# Information Security Policy

> **Document Version:** 1.0  
> **Document Owner:** Acme Inc  
> **Next Review Date:** 2027-03-19


**Effective Date:** 2026-03-19
**Last Updated:** 2026-03-19
**Organization:** Acme Inc
**Project:** nextjs-saas-example

## Related Documents

- Security Policy (`SECURITY.md`)
- Access Control Policy (`ACCESS_CONTROL_POLICY.md`)
- Encryption Policy (`ENCRYPTION_POLICY.md`)
- ISO 27001 Compliance Checklist (`ISO_27001_CHECKLIST.md`)

---

## 1. Purpose

This Information Security Policy establishes the framework for protecting Acme Inc's information assets. It aligns with ISO 27001 and NIST CSF standards.

## 2. Scope

This policy applies to:

- All information systems and data assets
- All employees, contractors, and third-party users
- All 8 integrated services detected in this project

## 3. Information Security Objectives

- **Confidentiality** — Protect information from unauthorized access
- **Integrity** — Ensure accuracy and completeness of information
- **Availability** — Ensure authorized users have access when needed

## 4. Roles and Responsibilities

| Role | Responsibility |
|------|---------------|
| CISO / Security Lead | Overall security strategy and policy enforcement |
| Development Team | Secure coding practices, vulnerability remediation |
| Operations Team | Infrastructure security, access management |
| All Staff | Compliance with this policy, incident reporting |

## 5. Access Control

- Principle of least privilege for all system access
- Multi-factor authentication required for production systems
- Access reviews conducted quarterly
- Immediate access revocation upon role change or termination

## 6. Development Security

CI/CD provider: **Unknown**

- Automated testing: Not detected — recommended
- Linting: Not detected — recommended
- Security scanning: Not detected — recommended
- Dependency scanning: Not detected — recommended

## 7. Incident Management

- All security incidents must be reported within 1 hour of discovery
- Security incidents: legal@acme.com
- See [Incident Response Plan](./INCIDENT_RESPONSE_PLAN.md) for detailed procedures

## 8. Policy Review

This policy is reviewed annually or upon significant changes to the information security environment.

---

*Generated by Codepliant. Review with your security team before adopting.*
