ISMS-PL-03 Asset Mgmt Policy .doc - SAHER Project...

SAHER Project ISMS-PL-03
ASSET MANAGEMENT
Policy/Framework Document
Place: JEDDAH Sign of Approver
Date: 26-Sept-2011 (Head – SAHER Project)
Revision details:
Revision Date Author(s) Revision Notes Approved by
0 12-Jul-2011 ISO Initial
Head – SAHER
Project
1 26-Sept-2011 ISO
Aligned in accordance to asset
labeling and management
practices
Head – SAHER
Project
Revision: 1 Rev. Date: 26-Sept-2011 Security Classification: INTERNAL Page
1 of 12

SAHER Project ISMS-PL-03
INDEX INDEX
1 PURPOSE ....................................................................................................................................................... 3
2 MANAGING THE ASSETS .......................................................................................................................... 3
2.1 I
NVENTORY OF
A
SSETS
............................................................................................................................... 3
2.2 A
SSET
O
WNERSHIP
..................................................................................................................................... 4
2.3 A
CCEPTABLE
U
SE OF
A
SSETS
.................................................................................................................... 5
2.4 A
SSET
L
ABELING AND
H
ANDLING
C
RITERIA
.............................................................................................. 5
2.5 A
SSET
D
ECLASSIFICATION
/ D
OWNGRADING
............................................................................................. 7
3 ASSET CLASSIFICATION FRAMEWORK .............................................................................................. 8
3.1 A
PPLICABILITY
............................................................................................................................................. 8
3.2 C
ONSISTENT
P
ROTECTION
......................................................................................................................... 8
3.3 Information Labeling and Handling ........................................................................................................ 8
Revision: 1 Rev. Date: 26-Sept-2011 Security Classification: INTERNAL Page
2 of 12

SAHER Project ISMS-PL-03
1 Purpose
The intent of this policy / framework document is to:
(a) Implement and maintain security of the information assets of the organization as
appropriate to its operations environment by classifying assets as per
functionality and requirement .
(b) Create awareness among users about their responsibilities towards security of
SAHER Project Data Centre information, information Assets and information
processing and storing devices.
The document outlines the policy to identify, classify, label and handle the Information
Assets of SAHER Project Data Centre, and to apply relevant protection mechanisms
commensurate to the level of confidentiality / sensitivity, importance and value. This
policy also documents the security related responsibilities of SAHER Project Data
Centre personnel and users of information resources. The policy applies to all SAHER
Project Data Centre information resources.
2 Managing the Assets
The confidentiality and sensitivity of information shall be maintained through an
Information Asset classification scheme. The level of security to be accorded to the
information of the company depends directly on the classification level of the asset,
which is associated with that information.
All employees, especially those who may use the sensitive information, are expected to
familiarize themselves with this Information Asset classification scheme, and to
consistently use it in the business operations.
2.1 Inventory of Assets
 An inventory of all information and information processing facilities such as project
files, project data, records, software and applications, information carrying / storage
devices, supporting services and human assets shall be maintained in an Asset
Register.
 Physical assets will be labeled with an asset number that identifies the asset in the
asset register.
o SAHER Project Data Centre has an internal mechanism for labeling of IT
equipments, Office equipments & facilities.
o The exceptions to asset labeling are on communication devices such as fixed
and mobile phones, locally issued CDs and pen drives, and furniture.