Strateji | Digital Infrastructure for Leadership

Policy Owner: Dave YeatesEffective Date: Jan 8, 2025

Information Security Management System (ISMS) Policy

Purpose

This policy provides a framework to be applied when establishing, implementing, maintaining, andcontinually improving the information security management system ("ISMS"), as defi ned in 01-ISMS Scopeof the ISMS, in accordance with the requirements of the ISO/IEC 27001 ("ISO 27001") standard.

Leadership

Leadership and commitment

Atlas Platforms is committed to continually enhancing its ISMS. This commitment is demonstrated throughthe actions of the ISMS Governance Council, which oversees implementation, monitoring, andimprovements.

We ensure:

Alignment of information security objectives with our strategic goals.
Allocation of necessary resources, including funding, tools, and expertise.
Integration of security practices into daily operations and agile workflows.

Information Security Policy

Atlas Platforms's information security policy:

Aligns with our mission to deliver secure and reliable SaaS solutions.
Sets the foundation for measurable security objectives.
Demonstrates compliance with legal, regulatory, and contractual obligations.
Emphasizes continuous improvement.

Transparency and Awareness:

This policy is accessible to all employees and contractors via Confluence.
External parties may access it upon request.
Annual reviews ensure ongoing relevance and effectiveness.

Roles, responsibilities and authorities

Roles and responsibilities for ISMS are based on Atlas Platforms' flat governance structure:

ISMS Governance Council Team: Oversees security governance, compliance, and audits.
Senior Management: Consisting of the organisations Co-Founders, to ensure implementation andadherence to ISMS controls.
All Personnel: Maintain awareness of security requirements and report issues promptly.

Competencies and gaps are assessed through regular reviews and training programs.

Planning

Atlas Platforms prioritizes the identifi cation of risks and opportunities, embedding iterative risk assessmentsinto agile workfl ows.

Risk Assessment:

Regular evaluation of security risks and prioritization of mitigations.
Documented outcomes and updates tracked in all active products (eg. Strateji and Meta Agility).

Risk Treatment:

Selection and implementation of controls to address identified risks.
Documented approvals and reviews integrated into quarterly retrospectives.

Security Objectives:

Protect confidentiality, availability, and integrity of data.
Ensure compliance with applicable laws and contractual obligations.
Achieve and maintain ISO 27001 certification.

Action plans for achieving objectives are reviewed annually and tracked in Strateji

Support

Resources:

Atlas Platforms allocates funding, expertise, and tools to support ISMS operations.

Competence:

Roles impacting information security are evaluated based on training, experience, and education.Competence gaps are addressed through mentoring, external expertise, or training.

Awareness:

Personnel complete annual awareness training and understand their roles and consequences of non-compliance.

Communication:

Internal and external security communications are coordinated and documented.
Policies are stored in Confluence and reviewed after major updates or annually.

Documentation Control:

Processes for creating, updating, and storing ISMS documentation are defined in the 05-ISMS DocumentControl Procedure.

Control of documented information

Processes for creating, updating, and storing ISMS documentation are defined in the 05-ISMS DocumentControl Procedure.

Operation

Atlas Platforms integrates information security into agile workflows:

Operational controls are documented and tracked in Product development tools (eg. Strateji's JiraBoard).
Risks are evaluated during planning cycles, with records maintained for audits.
External dependencies are assessed and managed effectively.

Performance evaluation

Internal audit

Atlas Platforms performs internal audits of its ISMS on a recurring basis and has defined an ISMS InternalAudit Procedure. For further details, please refer to the 07-ISMS Procedure for Internal Audits document.

Management review

Atlas Platforms has defined an ISMS Management Review Procedure consisting of the necessary inputs andoutputs to ensure that the company's ISMS is operating effectively, as intended, and is continuallyimproving. For further details, please refer to the 08-ISMS Procedure for Management Review.

Improvement

Continual Improvement

Atlas Platforms is dedicated to perpetually enhancing the relevance, sufficiency, and efficiency of ourinformation security management system.

Nonconformity and corrective action

In case of any deviation from established standards, Atlas Platforms commits to:

Address the nonconformity, manage its effects, and implement necessary corrections.
Evaluate the root cause, ensuring it doesn't repeat or emerge in other areas
Act upon any required changes and validate the efficacy of those changes.
All measures taken will be proportionate to the severity of the nonconformities identified.

