We have implemented an Information Security Management System based on ISO 27001 and SOC 2 controls. Our ISMS includes the following areas insofar as they relate to the characteristics of the business: Information Security Policy (this document) Access Control Policy Availability Management Clean Desk Policy Cryptography Policy IS Supplier Management Policy Logging and Monitoring Policy Mobile Device Policy Network Security Policy Password Management Policy Patch Management Policy Software Policy Technical Vulnerability Management Policy Risk Assessment Methodology Malware, Email and ISMS Policy Internet Acceptable Use Policy Penetration Testing Policy Teleworking Policy Records Retention and Protection. Department managers are responsible for maintaining awareness of, and complying with, security policies, procedures, and standards that are relevant to their area of responsibility. Risk acceptance levels have been defined within the risk management methodology and all risks are mitigated to an acceptable level with reasonable resolution time frames and stakeholder approval.