[Suburb] [STATE] [Postcode]
Earth Intelligence – Generational Impact
Policy Framework & Register
Entity: Next Seven Again Pty Ltd (trading as Nxt7a) Document owner: CEO / Company Secretary Status: Framework v1.0 – Draft for review Classification: Internal
1 · Purpose Of This Document
This is the master index and house style for Nxt7a's operating policies. It exists so that every individual policy looks and behaves consistently, maps cleanly to the standards we are working toward, and has a named owner and review cycle. It is the connective tissue auditors and certifiers will look for first.
We are drafting these policies to support three concurrent goals:
- B Corp certification – demonstrating accountability across Governance, Workers, Community, Environment and Customers.
- ISO/IEC 27001:2022 – an Information Security Management System (ISMS).
- ISO/IEC 42001:2023 – an AI Management System (AIMS).
Important. These are drafts aligned to the above frameworks. Alignment is not the same as certification. Each will need a gap assessment against the relevant standard and, for several policies, review by qualified legal counsel before adoption (flagged per policy). Nxt7a operates under Australian law; statutory references are to Commonwealth and NSW legislation.
2 · House Style – Every Policy Uses This Structure
Each policy document carries the same header block and section skeleton:
Header Block
| Field | Example |
|---|---|
| Policy name | Access Control Policy |
| Owner | Information Security Officer |
| Approver | CEO |
| Version | 1.0 (Draft) |
| Effective date | [on approval] |
| Next review | 12 months from effective date |
| Classification | Internal |
Sections
- Purpose
- Scope
- Policy statements (the substance)
- Roles & responsibilities
- Compliance, monitoring & breach
- Related documents
- Standards mapping
- Version history
Review cadence is annual by default, or on material change (new system, new regulation, incident, restructure).
3 · Ownership Model
With a small team, owners are by role, not headcount. Indicative assignment (confirm):
| Role | Likely holder | Owns |
|---|---|---|
| CEO / Company Secretary | Mike Welling | Governance, conduct, ethics, framework |
| CTO | Ezequiel Muns | Information security, technology, AI lifecycle |
| Information Security Officer | [CTO or delegate] | ISMS / 27001 policies |
| AI Governance Lead | [CTO or delegate] | AIMS / 42001 policies |
| People & Culture | [CEO or delegate] | Workplace & conduct |
| Legal review | [COO or delegate] | Review of statutory policies |
A single person may hold several roles at this stage; the point is that each policy has one accountable owner.
4 · Policy Register & Standards Crosswalk
Status key: ✓ Drafted · ○ Pending draft
Workplace & Conduct
| Policy | B Corp area | 27001 | 42001 | Statutory anchor (AU) | Status |
|---|---|---|---|---|---|
| Employee Handbook | Workers | A.6 (People) | – | Fair Work Act 2009; NES | ✓ |
| Code of Conduct | Governance, Workers | A.6 | A.3 | – | ✓ |
| Work Health & Safety | Workers | – | – | WHS Act 2011 (NSW) | ✓ |
| Diversity, Equity & Inclusion | Workers, Community | A.6 | – | Anti-Discrimination Act 1977 (NSW); Sex Discrimination Act 1984 | ✓ |
| Whistleblower & Grievance | Governance | A.6 | – | Corporations Act 2001 Pt 9.4AAA | ✓ |
Information Security & Technology (ISO/IEC 27001)
| Policy | B Corp area | 27001 | 42001 | Statutory anchor (AU) | Status |
|---|---|---|---|---|---|
| Information Security Policy | Governance | Clause 5; A.5 | – | Privacy Act 1988 | ✓ |
| Acceptable Use & IT | Workers | A.5.10; A.8 | A.9 | – | ✓ |
| Access Control | Customers | A.5.15–5.18; A.8.2–8.5 | – | – | ✓ |
| Data Classification & Retention | Customers | A.5.12–5.13, A.5.33 | A.7 | Privacy Act 1988 | ✓ |
| Incident Response | Customers | A.5.24–5.28 | – | Privacy Act (NDB scheme) | ✓ |
| Business Continuity & DR | Governance | A.5.29–5.30; A.8.13–8.14 | – | – | ✓ |
AI Management (ISO/IEC 42001)
| Policy | B Corp area | 27001 | 42001 | Statutory anchor (AU) | Status |
|---|---|---|---|---|---|
| Responsible AI Policy | Governance, Customers | – | Clause 5; A.2–A.3 | AU AI Ethics Principles | ✓ |
| AI Risk & Impact Assessment | Customers | – | A.5 (impact assessment) | – | ✓ |
| Model & Data Governance | Customers | A.5.12 | A.6 (lifecycle); A.7 (data) | – | ✓ |
| AI Use Guidelines | Workers | A.5.10 | A.9 (responsible use) | – | ✓ |
Ethics, Privacy & Sustainability
| Policy | B Corp area | 27001 | 42001 | Statutory anchor (AU) | Status |
|---|---|---|---|---|---|
| Privacy Policy | Customers | A.5.34 | A.7 | Privacy Act 1988; APPs | ✓ |
| Anti-Bribery & Corruption | Governance | – | – | Criminal Code Act 1995 (Cth) | ✓ |
| Environmental & Sustainability | Environment | – | – | – | ✓ |
| Supplier Code of Conduct | Community | A.5.19–5.21 | A.10 (third parties) | Modern Slavery Act 2018 (Cth) | ✓ |
| Data Sharing & Indigenous Data Sovereignty | Community, Customers | A.5.12 | A.7 | CARE Principles; UNDRIP | ✓ |
ISO control references are indicative and to be confirmed during gap assessment.
5 · Adoption Pathway
- Review and adjust this framework and the house style.
- Complete drafting of all 20 policies (all four categories now drafted at v1.0).
- Legal review of statutory policies (Privacy, Whistleblower, WHS, Anti-Bribery, Supplier Code, Indigenous Data Sovereignty).
- Gap assessment against 27001 and 42001; map policies to specific controls and identify missing procedures.
- Approve, version, publish to Confluence, and assign owners.
- Annual review cycle begins.
v1.0 Draft – pending review.