For transparency and due diligence, Atlas Platforms will document:

The specifics of any nonconformity and the corrective measures applied.
The outcomes of those corrective actions. Atlas Platforms has defined an ISMS Corrective Action andContinual Improvement Procedure when non-conformities are identified. Non-conformities may beidentified during internal audits, external audits, management reviews, or ongoing monitoring of theISMS. For further details, please refer to the 09-ISMS Procedure for Corrective Action and ContinualImprovement document.

Policy violation

All personnel, including employees, contractors, and third parties, must protect Atlas Platforms' data andsystems. Violations may result in corrective actions, including training, reassignment, or termination, in linewith severity and applicable laws.

ISO 27001 coverage

ISO 27001 4.1; 4.2; 4.3; 5.1

Version history

ISO 27001 4.1; 4.2; 4.3; 5.1

Version & Date

1.0

Aug 7, 2024

Author

Dave Yeates

Approver

Dave Yeates

27701 Privacy Information Management System (PIMS) Addendum

This addendum is automatically applicable for organizations implementing ISO 27701 and optional fororganizations who are implementing ISO 27001 only.

All references to "ISMS" in this document are changed to "IS&PMS"
All references of ISO 27001 in this document are changed to "ISO 27001/27701"
All references to "information security management system" are changed to "information security andprivacy management system"

Heading text

Lorem ipsum dolor sit amet, consectetur adipiscing elit. Donec ullamcorper mattis lorem non. Ultrices praesent amet ipsum justo massa. Eu dolor aliquet risus gravida nunc at feugiat consequat purus. Non massa enim vitae duis mattis. Vel in ultricies vel fringilla.

Heading text

Team members

100 users

Page 1 of 10

Heading text

Strategy is where governance begins.

It’s the anchor point that keeps leadership connected, accountable and assured.

When intent becomes observable, governance becomes proactive.

View the ISMS Policy

Read the Code of Conduct

Lead through complexity — with confidence.

Strateji brings structure, visibility and accountability to modern leadership. Let’s explore how it could work for you.

Book an Enterprise Briefing

Turn complexity into clarity.

Homepage

Strategy

Governance

Accountability

Enterprise

Enablement

Contact

Resources

Terms and Conditions

Policy Owner: Dave YeatesEffective Date: Jan 8, 2025

Information Security Management System (ISMS) Policy

Purpose

Leadership

Leadership and commitment

We ensure:

Alignment of information security objectives with our strategic goals.
Allocation of necessary resources, including funding, tools, and expertise.
Integration of security practices into daily operations and agile workflows.

Information Security Policy

Atlas Platforms's information security policy:

Aligns with our mission to deliver secure and reliable SaaS solutions.
Sets the foundation for measurable security objectives.
Demonstrates compliance with legal, regulatory, and contractual obligations.
Emphasizes continuous improvement.

Transparency and Awareness:

This policy is accessible to all employees and contractors via Confluence.
External parties may access it upon request.
Annual reviews ensure ongoing relevance and effectiveness.

Roles, responsibilities and authorities

Roles and responsibilities for ISMS are based on Atlas Platforms' flat governance structure:

ISMS Governance Council Team: Oversees security governance, compliance, and audits.
Senior Management: Consisting of the organisations Co-Founders, to ensure implementation andadherence to ISMS controls.
All Personnel: Maintain awareness of security requirements and report issues promptly.

Competencies and gaps are assessed through regular reviews and training programs.

Planning

Atlas Platforms prioritizes the identifi cation of risks and opportunities, embedding iterative risk assessmentsinto agile workfl ows.

Risk Assessment:

Regular evaluation of security risks and prioritization of mitigations.
Documented outcomes and updates tracked in all active products (eg. Strateji and Meta Agility).

Risk Treatment:

Selection and implementation of controls to address identified risks.
Documented approvals and reviews integrated into quarterly retrospectives.

Security Objectives:

Protect confidentiality, availability, and integrity of data.
Ensure compliance with applicable laws and contractual obligations.
Achieve and maintain ISO 27001 certification.

