SafeIT

ISMS PROCEDURE

Procedure No: ISM - Email Version: 1

Date: 19/10/22 Authorized :Paul Miser

Title: ISMS POLICY on Secure Development

1. Purpose
The purpose of this document is to state the SafeIT policy on Third Party Service
providers including suppliers
2. Responsibilities
The GM Operations shall remain responsible for maintenance, review and
modification of this policy and its related controls.
3. Policy
All those providing services by either utilising SafeIT facilities or their own IT
facilities must be aware of, and comply with, the security conditions below. They are
required to:
1. Accept that their use of facilities may be monitored and/or recorded whilw used for
SafeIT;
2. Comply with the Data Protection Act 1998 and all other legal, statutory or
contractual obligations;
3. Never attempt to access SafeIT facilities without written permission, and only use
authorised equipment at authorised locations;
4. Only access the Safe IT facilities by using the user identifier and password
provided by the SafeIT. Maintain secracy of the IDs and passwords.
6. Never exchange data on portable media with SafeIT e.g. on USB memory sticks or
DVD/CDs, without authorisation. These media must be kept secure and locked away
when not in use.
7. Always seek to prevent accidental disclosure of sensitive or personal information,
e.g. by the accidental overlooking or overhearing of such information;
8. To handle personal or sensitive data, emails, or information with care
9. Protect and handle securely any electronic or paper information when it is used,
sent, received, stored or processed;

IQMSL-IS3-ISMS-LA–IRCA-2348 Page 1 of 3
CASESTUDY 2022

2022 THIS MATERIAL IS THE PROPERTY OF IQMS LEARNING.

UNAUTHORISED COPYING OR USE IS PROHIBITED.
 SafeIT
ISMS PROCEDURE

Procedure No: ISM - Email Version: 1

Date: 19/10/22 Authorized :Paul Miser

Title: ISMS POLICY on Secure Development

10. Never disclose any sensitive or personal information unless satisfied that the
recipient(s) have a ‘need to know’ and are authorised by SafeIT to see it;
11. Never send files, web service data, or emails that contain sensitive or personal
data across the public Internet without providing encryption protection.
12. Ensure that any personnel security checks required by SafeIT for individuals
providing services are completed and the results are checked and accepted before
accessing the IT facilities or information.
13. Return, or securely destroy in an agreed fashion, any information or data used in
the provision of services;
14. Take precautions to protect all computer media, portable computers, and
electronic equipment (e.g. Internet phones) when carrying them in transit. For
example, never leave a laptop, other equipment, or computer media, unattended;
15. Report all suspected or actual security breach to the Information security manager
responsible.
16. Never knowingly cause any form of damage to the IT facilities, nor attempt to by-
pass or subvert system security controls;
17. Never insert portable computer media into the IT network without first getting
them checked for viruses and malware.
18. Ensure that any IT equipment used to provide services is protected by anti-virus
software and spyware, and that this software and any anti-virus definitions are always
up to date. Also never knowingly introduce viruses or other malware into the IT
network; nor knowingly disable anti-virus protection.
19. Never download software or programs (including screen savers and wallpaper)
from the Internet or from removable media onto the IT equipment. Software must
only be installed onto IT equipment by authorised staff.
20. Never disable any IT security safeguards that have been implemented on
computer equipment used to provide services;

IQMSL-IS3-ISMS-LA–IRCA-2348 Page 2 of 3
CASESTUDY 2022

2022 THIS MATERIAL IS THE PROPERTY OF IQMS LEARNING.

UNAUTHORISED COPYING OR USE IS PROHIBITED.
 SafeIT
ISMS PROCEDURE

Procedure No: ISM - Email Version: 1

Date: 19/10/22 Authorized :Paul Miser

Title: ISMS POLICY on Secure Development

21. Before termination of the contract or work agreement, inform SafeIT of any
information held, and ensure that this information is either destroyed, stored under an
agreement, or formally returned to SafeIT.
4. Records
Supplier performance records

IQMSL-IS3-ISMS-LA–IRCA-2348 Page 3 of 3
CASESTUDY 2022

2022 THIS MATERIAL IS THE PROPERTY OF IQMS LEARNING.

UNAUTHORISED COPYING OR USE IS PROHIBITED.