www.informationshield.com
Information Security Policies
Information Exchange Policy
Policy #
Version
1.0
Effective Date
Contact
MM/DD/YYYY
Policy Contact
Email
Phone
contact@companyx.com
888.123.4567
Table of Contents
Purpose ..................................................................................................................................... 1
Scope ........................................................................................................................................ 1
Policy ......................................................................................................................................... 1
Violations ..................................................................................................................................11
Definitions .................................................................................................................................11
References ...............................................................................................................................11
Related Documents ..................................................................................................................11
Approval and Ownership ...........................................................................................................11
Revision History ........................................................................................................................12
PURPOSE
This policy defines the requirements for the exchange of information with parties external to
Company X.
SCOPE
The target audience of this policy is any Company X employee and partner who access any
Company X information in hardcopy or on any Company X information asset.
POLICY
Disclosure Restrictions
External Information Requests - All requests from a third party for internal information that
is not classified as PUBLIC must be approved by both the Information Owner and the
Company X corporate counsel, who must each be given five business days to evaluate the
merits of the request.
Requests For Organization Information - Unless authorized by top management, all
requests for information about Company X and its business activities including, but not
limited to, questionnaires, surveys, and newspaper interviews, must be referred to the Public
Relations Department.
Information Transfer To Third Parties - Company X software, documentation, and all
other types of internal information must not be sold or otherwise transferred to any nonCompany X party for any purposes other than those expressly authorized by management.
Computer-Related Access Numbers - Information regarding access to Company X
computer and communication systems, such as dial-up modem phone numbers, is
considered confidential and must not be posted on the Internet, listed in telephone
Policy #
CONFIDENTIAL
Page 1
directories, placed on business cards, or otherwise made available to third parties without
the advance written permission of the Information Security Manager.
Disclosure Of Information System Controls - Workers must not disclose to any persons
outside Company X either the information system controls that are in use or the way in
which these controls are implemented without the permission of the Information Security
Manager.
Internet Information Exchange - Company X software, documentation, and all other types
of internal information must not be sold or otherwise transferred to any non-Company X
party for any purposes other than the business purposes expressly authorized by
management.
Financial Information Disclosure - Every disclosure of information about the financial
condition of Company X, anticipated changes in financial position, and business
developments that could reasonably be expected to materially alter the way investors view
the company must be cleared in advance with the Public Relations Department or a vice
president, and made publicly available to all investors and interested parties at the same
time.
Fair Disclosure Of Material Financial Information - Every unintentional disclosure of
material financial information, to either a private group or a private individual outside of
Company X, must be followed by a public announcement within a twenty-four hour period.
Organization Representations - All business-related representations made by Company X
workers including, but not limited to, those made in advertisements, in union negotiations,
on product labels, and in government reports, must be truthful at all times.
Sharing Marketing Information - Marketing information including, but not limited to, prices,
sales policies, strategies, plans, market share status, and other marketing information must
never be disclosed to competitors.
Legal Action Information - Third-party requests for information related to a current legal
case must not be granted unless the request is made by an authorized government agency
or court of law.
Future Earnings Or Products - Workers must not make any public representations about
Company X future earnings or the prospects for new products.
External Information Requests - All requests from a third party for internal information that
is not of a sales, marketing, or public relations nature must be approved by both the
Information Owner and the Company X corporate counsel, who must each be given five
business days to evaluate the merits of the request.
Controversial Sensitive Information - Controversial and sensitive Company X information
must be released to the public in installments.
Public Information Disclosures
Public Representation Approval - All public representations including, but not limited to,
media advertisements, Internet home pages, electronic bulletin board postings, and voice
mail broadcast messages, must be issued or approved by the Public Relations Department.
Release Of Organization Information - Permission to disclose any internal Company X
information to the news media or to other third parties must be obtained from Company X
senior management prior to release.
Policy #
CONFIDENTIAL
Page 2
Information Released To The Public — Contact Name - Information generated by
Company X and released to the public must be accompanied by the name of a designated
staff member acting as the single recognized official source and point-of-contact.
Information Released To The Public — Authorization - All internal Company X
information to be released to the public must have first been reviewed by management
according to an established and documented process.
