Information Security Policy
Dominance is committed to protecting its information and information systems against threats that could compromise confidentiality, integrity, or availability. Information shall be appropriately classified, handled, stored, transmitted, retained, and securely disposed of in accordance with applicable business, legal, regulatory, contractual, and privacy requirements.
Dominance has established and will maintain an Information Security Management System (ISMS) aligned with ISO/IEC 27001:2022. Information security risks and opportunities shall be identified, analysed, evaluated, treated, monitored, and reviewed. Appropriate controls shall be selected based on the organisation’s context, risk appetite, operational requirements, interested-party expectations, and the potential likelihood and impact of information security incidents.
Dominance and all personnel are committed to:
Maintaining an effective ISMS appropriate to the organisation’s purpose, strategic direction, activities, and operating environment.
Establishing measurable information security objectives that support the organisation’s strategic and operational goals.
Protecting the confidentiality, integrity, and availability of information and associated assets.
Applying reasonable, practical, proportionate, and effective security controls based on identified risks.
Preventing unauthorised or inappropriate access, use, disclosure, alteration, loss, destruction, or interruption of information and information systems.
Complying with applicable statutory, regulatory, contractual, privacy, and information security obligations.
Identifying and addressing information security risks associated with employees, contractors, suppliers, cloud services, technology, remote working, and other third-party relationships.
Ensuring information security responsibilities are clearly defined, assigned, communicated, and understood.
Providing appropriate resources, technology, competence, awareness programs, and training to support the effective operation of the ISMS.
Encouraging personnel to remain informed about emerging threats, vulnerabilities, security technologies, regulatory developments, and relevant security procedures.
Requiring all personnel and relevant external parties to promptly report suspected or actual information security events, weaknesses, incidents, and breaches.
Ensuring information security incidents are assessed, contained, investigated, responded to, documented, and reviewed to identify lessons and prevent recurrence.
Maintaining appropriate business continuity, ICT readiness, backup, recovery, and incident response arrangements to support the continued delivery of critical services.
Regularly testing business continuity, backup restoration, disaster recovery, and incident response arrangements.
Protecting information throughout its lifecycle, including its creation, collection, access, processing, transmission, storage, backup, retention, and secure disposal.
Monitoring the performance and effectiveness of the ISMS through security objectives, key performance indicators, risk reviews, internal audits, incident analysis, corrective actions, and management reviews.
Addressing nonconformities and implementing corrective actions to eliminate their causes and reduce the likelihood of recurrence.
Continually improving the suitability, adequacy, and effectiveness of the ISMS and its associated controls.