Action plans for achieving objectives are reviewed annually and tracked in Strateji

Support

Resources:

Atlas Platforms allocates funding, expertise, and tools to support ISMS operations.

Competence:

Roles impacting information security are evaluated based on training, experience, and education.Competence gaps are addressed through mentoring, external expertise, or training.

Awareness:

Personnel complete annual awareness training and understand their roles and consequences of non-compliance.

Communication:

Internal and external security communications are coordinated and documented.
Policies are stored in Confluence and reviewed after major updates or annually.

Documentation Control:

Processes for creating, updating, and storing ISMS documentation are defined in the 05-ISMS DocumentControl Procedure.

Control of documented information

Processes for creating, updating, and storing ISMS documentation are defined in the 05-ISMS DocumentControl Procedure.

Operation

Atlas Platforms integrates information security into agile workflows:

Operational controls are documented and tracked in Product development tools (eg. Strateji's JiraBoard).
Risks are evaluated during planning cycles, with records maintained for audits.
External dependencies are assessed and managed effectively.

Performance evaluation

Internal audit

Management review

Improvement

Continual Improvement

Atlas Platforms is dedicated to perpetually enhancing the relevance, sufficiency, and efficiency of ourinformation security management system.

Nonconformity and corrective action

In case of any deviation from established standards, Atlas Platforms commits to:

Address the nonconformity, manage its effects, and implement necessary corrections.
Evaluate the root cause, ensuring it doesn't repeat or emerge in other areas
Act upon any required changes and validate the efficacy of those changes.
All measures taken will be proportionate to the severity of the nonconformities identified.

For transparency and due diligence, Atlas Platforms will document:

The specifics of any nonconformity and the corrective measures applied.
The outcomes of those corrective actions. Atlas Platforms has defined an ISMS Corrective Action andContinual Improvement Procedure when non-conformities are identified. Non-conformities may beidentified during internal audits, external audits, management reviews, or ongoing monitoring of theISMS. For further details, please refer to the 09-ISMS Procedure for Corrective Action and ContinualImprovement document.

Policy violation

ISO 27001 coverage

ISO 27001 4.1; 4.2; 4.3; 5.1

Version history

ISO 27001 4.1; 4.2; 4.3; 5.1

Version

1.0

Date

Jan 8, 2025

Description

Version 1.0

Author

Dave Yeates

Approver

Dave Yeates

27701 Privacy Information Management System (PIMS) Addendum

This addendum is automatically applicable for organizations implementing ISO 27701 and optional fororganizations who are implementing ISO 27001 only.

All references to "ISMS" in this document are changed to "IS&PMS"
All references of ISO 27001 in this document are changed to "ISO 27001/27701"
All references to "information security management system" are changed to "information security andprivacy management system"

Strategy is where governance begins.

It’s the anchor point that keeps leadership connected, accountable and assured.

When intent becomes observable, governance becomes proactive.

View the ISMS Policy

Read the Code of Conduct

Lead through complexity — with confidence.

Strateji brings structure, visibility and accountability to modern leadership. Let’s explore how it could work for you.

Book an Enterprise Briefing

Turn complexity into clarity.

Homepage

Strategy

Governance

Accountability

Enterprise

Enablement

Contact

Resources

Terms and Conditions

Home

Strategy

Governance

Accountability

Enterprise

Enablement

Resources

Contact

Policy Owner: Dave YeatesEffective Date: Jan 8, 2025

Information Security Management System (ISMS) Policy

Purpose

Leadership

Leadership and commitment

We ensure:

Alignment of information security objectives with our strategic goals.
Allocation of necessary resources, including funding, tools, and expertise.
Integration of security practices into daily operations and agile workflows.

Information Security Policy

Atlas Platforms's information security policy:

Aligns with our mission to deliver secure and reliable SaaS solutions.
Sets the foundation for measurable security objectives.
Demonstrates compliance with legal, regulatory, and contractual obligations.
Emphasizes continuous improvement.

Transparency and Awareness:

This policy is accessible to all employees and contractors via Confluence.
External parties may access it upon request.
Annual reviews ensure ongoing relevance and effectiveness.

