> Document Version: 1.0 Document Owner: Acme Inc Next Review Date: 2027-03-19

Effective Date: 2026-03-19

Last Updated: 2026-03-19

Organization: Acme Inc

Project: nextjs-saas-example

## Related Documents

- Security Policy (`SECURITY.md`)
- Access Control Policy (`ACCESSCONTROLPOLICY.md`)
- Encryption Policy (`ENCRYPTION_POLICY.md`)
- ISO 27001 Compliance Checklist (`ISO27001CHECKLIST.md`)

## 1. Purpose

This Information Security Policy establishes the framework for protecting Acme Inc's information assets. It aligns with ISO 27001 and NIST CSF standards.

## 2. Scope

This policy applies to:

- All information systems and data assets
- All employees, contractors, and third-party users
- All 8 integrated services detected in this project

## 3. Information Security Objectives

- Confidentiality — Protect information from unauthorized access
- Integrity — Ensure accuracy and completeness of information
- Availability — Ensure authorized users have access when needed

## 4. Roles and Responsibilities

Role | Responsibility
--- | ---
CISO / Security Lead | Overall security strategy and policy enforcement
Development Team | Secure coding practices, vulnerability remediation
Operations Team | Infrastructure security, access management
All Staff | Compliance with this policy, incident reporting

## 5. Access Control

- Principle of least privilege for all system access
- Multi-factor authentication required for production systems
- Access reviews conducted quarterly
- Immediate access revocation upon role change or termination

## 6. Development Security

CI/CD provider: Unknown

- Automated testing: Not detected — recommended
- Linting: Not detected — recommended
- Security scanning: Not detected — recommended
- Dependency scanning: Not detected — recommended

## 7. Incident Management

- All security incidents must be reported within 1 hour of discovery
- Security incidents: legal@acme.com
- See Incident Response Plan for detailed procedures

## 8. Policy Review

This policy is reviewed annually or upon significant changes to the information security environment.

Generated by Codepliant. Review with your security team before adopting.