Richman Investments Security Policies

1. Statement of Intent

Richman aims to conduct its affairs in an open and transparent manner and make information publicly available unless there are justifiable reasons for withholding it.

The purpose of this policy is to set out Richman’s approach to openness but also to recognise the importance of respecting confidentiality.

It is important for Richman to demonstrate openness and accountability and a real commitment to providing opportunities for stakeholders to be involved in or influence decision making, and to uphold the principles and practice of equality and best value.

Richman believes it is important to promote the aims, values and activities of the organisation to a wider public and be accountable to our stakeholders.

Richman is committed to the principles of sustainability and will endeavour to develop fair and consistent policies, procedures and practices.

2. General Principles

All employees and Committee Members are required to comply with this policy.

Richman will comply with all relevant legislation in applying this policy.

For the purposes of this policy, stakeholders are people or organisations with a direct involvement and interest in the operation and performance of Richman. The main stakeholders include:

* Members; * Branches * Individuals who receive a service from Richman; * Local communities; * Local authorities; * Other partner organisations; * Employees; * Funders; * Regulators.

This is not an exhaustive list.

Action Plan

The Information Technology Department will have an action plan in case of an emergency or natural disaster. Richman’s IT Department has negotiated a contract with DELL Inc. to bring in new hardware to replace the hardware that was destroyed in the disaster, DELL Inc. does have computers with monitors and software on standby to replace the destroyed items in the natural disaster. Richman Investments also has a contract with CISCO to bring in new servers and switches to replace the equipment that was also destroyed in the natural disaster. And finally, Richman Investments has J & J Cabling Company on standby just in case new CAT Cable will have to be run. Richman’s IT Department has an offsite back up with a company called, “Barracuda Networks.” This will let Richman Investments IT Department have a way to have all data backed up offsite so no data can be destroyed.

Information about the work of Richman, the governing body and employees will be available on request. Richman will only withhold information if there is an issue that requires confidentiality, perhaps because it is sensitive in a personal, financial or commercial way, where the disclosure of information is covered by legislation or where providing this information is not practical.

The decision on whether information is sensitive in a personal, financial or commercial way will be made by the Senior Management Team or Chairman of Richman.

Interested parties will be allowed to attend a meeting of the Committee of Management as an observer to non confidential parts of the meeting. Advance notice of 14 working days will be required to enable the agenda to be prepared where any sensitive issues can be discussed at the end of the meeting and to ensure the venue and catering arrangements are appropriate for the numbers attending.

Committee papers will be accessible to Departmental Managers, with the exception of information which is sensitive in a personal, financial or commercial way, or where the disclosure is covered by legislation. Departmental Managers will provide an update to their staff at team meetings on items they feel are appropriate.

Tiers of Protection
The gateway serves as the entry and exit point to the company’s network, the IT Department has installed a security solution such as antivirus and content filtering at this tier, mass-mailer worms are scanned and deleted, spam is moved to quarantines. Outgoing mail is also checked to prevent viruses and inappropriate content from being sent from the company’s email servers.
Mail servers should also be equipped with security. Richman’s IT Department has installed Ice Warp E-mail Server’s, this Mail Server supports SMTP, POP & IMAP standards and works with all known email clients and servers on the market, by default, all services utilize SSL/TLS encryption and supports deployments of every kind and it automatically has IMAP integration and makes certain that you remain compliant with the Sarbanes-Oxley Act (SARBOX) by archiving all incoming & outgoing email messages in isolated non-production storage.
Desktops and laptops are one of the most important tiers to protect. Richman’s IT Department has outfitted all laptops and desktops with antivirus software and installed Common Access Card Readers to they will have all incoming and outgoing data encrypted with SSL and TLS technology. Also, Richman Investments have MS Outlook as their email provider. This will give employees at all branches access to their email and it will also let them set up encrypted emails that are signed with certificates and with the Common Access Card Reader employees are able to have access to their emails from home in a form of Outlook OAW.
Reduce Vulnerabilities
The IT Department at Richman Investment’s will keep all software and applications up to date with the latest patches. Also, the IT Department will keep the employees informed through training or secure emails on how important it is to keep all personal information safe by educating them on Personal Protected Information (PPI). The employees will be instructed to keep all passwords out of site and in a secured locked area. Confidentiality
Employees and Committee Members will be made aware of the need to treat information gained through their relationship with Richman as confidential and should not disclose any information which may be of a sensitive nature with any unauthorised person. Employees and Committee Members will be advised of the need for confidentiality as part of the induction process.

Back It Up
Richman’s IT Department will back up data with external device like a external hard drive with enough space so it can hold all data and they will use an offsite company that will store Richman’s data so that if there is a natural disaster all of the data will be backed up for easy access to get back the data that was backed up.

Role of the Resources Department

The Resources Director is responsible for overseeing this policy and its associated procedure. Role of Departmental Directors and the Committee of Management

Each Departmental Director (or designated officer) will be responsible for ensuring this Policy is applied in their department.

Role of the Resources Branch

The Resources Director is responsible for maintaining the Communications Plan.

The Resources Department will be responsible for responding to requests from stakeholders on accessing information.

This policy will be reviewed 5 years from the date of implementation, which will be the date the policy is approved by the Committee of Management or earlier if deemed appropriate.

Project Part 1