Policy 01  MASTER

Information Security Policy
PCI DSS Req 12.1  ·  the rule Revique must follow
← Docs homePoliciesProceduresPCI DSS reportsHIPAAQ&A
← All 21 policies
This page is the rule, not the implementation. It states what Revique must do, at or above the PCI DSS minimum. How Revique actually does it today — the real AWS configuration, the current values, and where an auditor logs in to verify them — is in Procedure 01. Values shown as [X] are placeholders still to be set.

Purpose

This is Revique's master governing policy. It establishes management's commitment to protecting the confidentiality, integrity, and availability of cardholder data (CHD), protected health information (PHI), and all information assets, and it authorizes every subordinate policy in this register.

Scope

Applies to all Revique personnel, contractors, systems, applications, and third parties that store, process, or transmit CHD/PHI, across the dev, UAT, and production environments.

Policy statements

Each statement below is mandatory. The bolded must marks the obligation.

1Revique must maintain a documented information security program approved by executive management and reviewed at least annually, or upon any significant change.
2Revique must assign overall responsibility for information security to a designated Security Officer.
3All personnel must acknowledge and comply with this policy and its subordinate policies.
4Every subordinate policy in this register must map to one or more PCI DSS requirements and be enforced.
5Security roles and responsibilities must be formally defined and communicated to all affected personnel.

Roles & responsibilities

RoleResponsibility
Executive ManagementApprove the security program, allocate resources, and review annually.
Security OfficerOwn, maintain, and enforce the information security program and all policies.
All PersonnelRead, acknowledge, and comply with all applicable policies.

Enforcement

This policy is issued under the authority of Policy 01 — Information Security Policy and is mandatory for everyone in scope. Compliance is verified through the controls and evidence described in the linked procedure. Failure to comply may result in withdrawal of access and disciplinary action. This policy is reviewed at least annually, or sooner on significant change.

⚙️See the Procedure for this policyHow Revique implements this rule today, the current values, the gaps, and the auditor verification path→
Revique security documentation  ·  generated 2026-08-13  ·  all identifiers masked  ·  AWS facts collected read-only on 2026-08-13
Policies define the rule; procedures describe the implementation and how to verify it.