Information Disclosure Approval - Disclosure of any file stored on Company X systems,
or any message sent through the Company X network, to outside parties must be preceded
by the review and approval of the vice president of the Legal Department.
Nature And Location Of Organization Information - Information about the nature and
location of Company X information, such as that found in a data dictionary, is confidential
and must only be disclosed to those with a demonstrable need to know.
Agreements
Software And Data Exchange Agreements - Exchanges of in-house software or internal
information between Company X and any third party must be accompanied by a written
agreement that specifies the terms of the exchange, and the manner in which the software
or information is to be handled and protected.
Third-Party Software Agreements - All software developed by Company X for use by
prospects, customers, business partners, and others, must be distributed only after the
recipients have signed an agreement stating they will not disassemble, reverse engineer,
modify, or otherwise use the programs except as agreed with Company X.
Online Contracts By Exchange Of Paper And Signatures - Whenever third parties accept
an online offer made by Company X, they must provide paper-based, hand-rendered
signatures by regular mail or courier.
Identity Validation Of External Parties - Before workers release any internal Company X
information, enter into any contracts, or order any products through public networks, the
identity of the individuals and organizations contacted must be confirmed through digital
certificates, letters of credit, third-party references, or telephone conversations.
Transit Controls
Delivering Sensitive Computer Output - Private, confidential, or secret computer system
hardcopy output must be personally delivered to the designated recipients and never
delivered to an unattended desk, or left out in the open in an unoccupied office.
Using Couriers - Private, Confidential, or Secret information in hardcopy form that is sent
through commercial courier must always be tracked with a weigh bill number and must
always be marked recipient “signature required.”
Delivery Of Secret Information - All deliveries of secret information must be conducted
such that the recipient formally acknowledges that the information has been received.
Secret Information Leaving Offices - Secret Company X information, no matter what form
it happens to take, must not leave Company X offices unless the approval of the Information
Security Manager has first been obtained.
Sensitive Information Removal Log - All sensitive information removed from Company X
premises must be logged with a record of the date, the information involved, and the
persons possessing the information.
Policy #
CONFIDENTIAL
Page 3
Downloading Sensitive Information - Before any Company X secret, confidential, or
private information may be transferred from one computer to another, the worker making the
transfer must ensure that access controls on the destination computer are commensurate
with access controls on the originating computer.
Sending Sensitive Information - If private, confidential, or secret information is sent
through internal mail, external mail, or by courier, it must be enclosed in two envelopes or
containers with the outside envelope or container providing no indication of the sensitivity of
the information contained therein and the inside sealed and opaque envelope or container
labeled “Private,” “Confidential,” or “Secret.”
Trade Secrets
Sending Secret Information - Secret information must be shipped or sent through internal
or external mails in a sealed opaque envelope marked “To Be Opened By Addressee Only,”
which is enclosed in a plain outer envelope that does not indicate the sensitivity of the
contents.
Transmitting Secret Hardcopy Information - Secret information in hardcopy form must be
sent by trusted courier or registered mail.
Wireless Transmissions Of Secret Information - Wireless technology must never be used
for the transmission of unencrypted secret information.
Software Distributed To Third Parties - All software developed by Company X for use by
prospects, customers, business partners, and others must be distributed in object code form
only.
Third-Party Delivery Of Secret Information - Unencrypted secret information must not be
sent through any third parties including, but not limited to, couriers, postal services,
telephone companies, and Internet service providers.
Traveling With Secret Information - Workers must not travel on public transportation when
in the possession of secret Company X information unless specific management approval
has been obtained.
International Transport Of Secret Information — Security - Whenever secret information
is carried by a Company X worker into a foreign country, the information must either be
stored in some inaccessible form or must remain in the worker’s possession at all times.
International Transport Of Secret Information — Authorization - Company X workers
must not take secret Company X information into another country unless advance
permission has been obtained from the Information Security Manager.
Encryption Of Private Electronic Mail - Unencrypted information that has been labeled
private must never be transmitted through electronic mail.
International Travel - Special Travel Laptops Required - All Company X employees
traveling with Secret information must only use special “travel” laptops issued by the
Information Technology department. These special devices are stripped of all non-essential
information and must employ both full-disk encryption and two-factor authentication.
