Information Security Policy

1. Introduction

1.1 Purpose

This Information Security Policy (“Policy”) outlines the principles, guidelines, and responsibilities for protecting The Lightbulb.ai’s information assets.

1.2 Scope

This Policy applies to all employees, contractors, consultants, and third-party users who have access to The Lightbulb.ai’s information resources.

1.3 Policy Ownership

The Chief Information Security Officer (CISO) or equivalent role is responsible for the development, implementation, and maintenance of this Policy.

2. Policy Statement

The Lightbulb.ai is committed to the protection, confidentiality, integrity, and availability of its information assets. It is our policy to:

• 2.1 Protect information assets from unauthorized access, disclosure, alteration, and destruction.
• 2.2 Comply with all applicable laws, regulations, and industry standards related to information security.
• 2.3 Assess and manage information security risks to a level acceptable to the organization.
• 2.4 Provide information security awareness and training programs for employees and contractors.
• 2.5 Establish an incident response plan to address security incidents promptly and effectively.

3. Definitions

Definitions for key terms and concepts used in this Policy should be provided here.

4. Roles and Responsibilities

• 4.1 Senior Management: Sets strategic direction and ensures resource allocation.
• 4.2 Information Security Team: Implements and monitors security controls and incident response.
• 4.3 Employees and Contractors: Must comply with the Policy and report incidents.

5. Information Classification and Handling

• 5.1 Information Classification: Classify assets (confidential, internal, public) and apply appropriate controls.
• 5.2 Data Handling and Protection: Align handling, storing, transmitting, and disposal with classification.

6. Access Control

• 6.1 User Access: Access based on the principle of least privilege.
• 6.2 Authentication: Use strong authentication methods.
• 6.3 Authorization: Authorize access based on roles and responsibilities.

7. Data Protection

• 7.1 Encryption: Encrypt sensitive data during transmission and storage.
• 7.2 Data Backup: Maintain regular backups.
• 7.3 Data Retention: Retain data as per legal/regulatory requirements.

8. Security Awareness and Training

• 8.1 Training: Initial and ongoing security training for employees and contractors.
• 8.2 Awareness: Promote awareness through various communication channels.

9. Acceptable Use of Resources

• 9.1 Use of Equipment: Use Lightbulb.ai resources for legitimate business purposes only.
• 9.2 Internet and Email Use: Follow appropriate usage guidelines.

10. Incident Response and Reporting

• 10.1 Incident Reporting: Report suspected or actual security incidents promptly.
• 10.2 Incident Response Plan: Maintain and test a response plan regularly.

11. Physical Security

Follow procedures for safeguarding access to facilities, servers, and infrastructure.

12. Remote and Mobile Device Security

Follow guidelines for securing devices that access Lightbulb.ai information remotely.

13. Third-Party Security

Ensure third-party vendors meet Lightbulb.ai’s security requirements in contracts.

14. Risk Assessment and Management

Regularly assess and manage information security risks.

15. Compliance and Legal Requirements

Comply with relevant laws, regulations, and industry standards for information security.

16. Monitoring and Auditing

Monitor and audit security measures to ensure effectiveness.

17. Document Control

Follow procedures for creating, maintaining, and updating documentation.

18. Policy Review and Revision

Review and update this Policy periodically based on changes in technology or regulations.

19. Enforcement and Consequences

Non-compliance may result in disciplinary action up to and including termination.

20. Acknowledgment

All employees and contractors must acknowledge understanding and compliance.

21. References

Include references to relevant standards, guidelines, and best practices.