Roles, responsibilities and authorities

Roles and responsibilities for ISMS are based on Atlas Platforms' flat governance structure:

ISMS Governance Council Team: Oversees security governance, compliance, and audits.
Senior Management: Consisting of the organisations Co-Founders, to ensure implementation andadherence to ISMS controls.
All Personnel: Maintain awareness of security requirements and report issues promptly.

Competencies and gaps are assessed through regular reviews and training programs.

Planning

Atlas Platforms prioritizes the identifi cation of risks and opportunities, embedding iterative risk assessmentsinto agile workfl ows.

Risk Assessment:

Regular evaluation of security risks and prioritization of mitigations.
Documented outcomes and updates tracked in all active products (eg. Strateji and Meta Agility).

Risk Treatment:

Selection and implementation of controls to address identified risks.
Documented approvals and reviews integrated into quarterly retrospectives.

Security Objectives:

Protect confidentiality, availability, and integrity of data.
Ensure compliance with applicable laws and contractual obligations.
Achieve and maintain ISO 27001 certification.

Action plans for achieving objectives are reviewed annually and tracked in Strateji

Support

Resources:

Atlas Platforms allocates funding, expertise, and tools to support ISMS operations.

Competence:

Roles impacting information security are evaluated based on training, experience, and education.Competence gaps are addressed through mentoring, external expertise, or training.

Awareness:

Personnel complete annual awareness training and understand their roles and consequences of non-compliance.

Communication:

Internal and external security communications are coordinated and documented.
Policies are stored in Confluence and reviewed after major updates or annually.

Documentation Control:

Processes for creating, updating, and storing ISMS documentation are defined in the 05-ISMS DocumentControl Procedure.

Control of documented information

Processes for creating, updating, and storing ISMS documentation are defined in the 05-ISMS DocumentControl Procedure.

Operation

Atlas Platforms integrates information security into agile workflows:

Operational controls are documented and tracked in Product development tools (eg. Strateji's JiraBoard).
Risks are evaluated during planning cycles, with records maintained for audits.
External dependencies are assessed and managed effectively.

Performance evaluation

Internal audit

Management review

Improvement

Continual Improvement

Atlas Platforms is dedicated to perpetually enhancing the relevance, sufficiency, and efficiency of ourinformation security management system.

Nonconformity and corrective action

In case of any deviation from established standards, Atlas Platforms commits to:

Address the nonconformity, manage its effects, and implement necessary corrections.
Evaluate the root cause, ensuring it doesn't repeat or emerge in other areas
Act upon any required changes and validate the efficacy of those changes.
All measures taken will be proportionate to the severity of the nonconformities identified.

For transparency and due diligence, Atlas Platforms will document:

The specifics of any nonconformity and the corrective measures applied.
The outcomes of those corrective actions. Atlas Platforms has defined an ISMS Corrective Action andContinual Improvement Procedure when non-conformities are identified. Non-conformities may beidentified during internal audits, external audits, management reviews, or ongoing monitoring of theISMS. For further details, please refer to the 09-ISMS Procedure for Corrective Action and ContinualImprovement document.

Policy violation

ISO 27001 coverage

ISO 27001 4.1; 4.2; 4.3; 5.1

Version history

ISO 27001 4.1; 4.2; 4.3; 5.1

Version

1.0

Date

Jan 8, 2025

Description

Version 1.0

Author

Dave Yeates

Approver

Dave Yeates

27701 Privacy Information Management System (PIMS) Addendum

This addendum is automatically applicable for organizations implementing ISO 27701 and optional fororganizations who are implementing ISO 27001 only.

All references to "ISMS" in this document are changed to "IS&PMS"
All references of ISO 27001 in this document are changed to "ISO 27001/27701"
All references to "information security management system" are changed to "information security andprivacy management system"

Strategy is where governance begins.

It’s the anchor point that keeps leadership connected, accountable and assured.

When intent becomes observable, governance becomes proactive.

View the ISMS Policy

Read the Code of Conduct

Lead through complexity — with confidence.

Strateji brings structure, visibility and accountability to modern leadership. Let’s explore how it could work for you.

Book an Enterprise Briefing

Turn complexity into clarity.

Homepage

Strategy

Governance

Accountability

Enterprise

Enablement

Contact

Resources

Terms and Conditions