Purpose

Information that’s collected, analysed, stored, communicated and reported upon may be subject to theft, misuse, loss and corruption. Information may be put at risk by poor education and training, and the breach of security controls.

Information security incidents can give rise to embarrassment, financial loss, non-compliance with standards and legislation, as well as possible judgements being made against Oho Experience Company Limited (“Oho Experience”).

This high level Information Security Policy sits alongside the ‘Information Risk Management Policy’ and ‘Data Protection Policy’. This is to provide the high-level outline of, and justification for, Oho Experience’s risk-based information security controls.

Objectives

Oho Experience’s security objectives are that:

• our information risks are identified, managed and treated according to an agreed risk tolerance
• our authorised users can securely access and share information in order to perform their roles
• our physical, procedural and technical controls balance user experience and security
• our contractual and legal obligations relating to information security are met
• our teaching, research and administrative activity considers information security
• individuals accessing our information are aware of their information security responsibilities
• incidents affecting our information assets are resolved and learnt from to improve our controls

Scope

The Information Security Policy and its supporting controls, processes and procedures apply to all information used at Oho Experience, in all formats. This includes information processed by other organisations in their dealings with Oho Experience.

The Information Security Policy and its supporting controls, processes and procedures apply to all individuals who have access to Oho Experience information and technologies. This includes external parties that provide information processing services to Oho Experience.

Compliance monitoring

Compliance with the controls in this policy will be monitored by the Development and Infrastructure Team, and reported to the Executive Board.

Review

A review of this policy will be undertaken by the Data Protection Officer (DPO). This will be annually or as required, and will be approved by the CTO.