Public Network Data Transmission - Strong cryptography and security protocols such as
SSL/TLS or IPSEC must be implemented to safeguard confidential Company X information,
e.g., cardholder data, during transmission over open, public networks.
Faxing Information
Policy #
CONFIDENTIAL
Page 4
Faxing Sensitive Information — Notification - If secret information is to be sent by fax,
the recipient must have been notified of the time when it will be transmitted, and also have
agreed that an authorized person will be present at the destination machine when the
material is sent. An exception to this policy is permitted when the destination fax machine is
physically or logically restricted such that persons who are not authorized to see the material
being faxed may not enter the immediate area or otherwise gain access to faxes received.
Faxing Sensitive Information — Human Presence - Sensitive materials must not be faxed
unless the sender has immediately beforehand confirmed that an authorized staff member is
on hand to properly handle the materials at the receiving machine. When the transmission is
complete, the staff member at the receiving end must confirm to the sender that a certain
number of pages were received. An exception is allowed if the receiving machine is in a
locked room accessible only to authorized personnel, or if a password-protected fax mailbox
is used to restrict unauthorized release of faxed materials.
Faxing Sensitive Information — Intermediaries - Sensitive Company X information must
not be faxed through untrusted intermediaries including, but not limited to, hotel staff, airport
office services staff, and rented mailbox store staff.
Faxing Sensitive Information — Cover Sheet - When sensitive information must be faxed,
a cover sheet must be sent and acknowledged by the recipient, after which the sensitive
information may be sent through a second call.
Faxing Sensitive Information — Unencrypted - Sensitive information may be faxed over
unencrypted lines only when time is of the essence, no alternative and higher-security
transmission methods are available, and voice contact with the receiving party is established
immediately prior to transmission.
Faxing Sensitive Information — Physical Security - Secret or confidential information
must not be sent to an unattended fax machine unless the destination machine is in a
locked room for which the keys are possessed only by people authorized to receive the
information.
Faxing Sensitive Information - Annual Inventory of FAX numbers - Company X must
maintain an inventory of all outgoing FAX numbers and the associated organization
designated to receive sensitive information. The list of numbers must be updated and
verified annually. The list must be distributed to all personnel responsible for transmitting
sensitive data.
Faxing Secret Information — Encryption - Secret information must not be sent by fax
unless the transmission is encrypted using methods approved by the Company X
Information Security Department.
Faxing Confidential Information — Speed Dial - When confidential information is sent by
fax, the operator must not use preset destination telephone numbers, but must instead
manually enter the destination number.
Faxing Secret Information — Passwords - Secret information must not be sent by fax
unless the receiving machine, prior to the initiation of a transmission, successfully receives a
correct password from an authorized person at the receiving end of the transmission.
Fax Cover Sheet Notice - All outgoing Company X faxes must include a cover sheet that
includes wording approved by the Legal Department.
Fax Logs - Logs reflecting the involved phone numbers and the number of pages for all
inbound and outbound fax transmissions must be retained for one year.
Policy #
CONFIDENTIAL
Page 5
Electronic Messaging
Secret Information In Electronic Mail - Unencrypted secret information must not be sent
by electronic mail unless a vice president specifically authorizes each occurrence.
Electronic Mail Addresses - Workers must not employ any electronic mail addresses other
than official Company X electronic mail addresses for all company business matters.
Sender Contact Information - All electronic mail sent using Company X information
systems must contain the sender’s first and last name, job title, organizational unit, and
telephone number.
Electronic Marketing Material Source - All marketing materials sent through electronic
mail must include an accurate return address and must provide clear and explicit
instructions permitting recipients to quickly be removed from the distribution list.
Centralized Control Over Electronic Mail Systems - Centralized control over both
inbound and outbound electronic mail will be provided by the Information Technology
Department. All Company X electronic mail must flow through systems established,
operated, and maintained by that same department.
Outbound Electronic Mail Footers - A footer prepared by the Legal Department that
indicates that the message may contain confidential information, is for the use of the named
recipients only, has been logged for archival purposes, may be reviewed by parties at
Company X other than those named in the message header, and does not necessarily
constitute an official representation of Company X, must be automatically appended to all
outbound electronic mail originating from Company X computers.
