Purpose and Scope

Your Business, LLC depends on its computers, phones, software and data to serve its customers and pay its people. This policy sets out the written information security program Your Business, LLC uses to protect that information and those systems, and the steps it will take when something goes wrong.

This policy applies to all owners, employees, volunteers and contractors, and to every device, account and system used for Your Business, LLC work, whether owned by Your Business, LLC or personally owned. It covers information in any form: electronic, paper and spoken.

The information protected by this program includes:

• Employee records, including Social Security numbers, driver's license numbers, bank details for payroll, and background and drug test results.
• Customer and client names, addresses, phone numbers and account details.

Program Leadership (Govern)

The Information Security Officer leads the Your Business, LLC information security program, with day-to-day support from Our managed IT service provider, under a written service agreement. The Information Security Officer will keep an inventory of systems, devices, software and data; carry out a written risk assessment at least once a year and after major changes; choose and oversee safeguards; oversee vendors; lead incident response; and report in writing to senior leadership at least once a year on the program, risks, incidents and recommended changes.

Accounts, Passwords and Access (Protect)

Your Business, LLC will protect accounts and access as follows:

• Every person has their own account; shared logins are not allowed except for documented shared devices such as a dispatch board.
• Multi-factor authentication is required for email, remote access, cloud apps, banking, payroll, accounting and any system holding sensitive information.
• People get only the access their job requires, approved by their manager.
• Administrator rights are limited to IT staff and use separate admin accounts that are not used for email or web browsing.
• Passwords are long (at least 15 characters for passphrases, as NIST SP 800-63B recommends), unique to each account, never shared, and kept in an approved password manager. Passwords are changed when there is any sign of compromise.
• Access is removed, and devices, keys and badges are collected, on or before a person's last day.
• Managers review who has access to key systems at least once a year, and the IT lead removes access no longer needed.

Devices, Patching, Backups and Data (Protect)

Your Business, LLC will protect devices and data as follows:

• Operating systems, browsers and software are set to update automatically, and critical security updates are installed within [patch days] days.
• Every computer and server has endpoint protection (anti-malware or EDR) that is monitored.
• Laptops, phones and tablets used for work have full-disk encryption and a passcode.
• Screens lock automatically after a few minutes of inactivity.
• Important systems and data are backed up daily, with at least one copy kept offline, immutable or otherwise out of reach of ransomware.
• Restores from backup are tested at least once a year, and after major changes.
• Old devices and drives are wiped or destroyed using a recognized method before disposal, and paper with sensitive data is shredded.
• Personal devices may be used for work only through approved apps, with a passcode and current updates.

Training and Vendors