1 Purpose 

The purpose of information processing and information security in Step Solutions AS is to support the organisation’s tasks and services so that we can achieve our goals and realise our vision, and so that we can help our customers reach theirs. Step Solutions’ goals and priorities are set out in the overall strategy and business plan; information security is a critical enabler of that strategy. 

Information processing that is goal-oriented, efficient, legal and reliable is fundamental to Step Solutions’ success as a partner to our customers. Adequate and balanced information security supports this and is the subject of this Policy. 

2 Scope 

This policy applies to all information processing activity in Step Solutions AS, and to information processed on behalf of our customers under our operational responsibility. It covers all processing, storage and communication of information — orally, on paper and digitally — and all use of IT tools. It is binding on all employees and contractors. 

3 References 

• ISO/IEC 27001:2022 – Information Security Management System 

• GDPR (Regulation (EU) 2016/679) 

• Digital Security Act (Norwegian implementation of NIS2) 

• Step Solutions AS – ISMS Organization & Governance 

• Step Solutions AS – Information Labeling Procedure 

• Step Solutions AS – Statement of Applicability 

• Step Solutions AS – Risk Assessment methodology (Wrike) 

4 Roles and responsibilities 

All ISMS roles, responsibilities, authorities, committee composition and meeting cadences are defined in the ISMS Organization & Governance document, which is the single source of truth on these matters. This Policy summarises the high-level intent only; refer to the Governance document for the full description of any role. 

 Top management — the CEO and Board — are ultimately accountable for this Policy and for Step Solutions’ information security measures, efforts and investments. Operational responsibility for the Information Security Management System (ISMS) is delegated to the Chief Information Security Officer (CISO). 

Oversight of the ISMS is exercised by the ISMS Steering Committee. The Steering Committee’s composition, dual role (operational steering and the formal Management Review forum under ISO 27001 Clause 9.3), meeting cadence, quorum and decision rules are defined in the Governance document. 

All employees and contractors are responsible for reading, understanding and following this Policy and the supporting procedures issued under it. 

5 Objectives for information security 

Information processing must be lawful, agreement-compliant, and contribute in a purpose- and cost-effective manner to the realisation of Step Solutions’ and our customers’ goals. The ISMS pursues the three classical security objectives: 

5.1 Confidentiality 

Information shall not be disclosed to unauthorised persons and shall be available only to those who have a legitimate need for it. 

5.2 Integrity 

Information shall be protected from unauthorised modification or deletion. It must remain correct, valid and complete. 

5.3 Availability 

Information shall be available to authorised users when they need it, in line with documented service-level commitments. 

6 Strategy for information security 

The information security strategy supports the business purpose of Step Solutions AS. Risk-based prioritisation, defence in depth, secure-by-design engineering, and continual improvement are the guiding principles. The strategy is set by top management and operationalised through the ISMS. 

7 Organisation 

Responsibility and authority for information security follow the ordinary line of responsibility in Step Solutions: managers responsible for work tasks and services are also responsible for information security in their area. Necessary joint functions, support functions and co-operation groups are established with clear roles and responsibilities (defined in the Governance document) to support managers. 

System owners for shared systems safeguard the interests of those who use the systems in their daily activities and involve them appropriately in system management and information-security work. Security is an integral part of internal control. 

8 Requirements for internal control 

• Information security work is embedded in an internal control framework based on recognised standards in the information-security domain (ISO/IEC 27001:2022). 

• Work follows applicable laws, regulations and contractual agreements. 

• Step Solutions AS systematically assesses the need for, and carries out, risk assessments. Risk reduction measures are based on risk, materiality, cost-benefit, and management guidelines. 

• Incidents that may adversely affect information security objectives are reported and followed up systematically, in accordance with the Incident Response Policy and Procedure. 

• Leaders at all levels systematically manage, control and follow up information security in their own units. 

• Information security efforts are evaluated systematically and in detail, and are an input to Management Review. 

9 Requirements for employees 

All employees and contractors must: 

• Maintain a conscious relationship to the goals of their own work, the information they process, and the requirements that apply to that processing. 

• Comply with applicable laws, regulations, guidelines, requirements, procedures and routines. 

• Complete assigned awareness and role-specific training. 

• Report suspected security events through the defined channels without delay. 

Strategies are implemented through management-led security choices. The Disciplinary Procedure governs the consequences of policy violations. 

10 Security principles 

10.1 Information classification 

Information and systems are classified to determine handling, access and protection requirements. The authoritative classification scheme is defined in the Information Labeling Procedure. 

10.2 Technical measures 

Technical measures implemented to achieve the information security objectives include: 

• Measures that prevent employees from negligently or intentionally damaging information systems or stored information. 

• Measures that ensure access for authorised users while preventing unauthorised access. 

• Security logging that allows detection of security events and breaches. 

• Anti-malware controls preventing malicious software from entering the information environment. 

• Regular backup of information and system configurations. 

• Recovery commitments aligned with documented RTO/RPO targets in the Business Continuity & ICT Resilience Policy. 

Further measures (cloud security, cryptography, secure development, secure information transfer) are documented in dedicated guidelines, standards and procedures. 

10.3 Organisational measures 

Organisational measures supporting the security objectives include: 

• Routines for handling access to information systems (passwords, rights, applications). 

• Routines for handling portable and storage devices. 

• Routines for physical security of premises and equipment, including handling of guests and out-of-hours access. 

• Procedures for protecting components, documents and information that are vital to business resilience. 

Further measures are available in the supporting guidelines, including the on/offboarding guide, guidelines for PC and mobile devices, and personnel-security documentation. 

11 Continual improvement 

Step Solutions shall continually improve the suitability and the effectiveness of the Information Security Managements System. The improvement is driven by: 

• Corrective actions of non-conformities and incidents. 

• Internal and external audit findings and reviews. 

• Systematically assess the risk situation and risk reduction based on these assessments. 

• Feedback from employees, customers and interested parties.