Information Security Policy

1 · Purpose

This is the top-level policy of Nxt7a's Information Security Management System (ISMS). It states management's commitment to protecting the confidentiality, integrity and availability of information, and sets the framework under which all other security policies operate.

2 · Scope

Applies to all information assets owned or handled by Next Seven Again Pty Ltd – including client, partner, Indigenous community and platform data – and to everyone who accesses them: employees, contractors and third parties, on any device or system, anywhere they work.

3 · Policy Statements

Commitment. Nxt7a is committed to establishing, operating and continually improving an ISMS aligned to ISO/IEC 27001:2022. Leadership provides the resources and direction to make this real, not nominal.

Objectives. We protect information so that: it is available to those who need it (availability); it is disclosed only to those authorised (confidentiality); and it is accurate and complete (integrity). For a platform whose value rests on trusted environmental data, integrity is paramount.

Risk-based approach. Security controls are selected and prioritised based on assessed risk to information assets, reviewed regularly and after material change.

Supporting policies. This policy is implemented through the Acceptable Use & IT, Access Control, Data Classification & Retention, Incident Response, and Business Continuity & DR policies, and the AI and privacy policies.

Legal and contractual. We meet our legal, regulatory and contractual security obligations – including Australian privacy law as a baseline and the laws of jurisdictions where we and our clients operate – and the security commitments in our client and partner agreements.

Continual improvement. Security performance is monitored; incidents, audits and reviews feed corrective action and improvement.

4 · Roles & Responsibilities

• CEO owns security accountability at leadership level and approves this policy.
• Information Security Officer ([CTO or delegate]) operates the ISMS, maintains policies, and reports on security posture.
• All personnel comply with security policies and report incidents and weaknesses promptly.
• Third parties meet equivalent obligations through contract (see Supplier Code of Conduct).

5 · Compliance, Monitoring & Breach

Compliance is monitored through reviews, audits and incident metrics. Breaches are handled under the Incident Response Policy and may result in disciplinary action under the Code of Conduct, and notification to affected parties or regulators where required.

6 · Related Documents

Acceptable Use & IT Policy · Access Control Policy · Data Classification & Retention Policy · Incident Response Policy · Business Continuity & DR Policy · Privacy Policy · Responsible AI Policy.

7 · Standards Mapping

• B Corp: Governance.
• ISO/IEC 27001:2022: Clause 5 (Leadership & policy); Annex A.5 (Organisational controls).
• Statutory: Privacy Act 1988 (Cth) as baseline; applicable laws where we operate.

Review note. This policy underpins certification. Confirm scope statement and control selection during the ISMS gap assessment.

8 · Version History