Information Security Policy
Introduction
This Information Security Policy is established to protect the confidentiality, integrity, and availability of Magic Makers’ information assets. It complies with ISO/IEC 27001 standards and applies to all employees, contractors, and third parties who access or use Magic Makers’ information assets.
Purpose
The purpose of this policy is to ensure the protection of information assets against all threats, whether internal or external, intentional or accidental.
This policy seeks to ensure compliance with all applicable laws, regulations, and contractual obligations by establishing a framework for defining, reviewing, and achieving information security objectives.
Additionally, the policy aims to promote awareness, educate employees, and guide decision-making processes related to information security within the organization.
Scope
Magic Makers, a company dedicated to [Company Activities and Objectives], has decided to implement an Information Security Management System (ISMS) to enhance the services provided to its clients.
This policy applies to all information assets that are owned, leased, managed, or controlled by Magic Makers, including:
Information stored on physical or electronic media.
Information transmitted through networks or communication channels.
Information processed or handled by employees, contractors, or third parties.
Objectives
The main objectives of this policy are to:
Protect the confidentiality of information to prevent unauthorized disclosure.
Ensure the integrity of information to prevent unauthorized modification.
Guarantee the availability of information for authorized users when needed.
Comply with applicable laws, regulations, and contractual obligations.
Continuously improve the ISMS.
Organization and Security Responsibilities
The Management of Magic Makers is responsible for providing leadership and commitment to information security. It must ensure the availability of the necessary resources for the implementation and maintenance of the ISMS, as well as approve security policies and procedures.
The ISMS Manager is responsible for developing, implementing, and maintaining the ISMS. Responsibilities include:
Conducting risk assessments.
Implementing appropriate security controls.
Reporting to senior management on the effectiveness of the ISMS.
Employees, contractors, and third parties are responsible for:
Complying with this policy and information security procedures.
Reporting any detected security incidents or vulnerabilities.
Participating in information security training and awareness programs.
Security Measures
To protect information assets, security measures have been established across various areas:
Human Resources Security: Measures are implemented to ensure that employees, contractors, and third parties understand their responsibilities and protect information assets.
Physical Security: Physical controls are applied to prevent unauthorized access, damage, or interference with information assets.
Asset Management: All information assets are identified, classified, and protected throughout their lifecycle.
Access Control: Access to information assets is restricted to authorized users through appropriate authentication and authorization mechanisms.
Network Security: Measures are implemented to protect network infrastructure against unauthorized access, breaches, and security threats.
Operations Security: Procedures are established to maintain the integrity of operational processes and ensure the secure execution of daily activities.
Configuration Management: Controls are applied to manage, document, and monitor the configuration of information systems.
Secure Development: Security practices are integrated into the software development lifecycle to ensure applications are securely designed, developed, and maintained.
Change Management: Procedures are established to control and document changes to information systems and technological infrastructure.
Risk Management: Regular risk assessments are conducted to identify and mitigate threats to information assets.
Data Management: Information is classified and protected according to its level of sensitivity and criticality.
Incident Management: A procedure is established to detect, respond to, and recover from information security incidents.
Business Continuity: Continuity plans are developed and tested to ensure the operation of critical functions in the event of disruption.
Third-Party Management: Security requirements are defined and enforced for suppliers and business partners, ensuring their compliance with the organization’s security standards.
Compliance: Periodic audits and reviews are conducted to verify compliance with applicable regulations and standards.
Awareness and Communication: Ongoing training programs are conducted for employees, contractors, and third parties regarding policies, procedures, and best practices in information security.
Continuous Improvement in Security
Magic Makers is committed to the continuous improvement of information security management. Periodic assessments and reviews are conducted to identify areas for improvement within the ISMS.
Audits, incident reports, and employee suggestions are evaluated to implement improvements.
Metrics and performance indicators are monitored to measure the effectiveness of security controls and identify optimization opportunities.
Adjustments are made to the ISMS to adapt to new threats and changes in organizational strategy.
Compliance
Magic Makers reserves the right to audit and monitor employee activities and information handled through its information systems.
All employees must comply with the Information Security Policy and Specific Security Policies.
Failure to comply with these policies will result in disciplinary measures proportional to the violation committed.
Review
This policy is reviewed and updated annually or as necessary.
Approved by CEO.