Skip to content

Information Security Policy

Purpose. The top-level policy committing Soon to information security: it sets the direction, the framework for objectives, and the set of supporting policies everyone at Soon must follow (ISO/IEC 27001 clauses 5.1, 5.2 and control A.5.1).

1. Scope

All systems, people and processes that constitute Soon's information systems, including board members, employees, contractors, suppliers and other third parties with access to Soon systems. Soon is a cloud Workforce Management SaaS provider hosted in AWS eu-west-1 and acts as a GDPR data processor for customer personal data; this policy exists above all to protect that data and the continuity of the service built on it.

2. Policy

2.1 Commitment

Soon operates an Information Security Management System (ISMS) in line with ISO/IEC 27001 and intends to achieve certification to this standard. TODO(owner): confirm the target certification date. Operating the ISMS protects our customers' data and our service availability, supports compliance with legal and regulatory requirements (notably GDPR), and underpins customer trust in Soon.

2.2 Information security requirements

Requirements for information security are derived from business needs, customer contracts (including data processing agreements), and statutory and regulatory obligations, and are documented within the ISMS. Security requirements for new or changed systems and services must be considered at design time. Controls are driven by these requirements and by risk assessment — not implemented for their own sake — and this principle is communicated to the team through the weekly ISMS meeting and onboarding.

2.3 Framework for setting objectives

Information security objectives are set and reviewed at least annually through the management review process, documented in the Information Security Objectives & Plan (docs/06-planning/isms6-infosec-objectives-plan.md), measurable where practicable, and resourced by top management.

The Annex A reference controls of ISO/IEC 27001 are adopted where applicable; the Statement of Applicability (docs/06-planning/ISMS-FORM-06-2-statement-of-applicability.md) records which controls are implemented and which are excluded, with justification. The cloud-specific and PII codes of practice ISO/IEC 27017 and ISO/IEC 27018 may be adopted later — TODO(owner): confirm ambition regarding 27017/27018.

2.4 Continual improvement

Soon will:

  • continually improve the effectiveness of the ISMS;
  • achieve ISO/IEC 27001 certification and maintain it thereafter;
  • make security processes measurable so decisions are informed by data (metrics reviewed at least annually);
  • collect improvement ideas from any source — team, customers, suppliers, risk assessments, incidents, audits — and evaluate them at the weekly ISMS meeting and management reviews.

2.5 Supporting policies

This overarching policy is implemented through the following supporting policies. Their current status, version and ownership are maintained in the document register, REGISTER.md, in the ISMS repository.

Organisational

  • Access Control Policy
  • Acceptable Use Policy (covering messaging, collaboration tools, social media)
  • HR Security Policy (covering screening, disciplinary process, whistleblowing)
  • Privacy & Personal Data Protection Policy
  • Supplier Relationships Security Policy
  • Cloud Services Policy
  • Asset Management Policy
  • Records Retention Policy
  • IP & Copyright Compliance Policy
  • Legal & Regulatory Compliance Policy

People & workplace

  • Remote Working Policy
  • Clear Desk & Clear Screen Policy

Technical

  • Cloud & Infrastructure Security Policy
  • Endpoint Protection Policy
  • Device Management Policy
  • Secure Development Policy
  • Vulnerability & Threat Management Policy
  • Cryptography Policy
  • Logging & Monitoring Policy
  • Backup Policy
  • Availability Management Policy
  • Data Handling & Deletion Policy
  • Software Policy

Incident management

  • Incident/Event Reporting Policy

2.6 Application of this policy

This policy and its supporting policies are approved by top management and compliance is mandatory for everyone in scope. Failure to comply may result in disciplinary action in accordance with the HR Security Policy's disciplinary process. Questions about any policy go first to the security responsible (Olaf Jacobson).

3. Roles & responsibilities

  • Top management — approves this policy, provides resources, and demonstrates leadership for information security. TODO(owner): confirm who signs this policy as top management.
  • Security responsible (Olaf Jacobson) — maintains the ISMS, owns day-to-day security decisions, first point of contact for policy questions.
  • All team members and third parties in scope — comply with this policy and the supporting policies relevant to their work, and report security events promptly.
  • REGISTER.md — register of all ISMS documents (replaces the former external "ISMS Documentation Log")
  • docs/06-planning/isms6-infosec-objectives-plan.md — Information Security Objectives & Plan
  • docs/06-planning/ISMS-FORM-06-2-statement-of-applicability.md — Statement of Applicability
  • docs/06-planning/ISMS-DOC-06-2-risk-assessment-and-treatment-process.md — Risk Assessment and Treatment Process
  • docs/05-leadership/isms5-executive-support-letter.md — Executive Support Letter

Change log

Version Date Author Comments
0.1 2023-11-13 First draft Information Security Policy
0.2 2025-05-06 Melvin Jacobson
0.3 2026-07-18 Andrea Cardinali Rewritten lean and Soon-specific (ISMS overhaul); supporting policy list rebuilt, external doc log replaced by REGISTER.md