Tape Ark® provides tape to cloud data migration services, which always involve processing customer data and may involve handling confidential or sensitive information. Tape Ark is committed to safeguarding both its privileged information and all customer data—whether transient or held under custodianship.
This policy mandates a consistent, risk-based approach to Information Security to ensure the confidentiality, integrity, and availability of information assets.
Tape Ark will ensure that:
- Information will be protected against unauthorized access, whether in-transit or at-rest.
- Confidentiality of information is maintained at all times.
- Information is not disclosed to unauthorized parties, whether by deliberate action or negligence.
- Information integrity is preserved by preventing unauthorized modification or unintended disclosure.
- Information remains available to authorized users as needed.
- All applicable staff complete Information Security training.
- All suspected or actual breaches of Information Security are reported and investigated promptly.
All individuals handling information on behalf of Tape Ark, including employees, contractors and consultants, must comply with this policy and associated Information Security documents.
To achieve these commitments, Tape Ark will:
- Ensure this policy reflects our business context, strategic direction, and relevant internal and external factors.
- Establish measurable Information Security objectives that are communicated, monitored, and reviewed during the annual Management Review. Corrective actions will be taken where deviations occur. Objectives are agreed collectively, and teams are empowered to deliver results with delegated accountability.
- Document and review all non-conformances and corrective/preventative actions at least quarterly.
- Address Information Security for all projects, regardless of scope, through risk assessment and objective setting.
- Educate staff to make informed, independent decisions regarding the secure handling of information and IT assets within the framework of our Information Security policies.
- Defend both tangible and intangible IT assets and information owned, governed, or controlled by Tape Ark.
- Continually improve the Quality and Information Security Management System (QISMS) through monitoring, review and documented corrective actions tracked in the Incident and Improvement System.
- Ensure compliance with applicable legislation, standards and industry best practices, including ISO/IEC 27001:2022.
All personnel are responsible for reporting suspected or actual Information Security breaches or IT incidents to the CEO or their immediate supervisor. Management and staff are jointly responsible for embedding Information Security risk management into all core activities, processes, and decisions. Information Security risk awareness and tolerance will inform business decision-making at all levels.
This Information Security Policy is communicated within the organisation and made available to relevant interested parties, as appropriate.
