Information Security and Incident Response Policy

1 Purpose and responsibilities

This policy protects Association systems, devices, accounts, data and digital services. The Board approves risk levels and resources; the technology officer manages controls and response with privacy and compliance personnel. Government security standards are technical references; a sector-specific standard is not claimed mandatory without established applicability.(1)

2 Accounts and devices

Each system and asset has a recorded owner, provider and data location. Individual accounts receive least-privilege access, with multi-factor authentication for sensitive accounts and separate technical-administration and everyday accounts. Access is revoked immediately when a role ends and reviewed periodically. Passwords and verification codes are not shared.

Devices are protected by encryption, updates, anti-malware and screen locking. Vulnerabilities are recorded and treated according to risk; unauthorised software is prohibited. Visitor and volunteer access is separated from financial and health systems. Backup restoration is tested.

3 Changes and providers

Changes are assessed before production for security, privacy, reliability and rollback, then approved with the executor recorded. Cloud services, data locations, provider contracts, incident notification and subcontractors are evaluated. Real data is not copied to an unauthorised test environment.(2)

4 Reporting and containment

Anyone observing phishing, device loss, unlawful access or leakage immediately reports through the announced internal technology channel. Discovery time, system, impact and evidence are recorded. Messages are not deleted and devices not reformatted before evidence is preserved. Affected components are isolated, suspicious access stopped and accounts secured.

Incidents are classified by safety, financial, data and continuity impact. Management, privacy and compliance are notified and an incident lead appointed. Assistance from the competent authority, bank, police or provider is sought where applicable. Internal remediation does not replace mandatory legal notification.

5 Recovery and communication

Service is restored from a clean source after addressing the cause and verifying integrity; recurrence is monitored. An authorised spokesperson handles accurate external communications consistent with obligations, without disclosing victims’ data or details aiding attackers.

All decisions, times and notifications to authorities and individuals are documented and response effectiveness reviewed. Employees do not pay extortion demands or enter settlements; the matter goes to competent authorities, legal review and the authorised decision-maker.

6 Review and records

Periodic awareness and exercises cover phishing, data loss and outages. Asset, access, change, vulnerability, incident and recovery records have restricted permissions. Corrective actions close with an owner, deadline and independent verification evidence.

References in the approved document

1. The Association’s approved 2026 Articles of Association, Articles 20, 63 and 74. This document establishes internal implementation controls without changing higher legal powers or requirements.

2. Federal Decree-Law No. 34 of 2021 on combating rumours and cybercrime, as amended; Decree-Law No. 45 of 2021 within its scope. This document establishes internal implementation controls without changing higher legal powers or requirements.