Information Security Monitoring and Compliance Policy

1. Purpose

This policy makes sure the Organisation knows which laws, regulations, contracts and internal rules apply to its information and systems, checks that it meets them, and corrects what it finds. It also sets the ground rules for audits and technical testing so that they give reliable results without disturbing the services they examine.

It supports the monitoring, measurement and internal audit requirements of the information security management system, and works with the Cyber Compliance Plan, which lists the scheduled compliance activities.

2. Scope

• In scope: all legal, regulatory, contractual and internal requirements that bear on information security, privacy, intellectual property, records and cryptography.
• In scope: all information systems, networks, applications, cloud services and processes run by or for the Organisation, including those run by suppliers.
• In scope: internal audits, external audits, customer audits, technical compliance checks and security testing.
• Out of scope: financial statutory audit procedures, except where they need access to security records. Detailed procedures for testing are in the Vulnerability Assessment and Penetration Testing Procedure.

3. Terms and definitions

4. Roles and Responsibilities

5. Compliance Policy Statements

5.1 Identifying legal and contractual requirements

• The Head of Compliance, with Legal, keeps a legal register of every law, regulation, licence, customer contract term and industry commitment that affects information security. Each entry has an owner, the controls that meet it, the evidence, and the next review date.
• The register is reviewed at least [every 6 months], and when a new law is published, a significant contract is signed or the Organisation starts work in a new country.
• Owners of processes confirm [every 12 months] that the entries covering their process are correct.
• Where the Organisation operates outside India, applicable law in each jurisdiction where the Organisation operates (such as the EU General Data Protection Regulation) is added to the register on advice from local counsel.

5.2 Statutory and regulatory obligations

The register includes at least the laws below. This table is a prompt for the register and is not legal advice; Legal confirms each entry before use.

5.3 Intellectual property and licensing

• Software, data and content are used only under valid licences. The IT asset register lists licences with the number purchased and the number in use, reconciled at least [every 6 months].
• Unlicensed or unauthorised software is removed on discovery. Staff must not copy licensed material beyond the licence.
• Open-source components are used under a recorded licence review, and obligations such as attribution are met.
• Where the Organisation holds licensed or customer-owned content, it respects the terms on copying, retention and onward sharing.

5.4 Protection of records

• Records required by law, contract or audit are identified in the records schedule, with a retention period, owner and format, as in the Documents and Records Management Procedure.
• Records are protected against loss, destruction, falsification and unauthorised access for their whole retention period. Where media may degrade, a migration plan is kept.
• Records subject to a legal hold or investigation are preserved and not destroyed until Legal releases the hold.

5.5 Privacy and protection of personal information

Personal data is handled according to the Data Protection and Privacy Policy. Compliance reviews check lawful basis or consent records, retention, individual rights handling, breach readiness and supplier contracts [at least annually]. The data protection lead reports gaps to the Head of Compliance.

5.6 Regulation of cryptographic controls

Encryption, digital signatures and key lengths are used in line with applicable import, export and use rules. Before the Organisation ships or deploys cryptography across borders, Legal checks restrictions. Cryptographic choices and key handling follow the Cryptography Policy.

5.7 Reporting to authorities and customers

• Only the persons named in the Information Security Incident Management Policy contact regulators or the national response team on behalf of the Organisation.
• Customer breach notices follow contract terms and are approved by Legal and top management.
• Requests from authorities, courts or law enforcement are sent to Legal on receipt, logged, and answered only after verifying authority and scope.

6. Compliance with Policies, Standards and Technical Requirements

6.1 Compliance with security policies and standards

• Managers review at least [every 12 months] that people in their area follow security policies and procedures, using a checklist from the Head of Compliance.
• System owners complete a self-assessment [twice a year] against the control requirements for their system and return evidence.
• The Head of Compliance samples the results and reports differences. Where a requirement is not met, the owner records a non-conformity with a cause, a corrective action, an owner and a due date.

6.2 Technical compliance checking

• Servers, endpoints, network devices, databases, cloud tenants and applications are checked against their secure configuration standard by automated tools at least [monthly] and after significant change.
• Vulnerability scans run at least [monthly] on internal systems and [weekly] on internet-facing systems, following the Vulnerability Assessment and Penetration Testing Procedure.
• Independent penetration tests are done at least [every 12 months] on internet-facing systems and critical applications, and after major releases.
• Test results are reviewed by a technically competent person, tracked to closure, and used to improve configuration standards.
• Testing is authorised in writing, scoped and scheduled, and the tester is competent and bound by confidentiality.

6.3 Independent review of information security

The approach to managing information security, including objectives, controls, policies and processes, is reviewed independently at planned intervals of at most [12 months] and when significant changes occur. The reviewer is an internal auditor not involved in the area, or an external party. The review and its follow-up are reported to top management.

7. Information Systems Audit Considerations

• Audit requirements and activities that involve checking operational systems are agreed with the system owner in advance, scheduled outside peak periods and limited to what is needed.
• Auditors get read-only access to software and data wherever possible. Where more is needed, it is time-limited, approved and monitored. Any audit copy of files is erased or protected on completion.
• Auditors work from named accounts, never from shared or owner credentials, and their activity is logged.
• Tests that could affect availability, such as load tests or penetration tests on production, are run only with a change record and a rollback plan, and outside business-critical windows.
• Audit tools and working papers are kept out of reach of those being audited and protected at the classification of the content.
• Customers' and regulators' audit rights in contracts are honoured; requests are routed through the Head of Compliance, who agrees scope and dates and checks that audit does not expose other customers' data.

8. Audit programme and findings management

Internal audit prepares an annual audit plan that covers every part of the management system at least once in [12 months], with more frequent coverage of high-risk areas. Findings are classified and tracked in the findings register until verified closed.

9. Compliance Monitoring and Measures

The Head of Compliance reports these measures [quarterly] to top management and as part of management review.

10. Records and evidence

• Legal register and review records: kept while current and for [7 years] after retirement.
• Audit plans, working papers, reports and findings register: [5 years].
• Technical scan outputs and penetration test reports: [3 years], or longer if an audit requires.
• Self-assessments and management confirmations: [3 years].
• Regulator and customer audit correspondence: [7 years].

Annexure A: Legal and contractual requirements register

Annexure B: Audit finding record

11. Exception

Exceptions to this document are allowed only where compliance is not practicable and the risk has been assessed. A request must state what is to be excepted, why, the risk it creates, the compensating controls, and an end date no later than [6 months]. It is approved in writing by the document owner and the risk owner, recorded in the exceptions register, and reviewed at the end date. An exception does not change the document.

12. Enforcement

Compliance is monitored through internal audits, management review and routine checks by the document owner. Non-compliance is reported through the incident or non-conformity process and handled under the organisation's disciplinary procedure, and under the terms of any contract for people who are not employees. Serious or repeated non-compliance may lead to loss of access and, where the law is broken, to referral to the authorities.

13. Review

This document is reviewed at least every [12 months], and when there is a significant change to the organisation, its systems, its risks or the law, or after an incident that shows it was not effective. Each review is recorded in the revision history.

ISO/IEC 27001:2022 references

Related documents

• Logging and Monitoring Policy
• Data Protection and Privacy Policy
• Information Security Policy
• Cyber Compliance Plan
• Vulnerability Assessment and Penetration Testing Procedure
• Documents and Records Management Procedure
• Supplier Relationship Management Policy