ISMS Policy Awareness

What Is ISMS Policy Awareness?

An Information Security Management System is the framework your organisation uses to manage information security risk, usually aligned with ISO 27001. You send a supplier handover pack that was never registered as an asset, so it goes out unclassified as a public link. You watch an outsider collect it and use a shared account secret from inside. Then you work through the ISMS: file the incident, register and label the asset, revoke the link, disable the account and see the fix hold.

What You'll Learn in ISMS Policy Awareness

• Explain how an ISMS aligned with ISO 27001 links asset management, classification, access control and incident management
• Recognize how an unregistered, unclassified asset bypasses the handling rules that should protect it
• Report a security incident through the ISMS with the details responders need: what left, when and how
• Register and classify an asset according to its contents before it is shared outside the organisation
• Contain an exposure by revoking a public link and disabling a shared account whose secret has leaked

ISMS Policy Awareness — Training Steps

1. The Handover Is Due

   Quantum Dynamics is handing monitoring of the Halberd programme over to a supplier, Solvane Operations. The programme manager wants the handover pack sent today. Read the request.

2. Open SecureTransfer

   SecureTransfer is the approved way to send large files outside Quantum Dynamics. Open it from the link in Priya's mail.

3. What the Gateway Knows About This Package

   Before you fill anything in, look at what SecureTransfer already believes about these files.

4. Release the Package

   Address the package to Solvane's handover mailbox and release it. This is exactly what the job asks for, and nothing on this screen will stop you.

5. Released as Public

   The package is on its way. Read the three lines the gateway printed underneath the link, because they describe something much larger than one email.

6. Who Decided That?

7. A Mailbox Nobody Watches

   Solvane Operations is a twelve-person supplier. Their shared handover mailbox has one password, no second factor, and four people who have left still know it. Bob bought that password three weeks ago and has been reading the mailbox ever since.

8. No Sign-In, No Expiry

   He did not need Solvane's password to open this. He only needed the link that was sitting in their inbox.

9. Take the Package

   Watch him collect the files. No credential is spent, and no alert fires.

10. What Was Inside

    The client roster alone is worth money. The third file is worth considerably more.