Outbound Electronic Mail Footer Approval - All outbound electronic mail messages sent
from Company X computers must have a standard footer automatically added to it. The
words appearing in this footer must be approved by both the Information Security Manager
and the Chief Legal Counsel.
Sales Department Electronic Mail - Salespersons must not send electronic mail messages
to customers or prospects unless these messages are first reviewed and approved by a
supervisor.
Electronic Mail Distributions - Company X must receive a positive confirmation through an
opt-in process for anyone who is placed on an electronic mail distribution list.
Blocking To Field On Systems Containing Private Information - In order to prevent the
inappropriate disclosure of electronic mail addresses, the "to" field for all electronic mail
messages containing more than one addressee, that are issued from systems containing
private information, must be automatically blocked.
Customer Communications
Customer Status Notifications Sent Via Electronic Mail - Company X must not use
electronic mail as the sole source of notification for changes or updates to customer account
features. Any customer notifications sent via electronic mail will include instructions for
validating the authenticity of the message.
No Specific Information in Automated Electronic Replies - Automated electronic mail
replies should not include specific information, such as names and contact information for
Company-X personnel that could be used to gain access to sensitive data.
Business Information Systems
Policy #
CONFIDENTIAL
Page 6
Intermediate Products Containing Sensitive Information - If a copy machine jams or
malfunctions when workers are making copies of secret information, they must not leave the
machine until all copies of the information are removed from the machine or destroyed
beyond recognition.
Distribution Of Marketing Materials - Workers must not use facsimile machines, electronic
mail, auto-dialer robot voice systems, or any other electronic communications systems for
the distribution of unsolicited advertising material.
Recording Video Conferences - Company X video conferencing sessions must not be
recorded unless this recording is approved in advance by the manager of information
security and communicated in advance to all video conference participants.
Logically Separate Voice And Data On IP Networks - In every instance where voice over
IP (VOIP) technology is deployed at Company X facilities, this technology must use a
completely logically separate network other than the network used for data transmission.
Critical Telephone Services Must Not Be Supported Via VOIP - Company X businesscritical telephone services -- such as over-the-phone order-taking with sales representatives
-- must not be supported by voice over IP (VOIP) systems, until the Information Security
Manager deems these systems sufficiently reliable and stable to support these services.
End-User Application Programs - All small systems must use approved software license
management software which is configured to detect unauthorized copies of third-party
software as well as new or modified application programs developed by end users.
Diskless Workstations - All workers in the Research and Development Department must
use diskless workstations connected to an isolated departmental network when working on
new product development projects and tasks.
Time-Sensitive Information - The most confidential time-sensitive information must not be
handled by electronic mail, voice mail, telephone calls, or other computerized systems until
the specifics have been announced publicly.
Direct Inward System Access Implementation - Company X sites must not enable the
direct inward system access features on private branch exchange telephone systems unless
they are accompanied by a fraud detection and limitation system approved by the manager
of the Telecommunications Department.
Record Change Orders - Orders to change any internal Company X records that are
placed over the phone must not be honored unless the identity of the caller has been
verified by approved procedures.
Conference Bridge Activation - Conference bridges must be specifically activated only
when needed. They must not be left in an activated state when not in use.
Internet and Intranet
Publicly-Modifiable Directories - All publicly-modifiable directories on Company X Internetconnected computers must be reviewed and cleared each evening.
Intranet Postings - Before any information is posted to the Company X intranet, both the
department manager in charge of the relevant intranet page and the Owner of the involved
information must approve.
Intranet Content Ownership - Unless approved in advance by the Information Technology
Department Manager, and explicitly noted on the intranet web page, all content posted to
the Company X intranet is the property of Company X.
Policy #
CONFIDENTIAL
Page 7
Intranet Information Validation - Before posting material to the Company X intranet,
workers must resolve all legal issues associated with the posting, confirm that the
information and programs do not contain malicious code, and also confirm the information’s
accuracy, timeliness, and relevance to Company X business.
Intranet Content Review And Testing - All new or changed content to be posted to the
Company X intranet must pass through a staging area where authorized personnel will
review the content and test its operation, unless written approval of the Information Security
Manager has been obtained.
Internet Content Moved To Intranet - All content downloaded from the Internet must go
through a structured and documented cleansing process before being posted to the
Company X intranet.
