Business Services in Policies

Policies and Standards

What Business Services owns here

This element holds the mandatory rules for information and technology — the management system standard, the standard for standards, and the information security, access and backup standards.

Example documents, by tier

Policy 1

Mobile Phone and Device PolicyIn 1 of 3 operator registersCompany-wideAlso in EI PSM · 07 Documentation, records and knowledge managementNot process safetyNot safety case critical

Standard 6

Management System StandardIn 3 of 3 operator registersCompany-wideAlso in EI PSM · 11 Standards and practicesNot process safetyNot safety case critical
Standard for Standards and ProceduresIn 1 of 3 operator registersCompany-wideAlso in EI PSM · 07 Documentation, records and knowledge managementNot process safetyNot safety case critical
Information Management StandardIn 2 of 3 operator registersCompany-wideAlso in EI PSM · 07 Documentation, records and knowledge managementNot process safetyNot safety case critical
Access Management StandardIn 2 of 3 operator registersCompany-wideAlso in EI PSM · 07 Documentation, records and knowledge managementNot process safetyNot safety case critical
Application Security StandardIn 1 of 3 operator registersCompany-wideAlso in EI PSM · 06 Hazard identification and risk assessmentNot process safetyNot safety case critical
Backup and Recovery StandardIn 1 of 3 operator registersCompany-wideAlso in EI PSM · 07 Documentation, records and knowledge managementNot process safetyNot safety case critical

Why these belong here

"Information security and document standards are company-wide rules. They belong beside every other mandatory standard, not in an IT silo."

What does not live here

→The procedures that implement the standardsE07 Procedures
→Cyber risk assessmentE05 Risk