In order to preserve the appropriate confidentiality, integrity and availability of FundApps information assets, we must make sure they are protected against unauthorized access, disclosure or modification. This is not just critical for assets covered by the Data Protection Act but for all customer information we deal with across the FundApps business.

This standard applies to all FundApps information, irrespective of the data location or the type of device it resides on.

Approach

As a result we can see at a glance

• What information assets fall under which data classification

• What information systems hold data falling under those classifications

• The controls that we expect each system to have in place

Responsibilities

FundApps & third parties

All FundApps employees, contractors and third parties who interact with information held by and on behalf of the FundApps are responsible for assessing and classifying the information they work with, and applying the appropriate controls. Individuals must respect the security classification of any information as defined, and must report the inappropriate situation of information to the Information Security Manager or Head of Security as quickly as possible.

Information Owners

Each type of information in our asset register has an explicitly designated owner, who is responsible for assessing information and classifying its sensitivity. They should then apply the appropriate controls in conjunction with our technology team to protect that information.

Management team

Responsible for the advising on and recommending information security standards on data classification, and ensuring these are regularly reviewed.

Classification guidance

Reporting Violations

Report suspected violations of this policy to the CTO or CEO. Reports of violations are considered Restricted data until otherwise classified.

Overview

FundApps approaches both information security and business continuity from risk based principles. Each identified information security or business continuity risk is reviewed with regard to Likelihood (the possibility of a risk happening), and Impact (the consequence of a risk happening).

Risks can be identified by any member of staff, and, staff members are encouraged to contribute. Once risks are identified and reviewed for Likelihood and Impact, an appropriate remediation plan can be formulated.

The key is that risk management drives activity to resolve identified risks, and is the responsibility is that of each employee of FundApps.

Risk Tolerance

Risk Management Process

Identify

Potential information security risks and business continuity risks are identified through both formal and informal channels

1. Monthly company-wide security awareness sessions

2. Monthly security review meetings

3. Incident response and reviews

4. As part of the Software Development Lifecycle

5. As part of the continuous release management

6. As part of everyday working practice

Assess

Likelihood and impact

Potential risks are recorded in the risk register and assigned an owner. Risks are assessed on two criteria with regards to any current controls that may already be in place:

Residual risk

Each risk level consists of

• the likelihood and impact levels

• a timeframe for review while the risk is open

• a timeframe for review once the risk is closed

Risk response

Based on this categorization we can then design a risk response in order to reduce our residual risk.

Strategies for responding to the risk can include:

• Avoid risk – activities with a high likelihood of loss and large business impact. The best response is to avoid the activity.

• Mitigate risk – activities with a high likelihood of occurring, but business impact is small. The best response is to use management control systems to reduce the risk of potential loss.

• Transfer risk – activities with low probability of occurring, but with a large business impact. The best response is to transfer a portion or all of the risk to a third party by purchasing insurance, hedging, outsourcing, or entering into partnerships.

• Accept risk – if cost-benefit analysis determines the cost to mitigate risk is higher than cost to bear the risk, then the best response is to accept and continually monitor the risk.

Our risk response may generate information security or business continuity controls which could be technical, procedural or policy based.

Closing a risk

Risks remain open until we have:

• implemented any new controls identified to reduce the likelihood or impact of the risk, and therefore reduce the residual risk

• re-assessed the risk and ensured it is below High

• decided to accept the residual risk level

Review

Once closed, risks are re-assessed on a timeframe defined in in the risk levels.

• Customer support queries

• Internal communications

• Server logs

• Development source code

Identification

Information assets are identified as part of:

• Monthly company-wide security awareness sessions

• Monthly security review meetings

• Our software development lifecycle

• Everyday working practice

Assessment

For each information asset identified, we

• Assign an owner for the information

• Identify if it falls under any specific regulation (primarily General Data Protection Regulation)

• Identify an appropriate data classification from these ratings

Any changes to the register results in:

• updates to our data classification policy with regards the information systems and asset information falling under each classification

Review

Information systems are reviewed as part of our monthly security review meetings.

• Rapptr (customer instances)

• Amazon AWS (production data)

• Google Mail (our own internal communications)

Identification

Information systems are identified as part of:

• Monthly company-wide security awareness sessions

• Monthly security review meetings

• Our software development lifecycle

• Everyday working practice

Third party vendors

Information systems that FundApps depend on that are managed by third party vendors are included in this register. As such we evaluate business continuity and sufficient security controls as part of our assessement process.

Assessment

For each information system identified, we

• Assign an owner for the system

• Identify information security controls based on the data classification

• Identify business continuity controls based on the data classification

Review

Information systems are reviewed as part of our monthly security review meetings.