001 in coming years.


IT Manager is appointed to lead the development and implementation of this IS policy. This policy will be reviewed every 3 years for its continual improvement & suitability and will be amended if required.