Information Security Policy
[INSERT COMPANY NAME]
Last Updated: [DATE]

1. Introduction and Philosophy
Welcome to [COMPANY NAME]. Our customers trust us with their data, and safeguarding that trust is the responsibility of every person on our team, not just the IT department. 

This policy isn't meant to drown you in technical jargon. Instead, it outlines the practical, common-sense rules we all need to follow to keep our company, our customers, and your personal information safe. 

2. Data Classification (DCM)
Not all data requires the same level of security. To make things simple, we classify all company data into three categories:

•	Public Data: Information that is freely available to anyone (e.g., our website content, press releases, public marketing materials). No special protection required.
•	Internal Data: Business information needed to do our jobs, but not meant for the public (e.g., internal memos, generic organizational charts, standard operating procedures). Should not be shared outside the company without permission.
•	Confidential / Personal Information: Highly sensitive data that could cause harm if leaked. This includes customer data, employee Personally Identifiable Information (PII) like Social Security Numbers, financial records, passwords, and source code. This data must be strictly safeguarded. It must never be sent via unencrypted personal email or stored on unapproved personal devices.

3. Safeguarding Data and Devices
The devices we use are the gateways to our company's data. Every team member is responsible for the security of their workspace, whether in the office or remote.

•	Passwords and Authentication: Use strong, unique passwords (ideally managed by a company-approved password manager) for all company accounts. Never share your password with anyone, including IT staff. Two-Factor Authentication (2FA) must be enabled on all critical applications (email, CRM, payroll, Ethica, etc.).
•	Screen Locking: Always lock your computer screen (Windows Key + L or Command + Control + Q on Mac) when you step away from your desk, even if you are just filling your coffee or working from home. Unattended, unlocked laptops are a major risk.
•	Physical Security: Do not leave company laptops or physical documents containing confidential information unattended in public places (like coffee shops) or visible in parked vehicles.
•	Software Updates: When your computer or phone prompts you to update its operating system or web browser, do so promptly. These updates often contain critical security patches.

4. Email Security and Phishing
Email is the most common entry point for cyber attacks. Most breaches start with a simple phishing email rather than a complex hack. Please adhere to the following rules:

•	Verify the True Sender: Always check the actual email address of the sender, not just the display name. Attackers frequently impersonate executives. If the "CEO" emails you from a random Gmail address asking you to buy gift cards or urgently wire money, it is a scam.
•	Think Before You Click: Do not click links or download attachments from unknown senders, or expected senders whose emails look unusual.
•	The Golden Rule - "When in Doubt, Don't Click": If an email looks suspicious, contact the sender via a different method (e.g., call them, Slack them, or text them) to verify it. Do not reply to the suspicious email to ask if it's real.

5. Device Policies (BYOD vs. Company Issued)
•	Company Issued Devices: Laptops and phones issued by the company are for business use. Do not install unauthorized software or let family members use them.
•	Personal Devices (Bring Your Own Device - BYOD): If you access company email or Slack on your personal phone, your phone must have a passcode/biometric lock enabled. 

6. Incident Reporting Protocol
Time is critical during a security incident. We do not punish employees who fall victim to sophisticated scams, provided they report it immediately. 

If you suspect you clicked a malicious link, if your laptop is lost or stolen, or if you accidentally send confidential information to the wrong person, you must report it immediately.

Contact Information:
Primary IT Security Contact: [NAME / EMAIL]
Emergency Phone Number: [PHONE NUMBER]

Acknowledgment
Rather than signing a physical piece of paper, we track acknowledgments digitally to save time and reduce waste.

Please log into our compliance portal (via the magic link sent to your email) to digitally check the acknowledgment box indicating you have read, understood, and agree to follow this Information Security Policy.