Information is a critical asset for every institution, supporting the delivery of public and private services, decision-making, and day-to-day operations. As reliance on digital technologies increases, information security threats are evolving just as quickly, putting institutional information, systems, and services at risk. Protecting information is no longer optional. It is a fundamental requirement.

To address this, the NCSA has developed an Information Security Policy template to serve as a practical reference for organizations’ top management to formally express their intention, governance and direction to ensure the confidentiality, integrity and availability of information assets.

This policy is intended for use by public and private institutions operating in Rwanda. It provides a foundation that institutions can adapt and customize to contain directives, rules and practices that prescribe how an organization manages, protects and distributes information. It establishes the responsibilities of all personnel and external parties regarding the protection of information assets.

By implementing this policy, institutions can clearly understand their information security responsibilities, reduce preventable risks, protect critical information, and contribute to building secure, reliable, and resilient institutions that protect both organizational assets and the people they serve.