Intranet Data Review - The Information Security Department must review all postings to the
Company X intranet quarterly to confirm that none of these postings contain confidential or
secret information.
Intranet Server Approval - All Company X intranet servers must be authorized by the
network services manager in the Information Technology Department before they are
connected to the internal network.
Access To Production Systems By Intranet - The intranet must not be used to provide
real-time connections to any Company X production information system that has extended
user authentication access controls, unless the approval of the Information Security
Manager has first been obtained.
Transfer To Internet From Intranet - Company X intranet users must not be transferred
directly to an Internet site without being presented with a notice indicating that the users are
about to be transferred to the Internet and a requirement that they confirm their
understanding of this network transfer.
Outbound Internet Communications - All outbound Internet communications must reflect
well on the Company X reputation and public image.
Internet News Sources - News feeds, electronic mail mailing lists, push data updates, and
other mechanisms for receiving information over the Internet must be restricted to material
that is clearly related to Company X business and the duties of the receiving workers.
Internet Representations Including Affiliation - When engaged in discussion groups, chat
rooms, and other Internet offerings, only those individuals authorized by management to
provide official support for Company X products and services may indicate their affiliation
with Company X.
Internet Disclosure Of Contact Information - Children and adults must not disclose their
real names, addresses, or telephone numbers on electronic bulletin boards, chat rooms, or
other public forums reached by the Internet.
Internet Transmission Of Sensitive Information - Unencrypted Company X secret,
proprietary, or private information must not be sent over the Internet.
Transferring Downloaded Files - Computers that are not connected to the Company X
network must be used when downloading any files from the Internet. These files must then
be checked with an authorized virus detection package prior to being moved to any other
computer.
Web Site Security
Policy #
CONFIDENTIAL
Page 8
Web Sites With Similar Names - Company X Legal Department staff must periodically
employ web search engines to determine whether any web sites with similar names are
masquerading as Company X authorized or sponsored sites.
Unofficial Web Pages - Every sponsor and/or owner of an unofficial web page dealing with
Company X products or services must have an in-force contract signed by the Public
Relations Department Manager.
Internet Web Page Review - A staff member from the Marketing Department must check
the Company X web page daily to confirm that the page is up-and-running, that no
unauthorized changes have been made, and that no unauthorized links have been
established.
Internet Server Command Response - Internet servers must be modified so the verbose
response to certain commands does not reveal information about the server software
installed.
Secret Information On Web - Company X secret information must not be resident on either
Internet or intranet servers.
Internet Monitoring For Information Use - The Legal Department must monitor the
Internet on at least a monthly basis for the unauthorized use of Company X trademarks,
service marks, brand names, or copyrighted materials owned by Company X.
Use Of Third-Party Trademarks - Company X web and commerce sites must not use any
other organization’s trademarks or service marks anywhere unless the usage reflects the
actual attributes of Company X products or services, and advance permission has been
obtained from Company X corporate legal counsel.
Encryption
Concealing Information Transmission - Information that is sensitive, which may be used
by adversaries, and that is readily available in readable form over public channels, must be
slightly modified to conceal its true high-integrity nature.
Secret Data Transmission - All Company X secret data transmitted over any
communication network must be encrypted.
Protecting Outbound Secret Computerized Information - All secret computerized
information which is being sent to any external party must be encrypted using an encryption
process approved by the Information Security Department.
Transportation Of Secret Data - All secret data transported in computer-readable storage
media must be encrypted.
Secret Information Encryption - All computerized secret information must be encrypted,
with tools approved by the Information Security Department, when not in active use for
authorized business purposes.
VOIP Remote Management Or Auditing Requires Encrypted Channel - Whenever either
remote management or remote auditing is performed on a voice over IP (VOIP) network,
these connections must employ a fully-encrypted channel.
Customer Electronic Mail Encryption - Every electronic mail message containing private
information about one or more specific customers must be encrypted when sent through a
network.
Policy #
CONFIDENTIAL
Page 9
Electronic Mail Encryption - All sensitive information including, but not limited to, credit
card numbers, passwords, and research and development information must be encrypted
when transmitted through electronic mail.
Compression And Encryption Of Secret Data - If secret information is to be stored on a
multi-user computer system, it must be compressed, then encrypted using an approved
encryption algorithm.
