Compliance Management Policy
Ensuring compliance with legal and regulatory requirements
Purpose
Define standards and procedures to ensure the organization meets its regulatory, contractual and strategic cybersecurity obligations.
Objectives
- Comply with applicable laws and regulations.
- Ensure cybersecurity plans, goals and initiatives support compliance.
- Implement policies, controls and projects that ensure compliance.
- Maintain a roadmap for the cybersecurity strategy.
- Periodically review policies, controls and strategies to ensure relevance and effectiveness.
- Document deviations and manage corrective actions.
- Manage exceptions with management approval.
- Meet international cybersecurity-related commitments.
Scope
Includes the standards and procedures of the Compliance Management program:
- Mapping requirements to policies, controls and projects.
- Regular testing and review of controls and policies.
- Documentation of deviations and exceptions.
- Identification, access, assessment and documentation of legal and regulatory requirements relevant to business continuity (BCMS).
Standards
Cybersecurity Strategy
- Define, document and approve the strategy in line with laws and regulations.
- Execution and approval are the responsibility of the Information Security team and the Authorizing Officer.
Identifying Legal and Regulatory Requirements
- Each department identifies the external and internal requirements relevant to its processes.
- Maintain an up-to-date Legal and Regulatory Register with interested parties and owners.
Access and Assessment
- Determine how to access requirements (websites, conferences, newsletters).
- Assess the impact of requirements on operations and business continuity.
- Inform interested parties about changes and their impact.
Approval and Mapping
- Management approves legal and contractual requirements before committing effort.
- Map each requirement to policies, controls and projects; regularly review their relevance and effectiveness.
Policies and Controls
- Each control must have documented policies and procedures that are tested regularly.
- Review policies at least every 12 months or when regulations change.
- Fix gaps detected in controls and policies.
Project Management
- Monitor the progress of compliance and cybersecurity projects and initiatives.
- Take corrective action in the event of delays or deviations.
- Ensure alignment with the cybersecurity strategy.
Ownership
- Each mitigation element (policy, control or project) has a responsible owner.
- The Information Security team assigns and regularly reviews ownership and responsibilities.
Monitoring and Review
- Periodically review the compliance program to ensure its effectiveness.
- Verify controls, policies, projects, owners and deviation management.
- Ensure policies and procedures remain relevant and effective.