E-CRIME BUREAU (“we”, “us”, or “the Bureau”) takes the security of information seriously. We are committed to protecting the confidentiality, integrity, and availability of all information entrusted to us — by our clients, partners, and employees.
1. Purpose and scope
This Policy forms the foundation of our Information Security Management System (ISMS), which has been developed in alignment with ISO/IEC 27001.
This policy applies to all information assets owned or processed by the Bureau including employee and client data, business records, intellectual property, and supporting infrastructure. It covers all employees, contractors, third-party service providers and stakeholders who handle information, across all locations and systems.
2. Three core pillars
We manage information security across three core pillars:
- Confidentiality: We ensure information is only accessible to those who are authorised.
- Integrity: We protect information from unauthorised modification or corruption.
- Availability: We ensure information and systems are available when needed.
3. Our obligations
This policy supports our obligation to:
- Safeguard Information Assets: We achieve this through the implementation of relevant controls to protect data against unauthorised access, disclosure, alteration, and destruction.
- Ensure Legal and Regulatory Compliance: The Bureau complies with all applicable laws such as Data Protection Act, 2012 (Act 843), Cyber Security Act 2020 (Act 1038), Electronic Transaction Act 2008 (Act 772) and applicable international regulations, contractual obligations and agreements related to information security and data protection.
- Manage Security Risks: We proactively identify, assess, and mitigate risks that could lead to information security incidents or data breaches.
- Maintain Business Continuity: We maintain tested Business Continuity and Disaster Recovery Plans to ensure the continued availability of critical systems and data in the event of disruption.
- Enhance Security Posture: We continuously monitor, review, and improve our information security practices to adapt to evolving threats and best practices.
4. Personal information
We handle all client and stakeholder information responsibly. Personal data is processed in accordance with our Privacy Notice and applicable data protection legislation.