Company Cyber Security Policy

Company Cyber Security Policy

Company Name: [Company Name]
Effective Date: [Effective Date]
Policy Owner: [Policy Owner]
Approved By: [Approved By]
Chief Information Security Officer: [Chief Information Security Officer]

PURPOSE & SCOPE
- This policy establishes the Organization's cyber security framework to protect information assets, systems, and networks from cyber threats including unauthorised access, data breaches, malware, and social engineering attacks.
- This policy applies to all information systems, networks, applications, and data owned or operated by the Organization, as well as all individuals who access these resources, including employees, contractors, and third-party service providers.
- The Chief Information Security Officer shall provide executive leadership for the Organization's cyber security program and shall be accountable for the development, implementation, and continuous improvement of the cyber security strategy.

THREAT PROTECTION & NETWORK SECURITY
- The Organization shall deploy a defence-in-depth security architecture that includes firewalls, intrusion detection and prevention systems, endpoint protection, and network segmentation to protect against external and internal cyber threats.
- All Organization systems and applications shall be subject to a formal vulnerability management program that includes regular scanning, risk-based prioritisation, and timely remediation of identified vulnerabilities.
- The Organization shall implement security information and event management capabilities to provide real-time monitoring, correlation, and analysis of security events across all critical systems and networks.
- All software, firmware, and operating systems shall be maintained at supported versions and patched in accordance with the Organization's patch management schedule. End-of-life software shall be replaced or isolated before vendor support ceases.

INCIDENT RESPONSE & RECOVERY
- The Organization shall maintain a documented Cyber Security Incident Response Plan that defines the procedures for identifying, containing, eradicating, and recovering from cyber security incidents. The plan shall be tested at least annually.
- All employees shall report suspected cyber security incidents to the Information Security team immediately upon discovery. The Organization shall classify incidents by severity and escalate them according to defined response procedures.
- The Organization shall maintain business continuity and disaster recovery plans for all critical IT systems that define recovery time objectives and recovery point objectives. These plans shall be tested at least annually.

SECURITY AWARENESS & TRAINING
- All employees shall complete mandatory cyber security awareness training upon hire and annually thereafter. Training shall cover phishing recognition, password security, social engineering, data handling, and incident reporting procedures.
- The Organization shall conduct simulated phishing exercises at least quarterly to test employee resilience against social engineering attacks. Results shall be tracked and employees who repeatedly fail shall receive additional targeted training.
- IT administrators and security personnel shall receive specialised technical training on an ongoing basis, covering current threat landscapes, advanced security technologies, and incident response techniques relevant to their roles.

COMPLIANCE & POLICY REVIEW
- The Organization shall conduct formal cyber security risk assessments at least annually, using a methodology aligned with the NIST Cybersecurity Framework, to identify, evaluate, and prioritise cyber risks across the Organization.
- The Organization shall engage an independent third-party auditor to assess the effectiveness of its cyber security controls at least annually. Audit scope shall include penetration testing, policy compliance, and control effectiveness.
- This policy shall be reviewed at least annually by the CISO in consultation with the Cyber Security Steering Committee. The policy shall be updated to reflect changes in the threat landscape, technology environment, and regulatory requirements.