Security Policy

Last update: Feb. 4, 2023

Innovadis attaches importance to information security in order to safeguard the continuity, integrity, and reliability of the information provision. Innovadis pays continuous attention to information security to ensure a secure and reliable information security can be maintained.

Frame

Innovadis works according to best practices in accordance with ISO 27001 and 27002 to ensure information security. Innovadis works with an ISMS (Information Security Management System) and the Plan-Do-Check-Act cycle to make information security an integral part of Innovadis' operations.

Policy principles

• Information security is characterized as ensuring the availability, integrity, and confidentiality of information provision.
• Information security is approached in the most pragmatic way possible: We strive for a good balance between security measures and business needs, ensuring that risk management remains the primary focus without compromising on it.
• Every employee is made aware of the importance and necessity of information security in order to ensure its enduring effectiveness.
• Information security is not optional: Every employee and third party involved has their own personal responsibility. Compliance is monitored by Management. This is discussed during evaluation interviews. In case of non-compliance, sanctions can be imposed.

Information security process

Innovadis views information security as a process rather than a one-time activity. The process is designed to keep information security in order and continuously improve it. The information policy consists of the following four primary processes:

Plan: set objectives and measures using risk analysis

• Classification of business processes, information systems and data
• Conducting risk assessments on threats and vulnerabilities
• Deciding what measures to take to reduce or accept risks

‍

Do: introduce and implement policies and measures

• Selection and implementation of measures and thereby conscious and controlled handling of risks

‍

Check: monitoring and assessment of objectives and measures

• Evaluate effectiveness of measures

‍

Act

• Periodically performing new risk analyses and potentially adjusting existing measures or adding new ones

‍