Encrypted Message Protection - All content sent over the Company X internal data
network must be encrypted. This network must also employ diversionary messages to
conceal the fact that certain parties are communicating with certain other parties. Messages
must also be padded with extraneous information to conceal the length of the actual
messages being sent.
Anonymous FTP Server Information - All user-provided files that have not been explicitly
approved for public release by the Marketing Department, and that are resident on the
Company X anonymous FTP server, must be encrypted using Company X standard
software.
Public Information
Publicly Posting Only Generic Information - With the exception of top management, all
publicly-posted contact points must use generic job titles rather than individual names. For
example, web sites, Internet public databases, and help wanted advertising would refer to
"systems administrator" rather than "Mary Smith." Likewise, direct dial telephone numbers
and individual email accounts must not be publicly posted.
Permissible Ways To Obtain Competitive Information - Company X workers must obtain
information about competitors from public domain sources, or legally purchase such
information from its rightful owner (such as a market research firm). Competitor information
gathered by any other means, whether intentionally or unintentionally obtained, must be
reported immediately to the Company X chief legal officer.
Third-Party Use Of Organization Name - No third-party organization may use the
Company X name in its advertising or marketing materials unless the written permission of
corporate legal counsel has first been obtained.
Use Of Organization Name - Every public written use of the Company X name in published
material requires the advance approval of a vice president or the Public Relations
Department.
Presentation Of Public Image - Company X must at all times present a low-profile and
secure image to both the public and third parties. This means that information about the
existence and nature of significant assets must be accessible only to those persons with a
demonstrable need to know.
Public Access Workstations - All user-supplied files and all temporary files created by
workstation-resident software must be automatically deleted nightly.
Public Research - Whenever Company X performs polls, analytical studies, or other
research that is intended for public consumption, the authors of the research must clearly
state in their report both the sponsor(s) and all potential conflicts of interest.
Policy #
CONFIDENTIAL
Page 10
VIOLATIONS
Any violation of this policy may result in disciplinary action, up to and including termination of
employment. Company X reserves the right to notify the appropriate law enforcement
authorities of any unlawful activity and to cooperate in any investigation of such activity.
Company X does not consider conduct in violation of this policy to be within an employee’s or
partner’s course and scope of employment, or the direct consequence of the discharge of the
employee’s or partner’s duties. Accordingly, to the extent permitted by law, Company X
reserves the right not to defend or pay any damages awarded against employees or partners
that result from violation of this policy.
Any employee or partner who is requested to undertake an activity which he or she believes is
in violation of this policy, must provide a written or verbal complaint to his or her manager, any
other manager or the Human Resources Department as soon as possible.
DEFINITIONS
Confidential Information (Sensitive Information) - Any Company X information that is not
publicly known and includes tangible and intangible information in all forms, such as information
that is observed or orally delivered, or is in electronic form, or is written or in other tangible form.
Confidential Information may include, but is not limited to, source code, product designs and
plans, beta and benchmarking results, patent applications, production methods, product
roadmaps, customer lists and information, prospect lists and information, promotional plans,
competitive information, names, salaries, skills, positions, pre-public financial results, product
costs, and pricing, and employee information and lists including organizational charts.
Confidential Information also includes any confidential information received by Company X from
a third party under a non-disclosure agreement.
Information Asset - Any Company X data in any form, and the equipment used to manage,
process, or store Company X data, that is used in the course of executing business. This
includes, but is not limited to, corporate, customer, and partner data.
Partner - Any non-employee of Company X who is contractually bound to provide some form of
service to Company X.
REFERENCES
ISO/IEC 27002 - 10.8 Exchange of Information
RELATED DOCUMENTS
APPROVAL AND OWNERSHIP
Owner
Title
Date
Policy Author
Title
MM/DD/YYYY
Approved By
Title
Date
Executive Sponsor
Title
MM/DD/YYYY
Policy #
CONFIDENTIAL
Signature
Signature
Page 11
REVISION HISTORY
Version
Description
Revision
Date
Review
Date
1.0
Initial Version
MM/DD/YYYY
MM/DD/YYYY
Policy #
CONFIDENTIAL
Reviewer/Approver
Name
Page 12