KMU Information Securiy Policy

出自KMU Wiki

---

在2013年11月20日 (三) 11:00所做的修訂版本

Kaohsiung Medical University Information Security Policy

Document No. IS-A-001

Confidentiality level general

Revision 1.3

目錄 1 Objective 2 Scope 2.1 Information security policy setting and evaluation. 2.2 Information security organization . 2.3 Information asset classification and control . 2.4 Safety of personnel management and training . 2.5 Physical and environmental security. 2.6 Communication and job security management. 2.7 Access control security . 2.8 Safety system development and maintenance . 2.9 Information security incident response and handling of . 2.10 Business continuity operations management . 2.11 Regulations and compliance policy implementation units . 3 Target 3.1 Protection of our business activities information from unauthorized access . 3.2 Protection of our business activities information from unauthorized modifications to ensure that it is correct and complete . 3.3 IT business continuity establish operational plans to ensure the continued operation of our business activities . 3.4 School 's activities shall comply with the implementation of the requirements of relevant laws or regulations . 4 Responsibility 4.1 School's management to establish and review this policy. 4.2 Information security managers through appropriate standards and procedures to implement this policy. 4.3 All personnel and outsourcing services vendors are required in accordance with relevant safety management procedures to maintain information security policies. 4.4 All officers are responsible for reporting information security incidents and of any identified weaknesses. 4.5 Any compromise information security behavior , depending on the seriousness will pursue its legal responsibility and administrative responsibility according to the school or the relevant provisions of punishment . 5 Review 6 Implementation 6.1 Information security policy management review meetings with the information security policy audits. 6.2 This policy will be "Information Security Committee" after the implementation of the resolutions , amendments are made.

Objective

The set of policies aimed at ensuring Kaohsiung Medical University (hereinafter referred to as the school) belongs information assets confidentiality, integrity and availability, and comply with the requirements of relevant laws and regulations, harmless from internal and external threat of deliberate or accidental .

Scope

Information security management covers 11 management issues, to avoid human error, deliberate or natural disasters and other factors, resulting information is not When using, leakage, tampering, destruction, violations occur, our school has brought a variety of possible risks and hazards. Management issues are as follows:

Information security policy setting and evaluation.

Information security organization .

Information asset classification and control .

Safety of personnel management and training .

Physical and environmental security.

Communication and job security management.

Access control security .

Safety system development and maintenance .

Information security incident response and handling of .

Business continuity operations management .

Regulations and compliance policy implementation units .

Our school 's internal staff, outsourcing vendors and visitors and should comply with this policy .

Target

Maintain the confidentiality of our information assets , integrity and availability , and protect user data privacy. With all my colleagues in common Efforts to achieve the following objectives:

Protection of our business activities information from unauthorized access .

Protection of our business activities information from unauthorized modifications to ensure that it is correct and complete .

IT business continuity establish operational plans to ensure the continued operation of our business activities .

School 's activities shall comply with the implementation of the requirements of relevant laws or regulations .

Responsibility

School's management to establish and review this policy.

Information security managers through appropriate standards and procedures to implement this policy.

All personnel and outsourcing services vendors are required in accordance with relevant safety management procedures to maintain information security policies.

All officers are responsible for reporting information security incidents and of any identified weaknesses.

Any compromise information security behavior , depending on the seriousness will pursue its legal responsibility and administrative responsibility according to the school or the relevant provisions of punishment .

Review

This policy should be reviewed at least annually once only , to reflect the government decree , the latest technology and business development status , to ensure that the school forever Continued operation of network services and the provision of academic ability .

Implementation

Information security policy management review meetings with the information security policy audits.

This policy will be "Information Security Committee" after the implementation of the resolutions , amendments are made.