Policy status: Approved and actively followed. Our ISMS governance, assigned control ownership, risk registers and management-review practices are in operation. Effective April 11, 2026.
Purpose and scope
We define an accountable, risk-based ISMS for Pingplus Media's in-scope communications services and supporting people, systems, suppliers and data.
This policy applies to personnel, contractors, technology and third parties acting for Pingplus Media to the extent of their approved access and applicable agreements. Customer and supplier responsibilities are aligned with our executed contracts and applicable law.
Controls and practices in operation
- The Founder & CEO appoints the ISMS Coordinator and named technical control owners in writing. For high-risk changes, we arrange an additional authorised review where practical, including when roles are combined in a small team.
- We maintain a documented ISMS scope and inventory of in-scope services, processing locations, information assets, outsourced activities, interfaces and exclusions. We reconcile the scope with the issued ISO/IEC 27001 certificate and applicable Statement of Applicability (SoA), while distinguishing certified scope from any additional services.
- We approve information-security objectives annually and measure at least: overdue high risks, joiner/leaver timeliness, overdue patches, completed access reviews, backup job failures, reported incidents and supplier reviews.
- We hold ISMS management reviews at least every six months and following material incidents or business changes. Our review records include participants, decisions, actions, risk acceptance, accountable owners and target dates.
- We maintain an applicable-laws/contractual-obligations register, controlled policy register, SoA linkage, internal assessment schedule and corrective-action tracker.
- We conduct an internal ISMS review or audit at least annually, using an independent reviewer wherever practical, and retain findings, action tracking and follow-up evidence.
- Our approved ISMS and employee policies are communicated to staff and relevant contractors, acknowledgements are retained, and confidential governance records are restricted to authorised personnel.
Review and responsibility
Every six months management review; annual policy/objective/internal review; immediate review after material change.
Accountability and reporting
Our personnel, contractors and in-scope service partners follow this policy, with established channels for prompt reporting of suspected security issues. Exceptions are recorded, reviewed and approved by an authorised policy owner. Applicable customer contracts and legal duties continue to govern the services provided.