Information Security Policy

1. Principles#

• Security is a property of how we build and operate, not a department.
• Encryption is a first principle, not a feature.
• Every regulator-relevant event is signed and replayable.
• Least privilege everywhere, by default, with audit on access.
• Customer data is processed only for the purpose collected.

2. Scope#

All Boundless information assets, all staff and contractors, all systems and suppliers handling Boundless data.

3. Control framework#

ISO/IEC 27001:2022 + Annex A controls + NCSC CAF v3.2, implemented as the 26-layer Abel control surface - see /security.

4. Ownership & review#

CISO is the executive owner. Reviewed annually by the Security & Resilience Committee, approved by the board.

5. Subordinate documents#

• Acceptable Use Policy
• Incident Response Plan
• Business Continuity & DR Policy
• Vulnerability Disclosure Policy
• Cryptographic Standards (internal)
• Access Control Standard (internal)